joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3de3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.005227a0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4b3e28
push ebx
call fcn.005211da
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4b3e5d
push 0x36
push 0x4020c39
push 6
call fcn.005211e0
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x4b3e79
push eax
mov ebx, eax
call fcn.0049bd83
inc eax
push eax
call fcn.005211d4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4b3e7e
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4b3e8f
push ebx
call fcn.005211da
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4b41d3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.004b35c0
test eax, eax
je 0x4b4216
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x4b4216
cmp word [eax], 0x5a4d
jne 0x4b4216
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x4b4216
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.004b3692
mov eax, dword [ebp + 8]
jmp 0x4b422f
mov esp, ebp
pop ebp
ret 4

Function at 0x4b77d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4b7808
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4b77f6
mov al, 1
jmp 0x4b7867
cmp dword [ebx + 0x54], ecx
jne 0x4b77ff
mov al, 2
jmp 0x4b7867
cmp dword [ebx + 0x7c], ecx
jne 0x4b7867
mov al, 3
jmp 0x4b7867
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4b781d
mov al, 4
jmp 0x4b7867
cmp ecx, 5
jne 0x4b783d
cmp ebx, 0
jne 0x4b782b
mov al, 5
jmp 0x4b7867
cmp ebx, 1
jne 0x4b7834
mov al, 6
jmp 0x4b7867
cmp ebx, 2
jne 0x4b783d
mov al, 7
jmp 0x4b7867
cmp ecx, 6
jne 0x4b7865
cmp ebx, 0
jne 0x4b784b
mov al, 8
jmp 0x4b7867
cmp ebx, 1
jne 0x4b7852
mov al, 9
cmp ebx, 2
jne 0x4b7859
mov al, 0xa
cmp ebx, 3
jne 0x4b7860
mov al, 0xb
cmp ebx, 4
jne 0x4b7867
mov al, 0xc
pop ebx
leave
ret

Function at 0x4ba955
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4ba981
add dword [esp], 5
retf

Function at 0x4baa14
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4baa1e
add dword [esp], 5
retf

Function at 0x4bafe1
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4bb00d
add dword [esp], 5
retf
Function at 0x4bb0d3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4bb0dd
add dword [esp], 5
retf
Function at 0x4c1ec8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4c1f09
push 0x2b
push 0x4014fb9
push 6
call fcn.005211e0
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
setne al
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4c1f47
push 0x59
push 0x4014fb9
push 6
call fcn.005211e0
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x4c1f4f
mov esp, ebp
pop ebp
ret 4

Function at 0x4c24ac
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], esp
mov eax, dword [0x76d86e]
push eax
push 0x24
call fcn.005211d4
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4c2561
push 0
push 0x4010cd5
push 6
call fcn.005211e0
add esp, 0xc
mov ebx, dword [ebp - 8]
push ebx
mov edi, dword [ebp - 0xc]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.005211da
add esp, 4
mov ebx, dword [0x76d86e]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp word [ebx], 6
je 0x4c261c
mov ebx, dword [0x76d86e]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp word [ebx], 9
je 0x4c261c
mov ebx, dword [0x76d86e]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp word [ebx], 0xa
je 0x4c261c
xor eax, eax
jmp 0x4c2621
mov eax, 1
mov dword [0x76d872], eax
mov eax, dword [0x76d872]
jmp 0x4c2630
mov esp, ebp
pop ebp
ret
Function at 0x4c39c7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.005227a0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c3a0c
push ebx
call fcn.005211da
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4c3a44
push 0x36
push 0x4010eb0
push 6
call fcn.005211e0
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x4c3a60
push eax
mov ebx, eax
call fcn.0049bd83
inc eax
push eax
call fcn.005211d4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4c3a65
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c3a76
push ebx
call fcn.005211da
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4cb5ca
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4cb5d4
add dword [esp], 5
retf
Function at 0x4d32b3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4d32bd
add dword [esp], 5
retf
Function at 0x4da54f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4da559
add dword [esp], 5
retf

Function at 0x4da717
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4da721
add dword [esp], 5
retf

Function at 0x4da7ac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x4da82c
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x4da82c
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x4da82c
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x4da82c
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x4da81d
test bl, bl
je 0x4da830
dec eax
mov eax, edx
jmp 0x4da809
inc ebp
test al, al
je 0x4da830
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x4da804
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x4da7f0
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x4da82a
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret

Function at 0x4da8af
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4da8db
add dword [esp], 5
retf

Function at 0x4daece
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4daf06
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4daef4
mov al, 1
jmp 0x4daf65
cmp dword [ebx + 0x54], ecx
jne 0x4daefd
mov al, 2
jmp 0x4daf65
cmp dword [ebx + 0x7c], ecx
jne 0x4daf65
mov al, 3
jmp 0x4daf65
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4daf1b
mov al, 4
jmp 0x4daf65
cmp ecx, 5
jne 0x4daf3b
cmp ebx, 0
jne 0x4daf29
mov al, 5
jmp 0x4daf65
cmp ebx, 1
jne 0x4daf32
mov al, 6
jmp 0x4daf65
cmp ebx, 2
jne 0x4daf3b
mov al, 7
jmp 0x4daf65
cmp ecx, 6
jne 0x4daf63
cmp ebx, 0
jne 0x4daf49
mov al, 8
jmp 0x4daf65
cmp ebx, 1
jne 0x4daf50
mov al, 9
cmp ebx, 2
jne 0x4daf57
mov al, 0xa
cmp ebx, 3
jne 0x4daf5e
mov al, 0xb
cmp ebx, 4
jne 0x4daf65
mov al, 0xc
pop ebx
leave
ret

Function at 0x4daf76
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4daf80
add dword [esp], 5
retf
Function at 0x4e2846
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x76d94e]
push ebx
call fcn.005211da
add esp, 4
mov eax, 0x5f68e9
mov dword [0x76d94e], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.005211da
add esp, 4
mov eax, 0x5f68e9
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x4e29a1
call dword [sym.imp.user32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4e28b3
push 0x34
push 0x4020c59
push 6
call fcn.005211e0
add esp, 0xc
mov eax, dword [0x76d94e]
push eax
push eax
mov ebx, eax
call fcn.0049d344
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.005211d4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.005211da
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x76d94e]
call fcn.0049f6cf
jmp 0x4e28fa
mov esp, ebp
pop ebp
ret 8

Function at 0x4e2abd
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x4e2bd3
call dword [sym.imp.user32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4e2af8
push 0
push 0x4020c5b
push 6
call fcn.005211e0
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x4e2b00
mov esp, ebp
pop ebp
ret 4
Function at 0x4e5ede
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x4e5f03
mov eax, 0x5f68e9
push eax
push 1
mov ebx, 0x194
call fcn.00522350
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 8]
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4e5f57
push 0x3b
push 0x40236d6
push 6
call fcn.005211e0
add esp, 0xc
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x4e5f6f
mov eax, 0x5f68e9
push eax
push 1
mov ebx, 0x194
call fcn.00522350
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x4e5fa3
add eax, 8
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4e5fd0
push 0x90
push 0x40236d6
push 6
call fcn.005211e0
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x4e5fd8
mov esp, ebp
pop ebp
ret 8
Function at 0x4e9839
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.shlwapi.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4e9870
push 0x12
push 0x40220f9
push 6
call fcn.005211e0
add esp, 0xc
jmp 0x4e9875
mov esp, ebp
pop ebp
ret 4
Function at 0x50392c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.005211d4
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.005211d4
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.005211d4
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.00527420
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x5039e5
mov eax, 0
jmp 0x503b51
cmp dword [ebp + 0xc], 0
jne 0x503a1b
mov dword [ebp - 0x18], esp
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x503a18
push 0xa0
push 0x402387b
push 6
call fcn.005211e0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x503a43
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x503a3d
push ebx
call fcn.005211da
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_OpenProcessToken]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x503a78
push 0x104
push 0x402387b
push 6
call fcn.005211e0
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x5f69a4
call dword [sym.imp.advapi32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x503aae
push 0x12e
push 0x402387b
push 6
call fcn.005211e0
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x503b4c
push 0x225
push 0x402387b
push 6
call fcn.005211e0
add esp, 0xc
jmp 0x503b51
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.005211da
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.005211da
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.005211da
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x507549
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x507553
add dword [esp], 5
retf

Function at 0x50842c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x508436
add dword [esp], 5
retf

Function at 0x50bb3e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x50bb6a
add dword [esp], 5
retf

Function at 0x520922
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x520947
mov eax, 0x5f68e9
push eax
push 1
mov ebx, 0x194
call fcn.00522350
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 8]
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x52099b
push 0x4e
push 0x40236de
push 6
call fcn.005211e0
add esp, 0xc
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.004e6f56
mov eax, dword [ebp - 4]
jmp 0x5209b4
mov esp, ebp
pop ebp
ret 8

Function at 0x522700
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x522792
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x522784
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x52277c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x522745
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x523a80
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x523ae9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00521c50
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x523f70
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x523f8e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x523f83
pop esi
ret

Function at 0x524360
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.005288c0
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x5244b0
test ecx, ecx
je 0x5244b0
inc ecx
push ecx
call fcn.00529b77
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00529b50
mov edi, eax
add esp, 0xc
test edi, edi
je 0x5243d9
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x52449d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.00529b77
add esp, 4
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x524461
cmp eax, 0xea
jne 0x524489
push esi
call fcn.00529b3e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00529b77
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x52442c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x52446f
cmp eax, 2
jne 0x524489
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00528170
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.00529b3e
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ebp
call fcn.00529b3e
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x5244de
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x5244ea
mov edx, dword [esp + 0x40]
test edx, edx
je 0x5244ea
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00528170
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret