joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9ce0
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e3e1b
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4d9edb
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x4d9edb
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4d9edb
push edi
call fcn.004d9f00
add esp, 4
test al, al
jne 0x4d9d46
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xa1
jmp 0x4d9ee8
push edi
mov ecx, esi
call fcn.004d9c50
test eax, eax
je 0x4d9d5a
push edi
mov ecx, esi
call fcn.004da030
call fcn.004d9390
mov eax, dword [edi]
push 0
push 0x42000000
push 3
push 0
push 3
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4d9d94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x4d9ee8
push 0xa05c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x4d9ddb
mov ecx, dword [esi + 0x44]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov dl, byte [esi + 0x40]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push ecx
push ebp
push edx
push edi
push ebx
mov ecx, eax
call fcn.004da680
mov edi, eax
jmp 0x4d9ddd
xor edi, edi
test edi, edi
mov dword [esp + 0x18], 0xffffffff
jne 0x4d9e02
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xe
jmp 0x4d9ee8
mov eax, dword [esi + 4]
push 0
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
mov dword [esi + 4], eax
jne 0x4d9e36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov ecx, edi
mov esi, eax
call fcn.004da900
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x4d9ee8
mov eax, dword [esi + 8]
test eax, eax
jne 0x4d9e86
lea ecx, [esp + 0x20]
push ecx
push 0
push esi
push 0x4dab20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 8], eax
jne 0x4d9e78
push eax
mov ecx, edi
call fcn.004da900
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
mov eax, 0xa4
je 0x4d9ee8
call esi
jmp 0x4d9ee8
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x20]
test eax, eax
mov dword [esi + 0xc], edx
je 0x4d9ec9
mov eax, dword [esi + 4]
mov ecx, edi
push eax
call fcn.004da9a0
mov ebx, eax
test ebx, ebx
je 0x4d9eab
push 0
mov ecx, edi
call fcn.004da900
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x4d9ee8
mov ecx, dword [esp + 0x28]
push esi
call fcn.004d95b0
push edi
mov ecx, esi
call fcn.004da240
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4d9ee8
push 0xa4
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xa4
jmp 0x4d9ee8
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0x57
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x18
Function at 0x4d9f00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d9f1c
test al, 0x10
je 0x4d9f1c
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4db9c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0x6b3d28
push 0
push esi
push 0x4dba60
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [0x6b3d24], eax
test eax, eax
je 0x4db9f9
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x6b3d24]
test eax, eax
setne al
pop esi
ret
Function at 0x41a4fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x41a509
pop dword [ebp - 0x24]
mov eax, 0x41a509
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x52ff2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xb6d20df7
add ecx, 0x492e457e
xor edi, edi
add edi, eax
mov edx, 0xf88cf665
add edx, 0x7bb979b
add edx, dword [ebp - 0x24]
mov esi, 0xff711a13
sub dword [ebp - 4], ecx
mov ebx, dword [edx]
sub dword [ebp - 0x14], 0xd9e7d7d1
sub ebx, esi
sub dword [ebp - 4], edx
mov dword [edi], ebx
xor dword [ebp - 0x18], edi
add edi, 4
add edx, 0xb6735753
add edx, 0x498ca8b1
loop 0x41a55a
add eax, 0x140a7
mov ebx, eax
add eax, 0x3af20115
sub eax, 0x3af20110
mov ecx, 0x58018fce
add ecx, 0xa83e7032
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x78
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x74], eax
mov edx, dword [0x40213c]
mov eax, dword [0x402134]
mov ecx, dword [0x402138]
push ebx
push ebp
push esi
push edi
push 0x5c
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov eax, dword [0x402140]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x402144]
lea edx, [esp + 0x2c]
push 0
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x402148
push 0x66
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push esi
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push 1
push 0
push 0
push 0x40000000
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4010dd
push 0
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 2
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, 0x20
jb 0x401126
push 0x402150
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40111f
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00401140
add esp, 0x78
ret 0x10

Function at 0x401140
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40114a
repz ret
jmp fcn.00401463
Function at 0x407743
Capabilities:
Get disk size

Disassembly:
xor eax, eax
push eax
push eax
push eax
call fcn.0041d550
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.0040d000
mov edx, dword [esp]
push edx
call fcn.0041d3b0
pop edx
push eax
push edx
call fcn.0041d480
mov edx, 0x42893e
push edx
call fcn.0041d480
lea eax, [esp + 4]
push eax
call fcn.0041d3f0
lea eax, [esp + 4]
push eax
push 0
push 0
push dword [esp + 0xc]
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
and eax, eax
je 0x40779d
jmp 0x40779d
lea eax, [esp + 4]
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x4077ac
push edx
push dword [esp + 4]
call fcn.0041d5e0
pop edx
add esp, 0xc
ret 4
Function at 0x40d759
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x40d7ae
push dword [esp + 0x10]
push 0x40d6d8
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x42bcc8]
test esi, esi
je 0x40d807
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40d7a6
cmp byte [esi + 0x10], 0
je 0x40d7a6
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x40d782
jmp 0x40d807
mov esi, dword [0x42bcc8]
test esi, esi
je 0x40d807
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x40d800
cmp byte [esi + 0x11], 0
je 0x40d7dc
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x40d7f3
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x42bcc8
call fcn.0041d31b
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40d7bb
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x40df49
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, eax
cmp dword [esp + 0x24], 0x18
je 0x40dff8
cmp dword [esp + 0x24], 2
je 0x40dff8
push 0x2000
push edi
push dword [0x42bbb8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x40dfcb
cmp dword [esp + 0x18], 2
jne 0x40dfe3
test ebx, ebx
jne 0x40dfb4
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x42bbb8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x40dfe3
cmp ax, 0xd
je 0x40dfcb
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x40df8b
push dword [esp + 0x28]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.0041e230
jmp 0x40e07e
push eax
push 0
push dword [0x42bbb8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x40e04a
cmp dword [esp + 0x18], 1
jne 0x40e062
test ebx, ebx
jne 0x40e039
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x42bbb8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x40e062
cmp al, 0xd
je 0x40e04a
mov byte [esi + edi], al
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x40e011
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x28]
mov byte [esi + edi], 0
push esi
jne 0x40e079
call fcn.0041e280
jmp 0x40e07e
call fcn.0041e390
push esi
push 0
push dword [0x42bbb8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc

Function at 0x40e817
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x42c1a0]
call fcn.0041cbbd
mov ebx, eax
test ebx, ebx
je 0x40e87b
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x40e840
push dword [esp + 0xc]
push ebx
call eax
jmp 0x40e87b
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.0041d710
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.0041d7f0
pop edi
pop esi
pop ebx
ret 8
Function at 0x40fcc7
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40fe3d
mov eax, dword [esp + 0x24]
dec eax
je 0x40fe20
dec eax
jne 0x40fe3d
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.0040fc80
pop ecx
test eax, eax
je 0x40fd7e
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x40fd41
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x40fe1c
dec ebx
je 0x40fe18
dec ebx
je 0x40fdf7
dec ebx
je 0x40fdb1
sub ebx, 4
jne 0x40fe3d
test edi, edi
jne 0x40fe3d
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x40fe3d
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x40fd41
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x40fd3c
sub edi, 0
je 0x40fde9
dec edi
je 0x40fddb
dec edi
je 0x40fdcd
dec edi
jne 0x40fe3d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x40fe3d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x40fe3d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x40fe3d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x40fe3d
sub edi, 0
je 0x40fe14
dec edi
je 0x40fe10
dec edi
jne 0x40fe3d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x40fe3d
push 0x3c
jmp 0x40fe3c
push 0x32
jmp 0x40fe3c
push 0x14
jmp 0x40fe3c
push 5
jmp 0x40fe3c
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40fe3a
cmp eax, 0xa
je 0x40fe36
cmp eax, 0x5a
jne 0x40fe3d
push 0x28
jmp 0x40fe3c
push 0x1e
jmp 0x40fe3c
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x40ff80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x42c19c]
call fcn.0041cbbd
mov esi, eax
test esi, esi
je 0x41005a
cmp dword [ebp + 0xc], 0
je 0x40ffcc
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x40ffbd
cmp dword [esi + 0x1c], 0
jne 0x40ffbd
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41005a
test byte [ebp + 0x10], 3
je 0x40ffe7
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.00410846
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x41000c
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x410020
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x41003d
test ebx, ebx
je 0x410031
push 8
jmp 0x410043
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x410050
test ebx, ebx
je 0x410046
push 3
pop ecx
jmp 0x410050
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x4109d9
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x410a71
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x410a6e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x410a6e
lea eax, [esi - 1]
push eax
push dword [0x42c19c]
call fcn.0041cbbd
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x410a70
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x410a65
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x410b58
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x410a4b
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x410b17
push eax
call esi
test al, al
jns 0x410b17
push 0x11
call esi
test al, al
js 0x410b17
push 0x10
call esi
test al, al
js 0x410b17
push 0x12
call esi
test al, al
js 0x410b17
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x410b17
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x410aeb
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x410b02
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x410b62
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x410b62
test ebp, ebp
je 0x410b3b
push 0x11
call esi
test al, al
js 0x410b33
push 0x10
call esi
test al, al
js 0x410b33
push 0x12
call esi
test al, al
jns 0x410b3b
push 1
push ebp
call fcn.00410b6e
test ebx, ebx
je 0x410b4f
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x410b62
test edi, edi
je 0x410b62
mov eax, dword [edi + 8]
jmp 0x410b64
and dword [esp + 0x14], 0
jmp 0x410a70
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x4115ed
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x411735
xor ecx, ecx
cmp word [eax], cx
je 0x411735
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x411646
cmp eax, 3
jne 0x411680
cmp word [esp + 0xa], 0x3a
jne 0x411680
cmp eax, 2
jne 0x411664
lea eax, [esp + 8]
push 0x427430
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x411735
push 0xfffffffffffffffe
pop edi
jmp 0x411735
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x411695
cmp ax, bx
jne 0x41169f
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x411688
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x4116de
test byte [esp + 0x21c], 0x10
je 0x4116c5
push 0xfffffffffffffffe
pop edi
jmp 0x4116d5
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x411733
cmp word [esp + 0x10], bp
jne 0x4116ec
cmp word [esp + 0x12], bp
je 0x41170b
cmp word [esp + 0x10], bx
jne 0x4116fa
cmp word [esp + 0x12], bx
je 0x41170b
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x411733
cmp word [esp + 0x12], ax
jne 0x411733
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x411720
test al, 0x10
je 0x411733
jmp 0x411730
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x411733
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x4117b6
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x42be7c]
push esi
test eax, eax
jne 0x4117db
push fcn.004118e3
push 0x10
push 0x258
call fcn.0041cc90
mov dword [0x42be7c], eax
push dword [esp + 0xc]
push eax
call fcn.0041cbfc
mov esi, eax
test esi, esi
je 0x4118dc
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x4117fd
mov edi, 0x42700c
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x41180d
xor eax, eax
cmp word [ebx], ax
jne 0x411812
mov ebx, 0x427434
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x42bbb8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4118c3
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x411873
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x411877
push 0x427430
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x411877
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x41189b
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x4118b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4118af
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x42bbb8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x4118da
cmp dword [esp + 0x14], 0xffffffff
je 0x4118ce
mov esi, dword [esp + 0x14]
push esi
push dword [0x42be7c]
call fcn.0041cb6e
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x411dd1
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x411dfa
test byte [esp + 8], 2
je 0x411dee
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x411dfc
xor eax, eax
ret 8

Function at 0x411e70
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x411eac
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x4123a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x42c208]
call fcn.0041cbbd
mov esi, eax
test esi, esi
je 0x41241f
cmp dword [esi + 4], 0
je 0x4123f0
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.00412ac0
test eax, eax
je 0x4123e4
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41242a
cmp dword [esp + 8], 0
je 0x41242a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4