joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4084ea
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x108
push ebx
push ebp
mov ebp, 0x200
test ebp, eax
push edi
je 0x408503
or dword [esi + 0x248], 8
test ax, 0x400
je 0x408510
or dword [esi + 0x248], 1
mov edi, pe_nt_image_headers32
test edi, eax
je 0x408520
or dword [esi + 0x248], 2
mov eax, dword [esi + 0x248]
test al, 8
mov ebx, 0x800
je 0x40853c
test ebx, eax
je 0x40853c
xor eax, 8
mov dword [esi + 0x248], eax
mov eax, dword [esi + 0x248]
test al, 1
je 0x408553
test edi, eax
je 0x408553
xor eax, 1
mov dword [esi + 0x248], eax
mov eax, dword [esi + 0x248]
test al, 2
je 0x40856a
test ebp, eax
je 0x40856a
xor eax, 2
mov dword [esi + 0x248], eax
mov eax, dword [esi + 0x248]
test al, 0x10
je 0x408583
test ax, 0x1000
je 0x408583
xor eax, 0x10
mov dword [esi + 0x248], eax
cmp dword [esi + 0x24c], 0
je 0x4085de
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [esi + 0x248]
test ebx, eax
jne 0x4085a6
mov byte [esp + 0x21], 0
test edi, eax
jne 0x4085af
mov byte [esp + 0x22], 0
test ebp, eax
jne 0x4085c3
mov ecx, dword [esi + 0x258]
mov byte [esp + 0x20], 0
mov byte [esp + ecx + 0x10], 0
test ax, 0x1000
jne 0x4085ce
mov byte [esp + 0x6b], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x4086d4
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call ebp
mov edi, 0x8000
test di, ax
jne 0x4085ff
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x408613
test dword [esi + 0x248], ebx
jne 0x408613
push 0
push 0x11
pop eax
mov ecx, esi
call fcn.00408f16
push 0x12
call ebp
test di, ax
jne 0x408629
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x408640
test word [esi + 0x248], 0x100
jne 0x408640
push 0
push 0x12
pop eax
mov ecx, esi
call fcn.00408f16
push dword [esi + 0x258]
call ebp
test di, ax
jne 0x40865e
push dword [esi + 0x258]
call dword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x408678
test word [esi + 0x248], 0x200
jne 0x408678
mov eax, dword [esi + 0x258]
push 0
mov ecx, esi
call fcn.00408f16
mov ebx, 0xa1
push ebx
call ebp
test di, ax
jne 0x408691
push ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x4086a7
test word [esi + 0x248], 0x400
jne 0x4086a7
push 0
mov eax, ebx
mov ecx, esi
call fcn.00408f16
push 0x5b
call ebp
test di, ax
jne 0x4086bd
push 0x5b
call dword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x4086d4
test word [esi + 0x248], 0x1000
jne 0x4086d4
push 0
push 0x5b
pop eax
mov ecx, esi
call fcn.00408f16
pop edi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x4086de
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
and dword [esp], 0
push ebx
mov ebx, dword [esp + 0x10c]
cmp dword [ebx + 0x24c], 0
je 0x408797
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov al, 0x80
cmp byte [esp + 0x19], al
jne 0x408723
test word [ebx + 0x248], 0x800
jne 0x408723
mov dword [esp + 4], 8
cmp byte [esp + 0x1a], al
jne 0x408739
test word [ebx + 0x248], 0x100
jne 0x408739
or dword [esp + 4], 1
mov ecx, dword [ebx + 0x258]
cmp byte [esp + ecx + 8], al
je 0x40874b
cmp byte [esp + 0x18], al
jne 0x40875b
test word [ebx + 0x248], 0x200
jne 0x40875b
or dword [esp + 4], 2
cmp byte [esp + 0xa9], al
jne 0x408774
test word [ebx + 0x248], 0x400
jne 0x408774
or dword [esp + 4], 4
cmp byte [esp + 0x63], al
jne 0x408879
test word [ebx + 0x248], 0x1000
jne 0x408879
or dword [esp + 4], 0x10
jmp 0x408879
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x4087bd
push 0x11
call ebp
test si, ax
je 0x4087d0
test word [ebx + 0x248], 0x800
jne 0x4087d0
mov dword [esp + 0x10], 8
push 0x12
call edi
test si, ax
jne 0x4087e2
push 0x12
call ebp
test si, ax
je 0x4087f2
test word [ebx + 0x248], 0x100
jne 0x4087f2
or dword [esp + 0x10], 1
add ebx, 0x258
push dword [ebx]
call edi
test si, ax
jne 0x40880a
push dword [ebx]
call ebp
test si, ax
je 0x408821
mov eax, dword [esp + 0x118]
test word [eax + 0x248], 0x200
jne 0x408821
or dword [esp + 0x10], 2
mov ebx, 0xa1
push ebx
call edi
test si, ax
jne 0x408836
push ebx
call ebp
test si, ax
je 0x40884d
mov eax, dword [esp + 0x118]
test word [eax + 0x248], 0x400
jne 0x40884d
or dword [esp + 0x10], 4
push 0x5b
call edi
test si, ax
jne 0x40885f
push 0x5b
call ebp
test si, ax
je 0x408876
mov eax, dword [esp + 0x118]
test word [eax + 0x248], 0x1000
jne 0x408876
or dword [esp + 0x10], 0x10
pop edi
pop esi
pop ebp
mov eax, dword [esp + 4]
pop ebx
add esp, 0x104
ret 4
Function at 0x40899f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
mov ebx, dword [ebp + 8]
test bl, 0x1f
push edi
je 0x408bb9
mov eax, dword [esi + 0x24c]
test eax, eax
je 0x408b2b
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x408b2b
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, ebx
and edi, 0x10
mov cl, 0x80
je 0x4089ef
or byte [ebp - 0xb9], cl
mov dword [ebp - 0x10], ebx
and dword [ebp - 0x10], 2
je 0x408a0d
mov eax, dword [esi + 0x258]
or byte [ebp - 0x104], cl
lea eax, [ebp + eax - 0x114]
or byte [eax], cl
mov dword [ebp - 0x14], ebx
and dword [ebp - 0x14], 4
je 0x408a1f
or byte [ebp - 0x104], cl
or byte [ebp - 0x73], cl
mov dword [ebp - 8], ebx
and dword [ebp - 8], 8
je 0x408a2e
or byte [ebp - 0x103], cl
mov dword [ebp - 0xc], ebx
and dword [ebp - 0xc], 1
je 0x408a3d
or byte [ebp - 0x102], cl
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
test edi, edi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
mov ebx, pe_nt_image_headers32
je 0x408a72
movzx eax, byte [esi + 0x255]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push ebx
push dword [esi + 0x24c]
call edi
cmp dword [ebp - 0x10], 0
je 0x408a95
movzx eax, byte [esi + 0x253]
shl eax, 0x10
or eax, 1
push eax
push dword [esi + 0x258]
push ebx
push dword [esi + 0x24c]
call edi
cmp dword [ebp - 0x14], 0
je 0x408ab4
movzx eax, byte [esi + 0x254]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push ebx
push dword [esi + 0x24c]
call edi
cmp dword [ebp - 8], 0
je 0x408ad3
movzx eax, byte [esi + 0x250]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push ebx
push dword [esi + 0x24c]
call edi
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x408bb0
cmp dword [ebp - 8], eax
jne 0x408b04
test word [ebp + 8], 0x800
jne 0x408b04
movzx eax, byte [esi + 0x251]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x408b1e
cmp dword [ebp - 0xc], eax
je 0x408bb0
movzx eax, byte [esi + 0x251]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push ebx
push dword [esi + 0x24c]
call edi
jmp 0x408bb0
test bl, 0x10
je 0x408b43
movzx eax, byte [esi + 0x255]
push eax
push 0x5b
xor ebx, ebx
mov eax, esi
call fcn.004082d0
test byte [ebp + 8], 2
je 0x408b62
movzx eax, byte [esi + 0x253]
push eax
movzx eax, byte [esi + 0x258]
push eax
xor ebx, ebx
mov eax, esi
call fcn.004082d0
test byte [ebp + 8], 4
je 0x408b7e
movzx eax, byte [esi + 0x254]
push eax
push 0xa1
xor ebx, ebx
mov eax, esi
call fcn.004082d0
test byte [ebp + 8], 8
je 0x408b97
movzx eax, byte [esi + 0x250]
push eax
push 0x11
xor ebx, ebx
mov eax, esi
call fcn.004082d0
test byte [ebp + 8], 1
je 0x408bb0
movzx eax, byte [esi + 0x251]
push eax
push 0x12
xor ebx, ebx
mov eax, esi
call fcn.004082d0
mov edi, dword [esi + 4]
push esi
call fcn.004094b7
pop edi
pop ebx
leave
ret 4
Function at 0x408bbf
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
test byte [ebp + 8], 0x1f
push ebx
push edi
je 0x408dd8
mov eax, dword [esi + 0x24c]
test eax, eax
je 0x408d52
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x408d52
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
and eax, 1
mov dword [ebp - 0x10], eax
mov ebx, 0x101
je 0x408c3b
test byte [ebp + 8], 8
jne 0x408c3b
test word [ebp + 8], 0x800
jne 0x408c3b
movzx eax, byte [esi + 0x251]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x408c52
test eax, eax
je 0x408c5a
movzx eax, byte [esi + 0x251]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push ebx
push dword [esi + 0x24c]
call edi
mov eax, dword [ebp + 8]
and eax, 8
mov dword [ebp - 8], eax
je 0x408c80
movzx eax, byte [esi + 0x250]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push ebx
push dword [esi + 0x24c]
call edi
mov eax, dword [ebp + 8]
and eax, 2
mov dword [ebp - 0xc], eax
je 0x408caa
movzx eax, byte [esi + 0x253]
shl eax, 0x10
or eax, 0xc0000001
push eax
push dword [esi + 0x258]
push ebx
push dword [esi + 0x24c]
call edi
mov eax, dword [ebp + 8]
and eax, 4
mov dword [ebp - 0x14], eax
je 0x408cd0
movzx eax, byte [esi + 0x254]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push ebx
push dword [esi + 0x24c]
call edi
mov eax, dword [ebp + 8]
and eax, 0x10
mov dword [ebp + 8], eax
je 0x408cf6
movzx eax, byte [esi + 0x255]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push ebx
push dword [esi + 0x24c]
call edi
xor edx, edx
cmp dword [ebp + 8], edx
mov cl, 0x80
je 0x408d05
xor byte [ebp - 0xb9], cl
cmp dword [ebp - 0xc], edx
je 0x408d1f
mov eax, dword [esi + 0x258]
xor byte [ebp - 0x104], cl
lea eax, [ebp + eax - 0x114]
xor byte [eax], cl
cmp dword [ebp - 0x14], edx
je 0x408d2d
xor byte [ebp - 0x104], cl
xor byte [ebp - 0x73], cl
cmp dword [ebp - 8], edx
je 0x408d38
xor byte [ebp - 0x103], cl
cmp dword [ebp - 0x10], edx
je 0x408d43
xor byte [ebp - 0x102], cl
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x408dd0
test byte [ebp + 8], 1
push 2
pop ebx
je 0x408d6c
movzx eax, byte [esi + 0x251]
push eax
push 0x12
mov eax, esi
call fcn.004082d0
test byte [ebp + 8], 8
je 0x408d83
movzx eax, byte [esi + 0x250]
push eax
push 0x11
mov eax, esi
call fcn.004082d0
test byte [ebp + 8], bl
je 0x408d9f
movzx eax, byte [esi + 0x253]
push eax
movzx eax, byte [esi + 0x258]
push eax
mov eax, esi
call fcn.004082d0
test byte [ebp + 8], 4
je 0x408db9
movzx eax, byte [esi + 0x254]
push eax
push 0xa1
mov eax, esi
call fcn.004082d0
test byte [ebp + 8], 0x10
je 0x408dd0
movzx eax, byte [esi + 0x255]
push eax
push 0x5b
mov eax, esi
call fcn.004082d0
mov edi, dword [esi]
push esi
call fcn.004094b7
pop edi
pop ebx
leave
ret 4
Function at 0x408e03
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov ebx, eax
push 0
push ebx
mov edi, ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [edi + 0x24c], 0
mov esi, eax
je 0x408ed9
cmp ebx, 0x14
je 0x408ed9
cmp ebx, 0x90
je 0x408ed9
cmp ebx, 0x91
je 0x408ed9
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
or byte [ebp + ebx - 0x104], 0x80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor edx, edx
shl esi, 0x10
inc edx
or esi, edx
cmp byte [ebp + 8], dl
je 0x408e8f
cmp ebx, 0x2d
je 0x408e89
mov eax, ebx
call fcn.00408887
jmp 0x408e8b
mov al, dl
cmp al, dl
jne 0x408e95
or esi, 0x1000000
mov ecx, dword [edi + 0x248]
test dl, cl
mov eax, pe_nt_image_headers32
jne 0x408ead
test eax, ecx
jne 0x408ead
cmp ebx, 0x12
jne 0x408ec8
test cl, 8
jne 0x408ec8
test cx, 0x800
jne 0x408ec8
or esi, 0x20000000
push esi
push ebx
push 0x104
jmp 0x408ecb
push esi
push ebx
push eax
push dword [edi + 0x24c]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x408f06
xor edx, edx
inc edx
cmp byte [ebp + 8], dl
je 0x408efb
cmp ebx, 0x2d
je 0x408eef
mov eax, ebx
call fcn.00408887
jmp 0x408ef1
mov al, dl
cmp al, dl
je 0x408efb
push esi
push ebx
xor ebx, ebx
jmp 0x408eff
push esi
push ebx
mov ebx, edx
mov eax, edi
call fcn.004082d0
push edi
mov edi, dword [edi + 4]
call fcn.004094b7
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x408f16
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov ebx, eax
push 0
push ebx
mov edi, ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [edi + 0x24c], 0
mov esi, eax
je 0x408fef
cmp ebx, 0x14
je 0x408fef
cmp ebx, 0x90
je 0x408fef
cmp ebx, 0x91
je 0x408fef
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
shl esi, 0x10
or esi, 0xc0000001
cmp byte [ebp + 8], 1
je 0x408f8f
cmp ebx, 0x2d
je 0x408f89
mov eax, ebx
call fcn.00408887
jmp 0x408f8b
mov al, 1
cmp al, 1
jne 0x408f95
or esi, 0x1000000
mov eax, dword [edi + 0x248]
test al, 1
jne 0x408faa
test ax, 0x100
jne 0x408faa
cmp ebx, 0x12
jne 0x408fc3
test al, 8
jne 0x408fc3
test ax, 0x800
jne 0x408fc3
or esi, 0x20000000
push esi
push ebx
push 0x105
jmp 0x408fca
push esi
push ebx
push 0x101
push dword [edi + 0x24c]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp + ebx - 0x104]
xor byte [eax], 0x80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x40901b
cmp byte [ebp + 8], 1
je 0x40900f
cmp ebx, 0x2d
je 0x409003
mov eax, ebx
call fcn.00408887
jmp 0x409005
mov al, 1
cmp al, 1
je 0x40900f
push esi
push ebx
push 2
jmp 0x409013
push esi
push ebx
push 3
pop ebx
mov eax, edi
call fcn.004082d0
push edi
mov edi, dword [edi]
call fcn.004094b7
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4094b7
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
test edi, edi
push esi
jl 0x40954b
jne 0x4094cf
push 0
jmp 0x409545
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x21d]
neg al
sbb eax, eax
and eax, 0x28
add eax, 0xf
cmp edi, eax
jae 0x409544
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call esi
test eax, eax
je 0x409544
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 8]
push eax
call esi
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sbb ecx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
fild qword [esp + 0x18]
fild qword [esp + 0x20]
fdivp st(1)
fmul qword [0x4713d0]
call fcn.00465256
cmp eax, edi
jb 0x409502
jmp 0x40954b
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x409552
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
cmp word [eax], bx
push esi
mov esi, ecx
mov byte [ebp - 1], 1
mov dword [ebp - 0xc], ebx
jne 0x409571
xor al, al
jmp 0x40968e
push eax
or eax, 0xffffffff
call fcn.0040df0e
mov ecx, dword [ebp + 0x10]
mov byte [ecx], bl
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x10], eax
mov byte [edi], bl
mov byte [esi], bl
mov byte [ecx], bl
call fcn.0044ff70
inc eax
push eax
call fcn.0044de32
add esp, 0xc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov al, byte [ecx + ebx]
cmp al, 0x2b
je 0x4095b8
cmp al, 0x5e
je 0x4095b4
cmp al, 0x21
je 0x4095b4
cmp al, 0x23
jne 0x4095dc
cmp al, 0x2b
jne 0x4095bd
mov eax, dword [ebp + 0xc]
jmp 0x4095cd
cmp al, 0x5e
jne 0x4095c6
mov byte [esi], 1
jmp 0x4095d9
cmp al, 0x21
jne 0x4095d2
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x4095d9
cmp al, 0x23
jne 0x4095d9
mov byte [edi], 1
inc ebx
jmp 0x40959e
mov al, byte [ecx + ebx]
inc ebx
cmp al, 0x7b
mov byte [ebp - 0x18], al
mov dword [ebp - 0x14], ebx
jne 0x40963e
mov ebx, dword [ebp - 8]
lea edx, [ebp - 0x14]
mov esi, ecx
add al, 2
call fcn.0040947a
test eax, eax
jne 0x40962a
mov esi, dword [ebp - 0xc]
push ebx
push dword [esi*4 + 0x4774a0]
call fcn.00462f65
test eax, eax
pop ecx
pop ecx
je 0x40961c
inc esi
cmp esi, 0x62
mov dword [ebp - 0xc], esi
jl 0x4095fd
cmp esi, 0x62
je 0x40962a
cmp byte [esi + 0x477628], 0
je 0x409630
mov byte [ebp - 1], 0
jmp 0x409670
mov eax, dword [esi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x409670
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov ecx, dword [ebp + 8]
movsx eax, ax
test ax, 0x200
mov dword [ecx], eax
je 0x409658
mov byte [esi], 1
test ax, 0x400
je 0x409664
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 1
test ax, 0x100
je 0x409670
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp + 8]
push dword [ebp - 0x10]
and dword [eax], 0xff
call fcn.0044de9c
push dword [ebp - 8]
call fcn.0044de9c
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop esi
pop ebx
leave
ret 0xc
Function at 0x409791
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, eax
xor ebp, ebp
cmp esi, ebp
push edi
jne 0x4097ad
push ebp
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov edi, dword [esp + 0x20]
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4097c5
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp eax, ebp
jne 0x409897
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebp
push dword [esp + 0x28]
mov ebx, eax
mov dword [esp + 0x24], ebx
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push ebx
mov dword [esp + 0x1c], eax
call esi
push 1
push edi
push ebx
call esi
push 1
push dword [esp + 0x14]
push edi
call esi
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp eax, ebp
mov dword [esp + 0x14], eax
jne 0x40987d
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ebp
push ebp
push ebp
push 0x12
call edi
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call ebx
push ebp
push 2
push ebp
push 0x12
call edi
push eax
push 0x12
call ebx
push ebp
push ebp
push ebp
push 0x12
call edi
push eax
push 0x12
call ebx
push ebp
push 2
push ebp
push 0x12
call edi
push eax
push 0x12
call ebx
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
push ebp
push dword [esp + 0x14]
push ebx
call esi
push ebp
push edi
push ebx
call esi
push ebp
push dword [esp + 0x14]
push edi
call esi
mov eax, dword [esp + 0x14]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
Function at 0x40996b
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
push edi
xor ebx, ebx
xor edi, edi
lea eax, [esi + 0x20]
cmp dword [eax], ebx
je 0x409988
inc edi
add eax, 8
cmp edi, 0x10
jl 0x40997b
cmp edi, 0x10
jne 0x409994
xor eax, eax
jmp 0x409a34
cmp byte [esi + 0x18], 1
jne 0x409a0b
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 4]
lea eax, [esi + edi*8 + 0x1c]
push ebx
push 0x438
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [esi + 8], ebx
jne 0x4099e7
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi], eax
je 0x4099e7
push str.VirtualAllocEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, ebx
jne 0x4099f3
mov eax, 0x409afe
mov ecx, dword [ebp + 0xc]
push 4
push 0x1000
push dword [ebp + 8]
lea esi, [esi + edi*8 + 0x20]
push ebx
push dword [ecx]
call eax
jmp 0x409a32
push ebx
push dword [ebp + 8]
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebx
push ebx
push ebx
push 0xf001f
mov dword [esi + edi*8 + 0x1c], eax
push eax
lea esi, [esi + edi*8 + 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi], eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40b48c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi]
test al, 3
je 0x40b50c
push ebx
xor ebx, ebx
inc ebx
test bl, al
je 0x40b4b5
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call fcn.00451428
mov eax, dword [ebp - 8]
or eax, dword [ebp - 4]
pop ecx
pop ecx
jne 0x40b50b
mov eax, dword [esi]
test al, 0x20
je 0x40b4d0
push dword [esi + 4]
push 2
push ebx
push 0x46be20
call fcn.004515f2
mov dword [esi + 0xc], ebx
jmp 0x40b508
test al, 0x40
je 0x40b4ed
push dword [esi + 4]
push 2
push ebx
push 0x46be24
call fcn.004515f2
mov dword [esi + 0xc], 2
jmp 0x40b508
test al, al
jns 0x40b50b
push dword [esi + 4]
push 3
push ebx
push str.rb
call fcn.004515f2
mov dword [esi + 0xc], 4
add esp, 0x10
pop ebx
leave
ret

Function at 0x40b540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and dword [esi + 0xc], 0
push edi
push 0x46be2c
push dword [ebp + 8]
mov byte [esi + 8], 0
call fcn.00451309
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x40b5cb
push ebx
push edi
push 3
lea eax, [ebp + 8]
push 1
push eax
call fcn.004519fe
push edi
mov ebx, eax
call fcn.004516e6
add esp, 0x14
push 2
pop eax
cmp ebx, eax
jb 0x40b5a8
cmp byte [ebp + 8], 0xff
jne 0x40b597
cmp byte [ebp + 9], 0xfe
jne 0x40b5a8
mov dword [esi + 0xc], 1
jmp 0x40b5c6
cmp byte [ebp + 8], 0xfe
jne 0x40b5a8
cmp byte [ebp + 9], 0xff
jne 0x40b5a8
mov dword [esi + 0xc], eax
jmp 0x40b5c6
cmp ebx, 3
jb 0x40b5ca
cmp byte [ebp + 8], 0xef
jne 0x40b5ca
cmp byte [ebp + 9], 0xbb
jne 0x40b5ca
cmp byte [ebp + 0xa], 0xbf
jne 0x40b5ca
mov dword [esi + 0xc], 4
mov byte [esi + 8], 1
pop ebx
pop edi
pop ebp
ret 4