joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4036cc
Capabilities:
Get common file path

Disassembly:
mov eax, 0x420714
call fcn.00420620
mov eax, 0x1428
call fcn.0040ba60
push ebx
push esi
xor esi, esi
cmp dword [0x4d32f0], 0x5b1
push edi
jne 0x403761
push esi
lea eax, [ebp - 0xc34]
push eax
push esi
push 0x402d60
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
push esi
call sub.KERNEL32.dll_GetSystemTimes
lea eax, [ebp - 0x34]
call fcn.004039c3
push esi
mov dword [ebp - 4], esi
call fcn.0040455f
call fcn.004044fd
lea ecx, [ebp - 0x18]
mov dword [esp], 0x402da0
call fcn.00403210
lea ecx, [ebp - 0x18]
call fcn.0040322c
lea ecx, [ebp - 0x18]
call fcn.00403272
lea ecx, [ebp - 0x18]
call fcn.0040328b
push esi
push esi
call fcn.0040487c
push esi
call fcn.0040484d
add esp, 0xc
push esi
call fcn.00404c95
add dword [0x4d32f0], 0x1134b
push dword [0x4d32f0]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4d2240], eax
call fcn.00403617
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x206d47
jg 0x4037aa
inc edi
cmp edi, 0x4f6a4
jl 0x40378a
mov eax, dword [0x4d32f0]
xor ecx, ecx
cmp eax, esi
jbe 0x4037d0
mov edx, dword [0x4d32f4]
mov dl, byte [edx + ecx + 0x1134b]
mov edi, dword [0x4d2240]
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jb 0x4037b5
xor edi, edi
lea ecx, [eax + edi]
cmp ecx, 0xe
jne 0x40381b
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [ebp - 0x434]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402db0
push 0x402dbc
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
mov eax, dword [0x4d32f0]
inc edi
cmp edi, 0x39621
jl 0x4037d2
call fcn.00403505
xor edi, edi
call ebx
cmp edi, 0x26
jne 0x403837
call fcn.004035fd
inc edi
cmp edi, 0x6753f
jl 0x40382b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x7b
pop ebx
cmp dword [0x4d32f0], 0x86
jne 0x403892
push 0x402de8
push 0x402e1c
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push esi
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [0x4d32f0], 0xf
jne 0x4038ba
push esi
push esi
call edi
push esi
lea eax, [ebp - 0x1434]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0x402e34
push 0x402e78
call edi
dec ebx
jne 0x403849
push 0x402ec8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40541b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422494]
jne 0x405425
repz ret
jmp fcn.00408c3c
Function at 0x463280
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4632d1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4632b8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4632a8
jmp 0x4632d1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4632b9
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47106c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044dc
xor eax, eax
push ebp
push 0x471151
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x471160
mov eax, dword [ebp - 4]
call fcn.004044ec
push eax
mov eax, dword [0x479664]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov edi, eax
push edi
mov eax, dword [0x479664]
push eax
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x411fa4]
call fcn.00403228
mov ebx, eax
mov dl, 1
mov eax, dword [0x462834]
call fcn.0046e674
mov esi, eax
push edi
mov eax, dword [0x479664]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov edi, eax
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x10]
mov ecx, edi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FreeResource
xor ecx, ecx
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
call fcn.00403258
mov eax, ebx
call fcn.00403258
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471158
lea eax, [ebp - 4]
call fcn.0040402c
ret
Function at 0x6a902480
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6a903000
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6a903000
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6a9024e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6a90b060]
test esi, esi
jle 0x6a902600
mov eax, dword [0x6a90b064]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6a902514
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6a902597
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6a902500
mov dword [esp], ebx
call fcn.6a902cc0
mov edi, eax
test eax, eax
je 0x6a902627
mov eax, dword [0x6a90b064]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6a902e00
mov edx, dword [0x6a90b064]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6a902607
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6a902590
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6a9025a0
add dword [0x6a90b060], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6a90b064]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6a902590
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6a902480
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6a90251e
mov eax, dword [0x6a90b064]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6a902480
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6a902480
lea esi, [esi]
nop
Function at 0x6a902940
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6a90b070
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6a90b068]
sub esp, 4
test ebx, ebx
je 0x6a902995
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6a90298e
test esi, esi
je 0x6a90298e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6a902970
mov dword [esp], 0x6a90b070
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6a902cc0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6a900000], 0x5a4d
jne 0x6a902ce5
mov ecx, dword [0x6a90003c]
cmp dword [ecx + 0x6a900000], 0x4550
lea edx, [ecx + 0x6a900000]
je 0x6a902cf0
ret
cmp word [ecx + 0x6a900018], 0x10b
jne 0x6a902ce5
push esi
movzx eax, word [ecx + 0x6a900014]
push ebx
movzx esi, word [ecx + 0x6a900006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6a900000
test esi, esi
je 0x6a902d38
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6a902d2e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6a902d3a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6a902d20
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40836a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push dword [esp + 0xc]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x408386
mov dword [esp], 1
jmp 0x408396
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x4084a8
mov ebx, dword [esp + 0x10]
cmp ebx, 1
je 0x4083c8
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x4083b8
mov dword [esp], 1
jmp 0x4083c8
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x4084a8
mov ebx, dword [esp + 0x14]
cmp ebx, 1
je 0x4083fa
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x4083ea
mov dword [esp], 1
jmp 0x4083fa
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x4084a8
mov ebx, dword [esp + 0x18]
cmp ebx, 1
je 0x408429
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x40841c
mov dword [esp], 1
jmp 0x408429
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x4084a8
mov ebx, dword [esp + 0x10]
cmp ebx, 1
jne 0x40844f
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x40844f
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x4084a8
mov ebx, dword [esp + 0x14]
cmp ebx, 1
jne 0x408475
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x408475
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x4084a8
mov ebx, dword [esp + 0x18]
cmp ebx, 1
jne 0x40849b
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x40849b
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x4084a8
xor edx, edx
mov eax, 1
jmp 0x4084a8
add esp, 4
pop ebx
ret 0x10

Function at 0x40a98c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40aa70
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test byte [ebp + 0x10], 1
mov ebx, eax
je 0x40aa26
push edi
push edi
push edi
push dword [ebp + 0xc]
call fcn.0040b4d5
mov ebx, eax
cmp ebx, edi
je 0x40aa65
push dword [ebp + 8]
push dword [0x497178]
call fcn.00411ac3
mov esi, eax
mov eax, 0x10000
push eax
push ebx
mov dword [esi + 0x18], eax
call fcn.0040b478
push eax
push ebx
call fcn.0040b45e
push eax
call fcn.0040b0b9
cmp eax, edi
mov dword [esi], eax
je 0x40aa1e
mov dword [esi + 0x14], ebx
mov dword [ebp - 4], esi
jmp 0x40aa65
push ebx
call fcn.0040b485
jmp 0x40aa65
push ebx
push edi
push dword [0x496a04]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
je 0x40aa65
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push esi
push dword [ebp + 8]
call fcn.0040b0a3
push esi
push edi
push dword [0x496a04]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc
Function at 0x40abad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
push dword [0x497178]
mov dword [ebp - 8], ebx
xor edi, edi
call fcn.00411b5a
mov esi, eax
cmp esi, ebx
je 0x40ad28
mov eax, dword [esi]
mov dword [ebp - 4], eax
cmp dword [esi + 0x14], ebx
je 0x40ac5d
push dword [ebp + 8]
call fcn.0040b1d6
jmp 0x40abf0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1d], bl
jne 0x40abe8
push dword [esi + 0x14]
call fcn.0040b4ae
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
push ebx
mov eax, esi
mov byte [esi + 0x1c], 1
call fcn.0040aa8a
pop ecx
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push 0x40aaff
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x40ac32
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40ac43
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040b26c
mov eax, dword [esi]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x34]
mov esi, dword [esi]
mov eax, dword [esi]
push 1
push ebx
push ebx
push esi
call dword [eax + 0x30]
jmp 0x40ad28
test byte [ebp + 0xc], 1
je 0x40ac66
xor edi, edi
inc edi
test byte [ebp + 0xc], 2
je 0x40acf0
push esi
call fcn.0040ad42
lea eax, [esi + 4]
push 0xc
push eax
call fcn.00412160
pop ecx
pop ecx
lea edx, [ebp - 4]
push edx
push dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [0x49718c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jne 0x40ad28
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
push dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
push dword [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x40]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40acd6
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040b206
jmp 0x40ace2
mov eax, dword [ebp - 4]
push dword [esi + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push ebx
push ebx
push eax
call dword [ecx + 0x30]
jmp 0x40ad28
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x34]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40ad11
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040b26c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push ebx
push ebx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x40ad28
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40b64e
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x40b666
push dword [esp + 4]
push 0x40b5e7
call dword [sym.imp.USER32.DLL_EnumWindows]
jmp 0x40b6a3
push esi
mov esi, dword [0x4971b8]
test esi, esi
je 0x40b6a2
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40b69a
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
push edi
push 0x4971b8
call fcn.0041218d
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x40b673
pop edi
pop ebx
pop esi
ret 4
Function at 0x40bd41
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4971c8], 0
jne 0x40bd53
call fcn.0040bc92
push esi
push edi
push dword [0x4971c4]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
mov esi, eax
test esi, esi
jne 0x40bd78
call fcn.0040bc92
push dword [0x4971c4]
call edi
mov esi, eax
mov eax, dword [ebp + 8]
push 0x11
lea ecx, [esi + 8]
pop edx
mov edi, eax
imul edi, edi, 0x53a9b4fb
xor eax, eax
inc eax
sub eax, edi
mov dword [ecx + 0x44], eax
imul eax, eax, 0x53a9b4fb
xor edi, edi
inc edi
sub edi, eax
mov eax, edi
mov dword [ecx], eax
add ecx, 4
dec edx
jne 0x40bd81
and dword [esi], edx
push 0x1f
mov dword [esi + 4], 0xa
pop edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.0040bc49
dec edi
pop ecx
pop ecx
jne 0x40bdb2
pop edi
pop esi
leave
ret 4
Function at 0x40f100
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
test eax, eax
mov edi, dword [sym.imp.USER32.DLL_GetPropA]
mov dword [ebp - 4], eax
je 0x40f18b
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
push 9
call esi
test al, al
jns 0x40f17d
push 0x11
call esi
test al, al
js 0x40f17d
push 0x10
call esi
test al, al
js 0x40f17d
push 0x12
call esi
test al, al
js 0x40f17d
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40f17d
push eax
push eax
push 0x44e
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
test ax, 0x800
je 0x40f1ab
push str.PB_Hotkey
push dword [ebp - 4]
call edi
test eax, eax
jne 0x40f1ab
push str.PB_WindowID
push dword [ebp + 8]
call edi
test eax, eax
je 0x40f1ab
dec eax
push eax
push dword [0x497760]
call fcn.00411b5a
mov eax, dword [eax + 8]
jmp 0x40f1ad
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x40f537
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push esi
or esi, 0xffffffff
test eax, eax
push edi
mov edi, esi
je 0x40f648
cmp byte [eax], 0
je 0x40f648
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
cmp eax, 2
lea ecx, [ebp + eax - 0x109]
je 0x40f591
cmp eax, 3
jne 0x40f5ce
cmp byte [ebp - 0x107], 0x3a
jne 0x40f5ce
cmp eax, 2
jne 0x40f5b2
lea eax, [ebp - 0x108]
push 0x446288
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x40f648
jmp 0x40f642
mov byte [ecx], 0
dec ecx
cmp byte [ecx], 0x5c
je 0x40f5ca
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40f61a
test byte [ebp - 0x248], 0x10
je 0x40f5fd
push 0xfffffffffffffffe
pop edi
or esi, 0xffffffff
jmp 0x40f611
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x22c]
xor edi, edi
xor edx, edx
or edi, ecx
or esi, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40f648
cmp byte [ebp - 0x108], 0x5c
jne 0x40f648
cmp byte [ebp - 0x107], 0x5c
jne 0x40f648
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40f648
test al, 0x10
je 0x40f648
push 0xfffffffffffffffe
or esi, 0xffffffff
pop edi
mov eax, edi
pop edi
mov edx, esi
pop esi
leave
ret 4
Function at 0x40f660
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x40f695
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x40f8b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x40f909
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40f908
mov eax, dword [esp + 0x10]
mov ecx, dword [0x497778]
push eax
push ecx
call fcn.00411b5a
test eax, eax
je 0x40f904
cmp dword [eax + 4], 0
je 0x40f8f2
push esi
push edi
push eax
call fcn.0040fc70
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x40f910
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push edi
push eax
push 0x1000
mov dword [esp + 0x1c], 0x1000
call fcn.00412630
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x497778]
push ecx
mov edi, eax
push edx
mov ebp, edi
call fcn.00411b5a
mov ebx, eax
test ebx, ebx
je 0x40fa2e
push esi
lea ecx, [ecx]
mov byte [esp + 0x13], 0
cmp dword [ebx + 4], 0
je 0x40f96e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.0040fd70
mov dword [esp + 0x14], eax
jmp 0x40f985
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x13]
test al, al
je 0x40f997
mov byte [ebp], al
mov al, byte [esp + 0x13]
add ebp, 1
mov ecx, dword [esp + 0x18]
mov esi, ebp
sub esi, edi
cmp esi, ecx
jl 0x40f9c1
mov edx, dword [esp + 0x24]
add ecx, 0x1000
push edx
push ecx
mov dword [esp + 0x20], ecx
call fcn.00412630
mov edi, eax
mov al, byte [esp + 0x13]
lea ebp, [esi + edi]
test al, al
je 0x40fa2d
cmp dword [esp + 0x14], 0
je 0x40f9d8
cmp al, 0xd
je 0x40f9d8
cmp al, 0xa
jne 0x40f950
sub ebp, 1
cmp al, 0xd
jne 0x40fa2d
cmp dword [ebx + 4], 0
je 0x40f9f4
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.0040fd70
jmp 0x40fa0b
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x40fa2d
cmp dword [ebx + 4], 0
je 0x40fa1e
add dword [ebx + 0xc], 1
jmp 0x40fa2d
mov ecx, dword [ebx]
push 1
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
sub edi, ebp
add edi, dword [esp + 0x14]
mov byte [ebp], 0
push edi
call fcn.004126d0
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8