joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405450
Capabilities:
Reference 114dns dns server
Reference alidns dns server

Disassembly:
push 0xffffffffffffffff
push 0x429a29
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x20], ebx
mov eax, dword [0x44130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44130c
call edx
mov ecx, dword [esp + 0x68]
add eax, 0x10
mov dword [ecx], eax
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x24]
mov dword [esp + 0x60], ebx
mov esi, 1
push edx
mov dword [esp + 0x24], esi
call fcn.00405600
mov dword [esp + 0x60], esi
mov dword [esp + 0x28], str.114.114.114.114
mov dword [esp + 0x2c], str.223.5.5.5
xor ebp, ebp
mov eax, dword [0x44130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44130c
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x60], 2
mov ecx, dword [esp + ebp*4 + 0x28]
cmp ecx, ebx
jne 0x4054f1
xor eax, eax
jmp 0x4054ff
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4054f6
sub eax, esi
mov edi, eax
push ecx
lea eax, [esp + 0x1c]
call fcn.004039d0
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x30]
push eax
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
call fcn.00405110
mov ecx, dword [esp + 0x24]
add esp, 8
shr ecx, 2
cmp eax, ebx
je 0x405538
cmp ecx, ebx
jg 0x405569
lea eax, [esi - 0x10]
mov byte [esp + 0x60], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405559
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebp
cmp ebp, 2
jb 0x4054ca
mov ebp, dword [esp + 0x68]
jmp 0x4055b9
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
cmp eax, ebx
jne 0x40557c
xor ecx, ecx
jmp 0x40558a
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x405581
sub ecx, edi
mov ebp, dword [esp + 0x68]
push eax
mov edi, ecx
mov eax, ebp
call fcn.004039d0
lea eax, [esi - 0x10]
mov byte [esp + 0x60], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4055b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x60], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4055dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x405ff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x429e18
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 4]
push eax
call fcn.0040e400
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov byte [esi + 0x20], al
lea eax, [esi + 0x40]
push eax
mov byte [esp + 0x18], 1
call fcn.0040e400
fldz
fstp qword [esi + 0x38]
mov dword [esi], 5
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x409050
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x43b14c]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
push 0x228
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x14], 0
call fcn.0041a890
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x40916b
cmp esi, 0xffffffff
je 0x40916b
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x409149
jmp 0x4090c0
lea edx, [esp + 0x2c]
push str.EXPLORER.EXE
push edx
call fcn.00419bb0
add esp, 8
test eax, eax
je 0x409108
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4090c0
push esi
lea edi, [eax + 1]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00419054
add esp, 0x230
ret
mov ecx, dword [esp + 0x10]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00419054
add esp, 0x230
ret
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00419054
add esp, 0x230
ret
mov ecx, dword [esp + 0x234]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00419054
add esp, 0x230
ret
Function at 0x409f40
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x43b14c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x409f9d
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00419054
add esp, 0x14
ret
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x409fb6
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
pop ebx
xor ecx, esp
call fcn.00419054
add esp, 0x14
ret

Function at 0x409fe0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x43b14c]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [esp + 0x10]
lea esi, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call fcn.00409e90
test eax, eax
je 0x40a08e
cmp dword [esp + 0xc], 6
jbe 0x40a08e
call fcn.00409f40
test eax, eax
jne 0x40a08e
push 0x208
lea ecx, [esp + 0x56]
push ebx
push ecx
mov word [esp + 0x5c], ax
call fcn.0041a890
add esp, 0xc
lea edx, [esp + 0x50]
push 0x104
push edx
call fcn.00408cd0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [esp + 0x1c]
push ebx
push eax
mov dword [esp + 0x20], 0x3c
call fcn.0041a890
add esp, 0xc
lea edx, [esp + 0x14]
lea ecx, [esp + 0x50]
push edx
mov dword [esp + 0x24], str.runas
mov dword [esp + 0x28], ecx
mov dword [esp + 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
lea eax, [ebx + 1]
jne 0x40a090
mov eax, ebx
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00419054
add esp, 0x254
ret
Function at 0x40b3c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x429d88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
mov edi, dword [eax + 8]
mov ebp, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [0x44130c]
xor ebx, ebx
mov dword [esp + 0x28], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x44130c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], edi
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x44]
lea eax, [esp + 0x40]
call fcn.00403710
mov edx, dword [esp + 0x40]
cmp dword [edx - 4], 1
jle 0x40b44b
mov ecx, dword [edx - 0xc]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.004037a0
mov edx, dword [esp + 0x40]
push ebp
lea ebx, [esp + 0x20]
mov ecx, edi
call fcn.00412860
add esp, 4
test eax, eax
je 0x40b580
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x40b580
push ebx
call fcn.00418e1e
add esp, 4
push ebx
mov edi, eax
push 0
push edi
call fcn.0041a890
mov edx, dword [esp + 0x4c]
add esp, 0xc
cmp dword [edx - 4], 1
jle 0x40b4a1
mov eax, dword [edx - 0xc]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.004037a0
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
push edi
push ebp
call fcn.00412900
add esp, 8
test eax, eax
jne 0x40b50a
mov esi, str._ustr
call fcn.00401990
test edi, edi
je 0x40b4ca
push edi
call fcn.00419049
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b4f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea edx, [esp + 0x20]
push edx
push ebx
xor ebp, ebp
push edi
mov dword [esp + 0x2c], ebp
call fcn.00410aa0
add esp, 0xc
test eax, eax
jne 0x40b52a
mov esi, str._u6pf
jmp 0x40b4b8
cmp edi, ebp
je 0x40b573
cmp ebx, ebp
jne 0x40b536
cmp ebp, ebp
je 0x40b573
mov eax, dword [esi]
cmp eax, ebp
jne 0x40b547
push ebx
call fcn.00419140
add esp, 4
jmp 0x40b556
mov ecx, dword [esi + 8]
add ecx, ebx
push ecx
push eax
call fcn.0041920a
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x40b573
mov edx, dword [esi + 8]
push ebx
push edi
add edx, eax
push ebx
push edx
call fcn.00419425
add esp, 0x10
add dword [esi + 8], ebx
adc dword [esi + 0xc], ebp
mov dword [esp + 0x18], 1
jmp 0x40b4bd
push 0x42cf84
push 0x4420d8
mov edx, 1
call fcn.00403d60
push str._ulen
push 0x4420d8
mov edx, 5
call fcn.00403d60
jmp 0x40b4ca
Function at 0x410620
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4297b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, ebx
mov edi, edx
mov dword [esp + 0x18], 0
call fcn.00401380
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov edi, esp
call fcn.00401510
sub esi, ebx
sar esi, 2
push esi
add eax, 0x10
push 0
push ebx
mov dword [edi], eax
call fcn.00410120
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4106a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4106c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 8]
push ecx
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
ja 0x4106ec
xor eax, eax
pop edi
add esp, 0x10
ret
push ebp
push esi
lea ebp, [edi + 1]
push ebp
call fcn.00418e1e
push ebp
xor ebp, ebp
mov esi, eax
push ebp
push esi
call fcn.0041a890
add esp, 0x10
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x410734
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x437854
push esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x41073d
pop esi
pop ebp
xor eax, eax
pop edi
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0xa]
mov dx, word [eax + 8]
mov di, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
mov ecx, dword [esp + 0x20]
push edx
push eax
push 0x437858
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp esi, ebp
je 0x41077e
push esi
call fcn.004199c3
add esp, 4
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x10
ret

Function at 0x410aa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1000
jae 0x410ab3
xor eax, eax
jmp 0x410b08
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410acd
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x410ad1
xor eax, eax
jmp 0x410b08
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x410aec
xor eax, eax
jmp 0x410b08
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 4]
xor edx, edx
cmp ecx, 0x14c
sete dl
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x410ba0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x410bb2
cmp dword [ebp + 0x10], 0
jne 0x410bb9
xor eax, eax
jmp 0x410ce8
cmp dword [ebp + 8], 0
jne 0x410bc6
xor eax, eax
jmp 0x410ce8
mov dword [ebp - 0x14], 0
push 0x432ebc
call fcn.00410950
call fcn.00410a40
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jne 0x410c10
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410cf0
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x410ce8
push 0x432ee0
push 0x432ef0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410c37
xor eax, eax
jmp 0x410ce8
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
test eax, eax
jne 0x410c54
xor eax, eax
jmp 0x410ce8
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00410aa0
add esp, 0xc
test eax, eax
jne 0x410c77
xor eax, eax
jmp 0x410ce8
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0xc]
je 0x410c83
xor eax, eax
jmp 0x410ce8
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x410c97
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x410cc2
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004110e0
add esp, 0x18
mov dword [ebp - 0x14], eax
jmp 0x410ce5
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410cf0
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x411b90
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
jle 0x411bc6
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x411bd4
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0x10], 0
jle 0x411c09
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x54], eax
jmp 0x411c17
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
jle 0x411c4c
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x411c5a
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
jle 0x411c8f
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x64], edx
jmp 0x411c9d
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 8
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x48], 0
xor eax, eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x44], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0x48], esp
and esp, 0xfffffff0
push 0x33
call 0x411cfd
add dword [esp], 5
retf

Function at 0x411d90
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
je 0x411db0
cmp dword [ebp + 0xc], 0
jne 0x411daa
cmp dword [ebp + 0x10], 0
je 0x411db0
cmp dword [ebp + 0x14], 0
jne 0x411db2
jmp 0x411e05
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.00411dc5
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411e10
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
cmp dword [ebp + 8], 0
je 0x411e30
cmp dword [ebp + 0xc], 0
jne 0x411e2a
cmp dword [ebp + 0x10], 0
je 0x411e30
cmp dword [ebp + 0x14], 0
jne 0x411e34
xor al, al
jmp 0x411e98
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.00411e4b
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x411ea0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.00411ebb
Function at 0x414730
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x414737
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x414814
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4324e0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4324e0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4324e0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4324e0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4324e0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4324e0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4324e0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4324e0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x414750
pop edi
test edx, edx
je 0x41483b
jmp 0x414820
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4324e0]
inc ecx
sub edx, 1
jne 0x414820
not eax
pop esi
ret

Function at 0x414840
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4324e0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4324e0]
mov dword [edx + 8], ecx
ret

Function at 0x414890
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x4324e0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4324e0]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x414fe0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x415012
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x415008
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x415025
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0041d6c0
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x415040
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x415073
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41506d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x41509f
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x415085
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.0041d6c0
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x4150b6
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x4150b0
cmp byte [esi + 8], 0
je 0x4150b0
or eax, 0xffffffff
add esp, 8
ret