joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4029c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
movss xmm7, dword [esp + 0x70]
mov esi, dword [esp + 0x60]
movss dword [esp], xmm7
call fcn.0041ca70
movss xmm6, dword [esp + 0x74]
movss dword [esp], xmm6
fstp dword [esp + 0x10]
call fcn.0041ca70
movss xmm7, dword [esp + 0x78]
movss dword [esp], xmm7
fstp dword [esp + 0x14]
call fcn.0041ca70
movss xmm6, dword [esp + 0x70]
movss dword [esp], xmm6
fstp dword [esp + 0x18]
call fcn.0041ca50
movss xmm7, dword [esp + 0x74]
movss dword [esp], xmm7
fstp dword [esp + 0x24]
call fcn.0041ca50
movss xmm6, dword [esp + 0x78]
movss dword [esp], xmm6
fstp dword [esp + 0x1c]
call fcn.0041ca50
movss xmm0, dword [0x42608c]
movss dword [esp], xmm0
movss dword [esp + 0x2c], xmm0
fstp dword [esp + 0x20]
call fcn.0041ca70
movss xmm0, dword [esp + 0x2c]
movss dword [esp], xmm0
fstp dword [esp + 0x28]
call fcn.0041ca50
mov ebp, dword [esi]
dec ebp
fstp dword [esp + 0x2c]
movss xmm6, dword [esp + 0x2c]
js 0x402c10
movss xmm7, dword [0x4220e4]
xor ecx, ecx
xor ebx, ebx
mov edi, 0x1000000
lea esi, [esi]
lea esi, [esi]
mov edx, dword [esi + 0x20]
lea eax, [ecx + ecx*2]
shl eax, 2
movss xmm5, dword [esp + 0x24]
movss xmm4, dword [esp + 0x10]
add edx, eax
movss xmm2, dword [edx + 4]
movss xmm1, dword [edx + 8]
movaps xmm0, xmm5
movss xmm3, dword [edx]
mulss xmm4, xmm1
mov edx, dword [esi + 0x8c]
mulss xmm1, xmm5
mulss xmm0, xmm2
mulss xmm2, dword [esp + 0x10]
movss xmm5, dword [esp + 0x18]
add eax, edx
subss xmm0, xmm4
movss xmm4, dword [esp + 0x1c]
addss xmm2, xmm1
movss xmm1, dword [esp + 0x14]
mulss xmm5, xmm0
mulss xmm4, xmm3
mulss xmm1, xmm2
mulss xmm3, dword [esp + 0x14]
addss xmm5, dword [0x426088]
mulss xmm0, dword [esp + 0x20]
mulss xmm2, dword [esp + 0x1c]
addss xmm4, xmm1
movss xmm1, dword [esp + 0x20]
addss xmm3, dword [0x421008]
subss xmm0, dword [0x426084]
mulss xmm1, xmm4
mulss xmm4, dword [esp + 0x18]
subss xmm2, xmm3
subss xmm1, xmm5
movss xmm5, dword [esp + 0x28]
addss xmm4, xmm0
movaps xmm0, xmm6
movaps xmm3, xmm5
mulss xmm0, xmm2
mulss xmm3, xmm1
mulss xmm2, xmm5
mulss xmm1, xmm6
mulss xmm4, xmm7
subss xmm0, xmm3
addss xmm1, xmm2
divss xmm4, xmm0
addss xmm4, dword [0x4220ec]
mulss xmm1, xmm7
divss xmm1, xmm0
addss xmm1, dword [0x4220e8]
movss dword [esp + 0x38], xmm1
fld dword [esp + 0x38]
fistp dword [esp + 0x3c]
mov edx, dword [esp + 0x3c]
mov dword [eax], edx
movss dword [esp + 0x38], xmm4
fld dword [esp + 0x38]
fistp dword [esp + 0x34]
mov edx, dword [esp + 0x34]
mov dword [eax + 4], edx
mulss xmm0, dword [0x4220f0]
movss dword [esp + 0x38], xmm0
fld dword [esp + 0x38]
fistp dword [esp + 0x30]
mov edx, dword [esp + 0x30]
mov dword [eax + 8], edx
cmp ebx, edx
cmovl ebx, edx
test edx, edx
jle 0x402bea
cmp edi, edx
cmovg edi, edx
inc ecx
cmp ebp, ecx
jge 0x402aa0
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
xor ebx, ebx
mov edi, 0x1000000
jmp 0x402bf3
Function at 0x405210
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x4c]
test ebx, ebx
js 0x4052b0
test ebp, ebp
js 0x4052a0
shl ebp, 0x10
movzx ebx, bx
or ebx, ebp
test edi, edi
js 0x40527a
mov dword [esp], 0
lea ebp, [esp + 0x18]
call fcn.00409720
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor eax, eax
sub esp, 8
test edi, edi
setne al
mov dword [esp + 4], ebp
mov dword [esp + 0x1c], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [0x43338c], 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.00409940
mov ebp, eax
jmp 0x405233
mov dword [esp], esi
call fcn.004098a0
mov ebx, eax
jmp 0x40522f

Function at 0x405640
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x426100]
test eax, eax
je 0x405650
ret
push edi
push esi
push ebx
sub esp, 0x220
lea ebx, [esp + 0x18]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
sub esp, 8
test eax, eax
jne 0x405688
mov eax, dword [0x426100]
add esp, 0x220
pop ebx
pop esi
pop edi
ret
call fcn.004074e0
lea esi, [esp + 0x11c]
mov dword [esp + 4], str._fb_console_title__f
mov dword [esp], esi
fstp qword [esp + 8]
call sub.msvcrt.dll_sprintf
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [esp], esi
call edi
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.USER32.dll_FindWindowA]
sub esp, 8
mov dword [0x426100], eax
mov dword [esp], ebx
call edi
sub esp, 4
jmp 0x405675

Function at 0x405720
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
call fcn.00405640
mov esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
xor eax, eax
cmp esi, edx
je 0x405750
add esp, 0x10
pop ebx
pop esi
pop edi
ret
xor edx, edx
mov eax, 1
jmp 0x40576f
add edx, 1
movzx eax, byte [edx + edx*2 + 0x4221e0]
test al, al
je 0x4057b0
cmp eax, ebx
jne 0x405760
lea edi, [edx + edx*2 + 0x4221e0]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx eax, byte [edi + 1]
mov dword [esp], eax
call esi
mov ebx, eax
movzx eax, byte [edi + 2]
sub esp, 4
mov dword [esp], eax
call esi
or ebx, eax
sub esp, 4
add esp, 0x10
movsx eax, bx
sar eax, 0x1f
pop ebx
pop esi
pop edi
ret
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
Function at 0x409b10
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
test dword [esp + 0x4c], 0x100
je 0x409b33
mov ebx, edi
test bl, bl
je 0x409b68
cmp si, 0x58
jbe 0x409ba0
mov eax, dword [esp + 0x50]
test eax, eax
je 0x409b50
mov ebx, 0xffffffff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
movzx ebx, al
test al, al
je 0x409b41
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, esi
mov edx, 0x1c
xor eax, eax
jmp 0x409b83
lea edx, [eax + eax*4]
movzx edx, word [edx + edx + 0x4226c0]
cmp cx, dx
je 0x409c50
add eax, 1
cmp eax, 0xc
jne 0x409b78
jmp 0x409b41
movzx esi, si
movzx eax, ax
mov dword [esp + 4], 2
lea ecx, [esi*8 + 0x4223e0]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ebp, ax
sub esp, 8
mov dword [esp], ebp
mov ebx, ebp
call dword [sym.imp.msvcrt.dll_isupper]
mov dword [esp], ebp
test eax, eax
jne 0x409c30
call dword [sym.imp.msvcrt.dll_islower]
mov ecx, eax
mov eax, ebp
test ecx, ecx
je 0x409bf1
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll_toupper]
test byte [esp + 0x4c], 3
je 0x409c3d
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 6]
cmp ebx, 0xff
jle 0x409b39
mov ecx, edi
movzx ecx, cl
cmp ecx, ebp
je 0x409c1d
cmp eax, ecx
jne 0x409b39
or bl, 0xff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll_tolower]
test byte [esp + 0x4c], 3
jne 0x409bf8
test byte [esp + 0x4c], 0xc
je 0x409c90
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 4]
jmp 0x409c00
lea eax, [eax + eax*4]
lea eax, [eax + eax + 0x4226c0]
test byte [esp + 0x4c], 3
jne 0x409cb0
test byte [esp + 0x4c], 0xc
je 0x409cd0
movzx ebx, word [eax + 6]
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x409b41
cmp ebx, 0xff
jle 0x409b46
or bl, 0xff
jmp 0x409c20
test byte [esp + 0x4c], 0x10
jne 0x409cc0
mov ecx, edi
test cl, cl
jne 0x409c00
movzx ebx, word [esi*8 + 0x4223e0]
jmp 0x409c00
movzx ebx, word [eax + 8]
xor eax, eax
test ebx, ebx
setne al
jmp 0x409c73
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 2]
jmp 0x409c00
test byte [esp + 0x4c], 0x10
je 0x409ce4
movzx ebx, word [eax + 4]
xor eax, eax
test ebx, ebx
setne al
jmp 0x409c73
movzx ebx, word [eax + 2]
jmp 0x409c7b
Function at 0x409cf0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov edx, dword [ebx]
mov eax, dword [eax + 0xc]
test edx, edx
jne 0x409db0
test al, 0x1c
jne 0x409d0f
test al, 3
jne 0x409da2
mov ebx, dword [0x4275e8]
test ebx, ebx
je 0x409da2
movsx eax, bl
mov dword [esp], eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
sub esp, 4
movzx ecx, al
cwde
mov dword [esp + 0x28], 0
mov edx, eax
mov byte [esp + 0x2a], bl
mov ebx, eax
sar edx, 4
sar ebx, 6
and edx, 0x10
sar eax, 9
mov dword [esp], ecx
and ebx, 8
and eax, 2
mov dword [esp + 0x24], 0
or edx, ebx
mov word [esp + 0x26], cx
or eax, edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
mov word [esp + 0x28], ax
movzx eax, byte [0x4275e8]
lea edx, [esp + 0x20]
call fcn.004099e0
mov dword [0x4275e8], 0
add esp, 0x38
pop ebx
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 6]
mov dword [esp + 8], eax
movzx eax, word [ebx + 8]
mov dword [esp + 4], eax
movsx eax, byte [ebx + 0xa]
mov dword [esp], eax
call fcn.00409b10
mov edx, dword [ebx + 0xc]
test dl, 0x1c
je 0x409dff
cmp eax, 0xffffffff
je 0x409d0f
mov dword [0x4275e8], 0
mov edx, ebx
call fcn.004099e0
add esp, 0x38
pop ebx
ret
and dl, 3
je 0x409de0
movzx edx, word [ebx + 6]
lea ecx, [edx - 0x60]
cmp cx, 9
ja 0x409e34
mov ecx, dword [ebx]
test ecx, ecx
je 0x409e2a
mov ecx, dword [0x4275e8]
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*2 - 0x60]
mov dword [0x4275e8], edx
cmp eax, 0xffffffff
jne 0x409df3
jmp 0x409da2
cmp eax, 0xffffffff
jne 0x409de9
jmp 0x409da2
Function at 0x413f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
mov esi, 0x4245b4
push ebx
sub esp, 0x8c
fld dword [0x42465c]
mov edx, dword [0x437874]
mov dword [esp + 0x38], 0
lea ebp, [esp + 0x38]
lea edi, [esp + 0x44]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x3c], 0
mov ebx, dword [esp + 0xa0]
mov dword [esp + 0x44], eax
mov eax, dword [0x437870]
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], eax
mov eax, dword [0x437870]
mov dword [esp + 0x7c], 0
mov dword [esp + 0x54], 0
shl eax, 2
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x50], 2
mov dword [esp + 0x4c], edx
mov dword [esp + 0x64], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x6c], 3
fst dword [esp + 0x74]
mov dword [esp + 0x2c], eax
mov eax, 0x57
fstp dword [esp + 0x70]
lea esi, [esi]
nop
mov dword [esp + 0x68], eax
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x64]
add esi, 4
mov edx, dword [eax]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x38]
sub esp, 0x10
test eax, eax
jns 0x41402f
mov eax, dword [esi]
test eax, eax
jne 0x414000
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x414190
mov eax, dword [esp + 0x68]
mov esi, dword [ecx]
mov dword [esp + 0xc], 0
mov edx, dword [esp + 0x6c]
fld dword [0x42465c]
mov dword [esp], ecx
mov dword [esp + 0x54], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
fst dword [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
fstp dword [esp + 0x5c]
call dword [esi + 0x10]
sub esp, 0x1c
test eax, eax
js 0x414150
mov eax, dword [esp + 0x68]
cmp eax, 0x56
jbe 0x4140b1
mov edx, dword [0x42b334]
cmp dword [edx + 0x20], 0x17
jg 0x4140ed
cmp eax, 0x56
mov dword [esp], 0x20
setbe al
movzx eax, al
mov dword [esp + 4], eax
call fcn.0041a7d0
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x4c]
mov dword [esp], 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_calloc
mov dword [ebx + 0x24], eax
test eax, eax
je 0x414150
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x4245c0
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
js 0x414150
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x18], 0x4131a0
mov dword [ebx + 0x1c], fcn.00413f40
mov dword [ebx + 0x12c], eax
mov eax, dword [esp + 0x3c]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x14], eax
add esp, 0x8c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
test eax, eax
je 0x414163
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [esp + 0x38]
test eax, eax
je 0x414176
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
add esp, 0x8c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x414158
jmp 0x414176
Function at 0x4165e0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push ebx
sub esp, 0x114
mov eax, dword [0x43786c]
test eax, eax
jne 0x416600
call fcn.004117a0
add esp, 0x114
pop ebx
pop esi
ret
lea eax, [esp + 0x10]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
movzx eax, byte [0x4221e0]
mov edx, 0x4221e1
sub esp, 4
test al, al
jne 0x41663c
jmp 0x4165f1
or cl, byte [esp + ebx + 0x10]
shr cl, 7
mov byte [eax], cl
movzx eax, byte [edx + 2]
add edx, 3
test al, al
je 0x4165f1
movzx ecx, byte [edx]
mov esi, dword [0x42b334]
movzx ebx, byte [edx + 1]
movzx ecx, byte [esp + ecx + 0x10]
add eax, dword [esi + 0x64]
test bl, bl
jne 0x416628
shr cl, 7
mov byte [eax], cl
jmp 0x416631
Function at 0x417a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov eax, 0x1018
push edi
push esi
push ebx
call fcn.0041b858
sub esp, eax
mov ebx, dword [esp + 0x102c]
mov eax, dword [esp + 0x1034]
mov byte [esp + 0xd], 1
lea ebp, [esp + 0x1019]
mov ecx, dword [esp + 0x1038]
lea edx, [ebx + 1]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 1]
movzx ebx, byte [ebx]
shl edx, 8
and dx, 0xf00
mov esi, edx
mov edx, dword [esp + 0x1030]
or esi, ebx
lea edi, [edx - 1]
mov ebx, esi
mov edx, esi
mov word [esp + 0x12], si
mov byte [eax], bl
mov ebx, 0x100
mov byte [esp + 0x11], dl
lea edx, [eax + 1]
mov eax, dword [ecx]
mov dword [esp + 4], edi
add eax, edx
mov dword [ecx], 1
mov dword [esp + 0x14], eax
mov word [esp + 0xe], bx
test edi, edi
jle 0x417bc0
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
sub ebx, 1
cmp byte [esp + 0xd], 0
movzx edi, byte [esi]
movzx eax, byte [esi + 1]
je 0x417bd8
add esi, 2
sub dword [esp + 4], 2
mov dword [esp + 8], esi
movzx esi, al
mov eax, edi
shr al, 4
shl esi, 4
movzx edi, al
or esi, edi
xor byte [esp + 0xd], 1
cmp si, 0xfff
je 0x417c6b
cmp si, word [esp + 0xe]
jb 0x417c00
movzx eax, byte [esp + 0x11]
movzx ebx, word [esp + 0x12]
mov byte [esp + 0x19], al
lea eax, [esp + 0x1a]
jmp 0x417b54
lea ebx, [ebx + ebx*2]
add eax, 1
lea edi, [ebx + ebx + 0x4378e0]
movzx ebx, byte [edi + 4]
mov byte [eax - 1], bl
movzx ebx, word [edi + 2]
cmp eax, ebp
je 0x417bc0
cmp ebx, 0xff
jg 0x417b38
mov byte [esp + 0x11], bl
mov byte [eax], bl
mov edi, dword [esp + 0x14]
cmp edi, edx
jbe 0x417bc0
mov ebx, edx
sub ebx, edi
lea edi, [esp + 0x19]
add ebx, eax
mov dword [esp], ebx
jmp 0x417b85
cmp dword [esp], eax
je 0x417bc0
movzx ebx, byte [eax]
sub eax, 1
add edx, 1
mov byte [edx - 1], bl
add dword [ecx], 1
cmp eax, edi
jae 0x417b80
movzx edi, word [esp + 0xe]
cmp di, 0xffe
jbe 0x417c40
mov eax, dword [esp + 4]
test eax, eax
jle 0x417bc0
mov word [esp + 0x12], si
jmp 0x417acb
mov eax, 0xffffffff
add esp, 0x1018
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov esi, eax
mov eax, edi
add dword [esp + 8], 1
shl esi, 8
movzx edi, al
mov dword [esp + 4], ebx
and si, 0xf00
or esi, edi
jmp 0x417b04
movzx ebx, si
lea eax, [esp + 0x19]
jmp 0x417c33
lea ebx, [ebx + ebx*2]
add eax, 1
lea edi, [ebx + ebx + 0x4378e0]
movzx ebx, byte [edi + 4]
mov byte [eax - 1], bl
movzx ebx, word [edi + 2]
lea edi, [esp + 0x1018]
cmp eax, edi
je 0x417bc0
cmp ebx, 0xff
jg 0x417c10
jmp 0x417b5c
movzx eax, di
movzx ebx, word [esp + 0x12]
add edi, 1
lea eax, [eax + eax*2]
mov word [esp + 0xe], di
lea eax, [eax + eax + 0x4378e0]
mov word [eax + 2], bx
movzx ebx, byte [esp + 0x11]
mov byte [eax + 4], bl
jmp 0x417ba8
xor eax, eax
jmp 0x417bc5

Function at 0x41bc50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0041cda0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0041cda0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x41bcb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x42f23c]
test esi, esi
jle 0x41bdb0
mov eax, dword [0x42f240]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x41bce0
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x41bd5f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x41bcd0
mov dword [esp], ebx
call fcn.0041c620
mov edi, eax
test eax, eax
je 0x41bdd7
mov eax, dword [0x42f240]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0041c730
mov edx, dword [0x42f240]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x41bdb7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x41bd58
sub eax, 4
and eax, 0xfffffffb
jne 0x41bd66
add dword [0x42f23c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x42f240]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x41bd58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0041bc50
xor esi, esi
jmp 0x41bcea
mov eax, dword [0x42f240]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0041bc50
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0041bc50
lea esi, [esi]
nop

Function at 0x41c290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x42f258
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x42f250]
sub esp, 4
test ebx, ebx
je 0x41c2e5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x41c2de
test esi, esi
je 0x41c2de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x41c2c0
mov dword [esp], 0x42f258
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40cb9f
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x40cbdc
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x40cbd5
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x40cbe1
add edx, 0x28
cmp edx, esi
jne 0x40cbc6
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x40cbde

Function at 0x417385
Capabilities:
Encode data using xor

Disassembly:
call 0x4172fe
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x41732e
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x41734a
xor edx, 0
jmp 0x417355
xor edx, edx
jmp 0x41736c
jmp 0x417378
xor eax, eax
push 0x8427d7c0
call 0x417385
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x4173c1
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x41739a
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x4173d8
add eax, 0
jno 0x4173dd
add esi, 0
ret 0x10
Function at 0x418146
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x418168
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x41830a
cmp edi, dword [ebp + 0x10]
jb 0x41830a
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.00417c32
inc edi
jmp 0x4181f1
jmp 0x4181fe
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.00417c32
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.00417c32
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x418252
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x418236
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.00418280
add dword [eax], 0x39
jle 0x41825c
sub al, 0xf5
mov ch, al
call fcn.00418295
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x419f6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x419f83
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x419f94
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.00419fd5
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx