joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001a10
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
lea edx, [ebp - 0x2b4]
mov dword [esp + 0x10], 0x4009
mov dword [esp + 0xc], 0x2b4
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.shell32.dll_SHGetFileInfoW]
sub esp, 0x14
test eax, eax
je 0x10001a56
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebp - 0x2b0]
leave
ret

Function at 0x10006200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10006258
cmp byte [esi + ebx - 1], 0xa
je 0x1000622c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100150a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10006800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x100150b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x100069c0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x100150b4]
movzx eax, al
bt eax, esi
jae 0x10006a20
mov ecx, dword [0x100150a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x100068c5
test byte [0x10007068], 8
jne 0x10006960
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10007078], 8
jne 0x10006910
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10006894
cmp esi, 3
jbe 0x100068d0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10010d00]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10006894
mov ecx, dword [0x100150b4]
test ecx, ecx
je 0x10006a00
mov dword [esp], 0x10007078
call dword [0x100150b4]
test al, 8
je 0x1000686b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x1000686b
mov ebx, dword [0x100150b4]
test ebx, ebx
je 0x100069e0
mov dword [esp], 0x10007068
call dword [0x100150b4]
test al, 8
je 0x10006856
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x1000685e
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x100150b4
call sym._load_func.part.0
jmp 0x1000681d
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x100150b4
call sym._load_func.part.0
jmp 0x1000696a
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x100150b4
call sym._load_func.part.0
jmp 0x1000691e
mov eax, 0xffffffff
jmp 0x100068c5
Function at 0x10006b90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100150c0]
test eax, eax
je 0x10006c48
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10006bd0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x10006bbc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x10006c7d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100150c0], eax
sub esp, 8
test eax, eax
jne 0x10006bad
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x10006bbe
Function at 0x10006c90
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [ebp - 0x10], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x10006e11
mov eax, dword [esi]
test eax, eax
je 0x10006e00
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x1c], edx
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [ebp - 0x14], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x10006e15
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x10006df8
call dword [edx + 0x28]
sub esp, 8
mov dword [esi + 8], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
not eax
shr eax, 0x1f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
sub esp, 8
jmp 0x10006db9
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x10006cf6
xor eax, eax
jmp 0x10006de8
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x10006de8
Function at 0x408f0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x2137ee4
pushfd
push esi
add ecx, esi
mov esi, 0x1e4d04ba
xor ecx, esi
rol ecx, 0x95
rol esi, 0x19
sub ecx, 0x3653
add esi, ecx
sub esi, ecx
add ecx, 0x3653
ror esi, 0x19
ror ecx, 0x95
xor ecx, esi
pop esi
sub ecx, esi
popfd
call fcn.00407f64
mov edi, eax
push 0x2137ee4
call fcn.00412044
lea esp, [esp + 4]
pushfd
push esi
add ebp, esi
mov esi, 0xb2479dd3
xor ebp, esi
rol ebp, 0x74
rol esi, 0x9c
sub ebp, 0xe5de
add esi, ebp
sub esi, ebp
add ebp, 0xe5de
ror esi, 0x9c
ror ebp, 0x74
xor ebp, esi
pop esi
sub ebp, esi
popfd
mov ecx, 0x266c1cfc
pushfd
push esi
add ecx, esi
mov esi, 0x69d7d2fa
xor ecx, esi
rol ecx, 0x71
rol esi, 0xc3
sub ecx, 0x78ff
add esi, ecx
sub esi, ecx
add ecx, 0x78ff
ror esi, 0xc3
ror ecx, 0x71
xor ecx, esi
pop esi
sub ecx, esi
popfd
pushfd
pushfd
push esi
add edx, esi
mov esi, 0xce793e74
xor edx, esi
rol edx, 7
rol esi, 0xf1
sub edx, 0x3e57
add esi, edx
sub esi, edx
add edx, 0x3e57
ror esi, 0xf1
ror edx, 7
xor edx, esi
pop esi
sub edx, esi
popfd
xor ecx, 0x9905daf0
sub ecx, 0xf014be9
xor ecx, 0x7e1a07fe
rol ecx, 0x60
pushfd
push esi
add edx, esi
mov esi, 0x4d674d34
xor edx, esi
rol edx, 0x6a
rol esi, 0xf1
sub edx, 0xadff
add esi, edx
sub esi, edx
add edx, 0xadff
ror esi, 0xf1
ror edx, 0x6a
xor edx, esi
pop esi
sub edx, esi
popfd
popfd
pushfd
xor ecx, 0xc264176b
sub ecx, 0xd21e0297
xor ecx, 0xf9f8681f
rol ecx, 3
popfd
dec ecx
pushfd
push esi
add ecx, esi
mov esi, 0xe5779f61
xor ecx, esi
rol ecx, 0x90
rol esi, 0xc2
sub ecx, 0xe0ad
add esi, ecx
sub esi, ecx
add ecx, 0xe0ad
ror esi, 0xc2
ror ecx, 0x90
xor ecx, esi
pop esi
sub ecx, esi
popfd
push dword [ebp + ecx*4 + 8]
pushfd
push esi
add ebp, esi
mov esi, 0x261cca58
xor ebp, esi
rol ebp, 0xfc
rol esi, 0x81
sub ebp, 0x4660
add esi, ebp
sub esi, ebp
add ebp, 0x4660
ror esi, 0x81
ror ebp, 0xfc
xor ebp, esi
pop esi
sub ebp, esi
popfd
jne 0x40903e
mov ecx, eax
mov eax, ecx
lea ebx, [0x4090e0]
pushfd
push esi
add esi, esi
mov esi, 0x30de024a
xor esi, esi
rol esi, 0x79
rol esi, 0x19
sub esi, 0x3c26
add esi, esi
sub esi, esi
add esi, 0x3c26
ror esi, 0x19
ror esi, 0x79
xor esi, esi
pop esi
sub esi, esi
popfd
push ebx
call fcn.00409111
lea esp, [esp + 4]
mov esp, ebp
pushfd
push esi
add ecx, esi
mov esi, 0x2c9c9bf2
xor ecx, esi
rol ecx, 0xa8
rol esi, 0x37
sub ecx, 0xf9ef
add esi, ecx
sub esi, ecx
add ecx, 0xf9ef
ror esi, 0x37
ror ecx, 0xa8
xor ecx, esi
pop esi
sub ecx, esi
popfd
pop ebp
ret
Function at 0x40e5d3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4170c8]
add ax, 0x4aa3
mov word [0x4170e0], ax
movzx eax, word [0x4170d8]
movzx eax, ax
sub eax, 0x1ce9c0d
mov dword [0x4170d0], eax
movzx eax, word [0x4170e0]
xor ax, 0xb79a
mov word [0x4170e0], ax
movzx eax, word [0x4170d8]
movzx eax, ax
or eax, 0x734b9027
mov dword [0x4170c8], eax
mov eax, dword [0x4170dc]
imul eax, eax, 0xe13e3a77
mov dword [0x4170dc], eax
movzx eax, word [0x4170e0]
movzx eax, ax
or eax, 0x2079be9d
mov dword [0x4170d0], eax
mov eax, dword [0x4170dc]
imul eax, eax, 0x11c5490b
mov dword [0x4170dc], eax
mov eax, dword [0x4170dc]
and eax, 0x67be6255
mov dword [0x4170d4], eax
mov eax, dword [0x4170c8]
xor eax, 0x9529c752
mov dword [0x4170d4], eax
mov eax, dword [0x4170c8]
imul eax, eax, 0x8296bbeb
mov dword [0x4170dc], eax
mov eax, dword [0x4170d4]
sub ax, 0x3c93
mov word [0x4170e0], ax
movzx eax, word [0x4170e0]
and ax, 0xe61d
mov word [0x4170cc], ax
mov eax, dword [0x4170dc]
imul ax, ax, 0x6b8
mov word [0x4170cc], ax
movzx eax, word [0x4170e0]
movzx eax, ax
and eax, 0x38ef71e7
mov dword [0x4170c8], eax
movzx eax, word [0x4170e0]
movzx eax, ax
xor eax, 0xb446316c
mov dword [0x4170dc], eax
mov eax, dword [0x4170d0]
and ax, 0x13d4
mov word [0x4170cc], ax
mov dword [ebp - 0xc], 0x369
mov eax, dword [0x4170c8]
imul eax, eax, 0x33716c2
mov dword [0x4170d0], eax
mov eax, dword [0x4170d0]
or ax, 0xb2d9
mov word [0x4170d8], ax
movzx eax, word [0x4170d8]
or ax, 0x8806
mov word [0x4170e0], ax
mov eax, dword [0x4170c8]
or eax, 0xc04c49e5
mov dword [0x4170d0], eax
mov eax, dword [0x4170d0]
and eax, 0xee1184b
mov dword [0x4170d4], eax
mov dword [ebp - 0x18], 0x30
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
sub dword [ebp - 0xc], 3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4170d0]
or ax, 0x7436
mov word [0x4170d8], ax
movzx eax, word [0x4170e0]
or ax, 0xfb7d
mov word [0x4170cc], ax
movzx eax, word [0x4170e0]
imul ax, ax, 0x5f9b
mov word [0x4170d8], ax
mov eax, dword [0x4170d4]
xor eax, 0xd2f6e591
mov dword [0x4170c8], eax
movzx eax, word [0x4170d8]
and ax, 0x97d8
mov word [0x4170cc], ax
movzx eax, word [0x4170e0]
or ax, 0x74d5
mov word [0x4170cc], ax
movzx eax, word [0x4170cc]
movzx eax, ax
xor eax, 0x6b158887
mov dword [0x4170d4], eax
sub dword [ebp - 0xc], 1
mov eax, dword [0x4170d4]
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
shl eax, 9
mov word [0x4170cc], ax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetKeyboardState]
call eax
sub esp, 4
movzx eax, word [0x4170e0]
add ax, 0x49d6
mov word [0x4170cc], ax
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x413a36
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xf950517
call fcn.00407f64
mov edi, eax
push 0xf950517
call fcn.00412044
pushfd
push esi
add ecx, esi
mov esi, 0x576155f2
xor ecx, esi
rol ecx, 0xdc
rol esi, 0x2c
sub ecx, 0x76d9
add esi, ecx
sub esi, ecx
add ecx, 0x76d9
ror esi, 0x2c
ror ecx, 0xdc
xor ecx, esi
pop esi
sub ecx, esi
popfd
lea esp, [esp + 4]
mov ecx, 0x5010cfdf
pushfd
pushfd
push esi
add edx, esi
mov esi, 0x1b3f66b2
xor edx, esi
rol edx, 0x7b
rol esi, 0xba
sub edx, 0xddbd
add esi, edx
sub esi, edx
add edx, 0xddbd
ror esi, 0xba
ror edx, 0x7b
xor edx, esi
pop esi
sub edx, esi
popfd
xor ecx, 0x4878f5a1
sub ecx, 0x4c6dc6ef
pushfd
push esi
add ebp, esi
mov esi, 0xda6faae1
xor ebp, esi
rol ebp, 0x60
rol esi, 0x57
sub ebp, 0xf67c
add esi, ebp
sub esi, ebp
add ebp, 0xf67c
ror esi, 0x57
ror ebp, 0x60
xor ebp, esi
pop esi
sub ebp, esi
popfd
xor ecx, 0x545af87
rol ecx, 0xc9
popfd
pushfd
xor ecx, 0x8521e3d6
sub ecx, 0xde98db8d
pushfd
push esi
add ecx, esi
mov esi, 0x5dc45b28
xor ecx, esi
rol ecx, 0x36
rol esi, 0x49
sub ecx, 0x8344
add esi, ecx
sub esi, ecx
add ecx, 0x8344
ror esi, 0x49
ror ecx, 0x36
xor ecx, esi
pop esi
sub ecx, esi
popfd
xor ecx, 0x1c1516be
rol ecx, 0x4e
pushfd
push esi
add esi, esi
mov esi, 0x11e12eea
xor esi, esi
rol esi, 0x2b
rol esi, 0xb5
sub esi, 0xeb4a
add esi, esi
sub esi, esi
add esi, 0xeb4a
ror esi, 0xb5
ror esi, 0x2b
xor esi, esi
pop esi
sub esi, esi
popfd
popfd
dec ecx
pushfd
push esi
add edx, esi
mov esi, 0x8307787b
xor edx, esi
rol edx, 0x71
rol esi, 0x1c
sub edx, 0xd9aa
add esi, edx
sub esi, edx
add edx, 0xd9aa
ror esi, 0x1c
ror edx, 0x71
xor edx, esi
pop esi
sub edx, esi
popfd
push dword [ebp + ecx*4 + 8]
jne 0x413b67
mov ecx, eax
mov eax, ecx
lea ebx, [0x413c36]
push ebx
pushfd
push esi
add edx, esi
mov esi, 0x9bb94711
xor edx, esi
rol edx, 0x30
rol esi, 0x47
sub edx, 0x1643
add esi, edx
sub esi, edx
add edx, 0x1643
ror esi, 0x47
ror edx, 0x30
xor edx, esi
pop esi
sub edx, esi
popfd
call fcn.00413c67
pushfd
push esi
add ebx, esi
mov esi, 0x341695d1
xor ebx, esi
rol ebx, 0x58
rol esi, 0x10
sub ebx, 0xf59e
add esi, ebx
sub esi, ebx
add ebx, 0xf59e
ror esi, 0x10
ror ebx, 0x58
xor ebx, esi
pop esi
sub ebx, esi
popfd
lea esp, [esp + 4]
pushfd
push esi
add edx, esi
mov esi, 0xf727d7bd
xor edx, esi
rol edx, 0x8b
rol esi, 0x24
sub edx, 0xdde6
add esi, edx
sub esi, edx
add edx, 0xdde6
ror esi, 0x24
ror edx, 0x8b
xor edx, esi
pop esi
sub edx, esi
popfd
mov esp, ebp
pop ebp
ret
Function at 0x415b14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, word [0x4171b0]
sub eax, 0x5b
mov byte [0x4171a9], al
movzx edx, byte [0x4171a8]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 3
mov byte [0x4171a8], al
mov eax, dword [0x4171ac]
mov edx, 0xffffff93
imul eax, edx
mov byte [0x4171a9], al
movzx eax, byte [0x41719e]
movzx eax, al
imul eax, eax, 0x125a4c2b
mov dword [0x4171ac], eax
mov eax, dword [0x4171a4]
add eax, 0x1c
mov byte [0x4171a9], al
movzx eax, byte [0x41719e]
movzx eax, al
or ax, 0x7002
mov word [0x4171b0], ax
movzx eax, byte [0x41719e]
movzx eax, al
xor eax, 0xb389e58a
mov dword [0x4171a4], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 9], al
mov eax, dword [0x4171a0]
add eax, 0x33b5e9ac
mov dword [0x4171ac], eax
mov eax, dword [0x4171ac]
sub eax, 0x5988396
mov dword [0x4171a4], eax
movzx eax, byte [0x4171a9]
movzx eax, al
imul ax, ax, 0xf93
mov word [0x4171b0], ax
movzx eax, byte [0x41719e]
movzx eax, al
add ax, 0x4c2f
mov word [0x4171b0], ax
mov ecx, dword [ebp + 8]
mov edx, dword [0x41d7e4]
movzx eax, byte [ebp - 9]
xor edx, ecx
mov dword [eax*4 + 0x41c7e0], edx
movzx eax, byte [0x41719e]
mov edx, 0xffffffd8
imul eax, edx
mov byte [0x41719e], al
movzx eax, byte [0x41719e]
sub eax, 0x5f
mov byte [0x41719e], al
movzx eax, word [0x4171b0]
xor ax, 0x6fe2
mov word [0x4171b0], ax
mov eax, dword [0x4171a0]
add ax, 0x2830
mov word [0x41719c], ax
movzx eax, byte [0x4171a8]
and eax, 0x35
mov byte [0x4171a8], al
mov eax, dword [0x4171a4]
mov edx, 0x6e
imul eax, edx
mov byte [0x4171a9], al
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetKeyboardState]
call eax
sub esp, 4
movzx eax, word [0x41719c]
imul ax, ax, 0x618c
mov word [0x4171b0], ax
movzx eax, byte [ebp - 9]
shl eax, 2
add eax, 0x41c7e0
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea edx, [eax*8]
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x4171ac]
add eax, 0x1f
mov byte [0x4171a9], al
mov eax, dword [0x4171ac]
xor eax, 0xfffffffe
mov byte [0x4171a9], al
movzx eax, byte [0x4171a8]
or eax, 0xffffff9b
mov byte [0x4171a8], al
mov eax, dword [0x4171a4]
xor eax, 0x84439923
mov dword [0x4171a0], eax
movzx eax, word [0x4171b0]
and ax, 0x3c0c
mov word [0x41719c], ax
mov eax, dword [ebp + 8]
mov dword [0x41d7e4], eax
nop
leave
ret

Function at 0x415f60
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00416cd0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00416cd0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x415fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x41d82c]
test esi, esi
jle 0x4160e0
mov eax, dword [0x41d830]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x415ff4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x416077
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x415fe0
mov dword [esp], ebx
call fcn.004169b0
mov edi, eax
test eax, eax
je 0x416107
mov eax, dword [0x41d830]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00416af0
mov edx, dword [0x41d830]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4160e7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x416070
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x416080
add dword [0x41d82c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x41d830]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x416070
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00415f60
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x415ffe
mov eax, dword [0x41d830]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00415f60
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00415f60
lea esi, [esi]
nop

Function at 0x416620
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x41d848
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41d840]
sub esp, 4
test ebx, ebx
je 0x416675
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x41666e
test esi, esi
je 0x41666e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x416650
mov dword [esp], 0x41d848
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4169b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4169d5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4169e0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4169d5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x416a28
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x416a1e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x416a2a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x416a10
xor eax, eax
pop ebx
pop esi
ret