joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55c930
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x204
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x124]
test eax, eax
push edi
je 0x55c983
mov eax, dword [esi + 0x120]
xor edi, edi
test eax, eax
jle 0x55c983
mov eax, dword [esi + 0x124]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x55c978
mov ecx, dword [0x781e98]
push eax
call fcn.005df650
mov ecx, dword [esi + 0x124]
mov dword [ecx + edi*4], 0
mov eax, dword [esi + 0x120]
inc edi
cmp edi, eax
jl 0x55c952
mov edx, dword [esi + 0x120]
shl edx, 2
push edx
call fcn.0065b8d9
mov dword [esi + 0x124], eax
mov eax, dword [esi + 0x120]
add esp, 4
xor edi, edi
test eax, eax
jle 0x55ca82
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [esi + 0x124]
push 0
push 0x1a
push 0x40
mov dword [eax + edi*4], 0
mov ecx, dword [0x781e98]
push 0x40
call fcn.005df480
mov ecx, dword [esi + 0x124]
mov dword [ecx + edi*4], eax
mov edx, dword [esi + 0x124]
mov ecx, dword [edx + edi*4]
test ecx, ecx
lea eax, [edx + edi*4]
je 0x55ca8f
mov eax, ecx
mov edx, dword [eax]
call dword [edx + 4]
test al, al
je 0x55ca8f
lea eax, [esp + 0x110]
push eax
push 0x104
call ebp
mov ecx, dword [esi + 0x30]
add ecx, edi
mov edx, dword [ecx*4 + 0x76cd70]
push edx
lea eax, [esp + 0x14]
push 0x7166c4
push eax
call fcn.0065c60e
lea ecx, [esp + 0x1c]
push ecx
call fcn.005a8430
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x55ca55
mov edx, dword [esi + 0x124]
mov ecx, dword [edx + edi*4]
push 0
push ebx
call fcn.005e01b0
push ebx
call fcn.005a55f0
add esp, 4
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esi + 0x124]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx + 0x14]
test eax, eax
je 0x55ca8f
mov eax, dword [esi + 0x120]
inc edi
cmp edi, eax
jl 0x55c9b1
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x204
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x204
ret

Function at 0x562020
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6f4678
push eax
mov dword fs:[0], esp
push esi
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], 0
jae 0x56204d
lea eax, [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x64]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x54]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
push edx
mov ecx, esi
call fcn.0062dff0
cmp dword [esp + 0x30], 0x10
jb 0x562087
mov eax, dword [esp + 0x1c]
push eax
call fcn.0065d0d4
add esp, 4
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x28
Function at 0x56a2b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6f4ad9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00568430
xor ebp, ebp
mov dword [esi + 4], eax
mov dword [esi + 8], ebp
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], ebp
call fcn.00569610
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call fcn.00569680
lea edi, [esi + 0x58]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.0050aa00
mov dword [edi + 4], eax
mov byte [eax + 0x31], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x64]
mov ecx, edi
mov byte [esp + 0x18], 3
call fcn.00568410
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x56a2c7
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6f4ad9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00568430
xor ebp, ebp
mov dword [esi + 4], eax
mov dword [esi + 8], ebp
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], ebp
call fcn.00569610
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call fcn.00569680
lea edi, [esi + 0x58]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.0050aa00
mov dword [edi + 4], eax
mov byte [eax + 0x31], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x64]
mov ecx, edi
mov byte [esp + 0x18], 3
call fcn.00568410
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x570060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f4f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
call fcn.005615a0
xor ecx, ecx
mov dword [esi], 0x717260
mov dword [esi + 0x498], ecx
lea eax, [esi + 0x49c]
add eax, 0x38
add eax, 0x38
mov dword [eax - 0x70], ecx
mov dword [eax - 0x6c], ecx
mov dword [eax - 0x68], ecx
mov dword [eax - 0x64], ecx
mov dword [eax - 0x60], ecx
mov dword [eax - 0x5c], ecx
mov dword [eax - 0x58], ecx
mov dword [eax - 0x54], ecx
mov dword [eax - 0x50], ecx
mov dword [eax - 0x4c], ecx
mov dword [eax - 0x48], ecx
mov dword [eax - 0x44], ecx
mov dword [eax - 0x40], ecx
add eax, 0x38
mov dword [eax - 0x74], ecx
mov dword [eax - 0x70], ecx
mov dword [eax - 0x6c], ecx
mov dword [eax - 0x68], ecx
mov dword [eax - 0x64], ecx
mov dword [eax - 0x60], ecx
mov dword [eax - 0x5c], ecx
mov dword [eax - 0x58], ecx
mov dword [eax - 0x54], ecx
mov dword [eax - 0x50], ecx
mov dword [eax - 0x4c], ecx
mov dword [eax - 0x48], ecx
mov dword [eax - 0x44], ecx
mov dword [eax - 0x40], ecx
add eax, 0x38
mov dword [eax - 0x74], ecx
mov dword [eax - 0x70], ecx
mov dword [eax - 0x6c], ecx
mov dword [eax - 0x68], ecx
mov dword [eax - 0x64], ecx
mov dword [eax - 0x60], ecx
mov dword [eax - 0x5c], ecx
mov dword [eax - 0x58], ecx
mov dword [eax - 0x54], ecx
mov dword [eax - 0x50], ecx
mov dword [eax - 0x4c], ecx
mov dword [eax - 0x48], ecx
mov dword [eax - 0x44], ecx
mov dword [eax - 0x40], ecx
mov dword [eax - 0x3c], ecx
mov dword [eax - 0x38], ecx
mov dword [eax - 0x34], ecx
mov dword [eax - 0x30], ecx
mov dword [eax - 0x2c], ecx
mov dword [eax - 0x28], ecx
mov dword [eax - 0x24], ecx
mov dword [eax - 0x20], ecx
mov dword [eax - 0x1c], ecx
mov dword [eax - 0x18], ecx
mov dword [eax - 0x14], ecx
mov dword [eax - 0x10], ecx
mov dword [eax - 0xc], ecx
mov dword [eax - 8], ecx
mov dword [eax - 4], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
add eax, 0x38
mov dword [eax - 4], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [esi + 0x5f0], ecx
mov dword [esi + 0x5f4], ecx
mov dword [esi + 0x5f8], ecx
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5a3240
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5a32ac
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edi, dword [esp + 0xc]
push edi
call fcn.0065c790
add esp, 4
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x5a3296
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x5a328d
push edi
push eax
call fcn.0065d920
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x5a32a7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov al, 1
pop esi
ret
xor al, al
ret

Function at 0x5a3ab0
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x780250]
test al, al
jne 0x5a3abe
call fcn.005a3a10
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x5a3af3
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov dl, byte [ecx + edi]
xor edx, eax
and edx, 0xff
mov ebx, dword [edx*4 + 0x780258]
shr eax, 8
xor eax, ebx
inc ecx
cmp ecx, esi
jl 0x5a3ad3
pop edi
pop ebx
pop esi
ret

Function at 0x5a41a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x14
push edi
mov ebx, ecx
ja 0x5a41d1
je 0x5a41c6
mov eax, esi
sub eax, 2
je 0x5a41bc
sub eax, 0xe
jne 0x5a41f1
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x5a41f1
pop edi
pop esi
mov eax, 1
pop ebx
ret 0xc
cmp esi, 0x104
jne 0x5a41f1
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x5a420c
push 0x79
call edi
test ax, ax
jl 0x5a420c
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x5a8430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x6f61fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov ecx, dword [esp + 0x50]
push ebx
push ebp
push esi
push edi
lea esi, [esp + 0x34]
call fcn.005a7250
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x58], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x4c]
mov ebp, 0x10
cmp eax, ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x58], 1
jae 0x5a848a
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
call fcn.005a6310
add esp, 0xc
test al, al
jne 0x5a85a1
cmp dword [esp + 0x4c], ebp
mov eax, dword [esp + 0x38]
jae 0x5a84b7
lea eax, [esp + 0x38]
cmp byte [eax], bl
je 0x5a84d0
jmp 0x5a84c0
cmp byte [eax], 0x2f
jne 0x5a84c8
mov byte [eax], 0x5c
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x5a84c0
cmp dword [esp + 0x4c], ebp
mov eax, dword [esp + 0x38]
jae 0x5a84de
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x5a855a
test al, 0x10
jne 0x5a855a
push 0x34
call fcn.0065b835
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x58], 2
je 0x5a8525
cmp dword [esp + 0x4c], ebp
mov ecx, dword [esp + 0x38]
jae 0x5a8513
lea ecx, [esp + 0x38]
push 0x2000
push ebx
push ecx
mov ecx, eax
call fcn.005b1390
mov esi, eax
jmp 0x5a8527
xor esi, esi
cmp dword [esp + 0x30], ebp
jb 0x5a853a
mov edx, dword [esp + 0x1c]
push edx
call fcn.0065d0d4
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x5a85ee
mov eax, dword [esp + 0x38]
push eax
jmp 0x5a85e6
cmp dword [esp + 0x30], ebp
jb 0x5a856d
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0065d0d4
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x5a858c
mov edx, dword [esp + 0x38]
push edx
call fcn.0065d0d4
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
push 1
push eax
call fcn.005a80e0
mov esi, eax
mov eax, dword [esp + 0x38]
add esp, 8
cmp eax, ebp
jb 0x5a85cb
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0065d0d4
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x5a85ee
mov edx, dword [esp + 0x38]
push edx
call fcn.0065d0d4
add esp, 4
mov ecx, dword [esp + 0x50]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x5a9990
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
mov al, byte [0x780701]
sub esp, 0x24
test al, al
jne 0x5a99e7
push 0x7806f0
mov byte [0x780701], 1
call fcn.0065c57f
add esp, 4
rdtsc
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0x7806e8
mov dword [0x7806e0], eax
mov dword [0x7806e4], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x7806d8
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add esp, 0x24
ret
push esi
lea edx, [esp + 4]
push edi
push edx
call fcn.0065c57f
add esp, 4
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
rdtsc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [0x7806d8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov edi, dword [0x7806dc]
sub ecx, eax
sbb edx, edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
fild qword [esp + 0x14]
mov eax, dword [0x7806f0]
fild qword [0x7806e8]
mov ecx, dword [esp + 8]
push eax
push ecx
fdivp st(1)
fst qword [esp + 0x1c]
fsub qword [0x71bde8]
fstp qword [esp + 0x2c]
call fcn.00661780
fcomp qword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
add esp, 8
fnstsw ax
test ah, 0x41
jne 0x5a9a9d
mov eax, dword [0x7806e0]
mov ecx, dword [0x7806e4]
mov edx, edi
sub edx, eax
mov eax, esi
sbb eax, ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
fild qword [esp + 0x1c]
fdiv qword [esp + 0x14]
call fcn.0065ea1c
mov dword [0x7806f8], eax
mov dword [0x7806fc], edx
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [0x7806e0], edi
pop edi
mov dword [0x7806e4], esi
mov dword [0x7806f0], ecx
mov dword [0x7806d8], edx
mov dword [0x7806dc], eax
pop esi
add esp, 0x24
ret

Function at 0x5a9d10
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x5a9d38
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x5a9d35
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret
or eax, 0xffffffff
pop esi
ret

Function at 0x5a9d40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6f6371
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x71bdf8
mov dword [esp + 0x18], 0
lea edi, [esi + 0x74]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 3
call fcn.005b2a20
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.005b16b0
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 4
call fcn.005b2a20
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.005b16b0
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 0
call fcn.00401450
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], 0xffffffff
call fcn.00401450
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5a9de0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_getsockopt]
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc]
cmp ecx, 0xffffffff
lea eax, [esi + 0xc]
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
je 0x5a9e1c
push 4
push eax
mov eax, dword [esi + 4]
push 0x1002
push 0xffff
push eax
call edi
cmp eax, 0xffffffff
jne 0x5a9e3a
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x1002
push 0xffff
push edx
mov dword [esp + 0x20], 4
call ebx
mov ecx, dword [esi + 8]
cmp ecx, 0xffffffff
lea eax, [esi + 8]
je 0x5a9e64
push 4
push eax
mov eax, dword [esi + 4]
push 0x1001
push 0xffff
push eax
call edi
cmp eax, 0xffffffff
jne 0x5a9e82
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x1002
push 0xffff
push edx
mov dword [esp + 0x20], 4
call ebx
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret

Function at 0x5a9e90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6f63b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
or eax, 0xffffffff
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x18]
mov dword [esp + 8], esi
mov dword [esi], 0x71bdf8
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.005af7c0
lea ecx, [esi + 0x24]
mov dword [esp + 0x18], 0
call fcn.005af7c0
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x18], 1
mov dword [esp + 0xc], edi
call fcn.005b16d0
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 2
call fcn.005b2a60
lea edi, [esi + 0x74]
mov ecx, edi
mov byte [esp + 0x18], 3
mov dword [esp + 0xc], edi
call fcn.005b16d0
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 4
call fcn.005b2a60
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xb8], 0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5b0c00
Capabilities:
Get file size

Disassembly:
mov al, byte [ecx + 0x30]
test al, al
je 0x5b0c32
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x5b0c32
push esi
lea esi, [ecx + 8]
mov ecx, dword [ecx + 0x2c]
push edi
lea edi, [ecx + 1]
mov ecx, esi
call fcn.005b5e20
cmp eax, edi
jbe 0x5b0c2d
pop edi
mov ecx, esi
pop esi
jmp fcn.005b5e20
mov eax, edi
pop edi
pop esi
ret
add ecx, 8
jmp fcn.005b5e20

Function at 0x5b1220
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6f6868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.005b60e0
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x71bf84
call fcn.005b5ca0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x20], 1
mov dword [esi + 4], 4
mov dword [esi + 0x24], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5b1390
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6f6893
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.005b60e0
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x71bf84
call fcn.005b5ca0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov al, 1
mov byte [esp + 0x14], al
mov byte [esi + 0x20], al
mov eax, dword [esp + 0x24]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], 4
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
call fcn.005b12a0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x5b2cb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
xor edi, edi
test esi, esi
mov ebx, ecx
je 0x5b2cf8
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
push 0
push esi
lea eax, [edi + ebp]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x5b2cf0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x5b2cf4
cmp eax, 0x2738
jne 0x5b2cf8
jmp 0x5b2cf4
add edi, eax
sub esi, eax
test esi, esi
jne 0x5b2cc4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x5b5d40
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x5b5d9f
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x5b5d9f
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x5b5d60
lea edi, [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi]
push 0
push edi
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5b5d97
cmp dword [edi], ebx
je 0x5b5d88
mov eax, 2
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
ret 0xc
pop edi
mov dword [esi + 4], 0
pop esi
xor eax, eax
pop ebx
ret 0xc
mov ecx, esi
call fcn.005b5cd0
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x5b5db0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x5b5dbf
cmp eax, 2
jne 0x5b5dfd
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x5b5dfd
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x5b5dd3
lea eax, [esp + 0xc]
push 0
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5b5df6
mov dword [esi + 4], 0
xor eax, eax
pop esi
ret 0xc
mov ecx, esi
call fcn.005b5cd0
pop esi
ret 0xc

Function at 0x5b5e20
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x5b5e31
cmp eax, 2
je 0x5b5e31
xor eax, eax
pop ecx
ret
mov ecx, dword [ecx]
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop ecx
ret

Function at 0x5b6010
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x5b601f
cmp eax, 2
jne 0x5b6094
mov al, byte [esp + 0xc]
test al, al
push edi
je 0x5b6036
mov eax, dword [esp + 0xc]
mov ecx, dword [esi]
push 0
push 0
push eax
push ecx
jmp 0x5b6042
mov edx, dword [esp + 0xc]
mov eax, dword [esi]
push 1
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5b605b
mov ecx, esi
call fcn.005b5cd0
pop edi
pop esi
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x5b6067
cmp eax, 2
jne 0x5b6079
mov edx, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp edi, eax
jb 0x5b608a
pop edi
mov dword [esi + 4], 2
mov eax, 2
pop esi
ret 8
mov dword [esi + 4], 0
xor eax, eax
pop edi
pop esi
ret 8