joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48abe0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x48ac2a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x48ac59
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x48ac9b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x4aecf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4caff0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004a3cf8
mov eax, dword [0x4f2ac0]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004a3c2a
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004af810
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4aed97
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4aed8e
cmp al, 0xff
je 0x4aed8e
dec al
mov byte [ecx], al
jmp 0x4aed97
push ecx
call fcn.004b8c00
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4aedc8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4aedbf
cmp al, 0xff
je 0x4aedbf
dec al
mov byte [ecx], al
jmp 0x4aedc8
push ecx
call fcn.004b8c00
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4bb353
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4bb38b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b933d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b9315
jmp 0x4bb397
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4bca45
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4bca87
call fcn.004c2831
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4bca87
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4bca7e
xor eax, eax
jmp 0x4bca8f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004bca95
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c2d61
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c2d8f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c2dad
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c2cc7
jmp 0x4c2dad
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c2dad
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c2cc7
test edi, edi
mov eax, edi
jne 0x4c2d97
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x51b940
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x76000]
push edi
or ebp, 0xffffffff
jmp 0x51b962
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51b969
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51b958
mov eax, 1
add ebx, ebx
jne 0x51b97b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51b98c
jne 0x51b9ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51b9ab
dec eax
add ebx, ebx
jne 0x51b998
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51b970
add ebx, ebx
jne 0x51b9a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51b9fd
xor ecx, ecx
sub eax, 3
jb 0x51b9c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51ba32
sar eax, 1
mov ebp, eax
jmp 0x51b9ce
add ebx, ebx
jne 0x51b9ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51b99c
inc ecx
add ebx, ebx
jne 0x51b9dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51b99c
add ebx, ebx
jne 0x51b9e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51b9de
jne 0x51b9fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51b9de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51ba1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51ba0e
jmp 0x51b95e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51ba1c
add edi, ecx
jmp 0x51b95e
pop esi
mov edi, esi
mov ecx, 0x2f70
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51ba3a
cmp byte [edi], 0x13
jne 0x51ba3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51ba3f
lea edi, [esi + 0x118000]
mov eax, dword [edi]
or eax, eax
je 0x51bab7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11cebc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11cfc0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51ba6c
mov ecx, edi
jns 0x51ba9b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11cfc4]
or eax, eax
je 0x51bab1
mov dword [ebx], eax
add ebx, 4
jmp 0x51ba89
call dword [esi + 0x11cfd4]
mov ebp, dword [esi + 0x11cfc8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51baeb
sub esp, 0xffffff80
jmp 0x458e81
Function at 0x401f3b
Capabilities:
Access peb ldr_data
Check os version
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov edi, edx
test edi, edi
je 0x401fe0
mov ecx, edi
mov eax, dword [ecx + 0x28]
movzx esi, word [eax]
cmp esi, 0x4b
je 0x401ff2
cmp esi, 0x6b
jne 0x401f7d
cmp word [eax + 2], 0x45
je 0x401ff2
cmp word [eax + 2], 0x65
jne 0x401f8b
cmp word [eax + 4], 0x52
je 0x401ff2
cmp word [eax + 4], 0x72
jne 0x401f99
cmp word [eax + 6], 0x4e
je 0x401ff2
cmp word [eax + 6], 0x6e
jne 0x401fa7
cmp word [eax + 8], 0x45
je 0x401ff2
cmp word [eax + 8], 0x65
jne 0x401fb5
cmp word [eax + 0xa], 0x6c
je 0x401ff2
cmp word [eax + 0xa], 0x4c
jne 0x401fd1
cmp word [eax + 0xc], 0x33
jne 0x401fd1
cmp word [eax + 0xe], 0x32
jne 0x401fd1
cmp word [eax + 0x10], 0x2e
je 0x401ff2
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x20], edx
cmp edi, ecx
je 0x401fe0
test ecx, ecx
jne 0x401f62
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x401ff7
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ecx + 0x10]
jmp 0x401fe3
mov eax, dword [edi + 0x3c]
xor esi, esi
push ebx
mov eax, dword [eax + edi + 0x78]
mov ebx, dword [eax + edi + 0x1c]
mov edx, dword [eax + edi + 0x20]
add ebx, edi
mov ecx, dword [eax + edi + 0x24]
add edx, edi
mov eax, dword [eax + edi + 0x18]
add ecx, edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
test eax, eax
jle 0x402189
mov dword [ebp - 0x38], 3
Function at 0x40924f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x409350
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x409356
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4092b1
cmp al, 0x61
jb 0x4092a9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40929c
cmp edx, dword [esp + 0x14]
je 0x4092c1
dec ecx
jne 0x409291
xor eax, eax
jmp 0x409350
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x409350
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x409350
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x409301
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x409310
jmp 0x4092f8
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x409356
test eax, eax
je 0x409350
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40934b
cmp al, 0x61
jb 0x409343
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x409336
call 0x409265
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4093a3
mov al, cl
cmp al, 0x61
jb 0x40937e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4093a3
mov al, cl
cmp al, 0x61
jb 0x409396
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40936f
cmp edx, dword [esp + 0x18]
je 0x4093b3
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x409368
xor eax, eax
jmp 0x4093b6
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x409265
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x409350
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x409356
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4092b1
cmp al, 0x61
jb 0x4092a9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40929c
cmp edx, dword [esp + 0x14]
je 0x4092c1
dec ecx
jne 0x409291
xor eax, eax
jmp 0x409350
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x409350
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x409350
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x409301
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x409310
jmp 0x4092f8
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x409356
test eax, eax
je 0x409350
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40934b
cmp al, 0x61
jb 0x409343
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x409336
call 0x409265
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4093a3
mov al, cl
cmp al, 0x61
jb 0x40937e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4093a3
mov al, cl
cmp al, 0x61
jb 0x409396
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40936f
cmp edx, dword [esp + 0x18]
je 0x4093b3
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x409368
xor eax, eax
jmp 0x4093b6
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x409356
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x409350
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x409356
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4092b1
cmp al, 0x61
jb 0x4092a9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40929c
cmp edx, dword [esp + 0x14]
je 0x4092c1
dec ecx
jne 0x409291
xor eax, eax
jmp 0x409350
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x409350
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x409350
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x409301
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x409310
jmp 0x4092f8
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x409356
test eax, eax
je 0x409350
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40934b
cmp al, 0x61
jb 0x409343
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x409336
call 0x409265
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4093a3
mov al, cl
cmp al, 0x61
jb 0x40937e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4093a3
mov al, cl
cmp al, 0x61
jb 0x409396
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40936f
cmp edx, dword [esp + 0x18]
je 0x4093b3
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x409368
xor eax, eax
jmp 0x4093b6
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40cc54
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4c9e0e]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40cc8f
add dword [esp], 5
retf

Function at 0x40cd32
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4c9e0e]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40cd6d
add dword [esp], 5
retf
Function at 0x40eba6
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
cmp eax, ecx
je 0x40ecdc
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x40ebc9
cmp dword [edx + 0x10], esi
jne 0x40ebc1
xor eax, eax
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [edx + 0x20]
mov dword [esp], eax
call dword [ebp + 0x10]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x40ecdc
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp + 0xc]
add ecx, esi
sub eax, esi
lea edx, [ecx + 0xf8]
movzx ecx, word [ecx + 6]
mov dword [ebp - 0x24], eax
imul ecx, ecx, 0x28
add ecx, edx
cmp edx, ecx
je 0x40ecd5
mov esi, dword [edx + 0xc]
cmp eax, esi
jb 0x40ec56
mov edi, dword [edx + 0x10]
add edi, esi
cmp edi, eax
jb 0x40ec56
add eax, dword [edx + 0x14]
sub eax, esi
jne 0x40ec5b
jmp 0x40ecd5
add edx, 0x28
jmp 0x40ec35
xor edi, edi
mov dword [esp + 4], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp], ebx
call dword [ebp + 0x14]
sub esp, 0x10
inc eax
je 0x40ecd5
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [ebp + 0x18]
sub esp, 0x14
test eax, eax
je 0x40ecd5
cmp dword [ebp - 0x24], 8
jne 0x40ecd5
cmp byte [ebp - 0x20], 0xb8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jne 0x40ecd5
shrd eax, edx, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [ebp + 0x1c]
push ebx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x40ece0
mov dword [esp], ebx
call dword [ebp + 0x1c]
push eax
xor eax, eax
xor edx, edx
leave
ret 0x18

Function at 0x410a85
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x410a8f
add dword [esp], 5
retf

Function at 0x410af3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
pop edx
pop ecx
push edx
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x410b47
mov al, cl
cmp al, 0x61
jb 0x410b22
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x410b47
mov al, cl
cmp al, 0x61
jb 0x410b3a
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x410b13
cmp edx, dword [esp + 0x18]
je 0x410b57
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x410b0c
xor eax, eax
jmp 0x410b5a
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x410b97
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x410ba1
add dword [esp], 5
retf
Function at 0x410c72
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x410c7c
add dword [esp], 5
retf

Function at 0x410edc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x410f2c
mov al, cl
cmp al, 0x61
jb 0x410f07
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x410f2c
mov al, cl
cmp al, 0x61
jb 0x410f1f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x410ef8
cmp edx, dword [esp + 0x18]
je 0x410f3c
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x410ef1
xor eax, eax
jmp 0x410f3f
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x410f58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x41103f
lea esi, [ebx + eax]
test edx, 0xffff0000
je fcn.00411045
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x410fa4
cmp al, 0x61
jb 0x410f9c
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x410f8f
cmp edx, dword [esp + 0x14]
je 0x410fb4
dec ecx
jne 0x410f84
xor eax, eax
jmp 0x41103f
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x41103f
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x41103f
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x410ff0
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x410fff
jmp 0x410fe7
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.00411045
test eax, eax
je 0x41103f
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x41103a
cmp al, 0x61
jb 0x411032
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x411025
call fcn.00410f58
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x411045
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x411092
mov al, cl
cmp al, 0x61
jb 0x41106d
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x411092
mov al, cl
cmp al, 0x61
jb 0x411085
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x41105e
cmp edx, dword [esp + 0x18]
je 0x4110a2
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x411057
xor eax, eax
jmp 0x4110a5
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret