joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405fbc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423a40]
jne 0x405fc6
repz ret
jmp fcn.004073d8

Function at 0x4061fe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402cda
and dword [ebp - 4], 0
cmp dword [0x424910], 0
mov ebx, eax
jne 0x4062af
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406360
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406360
push eax
call fcn.00402c68
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x424910], eax
call esi
push eax
call fcn.00402c68
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x424914], eax
call esi
push eax
call fcn.00402c68
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x424918], eax
call esi
push eax
call fcn.00402c68
pop ecx
mov dword [0x424920], eax
test eax, eax
je 0x4062af
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402c68
pop ecx
mov dword [0x42491c], eax
mov eax, dword [0x42491c]
cmp eax, ebx
je 0x406307
cmp dword [0x424920], ebx
je 0x406307
push eax
call fcn.00402ce3
push dword [0x424920]
mov esi, eax
call fcn.00402ce3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406307
test edi, edi
je 0x406307
call esi
test eax, eax
je 0x4062fe
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4062fe
test byte [ebp - 0xc], 1
jne 0x406307
or dword [ebp + 0x10], 0x200000
jmp 0x406340
mov eax, dword [0x424914]
cmp eax, ebx
je 0x406340
push eax
call fcn.00402ce3
pop ecx
test eax, eax
je 0x406340
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406340
mov eax, dword [0x424918]
cmp eax, ebx
je 0x406340
push eax
call fcn.00402ce3
pop ecx
test eax, eax
je 0x406340
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424910]
call fcn.00402ce3
pop ecx
test eax, eax
je 0x406360
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406362
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a960
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
sub esp, 0x104
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, esp
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x40a995
cmp byte [esp + 0x12], 0
js 0x40a999
mov bl, byte [esp + 0xa5]
shr bl, 7
jmp 0x40a99b
xor ebx, ebx
jmp 0x40a99b
mov bl, 1
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0049f6f0
mov eax, ebx
add esp, 0x104
pop ebx
ret

Function at 0x40b3a0
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x502e3c]
test eax, eax
je 0x40b3d3
cmp byte [0x502e40], 1
jne 0x40b3d5
push 0
push 0x12
push 0
push 0
call dword [0x502e38]
push dword [0x502e3c]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x502e3c]
jmp 0x40b3d5
xor eax, eax
push eax
call fcn.00439860
add esp, 4
mov dword [0x502e3c], 0
mov byte [0x502e40], 0
ret
Function at 0x415ba0
Capabilities:
Contain obfuscated stackstrings
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x112c], 2
jl 0x415bff
mov eax, dword [esp + 0xc]
cmp dword [esi + 0x1124], eax
jne 0x415bff
mov dword [esi + 0xe28], 0
mov dword [esi + 0xe34], 0
mov dword [esi + 0xe38], 0
mov dword [esi + 0xe3c], 0
mov dword [esi + 0xe40], 0
push esi
call fcn.0040b640
add esp, 4
mov ecx, esi
xor edx, edx
pop esi
jmp fcn.00412070
pop esi
ret

Function at 0x41e780
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x502e6c]
test eax, eax
jne 0x41e7b5
push 0
push 0x41e7c0
push dword [esp + 0xc]
push 0x6e
push dword [0x501be8]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x502e6c], eax
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x502e6c]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
ret
Function at 0x429320
Capabilities:
Get memory capacity

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x2c], eax
lea esi, [esp + 0x2c]
push 4
push esi
push 9
call fcn.00428ed0
add esp, 0xc
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [esp + 0x2c], eax
push 4
push esi
push 0xa
call fcn.00428ed0
add esp, 0xc
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov dword [esp + 0x2c], eax
push 4
push esi
push 0xb
call fcn.00428ed0
add esp, 0xc
push 0x1cbf
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push 4
push eax
push 0xc
call fcn.00428ed0
add esp, 0xc
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
push esi
push 0xd
call fcn.00428ed0
add esp, 0xc
mov esi, esp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x20
push esi
push 6
call fcn.00428ed0
add esp, 0xc
lea ebp, [esp + 0x48]
lea ebx, [esp + 0x40]
lea edi, [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea esi, [esp + 0x30]
push ebp
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0x20
push esi
push 0xe
call fcn.00428ed0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebp
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0x20
push esi
push 0xf
call fcn.00428ed0
add esp, 0xc
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0049f6f0
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42ea90
Capabilities:
Get session user name

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x3a
push esi
call fcn.00437d40
add esp, 8
cmp byte [eax], 0
je 0x42eab0
push eax
call fcn.0043ef00
add esp, 4
pop esi
ret
push 0x3b
push esi
call fcn.00437b40
add esp, 8
test al, al
je 0x42eac5
pop esi
jmp fcn.00468350
xor eax, eax
pop esi
ret

Function at 0x43c2a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [0x501034]
xor esi, esp
mov dword [esp + 8], esi
mov dword [esp], 4
mov esi, esp
lea edi, [esp + 4]
push esi
push edx
push edi
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
xor ecx, 4
or ecx, eax
mov eax, dword [esp + 4]
xor eax, 4
or eax, ecx
sete bl
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0049f6f0
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
ret
Function at 0x43c340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 8], eax
mov ebx, esp
lea eax, [esp + 4]
push ebx
push 0
push eax
push 0
push dword [esp + 0x34]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x43c3df
cmp dword [esp + 4], 1
jne 0x43c3df
mov ebp, dword [esp]
add ebp, 1
push 0
push 1
push ebp
call fcn.004397d0
add esp, 0xc
mov ecx, edi
mov edi, eax
push ebx
push eax
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43c3d6
cmp dword [esp + 4], 1
jne 0x43c3d6
mov eax, dword [esp]
cmp eax, ebp
jb 0x43c3ce
push 0x6c
push str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_windows_utils_registry.c
push str.size___allocsize
call fcn.004aeeb3
add esp, 0xc
mov eax, dword [esp]
mov byte [edi + eax], 0
mov esi, edi
jmp 0x43c3df
push edi
call fcn.00439860
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x468350
Capabilities:
Get session user name

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 4], eax
cmp byte [0x5043fc], 0
je 0x468378
mov ecx, dword [0x5043f8]
test ecx, ecx
jne 0x4683bb
jmp 0x468408
push str.secur32.dll
call fcn.0043bfb0
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.0043bfb0
add esp, 4
test esi, esi
je 0x4683a8
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x4683aa
xor ecx, ecx
mov dword [0x5043f8], ecx
mov byte [0x5043fc], 1
test ecx, ecx
je 0x468408
mov dword [esp], 0
mov edi, esp
push edi
push 0
push 8
call ecx
push 0
push 1
push dword [esp + 8]
call fcn.004397d0
add esp, 0xc
mov esi, eax
push edi
push eax
push 8
call dword [0x5043f8]
test al, al
je 0x4683ff
push 0x40
push esi
call fcn.004a25b0
add esp, 8
test eax, eax
je 0x468455
mov byte [eax], 0
jmp 0x468455
push esi
call fcn.00439860
add esp, 4
mov dword [esp], 0
mov edi, esp
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x468423
mov eax, dword [esp]
jmp 0x46842f
mov dword [esp], 0x100
mov eax, 0x100
push 0
push 1
push eax
call fcn.004397d0
add esp, 0xc
mov esi, eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x468455
push esi
call fcn.00439860
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 8
pop esi
pop edi
ret

Function at 0x468810
Capabilities:
Get common file path

Disassembly:
push esi
cmp dword [0x504400], 0
jne 0x468870
push dword [0x504404]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, dword [0x504404]
jb 0x468870
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 1
push eax
push 1
push 0x504404
push dword [0x504400]
call fcn.00439870
add esp, 0x18
mov dword [0x504400], eax
push dword [0x504404]
push eax
call esi
cmp eax, dword [0x504404]
jae 0x468840
mov eax, dword [0x504400]
pop esi
ret

Function at 0x479de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
je 0x479e04
mov edx, dword [edi]
xor edx, dword [ecx]
mov ebp, dword [edi + 4]
xor ebp, dword [ecx + 4]
or ebp, edx
je 0x479e51
test ebx, ebx
jle 0x479e47
add ebx, esi
mov ebp, 0x4d61ac
nop
mov ecx, dword [edi]
mov edx, dword [edi + 4]
xor ecx, dword [esi]
xor edx, dword [esi + 4]
or edx, ecx
mov ecx, 0x4d61b0
cmove ecx, ebp
push 4
push ecx
push eax
call fcn.0047c000
add esp, 0xc
push 4
push 0x4d61b0
push eax
call fcn.0047c000
add esp, 0xc
add esi, 8
cmp esi, ebx
jb 0x479e10
test eax, eax
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push 4
push 0x4d61ac
push 0
call fcn.0047c000
add esp, 0xc
push 4
push 0x4d61b0
push eax
call fcn.0047c000
add esp, 0xc
test ebx, ebx
jg 0x479e08
jmp 0x479e47
Function at 0x47c000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test ecx, ecx
je 0x47c06b
mov edx, dword [esp + 0x18]
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [edx + esi]
xor edi, eax
mov ebx, edi
and ebx, 0xf
shr edi, 4
imul eax, ebx, 0x11111044
xor eax, edi
imul ebp, ebx, 0x8840020
imul edi, ebx, 0x4220000
xor edi, ebp
xor edi, eax
and eax, 0xf
shr edi, 4
imul ebx, eax, 0x11111044
imul ebp, eax, 0x8840020
xor ebp, ebx
imul eax, eax, 0x4220000
xor eax, edi
xor eax, ebp
add esi, 1
cmp ecx, esi
jne 0x47c020
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x47c070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x47c0dd
mov edx, dword [esp + 0x14]
xor esi, esi
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [edx + esi]
xor edi, eax
mov ebx, edi
and ebx, 0xf
shr edi, 4
imul eax, ebx, 0x11111044
xor eax, edi
imul ebp, ebx, 0x8840020
imul edi, ebx, 0x4220000
xor edi, ebp
xor edi, eax
and eax, 0xf
shr edi, 4
imul ebx, eax, 0x11111044
imul ebp, eax, 0x8840020
xor ebp, ebx
imul eax, eax, 0x4220000
xor eax, edi
xor eax, ebp
add esi, 1
cmp ecx, esi
jne 0x47c090
jmp 0x47c0df
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x493050
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x49307a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea esi, [edi - 1]
mov ebx, edi
and ebx, 3
cmp esi, 3
jae 0x493081
xor esi, esi
test ebx, ebx
jne 0x4930ce
jmp 0x4930e3
mov eax, 1
jmp 0x4930ed
mov dword [esp], ebx
and edi, 0xfffffffc
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
xor bl, byte [ecx]
mov bh, byte [eax + 1]
movzx ebp, bl
xor bh, byte [ecx + 1]
or ebp, esi
mov bl, byte [eax + 2]
xor bl, byte [ecx + 2]
movzx esi, bh
movzx ebx, bl
or ebx, esi
or ebx, ebp
movzx edx, byte [eax + 3]
add eax, 4
xor dl, byte [ecx + 3]
add ecx, 4
movzx esi, dl
or esi, ebx
add edi, 0xfffffffc
jne 0x493090
mov ebx, dword [esp]
test ebx, ebx
je 0x4930e3
xor edi, edi
movzx edx, byte [eax + edi]
xor dl, byte [ecx + edi]
movzx edx, dl
or esi, edx
add edi, 1
cmp ebx, edi
jne 0x4930d0
mov eax, 0x100
sub eax, esi
shr eax, 8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49ff77
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49ffb6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49ffb6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49ffb6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x49ffb6
cmp dword [ecx + 0x74], 0xe
jbe 0x49ffb6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4b3cd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b3cfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b3cfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4b40d1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4db748
push 0x4db740
push str.FlsAlloc
push 0x1e
call fcn.004b4764
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b4105
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4b410b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b414f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4db758
push 0x4db750
push str.FlsGetValue
push 0x20
call fcn.004b4764
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b4186
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4bb5d1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4bb66e
push ebx
push esi
call fcn.004bb6bf
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004bb51a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4bb61b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4bb66d
push edi
push eax
call fcn.004b6411
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4bb63b
call fcn.004b5ac6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4bb66c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004bb51a
add esp, 0x20
test eax, eax
jne 0x4bb65a
push edi
call fcn.004b5ac6
jmp 0x4bb662
push ebx
call fcn.004b5ac6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4bb701
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bb96a

Function at 0x4bbe77
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bbe82
Function at 0x401550
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x4015cf
mov eax, dword [ebp - 0xc]
mov ecx, eax
add ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
movzx ebx, byte [eax]
mov eax, dword [ebp - 0xc]
mov edx, eax
sar edx, 0x1f
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
add eax, dword [ebp + 0x10]
movzx eax, byte [eax]
xor eax, ebx
mov byte [ecx], al
mov eax, dword [ebp - 0xc]
mov edx, eax
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
movzx edx, byte [edx]
mov byte [eax], dl
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x40158b
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x401c10
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401c70
Function at 0x402160
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x402170
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x40216d
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x402730
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053c4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053dc]
sub esp, 4
test ebx, ebx
je 0x402785
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40277e
test esi, esi
je 0x40277e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402760
mov dword [esp], 0x4053c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a747
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x548
push ebx
push esi
push edi
xor ebx, ebx
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
push 0x3ff
mov dword [ebp - 0x38], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x543]
push ebx
push eax
mov dword [ebp - 0x40], 0x1002c52c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], 0x100
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 0x544], bl
call fcn.00423d83
mov eax, dword [0x100398a4]
add esp, 0xc
lea esi, [ebp - 0x38]
call fcn.004102e4
push dword [ebp + 8]
mov edi, 0x1002c520
push edi
mov esi, 0x400
push esi
push dword [ebp - 0x30]
call fcn.0041c209
add esp, 0x10
push ebx
push ebx
push dword [0x100398a4]
lea eax, [ebp - 0x38]
push 0x100398a8
push eax
push 0xc
pop edx
call fcn.00411b92
push eax
call fcn.0040fc91
mov eax, dword [ebp - 0x34]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40a7e6
sub eax, ecx
lea eax, [ebp - 0x544]
jne 0x40a807
push dword [ebp - 0x30]
push edi
push esi
push eax
call fcn.0041c209
add esp, 0x10
jmp 0x40a81c
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push 0x1002c534
push esi
push eax
call fcn.0041c209
add esp, 0x14
push 0x10032c60
push dword [0x10032c64]
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
lea eax, [ebp - 0x544]
push eax
push 0x1a
pop edx
call fcn.00411b92
push eax
push dword [0x10035fa8]
call dword [0x10026294]
mov edi, eax
push edi
call fcn.0040a4f8
mov eax, dword [ebp - 0x38]
pop ecx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a858
push dword [ebp - 0x28]
sub eax, esi
push dword [ebp - 0x2c]
push eax
push dword [ebp - 0x38]
push edi
call dword [0x10026298]
lea eax, [ebp - 0x38]
call fcn.00410361
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x144]
push eax
push 0x13
push edi
call dword [0x100262a8]
test eax, eax
jne 0x40a8a2
push edi
call dword [0x100262a0]
or eax, 0xffffffff
jmp 0x40a942
lea eax, [ebp - 0x144]
push eax
call fcn.0041c6a2
pop ecx
cmp eax, 0xc8
je 0x40a8c4
or ebx, 0xffffffff
push edi
call dword [0x100262a0]
mov eax, ebx
jmp 0x40a942
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
call dword [0x10026284]
test eax, eax
je 0x40a939
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jbe 0x40a939
cmp eax, dword [ebp + 0x10]
jae 0x40a939
cmp dword [ebp + 0x10], ebx
jbe 0x40a8b9
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push 0x1000
add eax, esi
push eax
push edi
call dword [0x1002628c]
test eax, eax
je 0x40a913
cmp dword [ebp - 8], ebx
je 0x40a913
add esi, dword [ebp - 8]
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp + 0x10]
jb 0x40a8e6
cmp esi, dword [ebp + 0x10]
jae 0x40a8b9
push edi
call dword [0x100262a0]
push dword [ebp + 0x10]
push 0xb
pop edx
call fcn.00411b92
mov ecx, dword [ebp + 0xc]
push eax
mov eax, esi
call fcn.00410199
pop ecx
pop ecx
jmp 0x40a942
push edi
call dword [0x100262a0]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret