joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428bc3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x48d870]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x428c03
cmp byte [ebx], 0xa
jne 0x428c03
or byte [edi + eax + 0x28], 4
jmp 0x428c08
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x428d07
mov dl, byte [eax]
cmp dl, 0x1a
je 0x428cea
inc eax
cmp dl, 0xd
je 0x428c34
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x428c5a
cmp eax, ecx
jae 0x428c68
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x428c1c
jmp 0x428d07
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x428ce5
cmp dword [ebp - 0x10], 0
je 0x428ce5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x48d870]
test byte [eax + edi + 0x28], 0x48
je 0x428cbf
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x428caa
mov byte [esi], dl
jmp 0x428cbb
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x48d870]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x428d07
cmp byte [ebp - 1], 0xa
jne 0x428cce
cmp esi, ebx
jne 0x428cce
mov byte [esi], 0xa
jmp 0x428d06
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00429c4d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x428d07
mov byte [esi], 0xd
jmp 0x428d06
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x48d870]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x428d04
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x428d07
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x428d10
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x48d870]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x428d56
cmp word [ebx], dx
jne 0x428d56
or byte [eax + edi + 0x28], 4
jmp 0x428d5b
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x428ebe
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x428e9e
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x428d9c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x428dd2
cmp eax, edx
jae 0x428de0
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x428d77
jmp 0x428ebe
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x428e99
cmp dword [ebp - 0x18], 0
je 0x428e99
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x48d870]
test byte [eax + edi + 0x28], 0x48
je 0x428e6f
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x428e33
mov word [esi], cx
jmp 0x428e6a
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x48d870]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x48d870]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x48d870]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x428ebe
pop eax
cmp word [ebp - 4], ax
jne 0x428e7f
cmp esi, ebx
jne 0x428e7f
mov word [esi], ax
jmp 0x428ebb
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00429c4d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x428ebe
push 0xd
pop eax
jmp 0x428e7a
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x48d870]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x428eb8
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x428ebe
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x437345
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x43739a
push dword [esp + 0x10]
push 0x4372c4
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [0x48ddec]
test edi, edi
je 0x4373f3
xor esi, esi
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x437392
cmp byte [edi + 0x10], 0
je 0x437392
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, ebx
test ebx, ebx
jne 0x43736e
jmp 0x4373f3
mov edi, dword [0x48ddec]
test edi, edi
je 0x4373f3
xor esi, esi
push ebp
mov ebp, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x4373ec
cmp byte [edi + 0x11], 0
je 0x4373c5
push 1
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [edi + 0x10], 0
je 0x4373dc
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [edi + 8]
push eax
push 0x48ddec
call fcn.0044faa4
pop ecx
pop ecx
mov edi, ebp
test ebp, ebp
jne 0x4373a7
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x437496
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push dword [0x48f264]
call fcn.0044f2e5
mov esi, eax
or ebx, 0xffffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, dword [esp + 0x28]
mov edx, eax
movzx ecx, word [edx]
test cx, cx
je 0x4375d3
mov eax, dword [esi]
mov edi, ecx
mov esi, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x20
push 0x22
pop ecx
movzx eax, di
cmp di, word [esp + 0x18]
jne 0x4374fc
push 0x20
pop edi
add edx, 2
movzx eax, word [edx]
cmp ax, di
je 0x4374f1
mov dword [esp + 0x14], 1
cmp ax, cx
jne 0x437536
add edx, 2
mov edi, edx
movzx eax, word [edx]
mov ebx, eax
test ax, ax
je 0x437590
push 0x22
mov ecx, eax
pop esi
movzx ebx, cx
cmp cx, si
je 0x437590
add edx, 2
movzx eax, word [edx]
mov ecx, eax
mov ebx, eax
test ax, ax
jne 0x43751d
jmp 0x437590
test ax, ax
je 0x4375a3
push 0x20
mov edi, edx
movzx eax, ax
pop ebp
movzx ebx, ax
cmp ax, bp
je 0x43758c
add edx, 2
push 0x22
pop ebx
movzx eax, word [edx]
mov ecx, eax
cmp ax, bx
jne 0x437581
add edx, 2
movzx eax, word [edx]
mov ecx, eax
test ax, ax
je 0x437581
mov esi, eax
movzx ecx, si
cmp si, bx
je 0x437581
add edx, 2
movzx eax, word [edx]
mov esi, eax
mov ecx, eax
test ax, ax
jne 0x43756a
movzx eax, cx
movzx ebx, cx
test cx, cx
jne 0x437543
mov ebp, dword [esp + 0x28]
test bx, bx
lea eax, [edx + 2]
mov ebx, dword [esp + 0x10]
mov esi, edx
cmove eax, edx
mov edx, eax
jmp 0x4375aa
and dword [esp + 0x14], 0
xor edi, edi
cmp dword [esp + 0x1c], ebx
jne 0x4375b4
test ebp, ebp
jne 0x4375db
cmp dword [esp + 0x14], 0
lea eax, [ebx + 1]
movzx ecx, word [edx]
cmove eax, ebx
mov edi, ecx
mov ebx, eax
mov dword [esp + 0x10], ebx
test cx, cx
jne 0x4374e1
test ebp, ebp
jne 0x4375f0
mov eax, ebx
jmp 0x4375f6
test edi, edi
je 0x4375f0
mov eax, dword [esp + 0x20]
sub esi, edi
sar esi, 1
mov dword [ebp], esi
inc dword [eax]
mov eax, edi
jmp 0x4375f6
and dword [ebp], 0
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x437e67
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x437ecb
cmp dword [ebp + 0x10], 0x18
push esi
jne 0x437e88
call fcn.00451ca0
mov esi, eax
push esi
call fcn.00467eb0
jmp 0x437e9c
cmp dword [ebp + 0x10], 2
jne 0x437e95
call fcn.00451d40
jmp 0x437e7e
call fcn.0041f6a2
add eax, eax
pop ecx
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
mov eax, dword [ebp + 8]
push esi
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0x10], 0x18
jne 0x437ebf
push esi
call fcn.00451c90
jmp 0x437ecb
cmp dword [ebp + 0x10], 2
jne 0x437ecb
push esi
call fcn.00451d30
pop esi
pop ebp
ret 0xc

Function at 0x437ed0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x437f8f
cmp dword [esp + 0x24], 2
je 0x437f8f
push 0x2000
push ebp
push dword [0x48c828]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x437f5e
cmp dword [esp + 0x18], 2
jne 0x437f7a
cmp dword [esp + 0x28], 0xffffffff
je 0x437f22
cmp ebp, dword [esp + 0x28]
jae 0x437f7a
add ebp, 2
test ebx, ebx
jne 0x437f47
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x48c828]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x437f7a
cmp ax, 0xd
je 0x437f5e
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x437f0e
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.00451e40
jmp 0x438021
push eax
push 0
push dword [0x48c828]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x437fad
cmp ebp, dword [esp + 0x28]
jae 0x438005
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438005
cmp dword [esp + 0x18], 1
jne 0x438005
inc ebp
test ebx, ebx
jne 0x437ff2
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x48c828]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x438005
cmp al, 0xd
je 0x437fa0
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x437fa0
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x43801c
call fcn.00451ba0
jmp 0x438021
call fcn.00451dd0
push esi
push 0
push dword [0x48c828]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x43ae5b
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x43aecd
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, ebp
and ecx, dword [esp + 0x14]
push esi
push edi
push dword [ebx]
cmp ecx, 0xffffffff
cmove ebp, eax
call fcn.0043a5cc
push ebp
push dword [ebx]
mov edi, eax
call fcn.0043a5a5
add esp, 0xc
mov esi, eax
push 0
push ebp
push 0x130c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebx]
call fcn.0043aeed
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x43b1fb
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x48f2b0]
call fcn.0044f34e
mov ebx, eax
test ebx, ebx
je 0x43b25f
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x43b224
push dword [esp + 0xc]
push ebx
call eax
jmp 0x43b25f
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00451300
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.0041f6a2
pop ecx
sub edi, eax
push edi
call fcn.004513a0
pop edi
pop esi
pop ebx
ret 8
Function at 0x43ca14
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x48f294]
call fcn.0044f2e5
xor ebx, ebx
mov esi, eax
cmp dword [0x48e4e4], ebx
jne 0x43cae6
xor ebp, ebp
inc ebp
mov dword [0x48e4e4], ebp
call fcn.00443b2d
mov edi, 0xa8
push edi
push ebx
push 0x48e438
call fcn.0042a340
add esp, 0xc
mov dword [0x48e438], 0x13
lea eax, [esp + 0x10]
mov dword [0x48e43c], edi
mov dword [0x48e448], 0x43c95f
mov dword [0x48e44c], 0x43cc84
push eax
mov dword [0x48e4a0], 0x43c937
mov dword [0x48e4a4], 0x43cbc9
mov dword [0x48e444], 0x43c912
mov dword [0x48e4c8], 0x43c97c
mov dword [0x48e4e8], ebp
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43cae6
cmp dword [esp + 0x20], ebp
je 0x43cae0
cmp dword [esp + 0x20], 2
jne 0x43cae6
cmp dword [esp + 0x14], 5
jb 0x43cae0
jne 0x43cae6
cmp dword [esp + 0x18], ebx
jne 0x43cae6
mov dword [0x48e4e8], ebx
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0044fc20
mov eax, dword [esp + 0x140]
push ebx
push dword [0x48c82c]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebx
push str.BUTTON
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x43cbba
mov ebp, dword [esp + 0x128]
push ebp
push dword [0x48f2b0]
call fcn.0044f375
mov esi, dword [esp + 0x13c]
mov ebx, eax
mov dword [ebx + 0x10], esi
test esi, esi
je 0x43cb8b
push esi
call fcn.00446a49
test eax, eax
je 0x43cb8b
push 0
push 0
push esi
call fcn.004466aa
jmp 0x43cb8d
xor eax, eax
push 0x43c669
push 0xfffffffffffffffc
mov dword [ebx + 0x18], eax
and dword [ebx + 0x14], 0
and dword [ebx + 0x1c], 0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x48e438
push edi
push ebx
push ebp
mov dword [0x48e4e0], eax
call fcn.004435fc
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x4405d5
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor edi, edi
push edi
push edi
push 0x147
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x440664
push 0xfffffffffffffff0
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
jne 0x440664
push esi
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push edi
push dword [0x48c828]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea ecx, [esi + 1]
push ecx
xor eax, eax
push edi
mov word [edi], ax
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
or esi, 0xffffffff
push esi
push 0x158
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push dword [0x48c828]
cmp eax, esi
cmove ebx, esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
mov eax, ebx
pop ebp
cdq
pop ebx
ret 4
Function at 0x442701
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push dword [0x48f294]
call fcn.0044f2e5
xor ebx, ebx
mov ebp, eax
cmp dword [0x48ecb0], ebx
jne 0x442795
mov esi, 0xa8
push esi
push ebx
push 0x48ec08
call fcn.0042a340
add esp, 0xc
mov dword [0x48ec0c], esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x48ec08], 0xa
mov dword [0x48ec10], 0x44228f
push 0x7f89
push ebx
mov dword [0x48ec80], 0x443c67
mov dword [0x48ec84], 0x443c41
mov dword [0x48ec14], 0x4422ae
mov dword [0x48ec98], 0x4422ce
call esi
mov dword [0x48ecb0], eax
test eax, eax
jne 0x442795
push 0x7f00
push ebx
call esi
mov dword [0x48ecb0], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0044fc20
push ebx
push dword [0x48c82c]
push 0xffffffffffffffff
push dword [ebp]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x40000000
push dword [esp + 0x48]
push str.STATIC
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x442861
push edi
push dword [esp + 0x14]
push dword [0x48f2b0]
call fcn.0044f375
mov edi, eax
push 8
or dword [edi + 0x10], 0xffffffff
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
push 0
mov dword [edi + 0x14], eax
push dword [0x48c828]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0x48ec08
push ebx
push edi
push dword [esp + 0x20]
mov dword [esi], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], ecx
mov byte [esi + 0x10], 0
mov dword [edi + 0x1c], esi
call fcn.004435fc
push 0x4423b4
push 0xfffffffffffffffc
push dword [edi]
mov ebx, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0x20
Function at 0x44460a
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x444773
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x444756
sub eax, 1
jne 0x444773
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.004445c3
pop ecx
test eax, eax
je 0x444681
cmp byte [esp + 0x23a], 1
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
jne 0x4446b7
inc edi
jmp 0x4446b7
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x444773
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x14]
inc edx
cmp byte [esp + 0x356], dl
cmove edi, edx
sub ecx, 3
je 0x444752
sub ecx, 1
je 0x44474e
sub ecx, 1
je 0x444730
sub ecx, 1
je 0x4446f4
sub ecx, 4
jne 0x444773
test eax, eax
jne 0x444773
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x444773
sub eax, 0
je 0x444723
sub eax, 1
je 0x444716
sub eax, 1
je 0x44470f
sub eax, 1
jne 0x444773
push 0x69
pop esi
push 0x64
jmp 0x444728
push 0x5a
pop esi
push 0x5f
jmp 0x44471b
push 0x50
pop esi
push 0x55
test edi, edi
pop eax
cmove esi, eax
jmp 0x444773
push 0x4b
pop esi
push 0x46
test edi, edi
pop eax
cmovne esi, eax
jmp 0x444773
sub eax, 0
je 0x44474a
sub eax, 1
je 0x444746
sub eax, 1
jne 0x444773
push 0x41
pop esi
push 0x3c
jmp 0x444728
push 0x3c
jmp 0x444772
push 0x32
jmp 0x444772
push 0x14
jmp 0x444772
push 5
jmp 0x444772
mov eax, dword [esp + 0x14]
test eax, eax
je 0x444770
cmp eax, 0xa
je 0x44476c
cmp eax, 0x5a
jne 0x444773
push 0x28
jmp 0x444772
push 0x1e
jmp 0x444772
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x444cb6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x48f2c4]
call fcn.0044f34e
mov esi, eax
test esi, esi
je 0x444d92
cmp dword [ebp + 0xc], 0
je 0x444d02
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x444cf3
cmp dword [esi + 0x1c], 0
jne 0x444cf3
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x444d92
test byte [ebp + 0x10], 3
push ebx
push 4
pop ebx
je 0x444d20
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.00445f6d
cmp dword [esi + 0x3c], 0xffffffff
je 0x444d44
xor eax, eax
cmp dword [esi + 0x3c], 0x1000000
sete al
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x444d5c
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
mov eax, dword [ebp + 8]
test dword [ebp + 0x10], 0x2000000
je 0x444d77
test eax, eax
je 0x444d6d
push 8
jmp 0x444d7d
push 7
test ecx, ecx
pop eax
cmovne ebx, eax
jmp 0x444d88
test eax, eax
je 0x444d80
push 3
pop ebx
jmp 0x444d88
xor ebx, ebx
test ecx, ecx
setne bl
inc ebx
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x4460ed
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x446183
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x446180
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x446180
lea eax, [esi - 1]
push eax
push dword [0x48f2c4]
call fcn.0044f34e
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x446182
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x446170
mov edx, 0xfa01
cmp word [ecx], dx
je 0x44617b
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x446160
jmp 0x446180
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x446229
push eax
call esi
test al, al
jns 0x446229
push 0x11
call esi
test al, al
js 0x446229
push 0x10
call esi
test al, al
js 0x446229
push 0x12
call esi
test al, al
js 0x446229
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x446229
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.00420da6
add esp, 0xc
test eax, eax
je 0x4461fd
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.00420da6
add esp, 0xc
test eax, eax
jne 0x446214
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x44626a
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call fcn.004682ac
pop ecx
pop ecx
test eax, eax
je 0x44626a
test ebp, ebp
je 0x44624d
push 0x11
call esi
test al, al
js 0x446245
push 0x10
call esi
test al, al
js 0x446245
push 0x12
call esi
test al, al
jns 0x44624d
push 1
push ebp
call fcn.00446276
test ebx, ebx
je 0x446261
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x44626a
test edi, edi
je 0x44626a
mov eax, dword [edi + 8]
jmp 0x44626c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4