joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4312e0
Capabilities:
Check for time delay via gettickcount
Delete file
Enumerate files on windows

Disassembly:
mov ecx, dword [0x45de54]
sub esp, 0x570
push esi
push 0
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
mov esi, dword [esp + 0x578]
test esi, esi
je 0x43133c
cmp byte [esi], 0
je 0x43133c
push 0x4567b0
push esi
call fcn.00409fc0
add esp, 8
test eax, eax
jne 0x43134b
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x43133c
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
mov eax, 1
pop esi
add esp, 0x570
ret 4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x431350
sub eax, edx
cmp eax, 0x208
jae 0x43133c
push 0x207
lea eax, [esp + 0x168]
push esi
push eax
call fcn.00443880
lea ecx, [esp + 0x170]
push 0x5c
push ecx
mov byte [esp + 0x37f], 0
call fcn.00444bf0
add esp, 0x14
test eax, eax
je 0x431397
mov byte [eax + 1], 0
jmp 0x43139f
mov byte [esp + 0x164], 0
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 4], 0
je 0x431464
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
sub eax, dword [0x45ef34]
cmp eax, 5
jbe 0x43140a
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x431403
push 0
push 0xffffffffffffffff
call fcn.00401650
add esp, 8
call edi
mov dword [0x45ef34], eax
test byte [esp + 0x30], 0x10
jne 0x43144a
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x174]
push edx
push str._s_s
lea eax, [esp + 0x384]
push 0x208
push eax
call fcn.0043c2b0
add esp, 0x14
lea ecx, [esp + 0x378]
push ecx
call ebp
test eax, eax
jne 0x43144a
inc dword [esp + 0x10]
lea edx, [esp + 0x30]
push edx
push esi
call ebx
test eax, eax
jne 0x4313d3
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 4]
mov ecx, dword [0x45de54]
push eax
call fcn.0043fa40
pop esi
add esp, 0x570
ret 4

Function at 0x431500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x80
push esi
push 1
push 0
call fcn.00415da0
mov esi, eax
test esi, esi
jne 0x431520
pop esi
add esp, 0x80
ret 4
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
push 0
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0043e8a0
mov eax, dword [esp + 0x88]
test eax, eax
je 0x4315a9
cmp byte [eax], 0
je 0x4315a9
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x431570
pop edi
mov eax, 1
pop esi
add esp, 0x80
ret 4
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0043c090
add esp, 8
push eax
mov ecx, esi
call fcn.0043e8a0
pop edi
pop esi
add esp, 0x80
ret 4
mov eax, 1
pop esi
add esp, 0x80
ret 4
Function at 0x432240
Capabilities:
Get file version info

Disassembly:
sub esp, 0x8c
push edi
push 1
push 0
call fcn.00415da0
mov edi, eax
test edi, edi
jne 0x432260
pop edi
add esp, 0x8c
ret 4
mov ecx, dword [0x45de54]
push ebp
push 0
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
push 0
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.0043e8a0
mov ebp, dword [esp + 0x98]
test ebp, ebp
je 0x43237a
cmp byte [ebp], 0
je 0x43237a
push ebx
lea eax, [esp + 0x10]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4322be
pop ebx
pop ebp
mov eax, 1
pop edi
add esp, 0x8c
ret 4
push esi
push ebx
call fcn.00444a39
add esp, 4
mov esi, eax
push esi
push ebx
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x4523d4
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x432308
push esi
call fcn.00444c1d
add esp, 4
pop esi
pop ebx
pop ebp
mov eax, 1
pop edi
add esp, 0x8c
ret 4
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
and edx, 0xffff
push edx
shr ecx, 0x10
push ecx
mov ecx, eax
and ecx, 0xffff
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
lea edx, [esp + 0x30]
push 0x80
push edx
call fcn.0043c2b0
push esi
call fcn.00444c1d
mov ecx, dword [0x45de54]
add esp, 0x20
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.0043e8a0
pop esi
pop ebx
pop ebp
pop edi
add esp, 0x8c
ret 4
pop ebp
mov eax, 1
pop edi
add esp, 0x8c
ret 4

Function at 0x432430
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0x10
jne 0x43244b
pop edi
mov al, 1
pop ebx
ret 4
cmp eax, 0xffffffff
push esi
jne 0x4324a2
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
cmp eax, 3
jne 0x4324d9
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432463
sub eax, edx
inc eax
push eax
call fcn.004444d3
mov esi, eax
mov edx, esi
add esp, 4
mov eax, edi
sub edx, edi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x432480
push 0x5c
push esi
call fcn.00444bf0
add esp, 8
test eax, eax
push esi
jne 0x4324aa
call fcn.004441cd
add esp, 4
pop esi
pop edi
xor al, al
pop ebx
ret 4
mov ecx, ebx
mov byte [eax], 0
call fcn.00432430
push esi
mov bl, al
call fcn.004441cd
add esp, 4
test bl, bl
je 0x4324d1
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
setne bl
pop esi
pop edi
mov al, bl
pop ebx
ret 4
call esi
cmp eax, 2
jne 0x4324a2
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
pop esi
test eax, eax
pop edi
setne al
pop ebx
ret 4
Function at 0x432500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x140
push esi
mov esi, dword [esp + 0x148]
push 0x2a
push esi
call fcn.00443dd0
add esp, 8
test eax, eax
jne 0x432543
push 0x3f
push esi
call fcn.00443dd0
add esp, 8
test eax, eax
jne 0x432543
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
pop esi
add esp, 0x140
ret 4
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x432560
xor al, al
pop esi
add esp, 0x140
ret 4
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, 1
pop esi
add esp, 0x140
ret 4
Function at 0x432c70
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x414
push esi
push 1
push 0
call fcn.00415da0
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jne 0x432c94
pop esi
add esp, 0x414
ret 0x10
mov ecx, dword [0x45de54]
push ebx
push ebp
push edi
push 0
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
push 0
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0043e8a0
mov ecx, dword [esp + 0x428]
mov al, byte [ecx]
cmp al, 0x41
mov edx, dword [esp + 0x434]
mov esi, dword [esp + 0x430]
mov edi, dword [esp + 0x42c]
je 0x432cde
cmp al, 0x61
jne 0x432d16
mov bl, byte [ecx + 1]
test bl, bl
jne 0x432d16
cmp byte [edi], 0
jne 0x432d16
cmp byte [esi], 0
jne 0x432d16
cmp byte [edx], 0
jne 0x432d16
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
test ebp, ebp
je 0x432d7a
mov al, byte [0x45d5fd]
test al, al
jne 0x432d76
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x432d7a
jmp 0x432d76
test al, al
jne 0x432d5e
cmp byte [edi], 0
jne 0x432d5e
cmp byte [esi], 0
jne 0x432d5e
cmp byte [edx], 0
jne 0x432d5e
mov eax, dword [0x45d6d0]
test eax, eax
je 0x432d7a
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x432d7a
mov al, byte [0x45d5fd]
test al, al
jne 0x432d56
mov eax, dword [0x45d6d0]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x432d7a
mov ebp, dword [0x45d6d0]
jmp 0x432d76
push 0
push 0
push 0
push 0
push 0
push edx
push esi
push edi
push ecx
call fcn.004417e0
add esp, 0x24
mov ebp, eax
test ebp, ebp
jne 0x432d8c
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x414
ret 0x10
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0
push ebp
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
test esi, esi
je 0x432dc5
cmp esi, edi
je 0x432dc5
push ebp
call fcn.004407a0
add esp, 4
test al, al
jne 0x432dc5
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_GetFocus]
test bl, bl
mov dword [esp + 0x1c], eax
je 0x432de1
push 0
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x432d7a
lea ecx, [esp + 0x24]
push 0x3fd
mov edx, ecx
push edx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x432d7a
lea eax, [esp + 0x10]
push eax
push 0x42ad50
push ebp
mov dword [esp + 0x24], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov al, byte [esp + 0x14]
test al, al
je 0x432d7a
mov ecx, dword [esp + 0x18]
push ecx
push 0x44f694
lea edx, [esp + 0x2c]
push 0x400
push edx
call fcn.0043c2e0
mov ecx, dword [0x45de54]
add esp, 0x10
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
mov ecx, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push eax
call fcn.0043e8a0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x414
ret 0x10
Function at 0x435f00
Capabilities:
Enumerate gui resources
Shutdown system

Disassembly:
mov al, byte [0x45f110]
sub esp, 0x14
test al, al
je 0x435f6c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x435f66
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x435f6c
xor al, al
add esp, 0x14
ret
mov al, byte [0x45f111]
test al, al
push ebx
mov ebx, dword [esp + 0x1c]
je 0x435f8f
test bl, 4
je 0x435f8f
push 0
push 0x434af0
xor ebx, 4
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
pop ebx
add esp, 0x14
ret

Function at 0x435fb0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x128
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x43602e
cmp byte [eax], bl
je 0x43602e
lea edx, [esp + 0x24]
push edx
push eax
call fcn.00434f60
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x435fd7
sub eax, edx
mov byte [esp + eax + 0x25], bl
lea ecx, [esp + 4]
lea eax, [esp + 0x24]
push ecx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
mov word [esp + 0x18], 0x54
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
mov eax, 0x452c78
jne 0x436028
mov eax, 0x44f664
push ebx
push 0xffffffffffffffff
push eax
jmp 0x436036
push ebx
push 0xffffffffffffffff
push 0x452c78
mov ecx, dword [0x45de54]
call fcn.0043e8a0
pop ebx
add esp, 0x128
ret 4
Function at 0x436050
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x234
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
push edi
lea eax, [esp + 0xc]
push eax
mov edi, ecx
lea ecx, [esp + 0x34]
push ecx
push 0x104
push edx
call esi
lea eax, [esp + 0x30]
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436080
sub eax, edx
cmp byte [esp + eax + 0x2f], 0x5c
jne 0x4360a4
lea eax, [esp + 0x30]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436097
sub eax, edx
mov byte [esp + eax + 0x2f], bl
mov edx, dword [esp + 0x248]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x13c]
push ecx
push 0x104
push edx
call esi
lea eax, [esp + 0x138]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4360d0
sub eax, edx
cmp byte [esp + eax + 0x137], 0x5c
jne 0x436100
lea eax, [esp + 0x138]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4360f0
sub eax, edx
mov byte [esp + eax + 0x137], bl
mov esi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
lea eax, [esp + 0x30]
push eax
call esi
cmp eax, 0xffffffff
je 0x436132
test al, 0x10
je 0x436132
lea ecx, [esp + 0x138]
push ecx
call esi
cmp eax, 0xffffffff
je 0x436140
test al, 0x10
je 0x436140
cmp byte [esp + 0x24c], bl
jne 0x43615f
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x234
ret 0xc
lea edx, [esp + 0x138]
push edx
mov ecx, edi
call fcn.00432430
test al, al
jne 0x43615f
pop edi
pop esi
pop ebx
add esp, 0x234
ret 0xc
lea edi, [esp + 0x30]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x436164
mov eax, dword [str..]
mov cl, byte [0x456d0c]
mov dword [edi], eax
lea eax, [esp + 0x30]
mov byte [edi + 4], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436183
sub eax, edx
mov byte [esp + eax + 0x31], bl
lea eax, [esp + 0x138]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4361a0
sub eax, edx
mov byte [esp + eax + 0x139], bl
lea ecx, [esp + 0x10]
lea edx, [esp + 0x30]
lea eax, [esp + 0x138]
push ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x2a], ebx
mov dword [esp + 0x2e], ebx
mov dword [esp + 0x26], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 2
mov word [esp + 0x24], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
pop edi
sbb al, al
pop esi
inc al
pop ebx
add esp, 0x234
ret 0xc
Function at 0x436200
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x12c
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0x104
push edx
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
lea eax, [esp + 0x28]
lea edx, [eax + 1]
xor ebx, ebx
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436230
sub eax, edx
cmp byte [esp + eax + 0x27], 0x5c
jne 0x436254
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436247
sub eax, edx
mov byte [esp + eax + 0x27], bl
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x436268
test al, 0x10
jne 0x436274
xor al, al
pop ebx
add esp, 0x12c
ret 8
cmp byte [esp + 0x138], bl
jne 0x436297
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
setne al
pop ebx
add esp, 0x12c
ret 8
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4362a0
sub eax, edx
mov byte [esp + eax + 0x29], bl
lea eax, [esp + 4]
lea edx, [esp + 0x28]
push eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop ebx
add esp, 0x12c
ret 8
Function at 0x4366c0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x234
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
push edi
lea eax, [esp + 0xc]
push eax
mov edi, ecx
lea ecx, [esp + 0x34]
push ecx
push 0x104
push edx
call esi
lea eax, [esp + 0x30]
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4366f0
sub eax, edx
cmp byte [esp + eax + 0x2f], 0x5c
jne 0x436714
lea eax, [esp + 0x30]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436707
sub eax, edx
mov byte [esp + eax + 0x2f], bl
mov edx, dword [esp + 0x248]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x13c]
push ecx
push 0x104
push edx
call esi
lea eax, [esp + 0x138]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436740
sub eax, edx
cmp byte [esp + eax + 0x137], 0x5c
jne 0x436770
lea eax, [esp + 0x138]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436760
sub eax, edx
mov byte [esp + eax + 0x137], bl
mov esi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
lea eax, [esp + 0x30]
push eax
call esi
cmp eax, 0xffffffff
je 0x4367d4
test al, 0x10
je 0x4367d4
lea ecx, [esp + 0x138]
push ecx
call esi
cmp eax, 0xffffffff
je 0x4367a2
test al, 0x10
je 0x4367a2
cmp byte [esp + 0x24c], bl
je 0x4367d4
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.00434fb0
test al, al
je 0x436801
push 1
lea ecx, [esp + 0x13c]
push ecx
lea edx, [esp + 0x38]
push edx
mov ecx, edi
call fcn.00436050
test al, al
jne 0x4367e2
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x234
ret 0xc
push 1
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.00436200
pop edi
test al, al
pop esi
setne al
pop ebx
add esp, 0x234
ret 0xc
lea eax, [esp + 0x30]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436808
sub eax, edx
mov byte [esp + eax + 0x31], bl
lea eax, [esp + 0x138]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x436820
sub eax, edx
mov byte [esp + eax + 0x139], bl
lea eax, [esp + 0x10]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x138]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2a], ebx
mov dword [esp + 0x2e], ebx
mov dword [esp + 0x26], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 1
mov word [esp + 0x24], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
add esp, 0x234
ret 0xc
Function at 0x4368c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4368cc
xor eax, eax
ret
push esi
mov esi, dword [eax*4 + 0x45dde0]
test esi, esi
je 0x436997
mov eax, dword [esi]
test eax, eax
push ebx
push ebp
push edi
je 0x436935
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x436935
xor edi, edi
mov eax, dword [edi*4 + 0x45dde0]
test eax, eax
je 0x436910
mov eax, dword [eax + 0x36d4]
cmp eax, dword [esi]
jne 0x436910
push edi
call fcn.004368c0
add esp, 4
inc edi
cmp edi, 5
jb 0x4368f2
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.USER32.dll_SetMenu]
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x36e4]
test eax, eax
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
je 0x436948
push eax
call ebp
mov eax, dword [esi + 0x36ec]
test eax, eax
je 0x436955
push eax
call ebp
mov eax, dword [esi + 8]
xor ebx, ebx
test eax, eax
jbe 0x436975
lea edi, [esi + 0x24]
mov eax, dword [edi]
test eax, eax
je 0x43696a
push eax
call ebp
mov eax, dword [esi + 8]
inc ebx
add edi, 0x1c
cmp ebx, eax
jb 0x436961
mov esi, dword [esp + 0x14]
mov ecx, dword [esi*4 + 0x45dde0]
push ecx
call fcn.004441cd
add esp, 4
pop edi
pop ebp
mov dword [esi*4 + 0x45dde0], 0
pop ebx
mov eax, 1
pop esi
ret
Function at 0x437150
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43715f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret

Function at 0x437170
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x36c0]
test eax, eax
jne 0x43718f
mov ecx, dword [ecx]
test ecx, ecx
je 0x4371ad
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret
mov eax, dword [ecx]
push 0
push 0xffffffffffffffff
push 0x464
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0xffffffffffffffff
call fcn.00401650
add esp, 8
mov eax, 1
ret
Function at 0x438970
Capabilities:
Hide graphical window

Disassembly:
movzx eax, byte [esp + 4]
dec eax
jne 0x438987
mov eax, dword [ecx]
test eax, eax
je 0x438987
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret 4

Function at 0x43b470
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010c
call fcn.004444f0
push ebx
push esi
push edi
push 1
push 0
call fcn.00415da0
mov ebx, eax
test ebx, ebx
jne 0x43b49b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x43b4a7
cmp byte [esi], 0
jne 0x43b4ac
mov esi, str.ERROR
mov edx, dword [ebp + 8]
xor eax, eax
mov byte [esp + 0x118], 0
mov ecx, 0x3fff
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x104
push edx
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push 0xffff
lea ecx, [esp + 0x120]
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x120]
push ecx
mov ecx, ebx
call fcn.0043e8a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43bd30
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
mov esi, dword [esp + 0x120]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
je 0x43bde2
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebp
test eax, eax
jne 0x43bdef
mov edx, dword [esp + 0x14]
push edx
call fcn.0043bd30
mov bl, al
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x43bdef
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x43bdef
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
jne 0x43bd76
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x110
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret

Function at 0x43be00
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov ecx, dword [0x45de54]
push edi
push 0
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x43be28
mov eax, 1
pop edi
pop ecx
ret 0xc
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43be50
pop ebp
mov eax, 1
pop edi
pop ecx
ret 0xc
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x43be9e
cmp byte [esi], 0
je 0x43be9e
push str.ahk_default
push esi
call fcn.0044e5aa
add esp, 8
test eax, eax
jne 0x43be75
mov esi, 0x44f4f8
mov ecx, dword [esp + 0xc]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43bed6
pop esi
pop ebp
mov eax, 1
pop edi
pop ecx
ret 0xc
mov eax, dword [esp + 0xc]
push ebx
push eax
call fcn.0043bd30
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
je 0x43be92
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x43bed6
pop esi
pop ebp
mov eax, 1
pop edi
pop ecx
ret 0xc
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
pop esi
pop ebp
pop edi
pop ecx
ret 0xc