joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070e1
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43514c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x407149
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40713d
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00413194
leave
ret

Function at 0x407156
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1d4]
sub esp, 0x254
mov eax, dword [0x43514c]
xor eax, ebp
mov dword [ebp + 0x1d0], eax
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [ebp - 0x44]
lea esi, [ebp - 0x40]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
call fcn.00407061
test eax, eax
je 0x4071fa
cmp dword [ebp - 0x40], 6
jbe 0x4071fa
call fcn.004070e1
test eax, eax
jne 0x4071fa
push 0x208
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x3a]
push ebx
push eax
call fcn.00414a20
add esp, 0xc
lea eax, [ebp - 0x3c]
push 0x104
push eax
call fcn.004066e6
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x38
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x3c
call fcn.00414a20
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x70], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x74], str.runas
mov dword [ebp - 0x64], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4071fa
inc ebx
mov ecx, dword [ebp + 0x1d0]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00413194
add ebp, 0x1d4
leave
ret
Function at 0x407214
Capabilities:
Resolve dns

Disassembly:
push 0x1c
mov eax, 0x424315
call fcn.0041514d
xor ebx, ebx
push str.WSHTCPIP.DLL
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov eax, dword [0x43b30c]
mov ecx, 0x43b30c
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
xor esi, esi
cmp esi, ebx
jne 0x407284
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x68
push 5
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
call sub.DNSAPI.dll_DnsQuery_W
cmp eax, ebx
jne 0x4072c3
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4072c3
push dword [eax + 0x18]
lea eax, [ebp - 0x10]
call fcn.004025a2
push 1
push dword [ebp - 0x14]
call sub.DNSAPI.dll_DnsFree
mov edi, dword [ebp - 0x10]
cmp esi, 1
jne 0x4072c3
push 5
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp + 0xc]
push eax
call fcn.00402644
lea eax, [ebp - 0x18]
push eax
call fcn.004076dd
add esp, 0xc
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00402561
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040159d
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
jle 0x407359
push 0x2e
push edi
call fcn.004149fc
pop ecx
pop ecx
cmp eax, ebx
jne 0x4072df
or eax, 0xffffffff
jmp 0x4072e1
sub eax, edi
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x10]
call fcn.004091fe
mov edi, ebx
mov byte [ebp - 4], 2
call fcn.00402561
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.0040159d
mov eax, ebx
push eax
call fcn.0040908b
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.00402681
mov byte [ebp - 4], 3
mov edx, dword [eax]
lea ecx, [ebp - 0x20]
call fcn.00410c80
mov byte [ebp - 4], 4
push dword [eax]
mov eax, ebx
call fcn.004025a2
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.0040159d
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.0040159d
mov edi, dword [ebp - 0x10]
xor ebx, ebx
cmp dword [edi - 0xc], ebx
jg 0x407363
inc esi
cmp esi, 2
jl 0x407248
push edi
push dword [ebp + 8]
call fcn.00402681
lea eax, [edi - 0x10]
call fcn.0040159d
mov eax, dword [ebp + 8]
call fcn.00415225
ret
Function at 0x4074ec
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
lea ebp, [esp - 0x1008]
mov eax, 0x1008
call fcn.0041ffb0
push 0xffffffffffffffff
push 0x423be9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x43514c]
xor eax, ebp
mov dword [ebp + 0x1004], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1010]
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
mov ebx, 0x43b30c
mov ecx, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], edi
call fcn.00401281
push edi
push edi
xor esi, esi
push edi
inc esi
push esi
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x34], esi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x28], eax
cmp eax, edi
je 0x4076a9
push 4
lea ecx, [ebp - 0x30]
push ecx
push 0x41
push eax
mov dword [ebp - 0x30], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [0x43b30c]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.Accept_Encoding:_gzip__deflate_r_nConnection:_Close
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], esi
call fcn.004026be
mov eax, dword [0x43b30c]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov esi, 0x42728c
push esi
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.004026be
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
jle 0x4075e0
push 0x4272ec
lea eax, [ebp - 0x14]
push eax
call fcn.00402736
push esi
lea eax, [ebp - 0x14]
push eax
call fcn.00402736
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push eax
xor esi, esi
call fcn.00402644
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004028d6
push str.https:__
push eax
mov byte [ebp - 4], 4
call fcn.00402754
mov ebx, eax
mov eax, dword [ebp - 0x2c]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040159d
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.0040159d
test bl, bl
je 0x407634
mov esi, 0x800000
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx - 0xc]
push edi
or esi, 0x4000000
push esi
push eax
push ebx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
cmp esi, edi
jne 0x40765e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x407696
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x18]
push eax
push 0x1000
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax], 0
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call fcn.0040466b
cmp dword [ebp - 0x1c], edi
je 0x407696
cmp dword [ebp - 0x18], edi
jne 0x407661
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040159d
lea eax, [ebx - 0x10]
call fcn.0040159d
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1004]
xor ecx, ebp
call fcn.00413194
add ebp, 0x1008
leave
ret
Function at 0x40833c
Capabilities:
Create process on windows
Create service
Persist via windows service
Start service

Disassembly:
push 0x1c
mov eax, 0x4238e5
call fcn.0041514d
mov eax, dword [0x43b30c]
and dword [ebp - 0x20], 0
mov esi, 0x43b30c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov eax, dword [0x43b30c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0xa
push 0x64
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004012ff
mov ebx, eax
call fcn.00412b00
pop ecx
call fcn.00402923
push 0xa
push 0x64
lea esi, [ebp - 0x14]
call fcn.004012ff
mov ebx, eax
call fcn.00412b00
pop ecx
call fcn.00402923
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.004011c7
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
je 0x40845c
push esi
push str.LocalSystem
push esi
push esi
push esi
push dword [ebp + 8]
push 1
push 2
push 0x10
push 0xf01ff
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x40846a
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x40845c
mov eax, dword [0x43b30c]
mov ecx, 0x43b30c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push str.sc.exe_start__s
call fcn.00401552
mov edi, dword [ebp - 0x18]
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x24]
push eax
call fcn.0040251b
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.0040159d
lea eax, [edi - 0x10]
call fcn.0040159d
cmp dword [ebp - 0x1c], esi
je 0x40846a
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, esi
je 0x408475
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040159d
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040159d
mov eax, dword [ebp - 0x20]
call fcn.00415225
ret
Function at 0x408494
Capabilities:
Create process on windows
Stop service

Disassembly:
push 0x28
mov eax, 0x4238b2
call fcn.0041514d
mov esi, 0xf003f
push esi
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x40853d
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, edi
je 0x40854b
lea eax, [ebp - 0x34]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x408540
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x426
je 0x408540
mov eax, dword [0x43b30c]
mov ecx, 0x43b30c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str.sc.exe_stop__s
mov dword [ebp - 4], edi
call fcn.00401552
mov esi, dword [ebp - 0x10]
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.0040251b
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040159d
lea eax, [esi - 0x10]
call fcn.0040159d
jmp 0x408540
mov ebx, dword [ebp - 0x18]
cmp ebx, edi
je 0x40854b
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x14], edi
je 0x408559
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.00415225
ret
Function at 0x40a410
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 8]
push ecx
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
ja 0x40a43c
xor eax, eax
pop edi
add esp, 0x10
ret
push ebp
push esi
lea ebp, [edi + 1]
push ebp
call fcn.00412f5e
push ebp
xor ebp, ebp
mov esi, eax
push ebp
push esi
call fcn.00414a20
add esp, 0x10
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40a484
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x431768
push esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40a48d
pop esi
pop ebp
xor eax, eax
pop edi
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0xa]
mov dx, word [eax + 8]
mov di, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
mov ecx, dword [esp + 0x20]
push edx
push eax
push 0x43176c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp esi, ebp
je 0x40a4ce
push esi
call fcn.00413aac
add esp, 4
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x10
ret

Function at 0x40a7f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1000
jae 0x40a803
xor eax, eax
jmp 0x40a858
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a81d
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x40a821
xor eax, eax
jmp 0x40a858
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x40a83c
xor eax, eax
jmp 0x40a858
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 4]
xor edx, edx
cmp ecx, 0x14c
sete dl
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40a8f0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x40a902
cmp dword [ebp + 0x10], 0
jne 0x40a909
xor eax, eax
jmp 0x40aa38
cmp dword [ebp + 8], 0
jne 0x40a916
xor eax, eax
jmp 0x40aa38
mov dword [ebp - 0x14], 0
push 0x42cdac
call fcn.0040a6a0
call fcn.0040a790
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jne 0x40a960
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040aa40
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x40aa38
push 0x42cdd0
push 0x42cde0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a987
xor eax, eax
jmp 0x40aa38
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
test eax, eax
jne 0x40a9a4
xor eax, eax
jmp 0x40aa38
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040a7f0
add esp, 0xc
test eax, eax
jne 0x40a9c7
xor eax, eax
jmp 0x40aa38
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0xc]
je 0x40a9d3
xor eax, eax
jmp 0x40aa38
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x40a9e7
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x40aa12
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040ae30
add esp, 0x18
mov dword [ebp - 0x14], eax
jmp 0x40aa35
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040aa40
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x40b8e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
jle 0x40b916
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x40b924
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0x10], 0
jle 0x40b959
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x54], eax
jmp 0x40b967
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
jle 0x40b99c
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x40b9aa
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
jle 0x40b9df
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x64], edx
jmp 0x40b9ed
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 8
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x48], 0
xor eax, eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x44], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0x48], esp
and esp, 0xfffffff0
push 0x33
call 0x40ba4d
add dword [esp], 5
retf

Function at 0x40bae0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
je 0x40bb00
cmp dword [ebp + 0xc], 0
jne 0x40bafa
cmp dword [ebp + 0x10], 0
je 0x40bb00
cmp dword [ebp + 0x14], 0
jne 0x40bb02
jmp 0x40bb55
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.0040bb15
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bb60
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
cmp dword [ebp + 8], 0
je 0x40bb80
cmp dword [ebp + 0xc], 0
jne 0x40bb7a
cmp dword [ebp + 0x10], 0
je 0x40bb80
cmp dword [ebp + 0x14], 0
jne 0x40bb84
xor al, al
jmp 0x40bbe8
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.0040bb9b
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40bbf0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.0040bc0b
Function at 0x40e480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x40e487
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40e564
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42c3d0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x42c3d0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x42c3d0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42c3d0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42c3d0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42c3d0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42c3d0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42c3d0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x40e4a0
pop edi
test edx, edx
je 0x40e58b
jmp 0x40e570
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x42c3d0]
inc ecx
sub edx, 1
jne 0x40e570
not eax
pop esi
ret

Function at 0x40e590
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x42c3d0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x42c3d0]
mov dword [edx + 8], ecx
ret

Function at 0x40e5e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x42c3d0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x42c3d0]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x40ed30
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x40ed62
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40ed58
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x40ed75
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.004178f0
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x40ed90
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x40edc3
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40edbd
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x40edef
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x40edd5
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.004178f0
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x40ee06
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x40ee00
cmp byte [esi + 8], 0
je 0x40ee00
or eax, 0xffffffff
add esp, 8
ret