joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496a28
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00521da0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x496a6d
push ebx
call fcn.0051fe39
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x496aa5
push 0x36
push 0x4010eb0
push 6
call fcn.0051fe3f
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x496ac1
push eax
mov ebx, eax
call fcn.0048d1a8
inc eax
push eax
call fcn.0051fe33
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x496ac6
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x496ad7
push ebx
call fcn.0051fe39
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4980fb
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x498105
add dword [esp], 5
retf

Function at 0x498892
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x49889c
add dword [esp], 5
retf

Function at 0x498927
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x4989a7
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x4989a7
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x4989a7
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x4989a7
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x498998
test bl, bl
je 0x4989ab
dec eax
mov eax, edx
jmp 0x498984
inc ebp
test al, al
je 0x4989ab
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x49897f
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x49896b
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x4989a5
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret
Function at 0x4989fe
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x498a36
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x498a24
mov al, 1
jmp 0x498a95
cmp dword [ebx + 0x54], ecx
jne 0x498a2d
mov al, 2
jmp 0x498a95
cmp dword [ebx + 0x7c], ecx
jne 0x498a95
mov al, 3
jmp 0x498a95
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x498a4b
mov al, 4
jmp 0x498a95
cmp ecx, 5
jne 0x498a6b
cmp ebx, 0
jne 0x498a59
mov al, 5
jmp 0x498a95
cmp ebx, 1
jne 0x498a62
mov al, 6
jmp 0x498a95
cmp ebx, 2
jne 0x498a6b
mov al, 7
jmp 0x498a95
cmp ecx, 6
jne 0x498a93
cmp ebx, 0
jne 0x498a79
mov al, 8
jmp 0x498a95
cmp ebx, 1
jne 0x498a80
mov al, 9
cmp ebx, 2
jne 0x498a87
mov al, 0xa
cmp ebx, 3
jne 0x498a8e
mov al, 0xb
cmp ebx, 4
jne 0x498a95
mov al, 0xc
pop ebx
leave
ret

Function at 0x498aa6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x498ad2
add dword [esp], 5
retf

Function at 0x498b65
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x498b6f
add dword [esp], 5
retf

Function at 0x499132
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x49913c
add dword [esp], 5
retf

Function at 0x4991c7
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4991f3
add dword [esp], 5
retf

Function at 0x4992b9
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4992c3
add dword [esp], 5
retf
Function at 0x49e3d8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0049e4b2
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x49e413
add dword [esp], 5
retf
Function at 0x49e851
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x49e89e
mov al, cl
cmp al, 0x61
jb 0x49e879
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x49e89e
mov al, cl
cmp al, 0x61
jb 0x49e891
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x49e86a
cmp edx, dword [esp + 0x18]
je 0x49e8ae
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x49e863
xor eax, eax
jmp 0x49e8b1
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x49e8b9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x49e9a0
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x49e9a6
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x49e905
cmp al, 0x61
jb 0x49e8fd
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x49e8f0
cmp edx, dword [esp + 0x14]
je 0x49e915
dec ecx
jne 0x49e8e5
xor eax, eax
jmp 0x49e9a0
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x49e9a0
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x49e9a0
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x49e951
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x49e960
jmp 0x49e948
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.0049e851
test eax, eax
je 0x49e9a0
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x49e99b
cmp al, 0x61
jb 0x49e993
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x49e986
call fcn.0049e8b9
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x49e9be
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x49e9be
sub edx, ecx
mov ecx, edx
jmp 0x49e915
xor eax, eax
jmp 0x49e9a0
Function at 0x49fc08
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x49fc40
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x49fc2e
mov al, 1
jmp 0x49fc9f
cmp dword [ebx + 0x54], ecx
jne 0x49fc37
mov al, 2
jmp 0x49fc9f
cmp dword [ebx + 0x7c], ecx
jne 0x49fc9f
mov al, 3
jmp 0x49fc9f
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x49fc55
mov al, 4
jmp 0x49fc9f
cmp ecx, 5
jne 0x49fc75
cmp ebx, 0
jne 0x49fc63
mov al, 5
jmp 0x49fc9f
cmp ebx, 1
jne 0x49fc6c
mov al, 6
jmp 0x49fc9f
cmp ebx, 2
jne 0x49fc75
mov al, 7
jmp 0x49fc9f
cmp ecx, 6
jne 0x49fc9d
cmp ebx, 0
jne 0x49fc83
mov al, 8
jmp 0x49fc9f
cmp ebx, 1
jne 0x49fc8a
mov al, 9
cmp ebx, 2
jne 0x49fc91
mov al, 0xa
cmp ebx, 3
jne 0x49fc98
mov al, 0xb
cmp ebx, 4
jne 0x49fc9f
mov al, 0xc
pop ebx
leave
ret

Function at 0x49fd9e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x49fda8
add dword [esp], 5
retf

Function at 0x4a0ceb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00521da0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4a0d30
push ebx
call fcn.0051fe39
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4a0d65
push 0x36
push 0x4012a84
push 6
call fcn.0051fe3f
add esp, 0xc
push 0xa1cad9
push dword [ebp - 4]
mov ecx, 2
call fcn.0048d213
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4a0d85
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4a0d96
push ebx
call fcn.0051fe39
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4a2c46
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], esp
mov eax, dword [0xce85da]
push eax
push 0x24
call fcn.0051fe33
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4a2cfb
push 0
push 0x4010cd5
push 6
call fcn.0051fe3f
add esp, 0xc
mov ebx, dword [ebp - 8]
push ebx
mov edi, dword [ebp - 0xc]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.0051fe39
add esp, 4
mov ebx, dword [0xce85da]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp word [ebx], 6
je 0x4a2db6
mov ebx, dword [0xce85da]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp word [ebx], 9
je 0x4a2db6
mov ebx, dword [0xce85da]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp word [ebx], 0xa
je 0x4a2db6
xor eax, eax
jmp 0x4a2dbb
mov eax, 1
mov dword [0xce85de], eax
mov eax, dword [0xce85de]
jmp 0x4a2dca
mov esp, ebp
pop ebp
ret

Function at 0x4a9d97
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4a9da1
add dword [esp], 5
retf
Function at 0x4ac833
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4ac88c
push 0x19
push 0x401472c
push 6
call fcn.0051fe3f
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x1f4
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4ac8c0
push 0x5d
push 0x401472c
push 6
call fcn.0051fe3f
add esp, 0xc
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4ac8ec
push 0x80
push 0x401472c
push 6
call fcn.0051fe3f
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x4ac8f4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ada42
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CheckRemoteDebuggerPresent]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4ada82
push 0
push 0x402542d
push 6
call fcn.0051fe3f
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x4ada8a
mov esp, ebp
pop ebp
ret 4
Function at 0x4b3029
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4b3061
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4b304f
mov al, 1
jmp 0x4b30c0
cmp dword [ebx + 0x54], ecx
jne 0x4b3058
mov al, 2
jmp 0x4b30c0
cmp dword [ebx + 0x7c], ecx
jne 0x4b30c0
mov al, 3
jmp 0x4b30c0
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4b3076
mov al, 4
jmp 0x4b30c0
cmp ecx, 5
jne 0x4b3096
cmp ebx, 0
jne 0x4b3084
mov al, 5
jmp 0x4b30c0
cmp ebx, 1
jne 0x4b308d
mov al, 6
jmp 0x4b30c0
cmp ebx, 2
jne 0x4b3096
mov al, 7
jmp 0x4b30c0
cmp ecx, 6
jne 0x4b30be
cmp ebx, 0
jne 0x4b30a4
mov al, 8
jmp 0x4b30c0
cmp ebx, 1
jne 0x4b30ab
mov al, 9
cmp ebx, 2
jne 0x4b30b2
mov al, 0xa
cmp ebx, 3
jne 0x4b30b9
mov al, 0xb
cmp ebx, 4
jne 0x4b30c0
mov al, 0xc
pop ebx
leave
ret
Function at 0x4bc022
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4bc063
push 0x2b
push 0x4014fb9
push 6
call fcn.0051fe3f
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
setne al
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4bc0a1
push 0x59
push 0x4014fb9
push 6
call fcn.0051fe3f
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x4bc0a9
mov esp, ebp
pop ebp
ret 4

Function at 0x4bdb70
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4bdb7a
add dword [esp], 5
retf

Function at 0x4bdd38
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4bdd42
add dword [esp], 5
retf

Function at 0x4bddcd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x4bde4d
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x4bde4d
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x4bde4d
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x4bde4d
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x4bde3e
test bl, bl
je 0x4bde51
dec eax
mov eax, edx
jmp 0x4bde2a
inc ebp
test al, al
je 0x4bde51
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x4bde25
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x4bde11
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x4bde4b
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret

Function at 0x4bded0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4bdefc
add dword [esp], 5
retf
Function at 0x4be4ef
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4be527
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4be515
mov al, 1
jmp 0x4be586
cmp dword [ebx + 0x54], ecx
jne 0x4be51e
mov al, 2
jmp 0x4be586
cmp dword [ebx + 0x7c], ecx
jne 0x4be586
mov al, 3
jmp 0x4be586
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4be53c
mov al, 4
jmp 0x4be586
cmp ecx, 5
jne 0x4be55c
cmp ebx, 0
jne 0x4be54a
mov al, 5
jmp 0x4be586
cmp ebx, 1
jne 0x4be553
mov al, 6
jmp 0x4be586
cmp ebx, 2
jne 0x4be55c
mov al, 7
jmp 0x4be586
cmp ecx, 6
jne 0x4be584
cmp ebx, 0
jne 0x4be56a
mov al, 8
jmp 0x4be586
cmp ebx, 1
jne 0x4be571
mov al, 9
cmp ebx, 2
jne 0x4be578
mov al, 0xa
cmp ebx, 3
jne 0x4be57f
mov al, 0xb
cmp ebx, 4
jne 0x4be586
mov al, 0xc
pop ebx
leave
ret

Function at 0x4be597
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4be5a1
add dword [esp], 5
retf
Function at 0x4c21e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4c22b5
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4c22b5
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x4c22b5
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x4c223b
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x4c22b5
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4c2280
test dl, dl
je 0x4c227c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4c2280
add ecx, 2
add eax, 2
test dl, dl
jne 0x4c2260
xor eax, eax
jmp 0x4c2285
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4c2297
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x4c22a2
inc esi
cmp esi, ebp
jae 0x4c22b5
mov edx, dword [esp + 0x10]
jmp 0x4c2256
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x4c2519
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4c2524
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x4c2538
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4c253c
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x4c2575
cmp dword [edi + ecx], 0x4550
jne 0x4c2575
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x4c2575
test byte [edi + ecx + 0x16], 2
je 0x4c2575
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x4c257a
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x4c25b6
xor eax, eax
jmp 0x4c2599
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x4c25bf
inc edx
movzx eax, dx
cmp eax, edi
jl 0x4c2599
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x4c25c5
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x4c25fd
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x4c260b
add edx, 0x20
cmp eax, edx
jne 0x4c261c
test bx, bx
je 0x4c2651
add esi, 2
add edi, 2
jmp 0x4c25ed
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x4c262a
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x4c2638
add edx, 0x20
sub ecx, edx
je 0x4c2651
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x4c25e6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4c266a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4c2743
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4c2743
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x4c2743
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x4c26c9
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x4c2743
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4c270e
test dl, dl
je 0x4c270a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4c270e
add ecx, 2
add eax, 2
test dl, dl
jne 0x4c26ee
xor eax, eax
jmp 0x4c2713
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4c2725
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x4c2730
inc esi
cmp esi, ebp
jae 0x4c2743
mov edx, dword [esp + 0x10]
jmp 0x4c26e4
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8