joyce8/EMBER2024-capa huggingface dataset:
Function at 0x553c70
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x6689bc]
sub esp, 0x190
test eax, eax
je 0x553c8b
mov eax, 1
add esp, 0x190
ret
push edi
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
pop edi
je 0x553cc0
xor eax, eax
add esp, 0x190
ret
mov eax, 1
mov dword [0x6689bc], eax
add esp, 0x190
ret

Function at 0x556560
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5e9f13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6457a8]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x6457a8]
mov dword [esp + 0x14], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x6457a8]
mov dword [esi + 0x20], edx
mov eax, dword [0x6457a8]
mov dword [esi + 0x24], eax
mov ecx, dword [0x6457a8]
mov dword [esi + 0x28], ecx
mov edx, dword [0x6457a8]
mov dword [esi + 0x2c], edx
mov eax, dword [0x6457a8]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 6
call fcn.005c6a91
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 7
call fcn.005c6a91
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x14], 8
push ecx
mov ecx, edi
mov dword [esi], 0x5fd2b4
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0x10
mov dword [esi + 0x10], 2
mov dword [esi + 0x14], 1
call fcn.005c87f0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x5567f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ea063
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6457a8]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x6457a8]
mov dword [esp + 0x1c], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x6457a8]
mov dword [esi + 0x20], edx
mov eax, dword [0x6457a8]
lea ebp, [esi + 0x24]
mov dword [ebp], eax
mov ecx, dword [0x6457a8]
lea ebx, [esi + 0x28]
mov dword [ebx], ecx
mov edx, dword [0x6457a8]
mov dword [esi + 0x2c], edx
mov eax, dword [0x6457a8]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 6
call fcn.005c6a91
lea ecx, [esi + 0x48]
mov byte [esp + 0x1c], 7
call fcn.005c6a91
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esi + 0xc], ecx
push eax
mov ecx, edi
mov byte [esp + 0x20], 8
mov dword [esi], 0x5fd2b4
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 1
call fcn.005c87f0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5568bf
push eax
mov ecx, ebx
call fcn.005c87f0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x5568cf
push eax
mov ecx, ebp
call fcn.005c87f0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x558250
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.004780b0
test eax, eax
je 0x55826e
mov dword [0x6689c8], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x558289
mov dword [0x6689c8], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push esi
push 2
push edi
push edi
mov dword [0x6689c8], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x5582b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
je 0x5582da
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x558318
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x55834f
jne 0x558318
test esi, esi
jne 0x5582fe
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x5582fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x558318
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x558318
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebp, eax
test ebp, ebp
jne 0x55836f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x6689c8], eax
jne 0x558358
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x55836f
mov eax, dword [0x6689c8]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x55836f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x55836a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x6689c8], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x55837c
push edi
call ebx
test esi, esi
je 0x558383
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x558590
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
call fcn.004780b0
test eax, eax
je 0x5585ac
mov dword [0x6689c8], 0x32
xor eax, eax
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
push 1
rep stosd dword es:[edi], eax
push ebp
push ebp
mov dword [0x6689c8], ebp
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebp
jne 0x5585eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, ebp
mov ebp, dword [esp + 0x34]
je 0x558609
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x558643
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x55865f
jne 0x558643
test esi, esi
jne 0x55862d
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x55862d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x558643
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x558643
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebp, eax
test ebp, ebp
jne 0x55867c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x558663
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x55866f
mov dword [0x6689c8], ebx
jmp 0x558686
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x6689c8], eax
jmp 0x558686
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x558693
push edi
call ebx
test esi, esi
je 0x55869a
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x558f60
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x5ea28b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push esi
push edi
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.005c6a91
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x634], esi
test eax, eax
je 0x558fa4
push eax
lea ecx, [esp + 0x14]
call fcn.005c6c6d
mov eax, dword [esp + 0x660]
test eax, eax
je 0x558fb9
push eax
lea ecx, [esp + 0x14]
call fcn.005c6c6d
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x22d]
mov byte [esp + 0x22c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x400
test eax, eax
jle 0x559038
lea eax, [esp + 8]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00496420
add esp, 0x10
test eax, eax
jne 0x559031
lea ecx, [esp + 0x10]
mov dword [esp + 0x634], 0xffffffff
call fcn.005c6ac4
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x624]
mov dword fs:[0], ecx
add esp, 0x630
ret
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0x64c]
mov ecx, dword [esp + 0x668]
mov edx, dword [esp + 0x664]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
mov edx, dword [esp + 0x65c]
push esi
mov esi, dword [esp + 0x654]
push 0
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebp, eax
test ebp, ebp
je 0x5590f1
mov ebx, dword [esp + 0x658]
test ebx, ebx
je 0x5590f1
test esi, esi
je 0x5590f1
call fcn.0043cf30
mov eax, dword [0x6655c8]
test eax, eax
je 0x5590f1
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x30]
push 0x104
push edx
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.00493a40
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x2c]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x6655c8]
lea ecx, [esp + 0x18]
mov dword [esp + 0x63c], 0xffffffff
call fcn.005c6ac4
mov ecx, dword [esp + 0x634]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x630
ret
Function at 0x559940
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x55995d
cmp edi, 4
jbe 0x55995d
mov dword [0x6689cc], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x55997c
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.0046ad60
cmp edi, 0xffffffff
je 0x559990
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.0046ad60
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x5599a8
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.0046ad60
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5599be
push eax
mov eax, dword [0x659820]
push eax
mov ecx, esi
call fcn.0046af10
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5599d5
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.0046af10
mov edx, dword [esp + 0x28]
test edx, edx
je 0x5599fb
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [str.ImagePath]
push 2
push eax
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x559a11
push eax
mov eax, dword [str.Group]
push eax
mov ecx, esi
call fcn.0046af10
mov eax, dword [esp + 0x30]
test eax, eax
je 0x559a28
mov ecx, dword [str.DependOnGroup]
push eax
push ecx
mov ecx, esi
call fcn.0046b3a0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x559a3f
mov edx, dword [str.DependOnService]
push eax
push edx
mov ecx, esi
call fcn.0046b3a0
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x55a9e0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ea4d0
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x55aa13
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp byte [esi], 0
jne 0x55aa2a
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.00469b00
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.00469c20
test eax, eax
je 0x55aad6
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.0046c120
test eax, eax
jne 0x55aa8b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00469ba0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x55aabe
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.0046a250
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.005c87a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.005c8667
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x55ab9d
mov dword [eax], 0x10
jmp 0x55ab9d
mov edx, dword [0x6457a8]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x628274
push ecx
mov byte [esp + 0x24], 2
call fcn.005c5f2f
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00469c20
test eax, eax
jne 0x55ab4a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.005c8667
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00469ba0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x55ab81
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.0046a250
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.005c87a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.005c8667
mov eax, dword [esp + 0x20]
test eax, eax
je 0x55ab8f
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.005c8667
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00469ba0
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x55abd0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ea4f8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x55acdf
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x55acdf
cmp byte [edi], bl
je 0x55acdf
cmp byte [esi], bl
je 0x55acdf
lea ecx, [esp + 0xc]
call fcn.00469b00
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x55ac7d
cmp eax, 1
je 0x55ac7d
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.00469c20
test eax, eax
jne 0x55ac6b
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.00469c90
test eax, eax
je 0x55acce
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0046af10
mov esi, eax
jmp 0x55ad62
mov edx, dword [0x6457a8]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x628274
push ecx
mov byte [esp + 0x2c], 1
call fcn.005c5f2f
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00469c20
test eax, eax
jne 0x55acf3
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.005c8667
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00469ba0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x6457a8]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.0044148e
add esp, 8
cmp eax, ebx
je 0x55ad1b
inc eax
lea ecx, [esp + 0x2c]
push eax
call fcn.005c87f0
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x55ad34
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.005c8667
jmp 0x55acc1
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0046af10
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.005c8667
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.005c8667
lea ecx, [esp + 0xc]
call fcn.00469c70
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00469ba0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x55c670
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5ea8fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6457a8]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [edi], eax
mov ecx, dword [0x6457a8]
lea ebp, [esi + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [ebp], ecx
mov edx, dword [0x6457a8]
mov dword [esi + 0x20], edx
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.005c7a20
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 3
mov dword [esi], 0x5fd2b8
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x24], 0xffff
call fcn.005c87f0
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x30]
test eax, 0xffff0000
mov word [esi + 0x24], cx
mov dword [esi + 0x14], eax
je 0x55c713
push eax
mov ecx, ebp
call fcn.005c87f0
mov edx, dword [ebp]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x2c]
test eax, 0xffff0000
mov dword [esi + 0x1c], eax
je 0x55c731
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.005c87f0
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x560190
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fd308
push 0x442c84
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x560222
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x56021b
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x56021b
cmp word [eax + 0x14], dx
je 0x56021b
cmp dword [ebp + 0xc], edx
je 0x5601f5
cmp word [eax + 4], 0x14c
jne 0x56021b
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x560310
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x56035d
mov edi, dword [esp + 0x18]
test edi, edi
je 0x56035d
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x56035d
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x560355
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x560364
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x560346
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x560c30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fd318
push 0x442c84
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005603b0
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x560ce3
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x560cdc
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x563cc0
Capabilities:
Get file size

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
mov dword [esp + 0x30], 0
call fcn.005622a0
add esp, 0x2c
test eax, eax
je 0x563da8
mov eax, dword [esp + 4]
cmp eax, 4
jne 0x563d34
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.0057c1a0
mov edx, dword [0x669268]
mov ecx, dword [0x66926c]
add esp, 8
mov dword [0x668a28], edx
mov edx, dword [0x669270]
mov dword [0x668a2c], ecx
mov dword [0x668a30], edx
pop esi
pop ecx
ret
cmp eax, 3
jne 0x563d6e
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.0056e520
mov ecx, dword [0x668ad8]
mov edx, dword [0x668adc]
add esp, 8
mov dword [0x668a28], ecx
mov ecx, dword [0x668ae0]
mov dword [0x668a2c], edx
mov dword [0x668a30], ecx
pop esi
pop ecx
ret
mov edx, dword [esp + 0x10]
cmp eax, 6
push edx
push esi
jne 0x563dae
call fcn.0058d0e0
mov ecx, dword [0x669880]
mov edx, dword [0x669884]
add esp, 8
mov dword [0x668a28], ecx
mov ecx, dword [0x669888]
mov dword [0x668a2c], edx
mov dword [0x668a30], ecx
pop esi
pop ecx
ret
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
pop ecx
ret
Function at 0x566d10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
xor esi, esi
cmp ebx, esi
je 0x566e68
cmp ebx, 0xffffffff
je 0x566e68
cmp dword [0x668a38], esi
je 0x566e68
mov ecx, dword [0x668a40]
cmp ecx, esi
je 0x566e68
mov eax, dword [0x668a3c]
cmp eax, esi
jge 0x566d59
neg eax
cmp ecx, eax
ja 0x566e68
push edi
push ecx
mov dword [esp + 0x10], esi
call fcn.005c8d38
mov edi, eax
add esp, 4
cmp edi, esi
mov dword [esp + 0x20], edi
je 0x566e5d
mov ecx, dword [0x668a40]
xor eax, eax
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 1
and ecx, 3
mov dword [esp + 0x1c], esi
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [0x668a40]
mov esi, dword [0x668a3c]
lea eax, [esp + 0x18]
push eax
push 0
push ebx
mov dword [esp + 0x24], 0
call edi
xor ecx, ecx
mov dword [esp + 0x1c], eax
test esi, esi
setl cl
dec ecx
and ecx, 0xfffffffe
add ecx, 2
push ecx
push 0
push esi
push ebx
call edi
cmp eax, 0xffffffff
je 0x566e4f
mov eax, dword [esp + 0x28]
test eax, eax
je 0x566de0
xor esi, esi
jmp 0x566df6
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x18]
push 0
push edx
push ebp
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push ebx
call edi
test esi, esi
je 0x566e4f
mov ebp, dword [0x6689e0]
xor edx, edx
test ebp, ebp
jle 0x566e4f
mov ebx, dword [0x6689dc]
mov eax, dword [ebx]
mov esi, dword [esp + 0x18]
mov ecx, dword [eax + 8]
cmp esi, ecx
jb 0x566e35
mov edi, dword [eax + 4]
mov esi, dword [esp + 0x24]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x566e47
inc edx
add ebx, 4
cmp edx, ebp
mov dword [esp + 0x10], 0
jge 0x566e4f
jmp 0x566e1b
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x24]
push ecx
call fcn.005c8d61
add esp, 4
pop ebp
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret