joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ec50
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x270
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push 0x20a
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
push edi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x44eca2
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
add eax, 0xffffff07
cmp eax, 0xfffffefc
jae 0x44ecbb
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
mov eax, ebx
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret
push str.control.exe
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ebx, ebx
test eax, eax
je 0x44eca4
lea esi, [ebp - 0x220]
mov dword [esi], ebx
mov ecx, esi
call fcn.0044eaa0
mov eax, dword [esi]
mov dword [ebp - 0x278], eax
mov ecx, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push ecx
call fcn.0044eb90
add esp, 8
lea ecx, [eax + 1]
mov dword [ebp - 0x27c], ecx
lea ecx, [eax + eax]
add ecx, 2
xor esi, esi
dec esi
cmp eax, 0xffffffff
cmovge esi, ecx
push esi
call fcn.00448d63
add esp, 4
push esi
push ebx
mov esi, eax
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp - 0x278]
mov eax, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push 0xffffffffffffffff
push dword [ebp - 0x27c]
push esi
call fcn.0044ebf0
add esp, 0x14
xorps xmm0, xmm0
lea eax, [ebp - 0x264]
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
mov dword [eax + 0x2c], 1
mov word [eax + 0x30], 0xa
lea ecx, [ebp - 0x274]
movups xmmword [ecx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
setne bl
je 0x44edb5
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x274]
call edi
push dword [ebp - 0x270]
call edi
push esi
call fcn.004484c0
add esp, 4
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x44eca4
push eax
call fcn.004484c0
add esp, 4
jmp 0x44eca4
Function at 0x408218
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40826a
test eax, edx
je 0x40826d
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40822d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408253
add ecx, 4
js 0x408243
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x408250
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x408279
test edx, edx
jne 0x408220
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40b440
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b479
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404904
jmp 0x40b482
mov eax, ebx
mov edx, esi
call fcn.00404868
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b48c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b4ae
movzx eax, byte [esp]
jmp 0x40b4b0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bb40
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b9b8
mov eax, dword [0x4589e4]
cmp byte [eax], 0
je 0x40bbbc
mov eax, dword [0x458814]
call fcn.004031c8
call fcn.00402fac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408bc0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bc04
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bbf2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4587c0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45b7f4]
call fcn.0040596c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x451790
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4517a7
add esp, 0xfffffff0
call fcn.00403d0c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419fcc
mov eax, dword [0x458900]
cmp word [eax + 2], 0
jne 0x4517cf
mov eax, dword [0x458900]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00453480
mov eax, dword [0x4589a4]
cmp word [eax + 2], 0
jne 0x4517e9
mov eax, dword [0x4589a4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045368c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411d7c]
call fcn.004039d0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411d7c]
call fcn.004039d0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x411d7c]
call fcn.004039d0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41e33c]
call fcn.00424208
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4519a0
mov eax, dword [0x45882c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004245dc
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x453d50
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45882c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c998
test eax, eax
je 0x4518f0
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408c14
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c9cc
test eax, eax
je 0x451904
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
mov byte [ebx + 0xd4], 0
push ebx
push 0x452f0c
call fcn.0041b148
mov dword [ebx + 0xc8], eax
mov eax, dword [0x458738]
cmp byte [eax], 0
jne 0x451955
mov eax, ebx
call fcn.00451ae4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00453f64
mov eax, ebx
call fcn.00454ac8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x451995
call fcn.00403d64
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4017f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [0x401987]
push eax
call fcn.00407f50
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x80], 0
lea eax, [ebp - 0x7c]
