joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408932
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
mov edi, 0x242768c0
call fcn.00408957
sub edi, edi
xor dword [eax], esi
inc eax
or edi, edi
mov edi, ebx
cmp eax, ecx
jne fcn.00408932
sub edi, 0x8063eb73
ret
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret
Function at 0x40dd5a
Capabilities:
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x44b9ce
call fcn.00425a64
mov ebx, ecx
mov dword [ebp - 0x34], ebx
xor edi, edi
cmp dword [ebx + 0x38], edi
je 0x40de92
cmp byte [ebx + 0x3e], 0
je 0x40de92
call fcn.00403720
movzx esi, ax
mov ecx, ebx
push esi
call fcn.0040d840
mov word [ebp - 0x3a], ax
lea eax, [ebp - 0x3a]
push eax
lea eax, [ebp - 0x36]
mov word [ebp - 0x36], si
push eax
call fcn.00404261
pop ecx
pop ecx
test al, al
je 0x40ddb2
xor al, al
jmp 0x40de94
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040e35b
mov dword [ebp - 4], edi
lea eax, [ebx + 0x40]
mov dword [ebp - 0x38], eax
jmp 0x40ddcb
mov ebx, dword [ebp - 0x34]
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040dca2
lea ecx, [ebp - 0x2c]
mov esi, dword [eax]
lea eax, [ebp - 0x40]
push eax
call fcn.0040dca2
lea ecx, [ebp - 0x2c]
mov edi, dword [eax]
call fcn.0040761f
mov ebx, dword [ebx + 0x38]
lea ecx, [ebp - 0x30]
push ecx
add eax, esi
push eax
mov esi, dword [ebx]
push edi
push dword [ebp - 0x38]
mov ecx, dword [esi + 0x20]
call dword [0x44d198]
mov ecx, ebx
call dword [esi + 0x20]
xor ebx, ebx
sub eax, ebx
je 0x40de1d
sub eax, 1
jne 0x40de73
mov esi, dword [ebp - 0x34]
jmp 0x40de23
mov esi, dword [ebp - 0x34]
mov byte [esi + 0x3e], bl
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040dca2
mov edi, dword [ebp - 0x30]
sub edi, dword [eax]
je 0x40de56
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040dca2
push dword [esi + 0x4c]
push edi
push 1
push dword [eax]
call fcn.0042f1b2
add esp, 0x10
cmp edi, eax
jne 0x40de7e
cmp byte [esi + 0x3e], bl
je 0x40de7c
test edi, edi
jne 0x40ddc8
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.004078d0
jmp 0x40ddc8
dec eax
sub eax, 1
jne 0x40de82
inc eax
jmp 0x40de80
mov bl, 1
mov al, bl
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00407dcd
mov al, bl
jmp 0x40de94
mov al, 1
call fcn.00425a0e
ret

Function at 0x416062
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub eax, edx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edx
sbb esi, esi
not esi
and esi, eax
je 0x416091
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x41607c
jmp 0x416093
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
ret 8

Function at 0x4418b6
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x28
and dword [ebp + ebp*2 + 0x50], edx
add bh, ah
adc eax, 0x5a49d65e
and bl, ch
push 0x7a
mov ch, byte [si]
insd dword es:[edi], dx
xor eax, 0x2fc5429d
lodsd eax, dword [esi]
insd dword es:[edi], dx
out dx, al
and dword [ebx], ecx
out 0xe2, al
in eax, 0x54
invalid
Function at 0x1013c94
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x101647c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x20a
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1013d7c
push ebx
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll__mbsrchr]
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x1013ce8
cmp byte [eax + 1], bl
jne 0x1013ce8
mov byte [eax], bl
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.01013a71
test eax, eax
jne 0x1013d07
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.01013b49
cmp dword [ebp + 0xc], 0x104
jb 0x1013d28
push edi
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d78
xor eax, eax
jmp 0x1013d7b
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1013d24
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1013d53
sub eax, edx
lea ecx, [eax + 1]
cmp ecx, dword [ebp + 0xc]
ja 0x1013d24
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x41c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01011c2a
leave
ret 0xc

Function at 0x40590e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ret
mov edx, ebx
mov esi, ebx
mov eax, ebx
jmp 0x40a5fe
pop eax
cmp byte [edi], 1
lea edi, [edi]
ja 0x405998
cld
nop
cld
cld
xor eax, 0xd2a7600c
jmp 0x4059fe
pop eax
imul eax, eax, 0xf
push eax
jmp 0x405abe
not edx
mov edx, edi
not edx
movzx eax, word [esi]
dec edx
pop esi
test edx, edx
dec dl
lea edx, [ebx]
xor edx, 0xffffffe7
wait
add edx, 0xffffffec
add esi, dword [edi + eax*4]
jmp 0x405a33
cld
lea edi, [eax + ebx]
lea edi, [edi]
je 0x405900
push 0
jmp 0x405997
wait
lea esi, [esi]
nop
lea edi, [edi]
nop
sbb eax, dword [esp + 4]
jne 0x40a5df
dec eax
lea esi, [ebx]
jmp 0x40a6f9
ret 4
movzx eax, byte [edi]
cmp al, 0x3a
sub dword [esp], eax
nop
lea edi, [edi + 1]
jmp 0x405975
inc ecx
lodsd eax, dword [esi]
cld
cmp ecx, dword [edx + 0x18]
jmp 0x4059eb
add eax, dword [ebx + 0x3c]
sub cl, 0xf
add edx, dword [eax + 0x78]
push 0xffffffffffffffff
add esi, dword [edx + 0x20]
pop ecx
jmp 0x40a5df
lea edi, [ebx]
add esi, dword [edx + 0x24]
test eax, 0x17dffb9d
dec eax
sbb eax, 0xdfb92d47
add edi, dword [edx + 0x1c]
lea esi, [esi + ecx*2]
push ebx
jmp 0x4059cb
Function at 0x8de16c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de172
pop ebp
sub ebp, 6
sub ebp, 0x4de16c
jmp 0x8de1d0
push ss
add byte [edi], al
add byte [eax], dl
add byte [edi + 0x67], cl
adc byte [eax + ecx*8], bh
std
xchg esi, eax
add byte [esi], 0x13
mov ebp, 0xfda259c5
mov dh, 0x4a
shl ch, 1
add byte [eax], al
add byte [edx + 0x6b], dh
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, cr3
xchg ebp, eax
pop edx
fcom dword [esi + 0x6a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
jmp 0x8de1d9
add al, 0
add byte [eax], al
jl 0x8de1b6
dec edx
jl 0x8de192
mov eax, 0x4de16c
add eax, ebp
add eax, 0x93
mov ecx, 0x62a
insb byte es:[edi], dx
loope 0x8de22a
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x62a], bh
mov edx, 0x8e94df3a
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de1f0
jmp 0x8de203
push eax
jp 0x8de258
cmp ch, byte [edx]
cmp bh, byte [edx]
push edx
cmp dh, dh
push ss
cmp bh, byte [ebx - 0x32fd2a36]
jp 0x8de1d1
retf 0x2d5
cmp bh, byte [edx]
cmp bh, byte [ebx + 0x3a3ac2fb]
cmp bh, byte [ecx]
test dword [edx + 0x3a3a3a3c], 0x3a3a1280
cmp cl, ch
fdivr dword [ecx]
mov cl, 0xbb
cmp bh, byte ss:[edx]
cmp bh, byte [ecx]
jmp [edx + 0x52]
push ds
push edx
cmp bh, byte [edx]
cmp bh, byte [edx]
sar byte [edi], cl
cmp bh, byte [edx]
cmp dl, bl
adc bh, byte [edx]
cmp bh, byte [edx]
outsd dx, dword [esi]
outsb dx, byte [esi]
mov cl, 0xbf
xor bh, byte [edx]
cmp bh, byte [edx]
mov cl, 0xaf
cmp bh, byte ss:[edx]
cmp dh, byte [ecx + 0x3a3a2ab7]
cmp bh, bl
sar dword [eax], cl
or edi, dword [eax]
mov ecx, 0x35733ef8
mov edi, 0xc5c5c5ce
clc
cmp dh, byte ss:[ecx + 0x3a3e1eb6]
cmp bh, byte [edx]
push edx
adc dword [ebx + esi], ecx
cmp dl, byte [edx + 0x7b]
xchg ecx, eax
jle 0x8de2db
cmp edx, dword [esi]
push ds
imul edx, edx, 0x3f
cmp bh, byte [edx]
cmp dl, bl
add eax, 0x6f3a3a38
mov cl, 0xd6
lds ecx, [edi + 0x36]
lds ecx, [edi + 0x32]
ror byte [eax + 0x3a], cl
cmp bh, byte [edx]
mov cl, 0x87
xor bh, byte [edx]
cmp bh, byte [edx]
mov ebx, 0xa57cdccb
or bh, byte [ebx - 0x5a832335]
or cl, byte [ecx]
or eax, ebp
mov ecx, 0x35723fd2
mov esi, 0x3a3a3a74
je 0x8de315
cmp bh, byte [edx]
xor eax, 0x3a3a72b2
cmp bl, byte [ecx + esi*4 + 0x26]
add edi, dword [edx - 0x41ca2d3f]
and byte [edx], bh
cmp bh, byte [edx]
mov edx, 0xbe35d3c1
sub edi, dword [edx]
cmp bh, byte [edx]
pop esp
mov ebx, 0x351fc5c1
mov esi, 0x3a3a3a2f
jnp 0x8de2d9
test ch, 0xc5
lds edx, [ebx]
jbe 0x8de310
cmp edi, dword [ecx - 0x2d46c005]
rol dword ds:[edi + 0x13c5c5c5], cl
outsb dx, byte [esi]
add edi, dword [eax]
mov ecx, 0xd0b93cfb
mov ecx, 0x91d33fd2
invalid
aas
mov ecx, 0x87d33ed2
invalid
xchg ebp, eax
invalid
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x1d061710
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x77594c84
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x318729bf
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x18d86173
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret

Function at 0x433003
Capabilities:
Check for software breakpoints
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x44136a
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0044151a
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x441468
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x44140b
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x44144e
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x441422
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x44143d
test al, 0x40
je 0x441434
mov ecx, dword [edi + 0x20]
jmp 0x44143b
test al, 0x80
je 0x44144e
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x44144e
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4413da
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x4a5374
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a53af
add dword [esp], 5
retf

Function at 0x4a551a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a5555
add dword [esp], 5
retf

Function at 0x4a89cc
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a5374
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a8a2c
add dword [esp], 5
retf

Function at 0x4a8c75
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a5374
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a8cd5
add dword [esp], 5
retf

Function at 0x4a8ec3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a8efe
add dword [esp], 5
retf

Function at 0x4a918f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a91ca
add dword [esp], 5
retf

Function at 0x4ab2a9
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4ab2e4
add dword [esp], 5
retf
Function at 0x4b12b3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b12ee
add dword [esp], 5
retf

Function at 0x4b15f8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b1633
add dword [esp], 5
retf

Function at 0x4b1710
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b173c
add dword [esp], 5
retf

Function at 0x4b1a71
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0xab6ddc]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b1aac
add dword [esp], 5
retf
Function at 0x4cc8a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4cc954
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004cc830
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x4cc92d
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cc960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x4cc97b
test ebp, ebp
je 0x4cc97b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4cc983
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x4cc9c3
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4cca1f
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4cca1a
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4cca05
test dl, dl
je 0x4cca01
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4cca05
add ecx, 2
add eax, 2
test dl, dl
jne 0x4cc9e5
xor eax, eax
jmp 0x4cca0a
sbb eax, eax
or eax, 1
test eax, eax
je 0x4cca29
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x4cc9d2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x4cca40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.004cc8a0
test eax, eax
jne 0x4cca58
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.004cc960
mov esi, eax
test esi, esi
jne 0x4cca8e
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x4ccaa8
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret