joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f22dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x16]
lea eax, [ebp - 4]
mov ecx, 4
call fcn.0040297c
lea edx, [ebp - 0x12]
lea eax, [ebp - 8]
mov ecx, 4
call fcn.0040297c
mov ebx, dword [0x5a899c]
mov ebx, dword [ebx]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16]
mov ecx, 2
call ebx
mov byte [ebp - 0xd], 8
mov dword [ebp - 0x24], 0x597ad4
lea ebx, [ebp - 0x1e]
push ebp
xor edx, edx
mov dl, byte [ebp - 0x16]
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
call fcn.004f229c
pop ecx
mov byte [ebx], al
mov byte [ebp - 0xe], 7
mov eax, dword [ebp - 0x24]
lea esi, [eax + 1]
lea edi, [ebp - 0x15]
push ebp
xor edx, edx
mov dl, byte [edi]
xor eax, eax
mov al, byte [esi]
call fcn.004f229c
pop ecx
xor byte [ebx], al
inc edi
inc esi
dec byte [ebp - 0xe]
jne 0x4f2353
inc ebx
add dword [ebp - 0x24], 8
dec byte [ebp - 0xd]
jne 0x4f2332
xor eax, eax
mov al, byte [ebp - 0x1e]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 7
lea eax, [ebp - 0x1d]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
shl edx, 8
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
shr ecx, 0x18
or edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shl edx, 8
xor ecx, ecx
mov cl, byte [eax]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], edx
inc eax
dec byte [ebp - 0xd]
jne 0x4f238e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f23c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov eax, 0x597b14
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], 5
mov ebx, dword [edx]
xor dword [ecx], ebx
mov ebx, dword [edx + 4]
xor dword [ecx + 4], ebx
add edx, 8
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1800]
mov ebx, dword [ecx]
mov edi, ebx
shr edi, 0x17
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, ebx
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3000]
mov edi, ebx
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3800]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
or esi, 1
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1800]
mov edi, dword [ecx]
shr edi, 0x17
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, dword [ecx]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x3000]
add ebx, ebx
and ebx, 0x1fe
or ebx, 1
xor esi, dword [eax + ebx*4 + 0x3800]
mov dword [ecx + 4], esi
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
dec dword [ebp - 0x10]
jne 0x4f23ea
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
xor dword [ecx + 4], eax
add edx, 8
mov eax, dword [ecx]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x5978d4]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x5978d4]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x5978d4]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x5978d4]
xor ebx, eax
mov dword [ecx], ebx
mov eax, dword [ecx + 4]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x5978d4]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x5978d4]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x5978d4]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x5978d4]
xor ebx, eax
mov dword [ecx + 4], ebx
mov eax, dword [edx]
xor eax, dword [ecx]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [edx + 4]
xor eax, dword [ecx + 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f3048
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
jmp 0x4f305a
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
cmp edx, dword [eax]
jne 0x4f3056
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4f30b1
xor eax, eax
push ebp
push 0x4f30aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f30b1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4f5818
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4f5847
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4f58c6
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004f40c4
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4f5894
mov cx, word [esp]
sub cx, si
jmp 0x4f5896
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4f587d
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4f58bc
mov cx, word [esp]
sub cx, si
jmp 0x4f58be
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4f58a5
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4f5923
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004f54ec
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4f590e
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4f5923
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4f5822
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fbe74
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5aafa0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4fbe96
shr eax, 1
xor eax, 0xedb88320
jmp 0x4fbe98
shr eax, 1
dec edx
jne 0x4fbe84
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4fbe7d
mov byte [0x5ab3a0], 1
pop esi
pop ebx
ret

Function at 0x4fbeb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5ab3a0], 0
jne 0x4fbece
call fcn.004fbe74
mov eax, edi
sub eax, 1
jno 0x4fbeda
call fcn.004034f4
test eax, eax
jl 0x4fbf00
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5aafa0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4fbee1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x504dc8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4184a8]
call fcn.00404f8c
xor eax, eax
push ebp
push 0x504f0c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5a5ca4], 0
jne 0x504e1b
mov ecx, dword [0x5a834c]
mov dl, 1
mov eax, dword [0x407ec0]
call fcn.0040da10
call fcn.00403e44
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f80
mov eax, ebx
call fcn.00404d30
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x504f1c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004062e4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d40
test eax, eax
jle 0x504eb3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x504eac
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404750
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404738
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408e68
test eax, eax
jne 0x504eac
mov ebx, 0x15
jmp 0x504eb8
mov ebx, 0x10
jmp 0x504eb8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5a5ca4]
call fcn.00504d20
mov eax, dword [ebp - 8]
call fcn.00504d20
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004062fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504f13
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004044ec
lea eax, [ebp - 0x10]
mov edx, dword [0x4184a8]
call fcn.0040505c
ret
Function at 0x50f2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50f3aa
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x47f2b4]
call fcn.00405b2c
add esp, 4
mov eax, edi
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx], al
mov eax, edi
shr eax, 8
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
mov eax, edi
shr eax, 0x10
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
mov eax, edi
shr eax, 0x18
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
mov eax, esi
call fcn.00405970
mov edi, eax
push edi
mov eax, ebx
mov ecx, 1
mov edx, dword [0x47f2b4]
call fcn.00405b2c
add esp, 4
mov edx, edi
dec edx
test edx, edx
jl 0x50f38e
inc edx
xor eax, eax
mov ecx, eax
and ecx, 0x80000003
jns 0x50f37c
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 4]
mov cl, byte [edi + ecx]
xor cl, byte [esi + eax]
mov edi, dword [ebx]
mov byte [edi + eax], cl
inc eax
dec edx
jne 0x50f36d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f3b1
lea eax, [ebp - 4]
mov edx, dword [0x47f2b4]
call fcn.00405c2c
ret
Function at 0x5605d4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x560705
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004044c8
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404560
lea eax, [ebp - 4]
call fcn.004049d8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404988
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x5606ef
mov eax, ebx
call fcn.00402780
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5606e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404988
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5606d2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x560714
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5606d2
push esi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
call fcn.00407858
movzx eax, ax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
movzx eax, ax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
call fcn.00407858
movzx eax, ax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
movzx eax, ax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x34]
mov ecx, 3
mov eax, 0x560720
call fcn.0040a6f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5606ef
mov eax, dword [ebp - 0xc]
call fcn.004027a0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56070c
lea eax, [ebp - 4]
call fcn.004044c8
ret

Function at 0x5610c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, edx
push 0
push eax
lea eax, [ebp - 0x105]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404738
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5610f4
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x18], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404978
mov eax, dword [ebp - 8]
call fcn.00404978
xor eax, eax
push ebp
push 0x5612e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004044c8
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x1c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_CreatePipe
xor eax, eax
push ebp
push 0x5612b3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x44
call fcn.00402f80
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 0x101
mov word [ebp - 0x38], 0
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00404560
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404988
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404988
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
test bl, bl
je 0x56129c
xor eax, eax
push ebp
push 0x561295
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x14]
push eax
push 0xff
lea eax, [ebp - 0x178]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x14], 0
jbe 0x561260
mov eax, dword [ebp - 0x14]
cmp eax, 0xff
jbe 0x561235
call fcn.004034ec
mov byte [ebp + eax - 0x178], 0
lea eax, [ebp - 0x17c]
lea edx, [ebp - 0x178]
mov ecx, pe_nt_image_headers32
call fcn.00404738
mov edx, dword [ebp - 0x17c]
mov eax, esi
call fcn.00404790
test bl, bl
je 0x56126a
cmp dword [ebp - 0x14], 0
jne 0x5611ff
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56129c
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5612ba
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
Function at 0x56159c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404978
mov eax, dword [ebp - 8]
call fcn.00404978
mov eax, dword [ebp + 0x10]
call fcn.00404978
xor eax, eax
push ebp
push 0x56168b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f80
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.00404988
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
call fcn.00404988
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
call fcn.00404988
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], 0
je 0x561622
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x561629
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x561666
cmp byte [ebp + 0xc], 0
je 0x561662
mov eax, ebx
call fcn.00479cc0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0xc], 0x103
jne 0x561662
cmp byte [ebx + 0x9c], 0
je 0x56163c
mov bl, 1
jmp 0x561668
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561692
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044ec
lea eax, [ebp + 0x10]
call fcn.004044c8
ret
Function at 0x561724
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404978
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x5618be
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.005036e4
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00503704
jmp 0x561885
lea eax, [ebp - 0x13c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404738
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00409b34
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408c88
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call fcn.00408c88
mov edx, dword [ebp - 0x140]
pop eax
call fcn.004048d4
je 0x561847
lea eax, [ebp - 0x148]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404738
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00408c88
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.00408c88
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.004048d4
jne 0x56187c
lea edx, [ebp - 8]
mov eax, dword [edi + 8]
call fcn.0056169c
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
lea edx, [ebp - 0x150]
call fcn.004092a8
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.0040451c
mov edx, edi
mov eax, ebx
call fcn.00503724
test eax, eax
jne 0x5617a8
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5618c5
lea eax, [ebp - 0x150]
mov edx, 8
call fcn.004044ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044ec
ret
Function at 0x564ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x564f07
push 0
push 0
mov dx, 4
mov eax, ebx
call fcn.0056448c
cmp dword [ebx + 0x38], 0xffffffff
jne 0x564f1c
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov dx, 0x18
mov eax, ebx
call fcn.0056448c
mov eax, dword [esi]
push eax
mov edx, edi
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.00564e9c
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
test eax, eax
jns 0x564f3e
call fcn.004034ec
push eax
push edi
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x564f5d
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x564f5d
xor eax, eax
jmp 0x564f5f
mov al, 1
test al, al
jne 0x564f77
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov dx, 2
mov eax, ebx
call fcn.0056448c
mov cl, 1
mov dl, 6
mov eax, ebx
call fcn.00568cf4
mov eax, dword [ebp - 8]
test eax, eax
jns 0x564f8e
call fcn.004034ec
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x565000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x565027
push 0
push 0
mov dx, 4
mov eax, ebx
call fcn.0056448c
mov eax, dword [esi]
mov byte [eax + 0x14], 1
cmp dword [ebx + 0x38], 0xffffffff
jne 0x565042
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov dx, 0x18
mov eax, ebx
call fcn.0056448c
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
test eax, eax
jns 0x565055
call fcn.004034ec
push eax
push edi
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x565074
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x565074
xor eax, eax
jmp 0x565076
mov al, 1
test al, al
jne 0x56508e
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov dx, 3
mov eax, ebx
call fcn.0056448c
mov eax, dword [ebp - 8]
test eax, eax
jns 0x56509a
call fcn.004034ec
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x56d2cc
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404978
xor eax, eax
push ebp
push 0x56d368
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5a863c]
mov eax, dword [eax]
cmp byte [eax + 0x541], 0
jne 0x56d302
call fcn.00553b4c
mov eax, dword [0x5a863c]
mov eax, dword [eax]
mov eax, dword [eax + 0x574]
mov eax, dword [eax + 0x148]
test eax, eax
je 0x56d32a
push 0
mov edx, dword [0x5a863c]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, esi
mov dl, 1
mov eax, dword [0x562908]
call fcn.0057a0d8
mov edx, dword [0x5a863c]
mov edx, dword [edx]
mov edx, dword [edx + 0x574]
mov dword [edx + 0x148], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d36f
lea eax, [ebp - 4]
call fcn.004044c8
ret