joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522480
Capabilities:
Enumerate services

Disassembly:
sub esp, 8
push esi
push edi
push 0x800
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0x800
push edi
push 3
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x5224d9
xor esi, esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lfence
mov dword [eax], edi
mov eax, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, esi
pop edi
pop esi
add esp, 8
ret 0xc
cmp dword [0x62db64], 0xffffffff
jae 0x5224ed
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
jmp 0x5224f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
mov esi, eax
cmp esi, 0x105
jne 0x522570
push edi
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 8]
push esi
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push esi
push edi
push 3
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x5224ba
cmp dword [0x62db64], 0xffffffff
jae 0x522562
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
jmp 0x522568
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
mov esi, eax
test esi, esi
jns 0x5224bc
push edi
push 0
lfence
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
add esp, 8
ret 0xc

Function at 0x522740
Capabilities:
Create service

Disassembly:
push ecx
push ebx
push esi
push edi
push 2
push 0
push 0
mov ebx, edx
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x522782
cmp dword [0x62db64], 0xffffffff
jae 0x52276e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
jmp 0x522774
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
test eax, eax
js 0x5227f9
mov esi, dword [esp + 0xc]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0
push 0
push 0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x5227c8
mov dword [edi], eax
xor edi, edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 0x20
cmp dword [0x62db64], 0xffffffff
mov dword [edi], 0
jae 0x5227e2
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
jmp 0x5227e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 0x20
Function at 0x522880
Capabilities:
Modify service

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x52289b
xor eax, eax
ret 0xc
cmp dword [0x62db64], 0xffffffff
jae 0x5228b6
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
push eax
call sym.SystemInformer.exe_Ordinal_1343
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
ret 0xc

Function at 0x5229e0
Capabilities:
Query service status

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
lea ecx, [esp]
push ecx
push 0x24
push eax
xorps xmm0, xmm0
mov dword [esp + 0xc], 0
push 0
push dword [esp + 0x18]
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [eax + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x522a1b
xor eax, eax
pop ecx
ret 8
cmp dword [0x62db64], 0xffffffff
jae 0x522a37
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
push eax
call sym.SystemInformer.exe_Ordinal_1343
pop ecx
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
pop ecx
ret 8

Function at 0x522b80
Capabilities:
Continue service

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
push 3
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x522bb0
xor eax, eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
cmp dword [0x62db64], 0xffffffff
jae 0x522bd7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
push eax
call sym.SystemInformer.exe_Ordinal_1343
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret

Function at 0x522c00
Capabilities:
Pause service

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x522c30
xor eax, eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
cmp dword [0x62db64], 0xffffffff
jae 0x522c57
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
push eax
call sym.SystemInformer.exe_Ordinal_1343
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret

Function at 0x522cc0
Capabilities:
Start service

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x522cdb
xor eax, eax
ret 0xc
cmp dword [0x62db64], 0xffffffff
jae 0x522cf6
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
push eax
call sym.SystemInformer.exe_Ordinal_1343
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
ret 0xc
Function at 0x522d20
Capabilities:
Stop service

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
lea ecx, [esp]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
nop
test eax, eax
je 0x522d57
xor eax, eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret 4
cmp dword [0x62db64], 0xffffffff
nop
jae 0x522d6d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
jmp 0x522d73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_Ordinal_1343
mov ecx, dword ds:[esp + 0x1c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret 4

Function at 0x528420
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
push ebx
push esi
mov eax, dword [eax + 0x30]
mov ebx, edx
push edi
mov ecx, dword [eax + 0xc]
add ecx, 0xc
mov dword [esp + 0x10], ecx
mov esi, dword [ecx]
cmp esi, ecx
je 0x5284de
nop
cmp dword [esp + 0x14], 0
movzx edi, word [esi + 0x2c]
movzx edx, word [esi + 0x24]
mov eax, dword [esi + 0x28]
mov dword [esp + 0x1c], edi
mov edi, dword [esi + 0x30]
mov dword [esp + 0x18], edi
mov edi, dword [ebp + 8]
je 0x52847d
mov ecx, dword [esp + 0x14]
cmp dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x10]
jne 0x5284d4
nop dword [eax]
test ebx, ebx
je 0x5284a7
mov dword [esp + 0x24], eax
mov eax, dword [ebx]
mov dword [esp + 0x20], eax
cmp edx, eax
jb 0x5284d4
push 1
push ebx
lea eax, [esp + 0x28]
push eax
call sym.SystemInformer.exe_Ordinal_1351
mov ecx, dword [esp + 0x10]
test al, al
je 0x5284d4
test edi, edi
je 0x5284e9
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [edi]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x1c], eax
jb 0x5284d4
push 1
push edi
lea eax, [esp + 0x30]
push eax
call sym.SystemInformer.exe_Ordinal_1351
test al, al
jne 0x5284e9
mov ecx, dword [esp + 0x10]
mov esi, dword [esi]
cmp esi, ecx
jne 0x528450
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x528580
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push esi
je 0x5285af
push 0x60
push 1
push 5
push 0x80
push 0x100081
push dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
call sym.SystemInformer.exe_Ordinal_1467
jmp 0x5285d3
mov eax, dword [ebp + 8]
push 0
push 0x60
push 1
push 5
push 0x80
push 0
push 0x100081
push dword [eax + 4]
lea eax, [esp + 0x28]
push eax
call sym.SystemInformer.exe_Ordinal_1469
test eax, eax
jns 0x5285e3
lfence
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x62db64], 0x3e
push dword ds:[esp + 8]
sbb eax, eax
mov dword [esp + 0x1c], 0x18
and eax, 0xf0000000
mov dword [esp + 0x20], 0
add eax, 0x11000000
mov dword [esp + 0x28], 0
push eax
push 2
push 0
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 0
push eax
push 5
lea eax, [esp + 0x24]
mov dword [esp + 0x40], 0
push eax
mov dword [esp + 0x48], 0
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov esi, eax
test esi, esi
js 0x5286ba
cmp dword [0x62db64], 0x67
push 2
sbb eax, eax
mov dword [esp + 0x14], 0
and eax, 0xfffc0000
mov dword [esp + 0x18], 0
add eax, 0x40000
push eax
push 2
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push dword ds:[esp + 0xc]
xor esi, esi
cmp eax, 0x40000003
cmovne esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x5286ba
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5286ba
mov ecx, dword [esp + 0x10]
or ecx, 2
mov dword [eax], ecx
push dword ds:[esp + 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x528a60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x1c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
push 3
lea eax, [esp + 0x20]
mov dword [esp + 0x24], ecx
push eax
push ebx
mov dword [esp + 0x30], 0
call dword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x528af4
lea eax, ds:[esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lfence
push dword [esp + 0x14]
push ebx
call dword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x528af4
test edi, edi
je 0x528ad4
mov eax, dword [esp + 0x10]
mov dword [edi], eax
test esi, esi
je 0x528ade
mov eax, dword [esp + 0x14]
mov dword [esi], eax
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00583f9f
add esp, 0x1c
ret 0x14
mov ecx, dword ds:[esp + 0x24]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x1c
ret 0x14
Function at 0x528d60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0x18]
sub esp, 8
mov eax, dword [eax + 0x30]
push esi
push edi
push dword [eax + 0xa0]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov edx, dword [eax]
cmp edx, eax
je 0x528daf
mov ecx, dword ds:[ebp + 8]
test ecx, ecx
je 0x528dd4
cmp dword [edx + 0x18], ecx
je 0x528dd4
mov edx, dword [edx]
cmp edx, eax
jne 0x528da4
xor esi, esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0xa0]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test esi, esi
jne 0x528e0b
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test edx, edx
je 0x528daf
movzx eax, word ds:[edx + 0x24]
mov ecx, eax
test ax, ax
jne 0x528dee
call sym.SystemInformer.exe_Ordinal_1430
mov esi, eax
jmp 0x528db1
mov eax, dword [edx + 0x28]
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x14], ecx
call sym.SystemInformer.exe_Ordinal_1331
mov esi, eax
jmp 0x528db1
push esi
call sym.SystemInformer.exe_Ordinal_1509
mov edi, eax
lea ecx, [esi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x528e28
call fcn.004fe1e0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x528e46
push 0
push 0x5c
push edi
call sym.SystemInformer.exe_Ordinal_1369
xor edx, edx
cmp eax, 0xffffffff
lea ecx, [eax + 1]
cmove ecx, edx
mov dword [esi], ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x528e60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov edi, edx
mov esi, ecx
push dword [eax + 0xa0]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x62db64], 0x3e
jb 0x528ef2
test esi, esi
jne 0x528ef2
test edi, edi
je 0x528ef2
mov eax, dword [edi]
test eax, eax
je 0x528ec4
mov edi, dword [edi + 4]
shr eax, 1
lea ebx, [edi + eax*2]
cmp edi, ebx
je 0x528ec4
nop
movzx eax, word ds:[edi]
mov ecx, eax
add eax, 0xffffff9f
cmp ax, 0x19
lea edx, [ecx - 0x20]
cmova edx, ecx
imul esi, esi, 0x1003f
add edi, 2
add esi, edx
cmp edi, ebx
jne 0x528ea0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
add ecx, 0xc
cmp eax, ecx
je 0x528eee
nop word [eax + eax]
cmp dword [eax + 0x90], esi
je 0x528efc
mov eax, dword [eax]
cmp eax, ecx
jne 0x528ee0
xor eax, eax
jmp 0x528efc
push edi
mov edx, esi
xor ecx, ecx
call fcn.00528420
nop dword [eax]
test eax, eax
je 0x528f09
mov esi, dword [eax + 0x18]
jmp 0x528f0b
xor esi, esi
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0xa0]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x528f40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, 0x5a4d
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
cmp word [edi], ax
jne 0x529130
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x529130
cmp eax, 0x7fffffff
jae 0x529130
add eax, edi
mov dword [esp + 0x14], eax
cmp dword [eax], 0x4550
jne 0x529130
lea edx, [eax + 0x78]
mov eax, dword [edx]
test eax, eax
je 0x529130
cmp dword [edx + 4], 0
je 0x529130
push dword [ebp + 8]
add eax, edi
push esi
push eax
call fcn.00529280
cmp dword [0x62db64], 0x64
mov ebx, eax
jb 0x529125
call fcn.00520400
nop dword [eax]
test eax, eax
je 0x529125
call fcn.00520400
mov esi, eax
mov ecx, eax
call dword [0x5a9914]
call esi
nop dword [eax]
test al, al
je 0x529125
mov edx, dword ds:[esp + 0x14]
lea eax, [esp + 0x18]
push ecx
push eax
lea eax, [esp + 0x18]
mov ecx, edi
push eax
push 0xa
call fcn.005291a0
test eax, eax
js 0x529125
mov edx, dword ds:[esp + 0x18]
mov ecx, dword [edx]
lea eax, [edx + 0x5c]
add ecx, edx
cmp eax, ecx
ja 0x529125
mov eax, dword [edx + 0x58]
shr eax, 0xe
test al, 1
je 0x529125
cmp byte [0x63400b], 0
nop dword [eax]
jne 0x5290d3
push dword [0x633a2c]
mov byte [0x63400b], 1
push 0x28
call sym.SystemInformer.exe_Ordinal_1240
mov esi, dword [0x633a54]
mov edi, eax
push 0x40
push 4
push esi
mov dword [edi], 8
mov dword [edi + 4], 0x502fe0
mov dword [edi + 8], 0x503000
mov dword [edi + 0xc], 0x10
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [edi + 0xc]
shl ecx, 2
push ecx
push 0xff
push eax
mov dword [edi + 0x10], eax
call fcn.005861d0
mov eax, dword [edi + 0xc]
add esp, 0xc
mov dword [edi + 0x14], eax
shl eax, 4
push eax
push 4
push esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0xffffffff
mov dword [edi + 0x24], 0
mov dword [0x635a70], edi
jmp 0x5290d9
mov edi, dword [0x635a70]
test edi, edi
je 0x529125
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push edi
call sym.SystemInformer.exe_Ordinal_1365
lea ecx, [eax + 4]
neg eax
sbb eax, eax
test ecx, eax
jne 0x529125
mov edx, ebx
lfence
call fcn.0051e540
test eax, eax
js 0x529125
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push dword [0x635a70]
mov dword [esp + 0x24], 1
call sym.SystemInformer.exe_Ordinal_1269
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x529900
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x14], edx
mov eax, 0x5a4d
cmp word [ebp], ax
je 0x529924
mov eax, 0xc000012f
lfence
pop ebp
add esp, 0x14
ret 0xc
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x529a99
cmp eax, 0x7fffffff
jae 0x529a99
cmp dword [eax + ebp], 0x4550
jne 0x529a99
mov ecx, dword [eax + ebp + 0x80]
test ecx, ecx
je 0x529a8a
cmp dword ds:[eax + ebp + 0x84], 0
je 0x529a8a
push ebx
lea ebx, [ebp + 0xc]
mov edx, 0xc0000001
add ebx, ecx
mov dword [esp + 8], edx
cmp dword [ebx], 0
je 0x529a80
push esi
push edi
mov ecx, dword [ebx - 0xc]
test ecx, ecx
je 0x529a7a
mov eax, dword ds:[ebx]
lea edi, [ecx + ebp]
push dword [esp + 0x20]
mov esi, dword [ebx + 4]
add eax, ebp
push eax
add esi, ebp
call fcn.0058e8c5
add esp, 8
test eax, eax
jne 0x529a5e
mov eax, dword [edi]
test eax, eax
je 0x529a5e
mov dword [esp + 0x18], 4
sub edi, esi
mov dword [esp + 0x14], 0
mov ecx, eax
nop
mov dword [esp + 0x1c], esi
test eax, eax
js 0x529a0b
mov eax, dword [esp + 0x28]
add ecx, 2
add ecx, ebp
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x529a02
test dl, dl
je 0x5299fd
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x529a02
add ecx, 2
add eax, 2
test dl, dl
jne 0x5299e1
xor eax, eax
jmp 0x529a07
sbb eax, eax
or eax, 1
test eax, eax
je 0x529a1a
mov eax, dword [edi + esi + 4]
add esi, 4
mov ecx, eax
test eax, eax
jne 0x5299d0
jmp 0x529a5e
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
js 0x529a62
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov edx, dword [esp + 0x10]
add ebx, 0x14
cmp dword [ebx], 0
jne 0x529980
pop edi
pop esi
pop ebx
mov eax, edx
pop ebp
add esp, 0x14
ret 0xc
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov eax, edx
pop ebp
add esp, 0x14
ret 0xc
mov eax, 0xc0000020
lfence
pop ebp
add esp, 0x14
ret 0xc
mov eax, 0xc000007b
lfence
pop ebp
add esp, 0x14
ret 0xc
Function at 0x52d2a0
Capabilities:
Map section object

Disassembly:
sub esp, 8
push esi
push 2
push 0
push 2
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0xffffffffffffffff
push ecx
mov esi, edx
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x52d2e1
lfence
pop esi
add esp, 8
ret
push esi
push dword [esp + 8]
push 0xffffffffffffffff
call sym.SystemInformer.exe_Ordinal_1535
push dword [esp + 4]
mov esi, eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x52fc40
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push str.DeviceNamedPipe_
mov dword [esp + 0x18], 0
mov dword [esp + 0x68], 0xc
mov dword [esp + 0x6c], 0
mov word [esp + 0x70], 0
call sym.SystemInformer.exe_Ordinal_1303
mov edi, eax
lea eax, [esp + 0x18]
movzx ecx, word [edi]
mov word [esp + 0x18], cx
movzx ecx, word [edi]
add cx, 2
mov word [esp + 0x1a], cx
mov ecx, dword [edi + 4]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x40
mov dword [esp + 0x3c], 0
call dword [sym.imp.ntdll.dll_RtlDefaultNpAcl]
nop
test eax, eax
js 0x52fd0e
push 1
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
push 0
push dword [esp + 0x14]
lea eax, [esp + 0x4c]
push 1
push eax
call dword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
lea eax, [esp + 0x44]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xff676980
push eax
push 0x1000
push 0x1000
push 0xffffffffffffffff
push 0
push 1
push 3
push 0x22
push 3
push 3
lea eax, [esp + 0x80]
mov dword [esp + 0x4c], 0xffffffff
push eax
lea eax, [esp + 0x54]
push eax
push 0x12019f
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.ntdll.dll_NtCreateNamedPipeFile]
mov esi, eax
test esi, esi
js 0x52fd64
mov ecx, dword [esp + 0x14]
mov dword [ebx], ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x52fd86
push eax
mov eax, dword fs:[0x18]
push 0
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x52fd99
call fcn.004fe1e0
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8