joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f77a
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CheckRemoteDebuggerPresent]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x49f7ba
push 0
push 0x402542d
push 6
call fcn.005295e1
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x49f7c2
mov esp, ebp
pop ebp
ret 4

Function at 0x4a05af
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4a05b9
add dword [esp], 5
retf

Function at 0x4a0777
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4a0781
add dword [esp], 5
retf

Function at 0x4a080c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x4a088c
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x4a088c
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x4a088c
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x4a088c
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x4a087d
test bl, bl
je 0x4a0890
dec eax
mov eax, edx
jmp 0x4a0869
inc ebp
test al, al
je 0x4a0890
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x4a0864
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x4a0850
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x4a088a
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret

Function at 0x4a08fa
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a0926
add dword [esp], 5
retf

Function at 0x4a364c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4a3684
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4a3672
mov al, 1
jmp 0x4a36e3
cmp dword [ebx + 0x54], ecx
jne 0x4a367b
mov al, 2
jmp 0x4a36e3
cmp dword [ebx + 0x7c], ecx
jne 0x4a36e3
mov al, 3
jmp 0x4a36e3
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4a3699
mov al, 4
jmp 0x4a36e3
cmp ecx, 5
jne 0x4a36b9
cmp ebx, 0
jne 0x4a36a7
mov al, 5
jmp 0x4a36e3
cmp ebx, 1
jne 0x4a36b0
mov al, 6
jmp 0x4a36e3
cmp ebx, 2
jne 0x4a36b9
mov al, 7
jmp 0x4a36e3
cmp ecx, 6
jne 0x4a36e1
cmp ebx, 0
jne 0x4a36c7
mov al, 8
jmp 0x4a36e3
cmp ebx, 1
jne 0x4a36ce
mov al, 9
cmp ebx, 2
jne 0x4a36d5
mov al, 0xa
cmp ebx, 3
jne 0x4a36dc
mov al, 0xb
cmp ebx, 4
jne 0x4a36e3
mov al, 0xc
pop ebx
leave
ret
Function at 0x4a36f4
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a3720
add dword [esp], 5
retf

Function at 0x4a37b3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4a37bd
add dword [esp], 5
retf

Function at 0x4a4a7b
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a4aa7
add dword [esp], 5
retf

Function at 0x4a4b6d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4a4b77
add dword [esp], 5
retf
Function at 0x4a98c3
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x4a98e5
mov eax, 0xfffffffd
jmp 0x4a99c5
mov ebx, dword [0x988f33]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x4a9993
mov ebx, dword [0x988f33]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x4a9934
mov ebx, dword [0x988f33]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x4a9934
mov eax, 1
jmp 0x4a9939
mov eax, 0
test eax, eax
je 0x4a9965
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x4a994e
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x988f33]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x4a99bb
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x4a99c5
mov esp, ebp
pop ebp
ret 4

Function at 0x4a9b42
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x4a9bf5
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x4aa160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0052b4f0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4aa1a5
push ebx
call fcn.005295db
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x7f6c38
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.0049547f
add esp, 8
cmp eax, 0
jne 0x4aa220
call fcn.004aa2a4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x988f3b]
test ebx, ebx
je 0x4aa1e3
push ebx
call fcn.005295db
add esp, 4
pop eax
mov dword [0x988f3b], eax
mov eax, dword [0x988f3b]
test eax, eax
je 0x4aa207
push eax
mov ebx, eax
call fcn.004953b8
inc eax
push eax
call fcn.005295d5
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4aa21a
push ebx
call fcn.005295db
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4aa25b
push 0x202
push 0x4027571
push 6
call fcn.005295e1
add esp, 0xc
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4aa26e
mov eax, 0x7f6c38
push eax
push 1
mov ebx, 0x170
call fcn.0052c1d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4aa28c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4aa29d
push ebx
call fcn.005295db
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4aa2a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0052b4f0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4aa2e9
push ebx
call fcn.005295db
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.kernel32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4aa31e
push 0x36
push 0x4027587
push 6
call fcn.005295e1
add esp, 0xc
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4aa331
mov eax, 0x7f6c38
push eax
push 1
mov ebx, 0x170
call fcn.0052c1d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4aa34f
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4aa360
push ebx
call fcn.005295db
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4aa365
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0052b4f0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4aa3aa
push ebx
call fcn.005295db
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4aa3df
push 0x36
push 0x4027572
push 6
call fcn.005295e1
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x4aa3fb
push eax
mov ebx, eax
call fcn.004953b8
inc eax
push eax
call fcn.005295d5
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4aa400
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4aa411
push ebx
call fcn.005295db
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4aa779
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.004a9b42
test eax, eax
je 0x4aa7bc
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x4aa7bc
cmp word [eax], 0x5a4d
jne 0x4aa7bc
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x4aa7bc
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.004a9c14
mov eax, dword [ebp + 8]
jmp 0x4aa7d5
mov esp, ebp
pop ebp
ret 4
Function at 0x4ad4fa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.0052b4f0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4ad53f
push ebx
call fcn.005295db
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4ad577
push 0x36
push 0x4010eb0
push 6
call fcn.005295e1
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x4ad593
push eax
mov ebx, eax
call fcn.004953b8
inc eax
push eax
call fcn.005295d5
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4ad598
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4ad5a9
push ebx
call fcn.005295db
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4ae661
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4ae66b
add dword [esp], 5
retf
Function at 0x4af1b6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], esp
mov eax, dword [0x988f73]
push eax
push 0x24
call fcn.005295d5
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4af26b
push 0
push 0x4010cd5
push 6
call fcn.005295e1
add esp, 0xc
mov ebx, dword [ebp - 8]
push ebx
mov edi, dword [ebp - 0xc]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.005295db
add esp, 4
mov ebx, dword [0x988f73]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp word [ebx], 6
je 0x4af326
mov ebx, dword [0x988f73]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp word [ebx], 9
je 0x4af326
mov ebx, dword [0x988f73]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp word [ebx], 0xa
je 0x4af326
xor eax, eax
jmp 0x4af32b
mov eax, 1
mov dword [0x988f77], eax
mov eax, dword [0x988f77]
jmp 0x4af33a
mov esp, ebp
pop ebp
ret

Function at 0x4b09f8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b0a24
add dword [esp], 5
retf
Function at 0x4b1031
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4b1069
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4b1057
mov al, 1
jmp 0x4b10c8
cmp dword [ebx + 0x54], ecx
jne 0x4b1060
mov al, 2
jmp 0x4b10c8
cmp dword [ebx + 0x7c], ecx
jne 0x4b10c8
mov al, 3
jmp 0x4b10c8
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4b107e
mov al, 4
jmp 0x4b10c8
cmp ecx, 5
jne 0x4b109e
cmp ebx, 0
jne 0x4b108c
mov al, 5
jmp 0x4b10c8
cmp ebx, 1
jne 0x4b1095
mov al, 6
jmp 0x4b10c8
cmp ebx, 2
jne 0x4b109e
mov al, 7
jmp 0x4b10c8
cmp ecx, 6
jne 0x4b10c6
cmp ebx, 0
jne 0x4b10ac
mov al, 8
jmp 0x4b10c8
cmp ebx, 1
jne 0x4b10b3
mov al, 9
cmp ebx, 2
jne 0x4b10ba
mov al, 0xa
cmp ebx, 3
jne 0x4b10c1
mov al, 0xb
cmp ebx, 4
jne 0x4b10c8
mov al, 0xc
pop ebx
leave
ret

Function at 0x4b10d9
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4b10e3
add dword [esp], 5
retf

Function at 0x4b3856
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4b3897
push 0x2b
push 0x4014fb9
push 6
call fcn.005295e1
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
setne al
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4b38d5
push 0x59
push 0x4014fb9
push 6
call fcn.005295e1
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x4b38dd
mov esp, ebp
pop ebp
ret 4
Function at 0x4b4da1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0052b4f0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4b4de6
push ebx
call fcn.005295db
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4b4e1b
push 0x36
push 0x4012a84
push 6
call fcn.005295e1
add esp, 0xc
push 0x7f77dd
push dword [ebp - 4]
mov ecx, 2
call fcn.00495423
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4b4e3b
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4b4e4c
push ebx
call fcn.005295db
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4b4ebb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4b4f14
push 0x19
push 0x401472c
push 6
call fcn.005295e1
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x1f4
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4b4f48
push 0x5d
push 0x401472c
push 6
call fcn.005295e1
add esp, 0xc
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4b4f74
push 0x80
push 0x401472c
push 6
call fcn.005295e1
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x4b4f7c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4b7f95
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.004b806f
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b7fd0
add dword [esp], 5
retf
Function at 0x4b840e
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4b845b
mov al, cl
cmp al, 0x61
jb 0x4b8436
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4b845b
mov al, cl
cmp al, 0x61
jb 0x4b844e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x4b8427
cmp edx, dword [esp + 0x18]
je 0x4b846b
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x4b8420
xor eax, eax
jmp 0x4b846e
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x4b8476
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x4b855d
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x4b8563
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4b84c2
cmp al, 0x61
jb 0x4b84ba
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4b84ad
cmp edx, dword [esp + 0x14]
je 0x4b84d2
dec ecx
jne 0x4b84a2
xor eax, eax
jmp 0x4b855d
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x4b855d
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x4b855d
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x4b850e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x4b851d
jmp 0x4b8505
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.004b840e
test eax, eax
je 0x4b855d
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4b8558
cmp al, 0x61
jb 0x4b8550
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4b8543
call fcn.004b8476
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x4b857b
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x4b857b
sub edx, ecx
mov ecx, edx
jmp 0x4b84d2
xor eax, eax
jmp 0x4b855d
Function at 0x4cb632
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4cb63c
add dword [esp], 5
retf
Function at 0x4d0a4b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4d0a83
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4d0a71
mov al, 1
jmp 0x4d0ae2
cmp dword [ebx + 0x54], ecx
jne 0x4d0a7a
mov al, 2
jmp 0x4d0ae2
cmp dword [ebx + 0x7c], ecx
jne 0x4d0ae2
mov al, 3
jmp 0x4d0ae2
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4d0a98
mov al, 4
jmp 0x4d0ae2
cmp ecx, 5
jne 0x4d0ab8
cmp ebx, 0
jne 0x4d0aa6
mov al, 5
jmp 0x4d0ae2
cmp ebx, 1
jne 0x4d0aaf
mov al, 6
jmp 0x4d0ae2
cmp ebx, 2
jne 0x4d0ab8
mov al, 7
jmp 0x4d0ae2
cmp ecx, 6
jne 0x4d0ae0
cmp ebx, 0
jne 0x4d0ac6
mov al, 8
jmp 0x4d0ae2
cmp ebx, 1
jne 0x4d0acd
mov al, 9
cmp ebx, 2
jne 0x4d0ad4
mov al, 0xa
cmp ebx, 3
jne 0x4d0adb
mov al, 0xb
cmp ebx, 4
jne 0x4d0ae2
mov al, 0xc
pop ebx
leave
ret
Function at 0x4dadcd
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x989073]
push ebx
call fcn.005295db
add esp, 4
mov eax, 0x7f6c41
mov dword [0x989073], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.005295db
add esp, 4
mov eax, 0x7f6c41
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x4daf28
call dword [sym.imp.user32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4dae3a
push 0x34
push 0x4027592
push 6
call fcn.005295e1
add esp, 0xc
mov eax, dword [0x989073]
push eax
push eax
mov ebx, eax
call fcn.00495398
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.005295d5
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.005295db
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x989073]
call fcn.00496013
jmp 0x4dae81
mov esp, ebp
pop ebp
ret 8

Function at 0x4db044
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x4db15a
call dword [sym.imp.user32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4db07f
push 0
push 0x4027594
push 6
call fcn.005295e1
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x4db087
mov esp, ebp
pop ebp
ret 4