joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c4ba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x45c4e1
call fcn.0045ca5b
mov dword [eax], esi
call fcn.0045ca48
push 0x16
pop esi
mov dword [eax], esi
call fcn.00463c40
mov eax, esi
jmp 0x45c536
test dword [ebp + 0xc], 0xfffffff9
jne 0x45c4c7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x45c50e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045ca6e
pop ecx
call fcn.0045ca48
mov eax, dword [eax]
jmp 0x45c536
test al, 0x10
jne 0x45c534
test al, 1
je 0x45c534
test byte [ebp + 0xc], 2
je 0x45c534
call fcn.0045ca5b
mov dword [eax], 5
call fcn.0045ca48
mov dword [eax], 0xd
jmp 0x45c505
xor eax, eax
pop esi
pop ebp
ret

Function at 0x470de0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4979d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00463f89
and dword [ebp - 0x14], 0
cmp dword [0x49a184], 0
mov dword [ebp - 0x18], eax
jne 0x470e93
push 0x47fa98
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x470f3b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x47fa8c
push ebx
call edi
test eax, eax
je 0x470f3b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x47fa7c
push ebx
mov dword [0x49a184], eax
call edi
push eax
call esi
push 0x47fa68
push ebx
mov dword [0x49a188], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49a18c], eax
call edi
push eax
call esi
mov dword [0x49a194], eax
test eax, eax
je 0x470e93
push 0x47fa34
push ebx
call edi
push eax
call esi
mov dword [0x49a190], eax
mov eax, dword [0x49a190]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x470eec
cmp dword [0x49a194], ecx
je 0x470eec
push eax
call esi
push dword [0x49a194]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x470eec
test ebx, ebx
je 0x470eec
call edi
test eax, eax
je 0x470ee3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x470ee3
test byte [ebp - 8], 1
jne 0x470eec
or dword [ebp + 0x10], 0x200000
jmp 0x470f1f
mov eax, dword [0x49a188]
cmp eax, dword [ebp - 0x18]
je 0x470f1f
push eax
call esi
test eax, eax
je 0x470f1f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x470f1f
mov eax, dword [0x49a18c]
cmp eax, dword [ebp - 0x18]
je 0x470f1f
push eax
call esi
test eax, eax
je 0x470f1f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49a184]
call esi
test eax, eax
je 0x470f3b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x470f3d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004596f3
leave
ret
Function at 0x402820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4028b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402898
xor eax, eax
push ebp
push 0x402891
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4028d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402898
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004024f4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x424041], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403308
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4041c0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404378
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404221
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404394
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40428e
xor eax, eax
push ebp
push 0x404287
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404270
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4043b4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40428e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40436f
cmp byte [ebp - 0xd], 0
jne 0x4042d0
cmp byte [ebp - 0x12], 0
je 0x40436f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4042e9
dec ebx
cmp byte [ebx], 0x2e
je 0x4042f8
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4042e8
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40436f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404325
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40436f
cmp byte [ebp - 0xd], 0
je 0x40436f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40436f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406bf4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406cfe
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x406c47
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403468
jmp 0x406ce5
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00406ba8
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406bc8
mov ebx, eax
test esi, esi
je 0x406c6f
dec esi
test esi, esi
jl 0x406c6f
cmp edi, ebx
jne 0x406c4e
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004034a8
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403700
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004034fc
cmp eax, 2
jl 0x406ce5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406ce5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004034fc
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406ce5
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004034fc
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403700
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d05
lea eax, [ebp - 0x110]
call fcn.00403384
ret

Function at 0x406da8
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x423878]
mov byte [eax], 1
mov edx, dword [0x40556c]
xor eax, eax
call fcn.004058a0
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x406d98
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x406e38
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x406e53
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x406e62
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x406f2c
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [ebx + 0x19], 1
pop ebx
ret
Function at 0x4070d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x407168
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x40711d
mov eax, dword [ebx + 0x19]
call fcn.004036c0
push eax
push esi
mov eax, edi
call fcn.004036c0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004036c0
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x407152
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.004036c0
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.004069a4
mov eax, dword [ebp - 8]
call fcn.004036c0
push eax
mov eax, edi
call fcn.004036c0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004036c0
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40716f
lea eax, [ebp - 8]
call fcn.00403384
ret
Function at 0x408bfc
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x408c0b
mov edx, dword [edx + 0x36]
jmp fcn.004034a8
mov ecx, dword [edx + 0x18]
jecxz 0x408c03
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.0040382c
pop edx
mov ecx, dword [ebx]
jecxz 0x408c33
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x40d434
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
cmp dword [0x4234fc], 0
jne 0x40d455
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
sete al
jmp 0x40d457
mov al, 1
inc dword [0x4234fc]
add esp, 0x190
ret
Function at 0x4140a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4245e8
cmp dword [edi], 0
jne 0x414124
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4245e4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x423598
mov ecx, 2
call fcn.004025e0
mov edx, 0x414080
lea eax, [esi + 5]
call fcn.004140a0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004140a0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0x52b
jl 0x4140f9
mov dword [0x4245e4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x416ba0
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe48
cmp dword [0x424608], 0
ja 0x416c27
lea eax, [esp + 0x28]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esp
mov edx, 0x28
call fcn.00405408
mov dword [esp + 4], 0x416a24
mov eax, 0x416c30
mov dword [esp + 0x24], eax
mov eax, dword [0x423894]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
push esp
call sub.user32.dll_RegisterClassA
push 0
mov eax, dword [0x423894]
mov eax, dword [eax]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x80000000
push 0
mov eax, dword [esp + 0x4c]
push eax
push 0x80
call sub.user32.dll_CreateWindowExA
mov dword [0x424608], eax
call fcn.00405990
mov dword [0x42460c], eax
add esp, 0x1b8
ret

Function at 0x416e3c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jne 0x416ecb
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
mov word [esp], 2
push esi
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, edi
call fcn.004036c0
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x416ea6
mov eax, dword [ebx + 0xc]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebx + 0xc], eax
jmp 0x416ecb
push 0x23
push 0x400
mov eax, dword [0x424608]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.wsock32.dll_WSAAsyncSelect
cmp word [ebx + 0x26], 0
je 0x416ecb
mov edx, ebx
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x416f34
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
jmp 0x416f66
push 0
push esi
push edi
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x416f60
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x416f71
mov byte [ebx + 0x10], 1
jmp 0x416f66
sub esi, eax
add eax, edi
mov edi, eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x416f71
test esi, esi
ja 0x416f3f
pop edi
pop esi
pop ebx
ret

Function at 0x418098
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0xd], 0
cmp byte [ebx + 0x14], 0
jne 0x4180b7
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x4180b7
mov byte [ebx + 0xd], 1
pop ebx
ret

Function at 0x418144
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x14], 0
jne 0x41816f
mov byte [ebx + 0x14], 1
push 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_TerminateThread
cmp byte [ebx + 0xd], 0
jne 0x41816b
mov eax, ebx
call fcn.00417f28
jmp 0x41816f
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x41931c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004036b0
xor eax, eax
push ebp
push 0x4193fe
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp dword [ebx + 8], 0
jne 0x4193e8
lea eax, [ebx + 0xc]
call fcn.00403384
xor eax, eax
mov dword [ebx + 0x10], eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x419379
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
jmp 0x4193e8
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.00402750
mov word [ebp - 0x18], 2
mov ax, word [ebp - 8]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 4]
call fcn.004036c0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x4193d7
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebx + 8], eax
jmp 0x4193e8
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 4]
call fcn.004033d8
mov eax, dword [ebp - 8]
mov dword [ebx + 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419405
lea eax, [ebp - 4]
call fcn.00403384
ret
Function at 0x2580274
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0xc]
jb 0x25802ae
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 8], ecx
jb 0x25802d3
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jle 0x25802bf
mov eax, dword [ebp + 8]
jmp 0x25802e8
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x2580292
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
sub edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x25927b4
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
xorpd xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov eax, dword [0x10095fa0]
or eax, dword [0x10095fa4]
jne 0x259281b
push 0x33
call fcn.025927e1
mov eax, dword [0x10095fa0]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10095fa4]
mov dword [ebp - 8], ecx
push 0x33
call fcn.02592833
Function at 0x259ca34
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
cmp dword [0x10096060], 0
jne 0x259ca57
xor eax, eax
xor edx, edx
jmp 0x259cc23
lea eax, [ebp + 0x14]
mov dword [ebp - 0x48], eax
cmp dword [ebp + 0x10], 0
jle 0x259ca86
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x54], edx
jmp 0x259ca8f
xorpd xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 0
jle 0x259cac4
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x48]
add eax, 8
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x68], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x64], eax
jmp 0x259cacd
xorpd xmm0, xmm0
movlpd qword [ebp - 0x68], xmm0
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x28], edx
cmp dword [ebp + 0x10], 0
jle 0x259cb02
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x48]
add ecx, 8
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x259cb0b
xorpd xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x38], eax
cmp dword [ebp + 0x10], 0
jle 0x259cb40
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x259cb49
xorpd xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
xorpd xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
sub eax, 8
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 8], ax
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call 0x259cba4
add dword [esp], 5
retf
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.025df6c8
mov esp, ebp
pop ebp
ret
Function at 0x259cc34
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
cmp dword [ebp + 8], 0
je 0x259cc5e
cmp dword [ebp + 0xc], 0
jne 0x259cc58
cmp dword [ebp + 0x10], 0
je 0x259cc5e
cmp dword [ebp + 0x14], 0
jne 0x259cc62
xor al, al
jmp 0x259ccc6
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x33
call fcn.0259cc79
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.025df6c8
mov esp, ebp
pop ebp
ret

Function at 0x259d0c4
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
cmp dword [ebp + 8], 0
je 0x259d0ee
cmp dword [ebp + 0xc], 0
jne 0x259d0e8
cmp dword [ebp + 0x10], 0
je 0x259d0ee
cmp dword [ebp + 0x14], 0
jne 0x259d0f0
jmp 0x259d143
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
push 0x33
call 0x259d103
add dword [esp], 5
retf
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.025df6c8
mov esp, ebp
pop ebp
ret

Function at 0x259d1a4
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
xorpd xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
push 0x33
call 0x259d1c4
add dword [esp], 5
retf

Function at 0x25a4c24
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x25a4c6d
mov al, byte [esi]
push eax
call fcn.025b2014
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x25a4c4b
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x25adcb4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x71e], 0
je 0x25add37
cmp dword [edi + 0x1b0], 0
je 0x25add01
push esi
push 1
push edi
call fcn.025a0b94
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.025a0b94
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x25add37
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x10081650
push 2
push eax
call fcn.025e0339
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.025e0339
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x25b03b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.02593254
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.025ec3e6