joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40750b
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
lea ebp, [esp - 0x1008]
mov eax, 0x1008
call fcn.00430680
push 0xffffffffffffffff
push 0x434836
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x449654]
xor eax, ebp
mov dword [ebp + 0x1004], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1010]
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
mov ebx, 0x44f98c
mov ecx, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], edi
call fcn.0040130c
push edi
push edi
xor esi, esi
push edi
inc esi
push esi
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x34], esi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x28], eax
cmp eax, edi
je 0x4076c8
push 4
lea ecx, [ebp - 0x30]
push ecx
push 0x41
push eax
mov dword [ebp - 0x30], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [0x44f98c]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.Accept_Encoding:_gzip__deflate_r_nConnection:_Close
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], esi
call fcn.00402737
mov eax, dword [0x44f98c]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov esi, 0x438fc4
push esi
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.00402737
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
jle 0x4075ff
push 0x439024
lea eax, [ebp - 0x14]
push eax
call fcn.004027af
push esi
lea eax, [ebp - 0x14]
push eax
call fcn.004027af
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push eax
xor esi, esi
call fcn.004026bd
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0040294f
push str.https:__
push eax
mov byte [ebp - 4], 4
call fcn.004027cd
mov ebx, eax
mov eax, dword [ebp - 0x2c]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00401629
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00401629
test bl, bl
je 0x407653
mov esi, 0x800000
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx - 0xc]
push edi
or esi, 0x4000000
push esi
push eax
push ebx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
cmp esi, edi
jne 0x40767d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4076b5
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x18]
push eax
push 0x1000
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax], 0
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call fcn.00404737
cmp dword [ebp - 0x1c], edi
je 0x4076b5
cmp dword [ebp - 0x18], edi
jne 0x407680
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401629
lea eax, [ebx - 0x10]
call fcn.00401629
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1004]
xor ecx, ebp
call fcn.0041cb8e
add ebp, 0x1008
leave
ret
Function at 0x40a531
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x449654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x4c], eax
xor ebx, ebx
xor eax, eax
push edi
cmp dword [esi + 4], ebx
je 0x40a5eb
push 8
pop ecx
push dword [0x45090c]
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 0x3e8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x10], eax
mov ax, word [esi]
mov word [ebp - 0xc], ax
cmp dword [ebp - 0x4c], ebx
je 0x40a5be
mov eax, dword [ebp - 0x4c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a59d
sub eax, edx
cmp eax, 0x20
jne 0x40a5be
push dword [ebp - 0x4c]
lea eax, [ebp - 0x34]
push 0x21
push eax
call fcn.0041e7d1
add esp, 0xc
jmp 0x40a5c9
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov esi, dword [esi + 4]
push 0x10
lea eax, [esi + 0xc]
push eax
push ebx
push 0x40
lea eax, [ebp - 0x48]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
test eax, eax
setg cl
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cb8e
leave
ret 8

Function at 0x40a6b1
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 8], 0
je 0x40a6e0
call fcn.0040e6dd
push 0x1388
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40a6dc
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 8], 0
xor eax, eax
inc eax
pop esi
ret

Function at 0x40bdfe
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, 0x434fae
call fcn.0041f15d
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
test eax, eax
je 0x40be2d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [esi + 0x2c]
push eax
call fcn.0040ae2c
lea eax, [esi + 0xc]
push eax
mov byte [ebp - 4], 0
call fcn.0040ae2c
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
call fcn.0041cb83
pop ecx
mov eax, esi
call fcn.0041f235
ret 4

Function at 0x40d571
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x40d58a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xc]
sub eax, 0x10
call fcn.00401629
mov eax, dword [esi + 8]
sub eax, 0x10
call fcn.00401629
mov eax, dword [esi + 4]
sub eax, 0x10
call fcn.00401629
push esi
call fcn.0041cb83
pop ecx
mov eax, esi
ret
Function at 0x40d5b5
Capabilities:
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
cmp eax, ebx
je 0x40d77c
push esi
push edi
push ebx
push ebx
push 3
push ebx
push 1
push closesocket
push dword [ebp + 8]
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x20], edi
cmp edi, 0xffffffff
je 0x40d72f
cmp edi, ebx
je 0x40d72f
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40d72f
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40d72f
lea eax, [ebp - 0x18]
push eax
push edi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d72f
push ebx
push esi
push dword [ebp - 0x18]
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x40d72f
cmp eax, 0xffffffff
je 0x40d72f
push esi
push ebx
push ebx
push 4
pop edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x40d72f
push ebx
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40d72f
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 2
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x40d72f
push dword [ebp - 4]
call fcn.00419904
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x40d72f
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push 2
push dword [ebp - 8]
call esi
test eax, eax
je 0x40d726
cmp dword [ebp - 4], 0x80
jae 0x40d726
xor esi, esi
cmp dword [ebp - 4], ebx
jbe 0x40d71f
xor edi, edi
mov eax, dword [ebp - 0x1c]
movzx eax, byte [esi + eax]
push eax
mov eax, pe_nt_image_headers32
sub eax, edi
push 0x44344c
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push eax
call fcn.0041df26
add esp, 0x10
inc esi
inc edi
inc edi
cmp esi, dword [ebp - 4]
jb 0x40d6f4
mov dword [ebp - 0x24], 1
push dword [ebp - 0x1c]
call fcn.0041cb83
pop ecx
cmp dword [ebp - 8], ebx
je 0x40d73d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x10], ebx
je 0x40d74c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x14], ebx
je 0x40d75a
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], ebx
je 0x40d770
cmp dword [ebp - 0xc], 0xffffffff
je 0x40d770
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 0x20], ebx
je 0x40d77a
push dword [ebp - 0x20]
call esi
pop edi
pop esi
mov eax, dword [ebp - 0x24]
pop ebx
leave
ret
Function at 0x40e09d
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x449654]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x450c8c], 0
jne 0x40e109
lea eax, [ebp - 0x29c]
push eax
push 0x202
mov dword [0x450c8c], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x40e109
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40e109
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0x45090c], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor ecx, ebp
call fcn.0041cb8e
leave
ret 4

Function at 0x40e13a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0xc]
push ebx
push edi
test eax, eax
je 0x40e171
mov ecx, dword [esi + 0x10]
test ecx, ecx
jbe 0x40e171
mov ebx, dword [ebp + 8]
push ecx
push eax
push ebx
call fcn.00422d70
push dword [esi + 0xc]
mov edi, dword [esi + 0x10]
call fcn.0041cb83
and dword [esi + 0xc], 0
add esp, 0x10
and dword [esi + 0x10], 0
jmp 0x40e190
push 0
push 0x7d014
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x40e21d
mov ebx, dword [ebp + 8]
cmp dword [ebx], 1
jne 0x40e21d
cmp dword [ebx + 4], 0x3e9
jne 0x40e21d
mov ebx, dword [ebx + 0x10]
cmp ebx, 0x7d000
ja 0x40e21d
add ebx, 0x14
cmp ebx, edi
jb 0x40e1e8
mov eax, ebx
sub eax, edi
mov dword [ebp - 4], eax
je 0x40e218
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
mov eax, esi
call fcn.0040e5ee
test eax, eax
jle 0x40e21d
sub dword [ebp - 4], eax
push 1
add edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0
ja 0x40e1bd
jmp 0x40e218
mov eax, dword [esi + 0xc]
sub edi, ebx
test eax, eax
je 0x40e1fc
push eax
call fcn.0041cb83
and dword [esi + 0xc], 0
pop ecx
push edi
call fcn.00419904
mov ecx, dword [ebp + 8]
push edi
add ebx, ecx
push ebx
push eax
mov dword [esi + 0xc], eax
call fcn.00422d70
add esp, 0x10
mov dword [esi + 0x10], edi
xor eax, eax
inc eax
jmp 0x40e21f
xor eax, eax
pop edi
pop ebx
leave
ret 4
Function at 0x40e524
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x449654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov dword [ebp - 0x18], eax
xor ebx, ebx
call esi
push edi
cmp eax, 0xffffffff
jne 0x40e5b2
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40e56c
movzx ecx, word [eax + 8]
cmp cx, 2
je 0x40e567
cmp cx, 0x17
jne 0x40e56c
mov eax, dword [eax + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebx + 4]
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 2
mov word [ebp - 0x12], ax
pop eax
mov word [ebp - 0x14], ax
xor eax, eax
push eax
push eax
push eax
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
call dword [sym.imp.WS2_32.dll_WSAConnect]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0041cb8e
leave
ret 8
call esi
jmp 0x40e56f

Function at 0x40e5b6
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
xor esi, esi
xor eax, eax
test edi, edi
jle 0x40e5e4
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [esp + 0x14]
add eax, esi
push eax
mov eax, dword [esp + 0x14]
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x40e5e4
add esi, eax
cmp esi, edi
jl 0x40e5bf
cmp esi, edi
pop esi
jne 0x40e5eb
mov eax, edi
ret 8

Function at 0x40e5ee
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [eax]
call dword [sym.imp.WS2_32.dll_recv]
ret 8

Function at 0x40e773
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40fee0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 8]
push ecx
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
ja 0x40ff0c
xor eax, eax
pop edi
add esp, 0x10
ret
push ebp
push esi
lea ebp, [edi + 1]
push ebp
call fcn.00419904
push ebp
xor ebp, ebp
mov esi, eax
push ebp
push esi
call fcn.0041ea30
add esp, 0x10
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40ff54
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x443458
push esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40ff5d
pop esi
pop ebp
xor eax, eax
pop edi
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0xa]
mov dx, word [eax + 8]
mov di, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
mov ecx, dword [esp + 0x20]
push edx
push eax
push 0x44345c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp esi, ebp
je 0x40ff9e
push esi
call fcn.0041d513
add esp, 4
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x10
ret
Function at 0x410780
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1000
jae 0x410793
xor eax, eax
jmp 0x4107e8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4107ad
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x4107b1
xor eax, eax
jmp 0x4107e8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x4107cc
xor eax, eax
jmp 0x4107e8
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 4]
xor edx, edx
cmp ecx, 0x14c
sete dl
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x410880
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x410892
cmp dword [ebp + 0x10], 0
jne 0x410899
xor eax, eax
jmp 0x4109e3
cmp dword [ebp + 8], 0
jne 0x4108a6
xor eax, eax
jmp 0x4109e3
mov dword [ebp - 0x14], 0
push 0x43ea74
call fcn.00410630
call fcn.00410720
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jne 0x4108f0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410ae0
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x4109e3
push 0x43ea98
push 0x43eaa8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410917
xor eax, eax
jmp 0x4109e3
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
test eax, eax
jne 0x410934
xor eax, eax
jmp 0x4109e3
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00410780
add esp, 0xc
test eax, eax
jne 0x41095a
xor eax, eax
jmp 0x4109e3
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0xc]
je 0x410966
xor eax, eax
jmp 0x4109e3
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x41097a
mov dword [ebp - 4], 1
cmp dword [0x450c90], 0
jne 0x410992
mov dword [0x450c90], 1
call fcn.00410a70
cmp dword [ebp - 4], 0
je 0x4109bd
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410ed0
add esp, 0x18
mov dword [ebp - 0x14], eax
jmp 0x4109e0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410ae0
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x410a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00411ae0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x410a40
cmp dword [ebp - 4], 0
jne 0x410a61
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4122d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
jle 0x412306
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x412314
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0x10], 0
jle 0x412349
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x54], eax
jmp 0x412357
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
jle 0x41238c
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x41239a
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
jle 0x4123cf
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x64], edx
jmp 0x4123dd
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 8
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x48], 0
xor eax, eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x44], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0x48], esp
and esp, 0xfffffff0
push 0x33
call 0x41243d
add dword [esp], 5
retf

Function at 0x4124d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
je 0x4124f0
cmp dword [ebp + 0xc], 0
jne 0x4124ea
cmp dword [ebp + 0x10], 0
je 0x4124f0
cmp dword [ebp + 0x14], 0
jne 0x4124f2
jmp 0x412545
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.00412505
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412550
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
cmp dword [ebp + 8], 0
je 0x412570
cmp dword [ebp + 0xc], 0
jne 0x41256a
cmp dword [ebp + 0x10], 0
je 0x412570
cmp dword [ebp + 0x14], 0
jne 0x412574
xor al, al
jmp 0x4125d8
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.0041258b
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4125e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.004125fb