joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40b408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40b400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x404e95
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x404e8e
test esi, esi
je 0x404e8e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x404e70
mov dword [esp], 0x40b408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4050b0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4050e8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4050de
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4050ea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4050d0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401129
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401164
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401160
lea ebx, [ebx]
cmp esi, eax
jae 0x401164
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401150
cmp esi, eax
jb 0x40116a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x401c40
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x14], esi
cmp eax, 1
jne 0x401c60
mov ebx, dword [ebp + 4]
mov dword [esp + 0x18], esi
jmp 0x401c74
cmp eax, 2
jne 0x401e55
mov ebx, dword [ebp + 8]
mov dword [esp + 0x18], 1
cmp ebx, esi
jne 0x401c83
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 4
push 2
push 0xc
lea eax, [esp + 0x24]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x401cae
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov dword [ebp + 0x18], eax
pop ebp
mov eax, 0x1d
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [esp + 0x1c]
xor ecx, ecx
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
cmp eax, esi
jbe 0x401e14
lea edx, [esp + 0x18]
push edx
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x401e20
mov eax, dword [esp + 0x18]
test byte [eax + 1], 0x10
jne 0x401e01
mov ecx, dword [ebp + 0x28]
mov edi, dword [ecx + 0xc]
test edi, edi
je 0x401e01
mov eax, edi
test edi, edi
je 0x401e38
cmp dword [esp + 0x1c], 0
mov edi, dword [edi]
mov esi, dword [eax + 8]
je 0x401d12
cmp dword [esi + 0x18], 0
jmp 0x401d16
cmp dword [esi + 0x14], 0
je 0x401d2e
mov edx, dword [esi + 0xc]
mov eax, dword [esp + 0x18]
push edx
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x401d37
test edi, edi
jne 0x401cf6
jmp 0x401e01
mov eax, dword [esi + 0x10]
test eax, 0x200
je 0x401d67
mov ecx, dword [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
je 0x401e3d
mov eax, 1
sub dword [esp + 0x14], eax
sub dword [esp + 0x10], eax
jmp 0x401e01
test eax, 0x100
je 0x401da0
mov edx, dword [esi + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push ebx
mov ecx, ebp
call fcn.00401420
mov esi, eax
test esi, esi
jne 0x401dc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebp + 0x18], eax
pop ebp
mov eax, 0x1f
pop ebx
add esp, 0x1c
ret 4
test eax, 0x400
je 0x401e01
mov edx, dword [esi + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push ebx
mov ecx, ebp
call fcn.00401660
mov esi, eax
test esi, esi
je 0x401d88
inc dword [esp + 0x14]
mov edi, dword [esp + 0x30]
cmp edi, 1
jne 0x401dd7
mov ecx, ebp
call fcn.00401970
jmp 0x401de3
cmp edi, 2
jne 0x401de3
mov ecx, ebp
call fcn.004019a0
mov ebx, esi
cmp edi, 1
jne 0x401df2
mov dword [ebp + 4], esi
mov dword [ebp + 0x30], edi
jmp 0x401e01
cmp edi, 2
jne 0x401e01
mov dword [ebp + 8], esi
mov dword [ebp + 0x34], 1
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x14]
jb 0x401cc5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebp + 0x18], eax
pop ebp
mov eax, 0x1d
pop ebx
add esp, 0x1c
ret 4
call fcn.004142cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebp + 0x18], eax
pop ebp
mov eax, 0x1e
pop ebx
add esp, 0x1c
ret 4
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x1c
ret 4
Function at 0x4041e0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x434f40
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x449fb0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x2c]
lea ecx, [edi + 0xe4]
push eax
mov dword [esp + 0x28], 0
call fcn.00403950
mov eax, dword [edi + 0xe8]
lea esi, [edi + 0xe8]
test eax, eax
je 0x40423f
push eax
call fcn.0042201d
add esp, 4
mov dword [esi], 0
mov ecx, dword [esp + 0x2c]
push 0x438648
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0
call fcn.00421f53
mov eax, dword [esp + 0x1c]
xor ecx, ecx
add esp, 0xc
test eax, eax
setne cl
mov ebp, ecx
test eax, eax
je 0x404278
push eax
call fcn.0042201d
add esp, 4
mov edx, dword [esp + 0x2c]
push 0x438640
push edx
push esi
call fcn.00421f53
mov esi, dword [esi]
add esp, 0xc
test esi, esi
je 0x4042f2
test eax, eax
jne 0x4042f2
test ebp, ebp
jne 0x4042b3
push esi
push 1
lea eax, [esp + 0x1c]
push 2
push eax
mov dword [esp + 0x24], 0xfeff
call fcn.00421e0b
add esp, 0x10
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4042db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 4
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x18]
push str.ERROR:_Opening_log_file:__
push edx
call fcn.00403860
add esp, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.__failed_
push eax
push ecx
mov byte [esp + 0x34], 1
call fcn.00403780
add esp, 0xc
mov ecx, edi
call fcn.00403a30
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40434f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404377
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x22
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 4
Function at 0x406f60
Capabilities:
Get domain controller name

Disassembly:
push 0xffffffffffffffff
push 0x434fc8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x449fb0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push edi
lea ebx, [esi + 4]
push 0x438708
mov ecx, ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], edi
call fcn.00402c30
mov ecx, dword [esi + 0x14]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
cmp ecx, edi
je 0x406fbb
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x14], edi
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], edi
je 0x407058
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
push edi
push edi
push eax
push edi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x407054
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, ebx
call fcn.00404560
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x406ffd
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x14], edi
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40703d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x1c], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407078
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x2b
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10
Function at 0x4070a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4352ab
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x449fb0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], vtable.CSD.0
lea ebx, [esi + 0x1c]
call fcn.00414de3
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4070ef
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, dword [esp + 0x24]
push edi
mov dword [esi + 0x28], ecx
push 0x438708
mov ecx, ebx
mov dword [esp + 0x24], edi
call fcn.00402c30
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x14], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40d890
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xd8]
push edi
lea edi, [esi + 0xd8]
test eax, eax
je 0x40d8b5
push eax
call fcn.0042201d
add esp, 4
mov dword [edi], 0
mov eax, dword [esi + 0xd4]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x40d8f5
push 0x439ea4
push eax
push edi
call fcn.00421f53
mov ecx, dword [edi]
add esp, 0xc
test ecx, ecx
je 0x40d926
test eax, eax
jne 0x40d926
push ecx
push 1
lea eax, [esp + 0x14]
push 2
push eax
mov dword [esp + 0x1c], 0xfeff
call fcn.00421e0b
add esp, 0x10
mov eax, dword [esi + 0x50]
cmp eax, 1
jne 0x40d930
mov eax, dword [esi + 0x4c]
push fcn.0040c5b0
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov ebx, esp
push eax
call fcn.004021b0
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [ebx], eax
call fcn.00408dc0
jmp 0x40d97d
mov eax, 0x22
pop edi
pop esi
pop ebx
pop ecx
ret
cmp eax, 4
mov eax, dword [esi + 0x4c]
jne 0x40d95e
push fcn.0040c5b0
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov ebx, esp
push eax
call fcn.004021b0
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [ebx], eax
call fcn.004053f0
jmp 0x40d97d
push ecx
sub eax, 0x10
mov dword [esp + 0x10], esp
mov ebx, esp
push eax
call fcn.004021b0
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [ebx], eax
call fcn.0040c5b0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x40d994
push eax
call fcn.0042201d
add esp, 4
mov dword [edi], 0
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
Function at 0x414040
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x43687b
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
push esi
mov eax, dword [0x449fb0]
xor eax, esp
push eax
lea eax, [esp + 0x104]
mov dword fs:[0], eax
push 0x40eb20
lea ecx, [esp + 0xc]
call fcn.00407220
push 0
mov dword [esp + 0x110], 0
mov dword [0x44b328], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.00415bae
test eax, eax
jne 0x4140e7
push str.ERROR:_MFC_initialization_failed__n
call fcn.00422484
add esp, 4
lea ecx, [esp + 8]
mov dword [esp + 0x10c], 0xffffffff
call fcn.00407470
mov eax, 2
mov ecx, dword [esp + 0x104]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x108
ret
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
lea eax, [esp + 8]
push eax
push 0x40eb20
push ecx
push edx
call fcn.0040eb60
mov esi, eax
add esp, 0x10
lea ecx, [esp + 8]
test esi, esi
jne 0x41411e
call fcn.0040da30
mov esi, eax
lea ecx, [esp + 8]
mov dword [esp + 0x10c], 0xffffffff
call fcn.00407470
mov eax, esi
mov ecx, dword [esp + 0x104]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x108
ret

Function at 0x421a20
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x449fb0]
jne 0x421a2a
repz ret
jmp fcn.0042954c
Function at 0x4314b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042654f
and dword [ebp - 4], 0
cmp dword [0x44de4c], 0
mov ebx, eax
jne 0x431566
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x431617
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x431617
push eax
call fcn.004264dd
mov dword [esp], 0x4422dc
push edi
mov dword [0x44de4c], eax
call esi
push eax
call fcn.004264dd
mov dword [esp], 0x4422c8
push edi
mov dword [0x44de50], eax
call esi
push eax
call fcn.004264dd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44de54], eax
call esi
push eax
call fcn.004264dd
pop ecx
mov dword [0x44de5c], eax
test eax, eax
je 0x431566
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004264dd
pop ecx
mov dword [0x44de58], eax
mov eax, dword [0x44de58]
cmp eax, ebx
je 0x4315be
cmp dword [0x44de5c], ebx
je 0x4315be
push eax
call fcn.00426558
push dword [0x44de5c]
mov esi, eax
call fcn.00426558
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4315be
test edi, edi
je 0x4315be
call esi
test eax, eax
je 0x4315b5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4315b5
test byte [ebp - 0xc], 1
jne 0x4315be
or dword [ebp + 0x10], 0x200000
jmp 0x4315f7
mov eax, dword [0x44de50]
cmp eax, ebx
je 0x4315f7
push eax
call fcn.00426558
pop ecx
test eax, eax
je 0x4315f7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4315f7
mov eax, dword [0x44de54]
cmp eax, ebx
je 0x4315f7
push eax
call fcn.00426558
pop ecx
test eax, eax
je 0x4315f7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44de4c]
call fcn.00426558
pop ecx
test eax, eax
je 0x431617
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x431619
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4046b0
Capabilities:
Create process on windows

Disassembly:
push esi
push ebx
mov esi, ecx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov ecx, ebx
call fcn.00416420
cmp eax, 1
je 0x404710
cmp eax, 2
je 0x404700
test eax, eax
je 0x4046f0
mov dword [esp + 4], eax
mov dword [esp], str.Unrecognized_message__id:_d
call fcn.004168d0
add esp, 0x14
pop ebx
pop esi
ret 4
mov dword [esp + 0x20], ebx
add esp, 0x14
mov ecx, esi
pop ebx
pop esi
jmp fcn.00403e40
mov dword [esp + 0x20], ebx
add esp, 0x14
mov ecx, esi
pop ebx
pop esi
jmp fcn.00402b20
mov dword [esp + 0x20], ebx
add esp, 0x14
mov ecx, esi
pop ebx
pop esi
jmp fcn.00402310

Function at 0x407520
Capabilities:
Manipulate console buffer

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
cmp eax, edx
jne 0x407540
add esp, 0x24
pop ebx
pop esi
ret 4
sub eax, edx
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 0
sar eax, 2
mov dword [esp + 4], edx
imul eax, eax, 0xcccccccd
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
sub esp, 0x10
test eax, eax
jne 0x407582
mov dword [esp], str.WriteConsoleInputW_failed
call fcn.004168d0
mov eax, dword [ebx]
mov dword [ebx + 4], eax
add esp, 0x24
pop ebx
pop esi
ret 4

Function at 0x408950
Capabilities:
Log keystrokes

Disassembly:
push edi
push esi
xor edx, edx
push ebx
mov ecx, 1
sub esp, 0x30
mov eax, dword [esp + 0x48]
mov word [esp + 0x2e], dx
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x1e], 0
mov dword [esp + 0x26], 0
mov word [esp + 0x26], ax
movzx eax, ax
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x20], edx
mov edx, 1
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x2a], 0
mov word [esp + 0x1c], cx
mov word [esp + 0x24], dx
mov dword [esp + 4], 0
mov dword [esp], eax
movzx ebx, bx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov word [esp + 0x28], ax
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
mov word [esp + 0x2a], di
mov dword [esp + 0x2c], ebx
je 0x408a10
test eax, eax
je 0x4089fc
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0x10], edx
add eax, 0x14
mov dword [esi + 4], eax
add esp, 0x30
pop ebx
pop esi
pop edi
ret
lea edx, [esp + 0x1c]
mov ecx, esi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0043d4b0
sub esp, 8
add esp, 0x30
pop ebx
pop esi
pop edi
ret
Function at 0x408a30
Capabilities:
Log keystrokes
Read pipe
Write pipe

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x5c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x60]
cmp eax, 0xffff
ja 0x408a80
lea ebx, [eax - 0xd800]
cmp ebx, 0x7ff
ja 0x408af0
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], str.INTERNAL_ERROR:_appendInputRecordCP:_invalid_codePoint:_U_04X
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004168d0
cmp eax, 0x10ffff
ja 0x408a64
lea ebx, [eax - 0x10000]
movzx ebp, cx
movzx edx, dx
mov dword [esp + 0x10], ebp
mov dword [esp + 8], edx
mov eax, ebx
mov dword [esp + 4], edi
mov dword [esp], esi
shr eax, 0xa
mov dword [esp + 0x2c], edx
or ax, 0xd800
movzx eax, ax
mov dword [esp + 0xc], eax
call fcn.00408950
mov eax, ebx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x60], ebp
and eax, 0x3ff
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], esi
or ah, 0xdc
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00408950
movzx ecx, cx
movzx edx, dx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x58], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00408950
Function at 0x40fcb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x4c
cmp byte [ecx + 8], 0
jne 0x40fdd0
lea eax, [ebx + 0x28]
mov dword [esp + 0x38], 0
mov byte [esp + 0x37], 0
lea ebp, [esp + 0x37]
lea esi, [ebx + 0x14]
mov dword [esp + 0x2c], eax
jmp 0x40fd1f
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x40fda9
mov eax, dword [ebx + 0x10]
mov edi, 2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
sub esp, 4
mov eax, dword [ebx]
mov ecx, ebx
mov edx, dword [esp + 0x3c]
mov dword [esp], edx
call dword [eax + 8]
mov dword [ebx + 0xc], 0
sub esp, 4
mov eax, dword [ebx]
lea ecx, [esp + 0x38]
mov dword [esp + 4], ebp
mov dword [esp], ecx
mov ecx, ebx
call dword [eax + 0xc]
sub esp, 8
test al, al
je 0x40fdbf
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
cmp byte [esp + 0x37], 0
mov dword [esp + 0x3c], 0
mov dword [ebx + 0xc], eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov edx, dword [ebx + 0x10]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov dword [ebx + 0x24], edx
mov edx, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [edx + 0x68]
mov dword [esp], eax
jne 0x40fce2
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jne 0x40fcf3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40fe60
mov edi, 1
add esp, 0x4c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 8], eax
lea eax, [ecx + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x68]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
sub esp, 0x10
test eax, eax
jne 0x40fe22
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
setne al
add esp, 0x4c
movzx eax, al
mov edi, eax
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x10]
mov edi, 2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
sub esp, 4
mov eax, dword [ebx]
mov byte [ebx + 8], 0
mov edx, dword [esp + 0x3c]
mov ecx, ebx
mov dword [esp], edx
call dword [eax + 8]
mov dword [ebx + 0xc], 0
sub esp, 4
jmp 0x40fcc5
mov byte [ebx + 8], 1
add esp, 0x4c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4142c0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
sub esp, 4
test eax, eax
jne 0x4142e5
mov dword [esp], str.SetConsoleTitleW_failed
call fcn.004168d0
add esp, 0x1c
ret 4

Function at 0x4149e0
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ecx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
test eax, eax
jne 0x414a0b
mov dword [esp], str.SetConsoleCursorPosition_failed
call fcn.004168d0
add esp, 0x1c
ret 4

Function at 0x4157f0
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
sub esp, 0x38
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 0x28], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0x2c], edx
movzx edx, word [ebx + 4]
add eax, 1
sub ax, word [ebx + 2]
add edx, 1
sub dx, word [ebx]
mov dword [esp + 0xc], 0
mov word [esp + 0x22], ax
lea eax, [esp + 0x28]
mov word [esp + 0x20], dx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [ecx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
sub esp, 0x14
test eax, eax
jne 0x415862
mov dword [esp], str.WriteConsoleOutput_failed
call fcn.004168d0
add esp, 0x38
pop ebx
ret 8