joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65a8ae00
Capabilities:
Create pipe

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
lea eax, [esp + 0x34]
mov dword [esp + 0x38], 0
mov ebx, dword [esp + 0x64]
mov dword [esp + 8], eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0xc
mov dword [esp + 0xc], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
sub esp, 0x10
test eax, eax
je 0x65a8af30
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov edi, eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x65a8aed0
mov ebp, dword [esp + 0x2c]
call esi
lea edx, [esp + 0x30]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x65a8af8e
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov dword [ebx], edx
mov dword [ebx + 4], eax
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x28]
call esi
lea edx, [esp + 0x30]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x65a8af8e
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
jmp 0x65a8aebf
mov eax, dword [esp + 0x60]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call fcn.65a83a80
mov dword [esp + 0x10], 0x65a9c650
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], str.__assuan_pipe
mov dword [esp + 0x14], eax
mov dword [esp], eax
mov dword [esp + 8], str._s___s_p_:_call:_CreatePipe_failed:__s_n
mov dword [esp + 4], 5
call fcn.65a82cd0
mov dword [esp], 5
call sub.libgpg_error_0.dll_gpg_err_set_errno
mov eax, 0xffffffff
jmp 0x65a8aec6
mov eax, dword [esp + 0x60]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call fcn.65a83a80
mov dword [esp + 0x10], 0x65a9c650
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], str.__assuan_pipe
mov dword [esp + 0x14], eax
mov dword [esp], eax
mov dword [esp + 8], str._s___s_p_:_call:_DuplicateHandle_failed:__s_n
mov dword [esp + 4], 5
call fcn.65a82cd0
mov eax, dword [esp + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp], 5
call sub.libgpg_error_0.dll_gpg_err_set_errno
mov eax, 0xffffffff
jmp 0x65a8aec6
Function at 0x65a8b030
Capabilities:
Get socket status
Read file on windows
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, dword [esp + 0x164]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
sub esp, 4
lea edi, [esp + 0x3c]
cmp eax, 3
je 0x65a8b0b0
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x168]
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x65a8b1b0
mov eax, dword [esp + 0x3c]
cmp eax, 0xffffffff
je 0x65a8b18b
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x38]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x34]
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
sub esp, 0x14
test eax, eax
jne 0x65a8b056
mov dword [esp + 0x2c], edi
mov ebp, dword [sym.imp.WS2_32.dll_recv]
mov esi, 4
mov edi, dword [esp + 0x16c]
lea esi, [esi]
lea esi, [esi]
mov eax, dword [esp + 0x168]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x65a8b0a1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x65a8b1b6
sub esi, 1
je 0x65a8b218
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
jmp 0x65a8b100
cmp eax, 0x2733
je 0x65a8b218
mov dword [esp], 5
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x14c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2736
jne 0x65a8b1e0
mov dword [esp], 9
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x14c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
jg 0x65a8b208
cmp eax, 0x6d
jne 0x65a8b180
mov dword [esp], 0x20
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x14c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x2746
je 0x65a8b1e7
jmp 0x65a8b18b
mov dword [esp], 0xb
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x14c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x65a8b8c0
Capabilities:
Connect socket

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
mov ebx, eax
test eax, eax
js 0x65a8b8f8
add esp, 0x18
mov eax, ebx
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp], eax
call fcn.65a89ee0
mov dword [esp], eax
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x18
mov eax, ebx
pop ebx
ret

Function at 0x65a8b920
Capabilities:
Get socket status
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, dword [esp + 0x164]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
sub esp, 4
lea edi, [esp + 0x3c]
cmp eax, 3
je 0x65a8b998
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x168]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x65a8ba90
mov eax, dword [esp + 0x3c]
cmp eax, 0xffffffff
je 0x65a8ba70
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x38]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x34]
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
sub esp, 0x14
test eax, eax
jne 0x65a8b946
mov dword [esp + 0x2c], edi
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov esi, 4
mov edi, dword [esp + 0x16c]
lea esi, [esi]
mov eax, dword [esp + 0x168]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x65a8b989
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x65a8ba96
sub esi, 1
je 0x65a8bae8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
jmp 0x65a8b9e0
cmp eax, 0x2733
je 0x65a8bae8
cmp eax, 0x6d
je 0x65a8bac9
mov dword [esp], 5
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x14c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2736
jne 0x65a8bac0
mov dword [esp], 9
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x14c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
jg 0x65a8ba70
cmp eax, 0xe8
jne 0x65a8ba60
mov dword [esp], 0x20
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x14c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0xb
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x14c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x65a8bbc0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
sub esp, 0x10
add esp, 0x1c
ret

Function at 0x65a8c240
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.65a99930
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.65a99930
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x65a8c2a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x65aa3168]
test esi, esi
jle 0x65a8c3c0
mov eax, dword [0x65aa316c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x65a8c2d4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x65a8c357
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x65a8c2c0
mov dword [esp], ebx
call fcn.65a8ca00
mov edi, eax
test eax, eax
je 0x65a8c3e7
mov eax, dword [0x65aa316c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.65a8cb40
mov edx, dword [0x65aa316c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x65a8c3c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x65a8c350
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x65a8c360
add dword [0x65aa3168], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x65aa316c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x65a8c350
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.65a8c240
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x65a8c2de
mov eax, dword [0x65aa316c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.65a8c240
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.65a8c240
lea esi, [esi]
nop
Function at 0x65a8ca00
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x65a80000], 0x5a4d
jne 0x65a8ca25
mov ecx, dword [0x65a8003c]
cmp dword [ecx + 0x65a80000], 0x4550
lea edx, [ecx + 0x65a80000]
je 0x65a8ca30
ret
cmp word [ecx + 0x65a80018], 0x10b
jne 0x65a8ca25
push esi
movzx eax, word [ecx + 0x65a80014]
push ebx
movzx esi, word [ecx + 0x65a80006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x65a80000
test esi, esi
je 0x65a8ca78
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x65a8ca6e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x65a8ca7a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x65a8ca60
xor eax, eax
pop ebx
pop esi
ret
Function at 0x409861
Capabilities:
Create thread
Inject thread

Disassembly:
mov eax, dword [0x53fd78]
mov dword [0x53fe4c], eax
mov edx, dword [0x53fd80]
push dword [0x540424]
call fcn.004102a0
lea ecx, [0x53fe50]
pop edx
call fcn.0040b000
push dword [0x53fe50]
call fcn.0040b380
mov ebx, eax
inc ebx
mov dword [0x53fe54], ebx
push dword [0x53fe4c]
push 0
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x53fe58], eax
cmp dword [0x53fe58], 0
je 0x4099e7
push 4
push 0x1000
push dword [0x53fe54]
push 0
push dword [0x53fe58]
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [0x53fe5c], eax
cmp dword [0x53fe5c], 0
je 0x4099dc
push 0x53fe60
push dword [0x53fe54]
push dword [0x53fe50]
push dword [0x53fe5c]
push dword [0x53fe58]
call sub.KERNEL32.dll_WriteProcessMemory
mov ebx, dword [0x53fe60]
cmp ebx, dword [0x53fe54]
jl 0x4099c0
push str.Kernel32.dll
push 0
call fcn.0040d0c9
and eax, eax
je 0x4099c0
push 0x41b3da
push 0
call fcn.0040d106
mov dword [0x53fe64], eax
push 0
call fcn.0040d05a
cmp dword [0x53fe64], 0
je 0x4099c0
push 0
push 0
push dword [0x53fe5c]
push dword [0x53fe64]
push 0
push 0
push dword [0x53fe58]
call sub.KERNEL32.dll_CreateRemoteThread
mov dword [0x53fe68], eax
cmp dword [0x53fe68], 0
je 0x4099c0
push 0xffffffff
push dword [0x53fe68]
call sub.KERNEL32.dll_WaitForSingleObject
push 0x53fcac
push dword [0x53fe68]
call sub.KERNEL32.dll_GetExitCodeThread
push 0x4000
push dword [0x53fe54]
push dword [0x53fe5c]
push dword [0x53fe58]
call sub.KERNEL32.dll_VirtualFreeEx
push dword [0x53fe58]
call sub.KERNEL32.dll_CloseHandle
push dword [0x53fd80]
call fcn.0040f7ae
mov dword [0x53fcac], eax
ret
Function at 0x40c257
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
push dword [0x540004]
mov dword [ebp - 8], ebx
xor edi, edi
call fcn.0041002e
mov esi, eax
cmp esi, ebx
je 0x40c392
mov eax, dword [esi]
mov dword [ebp - 4], eax
cmp dword [esi + 0x14], ebx
je 0x40c2f6
push dword [ebp + 8]
call fcn.0040c4b9
jmp 0x40c29a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1d], bl
jne 0x40c292
push dword [esi + 0x14]
call fcn.0040c6f7
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
push ebx
mov eax, esi
mov byte [esi + 0x1c], 1
call fcn.0040c134
pop ecx
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push 0x40c1a9
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x40c2dc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x34]
mov esi, dword [esi]
mov eax, dword [esi]
push 1
push ebx
push ebx
push esi
call dword [eax + 0x30]
jmp 0x40c392
test byte [ebp + 0xc], 1
je 0x40c2ff
xor edi, edi
inc edi
test byte [ebp + 0xc], 2
je 0x40c36b
push esi
call fcn.0040bdbc
lea eax, [esi + 4]
push 0xc
push eax
call fcn.004101a7
pop ecx
pop ecx
lea edx, [ebp - 4]
push edx
push dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [0x540018]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jne 0x40c392
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
push dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
push dword [esi + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
push dword [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push ebx
push ebx
push eax
call dword [ecx + 0x30]
jmp 0x40c392
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x34]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push ebx
push ebx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x40c392
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40c87d
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x40c895
push dword [esp + 4]
push 0x40c816
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x40c8d2
push esi
mov esi, dword [0x540044]
test esi, esi
je 0x40c8d1
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40c8c9
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x540044
call fcn.004101ea
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x40c8a2
pop edi
pop ebx
pop esi
ret 4
Function at 0x40f6b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x40f722
push 0x11
call esi
test al, al
js 0x40f722
push 0x10
call esi
test al, al
js 0x40f722
push 0x12
call esi
test al, al
js 0x40f722
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40f722
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x40f746
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x40f746
dec eax
push eax
push dword [0x54094c]
call fcn.0041002e
mov eax, dword [eax + 0xc]
jmp 0x40f748
xor eax, eax
pop esi
leave
ret 4

Function at 0x40f7c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x40f7f5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x40fa80
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x54095c]
push ebx
push esi
push edi
push eax
or edi, 0xffffffff
push ecx
or ebx, edi
call fcn.0041002e
mov esi, eax
test esi, esi
je 0x40fada
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov eax, dword [esp + 0x10]
xor edi, edi
xor edx, edx
or ecx, edx
or edi, eax
cmp dword [esi + 4], edx
je 0x40fad0
cmp dword [esi + 0x14], edx
jne 0x40fad0
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
cdq
add ecx, eax
adc edi, edx
mov edx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
ret 4
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
ret 4

Function at 0x40faf0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x54095c]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.0041002e
test eax, eax
je 0x40fb3a
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x40fb27
push 1
push edx
push eax
call fcn.0040fdb0
movzx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [esp + 3]
pop ecx
ret 4
Function at 0x40fb50
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x54095c]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041002e
test eax, eax
je 0x40fb9a
cmp dword [eax + 4], 0
lea edx, [esp]
je 0x40fb87
push 4
push edx
push eax
call fcn.0040fdb0
mov eax, dword [esp]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x40fbb0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x54095c]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.0041002e
test eax, eax
je 0x40fbfa
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x40fbe7
push 1
push edx
push eax
call fcn.0040fdb0
movsx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, byte [esp + 3]
pop ecx
ret 4

Function at 0x40fc10
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x40fc69
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40fc68
mov eax, dword [esp + 0x10]
mov ecx, dword [0x54095c]
push eax
push ecx
call fcn.0041002e
test eax, eax
je 0x40fc64
cmp dword [eax + 4], 0
je 0x40fc52
push esi
push edi
push eax
call fcn.0040fee0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x40fc70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push edi
push eax
push 0x1000
mov dword [esp + 0x1c], 0x1000
call fcn.004104e0
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x54095c]
push ecx
mov edi, eax
push edx
mov ebp, edi
call fcn.0041002e
mov ebx, eax
test ebx, ebx
je 0x40fd8e
push esi
lea ecx, [ecx]
mov byte [esp + 0x13], 0
cmp dword [ebx + 4], 0
je 0x40fcce
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.0040fdb0
mov dword [esp + 0x14], eax
jmp 0x40fce5
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x13]
test al, al
je 0x40fcf7
mov byte [ebp], al
mov al, byte [esp + 0x13]
add ebp, 1
mov ecx, dword [esp + 0x18]
mov esi, ebp
sub esi, edi
cmp esi, ecx
jl 0x40fd21
mov edx, dword [esp + 0x24]
add ecx, 0x1000
push edx
push ecx
mov dword [esp + 0x20], ecx
call fcn.004104e0
mov edi, eax
mov al, byte [esp + 0x13]
lea ebp, [esi + edi]
test al, al
je 0x40fd8d
cmp dword [esp + 0x14], 0
je 0x40fd38
cmp al, 0xd
je 0x40fd38
cmp al, 0xa
jne 0x40fcb0
sub ebp, 1
cmp al, 0xd
jne 0x40fd8d
cmp dword [ebx + 4], 0
je 0x40fd54
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.0040fdb0
jmp 0x40fd6b
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x40fd8d
cmp dword [ebx + 4], 0
je 0x40fd7e
add dword [ebx + 0xc], 1
jmp 0x40fd8d
mov ecx, dword [ebx]
push 1
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
sub edi, ebp
add edi, dword [esp + 0x14]
mov byte [ebp], 0
push edi
call fcn.00410560
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8