joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018910
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100191c9
mov eax, dword fs:[0]
push eax
mov eax, 0x103c
call fcn.1000c9f0
mov eax, dword [0x10021030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1030], 0
lea ecx, [ebp - 0x101c]
call fcn.10001100
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1020]
call fcn.10001100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1018]
call fcn.10001100
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1024]
push eax
call fcn.10016d30
add esp, 4
mov dword [ebp - 0x1034], eax
mov ecx, dword [ebp - 0x1034]
mov dword [ebp - 0x1038], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1038]
push edx
lea ecx, [ebp - 0x1020]
call fcn.10001160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1024]
call fcn.10001140
push str.6F2A522A5E2A582A4B2A632A442A4C2A452A042A432A442A432A2A2A
lea eax, [ebp - 0x1028]
push eax
call fcn.100110b0
add esp, 8
mov dword [ebp - 0x103c], eax
mov ecx, dword [ebp - 0x103c]
mov dword [ebp - 0x1040], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x1040]
push edx
lea ecx, [ebp - 0x1020]
call fcn.10001180
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1028]
call fcn.10001140
mov ax, word [0x1001e034]
mov word [ebp - 0x1014], ax
push 0xffe
push 0
lea ecx, [ebp - 0x1012]
push ecx
call fcn.10004e00
add esp, 0xc
push 0x1000
push 0
lea edx, [ebp - 0x1014]
push edx
call fcn.10004e00
add esp, 0xc
lea ecx, [ebp - 0x1020]
call fcn.10001880
push eax
push 0x800
lea eax, [ebp - 0x1014]
push eax
push 0x1001e038
push 0x1001e03c
push 0x1001e048
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x1014]
push ecx
call fcn.10004e7a
add esp, 4
cmp eax, 0x1b
jbe 0x10018b53
lea edx, [ebp - 0xfde]
push edx
lea ecx, [ebp - 0x1018]
call fcn.100027f0
push 1
lea ecx, [ebp - 0x1018]
call fcn.10001880
push eax
lea eax, [ebp - 0x102c]
push eax
call fcn.10011860
add esp, 0xc
mov dword [ebp - 0x1044], eax
mov ecx, dword [ebp - 0x1044]
mov dword [ebp - 0x1048], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1048]
push edx
lea ecx, [ebp - 0x101c]
call fcn.10001160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x102c]
call fcn.10001140
lea ecx, [ebp - 0x101c]
call fcn.10001250
movzx eax, al
test eax, eax
jne 0x10018b53
lea ecx, [ebp - 0x101c]
push ecx
call fcn.10018640
add esp, 4
lea ecx, [ebp - 0x101c]
call fcn.10001880
push eax
call fcn.10018500
add esp, 4
test eax, eax
jne 0x10018b34
lea ecx, [ebp - 0x101c]
call fcn.100011a0
jmp 0x10018b53
movzx edx, byte [0x10023f2c]
and edx, 0xf
mov byte [0x10023f2c], dl
movzx eax, byte [0x10023f2c]
add eax, 0x10
mov byte [0x10023f2c], al
lea ecx, [ebp - 0x101c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10001120
mov edx, dword [ebp - 0x1030]
or edx, 1
mov dword [ebp - 0x1030], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1018]
call fcn.10001140
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1020]
call fcn.10001140
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101c]
call fcn.10001140
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10004cab
mov esp, ebp
pop ebp
ret
Function at 0x1e55058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01e551a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1e5507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e5506a
add dl, dl
jne 0x1e55089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e550dc
xor eax, eax
add dl, dl
jne 0x1e55096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e5517d
add dl, dl
jne 0x1e550a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e550b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e550bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e550c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1e550d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1e55075
mov eax, 1
add dl, dl
jne 0x1e550ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e550f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e550e1
sub eax, ebx
mov ebx, 1
jne 0x1e55128
mov ecx, 1
add dl, dl
jne 0x1e5510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1e55119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e55105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e55075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1e5513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1e5514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e55136
cmp eax, 0x7d00
jae 0x1e5516d
cmp eax, 0x500
jb 0x1e55168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e55075
cmp eax, 0x7f
ja 0x1e55170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e55075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1e5519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1e55075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401500
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x50
call dbg.__main
mov dword [esp + 0x16], 0x505c3a43
mov dword [esp + 0x1a], 0x72676f72
mov dword [esp + 0x1e], 0x46206d61
mov dword [esp + 0x22], 0x73656c69
mov dword [esp + 0x26], 0x6e69575c
mov dword [esp + 0x2a], 0x73776f64
mov dword [esp + 0x2e], 0x66654420
mov dword [esp + 0x32], 0x65646e65
mov dword [esp + 0x36], 0x635c7272
mov dword [esp + 0x3a], 0x6d782e63
mov word [esp + 0x3e], 0x6c
mov dword [esp + 4], 0x404000
lea eax, [esp + 0x16]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x4c], eax
cmp dword [esp + 0x4c], 0
jne 0x40159a
mov dword [esp], str.Error_opening_file_
call sym._printf
mov eax, 1
jmp 0x401657
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sym._fseek
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sym._ftell
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sym._rewind
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sym._malloc
mov dword [esp + 0x44], eax
cmp dword [esp + 0x44], 0
jne 0x401608
mov dword [esp], str.Memory_allocation_failed_
call sym._printf
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sym._fclose
mov eax, 1
jmp 0x401657
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sym._fread
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x44]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
call eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sym._free
mov eax, 0
leave
ret

Function at 0x401ac0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable
Function at 0x1833700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0183378f
jae 0x183370e
xor ecx, ecx
call fcn.0183378f
jae 0x183373d
xor eax, eax
call fcn.0183378f
jae 0x183374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0183378f
adc al, al
jae 0x183372f
jne 0x1833779
stosb byte es:[edi], al
jmp 0x1833711
call fcn.0183379b
sub ecx, ebx
jne 0x1833756
call fcn.01833799
jmp 0x1833775
lodsb al, byte [esi]
shr eax, 1
je 0x1833783
adc ecx, ecx
jmp 0x1833772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01833799
cmp eax, 0x7d00
jae 0x1833772
cmp ah, 5
jae 0x1833773
cmp eax, 0x7f
ja 0x1833774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1833711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x26f3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.026f378f
jae 0x26f370e
xor ecx, ecx
call fcn.026f378f
jae 0x26f373d
xor eax, eax
call fcn.026f378f
jae 0x26f374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.026f378f
adc al, al
jae 0x26f372f
jne 0x26f3779
stosb byte es:[edi], al
jmp 0x26f3711
call fcn.026f379b
sub ecx, ebx
jne 0x26f3756
call fcn.026f3799
jmp 0x26f3775
lodsb al, byte [esi]
shr eax, 1
je 0x26f3783
adc ecx, ecx
jmp 0x26f3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.026f3799
cmp eax, 0x7d00
jae 0x26f3772
cmp ah, 5
jae 0x26f3773
cmp eax, 0x7f
ja 0x26f3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26f3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40596d
pop dword [ebp - 0x1c]
mov eax, 0xc7d752eb
sub eax, 0xc796f97e
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x76936748
add dword [ebp - 0x2c], 0xd7bede03
mov dword [ebp - 0x28], 0x6ae4c7a8
sub dword [ebp - 0x28], 0x38b17b63
mov dword [ebp - 0x24], 0x7b8dfe0c
sub dword [ebp - 0x24], 0x2f41b9de
mov dword [ebp - 0x20], 0x1a1385a1
sub dword [ebp - 0x20], 0x1a1385a1
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x21a21b08
add eax, 0xde9e5558
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xf41ea980
sub dword [ebp - 0x2c], 0x7fac402a
mov dword [ebp - 0x28], 0x15208520
add dword [ebp - 0x28], 0x2c4bdc55
mov dword [ebp - 0x24], 0x76f48105
sub dword [ebp - 0x24], 0x13851499
mov dword [ebp - 0x20], 0x10f02900
sub dword [ebp - 0x20], 0x10f02900
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x1d8e6d49
add eax, 0xe2b203b7
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34f9f
push 0
call eax
mov ecx, 0x410a
mov ebx, eax
mov esi, 0x7675f06a
sub esi, 0x7634f06a
add esi, dword [ebp - 0x1c]
mov edx, 0x66954fa2
add edx, 0x7fab13b4
sub dword [ebp - 0xc], 0xe05cf17f
mov edi, dword [esi]
xor dword [ebp - 0x18], 0x54dff222
xor edi, edx
add dword [ebp - 0x18], edi
mov dword [ebx], edi
sub dword [ebp - 0xc], edi
add ebx, 4
add esi, 0xdfbeea3f
add esi, 0x204115c5
loop 0x405a89
add eax, 0xed57112f
add eax, 0x12a9e5cc
xor ebx, ebx
add ebx, eax
add eax, 0xd0a8b2c2
add eax, 0x2f574d43
mov ecx, 0x7f9799f4
sub ecx, 0x7f5799f4
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4013c9
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x401416
mov al, cl
cmp al, 0x61
jb 0x4013f1
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x401416
mov al, cl
cmp al, 0x61
jb 0x401409
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x4013e2
cmp edx, dword [esp + 0x18]
je 0x401426
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x4013db
xor eax, eax
jmp 0x401429
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x401431
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x401518
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40151e
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40147d
cmp al, 0x61
jb 0x401475
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x401468
cmp edx, dword [esp + 0x14]
je 0x40148d
dec ecx
jne 0x40145d
xor eax, eax
jmp 0x401518
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x401518
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x401518
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x4014c9
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x4014d8
jmp 0x4014c0
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.004013c9
test eax, eax
je 0x401518
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x401513
cmp al, 0x61
jb 0x40150b
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4014fe
call fcn.00401431
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x401536
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x401536
sub edx, ecx
mov ecx, edx
jmp 0x40148d
xor eax, eax
jmp 0x401518

Function at 0x4043ba
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4d7138]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4043f5
add dword [esp], 5
retf

Function at 0x404490
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4d7138]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4044cb
add dword [esp], 5
retf
Function at 0x404cf6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x40
xor eax, dword [ebp + ecx]
sub ecx, 8
cmp ecx, 0
jne 0x404d00
leave
ret 0x40

Function at 0x40583a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0x4d7140], 0
jne 0x405861
cmp dword [0x4d7144], 0
jne 0x40590c
mov dword [ebp - 0xc], esp
push str.ntdll.dll
mov eax, 9
call fcn.0041555e
cmp dword [ebp - 0xc], esp
je 0x405895
push 0x85
push 0x401049a
push 6
call fcn.00415558
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push str.ZwQueryVirtualMemory
push dword [ebp - 0x10]
mov eax, 0xa
call fcn.0041555e
cmp dword [ebp - 0x14], esp
je 0x4058c9
push 0x85
push 0x401049a
push 6
call fcn.00415558
add esp, 0xc
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x4ab573]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.0040455a
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x417200
call fcn.00415564
add esp, 0x10
cdq
mov dword [0x4d7140], eax
mov dword [0x4d7144], edx
mov edx, dword [0x4d7144]
mov eax, dword [0x4d7140]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x33
call 0x405924
add dword [esp], 5
retf

Function at 0x40595a
Capabilities:
Execute syscall

Disassembly:
dec ecx
mov edx, ecx
dec eax
mov eax, dword [ebp - 8]
syscall
ret

Function at 0x405ca9
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0x4d7148], 0
jne 0x405cd0
cmp dword [0x4d714c], 0
jne 0x405d7b
mov dword [ebp - 0xc], esp
push str.ntdll.dll
mov eax, 9
call fcn.0041555e
cmp dword [ebp - 0xc], esp
je 0x405d04
push 0x85
push 0x401049b
push 6
call fcn.00415558
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push str.ZwReadVirtualMemory
push dword [ebp - 0x10]
mov eax, 0xa
call fcn.0041555e
cmp dword [ebp - 0x14], esp
je 0x405d38
push 0x85
push 0x401049b
push 6
call fcn.00415558
add esp, 0xc
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x4ab573]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.0040455a
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x417200
call fcn.00415564
add esp, 0x10
cdq
mov dword [0x4d7148], eax
mov dword [0x4d714c], edx
mov edx, dword [0x4d714c]
mov eax, dword [0x4d7148]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x33
call 0x405d93
add dword [esp], 5
retf
Function at 0x40ddc3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4d7138]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40ddfe
add dword [esp], 5
retf

Function at 0x40ded0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4d7138]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40df0b
add dword [esp], 5
retf

Function at 0x40dfaa
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4d7138]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40dfe5
add dword [esp], 5
retf
Function at 0x41c8c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a4b7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00499af3
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41c942
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00497a05
mov eax, dword [eax]
push 0x4c3ca0
push eax
call fcn.004897f4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00499d7e
test bl, bl
je 0x41c942
push 0x4c3ca0
lea ecx, [esp + 0xc]
call fcn.0049a10e
push 0x4c3cac
lea ecx, [esp + 0xc]
call fcn.0049a10e
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41c97e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00499d7e
jmp 0x41ca49
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41ca02
lea edx, [esp + 0x7c]
push 0x4c3ca8
push edx
call fcn.004897f4
add esp, 8
test eax, eax
je 0x41ca02
lea eax, [esp + 0x7c]
push 0x4c3ca4
push eax
call fcn.004897f4
add esp, 8
test eax, eax
je 0x41ca02
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41c992
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00499d7e
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41d240
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41d2a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x41d2b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a4bfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4d30d8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x41d3e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x41d316
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00499d7e
xor eax, eax
jmp 0x41d45f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00499ebb
push esi
lea ecx, [esp + 0xc]
call fcn.0049a14a
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41d43d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0041d240
test eax, eax
jne 0x41d43d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0041d240
test eax, eax
jne 0x41d43d
lea eax, [esp + 0x14]
push 0x4c3cbc
push eax
call fcn.0048a9a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41d41c
lea ecx, [esp + 0x14]
push 0x4c3cb8
push ecx
call fcn.0048a920
mov esi, eax
add esp, 8
test esi, esi
jne 0x41d41c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41d41f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00499e6b
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41d32e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00499d7e
xor eax, eax
jmp 0x41d45f
mov byte [esi], 0
push 0x4c3cb4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00499d7e
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4