joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056c0
Capabilities:
Reference 114dns dns server
Reference alidns dns server

Disassembly:
push 0xffffffffffffffff
push 0x427329
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43914c]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x20], ebx
mov eax, dword [0x43f30c]
mov edx, dword [eax + 0xc]
mov ecx, 0x43f30c
call edx
mov ecx, dword [esp + 0x68]
add eax, 0x10
mov dword [ecx], eax
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x24]
mov dword [esp + 0x60], ebx
mov esi, 1
push edx
mov dword [esp + 0x24], esi
call fcn.00405870
mov dword [esp + 0x60], esi
mov dword [esp + 0x28], str.114.114.114.114
mov dword [esp + 0x2c], str.223.5.5.5
xor ebp, ebp
mov eax, dword [0x43f30c]
mov edx, dword [eax + 0xc]
mov ecx, 0x43f30c
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x60], 2
mov ecx, dword [esp + ebp*4 + 0x28]
cmp ecx, ebx
jne 0x405761
xor eax, eax
jmp 0x40576f
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x405766
sub eax, esi
mov edi, eax
push ecx
lea eax, [esp + 0x1c]
call fcn.00403c40
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x30]
push eax
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
call fcn.00405380
mov ecx, dword [esp + 0x24]
add esp, 8
shr ecx, 2
cmp eax, ebx
je 0x4057a8
cmp ecx, ebx
jg 0x4057d9
lea eax, [esi - 0x10]
mov byte [esp + 0x60], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4057c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebp
cmp ebp, 2
jb 0x40573a
mov ebp, dword [esp + 0x68]
jmp 0x405829
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
cmp eax, ebx
jne 0x4057ec
xor ecx, ecx
jmp 0x4057fa
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x4057f1
sub ecx, edi
mov ebp, dword [esp + 0x68]
push eax
mov edi, ecx
mov eax, ebp
call fcn.00403c40
lea eax, [esi - 0x10]
mov byte [esp + 0x60], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405829
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x60], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40584d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x406130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4278a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43914c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 4]
push eax
call fcn.00407310
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov byte [esi + 0x20], al
lea eax, [esi + 0x40]
push eax
mov byte [esp + 0x18], 1
call fcn.00407310
fldz
fstp qword [esi + 0x38]
mov dword [esi], 5
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x4090d0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x43914c]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
push 0x228
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x14], 0
call fcn.00418320
add esp, 0xc
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x4091eb
cmp esi, 0xffffffff
je 0x4091eb
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x4091c9
jmp 0x409140
lea edx, [esp + 0x2c]
push str.EXPLORER.EXE
push edx
call fcn.00417669
add esp, 8
test eax, eax
je 0x409188
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x409140
push esi
lea edi, [eax + 1]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00416b64
add esp, 0x230
ret
mov ecx, dword [esp + 0x10]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push edi
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00416b64
add esp, 0x230
ret
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00416b64
add esp, 0x230
ret
mov ecx, dword [esp + 0x234]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00416b64
add esp, 0x230
ret
Function at 0x409c90
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x43914c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x409ced
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00416b64
add esp, 0x14
ret
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x409d06
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
pop ebx
xor ecx, esp
call fcn.00416b64
add esp, 0x14
ret

Function at 0x409d30
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x43914c]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [esp + 0x10]
lea esi, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call fcn.00409be0
test eax, eax
je 0x409dde
cmp dword [esp + 0xc], 6
jbe 0x409dde
call fcn.00409c90
test eax, eax
jne 0x409dde
push 0x208
lea ecx, [esp + 0x56]
push ebx
push ecx
mov word [esp + 0x5c], ax
call fcn.00418320
add esp, 0xc
lea edx, [esp + 0x50]
push 0x104
push edx
call fcn.00408d50
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x38
lea eax, [esp + 0x1c]
push ebx
push eax
mov dword [esp + 0x20], 0x3c
call fcn.00418320
add esp, 0xc
lea edx, [esp + 0x14]
lea ecx, [esp + 0x50]
push edx
mov dword [esp + 0x24], str.runas
mov dword [esp + 0x28], ecx
mov dword [esp + 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
lea eax, [ebx + 1]
jne 0x409de0
mov eax, ebx
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416b64
add esp, 0x254
ret
Function at 0x40b230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4277b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43914c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
mov edi, dword [eax + 8]
mov ebp, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [0x43f30c]
xor ebx, ebx
mov dword [esp + 0x28], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x43f30c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], edi
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x44]
lea eax, [esp + 0x40]
call fcn.00403310
mov edx, dword [esp + 0x40]
cmp dword [edx - 4], 1
jle 0x40b2bb
mov ecx, dword [edx - 0xc]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00403a70
mov edx, dword [esp + 0x40]
push ebp
lea ebx, [esp + 0x20]
mov ecx, edi
call fcn.00410380
add esp, 4
test eax, eax
je 0x40b3f0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x40b3f0
push ebx
call fcn.0041692e
add esp, 4
push ebx
mov edi, eax
push 0
push edi
call fcn.00418320
mov edx, dword [esp + 0x4c]
add esp, 0xc
cmp dword [edx - 4], 1
jle 0x40b311
mov eax, dword [edx - 0xc]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00403a70
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
push edi
push ebp
call fcn.00410420
add esp, 8
test eax, eax
jne 0x40b37a
mov esi, str._ustr
call fcn.00401ad0
test edi, edi
je 0x40b33a
push edi
call fcn.00416b59
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b362
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea edx, [esp + 0x20]
push edx
push ebx
xor ebp, ebp
push edi
mov dword [esp + 0x2c], ebp
call fcn.0040e5b0
add esp, 0xc
test eax, eax
jne 0x40b39a
mov esi, str._u6pf
jmp 0x40b328
cmp edi, ebp
je 0x40b3e3
cmp ebx, ebp
jne 0x40b3a6
cmp ebp, ebp
je 0x40b3e3
mov eax, dword [esi]
cmp eax, ebp
jne 0x40b3b7
push ebx
call fcn.00416c50
add esp, 4
jmp 0x40b3c6
mov ecx, dword [esi + 8]
add ecx, ebx
push ecx
push eax
call fcn.00416d1a
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x40b3e3
mov edx, dword [esi + 8]
push ebx
push edi
add edx, eax
push ebx
push edx
call fcn.00416f35
add esp, 0x10
add dword [esi + 8], ebx
adc dword [esi + 0xc], ebp
mov dword [esp + 0x18], 1
jmp 0x40b32d
mov esi, str._ulen
call fcn.00401ad0
jmp 0x40b33a
Function at 0x40e1d0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 8]
push ecx
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
ja 0x40e1fc
xor eax, eax
pop edi
add esp, 0x10
ret
push ebp
push esi
lea ebp, [edi + 1]
push ebp
call fcn.0041692e
push ebp
xor ebp, ebp
mov esi, eax
push ebp
push esi
call fcn.00418320
add esp, 0x10
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40e244
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x42fb30
push esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40e24d
pop esi
pop ebp
xor eax, eax
pop edi
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0xa]
mov dx, word [eax + 8]
mov di, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
mov ecx, dword [esp + 0x20]
push edx
push eax
push 0x42fb34
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp esi, ebp
je 0x40e28e
push esi
call fcn.0041747c
add esp, 4
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x10
ret

Function at 0x40e5b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1000
jae 0x40e5c3
xor eax, eax
jmp 0x40e618
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e5dd
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x40e5e1
xor eax, eax
jmp 0x40e618
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x40e5fc
xor eax, eax
jmp 0x40e618
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 4]
xor edx, edx
cmp ecx, 0x14c
sete dl
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40e6b0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x40e6c2
cmp dword [ebp + 0x10], 0
jne 0x40e6c9
xor eax, eax
jmp 0x40e7f8
cmp dword [ebp + 8], 0
jne 0x40e6d6
xor eax, eax
jmp 0x40e7f8
mov dword [ebp - 0x14], 0
push 0x435414
call fcn.0040e460
call fcn.0040e550
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jne 0x40e720
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040e800
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x40e7f8
push 0x435438
push 0x435448
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40e747
xor eax, eax
jmp 0x40e7f8
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
test eax, eax
jne 0x40e764
xor eax, eax
jmp 0x40e7f8
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040e5b0
add esp, 0xc
test eax, eax
jne 0x40e787
xor eax, eax
jmp 0x40e7f8
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0xc]
je 0x40e793
xor eax, eax
jmp 0x40e7f8
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x40e7a7
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x40e7d2
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040ebf0
add esp, 0x18
mov dword [ebp - 0x14], eax
jmp 0x40e7f5
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040e800
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x40f6a0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
jle 0x40f6d6
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x40f6e4
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0x10], 0
jle 0x40f719
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x54], eax
jmp 0x40f727
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
jle 0x40f75c
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x40f76a
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
jle 0x40f79f
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x64], edx
jmp 0x40f7ad
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 8
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x48], 0
xor eax, eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x44], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0x48], esp
and esp, 0xfffffff0
push 0x33
call 0x40f80d
add dword [esp], 5
retf

Function at 0x40f8a0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
je 0x40f8c0
cmp dword [ebp + 0xc], 0
jne 0x40f8ba
cmp dword [ebp + 0x10], 0
je 0x40f8c0
cmp dword [ebp + 0x14], 0
jne 0x40f8c2
jmp 0x40f915
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.0040f8d5
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f920
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
cmp dword [ebp + 8], 0
je 0x40f940
cmp dword [ebp + 0xc], 0
jne 0x40f93a
cmp dword [ebp + 0x10], 0
je 0x40f940
cmp dword [ebp + 0x14], 0
jne 0x40f944
xor al, al
jmp 0x40f9a8
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.0040f95b
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40f9b0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.0040f9cb
Function at 0x412250
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x412257
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x412334
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x434a38]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x434a38]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x434a38]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x434a38]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x434a38]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x434a38]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x434a38]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x434a38]
inc ecx
sub edx, 8
sub esi, 1
jne 0x412270
pop edi
test edx, edx
je 0x41235b
jmp 0x412340
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x434a38]
inc ecx
sub edx, 1
jne 0x412340
not eax
pop esi
ret

Function at 0x412360
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x434a38]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x434a38]
mov dword [edx + 8], ecx
ret

Function at 0x4123b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x434a38]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x434a38]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x412b00
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x412b32
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x412b28
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x412b45
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0041b150
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x412b60
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x412b93
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x412b8d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x412bbf
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x412ba5
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.0041b150
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x412bd6
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x412bd0
cmp byte [esi + 8], 0
je 0x412bd0
or eax, 0xffffffff
add esp, 8
ret