joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412080
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
jne 0x412099
push dword [0x520460]
call fcn.0041b99d
pop edi
ret 4
push esi
push edi
push dword [0x520460]
call fcn.00418de7
mov esi, eax
test esi, esi
je 0x412103
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4120ef
cmp dword [esi + 0x14], 0
mov dword [esp + 0xc], 0
jne 0x4120de
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
push dword [esi + 4]
push 0
push dword [0x4e8c1c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0x520460]
call fcn.00418e7c
pop esi
pop edi
ret 4

Function at 0x41307f
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x520d98]
sub esp, 0x20
test eax, eax
jne 0x41313d
push ebx
push ebp
push esi
push edi
mov esi, 0x520480
xor ebp, ebp
push esi
push 0xc8
mov dword [0x520d94], ebp
mov dword [0x520d98], ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, dword [sym.imp.WINMM.dll_mciSendCommandW]
push ebp
push 2
push 0x804
push 0xffffffffffffffff
call ebx
mov edi, ebp
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x204
push eax
push 0x3300
push 0x803
push ebp
mov dword [esp + 0x38], esi
call ebx
test eax, eax
mov eax, dword [0x520d98]
jne 0x41312a
mov ecx, dword [esp + 0x20]
mov dword [eax*8 + 0x520da0], ecx
mov dword [eax*8 + 0x520da4], esi
lea eax, [esp + 0x10]
push eax
push 0x400
push 0x80d
push ecx
mov dword [0x520d8c], ecx
mov dword [esp + 0x24], 0xa
call ebx
mov eax, dword [0x520d98]
inc eax
mov dword [0x520d98], eax
add edi, 4
lea esi, [edi*2 + 0x520480]
cmp word [esi], bp
jne 0x4130c6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x413470
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x520610]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x413498
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [ebp + 0x14]
mov eax, dword [esi + 0x90]
push dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 4]
pop esi
pop ebp
ret 0x14

Function at 0x4134bb
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x520610]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [ebp + 0x14], 0
mov ecx, eax
jle 0x4134f9
cmp dword [ebp + 0x18], 0
jle 0x4134f9
push dword [ebp + 0x18]
mov eax, dword [ecx + 0x90]
push dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ecx + 0x8c]
add eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push ecx
call dword [ecx + 0x28]
pop ebp
ret 0x14
Function at 0x41362d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push dword [0x520610]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [esp + 0x14]
mov esi, eax
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add edi, dword [esi + 0x8c]
add ebx, dword [esi + 0x90]
test ecx, ecx
je 0x4136a5
test ebp, ebp
je 0x4136a5
mov eax, ecx
sar eax, 0x1f
and eax, 2
dec eax
add eax, ecx
mov dword [esp + 0x20], eax
mov eax, ebp
sar eax, 0x1f
dec ebp
and eax, 2
add ebp, eax
mov eax, dword [esp + 0x24]
cmp eax, dword [esi + 0xac]
je 0x413694
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
lea eax, [ebx + ebp]
push eax
mov eax, dword [esp + 0x24]
add eax, edi
push eax
push ebx
push edi
push esi
call dword [esi + 0x48]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14

Function at 0x4136ac
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x520610]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x4136d4
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
mov ecx, dword [esi + 0x90]
mov eax, dword [ebp + 0x14]
mov edx, dword [esi + 0x8c]
add eax, ecx
push eax
mov eax, dword [ebp + 0x10]
add eax, edx
push eax
mov eax, dword [ebp + 0xc]
add eax, ecx
push eax
mov eax, dword [ebp + 8]
add eax, edx
push eax
push esi
call dword [esi + 0x48]
pop esi
pop ebp
ret 0x14

Function at 0x413760
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x520610]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
add eax, dword [edi + 0x90]
add ebp, dword [edi + 0x8c]
mov dword [esp + 0x18], eax
test esi, esi
jns 0x413796
add ebp, esi
neg esi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x4137a6
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, esi
jle 0x4137bb
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x4137d0
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [edi + 0xac]
je 0x4137e7
push eax
push edi
mov dword [edi + 0xac], eax
call dword [edi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push esi
push dword [esp + 0x28]
push ebp
push edi
call dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x1c
Function at 0x413801
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x41385e
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x41385e
mov eax, dword [esi + 0x70]
test eax, eax
je 0x41383d
push ebx
push esi
call eax
push esi
push ebx
push dword [0x4e8c1c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x520610]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x520614], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x417b88
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x5206f0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x417be9
push esi
push dword [0x5206ec]
push 8
push dword [0x4e8c1c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x5206f0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x5206e8]
jmp 0x417bd9
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x417bd7
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x417bc7
push edi
push 0x417cab
call fcn.0042a498
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x417bf3
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
and ecx, 3
je 0x417c09
push 4
pop eax
sub eax, ecx
add edi, eax
mov esi, dword [0x5206ec]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
jne 0x417c42
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push edi
push 8
push dword [0x4e8c1c]
mov dword [0x5206f0], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x5206f0]
call ebx
mov esi, dword [0x5206ec]
lea eax, [edi + esi]
push eax
push dword [0x5206f0]
mov dword [0x5206ec], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x4e8c1c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x5206f0]
call ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test edi, edi
jne 0x417c81
test ebx, ebx
je 0x417ca2
push 0x14
push 0x5206e8
call fcn.00418531
pop ecx
pop ecx
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
test edi, edi
je 0x417ca2
lea ecx, [esi + ebp]
push ecx
call edi
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x417d00
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x4e7fd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov ebp, dword [esp + 0x14]
mov esi, dword [edi + 8]
mov ecx, dword [ebp]
sub esi, ebx
lea eax, [esi + 0xa]
push eax
test ecx, ecx
jne 0x417d39
push ecx
push dword [0x5206f4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x417d48
push ecx
push 0
push dword [0x5206f4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
shr esi, 1
mov dword [ebp], ecx
mov eax, dword [edi]
push esi
add eax, ebx
push eax
push ecx
call fcn.0042a280
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x417d70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x4e7fd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov edi, eax
mov ecx, dword [edi]
add ecx, esi
push ecx
push dword [esp + 0x14]
call fcn.00418bf2
add esp, 0xc
mov dword [edi + 8], esi
pop edi
pop esi
ret 0xc
Function at 0x417f80
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4e7fd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
add ecx, dword [eax]
mov eax, ecx
ret

Function at 0x417fd0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4e7fd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 8], 2
ret

Function at 0x418670
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x4186c5
push dword [esp + 0x10]
push 0x418724
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [0x520730]
test edi, edi
je 0x41871e
xor esi, esi
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x4186bd
cmp byte [edi + 0x10], 0
je 0x4186bd
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, ebx
test ebx, ebx
jne 0x418699
jmp 0x41871e
mov edi, dword [0x520730]
test edi, edi
je 0x41871e
xor esi, esi
push ebp
mov ebp, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x418717
cmp byte [edi + 0x11], 0
je 0x4186f0
push 1
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [edi + 0x10], 0
je 0x418707
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [edi + 8]
push eax
push 0x520730
call fcn.00418560
pop ecx
pop ecx
mov edi, ebp
test ebp, ebp
jne 0x4186d2
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x418c40
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x4e7fd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov esi, eax
cmp ebx, 0xffffffff
jne 0x418c5e
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
lea ebp, [eax + eax]
add ecx, ebp
lea eax, [edx - 4]
cmp ecx, eax
jl 0x418c82
lea eax, [ecx + 0x4000]
mov dword [esi + 4], eax
add eax, 0xa
jmp 0x418c9d
cmp edx, 0x100000
jle 0x418cb0
cmp ecx, 0x100000
jge 0x418c97
mov ecx, 0x100000
mov dword [esi + 4], ecx
lea eax, [ecx + 0xa]
push eax
push dword [esi]
push 0
push dword [0x5206f4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi], eax
lea eax, [ebx + ebp]
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
pop ebp
add eax, ebx
pop ebx
ret 8

Function at 0x418cd0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4e7fd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
neg ecx
add ecx, ecx
add dword [eax + 8], ecx
ret 4
Function at 0x41b330
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4e7fd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov eax, dword [esp + 4]
mov edx, dword [ecx]
cmp eax, edx
jb 0x41b357
mov ecx, dword [ecx + 8]
add ecx, edx
cmp eax, ecx
ja 0x41b357
sub eax, edx
inc eax
ret 4
xor eax, eax
ret 4

Function at 0x41b360
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4e7fd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
mov eax, dword [esp + 4]
dec eax
add eax, ecx
ret 4

Function at 0x4222f9
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [0x51f044]
xor edi, edi
call fcn.00417b88
mov ebx, eax
cmp dword [ebp + 0xc], edi
je 0x4223e3
push esi
push 0x60
push 8
push dword [0x4e8c1c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 0xc]
mov esi, eax
or dword [esi + 4], 0xffffffff
mov dword [esi], 1
call fcn.004263d3
mov dword [esi + 8], eax
mov dword [esp], str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
call fcn.004263d3
pop ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ecx
mov eax, dword [ebx]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 4]
mov ebx, dword [ebp + 0x14]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], eax
test cl, 1
je 0x4223d3
test ebx, ebx
je 0x4223a1
push ebx
push edi
push dword [0x4e8c1c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x48], eax
test eax, eax
je 0x42239c
push ebx
push dword [ebp + 0x10]
push eax
call fcn.00418f20
add esp, 0xc
cmp dword [esi + 0x48], edi
je 0x4223ca
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push 0x4228f5
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4223c5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4223e0
cmp dword [ebp + 0xc], edi
jne 0x4223e0
push esi
call fcn.00405bda
pop ecx
jmp 0x4223e2
mov eax, dword [ebp + 0x10]
push esi
mov dword [esi + 0x48], eax
call fcn.004224f7
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x423dcd
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x188
push 8
push dword [0x4e8c1c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x520610]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x520614], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00433219
mov dword [esi + 0x58], 0x424ffb
mov eax, esi
mov dword [esi + 0x5c], 0x425047
mov dword [esi + 0x10], fcn.00423f34
mov dword [esi + 0x30], 0x4240c0
mov dword [esi + 0x64], 0x4242d7
mov dword [esi + 0x60], 0x42432f
mov dword [esi + 0x34], 0x424969
mov dword [esi + 0x24], 0x42481b
mov dword [esi + 0x28], 0x424844
mov dword [esi + 0x2c], 0x42486f
mov dword [esi + 0x44], 0x424df0
mov dword [esi + 0x68], 0x423ebf
mov dword [esi + 0x6c], 0x423f1e
pop esi
ret 4

Function at 0x425cd7
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp + 8]
or eax, 0x4000
push eax
push 0x2b4
lea eax, [ebp - 0x4bc]
push eax
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
leave
ret 4

Function at 0x425d1a
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x5207e0], 0
jne 0x425deb
push ebx
push ebp
push esi
xor ebp, ebp
inc ebp
push 0x520d00
mov dword [0x5207e0], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, 0x640
push eax
push 8
push dword [0x4e8c1c]
mov dword [0x520ca4], eax
mov dword [0x5207e4], 0x1f4
call esi
mov dword [0x520cb4], eax
mov eax, dword [0x5207e4]
add eax, eax
push eax
push 8
push dword [0x4e8c1c]
call esi
xor ebx, ebx
mov dword [0x520cb0], eax
push 0x520cc0
mov dword [0x520ca8], ebx
mov dword [0x520cac], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebp
push ebx
call esi
push ebx
push ebx
push ebp
push ebx
mov dword [0x520cd8], eax
call esi
mov dword [0x520cdc], eax
cmp dword [0x520cd8], ebx
je 0x425de2
test eax, eax
je 0x425de2
lea eax, [esp + 0xc]
mov dword [0x520cb8], ebx
push eax
push ebx
push ebx
push 0x4260af
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x520cbc], eax
jmp 0x425de8
mov dword [0x520cb8], ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x426fdf
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x427075
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x427072
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x427072
lea eax, [esi - 1]
push eax
push dword [0x520d30]
call fcn.00418de7
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x427074
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x427062
mov edx, 0xfa01
cmp word [ecx], dx
je 0x42706d
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x427052
jmp 0x427072
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x42711b
push eax
call esi
test al, al
jns 0x42711b
push 0x11
call esi
test al, al
js 0x42711b
push 0x10
call esi
test al, al
js 0x42711b
push 0x12
call esi
test al, al
js 0x42711b
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x42711b
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.0042a2b8
add esp, 0xc
test eax, eax
je 0x4270ef
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.0042a2b8
add esp, 0xc
test eax, eax
jne 0x427106
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x42715c
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call fcn.00419494
pop ecx
pop ecx
test eax, eax
je 0x42715c
test ebp, ebp
je 0x42713f
push 0x11
call esi
test al, al
js 0x427137
push 0x10
call esi
test al, al
js 0x427137
push 0x12
call esi
test al, al
jns 0x42713f
push 1
push ebp
call fcn.00427280
test ebx, ebx
je 0x427153
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x42715c
test edi, edi
je 0x42715c
mov eax, dword [edi + 8]
jmp 0x42715e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x4274a0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x42759f
cmp word [edx], 0
je 0x42759f
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x4274ce
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x427524
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4274e0
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x427506
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.0043a4b0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
xor eax, eax
cmp ecx, 2
push edx
setne al
dec eax
and eax, 0xfde9
push eax
call fcn.0043a5d0
mov edi, eax
test edi, edi
je 0x42751a
cmp dword [esi + 4], 0
je 0x427572
push dword [esp + 0x14]
push edi
push esi
call fcn.0043a4b0
push edi
push 0
push dword [0x4e8c1c]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x4e8c1c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x429017
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0042a220
mov eax, dword [0x4e81c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0042f530
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x429059
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4291b5
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00426c00
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5210f8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0043b579
mov ecx, dword [esi*4 + 0x5210f8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x4291ae
cmp eax, dword [ecx + edi + 0x24]
jne 0x4291ae
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4291ae
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0043b579
add esp, 0x14
test edx, edx
jl 0x4291ae
jg 0x429124
test eax, eax
jb 0x4291ae
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4291ae
jl 0x42913e
cmp dword [ebp - 0x1008], eax
ja 0x4291ae
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x42915c
test ebx, ebx
je 0x429195
cmp ecx, edi
jae 0x429195
mov al, byte [ecx]
cmp al, 0xd
jne 0x429176
lea eax, [edi - 1]
cmp ecx, eax
jae 0x429182
cmp byte [ecx + 1], 0xa
jne 0x429182
inc ecx
jmp 0x429182
movzx eax, al
movsx eax, byte [eax + 0x4e81f8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x42915c
cmp edx, ebx
jne 0x42915c
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4291b3
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042fae0
leave
ret

Function at 0x429610
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x429648
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x429643
xor eax, eax
cmp dword [esp + 0xc], esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.00418f20
add dword [edi + 8], esi
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret