joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001130
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
xor ecx, ecx
push esi
mov ebx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x100011de
push ebp
mov ebp, dword [esp + 0x20]
push edi
add esi, 0x10
cmp dword [esi], 0
jne 0x10001192
mov edx, dword [esp + 0x1c]
mov edi, dword [edx + 0x38]
test edi, edi
jle 0x100011c0
mov eax, dword [esi - 4]
push 4
push 0x1000
add eax, ebx
push edi
push eax
call dword [ebp + 8]
push edi
push eax
mov dword [esi - 8], eax
call fcn.10001030
add esp, 8
jmp 0x100011c0
mov edx, dword [esi - 4]
mov ecx, dword [esi]
push 4
push 0x1000
add edx, ebx
push ecx
push edx
call dword [ebp + 8]
mov ecx, dword [esi + 4]
mov edi, eax
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x1c]
add ecx, eax
push ecx
push edi
call fcn.10001000
add esp, 0xc
mov dword [esi - 8], edi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add esi, 0x28
mov ecx, dword [edx]
xor edx, edx
mov dword [esp + 0x10], eax
mov dx, word [ecx + 6]
cmp eax, edx
jl 0x10001162
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret 0x10

Function at 0x100011f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x28]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
push esi
push edi
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x28], 0x80
mov dword [esp + 0x2c], 0x20
mov dword [esp + 0x30], 0x40
lea eax, [ecx + ebx + 0x18]
jbe 0x100012ec
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x1000128a
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
mov ecx, dword [esp + 0x3c]
push 0x4000
push edx
push eax
call dword [ecx + 4]
jmp 0x100012d4
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x100012a1
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x100012bc
test al, 0x40
je 0x100012b3
mov ecx, dword [ebx + 0x20]
jmp 0x100012ba
test al, 0x80
je 0x100012d4
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x100012d4
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
mov edx, dword [esp + 0x48]
push ecx
call dword [edx + 0xc]
test eax, eax
je 0x100012ec
mov eax, dword [esp + 0x38]
xor ecx, ecx
inc ebp
add edi, 0x28
mov ebx, dword [eax]
mov cx, word [ebx + 6]
cmp ebp, ecx
jl 0x10001256
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
Function at 0x10001790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0
jmp 0x100017ea
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax + 0x18]
jae 0x1000183d
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x20], ecx
push 1
mov edx, dword [ebp - 0x20]
push edx
call fcn.10001720
cmp dword [ebp + 0xc], eax
jne 0x1000183b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dx, word [ecx + eax*2]
mov word [ebp - 0x24], dx
mov eax, dword [ebp - 0x24]
and eax, 0xffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x28]
jmp 0x1000183f
jmp 0x100017e1
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x100026ae
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10006070
cmp edx, dword [eax]
je 0x100026d0
add eax, 8
inc ecx
cmp eax, 0x10006100
jl 0x100026c1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10006070]
jne 0x100027fe
mov eax, dword [0x1000637c]
cmp eax, 1
je 0x100027d8
test eax, eax
jne 0x10002701
cmp dword [0x10006380], 1
je 0x100027d8
cmp edx, 0xfc
je 0x100027fe
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10002738
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10002a70
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10002b60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1000277b
lea eax, [ebp - 0x1a4]
push eax
call fcn.10002b60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1000538c
push edi
call fcn.10003be0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10002a70
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10002a80
lea eax, [ebp - 0xa0]
push 0x1000536c
push eax
call fcn.10002a80
push dword [esi + 0x10006074]
lea eax, [ebp - 0xa0]
push eax
call fcn.10002a80
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10003b4e
add esp, 0x2c
pop edi
jmp 0x100027fe
lea eax, [ebp + 8]
lea esi, [esi + 0x10006074]
push 0
push eax
push dword [esi]
call fcn.10002b60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40107e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x4305c8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x4305cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
call fcn.00401077
mov eax, dword [0x4305d0]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4305d4]
add ebx, 0x23f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, edi
shl eax, 4
cmp dword [0x43f80c], 0xc
mov dword [ebp - 4], eax
jne 0x4010f7
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
push ecx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, dword [0x43f80c]
cmp eax, 0xfa9
jne 0x401113
mov dword [0x43f808], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401131
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and dword [0x43f760], 0
mov ecx, dword [ebp - 8]
and dword [ebp - 0x10], 0
mov edx, edi
lea eax, [ebx + edi]
shr edx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [0x43f804], 0xf4ea3dee
add edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, esi
shr edx, cl
lea eax, [ebx + esi]
mov dword [ebp - 0x14], eax
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add ebx, 0x61c88647
dec dword [ebp - 0x18]
jne 0x4010cb
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x40802f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42fd70]
jne 0x408039
repz ret
jmp fcn.0040c312

Function at 0x40a7c8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404be7
and dword [ebp - 4], 0
cmp dword [0x4347f8], 0
mov ebx, eax
jne 0x40a879
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a92a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a92a
push eax
call fcn.00404b75
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4347f8], eax
call esi
push eax
call fcn.00404b75
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4347fc], eax
call esi
push eax
call fcn.00404b75
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x434800], eax
call esi
push eax
call fcn.00404b75
pop ecx
mov dword [0x434808], eax
test eax, eax
je 0x40a879
push 0x42bf18
push edi
call esi
push eax
call fcn.00404b75
pop ecx
mov dword [0x434804], eax
mov eax, dword [0x434804]
cmp eax, ebx
je 0x40a8d1
cmp dword [0x434808], ebx
je 0x40a8d1
push eax
call fcn.00404bf0
push dword [0x434808]
mov esi, eax
call fcn.00404bf0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a8d1
test edi, edi
je 0x40a8d1
call esi
test eax, eax
je 0x40a8c8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a8c8
test byte [ebp - 0xc], 1
jne 0x40a8d1
or dword [ebp + 0x10], 0x200000
jmp 0x40a90a
mov eax, dword [0x4347fc]
cmp eax, ebx
je 0x40a90a
push eax
call fcn.00404bf0
pop ecx
test eax, eax
je 0x40a90a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a90a
mov eax, dword [0x434800]
cmp eax, ebx
je 0x40a90a
push eax
call fcn.00404bf0
pop ecx
test eax, eax
je 0x40a90a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4347f8]
call fcn.00404bf0
pop ecx
test eax, eax
je 0x40a92a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a92c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4018c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x403464], eax
mov edi, 0
mov ecx, 0xa
push edi
loop 0x4018dd
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [0x403464]
mov dword [ebp - 0x1c], edx
lea ecx, str.contents
mov dword [ebp - 8], ecx
lea eax, section..text
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x66
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x403464]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403474], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403474]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019a6
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40198d
pop ebp
ret 0x10

Function at 0x40353a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403563
mov al, byte [esi + 1]
inc esi
test al, al
je 0x40355b
cmp al, 0x22
jne 0x40354f
cmp byte [esi], 0x22
jne 0x40356d
inc esi
jmp 0x40356d
cmp al, 0x20
jle 0x40356d
inc esi
cmp byte [esi], 0x20
jg 0x403567
mov al, byte [esi]
test al, al
je 0x403577
cmp al, 0x20
jle 0x403560
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401de7
push 0x404004
push section..data
call fcn.00403520
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4035a7
movzx eax, word [ebp - 0x14]
jmp 0x4035aa
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004035cd
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4019f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x7f2208]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x401b9d
cmp dword [0x7f220c], 0
jne 0x401b89
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.004034a0
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x401a40
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x401a50
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41b0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401a85
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004034a0
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401ae4
sub edx, esi
sar edx, 1
je 0x401b9d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x401b00
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x401b9d
xor eax, eax
push ebx
test edx, edx
je 0x401b38
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x401b38
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x401b21
xor eax, eax
test edx, edx
je 0x401b52
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x401b52
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401b40
xor eax, eax
test edx, edx
je 0x401b6f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x401b6f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401b60
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x7f2208]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x4023e0
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x7f2348
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x402509
cmp dword fs:[0xc0], eax
je 0x40240b
mov dword [0x7f2344], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x7f222c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x7f2230], eax
movzx edx, word [esi + 0xac]
mov dword [0x7f2234], edx
mov eax, dword [esi + 0xb0]
mov dword [0x7f2238], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40246b
push 0x7f
push eax
push 0x7f223c
call fcn.00403180
mov edx, dword [0x7f2234]
add esp, 0xc
jmp 0x402473
xor eax, eax
mov word [0x7f223c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x7f233c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x7f233e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x7f2340], ax
mov ecx, eax
mov byte [0x7f2342], 0
cmp byte [0x7ffe0268], 0
je 0x4024ba
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x7f2342], bl
cmp ebx, 1
pop ebx
jne 0x4024d4
and ecx, 0xffef
mov word [0x7f2340], cx
test edx, edx
jne 0x402509
call fcn.004023e0
cmp dword [0x7f222c], 6
ja 0x402509
jb 0x4024f1
cmp dword [0x7f2230], 4
jae 0x402509
call fcn.004023e0
cmp dword [0x7f222c], 0xa
jae 0x402509
mov dword [0x7f2234], 1
ret
Function at 0x403320
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x403348
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x403356
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40336f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40337d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x403396
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x4033a4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x4033bd
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x4033cb
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call fcn.00403412
Function at 0x4038c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40390b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x4038fb
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x4038e1
jmp 0x403900
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x40395b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x403920
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403920
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40393c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00403180
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40397d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x4039f0
mov esi, dword [ebx]
cmp esi, ebx
je 0x4039f0
test esi, esi
je 0x4039f0
cmp word [esi + 0x24], 2
jbe 0x4039ea
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x4039ea
cmp dword [esi + 0x18], 0
je 0x4039ea
test ebp, ebp
je 0x4039a5
cmp ebp, eax
jne 0x4039ea
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00403180
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4039ca
cmp eax, dword [esi + 0x18]
jne 0x4039ea
cmp dword [esp + 0x10], 0
je 0x4039fd
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401bb0
add esp, 8
test eax, eax
je 0x4039fd
mov esi, dword [esi]
cmp esi, ebx
jne 0x403983
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x404200
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x40425b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x404220
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x40423c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00403180
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40427d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x4042ef
mov esi, dword [ebx]
cmp esi, ebx
je 0x4042ef
test esi, esi
je 0x4042ef
cmp word [esi + 0x24], 2
jbe 0x4042e9
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x4042e9
cmp dword [esi + 0x18], 0
je 0x4042e9
test ebp, ebp
je 0x4042a5
cmp ebp, eax
jne 0x4042e9
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00403180
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x4042ca
cmp edx, dword [esi + 0x18]
jne 0x4042e9
cmp dword [esp + 0x14], eax
je 0x4042fc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401bb0
add esp, 8
test eax, eax
je 0x4042fc
mov esi, dword [esi]
cmp esi, ebx
jne 0x404283
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret

Function at 0x404310
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x7f3080]
sub esp, 0x11c
test eax, eax
jne 0x40440e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.004034a0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x404360
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x404370
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41b104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x4043a5
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00404200
pop edi
pop esi
pop ebx
test eax, eax
je 0x404409
mov eax, dword [eax + 0x18]
test eax, eax
je 0x404409
mov dword [0x7f3080], eax
add esp, 0x11c
ret
mov eax, dword [0x7f3080]
add esp, 0x11c
ret
Function at 0x41ac02
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret