Function at 0x42c4d0
Capabilities:
Contain obfuscated stackstrings
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4969fd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4e3ec8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 8]
push eax
push 0x66
call sub.mfc100.dll_Ordinal_381
xor ebx, ebx
lea ecx, [esi + 0x94]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CHookDlg.0
call fcn.004673f0
lea ecx, [esi + 0xec]
mov byte [ebp - 4], 1
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0xec], vtable.CStatic.0
lea ecx, [esi + 0x160]
mov byte [ebp - 4], 2
call sub.mfc100.dll_Ordinal_895
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x1d4]
mov byte [ebp - 4], 3
call sub.mfc100.dll_Ordinal_895
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x248]
mov byte [ebp - 4], 4
call sub.mfc100.dll_Ordinal_895
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x2bc]
mov byte [ebp - 4], 5
call sub.mfc100.dll_Ordinal_895
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x330]
mov byte [ebp - 4], 6
call sub.mfc100.dll_Ordinal_895
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x3a4]
mov byte [ebp - 4], 7
call sub.mfc100.dll_Ordinal_895
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x418]
mov byte [ebp - 4], 8
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x418], 0x4af294
lea ecx, [esi + 0x48c]
mov byte [ebp - 4], 9
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x48c], 0x4af294
lea ecx, [esi + 0x504]
mov byte [ebp - 4], 0xa
mov byte [esi + 0x500], bl
call sub.mfc100.dll_Ordinal_457
mov edi, vtable.CBitmap.0
mov dword [esi + 0x510], ebx
mov dword [esi + 0x50c], edi
mov dword [esi + 0x518], ebx
mov dword [esi + 0x514], edi
mov dword [esi + 0x520], ebx
mov dword [esi + 0x51c], edi
mov dword [esi + 0x528], ebx
mov dword [esi + 0x524], edi
mov dword [esi + 0x530], ebx
mov dword [esi + 0x52c], edi
mov dword [esi + 0x538], ebx
mov dword [esi + 0x534], edi
mov dword [esi + 0x540], ebx
mov dword [esi + 0x53c], edi
mov dword [esi + 0x548], ebx
mov dword [esi + 0x544], edi
mov dword [esi + 0x550], ebx
mov dword [esi + 0x54c], edi
mov dword [esi + 0x558], ebx
mov dword [esi + 0x554], edi
mov dword [esi + 0x560], ebx
mov dword [esi + 0x55c], edi
mov dword [esi + 0x568], ebx
mov dword [esi + 0x564], edi
mov dword [esi + 0x570], ebx
mov dword [esi + 0x56c], edi
mov dword [esi + 0x578], ebx
mov dword [esi + 0x574], edi
push fcn.00467140
push fcn.004673f0
push 0x1f4
push 0x58
lea ecx, [esi + 0x57c]
push ecx
mov byte [ebp - 4], 0x19
call fcn.0048ea1c
push fcn.00467140
push fcn.004673f0
push 0x1f4
push 0x58
lea edx, [esi + 0xb15c]
push edx
mov byte [ebp - 4], 0x1a
call fcn.0048ea1c
mov eax, dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [sym.imp.mfc100.dll_Ordinal_316]
push eax
push ecx
push 0x64
push 4
lea edx, [esi + 0x15d3c]
push edx
mov byte [ebp - 4], 0x1b
call fcn.0048ea1c
lea ecx, [esi + 0x15edc]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x15ee0]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x15ef4]
mov byte [ebp - 4], 0x1e
mov byte [esi + 0x15ee4], bl
call fcn.00438de0
lea ecx, [esi + 0x15f74]
mov byte [ebp - 4], 0x1f
call fcn.0046bc00
lea ecx, [esi + 0x1748c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov dword [esi + 0x174c4], ebx
mov dword [esi + 0x174c0], 0x4ae2a0
lea ecx, [esi + 0x174cc]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x174d0]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x174d4]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x174d8]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x174dc]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x174e0]
mov byte [ebp - 4], 0x27
call fcn.0040d080
lea ecx, [esi + 0x1750c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0x4b16e8
lea ecx, [esi + 0x17510]
mov byte [ebp - 4], 0x29
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0x4b16e8
lea ecx, [esi + 0x17514]
mov byte [ebp - 4], 0x2a
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0x4b16e8
lea ecx, [esi + 0x17518]
mov byte [ebp - 4], 0x2b
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [esi + 0x1751c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x17520]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x17524]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x17528]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x1752c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x17530]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov word [esi + 0x17534], bx
mov byte [esi + 0x17536], 1
push 0x4ae26b
lea ecx, [esi + 0x17ba4]
mov byte [ebp - 4], 0x32
mov dword [esi + 0x17b7c], ebx
mov dword [esi + 0x17b80], ebx
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0x4b64ac
lea ecx, [esi + 0x17ba8]
mov byte [ebp - 4], 0x33
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov word [esi + 0x17bac], 0x101
mov byte [esi + 0x17bae], 1
mov eax, vtable.CFont.0
mov dword [esi + 0x17d48], ebx
mov dword [esi + 0x17d44], eax
mov dword [esi + 0x17d50], ebx
mov dword [esi + 0x17d4c], eax
mov byte [esi + 0x17d6a], bl
mov dword [esi + 0x17d70], ebx
mov dword [esi + 0x17d6c], eax
mov dword [esi + 0x17d7c], ebx
mov dword [esi + 0x17d78], 0x4ae2a0
lea ecx, [esi + 0x17d80]
mov byte [ebp - 4], 0x38
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x17d80], 0x4b554c
lea ecx, [esi + 0x17df4]
mov byte [ebp - 4], 0x39
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x17df4], 0x4b554c
lea ecx, [esi + 0x17e68]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x17e6c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x17e70]
mov byte [ebp - 4], 0x3c
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x17e70], 0x4b554c
mov eax, dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [sym.imp.mfc100.dll_Ordinal_316]
push eax
push ecx
push 0x64
push 4
lea edx, [esi + 0x17ef0]
push edx
mov byte [ebp - 4], 0x3d
mov byte [esi + 0x17ee8], bl
call fcn.0048ea1c
lea ecx, [esi + 0x18084]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x18088]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x1808c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x18094]
mov byte [ebp - 4], 0x41
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x18094], 0x4af294
mov dword [esi + 0x18108], ebx
mov dword [esi + 0x1810c], ebx
lea ecx, [esi + 0x18118]
mov byte [ebp - 4], 0x42
mov dword [esi + 0x18110], ebx
mov dword [esi + 0x18114], ebx
call sub.mfc100.dll_Ordinal_374
mov dword [esi + 0x1812c], ebx
mov dword [esi + 0x18128], edi
lea ecx, [esi + 0x18138]
mov byte [ebp - 4], 0x44
call fcn.00448590
lea ecx, [esi + 0x18504]
mov byte [ebp - 4], 0x45
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x18504], 0x4af11c
lea ecx, [esi + 0x18578]
mov byte [ebp - 4], 0x46
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x18578], 0x4af294
lea ecx, [esi + 0x185f0]
mov byte [ebp - 4], 0x47
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x185f0], 0x4ae2bc
lea ecx, [esi + 0x18664]
mov byte [ebp - 4], 0x48
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x18664], 0x4af294
lea ecx, [esi + 0x186d8]
mov byte [ebp - 4], 0x49
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x186d8], 0x4b56d4
lea ecx, [esi + 0x1874c]
mov byte [ebp - 4], 0x4a
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x1874c], 0x4b5844
lea ecx, [esi + 0x187c0]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x187c4]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [esi + 0x187c8]
mov byte [ebp - 4], 0x4d
call fcn.0043b7b0
push 0x4ae26b
lea ecx, [esi + 0x18964]
mov byte [ebp - 4], 0x4e
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [esi + 0x18968]
mov byte [ebp - 4], 0x4f
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x18968], 0x4aea2c
lea ecx, [esi + 0x189dc]
mov byte [ebp - 4], 0x50
call sub.mfc100.dll_Ordinal_895
mov dword [esi + 0x189dc], 0x4b554c
push 0x4ae26b
lea ecx, [esi + 0x18a50]
mov byte [ebp - 4], 0x51
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov eax, dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [sym.imp.mfc100.dll_Ordinal_316]
push eax
push ecx
push 0x1f4
push 4
lea edx, [esi + 0x18a58]
push edx
mov byte [ebp - 4], 0x52
call fcn.0048ea1c
mov byte [ebp - 4], 0x53
mov dword [esi + 0x18a54], ebx
call fcn.00418890
mov dword [0x4e45f4], eax
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00421250
push ebx
push 1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x54
call dword [sym.imp.mfc100.dll_Ordinal_4143]
mov ecx, dword [0x4e45f4]
mov edx, dword [ecx]
test eax, eax
mov eax, dword [edx + 0x1c]
je 0x42cb87
push 0xbb4700
call eax
push 0xffffff
jmp 0x42cb8f
push 0xe5caa9
call eax
push ebx
mov ecx, dword [0x4e45f4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4ae26b
mov byte [esi + 0x17d69], bl
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, esi
call fcn.00423ab0
call sub.mfc100.dll_Ordinal_1929
push 0x8b
push 0xe
push 0x8b
call sub.mfc100.dll_Ordinal_1900
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
lea ecx, [ebp - 0x10]
push ecx
mov dword [esi + 0x17d74], eax
mov byte [esi + 0x17468], bl
mov byte [esi + 0x17d56], 1
call fcn.00479050
add esp, 4
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x55
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or edi, 0xffffffff
cmp eax, edi
jne 0x42cc22
push ebx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edx, [ebp + 8]
push edx
call fcn.004780a0
add esp, 4
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x56
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, edi
jne 0x42cc57
push ebx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, esi
call fcn.00427c90
mov ecx, esi
mov dword [esi + 0x15ed0], ebx
mov dword [esi + 0x17478], edi
mov dword [esi + 0x1747c], edi
mov dword [esi + 0x17450], edi
mov dword [esi + 0x17480], edi
mov dword [esi + 0x18134], ebx
mov dword [esi + 0x17d40], ebx
mov word [esi + 0x17d54], 0x100
mov dword [esi + 0x185ec], ebx
mov dword [esi + 0x17ee4], edi
call fcn.00422340
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4af974
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.in_chookdlg_constructor
mov byte [ebp - 4], 0x57
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 0x58
call sub.mfc100.dll_Ordinal_1929
mov ecx, dword [eax + 4]
mov byte [ebp - 4], 0x56
call fcn.0041a0c0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4