joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f19
Capabilities:
List domain servers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
movzx eax, word [0x10056c0]
push 0
neg eax
sbb eax, eax
and eax, 0x10056c0
push eax
push 0x2000000
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp + 8]
push 0x65
push 0
call sub.NETAPI32.dll_NetServerEnum
pop ebp
ret 8
Function at 0x100350a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1005268]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x100359f
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003528
sub eax, edx
sar eax, 1
mov ecx, 0x104
cmp eax, ecx
ja 0x100359f
push esi
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003559
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x20c]
dec eax
dec eax
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x100357f
cmp cx, 0x2f
jne 0x1003586
xor ecx, ecx
mov word [eax], cx
jmp 0x100356e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x10035a1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01003f51
leave
ret
Function at 0x10035b2
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x1005268]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10035f2
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1003607
sub eax, ecx
sar eax, 1
push 0x1001aa8
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x1003662
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x10037ed
mov ecx, 0x1001aa4
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003693
test dx, dx
je 0x100368f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003693
add eax, 4
add ecx, 4
test dx, dx
jne 0x100366d
xor eax, eax
jmp 0x1003698
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10037b3
mov ecx, 0x1001a9c
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10036d1
test dx, dx
je 0x10036cd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10036d1
add eax, 4
add ecx, 4
test dx, dx
jne 0x10036ab
xor eax, eax
jmp 0x10036d6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10037b3
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x1003717
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.01003a71
test eax, eax
je 0x10037b3
cmp dword [edi + 0xc], 0
je 0x1003790
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.01003437
test eax, eax
je 0x1003790
test byte [ebp - 0x75c], 0x10
je 0x10037b3
lea esi, [ebp - 0x30c]
call fcn.0100350a
test eax, eax
je 0x10037b3
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.0100327c
jmp 0x10037b3
lea esi, [ebp - 0x20c]
call fcn.0100350a
test eax, eax
je 0x10037b3
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.01003355
mov esi, eax
test esi, esi
jne 0x10037d0
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x1003662
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x10037eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10037eb
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01003f51
leave
ret 8
Function at 0x1003f37
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10043e8
call fcn.01004114
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100690c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003d4c
cmp eax, esi
jne 0x1003d3f
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003d4f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003d26
xor esi, esi
inc esi
mov eax, dword [0x1006908]
cmp eax, esi
jne 0x1003d62
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003d9d
mov eax, dword [0x1006908]
test eax, eax
jne 0x1003d97
mov dword [0x1006908], esi
push 0x1001178
push 0x100116c
call fcn.01003ca3
pop ecx
pop ecx
test eax, eax
je 0x1003d9d
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1003e67
mov dword [0x10052b8], esi
mov eax, dword [0x1006908]
cmp eax, esi
jne 0x1003dc1
push 0x1001168
push 0x1001160
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006908], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003dce
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1006910], ebx
je 0x1003def
push 0x1006910
call fcn.01004089
pop ecx
test eax, eax
je 0x1003def
push ebx
push 2
push ebx
call dword [0x1006910]
push dword [0x10052a0]
push dword [0x10052a4]
push dword [0x100529c]
call fcn.01001d54
add esp, 0xc
mov dword [0x10052b4], eax
cmp dword [0x10052a8], ebx
jne 0x1003e4d
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10052b8], ebx
jne 0x1003e5b
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10052b4]
call fcn.01004159
ret
call fcn.01004261
jmp 0x1003d04
Function at 0x401000
Capabilities:
Get windows directory from kuser_shared_data
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x448
call fcn.00401190
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov word [esp + 0x44], ax
lea eax, [esp + 0x2c]
push eax
push 0x1e
push 0x4ad190
call fcn.004038f0
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], al
lea eax, [esp + 0xc]
push eax
push 0x19
push 0x4ad1fc
call fcn.004038f0
lea eax, [esp + 0x44]
push 0
push eax
call fcn.00401aa0
add esp, 0x20
test eax, eax
je 0x401182
push esi
mov esi, dword [eax + 0x18]
push edi
call fcn.00401190
test esi, esi
je 0x4010bb
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4010bb
mov ecx, dword [eax + esi + 0x7c]
test ecx, ecx
je 0x4010bb
mov eax, dword [eax + esi + 0x78]
test eax, eax
je 0x4010bb
lea edx, [esp + 8]
push edx
push ecx
lea edx, [eax + esi]
mov ecx, esi
call fcn.00403460
add esp, 8
mov edi, eax
test edi, edi
jne 0x4010da
mov eax, dword [0x8f23f8]
test eax, eax
je 0x401180
lea ecx, [esp + 8]
push ecx
push esi
call eax
mov edi, eax
test edi, edi
je 0x401180
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
push eax
push 0x18
push 0x4ad1c4
call fcn.004038f0
push 0x400
lea eax, [esp + 0x60]
push 0
push eax
call fcn.004018d0
mov ecx, 0x7ffe0030
add esp, 0x18
xor edx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401120
sub ecx, esi
sar ecx, 1
je 0x401180
add ecx, 0xb
cmp ecx, 0x200
ja 0x401180
xor eax, eax
test ecx, ecx
je 0x40115a
movzx esi, word [edx + edx + 0x7ffe0030]
test si, si
je 0x40115a
mov word [esp + edx*2 + 0x50], si
inc eax
inc edx
cmp eax, ecx
jb 0x401142
xor eax, eax
test ecx, ecx
je 0x401179
lea edx, [esp + edx*2 + 0x50]
movzx esi, word [esp + eax*2 + 0x20]
test si, si
je 0x401179
mov word [edx], si
inc eax
add edx, 2
cmp eax, ecx
jb 0x401164
lea eax, [esp + 0x50]
push eax
call edi
pop edi
pop esi
add esp, 0x448
ret
Function at 0x401550
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
sub esp, 0x20c
push ebx
push ebp
mov ebp, dword [0x8f2400]
push esi
push edi
mov edi, ecx
test ebp, ebp
je 0x40167a
cmp dword [0x8f2404], 0
jne 0x401665
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov word [esp + 0x18], ax
mov byte [esp + 0x1a], al
lea eax, [esp + 0x10]
push eax
push 0xf
push 0x4ad22c
call fcn.004038f0
push 0x200
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004018d0
mov edx, 0x7ffe0030
add esp, 0x18
xor ecx, ecx
lea esi, [edx + 2]
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4015c0
sub edx, esi
sar edx, 1
je 0x40167a
mov esi, edi
lea ebx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x4015e0
sub esi, ebx
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x40167a
xor eax, eax
test edx, edx
je 0x401617
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x401617
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x401600
xor eax, eax
test edx, edx
je 0x401632
lea ecx, [ecx]
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x401632
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401620
xor eax, eax
test edx, edx
je 0x40164f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + edi]
test bl, bl
je 0x40164f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401640
push 8
push 0
lea eax, [esp + 0x24]
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push 0x800
push 0
push edi
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret
Function at 0x401aa0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x800
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
test ecx, ecx
je 0x401afb
mov edi, ecx
lea edx, [edi + 2]
jmp 0x401ac0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401ac0
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x401adc
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x418]
push eax
lea ebp, [edi + edi]
call fcn.004023f0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x410], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x401b1d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401b96
mov esi, dword [ebx]
cmp esi, ebx
je 0x401b96
test esi, esi
je 0x401b96
cmp word [esi + 0x24], 2
jbe 0x401b90
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x401b90
cmp dword [esi + 0x18], 0
je 0x401b90
test ebp, ebp
je 0x401b45
cmp ebp, eax
jne 0x401b90
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x18]
push eax
call fcn.004023f0
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x10], ax
mov eax, dword [esp + 0x818]
test eax, eax
je 0x401b6d
cmp eax, dword [esi + 0x18]
jne 0x401b90
cmp dword [esp + 0x814], 0
je 0x401ba3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x414]
push eax
call fcn.00401bb0
add esp, 8
test eax, eax
je 0x401ba3
mov esi, dword [esi]
cmp esi, ebx
jne 0x401b23
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x800
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
Function at 0x402120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x100
lea eax, [esp]
mov dword [esp], 0x3e991cb1
push 0x100
push eax
mov dword [esp + 0xc], 0xe6500482
mov dword [esp + 0x10], 0xd39c05b5
mov dword [esp + 0x14], 0x296f4817
mov dword [esp + 0x18], 0xba048419
mov dword [esp + 0x1c], 0x88026cb3
mov dword [esp + 0x20], 0x39d35c8d
mov dword [esp + 0x24], 0x608dfcd7
mov dword [esp + 0x28], 0xd3047d1e
mov dword [esp + 0x2c], 0x3cc46236
mov dword [esp + 0x30], 0x9be60847
mov dword [esp + 0x34], 0x9491ab2d
mov dword [esp + 0x38], 0x3317d2d9
mov dword [esp + 0x3c], 0x9bcf8749
mov dword [esp + 0x40], 0xa6a0026e
mov dword [esp + 0x44], 0x3b7994f0
mov dword [esp + 0x48], 0x7db5f368
mov dword [esp + 0x4c], 0xad0d4f10
mov dword [esp + 0x50], 0xb0552365
mov dword [esp + 0x54], 0xfcaeddb8
mov dword [esp + 0x58], 0x26b342ac
mov dword [esp + 0x5c], 0x98b16e81
mov dword [esp + 0x60], 0x2ff39bb4
mov dword [esp + 0x64], 0x587a2a3d
mov dword [esp + 0x68], 0xa9a1718f
mov dword [esp + 0x6c], 0xb5c429e6
mov dword [esp + 0x70], 0x435d565b
mov dword [esp + 0x74], 0x1b8831a7
mov dword [esp + 0x78], 0x2f3a3a5f
mov dword [esp + 0x7c], 0xebc8c55b
mov dword [esp + 0x80], 0x48fe68a6
mov dword [esp + 0x84], 0x30a92514
mov dword [esp + 0x88], 0x8e3788a5
mov dword [esp + 0x8c], 0x754994bf
mov dword [esp + 0x90], 0xaec26cc4
mov dword [esp + 0x94], 0x14c2f923
mov dword [esp + 0x98], 0x6cbcc057
mov dword [esp + 0x9c], 0x9f2f0132
mov dword [esp + 0xa0], 0xd81e44cd
mov dword [esp + 0xa4], 0x90432232
mov dword [esp + 0xa8], 0x919c2304
mov dword [esp + 0xac], 0x721b199a
mov dword [esp + 0xb0], 0x45acd5ef
mov dword [esp + 0xb4], 0x703d7f63
mov dword [esp + 0xb8], 0x6d892b64
mov dword [esp + 0xbc], 0xe0f4f5f6
mov dword [esp + 0xc0], 0x58bec1b4
mov dword [esp + 0xc4], 0x46d2f441
mov dword [esp + 0xc8], 0xfee57bf8
mov dword [esp + 0xcc], 0x6401d48
mov dword [esp + 0xd0], 0x313a383e
mov dword [esp + 0xd4], 0xb6872b3a
mov dword [esp + 0xd8], 0x1ad1156f
mov dword [esp + 0xdc], 0xc4fd95f4
mov dword [esp + 0xe0], 0x6946b0df
mov dword [esp + 0xe4], 0x26508928
mov dword [esp + 0xe8], 0x9ceffac5
mov dword [esp + 0xec], 0x7ba27f95
mov dword [esp + 0xf0], 0xe8b945eb
mov dword [esp + 0xf4], 0x5df8148a
mov dword [esp + 0xf8], 0x301f52d2
mov dword [esp + 0xfc], 0x8dea03d5
mov dword [esp + 0x100], 0x1f5e277d
mov dword [esp + 0x104], 0x3ec106c0
call fcn.004038a0
push 0x4ae040
push 0x100
lea eax, [esp + 0x10]
push eax
push 0x443800
push 0x4ae040
call fcn.00403770
mov eax, dword [esp + 0x120]
mov dword [eax], 0x4ae040
add esp, 0x11c
ret
Function at 0x403030
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40307b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40306b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x403051
jmp 0x403070
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4030cb
mov edi, edx
lea ecx, [edi + 2]
jmp 0x403090
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403090
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x4030ac
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.004023f0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4030ed
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x403160
mov esi, dword [ebx]
cmp esi, ebx
je 0x403160
test esi, esi
je 0x403160
cmp word [esi + 0x24], 2
jbe 0x40315a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40315a
cmp dword [esi + 0x18], 0
je 0x40315a
test ebp, ebp
je 0x403115
cmp ebp, eax
jne 0x40315a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.004023f0
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40313a
cmp eax, dword [esi + 0x18]
jne 0x40315a
cmp dword [esp + 0x10], 0
je 0x40316d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401bb0
add esp, 8
test eax, eax
je 0x40316d
mov esi, dword [esi]
cmp esi, ebx
jne 0x4030f3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x4031b0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x4031d8
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x4031e6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x4031ff
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40320d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x403226
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x403234
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x40324d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x40325b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x4032a2
add dword [esp], 5
retf

Function at 0x403330
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x8f2540
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403459
cmp dword fs:[0xc0], eax
je 0x40335b
mov dword [0x8f253c], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x8f2424], eax
mov eax, dword [esi + 0xa8]
mov dword [0x8f2428], eax
movzx edx, word [esi + 0xac]
mov dword [0x8f242c], edx
mov eax, dword [esi + 0xb0]
mov dword [0x8f2430], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x4033bb
push 0x7f
push eax
push 0x8f2434
call fcn.004023f0
mov edx, dword [0x8f242c]
add esp, 0xc
jmp 0x4033c3
xor eax, eax
mov word [0x8f2434], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x8f2534], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x8f2536], ax
movzx eax, word [0x7ffe02d0]
mov word [0x8f2538], ax
mov ecx, eax
mov byte [0x8f253a], 0
cmp byte [0x7ffe0268], 0
je 0x40340a
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x8f253a], bl
cmp ebx, 1
pop ebx
jne 0x403424
and ecx, 0xffef
mov word [0x8f2538], cx
test edx, edx
jne 0x403459
call fcn.00403330
cmp dword [0x8f2424], 6
ja 0x403459
jb 0x403441
cmp dword [0x8f2428], 4
jae 0x403459
call fcn.00403330
cmp dword [0x8f2424], 0xa
jae 0x403459
mov dword [0x8f242c], 1
ret
Function at 0x403770
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x104
lea eax, [esp + 4]
push ebp
push 0x100
push 0
push eax
call fcn.004018d0
add esp, 0xc
cmp dword [esp + 0x10c], 0
je 0x403891
cmp dword [esp + 0x114], 0
je 0x403891
mov ecx, dword [esp + 0x118]
test ecx, ecx
je 0x403891
cmp dword [esp + 0x11c], 0
push edi
je 0x403890
xor eax, eax
jmp 0x4037d0
mov byte [esp + eax + 0xc], al
inc eax
cmp eax, 0x100
jb 0x4037d0
mov edi, dword [esp + 0x118]
push esi
xor esi, esi
xor ebp, ebp
push ebx
lea esp, [esp]
mov eax, esi
mov bl, byte [esp + esi + 0x14]
xor edx, edx
div ecx
movzx ecx, bl
movzx eax, byte [edx + edi]
add eax, ebp
add ecx, eax
movzx ebp, cl
mov ecx, dword [esp + 0x124]
mov al, byte [esp + ebp + 0x14]
mov byte [esp + esi + 0x14], al
inc esi
mov byte [esp + ebp + 0x14], bl
cmp esi, 0x100
jb 0x4037f0
mov esi, dword [esp + 0x11c]
xor ebx, ebx
mov edi, dword [esp + 0x128]
mov ebp, dword [esp + 0x118]
mov dword [esp + 0x10], ebx
test esi, esi
je 0x40388e
sub ebp, edi
lea eax, [ebx + 1]
movzx ebx, al
lea edi, [edi + 1]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + ebx + 0x14]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [esp + 0x10], eax
movzx eax, byte [esp + eax + 0x14]
mov byte [esp + ebx + 0x14], al
mov eax, dword [esp + 0x10]
mov byte [esp + eax + 0x14], cl
movzx eax, byte [esp + ebx + 0x14]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x14]
xor al, byte [edi + ebp - 1]
mov byte [edi - 1], al
sub esi, 1
jne 0x403845
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x104
ret

Function at 0x4038a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x4038d3
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4038d2
lea eax, [esi - 1]
test eax, eax
je 0x4038cc
jmp 0x4038c0
mov cl, byte [eax + edx - 1]
xor byte [eax + edx], cl
sub eax, 1
jne 0x4038c0
mov al, byte [edx + esi - 1]
xor byte [edx], al
pop esi
ret
Function at 0x4038f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x108
push ebp
mov ebp, dword [esp + 0x110]
lea eax, [esp + 0xc]
push esi
push edi
push 0x100
push 0
lea esi, [ebp + 4]
push eax
mov dword [esp + 0x1c], esi
call fcn.004018d0
add esp, 0xc
xor edi, edi
test esi, esi
je 0x4039de
test ebp, ebp
je 0x4039de
push ebx
mov ebx, dword [esp + 0x124]
test ebx, ebx
je 0x4039dd
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x403940
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + ebp]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x403950
mov esi, dword [esp + 0x120]
xor edi, edi
mov dword [esp + 0x10], edi
add esi, 0xfffffffc
je 0x4039dd
mov ebp, dword [esp + 0x14]
sub ebp, ebx
lea eax, [edi + 1]
movzx edi, al
lea ebx, [ebx + 1]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + edi + 0x18]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [esp + 0x10], eax
movzx eax, byte [esp + eax + 0x18]
mov byte [esp + edi + 0x18], al
mov eax, dword [esp + 0x10]
mov byte [esp + eax + 0x18], cl
movzx eax, byte [esp + edi + 0x18]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x18]
xor al, byte [ebx + ebp - 1]
mov byte [ebx - 1], al
sub esi, 1
jne 0x403994
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x108
ret

Function at 0x4039f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x2000
mov bl, 1
xor edx, edx
jmp 0x403a00
movzx ecx, bl
inc bl
movzx eax, byte [ecx + 0x8f1880]
add byte [edx + 0x8f1980], al
mov cl, byte [ecx + 0x8f1980]
add byte [edx + 0x8f1980], cl
inc edx
cmp edx, 0x100
jb 0x403a00
mov bl, 1
xor edx, edx
jmp 0x403a30
movzx ecx, bl
inc bl
movzx eax, byte [ecx + 0x8f1880]
xor byte [edx + 0x8f1980], al
mov cl, byte [ecx + 0x8f1980]
xor byte [edx + 0x8f1980], cl
inc edx
cmp edx, 0x100
jb 0x403a30
mov bl, 1
xor edx, edx
jmp 0x403a60
movzx ecx, bl
inc bl
movzx eax, byte [ecx + 0x8f1880]
sub byte [edx + 0x8f1980], al
movzx eax, byte [edx + 0x8f1980]
sub al, byte [ecx + 0x8f1980]
mov byte [edx + 0x8f1980], al
inc edx
cmp edx, 0x100
jb 0x403a60
mov bl, 1
xor eax, eax
movzx edx, bl
inc bl
movzx ecx, byte [edx + 0x8f1880]
xor byte [eax + 0x8f1980], cl
mov dl, byte [edx + 0x8f1980]
xor byte [eax + 0x8f1980], dl
inc eax
cmp eax, 0x100
jb 0x403a92
sub esi, 1
jne 0x4039f7
pop esi
pop ebx
ret