joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bf88
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40c076
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004051d0
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xe]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x10]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x12]
mov word [ebp - 0xe], ax
cmp esi, 2
jg 0x40bfe6
lea eax, [ebp - 4]
mov edx, 0x40c08c
call fcn.00405268
jmp 0x40bff3
lea eax, [ebp - 4]
mov edx, 0x40c098
call fcn.00405268
push 0x100
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.00405660
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.KERNEL32.DLL_SetEndOfFile
push eax
call sub.KERNEL32.DLL_SetErrorMode
test eax, eax
je 0x40c060
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x100
call fcn.00405440
dec esi
jne 0x40c060
mov eax, dword [ebx]
cmp byte [eax], 0x30
jne 0x40c060
mov eax, dword [ebx]
mov dword [ebp - 0x118], eax
mov esi, dword [ebp - 0x118]
test esi, esi
je 0x40c050
sub esi, 4
mov esi, dword [esi]
push ebx
mov ecx, esi
dec ecx
mov eax, dword [ebx]
mov edx, 2
call fcn.004056c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c07d
lea eax, [ebp - 4]
call fcn.004051d0
ret

Function at 0x40d328
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40d43b
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_SetEndOfFile
mov dword [ebp - 4], eax
mov ebx, 1
mov esi, 0x48e830
mov edi, 0x48e860
push ebp
push 0xb
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4898b0
mov edx, ebx
dec edx
lea eax, [ebx + 0x44]
dec eax
call fcn.0040d2ec
pop ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405224
push ebp
push 0xb
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4898e0
mov edx, ebx
dec edx
lea eax, [ebx + 0x38]
dec eax
call fcn.0040d2ec
pop ecx
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405224
inc ebx
add edi, 4
add esi, 4
cmp ebx, 0xd
jne 0x40d35b
mov ebx, 1
mov esi, 0x48e890
mov edi, 0x48e8ac
lea eax, [ebx + 5]
mov ecx, 7
cdq
idiv ecx
mov dword [ebp - 8], edx
push ebp
push 6
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x489910
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x31
call fcn.0040d2ec
pop ecx
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00405224
push ebp
push 6
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x48992c
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x2a
call fcn.0040d2ec
pop ecx
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00405224
inc ebx
add edi, 4
add esi, 4
cmp ebx, 8
jne 0x40d3bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d442
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004051f4
ret
Function at 0x40d500
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0
push esi
xor eax, eax
push ebp
push 0x40d597
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov ecx, 0x40d5ac
mov edx, 0x100b
call fcn.0040d274
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.00409b34
mov esi, eax
mov eax, esi
add eax, 0xfffffffd
sub eax, 3
jae 0x40d581
push 4
push esi
call sub.KERNEL32.DLL_SetEndOfFile
push eax
push 0x40d44c
call sub.KERNEL32.DLL_GetVersion
mov edx, 7
mov eax, 0x48e8f4
mov dword [eax], 0xffffffff
add eax, 4
dec edx
jne 0x40d562
push 3
push esi
call sub.KERNEL32.DLL_SetEndOfFile
push eax
push 0x40d488
call sub.KERNEL32.DLL_GetVersion
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d59e
lea eax, [ebp - 4]
call fcn.004051d0
ret
Function at 0x40d5b0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40d780
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
mov eax, edi
call fcn.004051d0
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov ecx, 0x40d798
mov edx, 0x1009
call fcn.0040d274
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.00409b34
add eax, 0xfffffffd
sub eax, 3
jb 0x40d756
mov eax, dword [0x48e8cc]
sub eax, 4
je 0x40d622
add eax, 0xfffffff3
sub eax, 2
jb 0x40d622
xor eax, eax
jmp 0x40d624
mov al, 1
test al, al
je 0x40d65f
jmp 0x40d64f
movzx eax, byte [esi + ebx - 1]
sub al, 0x47
je 0x40d64e
sub al, 0x20
je 0x40d64e
lea eax, [ebp - 0xc]
movzx edx, byte [esi + ebx - 1]
call fcn.004053b8
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.0040549c
inc ebx
mov eax, esi
call fcn.00405490
cmp ebx, eax
jle 0x40d62a
jmp 0x40d765
mov eax, edi
mov edx, esi
call fcn.00405224
jmp 0x40d765
movzx eax, byte [esi + ebx - 1]
movzx eax, al
bt dword [0x489834], eax
jae 0x40d6ac
mov edx, ebx
mov eax, esi
call fcn.0040e6b8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.004056c8
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.0040549c
add ebx, dword [ebp - 4]
jmp 0x40d756
mov edx, 0x40d79c
lea eax, [esi + ebx - 1]
mov ecx, 2
call fcn.0040a2f8
test eax, eax
jne 0x40d6d5
mov eax, edi
mov edx, 0x40d7a8
call fcn.0040549c
inc ebx
jmp 0x40d755
mov edx, 0x40d7ac
lea eax, [esi + ebx - 1]
mov ecx, 4
call fcn.0040a2f8
test eax, eax
jne 0x40d6fd
mov eax, edi
mov edx, 0x40d7bc
call fcn.0040549c
add ebx, 3
jmp 0x40d755
mov edx, 0x40d7c4
lea eax, [esi + ebx - 1]
mov ecx, 2
call fcn.0040a2f8
test eax, eax
jne 0x40d723
mov eax, edi
mov edx, 0x40d7d0
call fcn.0040549c
inc ebx
jmp 0x40d755
movzx eax, byte [esi + ebx - 1]
sub al, 0x59
je 0x40d730
sub al, 0x20
jne 0x40d73e
mov eax, edi
mov edx, 0x40d7dc
call fcn.0040549c
jmp 0x40d755
lea eax, [ebp - 0x14]
movzx edx, byte [esi + ebx - 1]
call fcn.004053b8
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.0040549c
inc ebx
mov eax, esi
call fcn.00405490
cmp ebx, eax
jle 0x40d66d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d787
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004051f4
ret
Function at 0x40d974
Capabilities:
Get keyboard layout
Log keystrokes via polling
Read file on windows
Set thread local storage value

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d7ec
mov eax, dword [0x48ba58]
cmp byte [eax], 0
je 0x40d9f0
mov eax, dword [0x48b740]
call fcn.004035c4
call fcn.00403048
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.004079ec
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040a164
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_ReadFile
push eax
call sub.KERNEL32.DLL_TlsSetValue
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40da38
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_ReadFile
push eax
call sub.KERNEL32.DLL_TlsSetValue
jmp 0x40da26
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
mov eax, dword [0x48b6c8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x48e7f8]
call fcn.0040675c
push eax
call sub.user32.dll_GetKeyState
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_GetKeyboardLayoutNameA
add esp, 0x444
ret
Function at 0x40de94
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40e04f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 4]
cmp dword [ebx + 0x14], 0
jne 0x40dee5
lea edx, [ebp - 4]
mov eax, dword [0x48bc04]
call fcn.00407254
jmp 0x40def2
lea edx, [ebp - 4]
mov eax, dword [0x48b9c0]
call fcn.00407254
mov esi, dword [ebx + 0x18]
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_LocalAlloc
cmp dword [ebp - 0x10], 0x1000
jne 0x40dfc4
push 0x105
lea eax, [ebp - 0x125]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_GetFileSize
test eax, eax
je 0x40dfc4
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x148], eax
mov byte [ebp - 0x144], 5
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.00405440
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.0040a07c
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x140], eax
mov byte [ebp - 0x13c], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0xb
mov dword [ebp - 0x130], esi
mov byte [ebp - 0x12c], 5
lea eax, [ebp - 0x148]
push eax
push 3
lea edx, [ebp - 0x154]
mov eax, dword [0x48ba88]
call fcn.00407254
mov ecx, dword [ebp - 0x154]
mov dl, 1
mov eax, dword [0x408b28]
call fcn.0040da78
mov ebx, eax
jmp 0x40e01e
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x16c], eax
mov byte [ebp - 0x168], 5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x164], eax
mov byte [ebp - 0x160], 0xb
mov dword [ebp - 0x15c], esi
mov byte [ebp - 0x158], 5
lea eax, [ebp - 0x16c]
push eax
push 2
lea edx, [ebp - 0x170]
mov eax, dword [0x48b9e4]
call fcn.00407254
mov ecx, dword [ebp - 0x170]
mov dl, 1
mov eax, dword [0x408b28]
call fcn.0040da78
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e056
lea eax, [ebp - 0x170]
call fcn.004051d0
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.004051f4
lea eax, [ebp - 4]
call fcn.004051d0
ret
Function at 0x40e2e4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e3ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405268
lea eax, [ebp - 4]
call fcn.004056b8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405660
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40e3a4
mov eax, ebx
call fcn.00402eec
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40e39d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405660
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40e387
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40e3cc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e387
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e3a4
mov eax, dword [ebp - 0x10]
call fcn.00402f08
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e3c1
lea eax, [ebp - 4]
call fcn.004051d0
ret

Function at 0x40e964
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, 0x48e8c8
mov dword [esi], 0x409
mov dword [esi + 4], 9
mov dword [esi + 8], 1
call sub.KERNEL32.DLL_SetEndOfFile
test eax, eax
je 0x40e991
mov dword [esi], eax
test ax, ax
je 0x40e9ac
mov edx, eax
and dx, 0x3ff
movzx edx, dx
mov dword [esi + 4], edx
movzx eax, ax
shr eax, 0xa
mov dword [esi + 8], eax
push esi
mov esi, 0x40ea08
mov edi, 0x489834
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
cmp dword [0x4897f0], 4
jle 0x40e9d7
cmp dword [0x4897ec], 2
jne 0x40e9d7
mov byte [esi + 0xd], 1
jmp 0x40e9e6
push 0x4a
call sub.user32.dll_DrawIcon
test eax, eax
setne al
mov byte [esi + 0xd], al
push 0x2a
call sub.user32.dll_DrawIcon
test eax, eax
setne bl
mov byte [esi + 0xc], bl
test bl, bl
je 0x40ea00
push ebp
call fcn.0040e908
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f26c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call sub.KERNEL32.DLL_ResumeThread
mov word [ebp - 2], ax
movzx eax, byte [ebp - 2]
xor al, byte [ebp - 1]
and al, 0xf
pop ecx
pop ebp
ret
Function at 0x40f288
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov edi, eax
mov eax, edi
call fcn.0040f26c
mov ebx, eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
movzx eax, bl
mov ebp, dword [edi + eax*4 + 4]
jmp 0x40f2ae
mov ebp, dword [ebp]
test ebp, ebp
je 0x40f2b7
cmp esi, dword [ebp + 4]
jne 0x40f2ab
test ebp, ebp
jne 0x40f2f2
mov eax, edi
call fcn.0040f310
mov ebp, eax
test ebp, ebp
jne 0x40f2f2
mov eax, 0x10
call fcn.00402ed4
mov ebp, eax
mov dword [ebp + 4], esi
mov dword [ebp + 8], 0x7fffffff
mov dword [ebp], ebp
movzx eax, bl
lea eax, [edi + eax*4 + 4]
mov edx, ebp
call fcn.0040f204
mov dword [ebp], eax
mov eax, dword [esp]
mov dword [eax], ebp
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40f310
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0040f26c
movzx eax, al
mov ebx, dword [ebx + eax*4 + 4]
test ebx, ebx
je 0x40f34d
lea eax, [ebx + 8]
mov edx, 0x7fffffff
call fcn.0040f204
mov esi, eax
cmp esi, 0x7fffffff
je 0x40f347
call sub.KERNEL32.DLL_ResumeThread
mov dword [ebx + 4], eax
jmp 0x40f34d
mov ebx, dword [ebx]
test ebx, ebx
jne 0x40f326
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x40f354
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
test dl, dl
je 0x40f362
add esp, 0xfffffff0
call fcn.00404614
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004042d8
mov dword [esi + 0xc], 0xffff
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [esi + 0x10], eax
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0xffffffff
mov dl, 1
mov eax, dword [0x408fec]
call fcn.004042d8
mov dword [esi + 0x20], eax
mov eax, esi
test bl, bl
je 0x40f3c1
call fcn.0040466c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40f444
Capabilities:
Get thread local storage value

Disassembly:
mov edx, dword [eax + 0x18]
push edx
mov eax, dword [eax + 0x14]
push eax
call sub.KERNEL32.DLL_TlsGetValue
ret

Function at 0x40f454
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, eax
mov bl, 1
call sub.KERNEL32.DLL_ResumeThread
mov edi, eax
cmp edi, dword [ebp + 0x24]
je 0x40f4f3
mov eax, ebp
call fcn.0040f410
mov eax, dword [ebp + 0x28]
mov dword [esp + 4], eax
mov edx, esp
mov eax, dword [ebp + 0x20]
call fcn.0040f288
mov eax, dword [esp]
cmp dword [eax + 0xc], 0
seta bl
test bl, bl
je 0x40f4b9
lea eax, [ebp + 0xc]
call fcn.0040f1ec
jmp 0x40f4b9
lea eax, [ebp + 0xc]
mov edx, 0xffff
call fcn.0040f20c
mov esi, eax
test esi, esi
je 0x40f4b9
mov eax, ebp
call fcn.0040f444
lea eax, [ebp + 0xc]
mov edx, 0xffff0001
call fcn.0040f20c
cmp eax, 0xffff
jne 0x40f49f
mov eax, ebp
call fcn.0040f410
test bl, bl
je 0x40f4e0
lea eax, [ebp + 0xc]
call fcn.0040f1f8
mov dword [ebp + 0x24], edi
lea eax, [ebp + 0x28]
call fcn.0040f1ec
dec eax
cmp eax, dword [esp + 4]
sete bl
inc dword [ebp + 0x1c]
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40f550
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, eax
mov edx, esp
mov eax, dword [edi + 0x20]
call fcn.0040f288
mov eax, dword [esp]
inc dword [eax + 0xc]
mov eax, dword [esp]
cmp dword [eax + 0xc], 1
seta bl
call sub.KERNEL32.DLL_ResumeThread
cmp eax, dword [edi + 0x24]
je 0x40f5ba
test bl, bl
jne 0x40f5ba
mov eax, edi
call fcn.0040f434
jmp 0x40f5ae
lea eax, [edi + 0xc]
call fcn.0040f1ec
mov esi, eax
cmp esi, 0xffff
jne 0x40f5a0
mov eax, edi
call fcn.0040f428
push 0
call fcn.0040f090
mov eax, edi
call fcn.0040f434
lea eax, [edi + 0xc]
call fcn.0040f1f8
test eax, eax
jle 0x40f587
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40f5c0
Capabilities:
Resume thread

Disassembly:
push ebx
push ecx
mov ebx, eax
mov edx, esp
mov eax, dword [ebx + 0x20]
call fcn.0040f288
mov eax, dword [esp]
dec dword [eax + 0xc]
mov eax, dword [esp]
cmp dword [eax + 0xc], 0
jne 0x40f625
mov edx, esp
mov eax, dword [ebx + 0x20]
call fcn.0040f300
call sub.KERNEL32.DLL_ResumeThread
cmp eax, dword [ebx + 0x24]
je 0x40f625
lea eax, [ebx + 0xc]
call fcn.0040f1ec
mov ecx, eax
cmp ecx, 0xffff
jne 0x40f60c
mov eax, ebx
call fcn.0040f428
jmp 0x40f625
test ecx, ecx
jg 0x40f625
mov eax, ecx
mov ecx, 0xffff
cdq
idiv ecx
test edx, edx
jne 0x40f625
mov eax, ebx
call fcn.0040f428
pop edx
pop ebx
ret

Function at 0x40f6f4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push edx
call sub.KERNEL32.DLL_InterlockedIncrement
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40f766
push dword fs:[eax]
mov dword fs:[eax], esp
fnstcw word [ebp - 2]
xor eax, eax
push ebp
push 0x40f748
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405660
push eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f74f
fnclex
fldcw word [ebp - 2]
ret

Function at 0x41ffd4
Capabilities:
Get file attributes

Disassembly:
push 0x4909d0
call sub.KERNEL32.DLL_FindFirstFileA
push 0x420004
push 0
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [0x4909b8], eax
cmp dword [0x4909b8], 0
jne 0x420001
call fcn.0040f098
ret
Function at 0x42006c
Capabilities:
Extract resource via kernel32 functions
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
call sub.KERNEL32.DLL_ResumeThread
mov edx, dword [0x48bbf8]
cmp eax, dword [edx]
je 0x4200af
call sub.KERNEL32.DLL_ResumeThread
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x48b9b4]
mov dl, 1
mov eax, dword [0x417d44]
call fcn.0040db34
call fcn.00404b64
test ebx, ebx
jle 0x4200bc
mov eax, ebx
call fcn.0042002c
jmp 0x4200c1
call fcn.00420020
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x4909d0
call sub.KERNEL32.DLL_GetTimeZoneInformation
xor eax, eax
push ebp
push 0x420231
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x489b0c
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x420212
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x42010c
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x420110
xor eax, eax
jmp 0x420112
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4201fc
jmp 0x4201ef
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00419638
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0041952c
push 0x4909d0
call sub.KERNEL32.DLL_FreeLibrary
xor eax, eax
push ebp
push 0x4201b5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x420176
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42019d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4201bc
push 0x4909d0
call sub.KERNEL32.DLL_GetTimeZoneInformation
ret
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x420124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420219
mov eax, dword [ebp - 0xc]
call fcn.00404308
ret
Function at 0x4205b8
Capabilities:
Get file attributes
Get thread local storage value
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
call sub.KERNEL32.DLL_ResumeThread
mov edx, dword [0x48bbf8]
cmp eax, dword [edx]
jne 0x4205e2
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x42074f
cmp byte [ebp - 5], 0
je 0x4205f7
mov eax, 0xc
call fcn.00402eec
mov dword [ebp - 0xc], eax
jmp 0x4205fd
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], eax
movzx ebx, byte [ebp - 5]
xor bl, 1
test bl, bl
je 0x42061d
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_GetFileAttributesA
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
jmp 0x420625
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 8], edx
xor eax, eax
push ebp
push 0x42072e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4909d0
call sub.KERNEL32.DLL_GetTimeZoneInformation
xor eax, eax
push ebp
push 0x420707
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
movzx edx, byte [ebp - 5]
mov byte [eax + 4], dl
cmp dword [0x489b0c], 0
jne 0x42066f
mov dl, 1
mov eax, dword [0x416f68]
call fcn.004042d8
mov dword [0x489b0c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [0x489b0c]
call fcn.004194e0
call fcn.00420048
cmp word [0x489afa], 0
je 0x4206a6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
mov eax, dword [0x489afc]
call dword [0x489af8]
test bl, bl
je 0x4206ef
push 0x4909d0
call sub.KERNEL32.DLL_FreeLibrary
xor eax, eax
push ebp
push 0x4206e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_TlsGetValue
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4206ef
push 0x4909d0
call sub.KERNEL32.DLL_GetTimeZoneInformation
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42070e
push 0x4909d0
call sub.KERNEL32.DLL_FreeLibrary
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4207ac
Capabilities:
Get thread local storage value
Log keystrokes via polling
Resume thread

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov esi, eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
call sub.KERNEL32.DLL_ResumeThread
mov edx, dword [0x48bbf8]
cmp eax, dword [edx]
jne 0x420821
xor ebx, ebx
mov eax, dword [0x4909b8]
mov dword [esp + 8], eax
cmp ebx, 2
jne 0x4207eb
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_GetMenuItemCount
push pe_nt_image_headers32
push 0x3e8
push 0
lea eax, [esp + 0x10]
push eax
push 2
call sub.user32.dll_GetKeyboardState
mov ebx, eax
cmp ebx, 0xffffffff
setne dl
mov eax, esi
call fcn.004204b8
cmp ebx, 1
jne 0x42081b
xor eax, eax
call fcn.0042006c
test ebx, ebx
jne 0x4207d4
jmp 0x42082d
push 0xffffffffffffffff
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_TlsGetValue
push esp
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_SetThreadLocale
cmp eax, 1
sbb edx, edx
inc edx
mov eax, esi
call fcn.004204b8
mov eax, dword [esp]
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x4219cc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov eax, dword [0x48e7f8]
mov dword [0x489b24], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x489b38]
push eax
mov eax, dword [0x48e7f8]
push eax
call fcn.00407b0c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x421a06
mov edx, fcn.00407a34
cmp edx, dword [ebp - 0x24]
je 0x421a25
test al, al
je 0x421a1b
mov eax, dword [0x48e7f8]
push eax
mov eax, dword [0x489b38]
push eax
call sub.user32.dll_MapVirtualKeyA
push 0x489b14
call sub.user32.dll_GetWindow
push 0x80000000
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x48e7f8]
push eax
push 0
mov ecx, 0x421a7c
mov edx, dword [0x489b38]
mov eax, 0x80
call fcn.00407efc
mov ebx, eax
cmp word [ebp + 0xa], 0
je 0x421a70
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00421910
push eax
push 0xfffffffffffffffc
push ebx
call sub.user32.dll_IsDialogMessageW
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8