joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001392d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001392d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41c998
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push ebx
call sub.ADVAPI32.DLL_CryptAcquireContextA
add esp, 0xc
test eax, eax
je 0x41c9d4
sub esp, 0xc
lea eax, [ebx + 4]
push eax
push 0
push 0
push 0x8003
push dword [ebx]
call sub.ADVAPI32.DLL_CryptCreateHash
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x1eda0733
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1825484f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x94
mov dword [ebp - 0x17], 0x65746f4e
mov dword [ebp - 0x13], 0x41646170
mov word [ebp - 0xf], 0x7070
mov byte [ebp - 0xd], 0
lea edx, [ebp - 0x40]
mov eax, 0
mov ecx, 0xa
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3c], sym._WndProc_16
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 6
lea eax, [ebp - 0x17]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sym._RegisterClassA_4
sub esp, 4
test ax, ax
jne 0x4014f1
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Erro
mov dword [esp + 4], str.Erro_ao_registrar_a_classe_da_janela_
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov eax, 1
jmp 0x40169f
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x1e0
mov dword [esp + 0x18], 0x280
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], str.Bloco_de_Notas
lea eax, [ebp - 0x17]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401590
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Erro
mov dword [esp + 4], str.Erro_ao_criar_a_janela_
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov eax, 1
jmp 0x40169f
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x1ba
mov dword [esp + 0x18], 0x270
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50a00044
mov dword [esp + 8], 0x4060b9
mov dword [esp + 4], str.EDIT
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [0x408070], eax
mov eax, dword [0x408070]
test eax, eax
jne 0x401631
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Erro
mov dword [esp + 4], str.Erro_ao_criar_o_controle_de_edio_
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov eax, 1
jmp 0x40169f
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._UpdateWindow_4
sub esp, 4
jmp 0x401672
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._TranslateMessage_4
sub esp, 4
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._DispatchMessageA_4
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetMessageA_16
sub esp, 0x10
test eax, eax
jne 0x401656
mov eax, dword [ebp - 0x54]
mov edi, dword [ebp - 4]
leave
ret 0x10
Function at 0x4016a6
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
cmp eax, 2
je 0x401784
cmp eax, 0x10
je 0x4016cb
cmp eax, 1
je 0x4017ba
jmp 0x401795
mov eax, dword [0x408070]
mov dword [esp], eax
call sym._GetWindowTextLengthA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x401774
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401774
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov eax, dword [0x408070]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._GetWindowTextA_12
sub esp, 0xc
mov dword [esp + 4], 0x4060e6
mov dword [esp], str.texto_salvo.txt
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401769
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._DestroyWindow_4
sub esp, 4
jmp 0x4017bb
mov dword [esp], 0
call sym._PostQuitMessage_4
sub esp, 4
jmp 0x4017bb
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._DefWindowProcA_16
sub esp, 0x10
jmp 0x4017c0
nop
mov eax, 0
leave
ret 0x10
Function at 0x401e10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x401e5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401e54
test esi, esi
je 0x401e54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e30
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402040
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402168
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4020ce
cmp eax, 4
jne 0x4020f0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4020de
cmp edx, 4
je 0x4020de
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402040
Function at 0x403f40
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x403f76
jmp 0x403fae
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x403f73
cmp al, 9
je 0x403f73
cmp al, 0x22
jne 0x403f97
jmp 0x403ff6
cmp al, 9
je 0x403fa3
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x403f90
jmp 0x403fa3
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x403fa0
cmp al, 9
je 0x403fa0
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x403fbd
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x404002
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x403ff2
cmp al, 0x22
jne 0x403fa3
lea ebx, [edx + 2]
jmp 0x403fa3
Function at 0x4035d4
Capabilities:
Encode data using xor

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, str.user.config
sub eax, eax
test esi, esi
je 0x4036ac
sub eax, 1
test ecx, ecx
je 0x4036aa
test esi, 3
je 0x403612
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4035f7
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x403691
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40361c
mov ecx, edx
test ecx, ecx
je 0x4036aa
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x403697
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x403cc4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
shr eax, 0x10
mov edx, dword [edi + 0x3c]
mov dword [ebp - 0xc], edx
mov esi, dword [edx + edi + 0x78]
add esi, edi
test ax, ax
jne 0x403cf3
movzx ecx, cx
sub ecx, dword [esi + 0x10]
jmp 0x403d4f
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
add ecx, edi
add eax, edi
mov dword [ebp - 4], ecx
mov dword [ebp + 8], eax
mov dword [ebp - 8], ebx
cmp dword [esi + 0x18], ebx
jbe 0x403d3d
mov ebx, dword [ecx]
add ebx, edi
push ebx
call fcn.0040690b
push eax
push ebx
call fcn.00403838
add esp, 0xc
cmp eax, dword [ebp + 0xc]
je 0x403d46
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add ecx, 4
add dword [ebp + 8], 2
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp eax, dword [esi + 0x18]
jb 0x403d0b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
movzx ecx, word [eax]
test ecx, ecx
je 0x403d3d
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edi]
add ecx, edi
cmp ecx, esi
jbe 0x403d77
mov eax, ecx
sub eax, esi
cmp eax, dword [edx + edi + 0x7c]
jae 0x403d77
push ebx
push edi
call fcn.00403803
pop ecx
pop ecx
mov ecx, eax
mov eax, ecx
jmp 0x403d3f
Function at 0x403d7b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0xc]
mov esi, ebx
mov eax, dword [esi + 0x18]
push dword [esi + 0x28]
mov dword [ebp - 8], eax
call fcn.00403877
mov edi, eax
pop ecx
test edi, edi
je 0x403dcf
push 0
push edi
call fcn.00403eea
push edi
call fcn.00406924
add eax, eax
push eax
push edi
call fcn.00403838
add esp, 0x14
cmp dword [ebp + 8], eax
je 0x403de0
mov esi, dword [esi]
cmp ebx, esi
jne 0x403d9b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 8]
jmp 0x403dd7

Function at 0x405572
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
push edi
mov word [edx + 0x100], 1
mov eax, ecx
mov ebx, 0x100
mov byte [eax + edx], al
inc eax
cmp eax, ebx
jl 0x40558d
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov al, byte [ecx + edi]
xor byte [esi + edx], al
inc ecx
xor eax, eax
cmp ecx, dword [ebp + 0x10]
cmovge ecx, eax
inc esi
cmp esi, ebx
jl 0x40559a
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x405d5f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x41455243
mov dword [ebp - 0xc], 0x54204554
mov dword [ebp - 8], 0x454c4241
call fcn.0040690b
mov dword [ebp - 4], eax
lea esi, [eax + 0x10]
push esi
call fcn.0040377c
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x405e5a
push edi
push esi
push 0
push ebx
call fcn.0040374e
mov edi, ebx
mov byte [ebx + 0xc], 0x20
lea esi, [ebp - 0x10]
lea eax, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push eax
call fcn.0040372b
push 0x7d0
lea eax, [esi + 0xe]
mov byte [ebx + esi + 0xd], 0x20
push eax
push ebx
push dword [ebp + 8]
call fcn.004051ff
push ebx
mov esi, eax
call fcn.004037ab
add esp, 0x2c
test esi, esi
je 0x405e57
push 0x415194
push esi
call fcn.00406af6
mov edi, eax
pop ecx
pop ecx
inc edi
je 0x405e57
push 0x415198
push edi
call fcn.00406af6
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x405e28
push edi
call fcn.0040690b
push ebx
mov esi, eax
call fcn.0040690b
pop ecx
pop ecx
lea ecx, [esi + edi]
sub ecx, eax
mov byte [ecx - 1], 0
jmp 0x405e53
push 0x4151a0
push edi
call fcn.00406af6
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x405e57
push edi
call fcn.0040690b
push ebx
mov esi, eax
call fcn.0040690b
pop ecx
pop ecx
lea ecx, [esi + edi]
sub ecx, eax
mov byte [ecx], 0
mov eax, edi
jmp 0x405e59
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407b29
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407b46
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x407b48
xor eax, eax
pop ebp
ret
Function at 0x407e45
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x3c
push edi
test ecx, ecx
jle 0x407e6b
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 8], eax
jmp 0x407e73
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
test ecx, ecx
jle 0x407e8c
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x10], eax
jmp 0x407e94
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
test ecx, ecx
jle 0x407ead
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x18], eax
jmp 0x407eb5
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
test ecx, ecx
jle 0x407ece
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x20], eax
jmp 0x407ed6
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
and dword [ebp - 4], 0
mov eax, edx
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x3c], eax
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x407f01
add dword [esp], 5
retf

Function at 0x407f78
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push esi
push edi
je 0x407ffa
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test ecx, ecx
jne 0x407f94
test eax, eax
je 0x407ffa
cmp dword [ebp + 0x14], 0
je 0x407ffa
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
push 0x33
call fcn.00407fab
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4081d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push esi
push edi
je 0x40823e
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test ecx, ecx
jne 0x4081eb
test eax, eax
je 0x40823e
cmp dword [ebp + 0x14], 0
je 0x40823e
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
push 0x33
call 0x4081fe
add dword [esp], 5
retf
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40826e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
push 0x33
call 0x408282
add dword [esp], 5
retf
Function at 0x40d32c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x90], 0xf8a8ac1d
mov dword [ebp - 0x8c], 0x3e48b8d3
mov dword [ebp - 0x88], 0xa3e7d48
mov dword [ebp - 0x84], 0x26dd0762
mov dword [ebp - 0x80], 0x38167e6
mov dword [ebp - 0x7c], 0xa513b2e7
mov dword [ebp - 0x78], 0x4fee79b0
mov dword [ebp - 0x74], 0xed15410f
mov dword [ebp - 0x70], 0xe58c147b
mov dword [ebp - 0x6c], 0xc10d464b
mov dword [ebp - 0x68], 0xe7d6fe8e
mov dword [ebp - 0x64], 0x8b067527
mov dword [ebp - 0x60], 0xfdc0049
mov dword [ebp - 0x5c], 0xfd9ea030
mov dword [ebp - 0x58], 0xc8f18509
mov dword [ebp - 0x54], 0x8c175aa
mov dword [ebp - 0x50], 0xe2017905
mov dword [ebp - 0x4c], 0x80afd897
mov dword [ebp - 0x48], 0x710b6038
mov dword [ebp - 0x44], 0x7753680e
mov dword [ebp - 0x40], 0xf6610f2f
mov dword [ebp - 0x3c], 0x5c8f8e1d
mov dword [ebp - 0x38], 0x74213db2
mov dword [ebp - 0x34], 0x6b54b40
mov dword [ebp - 0x30], 0xbd7aab6e
mov dword [ebp - 0x2c], 0x327ea98b
mov dword [ebp - 0x28], 0x24066e8f
mov dword [ebp - 0x24], 0xa5a429d9
mov dword [ebp - 0x20], 0xfd2326be
mov dword [ebp - 0x1c], 0xf4cf1ee
mov dword [ebp - 0x18], 0xfb585e74
mov dword [ebp - 0x14], 0x91ef7491
mov dword [ebp - 0x10], 0x2e6d6f63
mov dword [ebp - 0xc], 0x6c707061
mov dword [ebp - 8], 0x61532e65
mov dword [ebp - 4], 0x69726166
call fcn.0040d54c
mov ebx, eax
mov dword [ebp - 0xa0], ebx
pop ecx
test ebx, ebx
je 0x40d544
and dword [ebp - 0x94], esi
lea eax, [ebp - 0x94]
push edi
push eax
push ebx
call fcn.0040434e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40d53c
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x40d53c
push esi
push esi
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0x90]
push 0xe28d3f7b
push 3
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xac], 0x90
call fcn.00403de5
xor edx, edx
lea ecx, [ebp - 0x9c]
push ecx
push edx
push edx
push edx
lea ecx, [ebp - 0xac]
push ecx
push edx
lea ecx, [ebp - 0xb4]
push ecx
call eax
test eax, eax
je 0x40d535
mov ebx, dword [ebp - 0x98]
movzx eax, byte [ebx]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x9c]
add eax, 0xfffffffc
push eax
call fcn.0040377c
mov esi, eax
pop ecx
test esi, esi
je 0x40d523
mov ecx, dword [ebp - 0x9c]
add ecx, 0xfffffffc
push ecx
push 0
push esi
call fcn.0040374e
push dword [ebp - 0xa4]
lea eax, [ebx + 4]
push eax
push esi
call fcn.0040372b
add esp, 0x18
push dword [ebp - 0x98]
call fcn.004042a3
mov ebx, dword [ebp - 0xa0]
pop ecx
push edi
call fcn.004037ab
pop ecx
push ebx
call fcn.004037ab
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fc54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00406924
add eax, eax
mov dword [ebp - 4], eax
lea edi, [eax + 2]
push edi
call fcn.0040377c
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x40fcb8
push edi
push 0
push ebx
call fcn.0040374e
mov al, byte [esi + 1]
add esp, 0xc
xor al, byte [esi]
or al, 0x50
mov byte [esi], al
push 2
pop edi
cmp dword [ebp - 4], edi
jbe 0x40fcb6
mov al, byte [esi]
xor byte [edi + esi], al
movzx eax, byte [edi + esi]
push eax
push ebx
push 0x41777c
push ebx
call fcn.00406acd
add esp, 0x10
inc edi
cmp edi, dword [ebp - 4]
jb 0x40fc97
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4125b3
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 5
jge 0x4125c6
xor eax, eax
jmp 0x412689
push ebx
push 0x63
pop eax
push 0x3a
mov word [ebp - 0x14], ax
xor ebx, ebx
pop eax
push 0x5c
mov word [ebp - 0x12], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x10], ax
xor eax, eax
push 0xf375eed5
push ebx
mov word [ebp - 0xe], ax
call fcn.00403de5
push ebx
push ebx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
call eax
test eax, eax
movzx eax, word [ebp - 4]
jne 0x412614
mov eax, 0xff00ff
push esi
push edi
push eax
call fcn.004037c8
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 4]
pop ecx
shr edi, 0x10
movzx ecx, byte [esi + 1]
and edi, 0x1f
movzx eax, byte [esi]
inc edi
shl ecx, 8
or ecx, eax
mov eax, ebx
add edi, ecx
jmp 0x412642
call fcn.004037d5
dec edi
test edi, edi
jg 0x41263c
movzx edx, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
cmp eax, edx
jne 0x412665
movzx ebx, byte [esi + 4]
cmp ebx, 0x40
jge 0x412665
cmp ebx, dword [ebp + 0xc]
jle 0x412669
xor eax, eax
jmp 0x412686
xor edi, edi
test ebx, ebx
jle 0x412680
call fcn.004037d5
xor al, byte [edi + esi + 5]
mov byte [edi + esi], al
inc edi
cmp edi, ebx
jl 0x41266f
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret