joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3000aef8
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0xff
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetWindowTextA
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.30001f58
add esp, 0x100
pop ebx
ret

Function at 0x3000b1c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.3000217c
xor eax, eax
push ebp
push 0x3000b262
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x30004bb0]
call fcn.300015cc
mov esi, eax
call fcn.3000274c
mov dword [eax + 0xc], esi
mov eax, dword [ebp - 4]
call fcn.300076b0
push eax
push 0x3000af28
call sub.user32.dll_EnumWindows
call fcn.3000274c
mov eax, dword [eax + 0xc]
call fcn.30004e0c
push eax
call fcn.3000274c
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 4]
mov eax, ebx
pop ecx
call fcn.30001edc
call fcn.3000274c
mov eax, dword [eax + 0xc]
call fcn.300015fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3000b269
lea eax, [ebp - 4]
call fcn.30001df0
ret

Function at 0x3000b304
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor ebx, ebx
push esi
call sub.user32.dll_IsIconic
test eax, eax
je 0x3000b31f
push 9
push esi
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
jne 0x3000b32f
mov bl, 1
jmp 0x3000b3c4
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov ebp, eax
push 0xffffffffffffffff
push edi
push ebp
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x3000b374
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 0
push edi
push ebp
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
test bl, bl
jne 0x3000b3ba
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoA
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [esp + 4]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x3000b410
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.3000217c
xor eax, eax
push ebp
push 0x3000b4f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x14
call sub.user32.dll_GetKeyState
not ax
test al, 1
sete al
neg al
sbb eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x3000b457
xor edx, edx
mov al, 0x14
call fcn.3000b3ec
mov eax, dword [ebp - 4]
call fcn.30001f94
mov esi, eax
test esi, esi
jle 0x3000b4cc
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
cmp al, 0x7e
jne 0x3000b47e
mov al, 0xd
call fcn.3000b3cc
jmp 0x3000b4c8
push eax
call sub.user32.dll_VkKeyScanA
mov edi, eax
mov eax, edi
call fcn.30002cd8
cmp al, 0xff
je 0x3000b4c8
mov eax, edi
cmp al, 0xff
je 0x3000b4c8
mov eax, edi
call fcn.30002cd8
and al, 1
cmp al, 1
jne 0x3000b4ab
mov al, 0x10
call fcn.3000b3cc
mov eax, edi
xor edx, edx
call fcn.3000b3ec
mov eax, edi
call fcn.30002cd8
and al, 1
cmp al, 1
jne 0x3000b4c8
mov al, 0x10
call fcn.3000b3dc
inc ebx
dec esi
jne 0x3000b46a
cmp dword [ebp - 8], 0
je 0x3000b4db
xor edx, edx
mov al, 0x14
call fcn.3000b3ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3000b4f8
lea eax, [ebp - 4]
call fcn.30001df0
ret

Function at 0x3000b500
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle
pop ebx
ret

Function at 0x3000b810
Capabilities:
Suspend thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov edi, eax
mov ebp, esp
mov edx, edi
mov eax, 4
call fcn.30006fd8
mov ebx, eax
mov dword [ebp], 0x1c
push ebp
push ebx
call fcn.30007038
mov eax, dword [ebp + 0xc]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x3000b84a
cmp eax, dword [esp]
pop edx
pop eax
jne 0x3000b86c
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1f03ff
call sub.kernel32.dll_OpenThread
mov esi, eax
push esi
call sub.kernel32.dll_SuspendThread
push esi
call sub.kernel32.dll_CloseHandle
push ebp
push ebx
call fcn.3000705c
test eax, eax
jne 0x3000b837
push ebx
call sub.kernel32.dll_CloseHandle
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x3000b888
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov edi, eax
mov ebp, esp
mov edx, edi
mov eax, 4
call fcn.30006fd8
mov ebx, eax
mov dword [ebp], 0x1c
push ebp
push ebx
call fcn.30007038
mov eax, dword [ebp + 0xc]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x3000b8c2
cmp eax, dword [esp]
pop edx
pop eax
jne 0x3000b8e4
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1f03ff
call sub.kernel32.dll_OpenThread
mov esi, eax
push esi
call sub.kernel32.dll_ResumeThread
push esi
call sub.kernel32.dll_CloseHandle
push ebp
push ebx
call fcn.3000705c
test eax, eax
jne 0x3000b8af
push ebx
call sub.kernel32.dll_CloseHandle
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x3000cb9c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x3000cba4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.3000217c
lea edi, [ebp - 0x144]
xor eax, eax
push ebp
push 0x3000cdaf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.300083c0
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 4]
call fcn.30001e88
push edi
lea eax, [ebp - 0x14c]
mov ecx, 0x3000cdc8
mov edx, dword [ebp - 4]
call fcn.30001fe0
mov eax, dword [ebp - 0x14c]
call fcn.3000218c
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x3000cd89
lea edx, [ebp - 0x150]
mov eax, edi
call fcn.3000869c
mov eax, dword [ebp - 0x150]
mov edx, 0x3000cdd4
call fcn.300020d8
je 0x3000cc45
mov eax, dword [edi + 0x20]
add dword [esi], eax
jmp 0x3000cd74
lea eax, [ebp - 0x154]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.30001f58
mov eax, dword [ebp - 0x154]
mov edx, 0x3000cde8
call fcn.300020d8
je 0x3000cd74
lea eax, [ebp - 0x158]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.30001f58
mov eax, dword [ebp - 0x158]
mov edx, 0x3000cdf4
call fcn.300020d8
je 0x3000cd74
lea eax, [ebp - 0x160]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.30001f58
mov ecx, dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.30001fe0
mov edx, dword [ebp - 0x15c]
mov eax, esi
call fcn.3000cb9c
jmp 0x3000cd74
lea edx, [ebp - 0x164]
mov eax, edi
call fcn.3000869c
mov eax, dword [ebp - 0x164]
mov edx, 0x3000cdd4
call fcn.300020d8
je 0x3000ccf6
mov eax, dword [edi + 0x20]
add dword [esi], eax
jmp 0x3000cd74
lea eax, [ebp - 0x168]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.30001f58
mov eax, dword [ebp - 0x168]
mov edx, 0x3000cde8
call fcn.300020d8
je 0x3000cd74
lea eax, [ebp - 0x16c]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.30001f58
mov eax, dword [ebp - 0x16c]
mov edx, 0x3000cdf4
call fcn.300020d8
je 0x3000cd74
lea eax, [ebp - 0x174]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.30001f58
mov ecx, dword [ebp - 0x174]
lea eax, [ebp - 0x170]
mov edx, dword [ebp - 4]
call fcn.30001fe0
mov edx, dword [ebp - 0x170]
mov eax, esi
call fcn.3000cb9c
push edi
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x3000ccd0
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3000cdb6
lea eax, [ebp - 0x174]
mov edx, 0xc
call fcn.30001e14
lea eax, [ebp - 4]
call fcn.30001df0
ret
Function at 0x3000ec78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x3000ec80
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.3000217c
xor eax, eax
push ebp
push 0x3000eed4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, 0x3000eee8
mov eax, dword [ebp - 8]
call fcn.300071dc
mov eax, dword [ebp - 0xc]
call fcn.30001f94
mov ecx, eax
inc ecx
lea eax, [ebp - 8]
mov edx, 1
call fcn.30002228
mov eax, dword [ebp - 0xc]
mov edx, 0x3000eef4
call fcn.300020d8
jne 0x3000ed34
xor eax, eax
mov dword [0x30015920], eax
cmp dword [0x30015924], 0
je 0x3000ecfb
mov eax, dword [0x30015924]
call fcn.30004a0c
cmp dword [ebp - 4], 0
je 0x3000ed0d
push ebp
mov eax, 0x3000ef04
call fcn.3000ebf8
pop ecx
mov eax, dword [ebp - 4]
mov dword [0x30015924], eax
cmp dword [0x3001591c], 0
jne 0x3000ed34
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x3000ebb8
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, dword [ebp - 0xc]
mov edx, 0x3000ef28
call fcn.300020d8
jne 0x3000ed86
cmp dword [ebp - 4], 0
je 0x3000ed55
push ebp
mov eax, 0x3000ef38
call fcn.3000ebf8
pop ecx
mov eax, dword [ebp - 4]
cmp eax, dword [0x30015924]
jne 0x3000ed67
xor eax, eax
mov dword [0x30015924], eax
cmp dword [0x30016038], 0
jne 0x3000eeac
mov eax, dword [0x3001591c]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [0x3001591c], eax
mov eax, dword [ebp - 0xc]
mov edx, 0x3000ef5c
call fcn.300020d8
jne 0x3000ede4
lea eax, [ebp - 8]
call fcn.30001df0
lea eax, [ebp - 0x14]
mov edx, 0x30015b30
call fcn.30001f4c
lea eax, [ebp - 0x14]
mov edx, 0x3000ef6c
call fcn.30001f9c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.3000d26c
push ebp
push dword [ebp - 0xc]
push 0x3000eee8
push dword [ebp - 8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.30002054
mov eax, dword [ebp - 0x18]
call fcn.3000ebf8
pop ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x3000ef7c
call fcn.300020d8
jne 0x3000ee6d
mov dl, 1
mov eax, dword [0x30004bb0]
call fcn.300015cc
mov ebx, eax
lea eax, [ebp - 0x20]
mov edx, 0x30015b30
call fcn.30001f4c
push dword [ebp - 0x20]
push 0x3000ef6c
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.30002054
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.30005298
mov eax, ebx
call fcn.30004e0c
mov ecx, eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 4]
call fcn.30001edc
mov eax, ebx
call fcn.300015fc
push ebp
push dword [ebp - 0xc]
push 0x3000eee8
push dword [ebp - 8]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.30002054
mov eax, dword [ebp - 0x24]
call fcn.3000ebf8
pop ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x3000ef8c
call fcn.300020d8
jne 0x3000eeac
lea eax, [ebp - 0x30]
mov edx, 0x30015b30
call fcn.30001f4c
push dword [ebp - 0x30]
push 0x3000ef6c
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.30002054
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.30009da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3000eedb
lea eax, [ebp - 0x30]
mov edx, 8
call fcn.30001e14
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.30001e14
ret
Function at 0x3000fd80
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
xor edx, edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x3000ff72
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x34], 0xc
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xffffffff
push 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_CreatePipe
push 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_CreatePipe
lea eax, [ebp - 0x78]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x4c], 0x181
mov word [ebp - 0x48], 0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0x10
push 0xffffffffffffffff
push 0
push 0
push 0x3000ff80
push 0
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov dword [ebp - 0x28], 1
push 0
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetNamedPipeHandleState
lea eax, [ebp - 4]
mov edx, 0x1000
call fcn.30002314
jmp 0x3000ff1a
push 0xa
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x88]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x24], 0x103
jne 0x3000ff24
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, ebx
call fcn.300048e0
cmp dword [ebp - 0x18], 0
je 0x3000fec0
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
call fcn.30001f94
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x1000
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
cmp dword [ebp - 0x1c], 0
jbe 0x3000ff1a
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.300021e8
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
mov edx, 0x3000ff8c
call fcn.30001fe0
mov edx, dword [ebp - 0x8c]
xor ecx, ecx
mov eax, ebx
call fcn.300047e8
cmp dword [ebx + 0x1c], 0
jne 0x3000fe6e
push 0
mov eax, dword [ebp - 0x88]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3000ff79
lea eax, [ebp - 0x90]
mov edx, 2
call fcn.30001e14
lea eax, [ebp - 0x18]
call fcn.30001df0
lea eax, [ebp - 4]
call fcn.30001df0
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x6b28522f
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2f6f152f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x68f40a0
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x60027960
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7ae84997
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..text
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x712b3f86
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402680
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4026cb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4026c4
test esi, esi
je 0x4026c4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4026a0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4028b0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4029d8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40293e
cmp eax, 4
jne 0x402960
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40294e
cmp edx, 4
je 0x40294e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004028b0
Function at 0x100025f0
Capabilities:
Check mutex on windows
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push 2
push eax
mov dword [ebp - 0x18], 0x20001
mov dword [ebp - 0x14], 0x100
mov dword [ebp - 0xc], 0x60001
mov dword [ebp - 8], 0x100
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x10002635
xor al, al
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
push dword [0x10077100]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x10068954
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0x100
push 0
push 0x10077107
mov dword [0x10077100], eax
call fcn.10020410
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [0x10077208], xmm0
push dword [0x10077100]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x10002690
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0xc
push 2
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x20001
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x60001
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov esp, ebp
pop ebp
ret

Function at 0x100026e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.1003f290
mov eax, dword [0x1007200c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10002712
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007975
mov esp, ebp
pop ebp
ret 4
push 0x10
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x10000003
push dword [edi]
call dword [sym.imp.USER32.dll_GetRawInputData]
push 0x10
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1004]
push eax
push 0x10000003
push dword [edi]
call dword [sym.imp.USER32.dll_GetRawInputData]
cmp eax, dword [ebp - 0x1008]
jne 0x100026ff
mov eax, dword [ebp - 0x1004]
cmp eax, 1
jne 0x1000278e
push 0xffffffffffffffff
push dword [0x10077100]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x10068954
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea edx, [ebp - 0xff4]
mov dword [0x10077100], eax
mov ecx, 0x10077107
call fcn.10001f40
jmp 0x100027c4
test eax, eax
jne 0x100027d0
push 0xffffffffffffffff
push dword [0x10077100]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x10068954
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea edx, [ebp - 0xff4]
mov dword [0x10077100], eax
mov ecx, 0x10077208
call fcn.10002570
push dword [0x10077100]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.10007975
mov esp, ebp
pop ebp
ret 4
Function at 0x10002870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10002889
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100028c6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100028c2
nop word [eax + eax]
cmp esi, edx
jae 0x100028c6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100028b0
cmp esi, edx
jb 0x100028cd
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret