joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a9b3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40aa50
push ebx
push esi
call fcn.0040a97c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a910
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a9fd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40aa4f
push edi
push eax
call fcn.0040b5d0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40aa1d
call fcn.00409471
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40aa4e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a910
add esp, 0x20
test eax, eax
jne 0x40aa3c
push edi
call fcn.00409471
jmp 0x40aa44
push ebx
call fcn.00409471
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40bd4d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46bd68
push 0x46bd60
push str.FlsAlloc
push 0x1f
call fcn.0040bc0c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40bd81
push dword [ebp + 8]
mov ecx, esi
call dword [0x415160]
call esi
jmp 0x40bd87
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40bdcb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46bd78
push 0x46bd70
push str.FlsGetValue
push 0x21
call fcn.0040bc0c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40be02
push dword [ebp + 8]
mov ecx, esi
call dword [0x415160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40be0a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46bd80
push 0x46bd78
push str.FlsSetValue
push 0x22
call fcn.0040bc0c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40be44
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x415160]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4112a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4112cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4112cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43b653
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov edx, dword [esp]
add esp, 4
mov eax, eax
or ebx, ebx
call fcn.0043b69b
and ebx, eax
xor dword [ecx], edx
sub esp, 4
mov dword [esp], 0xfd1cde69
pop ebx
sub eax, ebx
add ecx, 1
mov ebx, ebx
cmp ecx, esi
jne fcn.0043b653
add eax, 0x191859bf
mov ebx, eax
ret
Function at 0x406090
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
rdtsc
push 0
mov dword [0x40d3e8], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
push 0
mov dword [ebp - 4], ebx
call esi
mov edi, eax
push 1
mov dword [ebp - 0x10], edi
call esi
mov esi, eax
push ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push esi
push edi
push dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x40d3d4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [0x40d3d4]
mov esi, dword [0x40d3d8]
mov edx, dword [0x40d3dc]
mov ecx, dword [0x40d3e0]
lea eax, [edi + 0xa]
mov dword [0x40d3f0], eax
lea eax, [esi - 0xa]
mov dword [0x40d3f4], eax
lea eax, [edx + 0xa]
push 0
mov dword [0x40d3f8], eax
sub edx, edi
push 0
lea eax, [esi + 0xa]
mov dword [0x40d3fc], eax
lea eax, [edi - 0xa]
push 0
mov dword [0x40d400], eax
lea eax, [ecx - 0xa]
sub ecx, esi
mov dword [0x40d404], eax
push ecx
push edx
push esi
push edi
push dword [ebp - 4]
push 0x40d3f0
push ebx
call dword [sym.imp.GDI32.dll_PlgBlt]
mov ecx, dword [0x40d3e8]
shl ecx, 0xd
xor ecx, dword [0x40d3e8]
mov eax, ecx
shr eax, 0x11
xor eax, ecx
mov ebx, eax
shl ebx, 5
xor ebx, eax
mov eax, ebx
shl eax, 0xd
xor eax, ebx
mov ecx, eax
shr ecx, 0x11
xor ecx, eax
mov edi, ecx
shl edi, 5
xor edi, ecx
mov eax, edi
shl eax, 0xd
xor eax, edi
mov ecx, eax
shr ecx, 0x11
xor ecx, eax
mov eax, 0x80808081
mov esi, ecx
shl esi, 5
xor esi, ecx
mul esi
mov eax, 0x80808081
mov dword [0x40d3e8], esi
mov ecx, edx
mul edi
shr ecx, 7
mov eax, 0x80808081
shr edx, 7
add ecx, esi
add edx, edi
shl ecx, 0x10
shl edx, 8
and ecx, 0xff0000
and edx, 0xff00
or ecx, edx
mul ebx
shr edx, 7
add edx, ebx
movzx eax, dl
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x40d3e8]
shl ecx, 0xd
xor ecx, dword [0x40d3e8]
mov edx, ecx
shr edx, 0x11
xor edx, ecx
mov ecx, 0xee0086
mov eax, edx
shl eax, 5
xor eax, edx
mov dword [0x40d3e8], eax
test al, 1
mov eax, 0x8800c6
cmove eax, ecx
push eax
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406250
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
rdtsc
push 0
mov dword [0x40d3e8], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
push 0
mov dword [ebp - 4], ebx
call esi
mov edi, eax
push 1
mov dword [ebp - 0x10], edi
call esi
mov esi, eax
push ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push esi
push edi
push dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x40d3d4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [0x40d3d4]
mov esi, dword [0x40d3d8]
mov edx, dword [0x40d3dc]
mov ecx, dword [0x40d3e0]
lea eax, [edi - 0xa]
mov dword [0x40d3f0], eax
lea eax, [esi + 0xa]
mov dword [0x40d3f4], eax
lea eax, [edx - 0xa]
push 0
mov dword [0x40d3f8], eax
sub edx, edi
push 0
lea eax, [esi - 0xa]
mov dword [0x40d3fc], eax
lea eax, [edi + 0xa]
push 0
mov dword [0x40d400], eax
lea eax, [ecx + 0xa]
sub ecx, esi
mov dword [0x40d404], eax
push ecx
push edx
push esi
push edi
push dword [ebp - 4]
push 0x40d3f0
push ebx
call dword [sym.imp.GDI32.dll_PlgBlt]
mov ecx, dword [0x40d3e8]
shl ecx, 0xd
xor ecx, dword [0x40d3e8]
mov eax, ecx
shr eax, 0x11
xor eax, ecx
mov ebx, eax
shl ebx, 5
xor ebx, eax
mov eax, ebx
shl eax, 0xd
xor eax, ebx
mov ecx, eax
shr ecx, 0x11
xor ecx, eax
mov edi, ecx
shl edi, 5
xor edi, ecx
mov eax, edi
shl eax, 0xd
xor eax, edi
mov ecx, eax
shr ecx, 0x11
xor ecx, eax
mov eax, 0x80808081
mov esi, ecx
shl esi, 5
xor esi, ecx
mul esi
mov eax, 0x80808081
mov dword [0x40d3e8], esi
mov ecx, edx
mul edi
shr ecx, 7
mov eax, 0x80808081
shr edx, 7
add ecx, esi
add edx, edi
shl ecx, 0x10
shl edx, 8
and ecx, 0xff0000
and edx, 0xff00
or ecx, edx
mul ebx
shr edx, 7
add edx, ebx
movzx eax, dl
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x40d3e8]
shl ecx, 0xd
xor ecx, dword [0x40d3e8]
mov edx, ecx
shr edx, 0x11
xor edx, ecx
mov ecx, 0xee0086
mov eax, edx
shl eax, 5
xor eax, edx
mov dword [0x40d3e8], eax
test al, 1
mov eax, 0x8800c6
cmove eax, ecx
push eax
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c44
call fcn.00409f20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
cmp dword [0x40d3c4], 2
jl 0x406843
movaps xmm2, xmmword [0x40b900]
lea edx, [eax + 0xc]
lea esi, [eax + 4]
nop
movd xmm0, eax
lea ecx, [edx - 4]
pshufd xmm1, xmm0, 0
add eax, 0x10
paddd xmm1, xmm2
movaps xmm0, xmm1
psrld xmm0, 2
xorps xmm0, xmm1
pmulld xmm0, xmm1
psrld xmm0, 3
pshuflw xmm0, xmm0, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
andps xmm0, xmmword [0x40b940]
packuswb xmm0, xmm0
movd dword [ebp + esi - 0x50c0c], xmm0
movd xmm0, esi
pshufd xmm1, xmm0, 0
paddd xmm1, xmm2
movaps xmm0, xmm1
psrld xmm0, 2
xorps xmm0, xmm1
pmulld xmm0, xmm1
psrld xmm0, 3
pshuflw xmm0, xmm0, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
andps xmm0, xmmword [0x40b940]
packuswb xmm0, xmm0
movd dword [ebp + esi - 0x50c08], xmm0
add esi, 0x10
movd xmm0, ecx
pshufd xmm1, xmm0, 0
paddd xmm1, xmm2
movaps xmm0, xmm1
psrld xmm0, 2
xorps xmm0, xmm1
pmulld xmm0, xmm1
psrld xmm0, 3
pshuflw xmm0, xmm0, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
andps xmm0, xmmword [0x40b940]
packuswb xmm0, xmm0
movd dword [ebp + edx - 0x50c0c], xmm0
movd xmm0, edx
pshufd xmm1, xmm0, 0
paddd xmm1, xmm2
movaps xmm0, xmm1
psrld xmm0, 2
xorps xmm0, xmm1
pmulld xmm0, xmm1
psrld xmm0, 3
pshuflw xmm0, xmm0, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
andps xmm0, xmmword [0x40b940]
packuswb xmm0, xmm0
movd dword [ebp + edx - 0x50c08], xmm0
add edx, 0x10
cmp esi, 0x50bf4
jb 0x406710
cmp eax, 0x50bfe
jae 0x40685f
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul ecx, eax
shr ecx, 3
mov byte [ebp + eax - 0x50c08], cl
inc eax
cmp eax, 0x50bfe
jb 0x406843
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040926e
mov esp, ebp
pop ebp
ret
Function at 0x409a9e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409add
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409add
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409add
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409add
cmp dword [ecx + 0x74], 0xe
jbe 0x409add
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4010d4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, str._ccav_
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00401224
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401108
push ebx
call fcn.0040fae3
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [0x41bef1]
test ebx, ebx
je 0x40111f
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [0x41bef1], eax
push 0x41b216
push dword [0x41bef1]
call fcn.00401037
add esp, 8
cmp eax, 0
jne 0x401165
mov dword [ebp - 8], esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401448
call fcn.00403124
call main
call fcn.004033f7
call fcn.0040d441
mov eax, str._0bc740cf070b8527_
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401194
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x40119d
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4011ad
push ebx
call fcn.0040fae3
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x401760
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4017bb
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401780
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x40179c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00404240
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4017dd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x40184f
mov esi, dword [ebx]
cmp esi, ebx
je 0x40184f
test esi, esi
je 0x40184f
cmp word [esi + 0x24], 2
jbe 0x401849
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x401849
cmp dword [esi + 0x18], 0
je 0x401849
test ebp, ebp
je 0x401805
cmp ebp, eax
jne 0x401849
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00404240
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40182a
cmp edx, dword [esi + 0x18]
jne 0x401849
cmp dword [esp + 0x14], eax
je 0x40185c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403d30
add esp, 8
test eax, eax
je 0x40185c
mov esi, dword [esi]
cmp esi, ebx
jne 0x4017e3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x402060
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x4020ab
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40209b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x402081
jmp 0x4020a0
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4020fb
mov edi, edx
lea ecx, [edi + 2]
jmp 0x4020c0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4020c0
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x4020dc
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00404240
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40211d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x402190
mov esi, dword [ebx]
cmp esi, ebx
je 0x402190
test esi, esi
je 0x402190
cmp word [esi + 0x24], 2
jbe 0x40218a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40218a
cmp dword [esi + 0x18], 0
je 0x40218a
test ebp, ebp
je 0x402145
cmp ebp, eax
jne 0x40218a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00404240
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40216a
cmp eax, dword [esi + 0x18]
jne 0x40218a
cmp dword [esp + 0x10], 0
je 0x40219d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403d30
add esp, 8
test eax, eax
je 0x40219d
mov esi, dword [esi]
cmp esi, ebx
jne 0x402123
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x402c00
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x7fdd48
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x402d29
cmp dword fs:[0xc0], eax
je 0x402c2b
mov dword [0x7fdd44], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x7fdc2c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x7fdc30], eax
movzx edx, word [esi + 0xac]
mov dword [0x7fdc34], edx
mov eax, dword [esi + 0xb0]
mov dword [0x7fdc38], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x402c8b
push 0x7f
push eax
push 0x7fdc3c
call fcn.00404240
mov edx, dword [0x7fdc34]
add esp, 0xc
jmp 0x402c93
xor eax, eax
mov word [0x7fdc3c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x7fdd3c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x7fdd3e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x7fdd40], ax
mov ecx, eax
mov byte [0x7fdd42], 0
cmp byte [0x7ffe0268], 0
je 0x402cda
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x7fdd42], bl
cmp ebx, 1
pop ebx
jne 0x402cf4
and ecx, 0xffef
mov word [0x7fdd40], cx
test edx, edx
jne 0x402d29
call fcn.00402c00
cmp dword [0x7fdc2c], 6
ja 0x402d29
jb 0x402d11
cmp dword [0x7fdc30], 4
jae 0x402d29
call fcn.00402c00
cmp dword [0x7fdc2c], 0xa
jae 0x402d29
mov dword [0x7fdc34], 1
ret

Function at 0x402d30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x7feafc]
sub esp, 0x11c
test eax, eax
jne 0x402e2e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00401870
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402d80
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41e100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402d90
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41e104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402dc5
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00401760
pop edi
pop esi
pop ebx
test eax, eax
je 0x402e29
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402e29
mov dword [0x7feafc], eax
add esp, 0x11c
ret
mov eax, dword [0x7feafc]
add esp, 0x11c
ret
Function at 0x403de0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x403e08
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x403e16
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x403e2f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x403e3d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x403e56
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x403e64
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x403e7d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x403e8b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x403ed2
add dword [esp], 5
retf
Function at 0x403f60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x7fdc08]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x40410d
cmp dword [0x7fdc0c], 0
jne 0x4040f9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00401870
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x403fb0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41e0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x403fc0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41e0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x403ff5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00401870
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404054
sub edx, esi
sar edx, 1
je 0x40410d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x404070
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x40410d
xor eax, eax
push ebx
test edx, edx
je 0x4040a8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x4040a8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x404091
xor eax, eax
test edx, edx
je 0x4040c2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4040c2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4040b0
xor eax, eax
test edx, edx
je 0x4040df
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4040df
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4040d0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x7fdc08]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret

Function at 0x41d0e2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x42e41b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x42e42a
pop dword [ebp - 0x44]
mov eax, 0x42e42a
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x335bc
push 0
mov eax, 0x326c4370
sub eax, 0x3228fffc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x39c3
xor edx, edx
add edx, eax
mov esi, 0x1c5bd076
add esi, 0xe3e7fd8a
add esi, dword [ebp - 0x44]
mov ebx, 0x99a45ae
sub ebx, 0x38e05ce9
xor dword [ebp - 0x14], ecx
mov edi, dword [esi]
sub edi, ebx
mov dword [ebp - 0x40], 0xe0f01d4b
mov dword [edx], edi
xor dword [ebp - 0x38], edx
add edx, 4
add esi, 4
loop 0x42e480
add eax, 0x1d777780
add eax, 0xe289625f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x41ccf207
add ecx, 0xbe730df9
add ecx, dword [ebp - 0x44]
call ebx
leave
ret