joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c6ca0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x602de8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
mov eax, dword [eax]
sub eax, 0x10
call fcn.0040a210
lea ecx, [eax + 0x10]
mov dword [esp + 0x44], ecx
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov eax, dword [ecx - 0xc]
cmp eax, ebx
jle 0x5c6d11
lea edx, [eax - 1]
cmp edx, ebx
jl 0x5c6e00
cmp edx, eax
jg 0x5c6e00
movzx eax, word [ecx + edx*2]
cmp ax, 0x5c
je 0x5c6d11
push 0x5c
lea edi, [esp + 0x48]
call fcn.0040af90
mov edx, dword [0x677600]
mov eax, dword [edx + 0xc]
mov ecx, 0x677600
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
lea edx, [esp + 0x44]
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 2
call fcn.005c6a90
test al, al
mov eax, dword [esp + 0x24]
je 0x5c6e0a
cmp eax, ebx
je 0x5c6e24
mov edi, dword [esp + 0x28]
mov ecx, edi
sub ecx, eax
sar ecx, 2
je 0x5c6e0e
xor esi, esi
lea ecx, [ecx]
cmp eax, ebx
je 0x5c6e24
mov ecx, edi
sub ecx, eax
sar ecx, 2
cmp esi, ecx
jae 0x5c6e0e
cmp dword [ebp - 0xc], ebx
je 0x5c6dcc
cmp esi, ecx
jb 0x5c6d9d
call fcn.005d29f1
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + esi*4]
cmp dword [ecx - 0xc], ebx
lea ebp, [eax + esi*4]
jl 0x5c6dcc
mov edx, dword [esp + 0x18]
push edx
push ecx
call fcn.005d2e73
add esp, 8
cmp eax, ebx
je 0x5c6dc4
sub eax, dword [ebp]
sar eax, 1
cmp eax, 0xffffffff
jne 0x5c6dec
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x5c6dd9
sub edi, eax
sar edi, 2
cmp esi, edi
jb 0x5c6de2
call fcn.005d29f1
mov eax, dword [esp + 0x24]
mov eax, dword [eax + esi*4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x18]
add esi, 1
jmp 0x5c6d70
push 0x80070057
call fcn.00403650
mov edi, dword [esp + 0x28]
cmp eax, ebx
je 0x5c6e24
call fcn.004287d0
mov ecx, dword [esp + 0x24]
push ecx
call fcn.005d2367
add esp, 4
lea eax, [ebp - 0x10]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x3c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5c6e50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c6e78
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x5c7060
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x602daa
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x7c]
mov esi, ecx
mov eax, dword [esi]
xor bl, bl
cmp dword [eax - 0xc], 0
mov byte [esp + 0x17], bl
je 0x5c7206
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5c7206
mov eax, dword [ebp]
cmp dword [eax - 0xc], 0
je 0x5c7206
lea ecx, [esp + 0x28]
push ecx
xor edi, edi
call fcn.0050f180
mov dword [esp + 0x6c], edi
mov ecx, dword [esi]
lea edx, [esp + 0x28]
call fcn.0050f300
mov edx, dword [0x677600]
mov eax, dword [edx + 0xc]
mov ecx, 0x677600
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
mov ebx, 1
mov byte [esp + 0x6c], bl
mov eax, dword [ecx]
mov ecx, dword [edx]
lea edx, [esp + 0x28]
push edx
mov edi, 0x6244e0
lea esi, [esp + 0x20]
call fcn.0050fc40
mov esi, dword [esp + 0x1c]
cmp dword [esi - 0xc], ebx
jle 0x5c71bb
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, ebp
lea edi, [esp + 0x18]
mov byte [esp + 0x6c], 2
call fcn.0040ab90
mov eax, edi
call fcn.00576f50
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ebx, edi
mov byte [esp + 0x74], 3
call fcn.0041eb50
add esp, 8
lea edi, [esp + 0x20]
mov byte [esp + 0x6c], 4
call fcn.0040ab90
lea ecx, [esp + 0x24]
call fcn.00403870
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5c71a9
mov byte [esp + 0x17], 1
lea ecx, [esp + 0x20]
call fcn.00403870
lea ecx, [esp + 0x18]
call fcn.00403870
lea eax, [esi - 0x10]
mov byte [esp + 0x6c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c71dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x70], 0xffffffff
call fcn.0050f250
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
mov al, bl
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x5c8c20
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x607951
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
call fcn.005c7ba0
add esp, 4
mov dword [esp + 0x234], 0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
or ebp, 0xffffffff
cmp eax, 2
jle 0x5c8d94
cmp eax, 1
jge 0x5c8c94
push 0x80070057
call fcn.00403650
movzx eax, word [ecx + 2]
cmp ax, 0x3a
je 0x5c8d94
push 0x20a
lea ecx, [esp + 0x22]
push 0
push ecx
mov word [esp + 0x28], 0
call fcn.005da970
add esp, 0xc
push 1
push 0x14
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x5c8d00
or ebp, 0xffffffff
mov dword [esp + 0x234], ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x5c8cf9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x5c8e03
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call fcn.00409dd0
lea eax, [esp + 0x14]
mov byte [esp + 0x234], 1
call fcn.00576f50
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
lea ebx, [esp + 0x1c]
call fcn.0041eb50
add esp, 8
lea edi, [esp + 0x10]
mov byte [esp + 0x234], 2
call fcn.0040ab90
mov byte [esp + 0x234], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c8d6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x234], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c8d94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5c8dcf
mov dword [esp + 0x234], ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x5c8cf9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x5c8e03
lea ecx, [esp + 0x10]
call fcn.005c5f90
test al, al
mov dword [esp + 0x234], ebp
mov eax, dword [esp + 0x10]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x5c8e01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.005d28b3
add esp, 0x228
ret
Function at 0x5c9260
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x6000a8
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [0x680660]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x5c92e7
lea edi, [esp + 8]
call fcn.0047ac70
mov edi, 0x680660
mov dword [esp + 0x14], 0
call fcn.0040ab90
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c92d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.005c9080
push 5
push 0x640498
push 0x680660
call fcn.0040aee0
mov ecx, dword [0x680660]
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, 0x680660
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret

Function at 0x5c9890
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5fed38
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov ebx, ecx
mov edi, edx
mov eax, dword [esp + 0x24]
push eax
push edi
call fcn.005ca8c0
test al, al
je 0x5c99bd
mov esi, edi
call fcn.005cae50
test al, al
je 0x5c99ce
push ebx
lea ecx, [edi + 0x60]
push ecx
call fcn.005ca8c0
test al, al
je 0x5c99bd
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], ecx
mov eax, dword [ebp]
mov ebx, dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ecx
push eax
push ebx
call esi
test eax, eax
je 0x5c99bd
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx]
push 0
push eax
push ecx
call esi
test eax, eax
je 0x5c99b4
mov eax, dword [ebp]
push 3
push 0xc0000000
push eax
lea eax, [esp + 0x3c]
xor edx, edx
push eax
mov eax, 0x80
lea ecx, [edx + 3]
call fcn.0040f030
test eax, eax
jne 0x5c999a
lea ecx, [esp + 0x30]
push ecx
mov eax, edi
call fcn.005c9a10
test al, al
je 0x5c999a
lea edx, [esp + 0x30]
push edx
mov eax, edi
call fcn.005c9af0
test al, al
je 0x5c999a
lea eax, [esp + 0x30]
push eax
push edi
call fcn.005c9bd0
test al, al
je 0x5c999a
lea esi, [esp + 0x30]
call fcn.005ca130
test al, al
je 0x5c999a
mov ecx, dword [esp + 0x28]
push ebx
push ecx
call fcn.005ca360
test al, al
jne 0x5c99c1
lea esi, [esp + 0x30]
call fcn.0044b230
mov edx, dword [ebp]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edx
call esi
mov eax, dword [ebx]
push eax
call esi
lea esi, [esp + 0x30]
call fcn.0044b230
xor al, al
jmp 0x5c99fa
lea esi, [esp + 0x30]
call fcn.0044b230
mov al, 1
jmp 0x5c99fa
mov eax, dword [ebp]
mov ebx, dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push eax
push ebx
call esi
test eax, eax
je 0x5c99bd
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx]
push 0
push eax
push ecx
call esi
test eax, eax
setne al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
Function at 0x5c9a10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, eax
xor eax, eax
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
call fcn.005cb100
test al, al
jne 0x5c9a47
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
push 0x686d7478
lea edx, [esp + 0x1c]
push edx
lea eax, [esi + 0x60]
call fcn.005cb280
mov ebx, dword [esi + 0x88]
add esi, 0x80
cmp dword [esi + 4], ebx
jbe 0x5c9a6f
call fcn.005d29f1
mov edi, dword [esp + 0x18]
test edi, edi
je 0x5c9a7b
cmp edi, esi
je 0x5c9a80
call fcn.005d29f1
mov esi, dword [esp + 0x1c]
cmp esi, ebx
je 0x5c9a3b
test edi, edi
jne 0x5c9a91
call fcn.005d29f1
cmp esi, dword [edi + 8]
jb 0x5c9a9b
call fcn.005d29f1
mov eax, dword [esi + 8]
push 0
add eax, 8
push eax
push ebp
xor edx, edx
call fcn.00433e80
test eax, eax
jne 0x5c9a3b
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebp]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5c9adb
call fcn.0040f010
test eax, eax
jne 0x5c9a3b
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 4

Function at 0x5c9af0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
push ecx
mov eax, esi
call fcn.005cb1d0
test al, al
jne 0x5c9b28
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
push 0x766d7478
lea edx, [esp + 0x1c]
push edx
lea eax, [esi + 0x60]
call fcn.005cb280
mov ebx, dword [esi + 0x88]
add esi, 0x80
cmp dword [esi + 4], ebx
jbe 0x5c9b50
call fcn.005d29f1
mov edi, dword [esp + 0x18]
test edi, edi
je 0x5c9b5c
cmp edi, esi
je 0x5c9b61
call fcn.005d29f1
mov esi, dword [esp + 0x1c]
cmp esi, ebx
je 0x5c9b1c
test edi, edi
jne 0x5c9b72
call fcn.005d29f1
cmp esi, dword [edi + 8]
jb 0x5c9b7c
call fcn.005d29f1
mov eax, dword [esi + 8]
push 0
add eax, 8
push eax
push ebp
xor edx, edx
call fcn.00433e80
test eax, eax
jne 0x5c9b1c
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebp]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5c9bbc
call fcn.0040f010
test eax, eax
jne 0x5c9b1c
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 4
Function at 0x5ce210
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5f7753
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
call fcn.005cdd70
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x677580
or eax, 0xffffffff
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x626e46
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.005cd380
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x5ce2a0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5f7778
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x28]
test esi, esi
jne 0x5ce2e0
push esi
push esi
push esi
push 2
call fcn.005cf640
xor al, al
jmp 0x5ce46a
call fcn.005cd560
push 2
or eax, 0xffffffff
push 0
push esi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.005d9ae4
push esi
call fcn.005d99ef
push 0
push 0
push esi
mov edi, eax
call fcn.005d9ae4
add esp, 0x1c
test edi, edi
jg 0x5ce327
push 0
push 0
push 0
push 0xd
mov ecx, ebx
call fcn.005cf640
xor al, al
jmp 0x5ce46a
mov dword [esp + 0x14], 0x677580
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.005cd2e0
lea eax, [edi + 1]
push eax
call fcn.005d2776
push esi
push 1
mov ebp, eax
push edi
push ebp
mov byte [ebp], 0
call fcn.005d983c
add esp, 0x14
cmp eax, 1
je 0x5ce39d
push ebp
call fcn.005d2367
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebx
call fcn.005cf640
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
cmp eax, 0x677580
je 0x5ce396
push eax
call fcn.005d2367
add esp, 4
xor al, al
jmp 0x5ce46a
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, ebp
mov esi, ebp
je 0x5ce412
jmp 0x5ce3b0
mov cl, byte [esi]
cmp cl, 0xa
jne 0x5ce3d0
mov ecx, esi
sub ecx, eax
add ecx, 1
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.005cd470
add esi, 1
mov eax, esi
jmp 0x5ce40d
cmp cl, 0xd
jne 0x5ce40a
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x5ce3e8
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.005cd470
push 1
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0xa
call fcn.005cd470
cmp byte [esi + 1], 0xa
jne 0x5ce3c9
add esi, 2
mov eax, esi
jmp 0x5ce40d
add esi, 1
cmp byte [esi], 0
jne 0x5ce3b0
sub esi, eax
je 0x5ce421
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.005cd470
push ebp
call fcn.005d2367
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push 0
add edx, 8
push edx
mov ecx, ebx
call eax
cmp byte [ebx + 0x2c], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
jne 0x5ce386
cmp eax, 0x677580
je 0x5ce468
push eax
call fcn.005d2367
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x5d0ecc
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x6687b8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.005d0e0b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.005da970
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x5d0f1b
cmp dword [ebp - 0x1c], 5
jb 0x5d0f33
jmp 0x5d0f2f
cmp dword [ebp - 0x10], 1
jne 0x5d0f33
cmp dword [ebp - 0x1c], 4
ja 0x5d0f2f
jne 0x5d0f33
cmp dword [ebp - 0x18], 0
jbe 0x5d0f33
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x616b88
call fcn.004775a0
test eax, eax
jge 0x5d0f54
mov byte [0x678490], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005d28b3
add ebp, 0x78
leave
ret

Function at 0x5d13be
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x67761c], 0
push esi
jne 0x5d1331
call fcn.005d125c
test eax, eax
je 0x5d1374
mov eax, dword [0x67761c]
cmp eax, 1
jne 0x5d1352
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x5d1374
pop esi
ret
push eax
call dword [0x677624]
test eax, eax
jne 0x5d13bc
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x5d1378
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x67761c]
call dword [0x677624]
mov edi, eax
test edi, edi
je 0x5d139f
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x5d13bb
lea edi, [esi + 0xff0]
push esi
push dword [0x67761c]
call dword [0x677620]
add esi, 0x10
cmp esi, edi
jb 0x5d13a5
mov eax, esi
pop edi
pop esi
ret
jmp 0x5d131e

Function at 0x5d28b3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6687b8]
jne 0x5d28bd
repz ret
jmp fcn.005df038
Function at 0x5d95a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x5d95dd
cmp dword [ebp + 0x14], edi
je 0x5d95dd
cmp ecx, edi
jne 0x5d95e4
call fcn.005d7414
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.005d29cd
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x5d95f8
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x5d9619
cmp ebx, 0xffffffff
je 0x5d9608
push ebx
push edi
push ecx
call fcn.005da970
add esp, 0xc
cmp esi, edi
je 0x5d95c5
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x5d95c5
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x5d9635
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x5d963c
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x5d972d
test word [esi + 0xc], 0x10c
je 0x5d9690
mov eax, dword [esi + 4]
test eax, eax
je 0x5d9690
jl 0x5d978e
cmp ebx, eax
mov edi, ebx
jb 0x5d9661
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x5d9735
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.005d2a01
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x5d9725
cmp ebx, dword [ebp - 0xc]
jb 0x5d96fd
cmp dword [ebp - 0xc], 0
je 0x5d96ba
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x5d96af
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x5d96b6
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x5d96c5
mov eax, SysReAllocString
cmp ebx, eax
ja 0x5d96c5
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x5d9761
push eax
push dword [ebp - 8]
push esi
call fcn.005e59ab
pop ecx
push eax
call fcn.005e9ded
add esp, 0xc
test eax, eax
je 0x5d97a0
cmp eax, 0xffffffff
je 0x5d978e
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x5d9725
push esi
call fcn.005eba0d
cmp eax, 0xffffffff
pop ecx
je 0x5d9792
cmp dword [ebp - 4], 0
je 0x5d9761
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x5d9644
mov eax, dword [ebp + 0x14]
jmp 0x5d95df
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x5d974c
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.005da970
add esp, 0xc
call fcn.005d7414
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x5d95d5
cmp dword [ebp + 0xc], 0xffffffff
je 0x5d9777
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.005da970
add esp, 0xc
call fcn.005d7414
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x5d95d5
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x5d95df
or dword [esi + 0xc], 0x10
jmp 0x5d9792