joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070af
Capabilities:
Resolve dns

Disassembly:
push 0x1c
mov eax, 0x4351c8
call fcn.0041f0ed
xor ebx, ebx
push str.WSHTCPIP.DLL
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x44f98c]
mov ecx, 0x44f98c
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
xor esi, esi
cmp esi, ebx
jne 0x40711f
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x68
push 5
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
call sub.DNSAPI.dll_DnsQuery_W
cmp eax, ebx
jne 0x40715e
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x40715e
push dword [eax + 0x18]
lea eax, [ebp - 0x10]
call fcn.00402842
push 1
push dword [ebp - 0x14]
call sub.DNSAPI.dll_DnsFree
mov edi, dword [ebp - 0x10]
cmp esi, 1
jne 0x40715e
push 5
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp + 0xc]
push eax
call fcn.004024a0
lea eax, [ebp - 0x18]
push eax
call fcn.00407577
add esp, 0xc
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00402413
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401603
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
jle 0x4071f3
push 0x2e
push edi
call fcn.0041e74a
pop ecx
pop ecx
cmp eax, ebx
jne 0x40717a
or eax, 0xffffffff
jmp 0x40717c
sub eax, edi
mov ecx, eax
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x10]
call fcn.00409158
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00402413
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00401603
mov eax, edi
push eax
call fcn.00408fe5
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.004024dd
mov byte [ebp - 4], 3
mov edx, dword [eax]
lea ecx, [ebp - 0x20]
call fcn.00417570
mov byte [ebp - 4], 4
push dword [eax]
mov eax, edi
call fcn.00402842
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00401603
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.00401603
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
jg 0x4071fd
inc esi
cmp esi, 2
jl 0x4070e3
push edi
push dword [ebp + 8]
call fcn.004024dd
lea eax, [edi - 0x10]
call fcn.00401603
mov eax, dword [ebp + 8]
call fcn.0041f1c5
ret
Function at 0x407386
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
lea ebp, [esp - 0x1008]
mov eax, 0x1008
call fcn.00430610
push 0xffffffffffffffff
push 0x4347d6
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x449654]
xor eax, ebp
mov dword [ebp + 0x1004], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1010]
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
mov ebx, 0x44f98c
mov ecx, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], edi
call fcn.004028d3
push edi
push edi
xor esi, esi
push edi
inc esi
push esi
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x34], esi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x28], eax
cmp eax, edi
je 0x407543
push 4
lea ecx, [ebp - 0x30]
push ecx
push 0x41
push eax
mov dword [ebp - 0x30], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [0x44f98c]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.Accept_Encoding:_gzip__deflate_r_nConnection:_Close
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], esi
call fcn.0040251a
mov eax, dword [0x44f98c]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov esi, 0x438fa4
push esi
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.0040251a
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
jle 0x40747a
push 0x439004
lea eax, [ebp - 0x14]
push eax
call fcn.00402592
push esi
lea eax, [ebp - 0x14]
push eax
call fcn.00402592
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push eax
xor esi, esi
call fcn.004024a0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00402732
push str.https:__
push eax
mov byte [ebp - 4], 4
call fcn.004025b0
mov ebx, eax
mov eax, dword [ebp - 0x2c]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00401603
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00401603
test bl, bl
je 0x4074ce
mov esi, 0x800000
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx - 0xc]
push edi
or esi, 0x4000000
push esi
push eax
push ebx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
cmp esi, edi
jne 0x4074f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407530
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x18]
push eax
push 0x1000
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax], 0
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call fcn.004045b4
cmp dword [ebp - 0x1c], edi
je 0x407530
cmp dword [ebp - 0x18], edi
jne 0x4074fb
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401603
lea eax, [ebx - 0x10]
call fcn.00401603
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1004]
xor ecx, ebp
call fcn.0041cb1b
add ebp, 0x1008
leave
ret
Function at 0x40a4d8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x449654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x4c], eax
xor ebx, ebx
xor eax, eax
push edi
cmp dword [esi + 4], ebx
je 0x40a592
push 8
pop ecx
push dword [0x45090c]
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 0x3e8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x10], eax
mov ax, word [esi]
mov word [ebp - 0xc], ax
cmp dword [ebp - 0x4c], ebx
je 0x40a565
mov eax, dword [ebp - 0x4c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a544
sub eax, edx
cmp eax, 0x20
jne 0x40a565
push dword [ebp - 0x4c]
lea eax, [ebp - 0x34]
push 0x21
push eax
call fcn.0041e761
add esp, 0xc
jmp 0x40a570
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov esi, dword [esi + 4]
push 0x10
lea eax, [esi + 0xc]
push eax
push ebx
push 0x40
lea eax, [ebp - 0x48]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
test eax, eax
setg cl
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cb1b
leave
ret 8

Function at 0x40a658
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 8], 0
je 0x40a687
call fcn.0040e5fd
push 0x1388
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40a683
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 8], 0
xor eax, eax
inc eax
pop esi
ret

Function at 0x40bd2a
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, 0x434eae
call fcn.0041f0ed
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
test eax, eax
je 0x40bd59
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [esi + 0x2c]
push eax
call fcn.0040ae2e
lea eax, [esi + 0xc]
push eax
mov byte [ebp - 4], 0
call fcn.0040ae2e
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
call fcn.0041cb10
pop ecx
mov eax, esi
call fcn.0041f1c5
ret 4

Function at 0x40d49f
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x40d4b8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xc]
sub eax, 0x10
call fcn.00401603
mov eax, dword [esi + 8]
sub eax, 0x10
call fcn.00401603
mov eax, dword [esi + 4]
sub eax, 0x10
call fcn.00401603
push esi
call fcn.0041cb10
pop ecx
mov eax, esi
ret
Function at 0x40d4e3
Capabilities:
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
cmp eax, ebx
je 0x40d6aa
push esi
push edi
push ebx
push ebx
push 3
push ebx
push 1
push closesocket
push dword [ebp + 8]
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x20], edi
cmp edi, 0xffffffff
je 0x40d65d
cmp edi, ebx
je 0x40d65d
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40d65d
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40d65d
lea eax, [ebp - 0x18]
push eax
push edi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d65d
push ebx
push esi
push dword [ebp - 0x18]
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x40d65d
cmp eax, 0xffffffff
je 0x40d65d
push esi
push ebx
push ebx
push 4
pop edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x40d65d
push ebx
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40d65d
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 2
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x40d65d
push dword [ebp - 4]
call fcn.00419894
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x40d65d
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push 2
push dword [ebp - 8]
call esi
test eax, eax
je 0x40d654
cmp dword [ebp - 4], 0x80
jae 0x40d654
xor esi, esi
cmp dword [ebp - 4], ebx
jbe 0x40d64d
xor edi, edi
mov eax, dword [ebp - 0x1c]
movzx eax, byte [esi + eax]
push eax
mov eax, pe_nt_image_headers32
sub eax, edi
push 0x44353c
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push eax
call fcn.0041deb3
add esp, 0x10
inc esi
inc edi
inc edi
cmp esi, dword [ebp - 4]
jb 0x40d622
mov dword [ebp - 0x24], 1
push dword [ebp - 0x1c]
call fcn.0041cb10
pop ecx
cmp dword [ebp - 8], ebx
je 0x40d66b
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x10], ebx
je 0x40d67a
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x14], ebx
je 0x40d688
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], ebx
je 0x40d69e
cmp dword [ebp - 0xc], 0xffffffff
je 0x40d69e
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 0x20], ebx
je 0x40d6a8
push dword [ebp - 0x20]
call esi
pop edi
pop esi
mov eax, dword [ebp - 0x24]
pop ebx
leave
ret
Function at 0x40dfbd
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x449654]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x450c8c], 0
jne 0x40e029
lea eax, [ebp - 0x29c]
push eax
push 0x202
mov dword [0x450c8c], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x40e029
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40e029
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0x45090c], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor ecx, ebp
call fcn.0041cb1b
leave
ret 4

Function at 0x40e05a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0xc]
push ebx
push edi
test eax, eax
je 0x40e091
mov ecx, dword [esi + 0x10]
test ecx, ecx
jbe 0x40e091
mov ebx, dword [ebp + 8]
push ecx
push eax
push ebx
call fcn.00422d00
push dword [esi + 0xc]
mov edi, dword [esi + 0x10]
call fcn.0041cb10
and dword [esi + 0xc], 0
add esp, 0x10
and dword [esi + 0x10], 0
jmp 0x40e0b0
push 0
push 0x7d014
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x40e13d
mov ebx, dword [ebp + 8]
cmp dword [ebx], 1
jne 0x40e13d
cmp dword [ebx + 4], 0x3e9
jne 0x40e13d
mov ebx, dword [ebx + 0x10]
cmp ebx, 0x7d000
ja 0x40e13d
add ebx, 0x14
cmp ebx, edi
jb 0x40e108
mov eax, ebx
sub eax, edi
mov dword [ebp - 4], eax
je 0x40e138
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
mov eax, esi
call fcn.0040e50e
test eax, eax
jle 0x40e13d
sub dword [ebp - 4], eax
push 1
add edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0
ja 0x40e0dd
jmp 0x40e138
mov eax, dword [esi + 0xc]
sub edi, ebx
test eax, eax
je 0x40e11c
push eax
call fcn.0041cb10
and dword [esi + 0xc], 0
pop ecx
push edi
call fcn.00419894
mov ecx, dword [ebp + 8]
push edi
add ebx, ecx
push ebx
push eax
mov dword [esi + 0xc], eax
call fcn.00422d00
add esp, 0x10
mov dword [esi + 0x10], edi
xor eax, eax
inc eax
jmp 0x40e13f
xor eax, eax
pop edi
pop ebx
leave
ret 4
Function at 0x40e444
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x449654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov dword [ebp - 0x18], eax
xor ebx, ebx
call esi
push edi
cmp eax, 0xffffffff
jne 0x40e4d2
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40e48c
movzx ecx, word [eax + 8]
cmp cx, 2
je 0x40e487
cmp cx, 0x17
jne 0x40e48c
mov eax, dword [eax + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebx + 4]
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 2
mov word [ebp - 0x12], ax
pop eax
mov word [ebp - 0x14], ax
xor eax, eax
push eax
push eax
push eax
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
call dword [sym.imp.WS2_32.dll_WSAConnect]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0041cb1b
leave
ret 8
call esi
jmp 0x40e48f

Function at 0x40e4d6
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
xor esi, esi
xor eax, eax
test edi, edi
jle 0x40e504
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [esp + 0x14]
add eax, esi
push eax
mov eax, dword [esp + 0x14]
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x40e504
add esi, eax
cmp esi, edi
jl 0x40e4df
cmp esi, edi
pop esi
jne 0x40e50b
mov eax, edi
ret 8

Function at 0x40e50e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [eax]
call dword [sym.imp.WS2_32.dll_recv]
ret 8

Function at 0x40e693
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40fe70
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 8]
push ecx
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
ja 0x40fe9c
xor eax, eax
pop edi
add esp, 0x10
ret
push ebp
push esi
lea ebp, [edi + 1]
push ebp
call fcn.00419894
push ebp
xor ebp, ebp
mov esi, eax
push ebp
push esi
call fcn.0041e9c0
add esp, 0x10
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40fee4
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x443548
push esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40feed
pop esi
pop ebp
xor eax, eax
pop edi
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0xa]
mov dx, word [eax + 8]
mov di, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
mov ecx, dword [esp + 0x20]
push edx
push eax
push 0x44354c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp esi, ebp
je 0x40ff2e
push esi
call fcn.0041d4a0
add esp, 4
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x10
ret
Function at 0x410710
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1000
jae 0x410723
xor eax, eax
jmp 0x410778
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41073d
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x410741
xor eax, eax
jmp 0x410778
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x41075c
xor eax, eax
jmp 0x410778
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 4]
xor edx, edx
cmp ecx, 0x14c
sete dl
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x410810
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x410822
cmp dword [ebp + 0x10], 0
jne 0x410829
xor eax, eax
jmp 0x410973
cmp dword [ebp + 8], 0
jne 0x410836
xor eax, eax
jmp 0x410973
mov dword [ebp - 0x14], 0
push 0x43eac4
call fcn.004105c0
call fcn.004106b0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jne 0x410880
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410a70
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x410973
push 0x43eae8
push 0x43eaf8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4108a7
xor eax, eax
jmp 0x410973
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
test eax, eax
jne 0x4108c4
xor eax, eax
jmp 0x410973
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00410710
add esp, 0xc
test eax, eax
jne 0x4108ea
xor eax, eax
jmp 0x410973
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0xc]
je 0x4108f6
xor eax, eax
jmp 0x410973
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x41090a
mov dword [ebp - 4], 1
cmp dword [0x450c90], 0
jne 0x410922
mov dword [0x450c90], 1
call fcn.00410a00
cmp dword [ebp - 4], 0
je 0x41094d
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410e60
add esp, 0x18
mov dword [ebp - 0x14], eax
jmp 0x410970
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410a70
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4109a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00411a70
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4109d0
cmp dword [ebp - 4], 0
jne 0x4109f1
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x412260
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
jle 0x412296
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x4122a4
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0x10], 0
jle 0x4122d9
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x54], eax
jmp 0x4122e7
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
jle 0x41231c
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x41232a
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
jle 0x41235f
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x64], edx
jmp 0x41236d
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 8
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x48], 0
xor eax, eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x44], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0x48], esp
and esp, 0xfffffff0
push 0x33
call 0x4123cd
add dword [esp], 5
retf

Function at 0x412460
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
je 0x412480
cmp dword [ebp + 0xc], 0
jne 0x41247a
cmp dword [ebp + 0x10], 0
je 0x412480
cmp dword [ebp + 0x14], 0
jne 0x412482
jmp 0x4124d5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.00412495
pop edi
pop esi
mov esp, ebp
pop ebp
ret