joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push 0
push 0
push 6
push 0
mov ebx, edx
mov dword [ebp - 8], ecx
push str.InstallPath
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x403b78
push dword [ebp - 4]
call fcn.004153ae
mov edi, eax
add esp, 4
test edi, edi
jne 0x403b4f
lea eax, [edi + 0x68]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push edi
push 0
push 6
push 0
push str.InstallPath
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x403b6f
mov dword [esi + 0x18], edi
jmp 0x403b78
push edi
call fcn.004152cb
add esp, 4
cmp dword [esi + 0x18], 0
je 0x403ced
mov edi, dword [esi + 0xc]
test edi, edi
je 0x403bce
push 0
push 0
push 0
push 0xffffffffffffffff
push str.PythonCore
push 0xffffffffffffffff
push edi
push 9
push 0x428ea8
call dword [sym.imp.KERNEL32.dll_CompareStringEx]
sub eax, 1
je 0x403bce
sub eax, 1
je 0x403c1d
sub eax, 1
je 0x403bce
push str.PythonCore
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push str.Error_comparing__.s_and__.s__compare_
push 0
call fcn.00401200
add esp, 0x18
mov eax, dword [ebp - 8]
lea edi, [esi + 0x1c]
cmp byte [eax + 0x39], 0
je 0x403c8f
push str.WindowedExecutablePath
push str.InstallPath
mov edx, ebx
mov ecx, edi
call fcn.00403600
add esp, 8
test eax, eax
jne 0x403d24
cmp dword [edi], eax
je 0x403c9d
push str.WindowedExecutableArguments
push str.InstallPath
lea ecx, [esi + 0x20]
mov edx, ebx
call fcn.00403600
add esp, 8
jmp 0x403c91
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push str._d._d
push dword [esi + 0x10]
call fcn.00401100
add esp, 0x10
cmp eax, 2
je 0x403c52
push dword [esi + 0x10]
push dword [esi + 0xc]
push str.__s__s_has_an_invalid_version_tag_n
call fcn.00401130
add esp, 0xc
jmp 0x403bce
mov eax, dword [ebp - 4]
cmp eax, 2
je 0x403c77
cmp eax, 3
jne 0x403bce
mov eax, dword [ebp - 0xc]
test eax, eax
js 0x403bce
cmp eax, 5
jg 0x403bce
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov edx, ebx
push esi
call fcn.00403760
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
test eax, eax
jne 0x403d24
cmp dword [edi], eax
jne 0x403cf9
push str.ExecutablePath
push str.InstallPath
mov edx, ebx
mov ecx, edi
call fcn.00403600
add esp, 8
test eax, eax
jne 0x403d24
cmp dword [edi], eax
je 0x403cda
push str.ExecutableArguments
push str.InstallPath
lea ecx, [esi + 0x20]
mov edx, ebx
call fcn.00403600
add esp, 8
test eax, eax
jne 0x403d24
cmp dword [edi], eax
jne 0x403cf9
push dword [esi + 0x10]
push dword [esi + 0xc]
push str.__s__s_has_no_executable_path_n
call fcn.00401130
add esp, 0xc
mov eax, 0x67
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.SysArchitecture
push 0
lea ecx, [esi + 0x24]
mov edx, ebx
call fcn.00403600
add esp, 8
test eax, eax
jne 0x403d24
push str.DisplayName
push eax
lea ecx, [esi + 0x28]
mov edx, ebx
call fcn.00403600
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403d30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x218], eax
xor edi, edi
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x21c], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x100
push eax
lea eax, [ebp - 0x208]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x403f3c
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403f20
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x208]
call fcn.00403110
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
mov esi, eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esi + 0x14], eax
mov edx, dword [ebp - 0x210]
call fcn.00403b00
add esp, 8
mov edi, eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x67
jne 0x403e81
push dword [esi + 0xc]
call fcn.004152cb
add esp, 4
push dword [esi + 0x10]
call fcn.004152cb
add esp, 4
push dword [esi + 0x18]
call fcn.004152cb
add esp, 4
push dword [esi + 0x1c]
call fcn.004152cb
add esp, 4
push dword [esi + 0x20]
call fcn.004152cb
add esp, 4
push dword [esi + 0x28]
call fcn.004152cb
mov ecx, dword [esi]
add esp, 4
call fcn.00403220
mov ecx, dword [esi + 4]
mov dword [esi], 0
call fcn.00403220
push esi
mov dword [esi + 4], 0
call fcn.004152cb
mov esi, dword [ebp - 0x20c]
add esp, 4
xor edi, edi
inc ebx
jmp 0x403d71
test edi, edi
jne 0x403f1a
mov ecx, dword [ebp - 0x224]
xor edx, edx
push esi
call fcn.004033d0
mov edi, eax
add esp, 4
test edi, edi
je 0x403f1a
push dword [esi + 0xc]
call fcn.004152cb
add esp, 4
push dword [esi + 0x10]
call fcn.004152cb
add esp, 4
push dword [esi + 0x18]
call fcn.004152cb
add esp, 4
push dword [esi + 0x1c]
call fcn.004152cb
add esp, 4
push dword [esi + 0x20]
call fcn.004152cb
add esp, 4
push dword [esi + 0x28]
call fcn.004152cb
mov ecx, dword [esi]
add esp, 4
call fcn.00403220
mov ecx, dword [esi + 4]
mov dword [esi], 0
call fcn.00403220
push esi
mov dword [esi + 4], 0
call fcn.004152cb
mov esi, dword [ebp - 0x20c]
add esp, 4
cmp edi, 0x6e
jne 0x403f20
xor edi, edi
inc ebx
jmp 0x403d71
mov esi, dword [ebp - 0x20c]
inc ebx
test edi, edi
je 0x403d71
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004065bc
mov esp, ebp
pop ebp
ret
cmp eax, 0x103
je 0x403f52
push str.Failed_to_read_installs__tags__from_the_registry
push 0
call fcn.00401200
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004065bc
mov esp, ebp
pop ebp
ret
Function at 0x4049a0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x40], 0x3c
mov esi, ecx
mov dword [ebp - 0x3c], 0x8140
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push esi
push str._Installing_with__s__s_n
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 1
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
call fcn.00401130
add esp, 0xc
push 0
push 0
push str.PYLAUNCHER_DRYRUN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 2
jb 0x404ad3
push str._Exiting_due_to_PYLAUNCHER_DRYRUN_n
call fcn.00401130
add esp, 4
push 1
call fcn.0040ef6d
add esp, 4
push eax
call fcn.0040f301
add esp, 4
push 0x40000
push 1
call fcn.0040ef6d
add esp, 4
push eax
call fcn.004150a6
add esp, 4
push eax
call fcn.00414eb7
add esp, 8
mov ebx, eax
test edi, edi
je 0x404a7a
push edi
push esi
push str.__s___s_n
push 1
call fcn.0040ef6d
add esp, 4
push eax
call fcn.00401050
add esp, 0x10
jmp 0x404a93
push esi
push str.__s__n
push 1
call fcn.0040ef6d
add esp, 4
push eax
call fcn.00401050
add esp, 0xc
push 1
call fcn.0040ef6d
add esp, 4
push eax
call fcn.0040f301
add esp, 4
test ebx, ebx
js 0x404ac7
push ebx
push 1
call fcn.0040ef6d
add esp, 4
push eax
call fcn.004150a6
add esp, 4
push eax
call fcn.00414eb7
add esp, 8
mov eax, 0x6f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x404aed
mov eax, 0x67
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
test eax, eax
je 0x404ac7
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x404ac7
mov eax, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 0x6f
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4065b0
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.00405ae0

Function at 0x415f67
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415fa6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415fa6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415fa6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415fa6
cmp dword [ecx + 0x74], 0xe
jbe 0x415fa6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x418f4a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4258bc
push 0x4258b4
push str.FlsAlloc
push 0x1f
call fcn.00418e28
mov esi, eax
add esp, 0x10
test esi, esi
je 0x418f7e
push dword [ebp + 8]
mov ecx, esi
call dword [0x4231a8]
call esi
jmp 0x418f84
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x418fc8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4258cc
push 0x4258c4
push str.FlsGetValue
push 0x21
call fcn.00418e28
mov esi, eax
add esp, 0x10
test esi, esi
je 0x418fff
push dword [ebp + 8]
mov ecx, esi
call dword [0x4231a8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x419007
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4258d4
push 0x4258cc
push str.FlsSetValue
push 0x22
call fcn.00418e28
mov esi, eax
add esp, 0x10
test esi, esi
je 0x419041
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4231a8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41a59b
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x41a5e6
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0041a736
test al, al
jne 0x41a5e0
sub edx, 2
cmp edx, edi
jne 0x41a5c6
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x41a608
lea eax, [edi + 2]
cmp edx, eax
je 0x41a608
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0041a4e7
add esp, 0x10
jmp 0x41a702
push esi
lea ecx, [ebp - 0x255]
call fcn.0041a736
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41a64b
push dword [ebp - 0x25c]
jmp 0x41a5f8
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x41a688
cmp word [ebp - 0x226], 0
je 0x41a6a9
cmp word [ebp - 0x226], ax
jne 0x41a688
cmp word [ebp - 0x224], 0
je 0x41a6a9
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0041a4e7
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x41a6f5
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x41a662
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x41a6dd
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41a702
push 0x41a317
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0041f100
add esp, 0x10
jmp 0x41a6d2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004065bc
leave
ret

Function at 0x41b23e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x41b24f
pop esi
ret
push ebx
push edi
push esi
call fcn.0041b207
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00417288
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41b277
push ebx
push esi
push edi
call fcn.004080e0
add esp, 0xc
push 0
call fcn.0041724e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x41b647
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b28c

Function at 0x421d10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421d3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421d3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403250
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x4a25fc]
mov ecx, dword [0x49f508]
sub esp, 0xc24
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403354
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x4a25fc], 0x959
jne 0x40333a
push 0
call esi
push 0
lea eax, [esp + 0x434]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0x402d74
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov eax, dword [esp + 0x14]
push eax
call fcn.00403090
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403290
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc24
ret
Function at 0x40a7f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436620]
jne 0x40a7fa
repz ret
jmp fcn.0040e791

Function at 0x40e1e7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409183
and dword [ebp - 4], 0
cmp dword [0x4380a8], 0
mov ebx, eax
jne 0x40e298
push 0x40237c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40e349
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402370
push edi
call esi
test eax, eax
je 0x40e349
push eax
call fcn.00409111
mov dword [esp], 0x402360
push edi
mov dword [0x4380a8], eax
call esi
push eax
call fcn.00409111
mov dword [esp], 0x40234c
push edi
mov dword [0x4380ac], eax
call esi
push eax
call fcn.00409111
mov dword [esp], 0x402330
push edi
mov dword [0x4380b0], eax
call esi
push eax
call fcn.00409111
pop ecx
mov dword [0x4380b8], eax
test eax, eax
je 0x40e298
push 0x402318
push edi
call esi
push eax
call fcn.00409111
pop ecx
mov dword [0x4380b4], eax
mov eax, dword [0x4380b4]
cmp eax, ebx
je 0x40e2f0
cmp dword [0x4380b8], ebx
je 0x40e2f0
push eax
call fcn.0040918c
push dword [0x4380b8]
mov esi, eax
call fcn.0040918c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40e2f0
test edi, edi
je 0x40e2f0
call esi
test eax, eax
je 0x40e2e7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40e2e7
test byte [ebp - 0xc], 1
jne 0x40e2f0
or dword [ebp + 0x10], 0x200000
jmp 0x40e329
mov eax, dword [0x4380ac]
cmp eax, ebx
je 0x40e329
push eax
call fcn.0040918c
pop ecx
test eax, eax
je 0x40e329
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40e329
mov eax, dword [0x4380b0]
cmp eax, ebx
je 0x40e329
push eax
call fcn.0040918c
pop ecx
test eax, eax
je 0x40e329
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4380a8]
call fcn.0040918c
pop ecx
test eax, eax
je 0x40e349
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40e34b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401460
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0x100
je 0x40147e
cmp dword [ebp + 0xc], 0x104
jne 0x4014b7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp eax, 0x2e
jne 0x4014b0
mov dword [esp], 0x11
call sym._GetAsyncKeyState_4
sub esp, 4
test ax, ax
jns 0x4014b0
mov dword [esp], 0x12
call sym._GetAsyncKeyState_4
sub esp, 4
test ax, ax
js 0x4014b7
mov eax, 1
jmp 0x4014db
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CallNextHookEx_16
sub esp, 0x10
leave
ret 0xc

Function at 0x4014df
Capabilities:
Log keystrokes via application hook

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call sym.___main
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], dbg.LowLevelKeyboardProc@12
mov dword [esp], 0xd
call sym._SetWindowsHookExA_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40156f
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Erro
mov dword [esp + 4], str.Falha_ao_instalar_o_hook
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov eax, 1
jmp 0x4015ac
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._TranslateMessage_4
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._DispatchMessageA_4
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._GetMessageA_16
sub esp, 0x10
test eax, eax
jne 0x401553
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._UnhookWindowsHookEx_4
sub esp, 4
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x401c00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401c4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401c44
test esi, esi
je 0x401c44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c20
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401f58
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401ebe
cmp eax, 4
jne 0x401ee0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401ece
cmp edx, 4
je 0x401ece
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e30
Function at 0x673ea5c8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6806c018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6806c018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x673ea6cb
jmp 0x673ea7ae
jmp 0x673ea891
jmp 0x673ea974
jmp 0x673eaa57
jmp 0x673eab3a
jmp 0x673eac1d
jmp 0x673ead00
jmp 0x673eade3
jmp 0x673eaec6
jmp 0x673eafa9
mov dword [ebp - 0x14], 0
jmp 0x673eb093
jmp 0x673eb176
jmp 0x673eb259
jmp 0x673eb33c
jmp 0x673eb41f
jmp 0x673eb502
jmp 0x673eb5e5
jmp 0x673eb6c8
jmp 0x673eb7ab
jmp 0x673eb88e
jmp 0x673eb971
mov dword [ebp - 0x18], 0
jmp 0x673eba5b
jmp 0x673ebb3e
jmp 0x673ebc21
jmp 0x673ebd04
jmp 0x673ebde7
jmp 0x673ebeca
jmp 0x673ebfad
jmp 0x673ec090
jmp 0x673ec173
jmp 0x673ec256
jmp 0x673ec339
mov dword [ebp - 0x10], 0
jmp 0x673ec423
jmp 0x673ec506
jmp 0x673ec5e9
jmp 0x673ec6cc
jmp 0x673ec7af
jmp 0x673ec892
jmp 0x673ec975
jmp 0x673eca58
jmp 0x673ecb3b
jmp 0x673ecc1e
jmp 0x673ecd01
mov dword [ebp - 0x10], 0
jmp 0x673efe1a
jmp 0x673ecdf0
jmp 0x673eced3
jmp 0x673ecfb6
jmp 0x673ed099
jmp 0x673ed17c
jmp 0x673ed25f
jmp 0x673ed342
jmp 0x673ed425
jmp 0x673ed508
jmp 0x673ed5eb
jmp 0x673ed6ce
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6806c014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x673ed7c2
jmp 0x673ed8a5
jmp 0x673ed988
jmp 0x673eda6b
jmp 0x673edb4e
jmp 0x673edc31
jmp 0x673edd14
jmp 0x673eddf7
jmp 0x673ededa
jmp 0x673edfbd
jmp 0x673ee0a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6806c01c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x673ee194
jmp 0x673ee277
jmp 0x673ee35a
jmp 0x673ee43d
jmp 0x673ee520
jmp 0x673ee603
jmp 0x673ee6e6
jmp 0x673ee7c9
jmp 0x673ee8ac
jmp 0x673ee98f
jmp 0x673eea72
mov eax, dword [0x6806c008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x673eeb73
jmp 0x673eec56
jmp 0x673eed39
jmp 0x673eee1c
jmp 0x673eeeff
jmp 0x673eefe2
jmp 0x673ef0c5
jmp 0x673ef1a8
jmp 0x673ef28b
jmp 0x673ef36e
jmp 0x673ef451
add dword [ebp - 0xc], 0x28
jmp 0x673ef538
jmp 0x673ef61b
jmp 0x673ef6fe
jmp 0x673ef7e1
jmp 0x673ef8c4
jmp 0x673ef9a7
jmp 0x673efa8a
jmp 0x673efb6d
jmp 0x673efc50
jmp 0x673efd33
jmp 0x673efe16
add dword [ebp - 0x10], 1
mov eax, dword [0x6806c018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x673ecd0d
nop
leave
ret