joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bf50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1690
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b2a8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
test byte [0x260ddac], 0x80
je 0x40bf99
mov eax, 0xff7f
and word [0x260ddac], ax
mov byte [0x5b8fd5], 0x79
jmp 0x40bfac
mov ecx, 0x80
or word [0x260ddac], cx
mov byte [0x5b8fd5], 0x78
movzx edx, word [0x260dda2]
mov eax, dword [0x260ddb0]
mov cx, word [0x260dd80]
mov word [ebp - 0x14], dx
movzx edx, word [0x260dd84]
mov dword [ebp - 0x18], eax
mov ax, word [0x260dd88]
mov word [0x4b8030], cx
mov ecx, dword [0x260de70]
mov esi, 0x13
mov word [0x24c21f4], dx
mov word [0x4b800c], ax
mov dword [0x4b8028], ecx
call fcn.004016b0
mov edx, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push ebx
push edx
push ebx
push ebx
mov byte [0x2610d68], 1
mov byte [0x2610d69], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x261130c], ebx
jne 0x40c0e1
mov ax, word [ebp - 0x14]
cmp ax, word [0x260dda2]
jne 0x40c04a
mov ecx, dword [0x260ddb0]
cmp dword [ebp - 0x18], ecx
je 0x40c0ff
mov dword [ebp - 4], ebx
mov edi, 1
mov dword [0x260e130], edi
mov dword [0x260e12c], edi
call fcn.00431410
cmp dword [0x2611310], ebx
je 0x40c08f
test dword [0x260ddac], 0x200
je 0x40c08f
push ebx
call fcn.00426560
mov esi, eax
call fcn.004314d0
mov dword [0x2611310], ebx
call fcn.004265d0
mov edx, dword [0x260ddb0]
cmp edx, dword [0x260ddb4]
je 0x40c0a3
add dword [0x2611308], edi
mov eax, dword [0x2611304]
add eax, edi
mov dword [0x2611304], eax
cmp eax, 0x4000
jne 0x40c0c1
mov dword [0x2611304], ebx
call fcn.00425700
mov dword [ebp - 4], 0xffffffff
jmp 0x40c022
mov ax, word [0x4b8030]
mov word [0x260dd80], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov cx, word [0x4b8030]
mov word [0x260dd80], cx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c2b0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x4b802c]
cmp edi, eax
mov esi, ecx
mov dword [esp + 0x10], edi
jg 0x40c2d1
mov dword [esp + 0x10], eax
cmp dword [0x4b8bdc], esi
jne 0x40c2dd
cmp eax, edi
je 0x40c2e8
push esi
mov eax, edi
call fcn.00404a90
add esp, 4
xor eax, eax
mov word [0x4b944e], ax
mov al, byte [0x4b9449]
mov byte [0x4b9462], 0
cmp al, 0x70
je 0x40c323
cmp al, 0x71
je 0x40c323
cmp al, 0x73
je 0x40c323
xor eax, eax
cdq
idiv dword [0x4b80dc]
movzx ecx, word [0x4b944c]
imul edx, ecx
add edx, 0xb8000
jmp 0x40c328
mov edx, 0xb8000
imul esi, edi
mov dword [0x4b80c8], edx
add esi, esi
add edx, esi
xor eax, eax
mov dword [0x24c21d4], edx
call fcn.0040c220
add esi, eax
push 0xfffffffffffffff5
mov dword [0x25f24a0], eax
mov dword [0x4b8020], esi
mov dword [0x4b8bd8], 0x450
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp byte [ebp + 8], 0
mov esi, eax
mov dword [esp + 0x14], esi
je 0x40c457
mov eax, dword [0x25f24a0]
mov ecx, dword [0x4b8020]
mov bl, 0x20
cmp eax, ecx
jae 0x40c395
mov byte [eax + 0x4b9000], bl
inc eax
mov byte [eax + 0x4b9000], 7
inc eax
cmp eax, ecx
jb 0x40c382
push 0x4b8bc0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x10]
mov esi, dword [0x4b8bdc]
xor edi, edi
xor edx, edx
cmp ecx, edi
jle 0x40c3ee
cmp esi, edi
jle 0x40c3e9
movsx eax, word [0x4b8008]
imul eax, edx
lea eax, [eax*4 + 0x24c2202]
mov ecx, esi
lea esp, [esp]
mov byte [eax - 2], bl
mov edi, 7
mov word [eax], di
add eax, 4
sub ecx, 1
jne 0x40c3d0
mov ecx, dword [esp + 0x10]
xor edi, edi
inc edx
cmp edx, ecx
jl 0x40c3b2
xor eax, eax
mov word [esp + 0x18], ax
mov eax, dword [0x25f2560]
lea ecx, [eax + ecx - 1]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
mov word [esp + 0x1e], ax
mov eax, dword [0x4b8038]
push eax
mov word [esp + 0x26], cx
mov ecx, dword [0x4b8008]
push ecx
push 0x24c2200
dec esi
push edx
mov word [esp + 0x30], si
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
push 0x4b8bc0
mov dword [0x26112e8], edi
mov dword [0x26112e0], edi
mov dword [0x26112ec], edi
mov dword [0x26112e4], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [esp + 0x14]
mov cx, word [0x25f2560]
xor eax, eax
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov edx, dword [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 7
push esi
mov byte [0x4b800e], 1
mov byte [0x4b8033], 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c6b0
Capabilities:
Manipulate console buffer

Disassembly:
push ecx
mov cl, byte [0x260dd8d]
cmp byte [0x4b9462], cl
jne 0x40c784
mov dl, byte [0x260dd88]
movzx eax, cl
add eax, eax
cmp dl, byte [eax + 0x4b9450]
jne 0x40c6f1
mov dl, byte [0x260dd89]
cmp dl, byte [eax + 0x4b9451]
jne 0x40c6f1
cmp byte [0x4b8033], 0
je 0x40c784
movzx cx, byte [0x260dd89]
movzx ax, byte [0x260dd88]
add cx, word [0x25f2560]
push 0xfffffffffffffff5
mov word [esp + 4], ax
mov word [esp + 6], cx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx edx, byte [0x260dd89]
cmp edx, dword [0x4b802c]
jge 0x40c75d
mov ecx, dword [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x40c75d
cmp byte [0x2611450], 0
je 0x40c777
cmp dword [0x4b8be4], 0
jne 0x40c754
mov dword [0x4b8be4], 1
mov byte [0x2611450], 0
jmp 0x40c777
cmp dword [0x4b8be4], 0
je 0x40c777
mov dword [0x4b8be4], 0
mov byte [0x2611450], 1
mov cl, byte [0x260dd8d]
mov byte [0x4b8033], 0
movzx eax, cl
cdq
idiv dword [0x4b80dc]
mov al, byte [0x260dd88]
mov cl, byte [0x260dd89]
mov byte [edx + edx + 0x4b9450], al
mov byte [edx + edx + 0x4b9451], cl
add edx, edx
pop ecx
ret
Function at 0x40c800
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0xc
push ebx
mov bl, byte [0x260dd80]
movzx eax, bl
cmp eax, dword [0x4b80dc]
jge 0x40ca52
push esi
push edi
cmp byte [0x4b9462], bl
je 0x40c9b7
push ebp
call fcn.00401d70
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
mov word [esp + 0x14], dx
mov edx, dword [0x4b8bdc]
mov ecx, eax
mov eax, dword [0x25f2560]
dec edx
mov word [esp + 0x18], dx
mov edx, dword [0x4b802c]
mov word [esp + 0x16], ax
lea eax, [edx + eax - 1]
lea edx, [esp + 0x14]
push edx
mov edx, dword [0x4b8008]
mov word [esp + 0x1e], ax
mov eax, dword [0x4b8038]
push eax
push edx
push 0x24c2200
push ecx
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
movzx eax, byte [0x4b9462]
xor edi, edi
call fcn.0040c220
mov esi, dword [0x4b802c]
mov ebp, dword [0x4b8bdc]
mov ebx, dword [0x4b8008]
test esi, esi
jle 0x40c8eb
lea esp, [esp]
test ebp, ebp
jle 0x40c8e6
movsx ecx, bx
imul ecx, edi
lea ecx, [ecx*4 + 0x24c2202]
mov esi, ebp
movzx edx, byte [ecx - 2]
mov byte [eax + 0x4b9000], dl
movzx edx, byte [ecx]
inc eax
mov byte [eax + 0x4b9000], dl
inc eax
add ecx, 4
sub esi, 1
jne 0x40c8c3
mov esi, dword [0x4b802c]
inc edi
cmp edi, esi
jl 0x40c8b0
movzx eax, byte [0x260dd80]
xor edi, edi
call fcn.0040c220
test esi, esi
jle 0x40c93c
lea ecx, [ecx]
test ebp, ebp
jle 0x40c937
movsx ecx, bx
imul ecx, edi
lea ecx, [ecx*4 + 0x24c2202]
mov esi, ebp
mov dl, byte [eax + 0x4b9000]
inc eax
mov byte [ecx - 2], dl
movzx dx, byte [eax + 0x4b9000]
mov word [ecx], dx
inc eax
add ecx, 4
sub esi, 1
jne 0x40c913
mov esi, dword [0x4b802c]
inc edi
cmp edi, esi
jl 0x40c900
mov ecx, dword [0x4b8038]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
push ebx
push 0x24c2200
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov bl, byte [0x260dd80]
mov ecx, dword [0x4b802c]
movzx eax, bl
movzx dx, byte [eax + eax + 0x4b9450]
add eax, eax
movzx ax, byte [eax + 0x4b9451]
mov word [esp + 0x10], dx
mov edx, dword [0x25f2560]
add ax, dx
mov word [esp + 0x12], ax
cwde
add edx, ecx
cmp eax, edx
pop ebp
jge 0x40c9ae
mov ecx, dword [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov bl, byte [0x260dd80]
mov ecx, dword [0x4b802c]
mov byte [0x4b8033], 0
jmp 0x40c9bd
mov ecx, dword [0x4b802c]
imul ecx, dword [0x4b8bdc]
mov si, word [0x4b944c]
movzx dx, bl
imul dx, si
add ecx, ecx
cmp ecx, 0x8000
mov byte [0x4b9462], bl
mov word [0x4b944e], dx
mov edi, ecx
jl 0x40c9f1
mov edi, 0x8000
mov al, byte [0x4b9449]
cmp al, 0x70
je 0x40ca1a
cmp al, 0x71
je 0x40ca1a
cmp al, 0x73
je 0x40ca1a
movzx eax, bl
cdq
idiv dword [0x4b80dc]
movzx eax, si
imul edx, eax
add edx, 0xb8000
jmp 0x40ca1f
mov edx, 0xb8000
movzx esi, bl
mov dword [0x4b80c8], edx
add edx, edi
mov eax, esi
mov dword [0x24c21d4], edx
call fcn.0040c220
mov dword [0x25f24a0], eax
add eax, edi
lea ecx, [esi + esi + 0x450]
pop edi
mov dword [0x4b8020], eax
mov dword [0x4b8bd8], ecx
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x40cfb0
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 8
push ebx
mov bl, byte [0x260dd8d]
movzx ecx, bl
mov eax, ecx
cdq
idiv dword [0x4b80dc]
push esi
movzx si, byte [edx + edx + 0x4b9451]
push edi
movzx di, byte [edx + edx + 0x4b9450]
mov word [esp + 0xc], di
add edx, edx
cmp byte [0x4b9462], bl
jne 0x40d04d
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
add si, word [0x25f2560]
mov edi, eax
mov word [esp + 0xe], si
call fcn.00401d70
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push esi
push 1
push 0x25f5978
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
lea ecx, [esp + 0x10]
push ecx
push esi
push 1
push 0x24e2200
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
mov dl, byte [0x25f5978]
mov al, byte [0x24e2200]
pop edi
pop esi
mov byte [0x260dd80], dl
mov byte [0x260dd81], al
pop ebx
add esp, 8
ret
mov eax, ecx
call fcn.0040c220
movsx ecx, si
imul ecx, dword [0x4b8bdc]
movsx edx, di
pop edi
add ecx, edx
mov ax, word [eax + ecx*2 + 0x4b9000]
pop esi
mov word [0x260dd80], ax
pop ebx
add esp, 8
ret
Function at 0x40d3e0
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
push esi
push edi
push 0xfffffffffffffff5
call ebx
cmp byte [0x4b8033], 0
mov ebp, eax
je 0x40d45a
cmp byte [0x26112b2], 0
jne 0x40d41c
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [esp + 0x24]
mov dword [0x25f2560], ecx
movzx eax, byte [0x260dd8d]
movzx dx, byte [eax + eax + 0x4b9450]
add eax, eax
movzx ax, byte [eax + 0x4b9451]
add ax, word [0x25f2560]
mov word [esp + 0x10], dx
mov word [esp + 0x12], ax
mov ecx, dword [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov byte [0x4b8033], 0
movzx eax, byte [0x4b9462]
mov cl, byte [0x260dd80]
movzx si, byte [eax*2 + 0x4b9450]
movzx di, byte [eax*2 + 0x4b9451]
cmp cl, 7
je 0x40d594
cmp cl, 8
je 0x40d56a
cmp cl, 0xa
je 0x40d56f
cmp cl, 0xd
je 0x40d56a
call fcn.0040c220
movsx edx, di
imul edx, dword [0x4b8bdc]
movsx ecx, si
add edx, ecx
push 0x4b8bc0
lea ebx, [eax + edx*2]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx edx, byte [0x260dd80]
movzx eax, byte [0x4b9462]
push edx
call fcn.0040c220
mov ecx, ebx
sub ecx, eax
mov eax, ecx
call fcn.00401e10
add esp, 4
push 0x4b8bc0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc si
movsx edx, si
mov word [esp + 0x10], si
cmp edx, dword [0x4b8bdc]
jne 0x40d52e
inc di
movsx ecx, di
xor eax, eax
mov word [esp + 0x10], ax
cmp ecx, dword [0x4b802c]
jne 0x40d52e
call fcn.00401d70
push 0
lea edx, [esp + 0x18]
push edx
push 1
push 0x4a77ec
push ebp
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x40d54f
cmp byte [0x4b800e], 0
jne 0x40d556
add di, word [0x25f2560]
mov word [esp + 0x12], di
mov eax, dword [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov byte [0x4b800e], 1
mov cl, byte [0x260dd80]
pop edi
pop esi
pop ebp
mov byte [ebx + 0x4b9000], cl
pop ebx
add esp, 0x20
ret
cmp cl, 0xa
jne 0x40d574
call fcn.00401d70
push 0
lea edx, [esp + 0x18]
push edx
push 1
push 0x260dd80
push 0xfffffffffffffff5
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov byte [0x4b800e], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40e150
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x4b2a8c]
xor eax, esp
mov dword [esp + 0x44], eax
mov al, byte [0x260dd88]
push edi
test al, al
jns 0x40e173
movzx edi, al
and edi, 0x7f
add edi, 2
jmp 0x40e17f
cmp al, 2
jae 0x40e17c
movzx edi, al
jmp 0x40e17f
or edi, 0xffffffff
cmp byte [0x260dd80], 0
jne 0x40e1a9
mov eax, 1
or word [0x260ddac], ax
mov byte [0x260dd81], al
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00482caa
add esp, 0x48
ret
push 0
push edi
call fcn.0040e020
add esp, 8
test eax, eax
jne 0x40e1d7
or word [0x260ddac], 1
mov byte [0x260dd81], 0xff
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00482caa
add esp, 0x48
ret
push ebx
push esi
mov esi, edi
add edi, 0x41
push edi
lea eax, [esp + 0x14]
push str.._c:
shl esi, 5
push eax
add esi, 0x2610d70
call fcn.00483265
add esp, 0xc
push 0
push 0x20000080
push 3
push 0
push 3
push 0x80000000
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e23f
or word [0x260ddac], 1
pop esi
pop ebx
mov byte [0x260dd81], 0xff
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00482caa
add esp, 0x48
ret
movzx edi, byte [0x260dd84]
push ebp
movzx ebp, byte [0x260dd80]
mov eax, esi
call fcn.004010b0
movzx ecx, byte [0x260dd85]
mov edx, edi
and edx, 0xc0
add edx, edx
add edx, edx
or edx, ecx
mov ecx, dword [esi + 0x1c]
imul eax, edx
movzx edx, byte [0x260dd89]
add eax, edx
imul eax, dword [esi + 0x18]
and edi, 0x3f
lea eax, [eax + edi - 1]
movzx edi, word [0x260dd8c]
imul ecx, eax
add edi, dword [0x260de28]
push 0
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40e2c5
mov eax, dword [esi + 0x1c]
imul eax, ebp
push 0
lea edx, [esp + 0x14]
push edx
push eax
lea ecx, [edi + 0x4b9000]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e2d6
or word [0x260ddac], 1
mov byte [0x260dd81], 4
jmp 0x40e2dd
mov byte [0x260dd81], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x54]
pop ebp
pop esi
pop ebx
pop edi
xor ecx, esp
call fcn.00482caa
add esp, 0x48
ret
Function at 0x40e300
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x4b2a8c]
xor eax, esp
mov dword [esp + 0x44], eax
mov al, byte [0x260dd88]
push esi
test al, al
jns 0x40e323
movzx esi, al
and esi, 0x7f
add esi, 2
jmp 0x40e32f
cmp al, 2
jae 0x40e32c
movzx esi, al
jmp 0x40e32f
or esi, 0xffffffff
cmp byte [0x260dd80], 0
jne 0x40e359
mov eax, 1
or word [0x260ddac], ax
mov byte [0x260dd81], al
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00482caa
add esp, 0x48
ret
push 0
push esi
call fcn.0040e020
add esp, 8
test eax, eax
jne 0x40e387
or word [0x260ddac], 1
mov byte [0x260dd81], 0xff
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00482caa
add esp, 0x48
ret
mov eax, esi
shl eax, 5
push edi
lea edi, [eax + 0x2610d70]
mov eax, edi
call fcn.00401060
test eax, eax
jne 0x40e3be
or word [0x260ddac], 1
pop edi
mov byte [0x260dd81], 0xff
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00482caa
add esp, 0x48
ret
push ebx
add esi, 0x41
push esi
lea ecx, [esp + 0x14]
push str.._c:
push ecx
call fcn.00483265
add esp, 0xc
push 0
push 0x20000080
push 3
push 0
push 3
push 0x80000000
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e41a
or word [0x260ddac], 1
pop ebx
pop edi
mov byte [0x260dd81], 0xff
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00482caa
add esp, 0x48
ret
movzx esi, byte [0x260dd84]
push ebp
movzx ebp, byte [0x260dd80]
mov eax, edi
call fcn.004010b0
movzx edx, byte [0x260dd85]
mov ecx, esi
and ecx, 0xc0
add ecx, ecx
add ecx, ecx
or ecx, edx
mov edx, dword [edi + 0x1c]
imul eax, ecx
movzx ecx, byte [0x260dd89]
add eax, ecx
imul eax, dword [edi + 0x18]
and esi, 0x3f
lea eax, [eax + esi - 1]
movzx esi, word [0x260dd8c]
imul edx, eax
add esi, dword [0x260de28]
push 0
push 0
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40e4a0
mov ecx, dword [edi + 0x1c]
imul ecx, ebp
push 0
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esi + 0x4b9000]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40e4b1
or word [0x260ddac], 1
mov byte [0x260dd81], 4
jmp 0x40e4b8
mov byte [0x260dd81], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x54]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.00482caa
add esp, 0x48
ret
Function at 0x40e4e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x50
mov eax, dword [0x4b2a8c]
xor eax, esp
mov dword [esp + 0x4c], eax
mov al, byte [0x260dd88]
push edi
test al, al
jns 0x40e503
movzx edi, al
and edi, 0x7f
add edi, 2
jmp 0x40e50f
cmp al, 2
jae 0x40e50c
movzx edi, al
jmp 0x40e50f
or edi, 0xffffffff
cmp byte [0x260dd80], 0
jne 0x40e53a
mov ecx, 1
or word [0x260ddac], cx
mov byte [0x260dd81], cl
pop edi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
push 0
push edi
call fcn.0040e020
add esp, 8
test eax, eax
jne 0x40e568
or word [0x260ddac], 1
mov byte [0x260dd81], 0xff
pop edi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
push esi
mov esi, edi
add edi, 0x41
push edi
lea eax, [esp + 0x18]
push str.._c:
shl esi, 5
push eax
add esi, 0x2610d70
call fcn.00483265
add esp, 0xc
push 0
push 0x20000080
push 3
push 0
push 3
push 0x80000000
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x40e5d0
or word [0x260ddac], 1
pop esi
mov byte [0x260dd81], 0xff
pop edi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
movzx edi, byte [0x260dd84]
push ebx
movzx ebx, byte [0x260dd80]
push ebp
mov eax, esi
call fcn.004010b0
movzx ecx, byte [0x260dd85]
mov edx, edi
and edx, 0xc0
add edx, edx
add edx, edx
or edx, ecx
imul eax, edx
movzx edx, byte [0x260dd89]
add eax, edx
imul eax, dword [esi + 0x18]
and edi, 0x3f
lea ebp, [eax + edi - 1]
mov eax, dword [esi + 0x1c]
movzx edi, word [0x260dd8c]
imul eax, ebx
add edi, dword [0x260de28]
push eax
call fcn.00483bad
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x14]
imul ecx, ebp
add esp, 4
push 0
push 0
push ecx
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x40e670
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x10]
imul ecx, ebx
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e681
or word [0x260ddac], 1
mov byte [0x260dd81], 4
jmp 0x40e6ee
mov esi, dword [esi + 0x1c]
imul esi, ebx
mov eax, ebp
lea edi, [edi + 0x4b9000]
mov ecx, 1
cmp esi, 4
jb 0x40e6b4
lea esp, [esp]
mov edx, dword [edi]
cmp edx, dword [eax]
jne 0x40e6d7
sub esi, 4
add eax, 4
add edi, 4
cmp esi, 4
jae 0x40e6a0
test esi, esi
je 0x40e6e7
mov dl, byte [eax]
cmp dl, byte [edi]
jne 0x40e6d7
cmp esi, ecx
jbe 0x40e6e7
mov dl, byte [eax + 1]
cmp dl, byte [edi + 1]
jne 0x40e6d7
cmp esi, 2
jbe 0x40e6e7
mov al, byte [eax + 2]
cmp al, byte [edi + 2]
je 0x40e6e7
or word [0x260ddac], cx
mov byte [0x260dd81], 5
jmp 0x40e6ee
mov byte [0x260dd81], 0
push ebp
call fcn.004838e2
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x5c]
pop ebp
pop ebx
pop esi
pop edi
xor ecx, esp
call fcn.00482caa
add esp, 0x50
ret
Function at 0x40e720
Capabilities:
Get disk information

Disassembly:
mov al, byte [0x260dd88]
push esi
test al, al
jns 0x40e735
movzx esi, al
and esi, 0x7f
add esi, 2
jmp 0x40e741
cmp al, 2
jae 0x40e73e
movzx esi, al
jmp 0x40e741
or esi, 0xffffffff
push 1
push esi
call fcn.0040e020
add esp, 8
test eax, eax
je 0x40e85a
xor eax, eax
shl esi, 5
add esi, 0x2610d70
mov word [0x260dd80], ax
mov eax, dword [esi + 0x10]
dec eax
cmp eax, 0x12
ja case.0x40e775.4
movzx ecx, byte [eax + 0x40e888]
jmp dword [ecx*4 + 0x40e86c]
mov byte [0x260dd8c], 1
jmp 0x40e7b9
mov byte [0x260dd8c], 2
jmp 0x40e7b9
mov byte [0x260dd8c], 3
jmp 0x40e7b9
mov byte [0x260dd8c], 4
jmp 0x40e7b9
mov byte [0x260dd8c], 6
jmp 0x40e7b9
mov byte [0x260dd8c], 0x10
jmp 0x40e7b9
mov byte [0x260dd8c], 0
test byte [0x260dd88], 0x80
je 0x40e7de
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and eax, 0xc
cmp eax, 0xc
ja case.default.0x40e7ec
movzx edx, byte [eax + 0x40e8ac]
jmp dword [edx*4 + 0x40e89c]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and eax, 3
cmp eax, 3
ja case.default.0x40e7ec
jmp dword [eax*4 + 0x40e8bc]
mov byte [0x260dd88], 0
jmp case.default.0x40e7ec
mov byte [0x260dd88], 1
jmp case.default.0x40e7ec
mov byte [0x260dd88], 2
mov eax, esi
call fcn.004010b0
cmp dword [esi + 0xc], 0
mov byte [0x260dd89], al
mov eax, dword [esi + 8]
jl 0x40e82f
jg 0x40e82a
cmp eax, 0x3ff
jbe 0x40e82f
mov eax, 0x3ff
mov esi, dword [esi + 0x18]
mov ecx, 0x3f
cmp esi, 0x3f
ja 0x40e83e
mov ecx, esi
mov edx, eax
sar edx, 2
xor dl, cl
mov byte [0x260dd85], al
and dl, 0x3f
sar eax, 2
xor dl, al
mov byte [0x260dd84], dl
pop esi
ret
or word [0x260ddac], 1
mov byte [0x260dd81], 7
pop esi
ret

Function at 0x40fec0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call esi
shl al, 7
push 0x14
mov byte [0x260dd80], al
call esi
and al, 1
shl al, 6
or byte [0x260dd80], al
push 0x90
call esi
and al, 1
shl al, 5
or byte [0x260dd80], al
push 0x91
call esi
and al, 1
shl al, 4
or byte [0x260dd80], al
push 0x12
call esi
push 0x11
shr eax, 0xc
and al, 8
or byte [0x260dd80], al
call esi
push 0xa0
shr eax, 0xd
and al, 4
or byte [0x260dd80], al
call esi
push 0xa1
shr eax, 0xe
and al, 2
or byte [0x260dd80], al
call esi
pop esi
shr eax, 0xf
and al, 1
or byte [0x260dd80], al
ret

Function at 0x410050
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
call fcn.0040fec0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x14
mov byte [0x260dd81], 0
call esi
push 0x90
shr eax, 9
and al, 0x40
or byte [0x260dd81], al
call esi
push 0x91
shr eax, 0xa
and al, 0x20
or byte [0x260dd81], al
call esi
push 0xa5
shr eax, 0xb
and al, 0x10
or byte [0x260dd81], al
call esi
push 0xa3
shr eax, 0xc
and al, 8
or byte [0x260dd81], al
call esi
push 0xa4
shr eax, 0xd
and al, 4
or byte [0x260dd81], al
call esi
push 0xa2
shr eax, 0xe
and al, 2
or byte [0x260dd81], al
call esi
pop esi
shr eax, 0xf
and al, 1
or byte [0x260dd81], al
ret
Function at 0x4115a0
Capabilities:
Get file size

Disassembly:
movzx eax, word [0x260dd88]
mov ecx, dword [0x260de70]
lea eax, [eax + ecx + 0x4b9000]
xor ecx, ecx
cmp byte [eax], 0xff
push esi
sete cl
push edi
lea esi, [ecx*8]
sub esi, ecx
add esi, eax
call fcn.004064d0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4115f8
pop edi
mov byte [0x260dd80], 0xff
pop esi
ret
xor edx, edx
push edx
mov eax, 0x80
push edi
mov byte [0x260dd80], 0
mov word [esi + 0xc], dx
mov word [esi + 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x18], edi
pop edi
mov dword [esi + 0x10], eax
pop esi
ret