push eax
push edi
mov edi, eax
xor eax, eax
mov ecx, 0x18
rep stosd dword es:[edi], eax
pop edi
pop eax
mov dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x14]
push eax
push 0x13f
push 0
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.00407c80
mov dword [ebp - 0x94], eax
push dword [ebp - 0x94]
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [ebp - 0x10], eax
push dword [ebp - 0x94]
call fcn.00407ce0
cmp dword [ebp - 0x10], 0
je 0x4018cf
push 0
lea eax, [ebp - 0x90]
push eax
call fcn.004087d0
jmp 0x40199d
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov ebx, eax
push ebx
push 0
push 1
push 0
push 0xffffffffffffffff
push 1
lea ebx, [ebp - 0x90]
push ebx
call fcn.00408a40
add esp, 0x1c
lea ebx, [ebp - 0x18]
push ebx
mov ebx, dword [ebp - 0x90]
lea eax, [ebx]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp + 0x10]
push dword [eax]
call fcn.00407c80
mov dword [ebp - 0x98], eax
push dword [ebp - 0x98]
push dword [ebp - 0x14]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [ebp - 0x10], eax
push dword [ebp - 0x98]
call fcn.00407ce0
cmp dword [ebp - 0x10], 0
je 0x401938
jmp 0x401987
cmp dword [ebp - 0x1c], 4
sete al
shr eax, 1
sbb eax, eax
cmp dword [ebp - 0x1c], 4
sete bl
shr ebx, 1
sbb ebx, ebx
or eax, ebx
je 0x401971
push 0
push 0xffffffffffffffff
mov ebx, dword [ebp - 0x90]
push dword [ebx]
call fcn.00408b00
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
call fcn.004082d0
jmp 0x401987
push 0
mov eax, dword [ebp - 0x90]
lea ebx, [eax]
push ebx
push 0xffffffffffffffff
lea ebx, [ebp - 0xc]
push ebx
call fcn.00408730
push dword [ebp - 0x14]
call sub.ADVAPI32.dll_RegCloseKey
push 0
lea ebx, [ebp - 0x90]
push ebx
call fcn.004087d0
lea ebx, [ebp - 0xc]
push ebx
call fcn.00408be0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4045f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00407c80
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call fcn.00407ce0
cmp dword [ebp - 8], 0xffffffff
je 0x404631
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x404640
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x408]
push eax
push edi
mov edi, eax
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
pop edi
pop eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0x200
lea eax, [ebp - 0x408]
push eax
call fcn.004084e0
lea eax, [ebp - 0x408]
push eax
call sub.KERNEL32.dll_DeleteFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4046da
lea eax, [ebp - 0x408]
push eax
call sub.KERNEL32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4046d8
push pe_nt_image_headers32
lea eax, [ebp - 0x408]
push eax
call sub.KERNEL32.dll_SetFileAttributesW
lea eax, [ebp - 0x408]
push eax
call sub.KERNEL32.dll_DeleteFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4046d8
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x4046e0
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4048f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0x40000000
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00407c80
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_CreateFileW
mov dword [ebp - 8], eax
push dword [ebp - 0x10]
call fcn.00407ce0
cmp dword [ebp - 8], 0
jle 0x40496f
push 0
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.00408d40
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp - 8]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x4054e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
lea eax, [0x4055a4]
push eax
call fcn.00407f50
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
push 0
push 0xffffffffffffffff
push 1
push 0x412018
call fcn.0040a480
push eax
push dword [ebp + 8]
push 1
call fcn.00408f80
dec eax
push eax
push dword [ebp + 8]
call fcn.004091f0
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.004082d0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call fcn.00407c80
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.00407c80
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00407c80
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push str.open
push 0
call sub.SHELL32.dll_ShellExecuteW
mov dword [ebp - 0x14], eax
push dword [ebp - 0x20]
call fcn.00407ce0
push dword [ebp - 0x1c]
call fcn.00407ce0
push dword [ebp - 0x18]
call fcn.00407ce0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
call fcn.004093e0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x405b30
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
call sub.WININET.DLL_InternetGetConnectedState
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40ba10
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
test dword [esp + 0x4c], 0x100
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
je 0x40ba65
test bl, bl
jne 0x40ba65
mov esi, edi
mov edx, 0x413740
mov ecx, 0x1c
xor eax, eax
jmp 0x40ba44
movzx ecx, word [edx]
cmp si, cx
je 0x40bb30
add eax, 1
add edx, 0xa
cmp eax, 0xc
jne 0x40ba41
mov eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp di, 0x58
jbe 0x40ba81
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x40ba58
test bl, bl
movzx eax, bl
jne 0x40ba5d
mov eax, 0xffffffff
jmp 0x40ba5d
movzx edi, di
movzx eax, ax
mov dword [esp + 4], 2
lea edx, [edi*8 + 0x413460]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
movzx ebp, ax
mov dword [esp], ebp
mov esi, ebp
call dword [sym.imp.msvcrt.dll_isupper]
test eax, eax
mov dword [esp], ebp
jne 0x40bb10
call dword [sym.imp.msvcrt.dll_islower]
test eax, eax
mov ecx, ebp
je 0x40bad2
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll_toupper]
mov ecx, eax
test byte [esp + 0x4c], 3
je 0x40bb1f
mov eax, dword [esp + 0x1c]
movzx esi, word [eax + 6]
cmp esi, 0xff
jle 0x40ba6b
movzx eax, bl
cmp eax, ebp
je 0x40baf8
cmp ecx, eax
jne 0x40ba6b
and esi, 0xff00
lea eax, [esi + 0xff]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll_tolower]
test byte [esp + 0x4c], 3
mov ecx, eax
jne 0x40bad9
test byte [esp + 0x4c], 0xc
je 0x40bb80
mov eax, dword [esp + 0x1c]
movzx esi, word [eax + 4]
jmp 0x40bae1
test byte [esp + 0x4c], 3
lea eax, [eax + eax*4]
lea eax, [eax + eax + 0x413740]
jne 0x40bba0
test byte [esp + 0x4c], 0xc
je 0x40bbc0
movzx esi, word [eax + 6]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x40ba58
cmp esi, 0xff
mov eax, esi
jle 0x40ba5d
and esi, 0xff00
lea eax, [esi + 0xff]
jmp 0x40bb04
test byte [esp + 0x4c], 0x10
jne 0x40bbb0
test bl, bl
jne 0x40bae1
movzx esi, word [edi*8 + 0x413460]
jmp 0x40bae1
movzx esi, word [eax + 8]
xor eax, eax
test esi, esi
setne al
jmp 0x40bb53
mov eax, dword [esp + 0x1c]
movzx esi, word [eax + 2]
jmp 0x40bae1
test byte [esp + 0x4c], 0x10
je 0x40bbd7
movzx esi, word [eax + 4]
xor eax, eax
test esi, esi
setne al
jmp 0x40bb53
movzx esi, word [eax + 2]
jmp 0x40bb5b
Function at 0x40bbe0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov eax, dword [eax]
test eax, eax
jne 0x40bc40
mov eax, dword [ebx + 0xc]
test al, 0x1c
jne 0x40bc90
test al, 3
je 0x40bc90
mov eax, 0xffffffff
movzx edx, word [ebx + 6]
lea ecx, [edx - 0x60]
cmp cx, 9
ja 0x40bd31
mov ecx, dword [ebx]
test ecx, ecx
je 0x40bc2e
mov ecx, dword [0x4182c8]
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*2 - 0x60]
mov dword [0x4182c8], edx
cmp eax, 0xffffffff
je 0x40bc3a
mov edx, ebx
call fcn.0040b8e0
add esp, 0x38
pop ebx
ret
mov dword [esp + 0x10], 0
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 6]
mov dword [esp + 8], eax
movzx eax, word [ebx + 8]
mov dword [esp + 4], eax
movsx eax, byte [ebx + 0xa]
mov dword [esp], eax
call fcn.0040ba10
mov edx, dword [ebx + 0xc]
test dl, 0x1c
je 0x40bd23
cmp eax, 0xffffffff
je 0x40bc90
mov dword [0x4182c8], 0
jmp 0x40bc33
mov ebx, dword [0x4182c8]
test ebx, ebx
je 0x40bc3a
movsx eax, bl
mov dword [esp], eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
sub esp, 4
mov edx, eax
movzx ecx, al
mov dword [esp + 0x28], 0
mov byte [esp + 0x2a], bl
mov ebx, eax
shr ebx, 4
shr edx, 6
shr eax, 9
and ebx, 0x10
and edx, 8
and eax, 2
or edx, ebx
mov dword [esp + 0x24], 0
mov dword [esp], ecx
or eax, edx
mov word [esp + 0x26], cx
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
mov word [esp + 0x28], ax
movzx eax, byte [0x4182c8]
lea edx, [esp + 0x20]
call fcn.0040b8e0
mov dword [0x4182c8], 0
add esp, 0x38
pop ebx
ret
and dl, 3
je 0x40bc77
jmp 0x40bc04
cmp eax, 0xffffffff
jne 0x40bc7c
jmp 0x40bc3a

Function at 0x40cdb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0040ce10
Function at 0x40ce10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x41b344]
test esi, esi
jle 0x40cefd
mov edi, dword [0x41b348]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40ce44
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40cef6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x40ce30
mov dword [esp], eax
mov ebx, eax
call fcn.0040d6f0
test eax, eax
mov edi, eax
je 0x40cf3a
lea ebx, [esi + esi*2]
mov esi, dword [0x41b348]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.0040d7f0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x41b348]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40cf1a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40ceef
sub eax, 0x40
and eax, 0xffffffbf
je 0x40ceef
mov eax, dword [esp + 0x20]
add ebx, dword [0x41b348]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40cf04
add dword [0x41b344], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40ce4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040cdb0
mov eax, dword [0x41b348]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040cdb0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040cdb0
lea esi, [esi]

Function at 0x40d360
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x41b708
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41b700]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40d3b5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40d3ae
test esi, esi
je 0x40d3ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40d390
mov dword [esp], 0x41b708
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d610
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40d648
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40d63e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40d64a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40d630
xor eax, eax
pop ebx
pop esi
ret