joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, eax
cmp dword [edi + 0x14], 0x10
jb 0x4058d2
mov eax, dword [edi]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405916
push 0x25e85c0
push 0x261a898
call fcn.00407b10
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.004070b0
mov eax, dword [esi]
mov eax, dword [eax + 4]
jmp 0x405968
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
push 0
lea edx, [ebp - 4]
push edx
sub ecx, eax
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0x14], 0x10
jb 0x40593b
mov edi, dword [edi]
push edi
push ecx
push 0x25e85d8
push 0x261a950
call fcn.00407b10
add esp, 0xc
push eax
call fcn.00407b10
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.004070b0
mov edx, dword [esi]
mov eax, dword [edx + 4]
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x405988
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x405988
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x4059a9
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x4059a1
or eax, 4
push 0
push eax
call fcn.00404ad0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4059b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x38
mov esi, eax
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.005492c0
mov edi, 0x10
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
cmp dword [esi + 0x14], edi
jb 0x4059e9
mov ecx, dword [esi]
mov dword [ebp - 0x2c], ecx
jmp 0x4059ec
mov dword [ebp - 0x2c], esi
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x405a7c
cmp dword [esi + 0x14], edi
jb 0x405a08
mov esi, dword [esi]
push esi
push ecx
push 0x25e85e8
push 0x261a898
call fcn.00407b10
add esp, 0xc
push eax
call fcn.00407b10
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.004070b0
mov eax, dword [esi]
mov eax, dword [eax + 4]
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x405a55
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x405a55
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x405a92
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x405a6e
or eax, 4
push 0
push eax
call fcn.00404ad0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f0b5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x40f0fd
call fcn.00444926
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40f0fd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x40f140
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x40f129
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40f129
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x40f13d
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4126bc
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5705dc
call fcn.00548df3
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4126e1
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x412733
call fcn.004145af
push eax
lea ecx, [ebp - 0x10]
call fcn.00401990
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0054973b
push eax
call fcn.00401730
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401a40
mov eax, esi
call fcn.00548ecb
ret 8

Function at 0x4139d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00444926
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x413a0c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00413610
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x413a6a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x413a8e
cmp dword [edi + 0x74], 0
jne 0x413a8e
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00444926
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00413a2b
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41e83c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41e883
call fcn.00444926
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41e883
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41e89f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041e33c
mov esi, eax
test edi, edi
je 0x41e89d
test ebx, ebx
je 0x41e89d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x43a609
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x43a623
call fcn.00444926
mov esi, dword [eax + 0xc]
push dword [0x2616ae4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x43a641
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x43a639
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x43a66e
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x43a63b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0043a537
mov esi, eax
jmp 0x43a660
Function at 0x4c005e
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x4c009c
push 0x58cecc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4c00aa
push 0x58cf00
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c00aa
push dword [esi]
push 2
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x4c00ac
cmp dword [esi + 4], 0
je 0x4c00aa
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x4c2694
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x56e8ff
call fcn.00548df3
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040a9f0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4c26f6
call fcn.004441e9
cmp eax, 1
jne 0x4c26f6
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x579fb4
push eax
call fcn.00411b58
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040c445
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401a40
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401a40
mov eax, esi
call fcn.00548ecb
ret 0x10

Function at 0x4c271f
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x56e8ff
call fcn.00548df3
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040a9f0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4c2781
call fcn.004441e9
cmp eax, 1
jne 0x4c2781
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x579fb4
push eax
call fcn.00411b58
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040c445
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401a40
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401a40
mov eax, esi
call fcn.00548ecb
ret 0x14
Function at 0x50b3f1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x50b409
mov edi, dword [esi + 0xc]
jmp 0x50b449
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x50b422
call fcn.00414d24
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x50b437
call fcn.00414d24
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x50b449
call fcn.00414d24
call fcn.00444926
cmp dword [eax + 0x3c], 0
je 0x50b45e
push edi
mov ecx, ebx
call fcn.0050a2ad
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0050b30b
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x50b47c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x50b488
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5260c1
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00525d65
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x52610b
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00416748
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040e3df
jmp 0x526116
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004a392a
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x52611c
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00411fa2
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x526159
call fcn.00525d65
mov dword [esi + 0xc], 1
jmp 0x52615e
call fcn.00525d65
cmp dword [esi], 0
je 0x5261a7
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x52617f
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00416748
jmp 0x526191
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00401ba0
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040e3df
jmp 0x5261cb
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x5261cb
push dword [esi]
push dword [ebp + 8]
call fcn.004a392a
pop esi
pop ebp
ret 0xc
Function at 0x52c065
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00543f01
call fcn.00444357
cmp dword [eax + 0x14], 0
jne 0x52c082
mov ecx, esi
pop esi
jmp fcn.0052bb6a
pop esi
ret

Function at 0x52f0dc
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0052013d
call fcn.00444357
cmp dword [eax + 0x14], 0
jne 0x52f0f9
mov ecx, esi
pop esi
jmp fcn.0052eaaf
pop esi
ret

Function at 0x54774f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2612450]
jne 0x547759
repz ret
jmp fcn.0054ec43

Function at 0x559f39
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x2612450]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0054e66b
and dword [ebp - 0x14], 0
cmp dword [0x261a76c], 0
mov dword [ebp - 0x18], eax
jne 0x559fec
push 0x580164
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x55a094
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5a8bb8
push ebx
call edi
test eax, eax
je 0x55a094
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5a8ba8
push ebx
mov dword [0x261a76c], eax
call edi
push eax
call esi
push 0x5a8b94
push ebx
mov dword [0x261a770], eax
call edi
push eax
call esi
push 0x5a8b78
push ebx
mov dword [0x261a774], eax
call edi
push eax
call esi
mov dword [0x261a77c], eax
test eax, eax
je 0x559fec
push 0x5a8b60
push ebx
call edi
push eax
call esi
mov dword [0x261a778], eax
mov eax, dword [0x261a778]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x55a045
cmp dword [0x261a77c], ecx
je 0x55a045
push eax
call esi
push dword [0x261a77c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x55a045
test ebx, ebx
je 0x55a045
call edi
test eax, eax
je 0x55a03c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x55a03c
test byte [ebp - 8], 1
jne 0x55a045
or dword [ebp + 0x10], 0x200000
jmp 0x55a078
mov eax, dword [0x261a770]
cmp eax, dword [ebp - 0x18]
je 0x55a078
push eax
call esi
test eax, eax
je 0x55a078
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x55a078
mov eax, dword [0x261a774]
cmp eax, dword [ebp - 0x18]
je 0x55a078
push eax
call esi
test eax, eax
je 0x55a078
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x261a76c]
call esi
test eax, eax
je 0x55a094
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x55a096
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054774f
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063a0]
test esi, esi
jle 0x401c10
mov edi, dword [0x4063a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401b34
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401bb5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401b20
mov dword [esp], eax
mov ebx, eax
call fcn.004023f0
test eax, eax
mov edi, eax
je 0x401c37
mov eax, dword [0x4063a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004024f0
add eax, dword [edi + 0xc]
mov edx, dword [0x4063a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c17
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401bae
sub eax, 4
and eax, 0xfffffffb
jne 0x401bc0
add dword [0x4063a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4063a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401bae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00402aa0
lea esi, [esi]
xor esi, esi
jmp 0x401b3e
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00402aa0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00402aa0
mov esi, esi
lea edi, [edi]

Function at 0x402070
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
test ebx, ebx
je 0x4020c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4020be
test esi, esi
je 0x4020be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020a0
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402aa0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402740
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402740
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0

Function at 0x401000
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, 0x5bfe
mov eax, ecx
mov dword [0x4b4752], eax
mov dword [0x4b4739], 0
mov eax, dword [0x4b4739]
mov dword [0x4b48ef], eax
mov dword [0x4b49c1], 0
mov eax, dword [0x4b49c1]
mov eax, ebx
xor ebx, eax
test dword [0x4b428b], eax
jne 0x401045
mov ebx, 0x19c2
sub eax, ebx
dec eax
shl eax, 1
ror eax, 1
or eax, dword [0x4b43b9]
je 0x401077
sub eax, dword [0x4b47dd]
dec eax
mov ebx, 0x11e8
add eax, ebx
dec eax
or eax, ebx
mov ebx, 0x1dd0
sub eax, ebx
add eax, dword [0x4b4a1d]
xor ebx, eax
sub eax, dword [0x4b46db]
shr eax, 1
add dword [0x4b42db], eax
jmp fcn.00402754
Function at 0x822cb30
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x138]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x822cb54
movzx eax, word [ecx + 6]
jmp 0x822cb56
xor eax, eax
movzx esi, word [edi + 0x144]
sub eax, esi
movzx edx, ax
test ecx, ecx
jne 0x822cb6a
xor esi, esi
jmp 0x822cb73
movsx esi, si
shl esi, 7
add esi, dword [ecx + 8]
push ebx
test dx, dx
je 0x822ccb5
lea ecx, [ecx]
movzx eax, word [esi + 8]
dec edx
mov dword [ebp - 0x10], edx
cmp ax, 8
je 0x822cb98
cmp ax, 0x18
jne 0x822cca9
cmp dword [esi + 0x7c], 0
jne 0x822cbb3
mov ecx, 0x8222044
call fcn.08251fe3
mov dword [esi + 0x7c], eax
test eax, eax
je 0x822ccd7
cmp dword [ebp - 4], 0
jne 0x822cbd9
mov eax, dword [0x8246cbc]
push 0x10000
push 0
push eax
call fcn.08230040
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
je 0x822ccf4
mov ecx, dword [esi + 0x7c]
push 2
push 0
push ecx
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x822ccd7
mov edx, dword [esi + 0x7c]
push edx
call dword [sym.imp.msvcrt.dll_ftell]
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, 0x7fffffff
xor edi, edi
lea esp, [esp]
cmp ebx, 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov ecx, 0xffff
jg 0x822cc2b
mov ecx, ebx
push edi
lea edx, [ebp - 8]
push edx
movsx edx, word [esi + 0x44]
push edx
movzx edx, word [esi]
push ecx
mov ecx, dword [ebp - 4]
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.08230ee0
add esp, 0x20
test ax, ax
mov eax, dword [ebp + 8]
jne 0x822ccfc
mov edx, dword [eax + 0x1c]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [edx + 4]
jne 0x822cd14
mov eax, dword [ebp - 8]
test eax, eax
jle 0x822cc98
mov edx, dword [esi + 0x7c]
push edx
push 1
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x822cd31
mov eax, dword [ebp - 8]
add edi, eax
sub ebx, eax
jne 0x822cc10
mov eax, dword [esi + 0x60]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov edi, dword [ebp + 8]
sub esi, 0xffffff80
test dx, dx
jne 0x822cb80
xor esi, esi
mov eax, dword [ebp - 4]
pop ebx
test eax, eax
je 0x822ccce
push eax
mov eax, dword [0x8246cbc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov ax, si
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x27
push 0
push 0
push 0
add edi, 8
push edi
call fcn.0822a430
add esp, 0x1c
or esi, 0xffffffff
jmp 0x822ccb7
push 0
push 0
push 0x28
jmp 0x822ccdd
mov edx, dword [eax]
mov ecx, dword [eax + 0x1c]
push edx
push ecx
add eax, 8
push eax
call fcn.0822a640
add esp, 0xc
or esi, 0xffffffff
jmp 0x822ccb7
push 0
push 0
push 0x55
push 0
push 0
add eax, 8
push 0
push eax
call fcn.0822a430
add esp, 0x1c
or esi, 0xffffffff
jmp 0x822ccb7
mov edx, dword [ebp + 8]
push 0
push 0
push 0x27
push 0
push 0
add edx, 8
push 0
push edx
call fcn.0822a430
add esp, 0x1c
or esi, 0xffffffff
jmp 0x822ccb7