joyce8/EMBER2024-capa huggingface dataset:
Function at 0x528e80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, 0x5a4d
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
cmp word [edi], ax
jne 0x529070
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x529070
cmp eax, 0x7fffffff
jae 0x529070
add eax, edi
mov dword [esp + 0x14], eax
cmp dword [eax], 0x4550
jne 0x529070
lea edx, [eax + 0x78]
mov eax, dword [edx]
test eax, eax
je 0x529070
cmp dword [edx + 4], 0
je 0x529070
push dword [ebp + 8]
add eax, edi
push esi
push eax
call fcn.005291c0
cmp dword [0x62db64], 0x64
mov ebx, eax
jb 0x529065
call fcn.00520340
nop dword [eax]
test eax, eax
je 0x529065
call fcn.00520340
mov esi, eax
mov ecx, eax
call dword [0x5a9914]
call esi
nop dword [eax]
test al, al
je 0x529065
mov edx, dword ds:[esp + 0x14]
lea eax, [esp + 0x18]
push ecx
push eax
lea eax, [esp + 0x18]
mov ecx, edi
push eax
push 0xa
call fcn.005290e0
test eax, eax
js 0x529065
mov edx, dword ds:[esp + 0x18]
mov ecx, dword [edx]
lea eax, [edx + 0x5c]
add ecx, edx
cmp eax, ecx
ja 0x529065
mov eax, dword [edx + 0x58]
shr eax, 0xe
test al, 1
je 0x529065
cmp byte [0x63402b], 0
nop dword [eax]
jne 0x529013
push dword [0x633a4c]
mov byte [0x63402b], 1
push 0x28
call sym.SystemInformer.exe_Ordinal_1240
mov esi, dword [0x633a74]
mov edi, eax
push 0x40
push 4
push esi
mov dword [edi], 8
mov dword [edi + 4], 0x502ec0
mov dword [edi + 8], 0x502ee0
mov dword [edi + 0xc], 0x10
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [edi + 0xc]
shl ecx, 2
push ecx
push 0xff
push eax
mov dword [edi + 0x10], eax
call fcn.005861b0
mov eax, dword [edi + 0xc]
add esp, 0xc
mov dword [edi + 0x14], eax
shl eax, 4
push eax
push 4
push esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0xffffffff
mov dword [edi + 0x24], 0
mov dword [0x635a94], edi
jmp 0x529019
mov edi, dword [0x635a94]
test edi, edi
je 0x529065
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push edi
call sym.SystemInformer.exe_Ordinal_1365
lea ecx, [eax + 4]
neg eax
sbb eax, eax
test ecx, eax
jne 0x529065
mov edx, ebx
lfence
call fcn.0051e460
test eax, eax
js 0x529065
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push dword [0x635a94]
mov dword [esp + 0x24], 1
call sym.SystemInformer.exe_Ordinal_1269
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x529840
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x14], edx
mov eax, 0x5a4d
cmp word [ebp], ax
je 0x529864
mov eax, 0xc000012f
lfence
pop ebp
add esp, 0x14
ret 0xc
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x5299d9
cmp eax, 0x7fffffff
jae 0x5299d9
cmp dword [eax + ebp], 0x4550
jne 0x5299d9
mov ecx, dword [eax + ebp + 0x80]
test ecx, ecx
je 0x5299ca
cmp dword ds:[eax + ebp + 0x84], 0
je 0x5299ca
push ebx
lea ebx, [ebp + 0xc]
mov edx, 0xc0000001
add ebx, ecx
mov dword [esp + 8], edx
cmp dword [ebx], 0
je 0x5299c0
push esi
push edi
mov ecx, dword [ebx - 0xc]
test ecx, ecx
je 0x5299ba
mov eax, dword ds:[ebx]
lea edi, [ecx + ebp]
push dword [esp + 0x20]
mov esi, dword [ebx + 4]
add eax, ebp
push eax
add esi, ebp
call fcn.0058e8a5
add esp, 8
test eax, eax
jne 0x52999e
mov eax, dword [edi]
test eax, eax
je 0x52999e
mov dword [esp + 0x18], 4
sub edi, esi
mov dword [esp + 0x14], 0
mov ecx, eax
nop
mov dword [esp + 0x1c], esi
test eax, eax
js 0x52994b
mov eax, dword [esp + 0x28]
add ecx, 2
add ecx, ebp
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x529942
test dl, dl
je 0x52993d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x529942
add ecx, 2
add eax, 2
test dl, dl
jne 0x529921
xor eax, eax
jmp 0x529947
sbb eax, eax
or eax, 1
test eax, eax
je 0x52995a
mov eax, dword [edi + esi + 4]
add esi, 4
mov ecx, eax
test eax, eax
jne 0x529910
jmp 0x52999e
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
js 0x5299a2
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov edx, dword [esp + 0x10]
add ebx, 0x14
cmp dword [ebx], 0
jne 0x5298c0
pop edi
pop esi
pop ebx
mov eax, edx
pop ebp
add esp, 0x14
ret 0xc
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov eax, edx
pop ebp
add esp, 0x14
ret 0xc
mov eax, 0xc0000020
lfence
pop ebp
add esp, 0x14
ret 0xc
mov eax, 0xc000007b
lfence
pop ebp
add esp, 0x14
ret 0xc
Function at 0x52d1e0
Capabilities:
Map section object

Disassembly:
sub esp, 8
push esi
push 2
push 0
push 2
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0xffffffffffffffff
push ecx
mov esi, edx
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x52d221
lfence
pop esi
add esp, 8
ret
push esi
push dword [esp + 8]
push 0xffffffffffffffff
call sym.SystemInformer.exe_Ordinal_1535
push dword [esp + 4]
mov esi, eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x52fb80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push str.DeviceNamedPipe_
mov dword [esp + 0x18], 0
mov dword [esp + 0x68], 0xc
mov dword [esp + 0x6c], 0
mov word [esp + 0x70], 0
call sym.SystemInformer.exe_Ordinal_1303
mov edi, eax
lea eax, [esp + 0x18]
movzx ecx, word [edi]
mov word [esp + 0x18], cx
movzx ecx, word [edi]
add cx, 2
mov word [esp + 0x1a], cx
mov ecx, dword [edi + 4]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x40
mov dword [esp + 0x3c], 0
call dword [sym.imp.ntdll.dll_RtlDefaultNpAcl]
nop
test eax, eax
js 0x52fc4e
push 1
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
push 0
push dword [esp + 0x14]
lea eax, [esp + 0x4c]
push 1
push eax
call dword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
lea eax, [esp + 0x44]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xff676980
push eax
push 0x1000
push 0x1000
push 0xffffffffffffffff
push 0
push 1
push 3
push 0x22
push 3
push 3
lea eax, [esp + 0x80]
mov dword [esp + 0x4c], 0xffffffff
push eax
lea eax, [esp + 0x54]
push eax
push 0x12019f
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.ntdll.dll_NtCreateNamedPipeFile]
mov esi, eax
test esi, esi
js 0x52fca4
mov ecx, dword [esp + 0x14]
mov dword [ebx], ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x52fcc6
push eax
mov eax, dword fs:[0x18]
push 0
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x52fcd9
call fcn.004fe0c0
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
Function at 0x5304c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, edx
push edi
push dword [0x633a40]
mov edi, ecx
mov dword [esp + 0x1c], esi
lea eax, [esi*4]
mov dword [esp + 0x20], edi
push eax
call sym.SystemInformer.exe_Ordinal_1240
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov ebx, eax
xor ebp, ebp
mov dword [esp + 0x14], ebx
test esi, esi
je 0x53063a
mov ecx, dword [esp + 0x24]
lea eax, [ecx*4]
mov dword [esp + 0x10], eax
nop dword [eax + eax]
push dword [0x633a40]
push eax
call sym.SystemInformer.exe_Ordinal_1240
cmp dword [0x62db64], 0xffffffff
mov edi, eax
mov eax, dword [0x6356f0]
jae 0x530544
cmp eax, 0x40
jae 0x530544
lfence
mov esi, dword fs:[0x18]
mov esi, dword [esi + eax*4 + 0xe10]
jmp 0x53054d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
je 0x530601
mov eax, dword [esi]
cmp eax, 0x40
jae 0x530567
mov dword [esi + eax*4 + 4], edi
inc dword [esi]
jmp 0x530601
mov ecx, dword [esi + 0x10c]
mov ebx, dword [0x633a74]
test ecx, ecx
jne 0x530597
push 0x100
push 4
push ebx
mov dword [esi + 0x108], 0x40
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, eax
mov dword [esi + 0x10c], ecx
mov eax, dword ds:[esi + 0x108]
cmp dword [esi + 0x104], eax
jne 0x5305ee
add eax, eax
mov dword [esi + 0x108], eax
shl eax, 2
test eax, eax
jne 0x5305ca
test ecx, ecx
je 0x5305c6
push ecx
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ecx, ecx
jmp 0x5305e8
push eax
test ecx, ecx
je 0x5305db
push ecx
push 4
push ebx
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
jmp 0x5305e6
push 4
push ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, eax
mov dword [esi + 0x10c], ecx
mov eax, dword [esi + 0x104]
mov ebx, dword [esp + 0x14]
mov dword [ecx + eax*4], edi
inc dword [esi + 0x104]
push dword [esp + 0x10]
mov dword [ebx + ebp*4], edi
push 0
push edi
call fcn.005861b0
mov eax, dword ds:[esp + 0x1c]
inc ebp
add esp, 0xc
cmp ebp, dword [esp + 0x18]
jb 0x530510
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax], ebx
pop ebx
add esp, 0x10
ret 4
mov dword [edi], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x5319e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ecx
push esi
mov esi, dword [0x630ccc]
push edi
push esi
push 4
push dword [0x633a74]
mov dword [esp + 0x14], esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [esp + 8]
push eax
push esi
push edi
push 0xb
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, eax
cmp ecx, 0xc0000004
jne 0x531a4e
push edi
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 8]
push 4
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push edi
push 0xb
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, eax
lfence
test ecx, ecx
js 0x531a72
mov eax, dword ds:[esp + 8]
cmp eax, 0x100000
ja 0x531a6c
mov dword [0x630ccc], eax
mov eax, dword [esp + 0x10]
mov dword [eax], edi
pop edi
mov eax, ecx
pop esi
pop ecx
ret 4
Function at 0x531a80
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub esp, 0x134
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x12c], eax
push 0x120
lea eax, [esp + 0xc]
push 0
push eax
call fcn.005861b0
add esp, 0xc
mov dword [esp + 4], 0x120
lea eax, [esp + 4]
push eax
push 0x120
lea eax, [esp + 0x10]
push eax
push 0xb
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
je 0x531b0c
cmp eax, 0xc0000004
jne 0x531b0c
cmp dword [esp + 8], 1
jb 0x531b0c
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x531ae0
sub ecx, edx
lea eax, [esp + 0x28]
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1315
mov ecx, dword ds:[esp + 0x12c]
xor ecx, esp
call fcn.00583f7f
add esp, 0x134
ret
mov ecx, dword [esp + 0x12c]
xor eax, eax
xor ecx, esp
call fcn.00583f7f
add esp, 0x134
ret

Function at 0x531b30
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0xc
cmp dword [0x62db64], 0x64
jb 0x531b6d
mov ecx, dword [0x630ce8]
test ecx, ecx
jne 0x531b4e
add esp, 0xc
jmp sym.SystemInformer.exe_Ordinal_1430
mov eax, dword [str.SystemRootSystem32_ntoskrnl.exe]
push 0
mov dword [esp + 8], eax
lea eax, [esp + 4]
push 0
push eax
mov dword [esp + 0xc], ecx
call sym.SystemInformer.exe_Ordinal_1331
add esp, 0xc
ret
add esp, 0xc
jmp sym.SystemInformer.exe_Ordinal_1514

Function at 0x531b80
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub esp, 0x134
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
mov ebx, dword [esp + 0x144]
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x140]
push edi
mov edi, dword [esp + 0x148]
push 0x120
push 0
push eax
call fcn.005861b0
add esp, 0xc
mov dword [esp + 0xc], 0x120
lea eax, [esp + 0xc]
push eax
push 0x120
lea eax, [esp + 0x20]
push eax
push 0xb
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop
test eax, eax
je 0x531c5b
cmp eax, 0xc0000004
jne 0x531c60
cmp dword [esp + 0x18], 1
jb 0x531c5b
test esi, esi
je 0x531c39
cmp dword [0x62db64], 0x64
jb 0x531c2d
mov ecx, dword [0x630cd8]
test ecx, ecx
jne 0x531c10
call sym.SystemInformer.exe_Ordinal_1430
jmp 0x531c37
mov eax, dword [str.SystemRootSystem32_ntoskrnl.exe]
push 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x1c], ecx
call sym.SystemInformer.exe_Ordinal_1331
jmp 0x531c37
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_Ordinal_1313
mov dword [esi], eax
cmp dword [0x62db64], 0x71
mov eax, dword [esp + 0x24]
jb 0x531c4f
test eax, eax
jne 0x531c4f
mov eax, 0xfffffffe
mov dword [edi], eax
mov eax, dword [esp + 0x28]
mov dword [ebx], eax
xor eax, eax
jmp 0x531c60
mov eax, 0xc0000001
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x134
ret 0xc
Function at 0x5337e0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
movzx eax, word [ecx]
mov word [esp + 0x20], ax
add eax, 2
cmp dword [ecx], 0xfffe
mov word [esp + 0x22], ax
mov eax, dword [ecx + 4]
mov dword [esp + 0x24], eax
jbe 0x53381c
mov eax, 0xc0000106
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
nop dword [eax]
call fcn.005334c0
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
push ecx
lea ecx, [esp + 0x28]
push ecx
push 1
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov ecx, dword ds:[esp + 0x10]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
js 0x533924
mov edx, dword [ecx]
cmp edx, 7
je 0x53391f
cmp edx, 8
je 0x53391f
cmp dword [ebp + 0xc], 0
je 0x5338b9
mov ebx, dword [ecx + 4]
movzx eax, byte [ebx + 1]
lea edi, [eax*4 + 8]
push edi
push 4
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push edi
mov esi, eax
push ebx
push esi
call fcn.00586310
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov dword [eax], esi
mov esi, dword ds:[ebp + 0x10]
test esi, esi
je 0x533912
mov eax, dword [ecx + 8]
test eax, eax
js 0x533907
lea ecx, ds:[eax + eax*2]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
lea eax, [eax + ecx*4]
movzx ecx, word [eax]
test cx, cx
je 0x533907
mov eax, dword ds:[eax + 4]
mov dword [esp + 0x1c], eax
mov eax, ecx
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push 0
push eax
call sym.SystemInformer.exe_Ordinal_1331
jmp 0x53390c
call sym.SystemInformer.exe_Ordinal_1430
mov ecx, dword [esp + 0x10]
mov dword [esi], eax
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x533924
mov eax, dword [ecx]
mov dword [edx], eax
jmp 0x533924
mov ebx, 0xc0000073
mov eax, dword [esp + 0x14]
test eax, eax
je 0x533937
push eax
call dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x533946
push ecx
call dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5349e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov esi, ecx
call fcn.00533400
mov ecx, dword [esi + 2]
mov edx, eax
cmp ecx, dword [edx + 2]
jne 0x534a98
movzx eax, word [esi + 6]
cmp ax, word [edx + 6]
jne 0x534a98
cmp dword [esi + 8], 1
jne 0x534a98
mov eax, dword [esi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
call sym.SystemInformer.exe_Ordinal_1621
mov esi, eax
test esi, esi
je 0x534a98
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
add ecx, 2
mov dword [esp + 0x10], ecx
mov ecx, dword [esi]
push 0
and ecx, 0xfffffffe
push 0
sub ecx, 4
push eax
mov dword [esp + 0x18], ecx
call sym.SystemInformer.exe_Ordinal_1331
mov edi, eax
lea ecx, [esi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x534a85
nop
call fcn.004fe0c0
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret

Function at 0x535cd0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push esi
push edi
push 0
push 0x1c
push eax
push 0
push ecx
push 0xffffffffffffffff
mov esi, edx
call dword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x535d35
mov ecx, dword [esp + 0xc]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x535d35
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x535d35
mov edx, dword [eax + 0xd8]
mov edi, dword [eax + 0xdc]
test edx, edx
je 0x535d35
test edi, edi
je 0x535d35
lea eax, [edx + ecx]
cmp esi, eax
jb 0x535d35
lea eax, [edi + edx]
add eax, ecx
cmp esi, eax
jae 0x535d35
pop edi
mov al, 1
pop esi
add esp, 0x1c
ret
pop edi
xor al, al
pop esi
add esp, 0x1c
ret
Function at 0x536080
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x53617b
nop dword [eax + eax]
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x5360c8
sub edi, 0x8000000
jmp 0x536165
push 0
push 0x1c
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 0
push eax
push 0
xorps xmm0, xmm0
push edi
push 0xffffffffffffffff
movups xmmword [esp + 0x2c], xmm0
movq qword [esp + 0x3c], xmm0
call dword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x53617b
cmp dword [esp + 0x24], 0x10000
jne 0x53614f
cmp dword [esp + 0x20], 0x10000
jb 0x53614f
push 0x40
push 0x3000
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10000
push eax
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], edi
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x53616f
nop dword [eax]
cmp eax, 0xc0000604
je 0x53617b
sub edi, 0x10000
jmp 0x536165
mov ecx, dword [esp + 0x18]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x5360b0
jmp 0x53617b
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x53626a
movzx eax, si
test eax, eax
je 0x53618c
sub esi, eax
add esi, 0x10000
mov edi, dword [esp + 0x34]
cmp esi, edi
jae 0x536268
nop dword [eax + eax]
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x5361b8
add esi, 0x8000000
jmp 0x536258
push 0
push 0x1c
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 0
push eax
push 0
xorps xmm0, xmm0
push esi
push 0xffffffffffffffff
movups xmmword [esp + 0x2c], xmm0
movq qword [esp + 0x3c], xmm0
call dword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x536268
cmp dword [esp + 0x24], 0x10000
mov ecx, dword [esp + 0x20]
jne 0x536242
nop dword [eax + eax]
cmp ecx, 0x10000
jb 0x536242
push 0x40
push 0x3000
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10000
push eax
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x536273
cmp eax, 0xc0000604
je 0x536268
add esi, 0x10000
jmp 0x536258
mov esi, dword [esp + 0x14]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x536258
mov eax, 0x10000
sub eax, ecx
add esi, eax
nop dword [eax + eax]
cmp esi, edi
jb 0x5361a0
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
mov eax, dword ds:[esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
Function at 0x53a100
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
xor esi, esi
mov byte [esp + 0xf], 0
mov byte [esp + 0xe], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
push edi
mov edi, dword [esp + 0x3c]
test bl, 1
je 0x53a150
lea eax, ds:[esp + 0x12]
push eax
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetOwnerSecurityDescriptor]
test eax, eax
mov ecx, 1
cmovns esi, ecx
test bl, 2
je 0x53a16d
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetGroupSecurityDescriptor]
test eax, eax
js 0x53a16d
or esi, 2
mov ebp, ebx
and ebp, 4
je 0x53a198
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1b]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
test eax, eax
js 0x53a198
cmp byte [esp + 0x13], 0
je 0x53a198
or esi, 4
and ebx, 8
je 0x53a1c1
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1b]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetSaclSecurityDescriptor]
test eax, eax
js 0x53a1c1
cmp byte [esp + 0x13], 0
je 0x53a1c1
or esi, 8
cmp dword [esp + 0x34], 1
jne 0x53a21c
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetControlSecurityDescriptor]
test eax, eax
js 0x53a21c
mov cx, word [esp + 0x14]
test ebp, ebp
je 0x53a1fe
movzx eax, cx
test eax, 0x1000
je 0x53a1f8
or esi, 0x80000000
jmp 0x53a1fe
or esi, 0x20000000
nop
test ebx, ebx
je 0x53a21c
movzx eax, cx
test eax, 0x2000
je 0x53a216
or esi, 0x40000000
jmp 0x53a21c
or esi, 0x10000000
push dword [esp + 0x18]
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [esp + 0x30]
push esi
push dword [esp + 0x48]
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x53a250
push eax
call sym.SystemInformer.exe_Ordinal_1343
add esp, 0x1c
ret 0x10
xor eax, eax
add esp, 0x1c
ret 0x10
Function at 0x53b780
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
push edi
push 0x60
push 1
push 5
push 0x80
push 0x120089
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], ecx
push eax
call sym.SystemInformer.exe_Ordinal_1467
test eax, eax
jns 0x53b7d5
lfence
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x20]
push 5
push 0x18
push eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x53b83e
movq xmm0, qword [esp + 0x30]
movaps xmm1, xmmword [esp + 0x20]
movq qword [esp + 0x30], xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
psrldq xmm1, 0xc
movd ecx, xmm0
movd eax, xmm1
or ecx, eax
jne 0x53b83e
push edi
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, 0xc0000011
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
push ecx
mov edx, edi
call fcn.0057bca0
push edi
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x53b885
cmp dword [esi], 0
jne 0x53b87b
mov eax, dword ds:[esp + 0x14]
test eax, eax
je 0x53b866
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.0057e920
mov ecx, dword [esp + 0x4c]
mov eax, 0xc0000102
pop edi
pop esi
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8