joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4148cb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x414943
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.00419c36
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.004182de
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x414924
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x414921
cmp ecx, 0x5c
je 0x414921
cmp ecx, 0x2f
jne 0x41492e
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x41490e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x414945
xor eax, eax
leave
ret 4

Function at 0x414d66
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x46e318]
push esi
test eax, eax
jne 0x414d8b
push fcn.00414d34
push 0x10
push 0x258
call fcn.00417901
mov dword [0x46e318], eax
push dword [esp + 0xc]
push eax
call fcn.004177e1
mov esi, eax
test esi, esi
je 0x414e8c
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x414dad
mov edi, 0x455c34
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x414dbd
xor eax, eax
cmp word [ebx], ax
jne 0x414dc2
mov ebx, 0x455ba8
push edi
call fcn.004182de
push ebx
mov dword [esp + 0x24], eax
call fcn.004182de
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x414e73
push edi
push eax
call fcn.004182bc
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x414e23
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x414e27
push 0x454d88
push edi
call fcn.00419c05
pop ecx
pop ecx
jmp 0x414e27
mov edi, dword [esp + 0x18]
push ebx
push edi
call fcn.00419c05
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x414e4b
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x414e61
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x414e5f
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x414e8a
cmp dword [esp + 0x14], 0xffffffff
je 0x414e7e
mov esi, dword [esp + 0x14]
push esi
push dword [0x46e318]
call fcn.004178c7
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x414ed7
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x41501f
xor ecx, ecx
cmp word [eax], cx
je 0x41501f
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00419c36
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call fcn.004182de
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x414f30
cmp eax, 3
jne 0x414f6a
cmp word [esp + 0xa], 0x3a
jne 0x414f6a
cmp eax, 2
jne 0x414f4e
lea eax, [esp + 8]
push 0x454d88
push eax
call fcn.00419c05
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41501f
push 0xfffffffffffffffe
pop edi
jmp 0x41501f
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x414f7f
cmp ax, bx
jne 0x414f89
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x414f72
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x414fc8
test byte [esp + 0x21c], 0x10
je 0x414faf
push 0xfffffffffffffffe
pop edi
jmp 0x414fbf
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41501d
cmp word [esp + 0x10], bp
jne 0x414fd6
cmp word [esp + 0x12], bp
je 0x414ff5
cmp word [esp + 0x10], bx
jne 0x414fe4
cmp word [esp + 0x12], bx
je 0x414ff5
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x41501d
cmp word [esp + 0x12], ax
jne 0x41501d
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x41500a
test al, 0x10
je 0x41501d
jmp 0x41501a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41501d
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x415160
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x41519c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x4151b0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
jne 0x4151c9
push dword [0x46e31c]
call fcn.00417e6a
pop edi
ret 4
push esi
push edi
push dword [0x46e31c]
call fcn.0041785e
mov esi, eax
test esi, esi
je 0x415233
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41521f
cmp dword [esi + 0x14], 0
mov dword [esp + 0xc], 0
jne 0x41520e
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
push dword [esi + 4]
push 0
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0x46e31c]
call fcn.004178c7
pop esi
pop edi
ret 4

Function at 0x415620
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x46e31c]
call fcn.0041785e
mov esi, eax
test esi, esi
je 0x41569f
cmp dword [esi + 4], 0
je 0x415670
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.00425fa0
test eax, eax
je 0x415664
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4156aa
cmp dword [esp + 8], 0
je 0x4156aa
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x415b90
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x415c8f
cmp word [edx], 0
je 0x415c8f
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x415bbe
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x415c14
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415bd0
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x415bf6
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.004265a0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
xor eax, eax
cmp ecx, 2
push edx
setne al
dec eax
and eax, 0xfde9
push eax
call fcn.004266c0
mov edi, eax
test edi, edi
je 0x415c0a
cmp dword [esi + 4], 0
je 0x415c62
push dword [esp + 0x14]
push edi
push esi
call fcn.004265a0
push edi
push 0
push dword [0x46c694]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x419ad0
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x419b25
push dword [esp + 0x10]
push 0x419b84
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [0x46e3b0]
test edi, edi
je 0x419b7e
xor esi, esi
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x419b1d
cmp byte [edi + 0x10], 0
je 0x419b1d
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, ebx
test ebx, ebx
jne 0x419af9
jmp 0x419b7e
mov edi, dword [0x46e3b0]
test edi, edi
je 0x419b7e
xor esi, esi
push ebp
mov ebp, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x419b77
cmp byte [edi + 0x11], 0
je 0x419b50
push 1
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [edi + 0x10], 0
je 0x419b67
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [edi + 8]
push eax
push 0x46e3b0
call fcn.00419d9f
pop ecx
pop ecx
mov edi, ebp
test ebp, ebp
jne 0x419b32
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x419ddf
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x419e9e
cmp dword [esp + 0x24], 2
je 0x419e9e
push 0x2000
push ebp
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x419e6d
cmp dword [esp + 0x18], 2
jne 0x419e89
cmp dword [esp + 0x28], 0xffffffff
je 0x419e31
cmp ebp, dword [esp + 0x28]
jae 0x419e89
add ebp, 2
test ebx, ebx
jne 0x419e56
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x419e89
cmp ax, 0xd
je 0x419e6d
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x419e1d
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.0041bce0
jmp 0x419f30
push eax
push 0
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x419ebc
cmp ebp, dword [esp + 0x28]
jae 0x419f14
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419f14
cmp dword [esp + 0x18], 1
jne 0x419f14
inc ebp
test ebx, ebx
jne 0x419f01
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x419f14
cmp al, 0xd
je 0x419eaf
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x419eaf
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x419f2b
call fcn.0041bb00
jmp 0x419f30
call fcn.0041bc80
push esi
push 0
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10

Function at 0x419f78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x419fdc
cmp dword [ebp + 0x10], 0x18
push esi
jne 0x419f99
call fcn.0041ba60
mov esi, eax
push esi
call fcn.0041b9d0
jmp 0x419fad
cmp dword [ebp + 0x10], 2
jne 0x419fa6
call fcn.0041bbf0
jmp 0x419f8f
call fcn.004182de
add eax, eax
pop ecx
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
mov eax, dword [ebp + 8]
push esi
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0x10], 0x18
jne 0x419fd0
push esi
call fcn.0041baf0
jmp 0x419fdc
cmp dword [ebp + 0x10], 2
jne 0x419fdc
push esi
call fcn.0041baf0
pop esi
pop ebp
ret 0xc
Function at 0x420564
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
push ebx
push esi
mov esi, dword [esp + 0x48]
xor ebx, ebx
push edi
push 0x40
pop edi
cmp dword [esi + 0xc], ebx
jne 0x4206f9
push ebp
push 0x100
push ebx
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push ebx
push 4
mov dword [esi + 0xc], eax
pop eax
push eax
push dword [esi]
mov dword [esi + 0x14], ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x14], ebx
cmp dword [esi + 0x1c], 0x706c7a31
lea eax, [esp + 0x50]
push ebx
push eax
jne 0x420602
push 0x18
lea eax, [esp + 0x40]
push eax
push dword [esi]
call ebp
cmp dword [esp + 0x50], 0x18
jne 0x4206f8
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov ax, word [esp + 0x44]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov word [esp + 0x30], ax
jmp 0x420618
push 0x12
lea eax, [esp + 0x2c]
push eax
push dword [esi]
call ebp
cmp dword [esp + 0x50], 0x12
jne 0x4206f8
cmp dword [esi + 0x14], edi
jl 0x42063a
add edi, 0x40
mov eax, edi
shl eax, 2
push eax
push dword [esi + 0xc]
push 8
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi + 0xc], eax
movsx eax, word [esp + 0x30]
add eax, 0x19
push eax
push ebx
push dword [0x46c694]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x20]
mov ebx, eax
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x50]
push 0
push eax
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
movsx eax, word [esp + 0x38]
push eax
lea eax, [ebx + 0x18]
push eax
push dword [esi]
call ebp
movsx eax, word [esp + 0x30]
mov byte [eax + ebx + 0x18], 0
cmp dword [esi + 0x1c], 0x706c7a31
movsx eax, word [esp + 0x30]
jne 0x42069f
add eax, 0x18
jmp 0x4206a2
add eax, 0x12
add eax, dword [esp + 0x10]
mov ecx, eax
push 0
pop eax
adc eax, dword [esp + 0x14]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], ecx
add ecx, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
adc eax, dword [esp + 0x2c]
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
push 1
mov dword [eax + ecx*4], ebx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
inc dword [esi + 0x14]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push ecx
push dword [esi]
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
jmp 0x4205b1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3c
ret
Function at 0x420fea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x420ffe
mov esi, ebx
jmp 0x421010
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x4210fe
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x4210f3
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.004011c0
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x4210f2
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x4210f2
mov ebp, dword [esp + 0x10]
push 3
pop ebx
movzx ecx, byte [ebp + 1]
xor edx, edx
movzx eax, byte [ebp + 2]
add eax, ecx
movzx ecx, byte [ebp]
add eax, ecx
div ebx
mov byte [ebp], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebp, dword [esp + 0x10]
add ebp, ebx
mov dword [esp + 0x10], ebp
sub edi, 1
jne 0x4210b6
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x4210fe
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x422c32
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x422db6
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x422d99
sub eax, 1
jne 0x422db6
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.00422dc2
pop ecx
test eax, eax
je 0x422ca6
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
cmp byte [esp + 0x23a], 1
jmp 0x422cd7
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x422db6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp byte [esp + 0x356], 1
jne 0x422cdc
xor edi, edi
inc edi
sub ecx, 3
je 0x422d95
sub ecx, 1
je 0x422d91
sub ecx, 1
je 0x422d6c
sub ecx, 1
je 0x422d1c
sub ecx, 4
jne 0x422db6
test eax, eax
jne 0x422db6
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x422db6
sub eax, 0
je 0x422d5e
sub eax, 1
je 0x422d50
sub eax, 1
je 0x422d42
sub eax, 1
jne 0x422db6
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x422db6
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x422db6
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x422db6
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x422db6
sub eax, 0
je 0x422d8d
sub eax, 1
je 0x422d89
sub eax, 1
jne 0x422db6
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x422db6
push 0x3c
jmp 0x422db5
push 0x32
jmp 0x422db5
push 0x14
jmp 0x422db5
push 5
jmp 0x422db5
mov eax, dword [esp + 0x14]
test eax, eax
je 0x422db3
cmp eax, 0xa
je 0x422daf
cmp eax, 0x5a
jne 0x422db6
push 0x28
jmp 0x422db5
push 0x1e
jmp 0x422db5
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x423518
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4235ae
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4235ab
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4235ab
lea eax, [esi - 1]
push eax
push dword [0x46e444]
call fcn.0041785e
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4235ad
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x42359b
mov edx, 0xfa01
cmp word [ecx], dx
je 0x4235a6
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x42358b
jmp 0x4235ab
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x423654
push eax
call esi
test al, al
jns 0x423654
push 0x11
call esi
test al, al
js 0x423654
push 0x10
call esi
test al, al
js 0x423654
push 0x12
call esi
test al, al
js 0x423654
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x423654
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.00425e58
add esp, 0xc
test eax, eax
je 0x423628
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.00425e58
add esp, 0xc
test eax, eax
jne 0x42363f
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x423695
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call fcn.004197b4
pop ecx
pop ecx
test eax, eax
je 0x423695
test ebp, ebp
je 0x423678
push 0x11
call esi
test al, al
js 0x423670
push 0x10
call esi
test al, al
js 0x423670
push 0x12
call esi
test al, al
jns 0x423678
push 1
push ebp
call fcn.004237b9
test ebx, ebx
je 0x42368c
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x423695
test edi, edi
je 0x423695
mov eax, dword [edi + 8]
jmp 0x423697
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x424bf8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004374a0
mov eax, dword [0x46bf78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0043522e
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x424c3a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x424d96
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004373f0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x46e9b8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00436f73
mov ecx, dword [esi*4 + 0x46e9b8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x424d8f
cmp eax, dword [ecx + edi + 0x24]
jne 0x424d8f
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x424d8f
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00436f73
add esp, 0x14
test edx, edx
jl 0x424d8f
jg 0x424d05
test eax, eax
jb 0x424d8f
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x424d8f
jl 0x424d1f
cmp dword [ebp - 0x1008], eax
ja 0x424d8f
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x424d3d
test ebx, ebx
je 0x424d76
cmp ecx, edi
jae 0x424d76
mov al, byte [ecx]
cmp al, 0xd
jne 0x424d57
lea eax, [edi - 1]
cmp ecx, eax
jae 0x424d63
cmp byte [ecx + 1], 0xa
jne 0x424d63
inc ecx
jmp 0x424d63
movzx eax, al
movsx eax, byte [eax + 0x46bf80]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x424d3d
cmp edx, ebx
jne 0x424d3d
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x424d94
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043526a
leave
ret

Function at 0x425200
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x425238
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x425233
xor eax, eax
cmp dword [esp + 0xc], esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.00419240
add dword [edi + 8], esi
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret