joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467d90
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x764218], 0
jne 0x467d9e
call fcn.00467c10
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x76421c]
call esi
test eax, eax
jne 0x467dc1
call fcn.00467c10
push dword [0x76421c]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x467dd0
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x467e30
mov ebx, 0x10
test edi, edi
jns 0x467e39
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x467e02
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x467e50
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x764218], 0
jne 0x467e5e
call fcn.00467c10
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x76421c]
call esi
mov edx, eax
test edx, edx
jne 0x467e85
call fcn.00467c10
push dword [0x76421c]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x467eb8
mov ebx, 0x10
test esi, esi
jns 0x467ec1
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x467ed0
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x46c1e7
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x765db4]
call fcn.00489412
xor ebp, ebp
mov esi, eax
cmp dword [0x764520], ebp
jne 0x46c2c3
xor ebx, ebx
inc ebx
mov dword [0x764520], ebx
call fcn.0047072f
mov edi, 0xa4
push edi
push ebp
push 0x764528
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x764528], 0x13
lea eax, [esp + 0x10]
mov dword [0x76452c], edi
mov dword [0x764538], 0x46c132
mov dword [0x76453c], 0x46c47d
push eax
mov dword [0x764590], 0x46c10d
mov dword [0x764594], 0x46c3c8
mov dword [0x764534], 0x46c0e8
mov dword [0x7645b8], 0x46c14d
mov dword [0x7645cc], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x46c2c3
cmp dword [esp + 0x20], ebx
je 0x46c2ab
cmp dword [esp + 0x20], 2
jne 0x46c2c3
cmp dword [esp + 0x14], 5
jae 0x46c2b3
mov dword [0x7645cc], ebp
jmp 0x46c2c3
jne 0x46c2c3
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x7645cc], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0047517d
mov eax, dword [esp + 0x140]
push ebp
push dword [0x6eb398]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x46c399
push dword [esp + 0x128]
push dword [0x765dd0]
call fcn.00489a91
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x46c368
push edi
call fcn.00484247
test eax, eax
je 0x46c368
push ebp
push ebp
push edi
call fcn.00483eb6
mov dword [esi + 0x18], eax
jmp 0x46c36b
mov dword [esi + 0x18], ebp
push 0x46be37
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x764528
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x764524], eax
call fcn.00470af0
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x46df01
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x46df73
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp ebx, 0xffffffff
jne 0x46df2a
mov ebx, eax
push dword [ebp]
call fcn.0046d683
push ebx
push dword [ebp]
mov edi, eax
call fcn.0046d65a
add esp, 0xc
mov esi, eax
push 0
push ebx
push 0x130c
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebp]
call fcn.0046df93
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46ea81
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 1
call edi
mov ebx, 0x8000
test bx, ax
je 0x46ea9b
inc esi
push 2
call edi
test bx, ax
je 0x46eaa7
or esi, 2
push 4
call edi
test bx, ax
je 0x46eab3
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x46f049
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x46f081
push dword [edi]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [esp + 0x10], 1
push dword [edi]
push esi
call fcn.004708ed
test byte [edi + 0x14], 8
mov dword [esp + 0x14], eax
je 0x46f172
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [edi], eax
jne 0x46f172
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
sub ebp, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
test eax, eax
jle 0x46f1a0
test ebp, ebp
jle 0x46f1a0
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x46f1a0
push ebp
push dword [esp + 0x30]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x30], eax
test eax, eax
je 0x46f169
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x10], 0
je 0x46f113
push 4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x10]
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x46f128
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 2
pop eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
sub dword [esp + 0x20], eax
sub dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push ebp
push dword [esp + 0x40]
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x46f1a0
cmp dword [edi + 0x10], ebx
je 0x46f18c
push 4
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 0x10]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x46f1a0
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
push dword [esp + 0x14]
push esi
call fcn.004708cb
cmp dword [esp + 0x10], 0
je 0x46f1ba
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x46f1c2
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.00470ac1
push eax
call fcn.00471698
push dword [0x764974]
mov dword [esp + 0x24], eax
call fcn.00489562
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x46f236
inc ebx
push 0x12
call esi
test di, ax
je 0x46f242
or ebx, 2
push 0x11
call esi
test di, ax
je 0x46f24e
or ebx, 4
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.0046ea81
push 0x46f2a3
push ebp
push dword [esp + 0x2c]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x34]
push dword [esp + 0x2c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x44]
movzx eax, ax
push 0x332c
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x18], eax
call fcn.00474418
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x470063
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push dword [0x765db4]
call fcn.00489412
xor ebx, ebx
mov ebp, eax
cmp dword [0x764a50], ebx
jne 0x4700f7
mov esi, 0xa4
push esi
push ebx
push 0x764a58
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x764a5c], esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x764a58], 0xa
mov dword [0x764a60], 0x46fbf8
push 0x7f89
push ebx
mov dword [0x764ad0], 0x470cda
mov dword [0x764ad4], 0x470cb4
mov dword [0x764a64], 0x46fc17
mov dword [0x764ae8], 0x46fc37
call esi
mov dword [0x764a50], eax
test eax, eax
jne 0x4700f7
push 0x7f00
push ebx
call esi
mov dword [0x764a50], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0047517d
push ebx
push dword [0x6eb398]
push 0xffffffffffffffff
push dword [ebp]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x40000000
push dword [esp + 0x48]
push str.STATIC
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x4701c3
push edi
push dword [esp + 0x14]
push dword [0x765dd0]
call fcn.00489a91
mov edi, eax
push 8
or dword [edi + 0x10], 0xffffffff
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
push 0
mov dword [edi + 0x14], eax
push dword [0x6eb394]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0x764a58
push ebx
push edi
push dword [esp + 0x20]
mov dword [esi], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], ecx
mov byte [esi + 0x10], 0
mov dword [edi + 0x1c], esi
call fcn.00470af0
push 0x46fd1d
push 0xfffffffffffffffc
push dword [edi]
mov ebx, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0x20
Function at 0x47127d
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
lea eax, [ebp - 0x40]
push 0x40
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 6
jne 0x4712ae
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x60]
jmp 0x471330
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x47130a
mov eax, dword [ebp + 8]
sub eax, 0
je 0x471302
dec eax
je 0x4712fa
dec eax
je 0x4712f2
dec eax
je 0x4712ea
dec eax
je 0x4712e2
dec eax
jne 0x47130a
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x471332
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
jmp 0x471332
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x471332
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
jmp 0x471332
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
jmp 0x471332
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
jmp 0x471332
cmp dword [ebp + 8], 7
jne 0x47132e
push 0x2c
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x47132e
mov eax, dword [ebp - 0x68]
jmp 0x471330
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x471420
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x471596
mov eax, dword [esp + 0x24]
dec eax
je 0x471579
dec eax
jne 0x471596
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.004713d9
pop ecx
test eax, eax
je 0x4714d7
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x47149a
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x471575
dec ebx
je 0x471571
dec ebx
je 0x471550
dec ebx
je 0x47150a
sub ebx, 4
jne 0x471596
test edi, edi
jne 0x471596
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x471596
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x47149a
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x471495
sub edi, 0
je 0x471542
dec edi
je 0x471534
dec edi
je 0x471526
dec edi
jne 0x471596
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x471596
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x471596
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x471596
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x471596
sub edi, 0
je 0x47156d
dec edi
je 0x471569
dec edi
jne 0x471596
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x471596
push 0x3c
jmp 0x471595
push 0x32
jmp 0x471595
push 0x14
jmp 0x471595
push 5
jmp 0x471595
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x471593
cmp eax, 0xa
je 0x47158f
cmp eax, 0x5a
jne 0x471596
push 0x28
jmp 0x471595
push 0x1e
jmp 0x471595
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x471c34
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x765de0]
call fcn.00489a52
mov esi, eax
test esi, esi
je 0x471d0e
cmp dword [ebp + 0xc], 0
je 0x471c80
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x471c71
cmp dword [esi + 0x1c], 0
jne 0x471c71
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x471d0e
test byte [ebp + 0x10], 3
je 0x471c9b
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.0047278e
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x471cc0
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x471cd4
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x471cf1
test ebx, ebx
je 0x471ce5
push 8
jmp 0x471cf7
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x471d04
test ebx, ebx
je 0x471cfa
push 3
pop ecx
jmp 0x471d04
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x472921
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4729b9
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4729b6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4729b6
lea eax, [esi - 1]
push eax
push dword [0x765de0]
call fcn.00489a52
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4729b8
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x4729ad
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x472aa0
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x472993
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x472a5f
push eax
call esi
test al, al
jns 0x472a5f
push 0x11
call esi
test al, al
js 0x472a5f
push 0x10
call esi
test al, al
js 0x472a5f
push 0x12
call esi
test al, al
js 0x472a5f
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x472a5f
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x472a33
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x472a4a
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x472aaa
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x472aaa
test ebp, ebp
je 0x472a83
push 0x11
call esi
test al, al
js 0x472a7b
push 0x10
call esi
test al, al
js 0x472a7b
push 0x12
call esi
test al, al
jns 0x472a83
push 1
push ebp
call fcn.00472ab6
test ebx, ebx
je 0x472a97
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x472aaa
test edi, edi
je 0x472aaa
mov eax, dword [edi + 8]
jmp 0x472aac
and dword [esp + 0x14], 0
jmp 0x4729b8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x472c95
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x472ddd
xor ecx, ecx
cmp word [eax], cx
je 0x472ddd
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x472cee
cmp eax, 3
jne 0x472d28
cmp word [esp + 0xa], 0x3a
jne 0x472d28
cmp eax, 2
jne 0x472d0c
lea eax, [esp + 8]
push 0x528e18
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x472ddd
push 0xfffffffffffffffe
pop edi
jmp 0x472ddd
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x472d3d
cmp ax, bx
jne 0x472d47
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x472d30
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x472d86
test byte [esp + 0x21c], 0x10
je 0x472d6d
push 0xfffffffffffffffe
pop edi
jmp 0x472d7d
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x472ddb
cmp word [esp + 0x10], bp
jne 0x472d94
cmp word [esp + 0x12], bp
je 0x472db3
cmp word [esp + 0x10], bx
jne 0x472da2
cmp word [esp + 0x12], bx
je 0x472db3
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x472ddb
cmp word [esp + 0x12], ax
jne 0x472ddb
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x472dc8
test al, 0x10
je 0x472ddb
jmp 0x472dd8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x472ddb
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x472dfc
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x472e25
test byte [esp + 8], 2
je 0x472e19
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x472e27
xor eax, eax
ret 8

Function at 0x472e38
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x472eb0
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x472e91
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x472e8e
cmp ecx, 0x5c
je 0x472e8e
cmp ecx, 0x2f
jne 0x472e9b
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x472e7b
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x472eb2
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x472f58
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x764be8]
push esi
test eax, eax
jne 0x472f7d
push fcn.00473085
push 0x10
push 0x258
call fcn.00489b25
mov dword [0x764be8], eax
push dword [esp + 0xc]
push eax
call fcn.00489a91
mov esi, eax
test esi, esi
je 0x47307e
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x472f9f
mov edi, 0x525be0
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x472faf
xor eax, eax
cmp word [ebx], ax
jne 0x472fb4
mov ebx, 0x528e1c
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x6eb394]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x473065
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x473015
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x473019
push 0x528e18
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x473019
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x47303d
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x473053
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x473051
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x6eb394]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x47307c
cmp dword [esp + 0x14], 0xffffffff
je 0x473070
mov esi, dword [esp + 0x14]
push esi
push dword [0x764be8]
call fcn.00489a03
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc