joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456526
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push edi
xor edi, edi
test eax, eax
je 0x4566f3
cmp word [eax], di
je 0x4566f3
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x4566ef
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x4566e5
push ebx
push ebp
call fcn.00456b7e
mov ebx, eax
test ebx, ebx
je 0x4566e4
push esi
push 2
pop eax
cmp ebp, 0xffffffff
cmovne eax, ebp
push eax
push dword [esp + 0x20]
call fcn.00457005
mov esi, eax
test esi, esi
je 0x4566da
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
mov dword [esi + 0x2c], ebx
cmove eax, esi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x24]
add eax, 8
mov dword [esi + 0x40], edi
push eax
push edi
mov dword [esi + 0x14], edi
push dword [0x599ff8]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x28], eax
test eax, eax
je 0x456600
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x28]
mov dword [eax], edi
mov eax, dword [esi + 0x28]
add eax, 8
mov dword [esi + 0x44], eax
cmp ebp, 0xffffffff
je 0x45660c
mov dword [esi + 0x34], 1
push esi
push ebx
call fcn.004793c0
mov edx, dword [esp + 0x2c]
mov ebp, 0x4000
pop ecx
pop ecx
mov ecx, edi
mov dword [esp + 0x1c], ecx
lea eax, [ecx + ebp]
cmp eax, edx
jle 0x45662f
mov ebp, edx
sub ebp, ecx
push ebp
push ebx
call fcn.00478c80
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x4566c9
push edi
lea ecx, [esp + 0x24]
push ecx
push ebp
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x20]
cmp ecx, ebp
jne 0x4566b9
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x1c], eax
cmp dword [esi + 0x14], edi
jne 0x456682
push ecx
push dword [esp + 0x18]
call fcn.00456c29
mov dword [esi + 0x14], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x24]
jl 0x45668c
push 1
jmp 0x45668d
push edi
push ecx
push ebx
call fcn.00478fb0
add esp, 0xc
test eax, eax
je 0x4566ad
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
cmp ecx, edx
jl 0x456624
jmp 0x4566d7
push ebx
call fcn.00478f90
pop ecx
mov dword [esi + 0x18], eax
jmp 0x4566d0
mov dword [esi + 0x18], 0x100
mov dword [esi + 0x24], str.file_read_error
jmp 0x4566d7
mov dword [esi + 0x18], 1
push ebx
push esi
call fcn.00456cd5
mov dword [esi + 0x2c], edi
push ebx
call fcn.004790f0
pop ecx
mov edi, esi
pop esi
pop ebx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x4566f5
xor eax, eax
pop edi
pop ebp
pop ecx
pop ecx
ret 0xc
Function at 0x457655
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
push dword [esp + 0x54]
push dword [0x59c994]
call fcn.00471c3d
mov esi, eax
test esi, esi
je 0x45770c
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
push ebp
push dword [esp + 0x5c]
push 0x419
push dword [esi]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45770c
lea eax, [esp + 0x10]
push eax
push ebx
push 0x41d
push dword [esi]
call edi
mov dword [esp + 0x20], 0x30
mov dword [esp + 0x24], 0x10
mov eax, dword [esi]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x20]
push eax
push ebp
push 0x433
mov dword [esp + 0x38], ebx
mov dword [esp + 0x4c], ebp
push dword [esi + 4]
call edi
lea eax, [esp + 0x20]
push eax
push ebp
push 0x432
push dword [esi + 4]
call edi
xor eax, eax
inc eax
jmp 0x45770e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc

Function at 0x457847
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x4578e2
push edi
push 0x59c9a0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x59b3ac]
test edi, edi
je 0x4578b5
push ebp
push esi
lea ebp, [edi + 8]
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4578ae
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebp
push 0x59b3ac
call fcn.00471f61
pop ecx
pop ecx
jmp 0x4578b0
mov edi, dword [edi]
test edi, edi
jne 0x457883
pop ebp
mov esi, dword [0x594120]
push 0x10
push 0x59b3ac
lea eax, [esi + 1]
mov dword [0x594120], eax
call fcn.00471fa1
pop ecx
pop ecx
push 0x59c9a0
mov dword [eax], ebx
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 8

Function at 0x4578ea
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.004577fb
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x59c9a0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x59b3ac]
jmp 0x45791b
cmp dword [esi + 0xc], edi
je 0x457921
mov esi, dword [esi]
test esi, esi
jne 0x457914
jmp 0x457939
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x59b3ac
call fcn.00471f61
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4
Function at 0x45b73e
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x45b793
push dword [esp + 0x10]
push 0x45b6bd
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [0x59b6a0]
test edi, edi
je 0x45b7ec
xor esi, esi
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x45b78b
cmp byte [edi + 0x10], 0
je 0x45b78b
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, ebx
test ebx, ebx
jne 0x45b767
jmp 0x45b7ec
mov edi, dword [0x59b6a0]
test edi, edi
je 0x45b7ec
xor esi, esi
push ebp
mov ebp, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x45b7e5
cmp byte [edi + 0x11], 0
je 0x45b7be
push 1
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [edi + 0x10], 0
je 0x45b7d5
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [edi + 8]
push eax
push 0x59b6a0
call fcn.00471f61
pop ecx
pop ecx
mov edi, ebp
test ebp, ebp
jne 0x45b7a0
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x45c5f6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push dword [0x59c9fc]
call fcn.00471605
mov ebx, eax
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x45c64b
push ebp
push esi
xor ecx, ecx
mov ebp, 0xfde9
push ecx
push ecx
push 0xffffffffffffffff
push dword [eax + 0xc]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [esp + 0x10]
mov esi, eax
lea ecx, [esi - 1]
push ecx
call fcn.00472320
push esi
push eax
mov eax, dword [ebx + 0x20]
push 0xffffffffffffffff
push dword [eax + 0xc]
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop esi
pop ebp
pop ebx
ret 4
pop ebx
jmp fcn.004723d0

Function at 0x45c88a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x59c9fc]
call fcn.00471605
mov edi, dword [eax + 0x24]
test edi, edi
je 0x45c948
cmp dword [edi + 8], 1
je 0x45c948
mov edi, dword [edi + 0xc]
test edi, edi
je 0x45c948
mov al, byte [edi]
cmp al, 0x20
je 0x45c8c3
cmp al, 9
jne 0x45c8c6
inc edi
jmp 0x45c8b9
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call esi
push dword [esp + 0x14]
mov ebx, eax
lea ecx, [ebx - 1]
push ecx
call fcn.00472320
push ebx
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
test ebx, ebx
jle 0x45c917
push 9
pop edx
lea eax, [ebp - 2]
lea eax, [eax + ebx*2]
movzx ecx, word [eax]
push 0x20
pop esi
cmp cx, si
je 0x45c933
cmp cx, dx
je 0x45c933
pop edi
pop esi
pop ebp
pop ebx
ret 4
movzx ecx, word [eax]
cmp cx, si
je 0x45c92b
cmp cx, dx
jne 0x45c937
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, ebp
jae 0x45c91e
push ebp
call fcn.0043ee11
pop ecx
sub ebx, eax
push ebx
call fcn.004723b0
jmp 0x45c917
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.004723d0
Function at 0x45de08
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x59c9cc]
call fcn.00471c3d
mov ebx, eax
test ebx, ebx
je 0x45de6c
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x45de31
push dword [esp + 0xc]
push ebx
call eax
jmp 0x45de6c
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00472320
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.0043ee11
pop ecx
sub edi, eax
push edi
call fcn.004723b0
pop edi
pop esi
pop ebx
ret 8

Function at 0x45eeb9
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x45ef2b
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, ebp
and ecx, dword [esp + 0x14]
push esi
push edi
push dword [ebx]
cmp ecx, 0xffffffff
cmove ebp, eax
call fcn.0045e62a
push ebp
push dword [ebx]
mov edi, eax
call fcn.0045e603
add esp, 0xc
mov esi, eax
push 0
push ebp
push 0x130c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebx]
call fcn.0045ef4b
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x45f80f
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x59c9c8]
call fcn.00471605
xor ebx, ebx
mov esi, eax
cmp dword [0x59ba4c], ebx
jne 0x45f8e1
xor ebp, ebp
inc ebp
mov dword [0x59ba4c], ebp
call fcn.004646c5
mov edi, 0xa8
push edi
push ebx
push 0x59b9a0
call fcn.00449b30
add esp, 0xc
mov dword [0x59b9a0], 0x13
lea eax, [esp + 0x10]
mov dword [0x59b9a4], edi
mov dword [0x59b9b0], 0x45f75a
mov dword [0x59b9b4], 0x45fa9f
push eax
mov dword [0x59ba08], 0x45f732
mov dword [0x59ba0c], 0x45f9e4
mov dword [0x59b9ac], 0x45f70d
mov dword [0x59ba30], 0x45f777
mov dword [0x59ba50], ebp
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45f8e1
cmp dword [esp + 0x20], ebp
je 0x45f8db
cmp dword [esp + 0x20], 2
jne 0x45f8e1
cmp dword [esp + 0x14], 5
jb 0x45f8db
jne 0x45f8e1
cmp dword [esp + 0x18], ebx
jne 0x45f8e1
mov dword [0x59ba50], ebx
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0046b150
mov eax, dword [esp + 0x140]
push ebx
push dword [0x599ffc]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebx
push str.BUTTON
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x45f9b5
mov ebp, dword [esp + 0x128]
push ebp
push dword [0x59c9cc]
call fcn.00471c7b
mov esi, dword [esp + 0x13c]
mov ebx, eax
mov dword [ebx + 0x10], esi
test esi, esi
je 0x45f986
push esi
call fcn.0046c8b0
test eax, eax
je 0x45f986
push 0
push 0
push esi
call fcn.0046c511
jmp 0x45f988
xor eax, eax
push 0x45f464
push 0xfffffffffffffffc
mov dword [ebx + 0x18], eax
and dword [ebx + 0x14], 0
and dword [ebx + 0x1c], 0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x59b9a0
push edi
push ebx
push ebp
mov dword [0x59ba48], eax
call fcn.00464885
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x461c7d
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor edi, edi
push edi
push edi
push 0x147
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x461d0c
push 0xfffffffffffffff0
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
jne 0x461d0c
push esi
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push edi
push dword [0x599ff8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea ecx, [esi + 1]
push ecx
xor eax, eax
push edi
mov word [edi], ax
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
or esi, 0xffffffff
push esi
push 0x158
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push dword [0x599ff8]
cmp eax, esi
cmove ebx, esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
mov eax, ebx
pop ebp
cdq
pop ebx
ret 4
Function at 0x4653fa
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x465563
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x465546
sub eax, 1
jne 0x465563
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.004653b3
pop ecx
test eax, eax
je 0x465471
cmp byte [esp + 0x23a], 1
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
jne 0x4654a7
inc edi
jmp 0x4654a7
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x465563
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x14]
inc edx
cmp byte [esp + 0x356], dl
cmove edi, edx
sub ecx, 3
je 0x465542
sub ecx, 1
je 0x46553e
sub ecx, 1
je 0x465520
sub ecx, 1
je 0x4654e4
sub ecx, 4
jne 0x465563
test eax, eax
jne 0x465563
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x465563
sub eax, 0
je 0x465513
sub eax, 1
je 0x465506
sub eax, 1
je 0x4654ff
sub eax, 1
jne 0x465563
push 0x69
pop esi
push 0x64
jmp 0x465518
push 0x5a
pop esi
push 0x5f
jmp 0x46550b
push 0x50
pop esi
push 0x55
test edi, edi
pop eax
cmove esi, eax
jmp 0x465563
push 0x4b
pop esi
push 0x46
test edi, edi
pop eax
cmovne esi, eax
jmp 0x465563
sub eax, 0
je 0x46553a
sub eax, 1
je 0x465536
sub eax, 1
jne 0x465563
push 0x41
pop esi
push 0x3c
jmp 0x465518
push 0x3c
jmp 0x465562
push 0x32
jmp 0x465562
push 0x14
jmp 0x465562
push 5
jmp 0x465562
mov eax, dword [esp + 0x14]
test eax, eax
je 0x465560
cmp eax, 0xa
je 0x46555c
cmp eax, 0x5a
jne 0x465563
push 0x28
jmp 0x465562
push 0x1e
jmp 0x465562
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x466aea
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x466b80
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x466b7d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x466b7d
lea eax, [esi - 1]
push eax
push dword [0x59ca64]
call fcn.00471c3d
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x466b7f
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x466b6d
mov edx, 0xfa01
cmp word [ecx], dx
je 0x466b78
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x466b5d
jmp 0x466b7d
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x466c26
push eax
call esi
test al, al
jns 0x466c26
push 0x11
call esi
test al, al
js 0x466c26
push 0x10
call esi
test al, al
js 0x466c26
push 0x12
call esi
test al, al
js 0x466c26
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x466c26
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.00440515
add esp, 0xc
test eax, eax
je 0x466bfa
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.00440515
add esp, 0xc
test eax, eax
jne 0x466c11
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x466c67
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call fcn.00525789
pop ecx
pop ecx
test eax, eax
je 0x466c67
test ebp, ebp
je 0x466c4a
push 0x11
call esi
test al, al
js 0x466c42
push 0x10
call esi
test al, al
js 0x466c42
push 0x12
call esi
test al, al
jns 0x466c4a
push 1
push ebp
call fcn.00466c73
test ebx, ebx
je 0x466c5e
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x466c67
test edi, edi
je 0x466c67
mov eax, dword [edi + 8]
jmp 0x466c69
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x46876d
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x4688b5
xor ecx, ecx
cmp word [eax], cx
je 0x4688b5
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00525718
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call fcn.0043ee11
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x4687c6
cmp eax, 3
jne 0x468800
cmp word [esp + 0xa], 0x3a
jne 0x468800
cmp eax, 2
jne 0x4687e4
lea eax, [esp + 8]
push 0x549398
push eax
call fcn.00525758
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4688b5
push 0xfffffffffffffffe
pop edi
jmp 0x4688b5
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x468815
cmp ax, bx
jne 0x46881f
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x468808
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x46885e
test byte [esp + 0x21c], 0x10
je 0x468845
push 0xfffffffffffffffe
pop edi
jmp 0x468855
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4688b3
cmp word [esp + 0x10], bp
jne 0x46886c
cmp word [esp + 0x12], bp
je 0x46888b
cmp word [esp + 0x10], bx
jne 0x46887a
cmp word [esp + 0x12], bx
je 0x46888b
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x4688b3
cmp word [esp + 0x12], ax
jne 0x4688b3
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x4688a0
test al, 0x10
je 0x4688b3
jmp 0x4688b0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4688b3
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x468a8f
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebx
mov ebx, eax
mov eax, dword [0x59c220]
push esi
push edi
test eax, eax
jne 0x468aa0
push fcn.00468ba9
push 0x10
push 0x258
call fcn.00471d0f
mov dword [0x59c220], eax
mov edi, dword [esp + 0x10]
push edi
push eax
call fcn.00471c7b
mov esi, eax
test esi, esi
je 0x468ba1
cmp dword [esp + 0x14], ebx
mov eax, 0x54c268
push ebp
cmovne eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x468ad8
xor ecx, ecx
cmp word [ebp], cx
jne 0x468ae1
mov ebp, 0x55033c
mov dword [esp + 0x1c], ebp
push eax
call fcn.0043ee11
push ebp
mov dword [esp + 0x20], eax
call fcn.0043ee11
add eax, dword [esp + 0x20]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x599ff8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x468b8e
push dword [esp + 0x14]
push ebp
call fcn.005256f6
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x468b41
mov eax, dword [esp + 0x14]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x468b41
push 0x549398
push ebp
call fcn.00525758
pop ecx
pop ecx
push dword [esp + 0x1c]
push ebp
call fcn.00525758
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x468b66
xor ecx, ecx
mov dword [esi + 4], ecx
jmp 0x468b7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
jne 0x468b7c
mov dword [esi + 4], 1
mov ebx, esi
push ebp
push ecx
push dword [0x599ff8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x468ba0
cmp edi, 0xffffffff
cmove edi, esi
push edi
push dword [0x59c220]
call fcn.00471bee
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0xc

Function at 0x468da0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
jne 0x468db9
push dword [0x59caa8]
call fcn.00471728
pop edi
ret 4
push esi
push edi
push dword [0x59caa8]
call fcn.00471c3d
mov esi, eax
test esi, esi
je 0x468e23
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x468e0f
cmp dword [esi + 0x14], 0
mov dword [esp + 0xc], 0
jne 0x468dfe
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
push dword [esi + 4]
push 0
push dword [0x599ff8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0x59caa8]
call fcn.00471bee
pop esi
pop edi
ret 4

Function at 0x468e30
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x468e6c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4