joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf03ea0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0xf03eb9
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.00ee1940
push edx
push eax
call fcn.00ee1970
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0xf03f06
mov eax, dword [ebx + 0x148]
mov ecx, dword [ebx + 0x144]
push eax
push ecx
call fcn.00ee1940
push edx
push eax
call fcn.00ee1970
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0xf03f08
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0xf05570
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0xf055a2
push 0x2e
push esi
call fcn.00ebc740
add esp, 8
test eax, eax
je 0xf055a0
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0xf05680
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0xf387a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
mov ebp, dword [esp + 0x30]
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0xf0572a
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea esi, [esp + 0x20]
mov eax, ebp
mov byte [esp + 0x14], 8
mov byte [esp + 0x15], 2
mov dword [esp + 0x18], 0x6601
mov dword [esp + 0x1c], 8
call fcn.00f055f0
mov ecx, esi
push 8
push ecx
call fcn.00f09fb0
mov ecx, dword [esp + 0x10]
add esp, 8
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0xf0573c
mov edx, dword [esp + 4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00eb9637
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [esp + 0x20]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 4]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00eb9637
add esp, 0x24
ret
Function at 0xf05890
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf058a0
sub eax, edx
mov edi, eax
lea ebx, [edi + edi]
push ebx
call dword [0xf396e0]
mov esi, eax
add esp, 4
test esi, esi
jne 0xf058c9
pop edi
lea eax, [esi + 0x1b]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor eax, eax
test edi, edi
jbe 0xf058e0
nop
mov cl, byte [eax + ebp]
mov byte [esi + eax*2], cl
mov byte [esi + eax*2 + 1], 0
inc eax
cmp eax, edi
jb 0xf058d0
push 0xf0000000
push 1
push 0
push 0
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov edi, dword [esp + 0x28]
test eax, eax
je 0xf0595f
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8002
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0xf05952
mov edx, dword [esp + 0x10]
push 0
push ebx
push esi
push edx
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [edi + 0x10], eax
push esi
mov byte [edi + 0x14], al
call dword [0xf396e4]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0xf070d0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0xf070f2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0xf070e6
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0xf07122
cmp dword [esi + 8], 0
jne 0xf07115
mov ecx, dword [eax + 8]
push 0xf24ea4
push ecx
call fcn.00ebae0f
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0xf07115
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.00eba397
mov edi, eax
add esp, 0x10
test edi, edi
jne 0xf07144
mov eax, dword [esi + 8]
test eax, eax
je 0xf0713e
push eax
call fcn.00eba42b
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0xf09e20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0xf396e0]
mov edi, eax
add esp, 4
test edi, edi
jne 0xf09e45
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0xf09e8c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0xf09e90
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0xf09eee
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0xf09eb3
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0xf09f31
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0xf246a8
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0xf246a9
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0xf09f00
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x61cf668c
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..text_1
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x56e6134f
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10035bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100829d0]
cmp eax, 0xffffffff
je 0x10035c26
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c17
mov ecx, dword [0x10083c3c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x10083c3c], ecx
mov ecx, esi
call fcn.1001d720
mov ecx, esi
call fcn.1001d6c0
push 0x178
push esi
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
add esp, 8
push 0
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret

Function at 0x1003b2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1003b2ef
pop dword [ebp - 0x4c]
mov eax, 0x1003b2ef
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x6db62cca
add dword [ebp - 0x5c], 0xe09c1881
mov dword [ebp - 0x58], 0x2267e279
sub dword [ebp - 0x58], 0xf0349634
mov dword [ebp - 0x54], 0xaddb89b
sub dword [ebp - 0x54], 0xbe91746d
mov dword [ebp - 0x50], 0x90f0e293
sub dword [ebp - 0x50], 0x90f0e293
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xc41b58a0
sub eax, 0xb4159880
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xe252f331
sub dword [ebp - 0x5c], 0x6de089db
mov dword [ebp - 0x58], 0xd8073529
sub dword [ebp - 0x58], 0x969ad3b4
mov dword [ebp - 0x54], 0x4200ac45
add dword [ebp - 0x54], 0x216ec027
mov dword [ebp - 0x50], 0x33a7ca05
sub dword [ebp - 0x50], 0x33a7ca05
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x37891e9a
add eax, 0xd87ca182
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x570f7
push 0
call eax
mov ecx, 0xabce0914
add ecx, 0x54324df7
xor edx, edx
add edx, eax
mov ebx, 0x10091c00
add ebx, dword [ebp - 0x4c]
mov esi, 0x6e40b509
sub esi, 0x4124c8de
add dword [ebp - 0x48], 0xfbe7a756
mov edi, dword [ebx]
xor dword [ebp - 0x38], eax
xor edi, esi
sub dword [ebp - 0x48], ebx
mov dword [edx], edi
xor dword [ebp - 0x3c], ecx
add edx, 0xf30c3259
sub edx, 0xf30c3255
add ebx, 4
loop 0x1003b408
add eax, 0xf4a3d52c
add eax, 0xb5d79d3
xor ebx, ebx
add ebx, eax
add eax, 0x15c94538
add eax, 0xea36bacd
mov ecx, 0x3901a642
sub ecx, 0x2901a642
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40297e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40299c
mov eax, 0x62ca12
push eax
push 1
mov ebx, 0x585080
call fcn.00584b57
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4029c6
mov eax, 0
jmp 0x402a3a
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x402a27
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x402a10
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x4029ff
xor ecx, eax
xor edx, ebx
dec edi
jne 0x4029f0
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4

Function at 0x404124
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x4041d7
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x40900d
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40905a
mov al, cl
cmp al, 0x61
jb 0x409035
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40905a
mov al, cl
cmp al, 0x61
jb 0x40904d
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x409026
cmp edx, dword [esp + 0x18]
je 0x40906a
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40901f
xor eax, eax
jmp 0x40906d
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x409075
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40915c
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x409162
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4090c1
cmp al, 0x61
jb 0x4090b9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4090ac
cmp edx, dword [esp + 0x14]
je 0x4090d1
dec ecx
jne 0x4090a1
xor eax, eax
jmp 0x40915c
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40915c
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40915c
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40910d
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40911c
jmp 0x409104
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.0040900d
test eax, eax
je 0x40915c
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x409157
cmp al, 0x61
jb 0x40914f
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x409142
call fcn.00409075
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x40917a
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x40917a
sub edx, ecx
mov ecx, edx
jmp 0x4090d1
xor eax, eax
jmp 0x40915c
Function at 0x40c061
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov edi, eax
mov eax, dword [esi + 4]
bswap eax
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp + 8], eax
mov eax, dword [ebx + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x40c080
mov ebx, dword [ebp + 8]
mov edx, 0xfd1228e0
mov esi, 0x20
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx - 0x57e89147]
sub edi, ecx
sub esi, 1
jne 0x40c09c
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x411bfb
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x748648]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x411c36
add dword [esp], 5
retf

Function at 0x413b05
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x748648]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x413b40
add dword [esp], 5
retf

Function at 0x413c65
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x748648]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x413ca0
add dword [esp], 5
retf

Function at 0x413d3f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00413c65
mov dword [ebp - 4], 0
mov eax, dword [0x748648]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x413da2
add dword [esp], 5
retf

Function at 0x414d8d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x748648]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x414dc8
add dword [esp], 5
retf
Function at 0x4227a5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
leave
ret

Function at 0x422a5b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
leave
ret

Function at 0x428f51
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
jmp 0x428f6a
nop
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x428f89
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x428f80
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x428f78
mov eax, ebx
leave
ret

Function at 0x428fcb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 4
mov esp, ebp
pop ebp
jmp 0x428fed
nop
pop edx
pop eax
pop ecx
push edx
pushal
mov ebx, eax
mov edi, ecx
xor al, al
scasb al, byte es:[edi]
jne 0x428ff9
dec edi
sub edi, ecx
xchg ecx, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [ebx + eax + 0x78]
lea esi, [esi + ebx + 0x18]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
xchg ebp, eax
lodsd eax, dword [esi]
xchg ebp, eax
add eax, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
dec edx
je 0x429048
mov esi, dword [eax + edx*4]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x429034
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
jmp 0x42901e
shl edx, 1
add ebp, edx
movzx eax, word [ebp + ebx]
shl eax, 2
add eax, dword [esp]
mov eax, dword [ebx + eax]
add eax, ebx
pop ecx
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x42dfd1
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
jmp 0x42dfea
nop
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x42e009
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x42e000
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x42dff8
mov eax, ebx
leave
ret
Function at 0x42e04b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 4
mov esp, ebp
pop ebp
jmp 0x42e06d
nop
pop edx
pop eax
pop ecx
push edx
pushal
mov ebx, eax
mov edi, ecx
xor al, al
scasb al, byte es:[edi]
jne 0x42e079
dec edi
sub edi, ecx
xchg ecx, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [ebx + eax + 0x78]
lea esi, [esi + ebx + 0x18]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
xchg ebp, eax
lodsd eax, dword [esi]
xchg ebp, eax
add eax, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
dec edx
je 0x42e0c8
mov esi, dword [eax + edx*4]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x42e0b4
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
jmp 0x42e09e
shl edx, 1
add ebp, edx
movzx eax, word [ebp + ebx]
shl eax, 2
add eax, dword [esp]
mov eax, dword [ebx + eax]
add eax, ebx
pop ecx
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x44627e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x748648]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4462b9
add dword [esp], 5
retf

Function at 0x446828
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x748648]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x446863
add dword [esp], 5
retf

Function at 0x446940
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x44696c
add dword [esp], 5
retf

Function at 0x446b40
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x748648]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x446b7b
add dword [esp], 5
retf