joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4781ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov ecx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x48]
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edi, ecx
cmp byte [0x4a7cc1], bl
je 0x478346
mov eax, dword [0x4a7cc4]
cmp eax, ebx
je 0x478346
mov edx, 3
mov word [eax + 0x38], dx
mov dword [eax + 0x40], ecx
mov word [eax + 0x98], dx
call dword [0x482304]
mov edx, dword [0x4a7cc4]
mov dword [edx + 0xa0], eax
mov eax, 3
mov word [edx + 0xa8], ax
mov ecx, dword [ebp + 0xf4]
push ecx
call fcn.00437a4d
mov dword [edx + 0xb0], eax
cmp esi, ebx
je 0x4782c6
mov ecx, dword [esi + 4]
mov ebx, dword [0x482430]
mov eax, 8
mov word [esp + 0x20], ax
lea eax, [esp + 0x20]
push eax
add edx, 0x68
push edx
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x20]
push edx
add eax, 0x58
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x20]
push edx
add eax, 0x78
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, 3
mov word [eax + 0x88], cx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x90], edx
mov word [eax + 0xb8], cx
movzx ecx, word [esi]
test cx, cx
je 0x4782b7
movzx esi, cx
jmp 0x4782ba
mov esi, dword [esi + 0x1c]
mov dword [eax + 0xc0], esi
test esi, esi
je 0x4782c6
mov edi, esi
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4782db
mov edi, eax
lea ebx, [esp + 0x10]
call fcn.0040e6d0
jmp 0x4782fa
push edi
lea edx, [esp + 0x34]
push edx
call fcn.0044af5c
mov edi, eax
lea esi, [esp + 0x10]
call fcn.0040e640
lea ecx, [esp + 0x30]
call fcn.00402620
mov eax, dword [0x4a7cc4]
add eax, 0x48
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00476a8a
mov ecx, dword [0x4a7cc4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
add esp, 8
call eax
mov edx, dword [ebp]
mov ecx, dword [esp + 0x48]
mov eax, dword [edx + 4]
push 0
push ecx
add eax, ebp
call fcn.004040e0
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x14
mov eax, dword [ebp]
mov eax, dword [eax + 4]
push ebx
push ecx
add eax, ebp
call fcn.004040e0
cmp byte [esp + 0x54], bl
je 0x478331
lea esi, [esp + 0x10]
call fcn.004092c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret 0x14
Function at 0x40b050
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x42ff68
call fcn.0040aaf0
push 1
call fcn.0040a5b1
pop ecx
test al, al
je 0x40b02e
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040a562
mov byte [ebp - 0x24], al
mov eax, dword [0x431b8c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40b02e
test eax, eax
jne 0x40af4c
mov dword [0x431b8c], ecx
push 0x42eb90
push 0x42eb6c
call fcn.00410c74
pop ecx
pop ecx
test eax, eax
je 0x40af2f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40b01e
push 0x42eb68
push 0x42eb60
call fcn.00410c2f
pop ecx
pop ecx
mov dword [0x431b8c], 2
jmp 0x40af51
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040a594
pop ecx
call fcn.0040b163
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40af82
push esi
call fcn.0040a4ce
pop ecx
test al, al
je 0x40af82
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.0040b169
mov esi, eax
cmp dword [esi], edi
je 0x40afa0
push esi
call fcn.0040a4ce
pop ecx
test al, al
je 0x40afa0
push dword [esi]
call fcn.0040fc02
pop ecx
call fcn.0041076a
mov edi, eax
call fcn.0040cc12
mov esi, dword [eax]
call fcn.0040cc0c
push edi
push esi
push dword [eax]
call main
add esp, 0xc
mov esi, eax
call fcn.0040a728
test al, al
je 0x40b035
test bl, bl
jne 0x40afd3
call fcn.0040fbe4
push 0
push 1
call fcn.0040a5ea
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40b01e
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0040a784
push esi
call fcn.0040fbb8
push dword [ebp - 0x20]
call fcn.0040fbce
int3
call fcn.004c6000
jmp 0x40aec2

Function at 0x419586
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004197cf

Function at 0x41d12f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041d13a
Function at 0x4067e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [0x46c19c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x288dafce
mov eax, dword [ebp - 0x10]
mov ecx, eax
sub ecx, 0xdf88b8c6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jg 0x40682e
jmp 0x406818
mov eax, dword [ebp - 0x14]
sub eax, 0x8b408e5b
mov dword [ebp - 0x1c], eax
je 0x4068d3
jmp 0x406870
mov eax, dword [ebp - 0x14]
sub eax, 0xdf88b8c7
mov dword [ebp - 0x20], eax
je 0x4068a7
jmp 0x406844
mov eax, dword [ebp - 0x14]
sub eax, 0x27dc76d8
mov dword [ebp - 0x24], eax
je 0x406893
jmp 0x40685a
mov eax, dword [ebp - 0x14]
sub eax, 0x288dafce
mov dword [ebp - 0x28], eax
je 0x406875
jmp 0x406870
jmp 0x4068db
mov eax, 0xdf88b8c7
mov ecx, 0x27dc76d8
mov edx, dword [ebp - 4]
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x4068db
mov eax, dword [0x46c19c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x8b408e5b
jmp 0x4068db
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x46c19c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x8b408e5b
jmp 0x4068db
mov eax, dword [ebp - 8]
add esp, 0x28
pop ebp
ret
jmp 0x4067fc
Function at 0x440aab
Capabilities:
Parse pe header
Terminate process

Disassembly:
add byte [eax], al
add byte [eax], al
push 0x14
push 0x44b270
call fcn.004422aa
call fcn.00441f73
movzx esi, ax
push 2
call fcn.00441d43
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x440add
xor ebx, ebx
jmp 0x440b10
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x440ad9
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x440ad9
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x440b10
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.00440d40
test eax, eax
jne 0x440b24
push 0x1c
call fcn.00440bff
pop ecx
call fcn.004411ea
test eax, eax
jne 0x440b35
push 0x10
call fcn.00440bff
pop ecx
call fcn.00441e2a
and dword [ebp - 4], 0
call fcn.00441787
test eax, eax
jns 0x440b4f
push 0x1b
call fcn.00440bff
pop ecx
call dword [0x44701c]
mov dword [0x46ec90], eax
call fcn.00441e6a
mov dword [0x46c7b8], eax
call fcn.00441a35
test eax, eax
jns 0x440b75
push 8
call fcn.004412c5
pop ecx
call fcn.00441c62
test eax, eax
jns 0x440b86
push 9
call fcn.004412c5
pop ecx
push 1
call fcn.004412ff
pop ecx
test eax, eax
je 0x440b99
push eax
call fcn.004412c5
pop ecx
call fcn.0044224a
push esi
push eax
push 0
push 0x400000
call fcn.0040322a
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x440bbb
push esi
call fcn.0044155b
call fcn.004412f0
jmp 0x440bf0
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.004422ef
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x28
push 0
push 0x411ae0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x411ae4], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x411ae0], eax
mov eax, 0x41074c
mov dword [0x411ae8], eax
call fcn.0040324f
call fcn.0040d6c0
call fcn.0040cde0
call fcn.0040c80a
call fcn.0040c207
call fcn.0040bfce
call fcn.0040bf34
call fcn.0040b900
call fcn.00409a3c
call fcn.004092e0
call fcn.004087ad
call fcn.00407af5
call fcn.00407a3c
call fcn.0040761e
call fcn.004063e3
call fcn.00403ef7
call fcn.00403cc1
call fcn.0040339d
mov dword [0x411af0], 0
mov edx, dword [0x41205c]
push edx
push edx
mov edx, dword [0x41205c]
push edx
push edx
call fcn.004033cc
mov edx, dword [0x41076c]
add dword [esp], edx
call fcn.0040bfda
push 0x411af4
call fcn.0040d740
call fcn.00401faf
push 0
jmp 0x4010eb
call 0x401105
call fcn.0040d710
push dword [0x411ae0]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess

Function at 0x401142
Capabilities:
Get disk information

Disassembly:
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x18]
mov dword [0x41205c], eax
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.00403000
mov edx, dword [0x41205c]
push edx
push edx
push 0x100
call fcn.0040bbb0
lea eax, [esp + 8]
push eax
call fcn.0040d740
mov edx, dword [0x41205c]
push edx
push edx
push 0x100
call fcn.0040bbb0
lea eax, [esp + 0xc]
push eax
call fcn.0040d740
mov edx, dword [esp]
push dword [0x41205c]
push edx
call fcn.0040d7c0
mov edx, 0x4104cc
push edx
call fcn.0040d7c0
lea eax, [esp + 0x10]
push eax
call fcn.0040d740
push 0xff
mov eax, dword [esp + 0xc]
push eax
push 0
push 0
push 0
push 0xff
mov eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x28]
call sub.KERNEL32.dll_GetVolumeInformationW
mov edx, dword [esp + 4]
push dword [0x41205c]
push edx
call fcn.0040d7c0
pop eax
add eax, dword [0x41076c]
jmp 0x40120e
push dword [esp + 0xc]
call fcn.0040d820
push dword [esp]
call fcn.0040d820
push dword [esp + 8]
call fcn.0040d820
push dword [esp + 4]
call fcn.0040d820
add esp, 0x10
ret 4
Function at 0x401faf
Capabilities:
Hide graphical window

Disassembly:
push ebx
xor eax, eax
push eax
mov byte [esp], 0xff
push 0x122
push 0xd2
push 0
push 0
call fcn.00401b77
push 0
call fcn.0040681a
mov dword [0x411b04], eax
call fcn.00406961
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x401ffb
push 0
jmp 0x4010eb
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x402053
call fcn.0040c321
push eax
mov ebx, dword [0x411afc]
cmp ebx, dword [esp]
jne 0x40203d
push 0
push dword [0x411b04]
call sub.USER32.dll_ShowWindow
call fcn.004013a9
push 5
push dword [0x411b04]
call sub.USER32.dll_ShowWindow
jmp 0x402052
mov ebx, dword [0x411b00]
cmp ebx, dword [esp]
jne 0x402052
push 0
jmp 0x4010eb
pop eax
pop eax
movsx ebx, byte [esp]
and ebx, ebx
jl 0x401fdf
xor eax, eax
add esp, 4
pop ebx
ret
Function at 0x402190
Capabilities:
Get disk information

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
mov dword [esp + 8], 2
jmp 0x4021a2
mov eax, 0x19
cmp eax, dword [esp + 8]
jl 0x402397
mov edx, dword [0x41205c]
push edx
push edx
mov ebx, dword [esp + 0x10]
add ebx, 0x41
push ebx
call fcn.0040bdd0
lea eax, [esp + 4]
push eax
call fcn.0040d740
push dword [esp]
mov edx, 0x410110
pop ecx
call fcn.004030a0
je 0x4021e5
jmp 0x40238d
push dword [0x41205c]
mov edx, dword [esp + 4]
push dword [0x41205c]
push edx
call fcn.0040d7c0
mov edx, 0x4104cc
push edx
call fcn.0040d7c0
mov edx, dword [0x41076c]
add dword [esp], edx
call sub.KERNEL32.dll_GetDriveTypeW
pop dword [0x41205c]
mov ebx, eax
cmp ebx, 3
jne 0x40238d
push dword [0x41205c]
push dword [esp + 4]
call fcn.00401142
lea eax, [esp + 8]
push eax
call fcn.0040d740
push dword [esp + 4]
call fcn.0040bce0
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
cmp ebx, 0x14
jle 0x40227f
mov edx, dword [0x41205c]
push edx
push edx
push 0x12
push dword [esp + 0x10]
call fcn.0040bc00
mov edx, 0x41064c
push edx
call fcn.0040d7c0
lea eax, [esp + 8]
push eax
call fcn.0040d740
push dword [0x41205c]
mov edx, dword [esp + 4]
push dword [0x41205c]
push edx
call fcn.0040d7c0
mov edx, str.:___
push edx
call fcn.0040d7c0
mov edx, dword [esp + 0xc]
push edx
call fcn.0040d7c0
mov edx, 0x4100de
push edx
call fcn.0040d7c0
add dword [0x41205c], 2
push 0xffffffff
push 5
mov edx, dword [0x41076c]
add dword [esp + 8], edx
call fcn.004053fd
pop dword [0x41205c]
push dword [0x41205c]
mov edx, dword [esp + 4]
push dword [0x41205c]
push edx
call fcn.0040d7c0
mov edx, str.:Windows
push edx
call fcn.0040d7c0
mov edx, dword [0x41076c]
add dword [esp], edx
call fcn.0040c069
pop dword [0x41205c]
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40231e
cmp edi, 0xffffffff
je 0x402322
xor eax, eax
jmp 0x402327
mov eax, 1
or eax, eax
je 0x40238d
inc dword [0x411af0]
push dword [0x41205c]
mov edx, dword [esp + 4]
push dword [0x41205c]
push edx
call fcn.0040d7c0
mov edx, str.:Windows___
push edx
call fcn.0040d7c0
mov edx, dword [esp + 0xc]
push edx
call fcn.0040d7c0
mov edx, 0x4100de
push edx
call fcn.0040d7c0
add dword [0x41205c], 2
push 0xffffffff
push 4
mov edx, dword [0x41076c]
add dword [esp + 8], edx
call fcn.004053fd
pop dword [0x41205c]
inc dword [esp + 8]
jno 0x4021a2
mov ebx, dword [0x411af0]
and ebx, ebx
jne 0x4023b6
mov eax, 0x410636
push eax
push 0xffffffff
push 4
call fcn.004053fd
xor eax, eax
push dword [esp + 4]
call fcn.0040d820
push dword [esp]
call fcn.0040d820
add esp, 0x10
pop edi
pop ebx
ret
Function at 0x403b0a
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x403bc9
cmp dword [esp + 0x24], 2
je 0x403bc9
push 0x2000
push ebp
push dword [0x411ae0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x403b98
cmp dword [esp + 0x18], 2
jne 0x403bb4
cmp dword [esp + 0x28], 0xffffffff
je 0x403b5c
cmp ebp, dword [esp + 0x28]
jae 0x403bb4
add ebp, 2
test ebx, ebx
jne 0x403b81
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x411ae0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x403bb4
cmp ax, 0xd
je 0x403b98
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403b48
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.0040dfb0
jmp 0x403c5b
push eax
push 0
push dword [0x411ae0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x403be7
cmp ebp, dword [esp + 0x28]
jae 0x403c3f
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403c3f
cmp dword [esp + 0x18], 1
jne 0x403c3f
inc ebp
test ebx, ebx
jne 0x403c2c
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x411ae0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x403c3f
cmp al, 0xd
je 0x403bda
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x403bda
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x403c56
call fcn.0040e000
jmp 0x403c5b
call fcn.0040e070
push esi
push 0
push dword [0x411ae0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10

Function at 0x403f9d
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x4120ac]
call fcn.0040cf7f
mov ebx, eax
test ebx, ebx
je 0x404001
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x403fc6
push dword [esp + 0xc]
push ebx
call eax
jmp 0x404001
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.0040d950
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.0040da20
pop edi
pop esi
pop ebx
ret 8
Function at 0x4061c3
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x406339
mov eax, dword [esp + 0x24]
dec eax
je 0x40631c
dec eax
jne 0x406339
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.0040617c
pop ecx
test eax, eax
je 0x40627a
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x40623d
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x406318
dec ebx
je 0x406314
dec ebx
je 0x4062f3
dec ebx
je 0x4062ad
sub ebx, 4
jne 0x406339
test edi, edi
jne 0x406339
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x406339
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x40623d
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x406238
sub edi, 0
je 0x4062e5
dec edi
je 0x4062d7
dec edi
je 0x4062c9
dec edi
jne 0x406339
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x406339
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x406339
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x406339
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x406339
sub edi, 0
je 0x406310
dec edi
je 0x40630c
dec edi
jne 0x406339
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x406339
push 0x3c
jmp 0x406338
push 0x32
jmp 0x406338
push 0x14
jmp 0x406338
push 5
jmp 0x406338
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x406336
cmp eax, 0xa
je 0x406332
cmp eax, 0x5a
jne 0x406339
push 0x28
jmp 0x406338
push 0x1e
jmp 0x406338
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x407329
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4073c1
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4073be
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4073be
lea eax, [esi - 1]
push eax
push dword [0x4120b8]
call fcn.0040cf7f
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4073c0
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x4073b5
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x4074a8
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x40739b
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x407467
push eax
call esi
test al, al
jns 0x407467
push 0x11
call esi
test al, al
js 0x407467
push 0x10
call esi
test al, al
js 0x407467
push 0x12
call esi
test al, al
js 0x407467
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x407467
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x40743b
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x407452
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x4074b2
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4074b2
test ebp, ebp
je 0x40748b
push 0x11
call esi
test al, al
js 0x407483
push 0x10
call esi
test al, al
js 0x407483
push 0x12
call esi
test al, al
jns 0x40748b
push 1
push ebp
call fcn.004074be
test ebx, ebx
je 0x40749f
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x4074b2
test edi, edi
je 0x4074b2
mov eax, dword [edi + 8]
jmp 0x4074b4
and dword [esp + 0x14], 0
jmp 0x4073c0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x4099d0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x409a02
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4099fd
cmp dword [esp + 0xc], esi
je 0x409a19
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret