joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abda1
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x4abdc3
mov eax, 0xfffffffd
jmp 0x4abea3
mov ebx, dword [0x95d11e]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x4abe71
mov ebx, dword [0x95d11e]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x4abe12
mov ebx, dword [0x95d11e]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x4abe12
mov eax, 1
jmp 0x4abe17
mov eax, 0
test eax, eax
je 0x4abe43
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x4abe2c
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x95d11e]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x4abe99
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x4abea3
mov esp, ebp
pop ebp
ret 4

Function at 0x4ac020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x4ac0d3
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x4ac63e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0053ad50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4ac683
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x691579
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.004a621f
add esp, 8
cmp eax, 0
jne 0x4ac6fe
call fcn.004ac782
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x95d126]
test ebx, ebx
je 0x4ac6c1
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov dword [0x95d126], eax
mov eax, dword [0x95d126]
test eax, eax
je 0x4ac6e5
push eax
mov ebx, eax
call fcn.004a6158
inc eax
push eax
call fcn.00538de3
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4ac6f8
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4ac739
push 0x202
push 0x4025ae0
push 6
call fcn.00538def
add esp, 0xc
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4ac74c
mov eax, 0x691579
push eax
push 1
mov ebx, 0x170
call fcn.0053ad90
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4ac76a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4ac77b
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4ac782
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0053ad50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4ac7c7
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.kernel32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4ac7fc
push 0x36
push 0x4025af6
push 6
call fcn.00538def
add esp, 0xc
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4ac80f
mov eax, 0x691579
push eax
push 1
mov ebx, 0x170
call fcn.0053ad90
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4ac82d
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4ac83e
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4ac843
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0053ad50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4ac888
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4ac8bd
push 0x36
push 0x4025ae1
push 6
call fcn.00538def
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x4ac8d9
push eax
mov ebx, eax
call fcn.004a6158
inc eax
push eax
call fcn.00538de3
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4ac8de
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4ac8ef
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4acc57
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.004ac020
test eax, eax
je 0x4acc9a
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x4acc9a
cmp word [eax], 0x5a4d
jne 0x4acc9a
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x4acc9a
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.004ac0f2
mov eax, dword [ebp + 8]
jmp 0x4accb3
mov esp, ebp
pop ebp
ret 4
Function at 0x4af9d8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.0053ad50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4afa1d
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4afa55
push 0x36
push 0x4010eb0
push 6
call fcn.00538def
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x4afa71
push eax
mov ebx, eax
call fcn.004a6158
inc eax
push eax
call fcn.00538de3
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4afa76
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4afa87
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4b10ab
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4b10b5
add dword [esp], 5
retf

Function at 0x4b1842
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4b184c
add dword [esp], 5
retf

Function at 0x4b18d7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x4b1957
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x4b1957
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x4b1957
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x4b1957
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x4b1948
test bl, bl
je 0x4b195b
dec eax
mov eax, edx
jmp 0x4b1934
inc ebp
test al, al
je 0x4b195b
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x4b192f
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x4b191b
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x4b1955
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret
Function at 0x4b19ae
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4b19e6
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4b19d4
mov al, 1
jmp 0x4b1a45
cmp dword [ebx + 0x54], ecx
jne 0x4b19dd
mov al, 2
jmp 0x4b1a45
cmp dword [ebx + 0x7c], ecx
jne 0x4b1a45
mov al, 3
jmp 0x4b1a45
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4b19fb
mov al, 4
jmp 0x4b1a45
cmp ecx, 5
jne 0x4b1a1b
cmp ebx, 0
jne 0x4b1a09
mov al, 5
jmp 0x4b1a45
cmp ebx, 1
jne 0x4b1a12
mov al, 6
jmp 0x4b1a45
cmp ebx, 2
jne 0x4b1a1b
mov al, 7
jmp 0x4b1a45
cmp ecx, 6
jne 0x4b1a43
cmp ebx, 0
jne 0x4b1a29
mov al, 8
jmp 0x4b1a45
cmp ebx, 1
jne 0x4b1a30
mov al, 9
cmp ebx, 2
jne 0x4b1a37
mov al, 0xa
cmp ebx, 3
jne 0x4b1a3e
mov al, 0xb
cmp ebx, 4
jne 0x4b1a45
mov al, 0xc
pop ebx
leave
ret

Function at 0x4b1a56
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b1a82
add dword [esp], 5
retf

Function at 0x4b1b15
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4b1b1f
add dword [esp], 5
retf

Function at 0x4b20e2
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4b20ec
add dword [esp], 5
retf

Function at 0x4b2177
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b21a3
add dword [esp], 5
retf

Function at 0x4b2269
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4b2273
add dword [esp], 5
retf
Function at 0x4b7388
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.004b7462
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b73c3
add dword [esp], 5
retf
Function at 0x4b7801
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4b784e
mov al, cl
cmp al, 0x61
jb 0x4b7829
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4b784e
mov al, cl
cmp al, 0x61
jb 0x4b7841
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x4b781a
cmp edx, dword [esp + 0x18]
je 0x4b785e
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x4b7813
xor eax, eax
jmp 0x4b7861
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x4b7869
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x4b7950
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x4b7956
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4b78b5
cmp al, 0x61
jb 0x4b78ad
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4b78a0
cmp edx, dword [esp + 0x14]
je 0x4b78c5
dec ecx
jne 0x4b7895
xor eax, eax
jmp 0x4b7950
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x4b7950
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x4b7950
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x4b7901
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x4b7910
jmp 0x4b78f8
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.004b7801
test eax, eax
je 0x4b7950
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4b794b
cmp al, 0x61
jb 0x4b7943
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4b7936
call fcn.004b7869
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x4b796e
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x4b796e
sub edx, ecx
mov ecx, edx
jmp 0x4b78c5
xor eax, eax
jmp 0x4b7950
Function at 0x4b8bb8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4b8bf0
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4b8bde
mov al, 1
jmp 0x4b8c4f
cmp dword [ebx + 0x54], ecx
jne 0x4b8be7
mov al, 2
jmp 0x4b8c4f
cmp dword [ebx + 0x7c], ecx
jne 0x4b8c4f
mov al, 3
jmp 0x4b8c4f
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4b8c05
mov al, 4
jmp 0x4b8c4f
cmp ecx, 5
jne 0x4b8c25
cmp ebx, 0
jne 0x4b8c13
mov al, 5
jmp 0x4b8c4f
cmp ebx, 1
jne 0x4b8c1c
mov al, 6
jmp 0x4b8c4f
cmp ebx, 2
jne 0x4b8c25
mov al, 7
jmp 0x4b8c4f
cmp ecx, 6
jne 0x4b8c4d
cmp ebx, 0
jne 0x4b8c33
mov al, 8
jmp 0x4b8c4f
cmp ebx, 1
jne 0x4b8c3a
mov al, 9
cmp ebx, 2
jne 0x4b8c41
mov al, 0xa
cmp ebx, 3
jne 0x4b8c48
mov al, 0xb
cmp ebx, 4
jne 0x4b8c4f
mov al, 0xc
pop ebx
leave
ret

Function at 0x4b8d4e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4b8d58
add dword [esp], 5
retf

Function at 0x4b9c9b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0053ad50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4b9ce0
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4b9d15
push 0x36
push 0x4012a84
push 6
call fcn.00538def
add esp, 0xc
push 0x691691
push dword [ebp - 4]
mov ecx, 2
call fcn.004a61c3
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4b9d35
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4b9d46
push ebx
call fcn.00538de9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4bbbf6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], esp
mov eax, dword [0x95d192]
push eax
push 0x24
call fcn.00538de3
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4bbcab
push 0
push 0x4010cd5
push 6
call fcn.00538def
add esp, 0xc
mov ebx, dword [ebp - 8]
push ebx
mov edi, dword [ebp - 0xc]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.00538de9
add esp, 4
mov ebx, dword [0x95d192]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp word [ebx], 6
je 0x4bbd66
mov ebx, dword [0x95d192]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp word [ebx], 9
je 0x4bbd66
mov ebx, dword [0x95d192]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp word [ebx], 0xa
je 0x4bbd66
xor eax, eax
jmp 0x4bbd6b
mov eax, 1
mov dword [0x95d196], eax
mov eax, dword [0x95d196]
jmp 0x4bbd7a
mov esp, ebp
pop ebp
ret

Function at 0x4c2d47
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4c2d51
add dword [esp], 5
retf
Function at 0x4c57e3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4c583c
push 0x19
push 0x401472c
push 6
call fcn.00538def
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x1f4
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4c5870
push 0x5d
push 0x401472c
push 6
call fcn.00538def
add esp, 0xc
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4c589c
push 0x80
push 0x401472c
push 6
call fcn.00538def
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x4c58a4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c69f2
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CheckRemoteDebuggerPresent]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4c6a32
push 0
push 0x402542d
push 6
call fcn.00538def
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x4c6a3a
mov esp, ebp
pop ebp
ret 4
Function at 0x4cbfd9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4cc011
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4cbfff
mov al, 1
jmp 0x4cc070
cmp dword [ebx + 0x54], ecx
jne 0x4cc008
mov al, 2
jmp 0x4cc070
cmp dword [ebx + 0x7c], ecx
jne 0x4cc070
mov al, 3
jmp 0x4cc070
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4cc026
mov al, 4
jmp 0x4cc070
cmp ecx, 5
jne 0x4cc046
cmp ebx, 0
jne 0x4cc034
mov al, 5
jmp 0x4cc070
cmp ebx, 1
jne 0x4cc03d
mov al, 6
jmp 0x4cc070
cmp ebx, 2
jne 0x4cc046
mov al, 7
jmp 0x4cc070
cmp ecx, 6
jne 0x4cc06e
cmp ebx, 0
jne 0x4cc054
mov al, 8
jmp 0x4cc070
cmp ebx, 1
jne 0x4cc05b
mov al, 9
cmp ebx, 2
jne 0x4cc062
mov al, 0xa
cmp ebx, 3
jne 0x4cc069
mov al, 0xb
cmp ebx, 4
jne 0x4cc070
mov al, 0xc
pop ebx
leave
ret
Function at 0x4d4fd2
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4d5013
push 0x2b
push 0x4014fb9
push 6
call fcn.00538def
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
setne al
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4d5051
push 0x59
push 0x4014fb9
push 6
call fcn.00538def
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x4d5059
mov esp, ebp
pop ebp
ret 4

Function at 0x4d6b20
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4d6b2a
add dword [esp], 5
retf

Function at 0x4d6ce8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4d6cf2
add dword [esp], 5
retf

Function at 0x4d6d7d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x4d6dfd
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x4d6dfd
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x4d6dfd
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x4d6dfd
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x4d6dee
test bl, bl
je 0x4d6e01
dec eax
mov eax, edx
jmp 0x4d6dda
inc ebp
test al, al
je 0x4d6e01
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x4d6dd5
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x4d6dc1
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x4d6dfb
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret

Function at 0x4d6e80
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4d6eac
add dword [esp], 5
retf
Function at 0x4d749f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4d74d7
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4d74c5
mov al, 1
jmp 0x4d7536
cmp dword [ebx + 0x54], ecx
jne 0x4d74ce
mov al, 2
jmp 0x4d7536
cmp dword [ebx + 0x7c], ecx
jne 0x4d7536
mov al, 3
jmp 0x4d7536
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4d74ec
mov al, 4
jmp 0x4d7536
cmp ecx, 5
jne 0x4d750c
cmp ebx, 0
jne 0x4d74fa
mov al, 5
jmp 0x4d7536
cmp ebx, 1
jne 0x4d7503
mov al, 6
jmp 0x4d7536
cmp ebx, 2
jne 0x4d750c
mov al, 7
jmp 0x4d7536
cmp ecx, 6
jne 0x4d7534
cmp ebx, 0
jne 0x4d751a
mov al, 8
jmp 0x4d7536
cmp ebx, 1
jne 0x4d7521
mov al, 9
cmp ebx, 2
jne 0x4d7528
mov al, 0xa
cmp ebx, 3
jne 0x4d752f
mov al, 0xb
cmp ebx, 4
jne 0x4d7536
mov al, 0xc
pop ebx
leave
ret

Function at 0x4d7547
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4d7551
add dword [esp], 5
retf