joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55c3b0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x674010]
sub esp, 0x190
test eax, eax
je 0x55c3cb
mov eax, 1
add esp, 0x190
ret
push edi
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
pop edi
je 0x55c400
xor eax, eax
add esp, 0x190
ret
mov eax, 1
mov dword [0x674010], eax
add esp, 0x190
ret

Function at 0x55eca0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5f3543
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x650810]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x650810]
mov dword [esp + 0x14], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x650810]
mov dword [esi + 0x20], edx
mov eax, dword [0x650810]
mov dword [esi + 0x24], eax
mov ecx, dword [0x650810]
mov dword [esi + 0x28], ecx
mov edx, dword [0x650810]
mov dword [esi + 0x2c], edx
mov eax, dword [0x650810]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 6
call fcn.005cf1d1
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 7
call fcn.005cf1d1
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x14], 8
push ecx
mov ecx, edi
mov dword [esi], 0x6066e4
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0x10
mov dword [esi + 0x10], 2
mov dword [esi + 0x14], 1
call fcn.005d0f30
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x55ef30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f3693
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x650810]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x650810]
mov dword [esp + 0x1c], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x650810]
mov dword [esi + 0x20], edx
mov eax, dword [0x650810]
lea ebp, [esi + 0x24]
mov dword [ebp], eax
mov ecx, dword [0x650810]
lea ebx, [esi + 0x28]
mov dword [ebx], ecx
mov edx, dword [0x650810]
mov dword [esi + 0x2c], edx
mov eax, dword [0x650810]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 6
call fcn.005cf1d1
lea ecx, [esi + 0x48]
mov byte [esp + 0x1c], 7
call fcn.005cf1d1
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esi + 0xc], ecx
push eax
mov ecx, edi
mov byte [esp + 0x20], 8
mov dword [esi], 0x6066e4
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 1
call fcn.005d0f30
mov eax, dword [esp + 0x30]
test eax, eax
je 0x55efff
push eax
mov ecx, ebx
call fcn.005d0f30
mov eax, dword [esp + 0x34]
test eax, eax
je 0x55f00f
push eax
mov ecx, ebp
call fcn.005d0f30
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x560990
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.00478320
test eax, eax
je 0x5609ae
mov dword [0x67401c], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x5609c9
mov dword [0x67401c], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push esi
push 2
push edi
push edi
mov dword [0x67401c], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x5609f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
je 0x560a1a
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x560a58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x560a8f
jne 0x560a58
test esi, esi
jne 0x560a3e
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x560a3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x560a58
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x560a58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebp, eax
test ebp, ebp
jne 0x560aaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x67401c], eax
jne 0x560a98
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x560aaf
mov eax, dword [0x67401c]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x560aaf
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x560aaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x67401c], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x560abc
push edi
call ebx
test esi, esi
je 0x560ac3
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x560cd0
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
call fcn.00478320
test eax, eax
je 0x560cec
mov dword [0x67401c], 0x32
xor eax, eax
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
push 1
rep stosd dword es:[edi], eax
push ebp
push ebp
mov dword [0x67401c], ebp
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebp
jne 0x560d2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, ebp
mov ebp, dword [esp + 0x34]
je 0x560d49
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x560d83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x560d9f
jne 0x560d83
test esi, esi
jne 0x560d6d
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x560d6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x560d83
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x560d83
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebp, eax
test ebp, ebp
jne 0x560dbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x560da3
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x560daf
mov dword [0x67401c], ebx
jmp 0x560dc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x67401c], eax
jmp 0x560dc6
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x560dd3
push edi
call ebx
test esi, esi
je 0x560dda
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x5616a0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x5f38bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push esi
push edi
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.005cf1d1
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x634], esi
test eax, eax
je 0x5616e4
push eax
lea ecx, [esp + 0x14]
call fcn.005cf3ad
mov eax, dword [esp + 0x660]
test eax, eax
je 0x5616f9
push eax
lea ecx, [esp + 0x14]
call fcn.005cf3ad
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x22d]
mov byte [esp + 0x22c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x400
test eax, eax
jle 0x561778
lea eax, [esp + 8]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00496890
add esp, 0x10
test eax, eax
jne 0x561771
lea ecx, [esp + 0x10]
mov dword [esp + 0x634], 0xffffffff
call fcn.005cf204
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x624]
mov dword fs:[0], ecx
add esp, 0x630
ret
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0x64c]
mov ecx, dword [esp + 0x668]
mov edx, dword [esp + 0x664]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
mov edx, dword [esp + 0x65c]
push esi
mov esi, dword [esp + 0x654]
push 0
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebp, eax
test ebp, ebp
je 0x561831
mov ebx, dword [esp + 0x658]
test ebx, ebx
je 0x561831
test esi, esi
je 0x561831
call fcn.0043d1a0
mov eax, dword [0x670c18]
test eax, eax
je 0x561831
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x30]
push 0x104
push edx
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.00493e90
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x2c]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x670c18]
lea ecx, [esp + 0x18]
mov dword [esp + 0x63c], 0xffffffff
call fcn.005cf204
mov ecx, dword [esp + 0x634]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x630
ret
Function at 0x562080
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x56209d
cmp edi, 4
jbe 0x56209d
mov dword [0x674020], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x5620bc
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.0046afd0
cmp edi, 0xffffffff
je 0x5620d0
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.0046afd0
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x5620e8
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.0046afd0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5620fe
push eax
mov eax, dword [0x664e70]
push eax
mov ecx, esi
call fcn.0046b180
mov eax, dword [esp + 0x24]
test eax, eax
je 0x562115
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.0046b180
mov edx, dword [esp + 0x28]
test edx, edx
je 0x56213b
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [str.ImagePath]
push 2
push eax
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x562151
push eax
mov eax, dword [str.Group]
push eax
mov ecx, esi
call fcn.0046b180
mov eax, dword [esp + 0x30]
test eax, eax
je 0x562168
mov ecx, dword [str.DependOnGroup]
push eax
push ecx
mov ecx, esi
call fcn.0046b610
mov eax, dword [esp + 0x34]
test eax, eax
je 0x56217f
mov edx, dword [str.DependOnService]
push eax
push edx
mov ecx, esi
call fcn.0046b610
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x563120
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f3b00
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x563153
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp byte [esi], 0
jne 0x56316a
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.00469d70
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.00469e90
test eax, eax
je 0x563216
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.0046c390
test eax, eax
jne 0x5631cb
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00469e10
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x5631fe
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.0046a4c0
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.005d0ee0
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.005d0da7
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x5632dd
mov dword [eax], 0x10
jmp 0x5632dd
mov edx, dword [0x650810]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x633274
push ecx
mov byte [esp + 0x24], 2
call fcn.005ce66f
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00469e90
test eax, eax
jne 0x56328a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.005d0da7
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00469e10
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x5632c1
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.0046a4c0
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.005d0ee0
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.005d0da7
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5632cf
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.005d0da7
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00469e10
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x563310
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f3b28
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x56341f
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x56341f
cmp byte [edi], bl
je 0x56341f
cmp byte [esi], bl
je 0x56341f
lea ecx, [esp + 0xc]
call fcn.00469d70
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x5633bd
cmp eax, 1
je 0x5633bd
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.00469e90
test eax, eax
jne 0x5633ab
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.00469f00
test eax, eax
je 0x56340e
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0046b180
mov esi, eax
jmp 0x5634a2
mov edx, dword [0x650810]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x633274
push ecx
mov byte [esp + 0x2c], 1
call fcn.005ce66f
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00469e90
test eax, eax
jne 0x563433
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.005d0da7
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00469e10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x650810]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.004416fe
add esp, 8
cmp eax, ebx
je 0x56345b
inc eax
lea ecx, [esp + 0x2c]
push eax
call fcn.005d0f30
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x563474
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.005d0da7
jmp 0x563401
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0046b180
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.005d0da7
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.005d0da7
lea ecx, [esp + 0xc]
call fcn.00469ee0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00469e10
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x564db0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5f3f2c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x650810]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [edi], eax
mov ecx, dword [0x650810]
lea ebp, [esi + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [ebp], ecx
mov edx, dword [0x650810]
mov dword [esi + 0x20], edx
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.005d0160
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 3
mov dword [esi], 0x6066e8
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x24], 0xffff
call fcn.005d0f30
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x30]
test eax, 0xffff0000
mov word [esi + 0x24], cx
mov dword [esi + 0x14], eax
je 0x564e53
push eax
mov ecx, ebp
call fcn.005d0f30
mov edx, dword [ebp]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x2c]
test eax, 0xffff0000
mov dword [esi + 0x1c], eax
je 0x564e71
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.005d0f30
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x5688d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x606738
push 0x442ef4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x568962
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x56895b
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x56895b
cmp word [eax + 0x14], dx
je 0x56895b
cmp dword [ebp + 0xc], edx
je 0x568935
cmp word [eax + 4], 0x14c
jne 0x56895b
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x568a50
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x568a9d
mov edi, dword [esp + 0x18]
test edi, edi
je 0x568a9d
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x568a9d
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x568a95
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x568aa4
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x568a86
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x569370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x606748
push 0x442ef4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00568af0
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x569423
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x56941c
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56c400
Capabilities:
Get file size

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
mov dword [esp + 0x30], 0
call fcn.0056a9e0
add esp, 0x2c
test eax, eax
je 0x56c4e8
mov eax, dword [esp + 4]
cmp eax, 4
jne 0x56c474
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.005848e0
mov edx, dword [0x6748c0]
mov ecx, dword [0x6748c4]
add esp, 8
mov dword [0x674080], edx
mov edx, dword [0x6748c8]
mov dword [0x674084], ecx
mov dword [0x674088], edx
pop esi
pop ecx
ret
cmp eax, 3
jne 0x56c4ae
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.00576c60
mov ecx, dword [0x674130]
mov edx, dword [0x674134]
add esp, 8
mov dword [0x674080], ecx
mov ecx, dword [0x674138]
mov dword [0x674084], edx
mov dword [0x674088], ecx
pop esi
pop ecx
ret
mov edx, dword [esp + 0x10]
cmp eax, 6
push edx
push esi
jne 0x56c4ee
call fcn.00595820
mov ecx, dword [0x674ed8]
mov edx, dword [0x674edc]
add esp, 8
mov dword [0x674080], ecx
mov ecx, dword [0x674ee0]
mov dword [0x674084], edx
mov dword [0x674088], ecx
pop esi
pop ecx
ret
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
pop ecx
ret
Function at 0x56f450
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
xor esi, esi
cmp ebx, esi
je 0x56f5a8
cmp ebx, 0xffffffff
je 0x56f5a8
cmp dword [0x674090], esi
je 0x56f5a8
mov ecx, dword [0x674098]
cmp ecx, esi
je 0x56f5a8
mov eax, dword [0x674094]
cmp eax, esi
jge 0x56f499
neg eax
cmp ecx, eax
ja 0x56f5a8
push edi
push ecx
mov dword [esp + 0x10], esi
call fcn.005d1478
mov edi, eax
add esp, 4
cmp edi, esi
mov dword [esp + 0x20], edi
je 0x56f59d
mov ecx, dword [0x674098]
xor eax, eax
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 1
and ecx, 3
mov dword [esp + 0x1c], esi
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [0x674098]
mov esi, dword [0x674094]
lea eax, [esp + 0x18]
push eax
push 0
push ebx
mov dword [esp + 0x24], 0
call edi
xor ecx, ecx
mov dword [esp + 0x1c], eax
test esi, esi
setl cl
dec ecx
and ecx, 0xfffffffe
add ecx, 2
push ecx
push 0
push esi
push ebx
call edi
cmp eax, 0xffffffff
je 0x56f58f
mov eax, dword [esp + 0x28]
test eax, eax
je 0x56f520
xor esi, esi
jmp 0x56f536
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x18]
push 0
push edx
push ebp
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push ebx
call edi
test esi, esi
je 0x56f58f
mov ebp, dword [0x674038]
xor edx, edx
test ebp, ebp
jle 0x56f58f
mov ebx, dword [0x674034]
mov eax, dword [ebx]
mov esi, dword [esp + 0x18]
mov ecx, dword [eax + 8]
cmp esi, ecx
jb 0x56f575
mov edi, dword [eax + 4]
mov esi, dword [esp + 0x24]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x56f587
inc edx
add ebx, 4
cmp edx, ebp
mov dword [esp + 0x10], 0
jge 0x56f58f
jmp 0x56f55b
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x24]
push ecx
call fcn.005d14a1
add esp, 4
pop ebp
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret