joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ed50
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp + 0xc], eax
jne 0x1003ed70
jmp 0x1003eee6
mov eax, dword [ebp + 0xc]
push eax
call fcn.1003dfe0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003eea6
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1003e060
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.OpenProcessHandler:_Injection_info_created_for_Pid__d__handle_0x_x._n
call fcn.1003def0
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1003edc5
push str.OpenProcessHandler:_Error___cannot_create_new_injection_info._n
call fcn.1003def0
add esp, 4
jmp 0x1003eea4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 8]
push edx
call fcn.10074450
add esp, 4
mov ecx, dword [0x10661938]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp + 8]
push edx
call fcn.10074e10
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x1003ee2e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.OpenProcessHandler:_Image_base_for_process__d__handle_0x_x_:_0x_p._n
call fcn.1003def0
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1003ee76
push str.OpenProcessHandler:_Handle_insufficient_to_obtain_target_process_name._n
call fcn.1003def0
add esp, 4
push str.Unable_to_obtain_target_process_name
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [0x10661938]
mov eax, dword [edx + 0x14]
push eax
call fcn.1003df70
add esp, 0xc
jmp 0x1003eea4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [0x10661938]
mov eax, dword [edx + 0x14]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.10038c20
add esp, 0xc
test eax, eax
jne 0x1003eea4
push str.OpenProcessHandler:_Error_translating_target_process_path
call fcn.1003f670
add esp, 4
jmp 0x1003eee6
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x1003eee6
mov eax, dword [ebp + 8]
push eax
call fcn.10074e10
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x1003eee6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x103df1c0
call fcn.1003def0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1003f670
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x400
mov edx, dword [ebp - 4]
push edx
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x104
push 0
push 0x10501208
call fcn.1024b810
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0xffffffffffffffff
push 0x104
push 0x10501208
call fcn.10001170
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10252faa
add esp, 0x20
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x1003f6f9
mov dword [ebp - 0x14], 0xffffffff
jmp 0x1003f6ff
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 0x104
push 0
push 0x10501100
call fcn.1024b810
add esp, 0xc
mov ecx, dword [ebp - 0x18]
push ecx
push 0x10501208
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
push str.Error__d__0x_x_____s:__s
push 0xffffffffffffffff
push 0x104
push 0x10501100
call fcn.1003f600
add esp, 0x20
cmp dword [0x104f31e4], 0
je 0x1003f753
push 0x10501100
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1003f7a0
push 0x104
push 0
push 0x10500ff8
call fcn.1024b810
add esp, 0xc
push 0x10501100
push str.CRITICAL:_s
push 0xffffffffffffffff
push 0x104
push 0x10500ff8
call fcn.1003f600
add esp, 0x14
push 0x10500ff8
call fcn.1024f510
add esp, 4
push eax
push 0x10500ff8
call fcn.1007c790
add esp, 8
mov dword [ebp - 0xc], 0
mov esp, ebp
pop ebp
ret
Function at 0x10047f70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov dword [ebp - 8], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
mov word [ebp - 0xc], ax
push 0x208
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.1024b810
add esp, 0xc
mov edx, 2
shl edx, 0
mov eax, 0x3a
mov word [ebp + edx - 0x10], ax
push 3
mov ecx, dword [ebp - 8]
call fcn.100483e0
mov byte [ebp - 1], 0x61
jmp 0x10047fc6
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movsx edx, byte [ebp - 1]
cmp edx, 0x7a
jg 0x10048083
movsx ax, byte [ebp - 1]
mov ecx, 2
imul edx, ecx, 0
mov word [ebp + edx - 0x10], ax
push 0x104
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jbe 0x1004807e
movsx edx, byte [ebp - 1]
push edx
call fcn.1025c8d4
add esp, 4
mov ecx, 2
imul edx, ecx, 0
mov word [ebp + edx - 0x224], ax
mov eax, 2
shl eax, 0
mov ecx, 0x3a
mov word [ebp + eax - 0x224], cx
mov edx, 2
shl edx, 1
xor eax, eax
mov word [ebp + edx - 0x224], ax
lea ecx, [ebp - 0x42c]
push ecx
call fcn.1025326f
add esp, 4
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x42c]
push edx
push 0x104
lea eax, [ebp - 0x21e]
push eax
call fcn.1025c7fb
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10048480
jmp 0x10047fbd
mov ecx, dword [ebp - 8]
call fcn.100481c0
mov esp, ebp
pop ebp
ret
Function at 0x10050de0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x104f4eb0], 0
je 0x10050df2
jmp 0x10050f87
push 0x1030953c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10050e0b
jmp 0x10050f87
push 0x10309548
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ea0], eax
push 0x1030955c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ecc], eax
push 0x10309570
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ebc], eax
push 0x10309580
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ed4], eax
push 0x10309590
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4eb8], eax
push 0x103095a0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4edc], eax
push 0x103095b8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ec8], eax
push 0x103095d4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ed8], eax
push 0x103095f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ed0], eax
push 0x1030960c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ec0], eax
push 0x10309624
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ec4], eax
push 0x10309634
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ea4], eax
push str.NtSetInformationThread
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4eac], eax
push str.NtSuspendProcess
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4ea8], eax
push 0x10309670
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4eb4], eax
push str.NtOpenSymbolicLinkObject
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4e94], eax
push str.NtQuerySymbolicLinkObject
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4e98], eax
push 0x103096bc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4eb0], eax
push 0x103096d4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f4e9c], eax
mov esp, ebp
pop ebp
ret
Function at 0x100516b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10052650
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1024a276
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x38], eax
mov ecx, dword [ebp - 8]
call fcn.10052810
movzx ecx, al
test ecx, ecx
je 0x10051827
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call fcn.10055fa0
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x44], eax
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x38]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005181f
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10052250
mov ecx, dword [ebp - 8]
call fcn.10051470
movzx edx, al
test edx, edx
je 0x1005181f
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.100525d0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jae 0x1005181f
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x44], 0
jbe 0x100517aa
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x44]
cmp edx, dword [ebp - 0x10]
jae 0x100517aa
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x44]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1024a271
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.1024a276
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x38], ecx
push 0
push 0
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005181f
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x38]
push eax
mov ecx, dword [ebp - 8]
call fcn.10052250
mov ecx, dword [ebp - 8]
call fcn.10052900
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 4
Function at 0x100534a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x2c]
push ecx
call fcn.1024a276
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0x28], eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005350e
mov dword [ebp - 8], 1
jmp 0x10053515
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x100543d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 8]
call fcn.100544a0
movzx eax, al
test eax, eax
jne 0x100543f3
xor al, al
jmp 0x10054493
mov ecx, dword [ebp - 8]
call fcn.10052810
movzx ecx, al
test ecx, ecx
je 0x10054490
mov ecx, dword [ebp - 8]
call fcn.10052670
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call fcn.10055fa0
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
push ecx
call fcn.1024a276
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x2c], eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x30]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10054488
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 8]
call fcn.10052900
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x10055fa0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xffffffff
je 0x10055fe2
cmp dword [ebp + 8], 0
je 0x10055fe2
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10055fd8
xor eax, eax
xor edx, edx
jmp 0x10055fe6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
jmp 0x10055fe6
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x10055ff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
je 0x10056069
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10056041
cmp dword [ebp - 8], 0
je 0x10056041
xor al, al
jmp 0x1005606b
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10056063
mov al, 1
jmp 0x1005606b
xor al, al
jmp 0x1005606b
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10056070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
je 0x100560ef
cmp dword [ebp + 0x14], 0
je 0x100560ef
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x100560c7
cmp dword [ebp - 8], 0
je 0x100560c7
xor al, al
jmp 0x100560f1
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100560e9
mov al, 1
jmp 0x100560f1
xor al, al
jmp 0x100560f1
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10061a30
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], 0
jle 0x10061a68
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 8
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov edx, dword [eax - 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
jmp 0x10061a70
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp + 0x10], 0
jle 0x10061aa5
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx - 8]
mov eax, dword [ecx - 4]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
jmp 0x10061aad
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], edx
cmp dword [ebp + 0x10], 0
jle 0x10061ae2
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, 8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x10061aea
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], eax
cmp dword [ebp + 0x10], 0
jle 0x10061b1f
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 8
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov edx, dword [eax - 4]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
jmp 0x10061b27
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, 8
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0xc], 0
xor ecx, ecx
mov word [ebp - 4], cx
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call fcn.10061b81

Function at 0x10061c10
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x33
call fcn.10061c1d
Function at 0x10062510
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10062548
push str.WoW64fix:_Failed_to_get_OS_version
call fcn.1003f670
add esp, 4
xor eax, eax
jmp 0x100626b5
cmp dword [ebp - 0xa8], 6
jne 0x1006255a
cmp dword [ebp - 0xa4], 1
ja 0x10062563
cmp dword [ebp - 0xa8], 6
jbe 0x10062585
mov ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
push str.WoW64fix:_Windows_version__d._d_not_supported._n
call fcn.1003def0
add esp, 0xc
xor eax, eax
jmp 0x100626b5
push 0x10661130
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [0x10661130], 0
jne 0x100625b4
push str.WoW64_not_detected._n
call fcn.1003def0
add esp, 4
xor eax, eax
jmp 0x100626b5
push 0x103e612c
call fcn.10061f10
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push str.wow64.dll
call fcn.10061f10
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push str.Wow64PrepareForException
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10061f50
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0x103e5e54
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10061f50
add esp, 0xc
mov dword [0x10661120], eax
mov dword [0x10661124], edx
push str.NtSetContextThread
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.10061f50
add esp, 0xc
mov dword [0x10661118], eax
mov dword [0x1066111c], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [0x1066111c]
push edx
mov eax, dword [0x10661118]
push eax
mov ecx, dword [0x10661124]
push ecx
mov edx, dword [0x10661120]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push str.WoW64_detected:_64_bit_ntdll_base:_0x_x__KiUserExceptionDispatcher:_0x_x__NtSetContextThread:_0x_x__Wow64PrepareForException:_0x_x_n
call fcn.1003def0
add esp, 0x24
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x10661118]
push eax
mov ecx, dword [0x10661120]
push ecx
call fcn.100621e0
add esp, 0xc
mov dword [0x10661128], eax
mov dword [0x1066112c], edx
call fcn.10062420
mov edx, dword [0x1066112c]
push edx
mov eax, dword [0x10661128]
push eax
push str.WoW64_workaround:_KiUserExceptionDispatcher_hook_installed_at:_0x_x_n
call fcn.1003def0
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret