joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e7a7460
Capabilities:
Inspect section memory permissions

Disassembly:
xlatb
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a7486
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a748f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a7499
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a747b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]

Function at 0x1e7a74b0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a7423
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a7441
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
invalid
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a749f
mov edx, edi
jbe 0x1e7a7405
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1e7a74ec
dec eax
je 0x1e7a74e3
sub eax, 3
je 0x1e7a74da
mov dword [ebp - 4], 0x40
jmp 0x1e7a7509
mov dword [ebp - 4], 4
jmp 0x1e7a74ef
mov dword [ebp - 4], 0x20
jmp 0x1e7a74ef
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
invalid

Function at 0x1e7a7960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aaa
add al, 0x68
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
invalid
test esp, esi
cli
invalid
Function at 0x1e7a7ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edx + 0x21fffffc], ebx
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
invalid
invalid
sahf
cld
invalid

Function at 0x1e7a9c90
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], 0
push ebx
mov ebx, dword [sym.imp.python27.dll_Py_FatalError]
push esi
push edi
mov edi, dword [sym.imp.python27.dll_PyThreadState_Swap]
jne 0x1e7a9ccd
push 0
call edi
mov esi, eax
add esp, 4
test esi, esi
jne 0x1e7a9cbf
push str.pywintypes:_can_not_setup_interpreter_state__as_current_state_is_invalid
call ebx
add esp, 4
mov eax, dword [esi + 4]
push esi
mov dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], eax
call edi
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1e7a9ce7
push 0x1e7b10fc
call ebx
add esp, 4
mov ecx, dword [0x1e7ba8b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
call edi
push eax
mov dword [esi], eax
call edi
add esp, 8
pop edi
mov dword [esi + 4], 0
pop esi
pop ebx
ret

Function at 0x1e7a9d10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1e7ba8b8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1e7a9d7f
push esi
push edi
mov edi, dword [sym.imp.python27.dll_Py_FatalError]
cmp dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], eax
jne 0x1e7a9d3a
push str.Can_not_setup_thread_state__as_have_no_interpreter_state
call edi
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1e7a9d54
push str.Out_of_memory_allocating_thread_state.
call edi
add esp, 4
mov ecx, dword [0x1e7ba8b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState]
push edx
call dword [sym.imp.python27.dll_PyThreadState_New]
add esp, 4
mov dword [esi], eax
mov eax, 1
pop edi
mov dword [esi + 4], eax
pop esi
ret
xor eax, eax
ret

Function at 0x1e7a9dd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1e7ba8b8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1e7a9e0b
cmp dword [esi + 4], 0
je 0x1e7a9e0b
mov ecx, dword [esi]
push ecx
call dword [sym.imp.python27.dll_PyThreadState_Delete]
mov edx, dword [0x1e7ba8b8]
add esp, 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
ret
Function at 0x4024da
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, eax
dec eax
test ecx, ecx
je 0x4024f3
lea ecx, [eax + 1]
mov eax, dword [esp + 4]
xor byte [eax], 0xa5
inc eax
dec ecx
jne 0x4024ec
ret

Function at 0x406b72
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, 0x2000000
push edi
mov eax, dword [esi]
mov ebx, 0xff0000
mov edi, 0xff00
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
cmp eax, ebp
mov eax, dword [esi + 0x18]
jne 0x406bbf
mov ecx, dword [eax + 8]
mov edx, ecx
mov ebp, ecx
and edx, ebx
shr ebp, 0x10
or edx, ebp
mov ebp, ecx
shl ebp, 0x10
and ecx, edi
or ebp, ecx
shr edx, 8
shl ebp, 8
or edx, ebp
mov ebp, 0x2000000
jmp 0x406bc2
mov edx, dword [eax + 8]
test dl, 1
je 0x406c82
mov ecx, dword [esi]
cmp dword [ecx + 4], ebp
mov ecx, dword [eax]
jne 0x406bfb
mov edx, ecx
mov ebp, ecx
and edx, ebx
shr ebp, 0x10
or edx, ebp
mov ebp, ecx
shl ebp, 0x10
and ecx, edi
or ebp, ecx
shr edx, 8
shl ebp, 8
or edx, ebp
mov ebp, 0x2000000
mov dword [esp + 0x14], edx
jmp 0x406bff
mov dword [esp + 0x14], ecx
mov ecx, dword [esi]
cmp dword [ecx + 4], ebp
jne 0x406c2c
mov ecx, dword [eax + 4]
mov edx, ecx
mov ebp, ecx
and edx, ebx
shr ebp, 0x10
or edx, ebp
mov ebp, ecx
shl ebp, 0x10
and ecx, edi
or ebp, ecx
shr edx, 8
shl ebp, 8
or edx, ebp
mov ebp, 0x2000000
jmp 0x406c2f
mov edx, dword [eax + 4]
add eax, 0xc
push edx
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24]
call fcn.00408e10
add esp, 0x10
test eax, eax
jne 0x406c7b
mov eax, dword [esi]
cmp dword [eax + 4], ebp
mov eax, dword [esi + 0x18]
jne 0x406c73
mov eax, dword [eax]
mov ecx, eax
mov edx, eax
and ecx, ebx
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, edi
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
jmp 0x406c75
mov ecx, dword [eax]
cmp dword [esp + 0x14], ecx
je 0x406cc0
xor eax, eax
jmp 0x406d38
cmp dword [esp + 0x14], ebp
jne 0x406cad
mov ecx, dword [eax]
mov edx, ecx
mov ebp, ecx
and edx, ebx
shr ebp, 0x10
or edx, ebp
mov ebp, ecx
shl ebp, 0x10
and ecx, edi
or ebp, ecx
shr edx, 8
shl ebp, 8
or edx, ebp
mov ebp, 0x2000000
jmp 0x406caf
mov edx, dword [eax]
add eax, 0xc
push edx
push eax
push dword [esp + 0x20]
call fcn.00408b78
add esp, 0xc
mov eax, dword [esi]
mov esi, dword [esi + 0x18]
mov eax, dword [eax + 4]
cmp eax, ebp
mov dword [esp + 0x14], eax
jne 0x406cf1
mov eax, dword [esi + 8]
mov ecx, eax
mov edx, eax
and ecx, ebx
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, edi
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
jmp 0x406cf4
mov ecx, dword [esi + 8]
test cl, 2
je 0x406d34
cmp dword [esp + 0x14], ebp
mov edx, dword [esp + 0x18]
jne 0x406d23
mov ecx, dword [esi]
mov eax, ecx
mov esi, ecx
and eax, ebx
shr esi, 0x10
or eax, esi
mov esi, ecx
shl esi, 0x10
and ecx, edi
or esi, ecx
shr eax, 8
shl esi, 8
or eax, esi
jmp 0x406d25
mov eax, dword [esi]
mov ecx, eax
dec eax
test ecx, ecx
je 0x406d34
inc eax
xor byte [edx], 0xea
inc edx
dec eax
jne 0x406d2d
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x406f2e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
call dword [0x40c0ec]
push dword [ebp - 4]
call dword [0x40c114]
pop ecx
pop ecx
call dword [0x40c110]
mov edi, eax
mov eax, dword [ebp + 8]
and edi, 0x7f
add edi, 0x20
and edi, 0xfffffffc
cmp dword [eax + 4], 0x2000000
jne 0x406f8f
mov eax, dword [eax + 8]
mov ebx, eax
mov ecx, eax
and ebx, 0xff0000
shr ecx, 0x10
or ebx, ecx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shr ebx, 8
shl ecx, 8
or ebx, ecx
jmp 0x406f92
mov ebx, dword [eax + 8]
mov ecx, dword [ebp + 0xc]
add ebx, edi
lea eax, [ebx + 0xc]
push eax
mov dword [ecx], eax
call dword [0x40c0a8]
mov esi, eax
pop ecx
test esi, esi
je 0x40701d
push 0x10
mov dword [esi + 4], 2
pop eax
mov word [esi + 0xc], di
cmp edi, eax
mov dword [esi + 8], ebx
mov dword [ebp + 0xc], eax
jbe 0x406fd6
call dword [0x40c110]
mov ecx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], edi
mov byte [ecx + esi], al
jb 0x406fc2
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx + 8], eax
jbe 0x406ff2
add edi, esi
mov edx, dword [eax + ecx]
xor edx, ebx
mov dword [edi + eax], edx
add eax, 4
cmp eax, dword [ecx + 8]
jb 0x406fe2
push 4
push 0x40d1bc
push esi
call fcn.00408b78
push 0xc
lea eax, [esi + ebx]
push esi
push eax
call fcn.00408b78
push 4
push 0x40d1b4
push esi
call fcn.00408b78
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4070ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, dword [ebx]
test esi, esi
je 0x4071a5
push 4
push 0x40d1b4
push esi
call fcn.00408b7e
add esp, 0xc
test eax, eax
jne 0x4071a5
mov eax, dword [esi + 4]
mov edx, 0x2000000
cmp eax, edx
jne 0x40714b
mov ecx, dword [esi + 8]
mov eax, ecx
mov edi, ecx
and eax, 0xff0000
shr edi, 0x10
or eax, edi
mov edi, ecx
shl edi, 0x10
and ecx, 0xff00
or edi, ecx
shr eax, 8
shl edi, 8
or eax, edi
jmp 0x40714e
mov eax, dword [esi + 8]
cmp dword [esi + 4], edx
jne 0x407168
mov cx, word [esi + 0xc]
xor edx, edx
movzx edi, cx
mov dh, cl
movzx ecx, dx
shr edi, 8
or edi, ecx
jmp 0x40716c
movzx edi, word [esi + 0xc]
sub eax, edi
push eax
mov dword [ebp + 8], eax
call dword [0x40c0a8]
pop ecx
mov dword [ebx], eax
xor ecx, ecx
cmp eax, ecx
jne 0x407185
xor eax, eax
jmp 0x4071a8
cmp dword [ebp + 8], ecx
mov dword [ebx + 0xc], 1
jbe 0x4071a5
lea edx, [edi + esi]
mov edi, dword [edx + ecx]
xor edi, dword [esi + 8]
mov dword [ecx + eax], edi
add ecx, 4
cmp ecx, dword [ebp + 8]
jb 0x407194
push 1
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x7db270
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0x7db2cb
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
sub dword [ebp + 8], 1
mov byte [edi - 1], dl
jne 0x7db290
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x118e41c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call fcn.00e1b4ec
invalid
jmp 0x7db730
Function at 0x4011bb
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp loc.01c3efc1

Function at 0x402199
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x402239
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [0x1c11a28]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x402236
push 0x46
push 0x406a092
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40226f
push 0x75
push 0x406a092
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4022a7
push 0x9c
push 0x406a092
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push 0x46e2ee
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4022dd
push 0xc6
push 0x406a092
push 6
call fcn.00456f15
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x402376
push 0x1d6
push 0x406a092
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
xor eax, eax
call dword [0x1c11a2c]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4023a5
push 0x216
push 0x406a092
push 6
call fcn.00456f15
add esp, 0xc
mov eax, dword [ebp - 0x14]
jmp 0x4023ad
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00456f0f
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4035cd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403610
push 0x19
push 0x40b494e
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403627
mov eax, 0x46e255
jmp 0x4036d6
inc dword [ebp - 4]
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x46e389]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.00401194
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.00457b30
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403675
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004036ee
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4036b7
push 0x136
push 0x40b494e
push 6
call fcn.00456f15
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x4036d1
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00456f09
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4036d6
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4036e7
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40545e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
jne 0x4054b0
push 0
mov ebx, 0x108
call fcn.004582a0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4054aa
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
push dword [ebp + 8]
call fcn.00405571
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4054f1
push 0x99
push 0x406327a
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405525
push 0xe0
push 0x406327a
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [0x1c11a2c]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405563
push 0x10e
push 0x406327a
push 6
call fcn.00456f15
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x40556b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x407338
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
jmp loc.01c32fc3
Function at 0x40a0f3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x433083
jmp loc.01c42b75

Function at 0x40a7b7
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp loc.01c33713
Function at 0x411a7e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push htons
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x411ac6
mov eax, 0x46e255
push eax
push 1
mov ebx, 0x194
call fcn.00457cf0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x411aeb
jmp 0x411c73
push dword [ebp + 8]
call fcn.004036ee
mov dword [ebp - 8], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x46e389]
fstp qword [ebp - 0x28]
mov dword [ebp - 0x2c], esp
fld qword [ebp - 0x28]
call fcn.00401194
push eax
push 0x40
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x411b3f
push 0x129
push 0x40b4930
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 0xc], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fsub qword [0x46e389]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.00401194
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x411c44
fild dword [ebp - 8]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild dword [ebp - 0x10]
fstp qword [ebp - 0x28]
fadd qword [ebp - 0x28]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
call fcn.00401194
push eax
call fcn.00404a67
mov word [ebp - 0x14], ax
cmp word [ebp - 0x14], 0
jne 0x411be2
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x411bd8
push 0x222
push 0x40b4930
push 6
call fcn.00456f15
add esp, 0xc
jmp 0x411c44
cmp word [ebp - 0x14], 0x5c
jne 0x411c2b
cmp dword [ebp - 0x18], 0
jle 0x411c28
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x411c28
push 0x2c3
push 0x40b4930
push 6
call fcn.00456f15
add esp, 0xc
inc dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00411c79
pop ebx
pop ecx
pop edx
add ecx, 2
jmp 0x411b68
add esp, 0xc
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x411c73
push 0x374
push 0x40b4930
push 6
call fcn.00456f15
add esp, 0xc
mov esp, ebp
pop ebp
ret 4

Function at 0x411f2a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
jmp loc.01c326d6
Function at 0x431a91
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
push 0xc
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x54], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 0xc
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x58], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
push 0xc
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x6c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x70], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x74], eax
mov edi, eax
mov esi, 0x46e255
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x78], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x7c], 0
push 0x10
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x80], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x84], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x90], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
jmp loc.01c3cb07

Function at 0x435c0a
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.01c34f28
push ebp
mov ebp, esp
sub esp, 0x48
push 0x48
call fcn.00456f09
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x1c104de
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x433073

Function at 0x435fe9
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c11988]
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x33
call fcn.00436013