joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019a0
Capabilities:
Create directory

Disassembly:
push ebx
sub esp, 0x268
mov ebx, dword [esp + 0x270]
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
cmp eax, 0xffffffff
je 0x401a04
test byte [esp + 0x10], 0x10
mov dword [esp], eax
jne 0x4019f1
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov dword [0x418a00], 5
sub esp, 4
add esp, 0x268
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
sub esp, 4
add esp, 0x268
pop ebx
ret
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
sub esp, 8
jmp 0x4019e9

Function at 0x401a20
Capabilities:
Get file size

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov dword [0x419a94], eax
cmp eax, 0xffffffff
je 0x401a94
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub esp, 8
mov edx, eax
mov eax, dword [esp + 0x34]
mov dword [eax], edx
xor eax, eax
cmp edx, 0xffffffff
je 0x401ac5
add esp, 0x2c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x401ab2
mov dword [0x418a00], 7
mov eax, 1
add esp, 0x2c
ret
mov dword [0x418a00], 6
mov eax, 1
add esp, 0x2c
ret
mov eax, dword [0x419a94]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [0x418a00], 8
sub esp, 4
jmp 0x401a90

Function at 0x401af0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov dword [0x419a94], eax
cmp eax, 0xffffffff
je 0x401bb0
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x48]
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x401b84
mov eax, dword [0x419a94]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x3c
ret
mov eax, dword [0x419a94]
mov dword [0x418a00], 0xa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
sub esp, 4
add esp, 0x3c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x401bd0
mov dword [0x418a00], 7
mov eax, 1
add esp, 0x3c
ret
mov dword [0x418a00], 6
mov eax, 1
add esp, 0x3c
ret
Function at 0x402f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov edx, dword [esp + 0xa4]
lea eax, [esp + 0x48]
mov ebx, dword [esp + 0xa0]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00402b10
movzx edi, byte [ebx + 0xe]
movzx eax, word [esp + 0x48]
movzx edx, word [esp + 0x4e]
movzx ecx, word [esp + 0x4a]
mov esi, dword [ebx + 4]
movzx ebp, word [esp + 0x54]
mov word [esp + 0x3c], ax
mov eax, edi
mov word [esp + 0x3e], dx
test al, al
movzx eax, word [esp + 0x3e]
mov word [esp + 0x3a], cx
movzx edx, word [esp + 0x50]
mov dword [esp + 0x14], eax
movzx eax, word [esp + 0x3a]
movzx ecx, word [esp + 0x52]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x3c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], eax
jne 0x4030d0
lea eax, [esp + 0x58]
mov dword [esp + 8], 0x412068
lea ebp, [esi + 0x25]
mov dword [esp + 4], 0x14
shr ebp, 0xa
mov dword [esp], eax
add ebp, 1
call sub.msvcrt.dll_swprintf_s
movzx eax, word [ebx + 0xc]
cmp eax, ebp
jb 0x4030a0
mov eax, dword [ebx]
add esi, eax
mov eax, dword [esp + 0x58]
mov dword [esi], eax
mov eax, dword [esp + 0x5c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x64]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x68]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x78]
mov dword [esi + 0x20], eax
movzx eax, word [esp + 0x7c]
mov word [esi + 0x24], ax
add dword [ebx + 4], 0x26
add esp, 0x8c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebp
shl eax, 0xa
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x403160
mov dword [ebx], eax
mov word [ebx + 0xc], bp
jmp 0x40303c
lea eax, [esp + 0x58]
lea edi, [esi + 0x12]
mov dword [esp + 8], str._04d._02d._02d__02d:_02d:_02d
mov dword [esp + 4], 0x14
shr edi, 0xa
mov dword [esp], eax
add edi, 1
call dword [0x411038]
movzx eax, word [ebx + 0xc]
cmp eax, edi
jb 0x403141
mov eax, dword [ebx]
mov edx, dword [esp + 0x58]
add eax, esi
xor edi, edi
mov dword [eax], edx
mov edx, dword [esp + 0x5c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x60]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x64]
mov dword [eax + 0xc], edx
movzx edx, word [esp + 0x68]
mov word [eax + 0x10], dx
movzx edx, byte [esp + 0x6a]
mov byte [eax + 0x12], dl
mov eax, edi
add dword [ebx + 4], 0x13
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
shl eax, 0xa
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x403160
mov dword [ebx], eax
mov word [ebx + 0xc], di
jmp 0x403100
mov dword [0x418a00], 1
mov edi, 1
jmp 0x403089
Function at 0x403a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14
mov edx, dword [esp + 0x28]
mov ecx, dword [edx + 0x10]
cmp ecx, 7
jbe 0x403b00
xor eax, eax
cmp ecx, 8
je 0x403af4
mov ebp, dword [edx]
xor ebx, ebx
mov eax, dword [ebp]
lea edx, [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp + 4]
add ebp, ecx
xor ecx, ecx
mov dword [esp + 0xc], eax
cmp edx, ebp
jae 0x403ae0
mov dword [esp + 4], ebp
nop
lea esi, [esi]
movzx eax, byte [edx]
mov esi, ecx
mov edi, ebx
add edx, 1
shrd esi, ebx, 8
shr edi, 8
xor eax, ecx
movzx eax, al
mov ebp, dword [eax*8 + 0x413240]
xor edi, dword [eax*8 + 0x413244]
mov ebx, edi
xor ebp, esi
mov ecx, ebp
cmp edx, dword [esp + 4]
jne 0x403ab0
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
xor edx, ecx
xor eax, ebx
or edx, eax
setne al
movzx eax, al
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x418a00], 0xd
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403b50
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
lea eax, [esp + 0x28]
mov esi, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.00401a20
test eax, eax
jne 0x403c30
mov ecx, dword [esp + 0x28]
mov edi, dword [esi]
cmp ecx, 0x8c
jbe 0x403ba5
lea edx, [ecx - 1]
mov ebx, 0x3a83a83b
shr edx, 2
mov eax, edx
mul ebx
movzx eax, word [esi + 0xc]
shr edx, 3
lea ebx, [edx + 1]
cmp eax, ebx
jb 0x403c50
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [0x419a94]
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
mov eax, dword [0x419a94]
mov dword [esp], eax
je 0x403c10
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esi + 0x10], eax
mov dword [esp], esi
call fcn.00403a70
mov edx, eax
xor eax, eax
test edx, edx
jle 0x403c28
mov dword [0x418a00], 0xb
add esp, 0x30
mov eax, 1
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [0x418a00], 9
sub esp, 4
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [0x418a00], 3
add esp, 0x30
mov eax, 1
pop ebx
pop esi
pop edi
ret
imul eax, ebx, 0x8c
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
mov edi, eax
test eax, eax
je 0x403c80
mov dword [esi], eax
mov ecx, dword [esp + 0x28]
mov word [esi + 0xc], bx
jmp 0x403ba5
mov eax, dword [0x419a94]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [0x418a00], 1
sub esp, 4
jmp 0x403c28
Function at 0x406590
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, dword [0x41217e]
mov dword [esp + 0x24], 0x5c3a43
mov ebx, eax
mov eax, dword [0x41217a]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], eax
test ebx, ebx
je 0x40675c
mov esi, 0x41
lea edi, [esp + 0x24]
jmp 0x4065db
add esi, 1
shr ebx, 1
je 0x40675c
test bl, 1
je 0x4065d0
mov dword [esp], 0x41a060
call fcn.004032b0
mov eax, esi
mov dword [esp], 0x41a060
movzx eax, al
mov dword [esp + 4], eax
call fcn.004035f0
mov eax, esi
mov dword [esp], edi
mov byte [esp + 0x24], al
cbw
mov word [esp + 0x40], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub esp, 4
movzx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x41a060
call fcn.004035f0
lea eax, [esp + 0x38]
mov dword [esp], edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x30]
mov dword [esp + 8], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
sub esp, 0x10
test eax, eax
je 0x406764
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov dword [esp], 0x41a060
shrd eax, edx, 0x14
mov dword [esp + 4], eax
mov dword [esp + 0x20], eax
call fcn.004034a0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov dword [esp], 0x41a060
shrd eax, edx, 0x14
mov dword [esp + 4], eax
mov dword [esp + 0x20], eax
call fcn.004034a0
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp], 0x41a060
shrd eax, edx, 0x14
mov dword [esp + 4], eax
mov dword [esp + 0x20], eax
call fcn.004034a0
lea eax, [esp + 0x20]
lea ebp, [esp + 0x48]
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x258
mov dword [esp + 4], 0x418f60
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
sub esp, 0x20
test eax, eax
je 0x4067a5
mov eax, dword [esp + 0x20]
mov dword [esp], 0x41a060
add esi, 1
mov dword [esp + 4], eax
call fcn.004034a0
mov dword [esp + 8], 0x258
mov dword [esp + 4], 0x418f60
mov dword [esp], 0x41a060
call fcn.004036a0
mov dword [esp + 8], 0xc
mov dword [esp + 4], ebp
mov dword [esp], 0x41a060
call fcn.004036a0
shr ebx, 1
jne 0x4065db
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0
mov dword [esp], 0x41a060
call fcn.004034a0
mov dword [esp + 4], 0
mov dword [esp], 0x41a060
call fcn.004034a0
mov dword [esp + 4], 0
mov dword [esp], 0x41a060
call fcn.004034a0
jmp 0x4066b9
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0x41a060
call fcn.004034a0
jmp 0x4065d0
Function at 0x406db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00405ef0
test eax, eax
jne 0x406f70
mov edx, dword [0x419b44]
test edx, edx
je 0x406f70
mov eax, dword [esp + 0x70]
cmp edx, dword [eax + 0x14]
ja 0x406f70
call fcn.004015c0
test al, al
jne 0x406f70
mov eax, dword [esp + 0x70]
lea ebp, [esp + 0x40]
lea edi, [esp + 0x38]
mov ebx, dword [eax + 4]
jmp 0x406e9f
mov dword [esp + 4], 0x4122f2
mov dword [esp], 0x418f60
mov byte [esp + 0x2c], dl
call fcn.00401cd0
movzx eax, byte [esp + 0x2c]
test al, 1
jne 0x406f80
mov dword [esp + 4], 0x4122ec
mov dword [esp], 0x418f60
call fcn.00401cd0
lea eax, [ebx + 0x13]
mov dword [esp], 0x418f60
mov dword [esp + 4], eax
call fcn.00401cd0
mov dword [esp + 4], 0x4122f8
mov dword [esp], 0x418f60
call fcn.00401cd0
mov eax, dword [ebx + 0xb]
mov edx, dword [ebx + 0xf]
mov dword [esp], 0x418f60
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.004026b0
movzx eax, word [ebx]
mov dword [esp], esi
add ebx, eax
call fcn.00406410
test eax, eax
je 0x406f70
xor eax, eax
mov word [0x418f60], ax
mov eax, dword [ebx + 2]
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 6]
mov dword [esp + 4], ebp
mov dword [esp + 0x3c], eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
sub esp, 8
movzx eax, word [esp + 0x4a]
mov dword [esp + 8], str._04d._02d._02d__02d:_02d
mov dword [esp + 4], 0x258
mov dword [esp + 0x1c], eax
movzx eax, word [esp + 0x48]
mov dword [esp], 0x418f60
mov dword [esp + 0x18], eax
movzx eax, word [esp + 0x46]
mov dword [esp + 0x14], eax
movzx eax, word [esp + 0x42]
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x40]
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_swprintf_s
movzx edx, byte [ebx + 0xa]
cmp edx, 1
mov dword [esp + 0x2c], edx
ja 0x406e10
mov dword [esp + 4], 0x4122e0
mov dword [esp], 0x418f60
call fcn.00401cd0
mov edx, dword [esp + 0x2c]
cmp edx, 1
je 0x406fa0
mov dword [esp + 4], 0x4122ec
mov dword [esp], 0x418f60
call fcn.00401cd0
lea eax, [ebx + 0xb]
mov dword [esp], 0x418f60
mov dword [esp + 4], eax
call fcn.00401cd0
jmp 0x406e8a
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x4122e6
mov dword [esp], 0x418f60
call fcn.00401cd0
jmp 0x406e35
mov dword [esp + 4], 0x4122e6
mov dword [esp], 0x418f60
call fcn.00401cd0
jmp 0x406f3c
Function at 0x40b6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp], str.b_data
call fcn.004018a0
test eax, eax
jne 0x40b8c2
movzx eax, byte [0x4184c8]
test al, 0x40
je 0x40b7c6
mov ebp, dword [0x41a0b0]
cmp ebp, 8
jbe 0x40b749
mov eax, dword [0x41a0a0]
xor ecx, ecx
xor ebx, ebx
lea edx, [eax + 8]
add ebp, eax
mov dword [esp + 0x2c], eax
cmp edx, ebp
jae 0x40b740
mov dword [esp + 0x28], ebp
nop
movzx eax, byte [edx]
mov esi, ecx
mov edi, ebx
add edx, 1
shrd esi, ebx, 8
shr edi, 8
xor eax, ecx
movzx eax, al
mov ebp, dword [eax*8 + 0x413240]
xor edi, dword [eax*8 + 0x413244]
mov ebx, edi
xor ebp, esi
mov ecx, ebp
cmp edx, dword [esp + 0x28]
jne 0x40b710
mov eax, dword [esp + 0x2c]
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [esp + 0xc], str.b_data
mov dword [esp + 8], 0x412d44
mov dword [esp + 4], 0x258
mov dword [esp], 0x418f60
call sub.msvcrt.dll_swprintf_s
mov eax, dword [0x41a0b0]
mov dword [esp], 0x418f60
mov dword [esp + 8], eax
mov eax, dword [0x41a0a0]
mov dword [esp + 4], eax
call fcn.00401af0
test eax, eax
jne 0x40b8c2
mov dword [esp + 8], 0x412d58
mov dword [esp + 4], 0x258
mov dword [esp], 0x418aa0
call sub.msvcrt.dll_swprintf_s
movzx eax, byte [0x4184c8]
or word [0x4184c0], 0x24
and eax, 0xffffffbf
mov byte [0x4184c8], al
test al, al
js 0x40b7d2
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [0x418410]
cmp ebp, 8
jbe 0x40b839
mov eax, dword [0x418400]
xor ecx, ecx
xor ebx, ebx
lea edx, [eax + 8]
add ebp, eax
mov dword [esp + 0x2c], eax
cmp edx, ebp
jae 0x40b830
mov dword [esp + 0x28], ebp
mov esi, esi
lea edi, [edi]
movzx eax, byte [edx]
mov esi, ecx
mov edi, ebx
add edx, 1
shrd esi, ebx, 8
shr edi, 8
xor eax, ecx
movzx eax, al
mov ebp, dword [eax*8 + 0x413240]
xor edi, dword [eax*8 + 0x413244]
mov ebx, edi
xor ebp, esi
mov ecx, ebp
cmp edx, dword [esp + 0x28]
jne 0x40b800
mov eax, dword [esp + 0x2c]
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [esp + 0x10], str.k_folder
mov dword [esp + 0xc], str.b_data
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x258
mov dword [esp], 0x418f60
call sub.msvcrt.dll_swprintf_s
mov eax, dword [0x418410]
mov dword [esp], 0x418f60
mov dword [esp + 8], eax
mov eax, dword [0x418400]
mov dword [esp + 4], eax
call fcn.00401af0
test eax, eax
jne 0x40b8e0
mov dword [esp + 0xc], str.k_folder
mov dword [esp + 8], 0x412d98
mov dword [esp + 4], 0x258
mov dword [esp], 0x418aa0
call sub.msvcrt.dll_swprintf_s
and byte [0x4184c8], 0x7f
or word [0x4184c0], 0x24
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.b_data
add dword [0x418a00], 0x10100
call fcn.0040b430
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.b_data
add dword [0x418a00], 0x20100
call fcn.0040b430
jmp 0x40b7ca
Function at 0x40e690
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push edi
xor eax, eax
push esi
push ebx
sub esp, 0x130
mov edx, dword [0x419a84]
mov ebx, dword [esp + 0x140]
nop
lea esi, [esi]
cmp word [edx + eax*2], 0
je 0x40e6d0
add eax, 1
cmp eax, 0x258
jne 0x40e6b0
add esp, 0x130
pop ebx
pop esi
pop edi
ret
cmp eax, 0x257
je 0x40e6c1
mov eax, dword [0x419a88]
cmp dword [0x419a8c], eax
ja 0x40e6c1
cmp ebx, 8
je 0x40e7b6
lea eax, [ebx - 0x30]
mov edx, 1
cmp eax, 9
jbe 0x40e700
cmp ebx, 0x20
sete dl
lea eax, [ebx - 0x40]
cmp eax, 0x1a
jbe 0x40e722
lea eax, [ebx - 0xba]
cmp eax, 6
jbe 0x40e722
lea eax, [ebx - 0xdb]
cmp eax, 3
jbe 0x40e722
test dl, dl
je 0x40e6c1
lea esi, [esp + 0x30]
xor eax, eax
mov ecx, 0x40
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esp], 0xa0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
test ax, ax
je 0x40e74b
mov byte [esp + 0x40], pe_nt_image_headers32
mov dword [esp], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
sub esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2e]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ToUnicodeEx]
sub esp, 0x1c
movzx eax, word [esp + 0x2e]
mov dword [esp], 0x419a84
mov dword [esp + 4], eax
call fcn.00404740
or word [0x4184c0], 2
add esp, 0x130
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0x419a84
call fcn.004047e0
or word [0x4184c0], 2
jmp 0x40e6c1
Function at 0x40f510
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4183a0]
test esi, esi
jle 0x40f620
mov edi, dword [0x4183a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40f544
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40f5c5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x40f530
mov dword [esp], eax
mov ebx, eax
call fcn.0040fe00
test eax, eax
mov edi, eax
je 0x40f647
mov eax, dword [0x4183a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040ff00
add eax, dword [edi + 0xc]
mov edx, dword [0x4183a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40f627
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40f5be
sub eax, 4
and eax, 0xfffffffb
jne 0x40f5d0
add dword [0x4183a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4183a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40f5be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00410780
lea esi, [esi]
xor esi, esi
jmp 0x40f54e
mov eax, dword [0x4183a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00410780
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00410780
mov esi, esi
lea edi, [edi]

Function at 0x40fa80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4183b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4183b0]
sub esp, 4
test ebx, ebx
je 0x40fad5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40face
test esi, esi
je 0x40face
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40fab0
mov dword [esp], 0x4183b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x410780
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004102a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004102a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x28aa55f0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x84c1cde
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x4018c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x403464], eax
mov edi, 0
mov ecx, 0xa
push edi
loop 0x4018dd
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [0x403464]
mov dword [ebp - 0x1c], edx
lea ecx, str.contents
mov dword [ebp - 8], ecx
lea eax, section..text
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x66
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x403464]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403474], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403474]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019a6
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40198d
pop ebp
ret 0x10