joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f3dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
xor ebx, ebx
cmp byte [0x466eec], bl
mov dword [ebp - 8], ecx
jne 0x40f541
cmp dword [0x4663c4], ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
jne 0x40f40d
call edi
mov dword [0x4663c4], eax
inc dword [0x466ee8]
push esi
call edi
mov ecx, dword [0x466ee8]
mov esi, dword [0x463080]
mov edx, eax
sub edx, dword [0x4663c4]
cmp ecx, dword [0x46307c]
mov dword [0x4663c8], eax
jbe 0x40f4ae
cmp edx, esi
jae 0x40f4ae
push edx
push ecx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
xor esi, esi
lea eax, [ebp - 0x80c]
push 0x800
inc esi
push eax
mov dword [ebp - 0xc], esi
call fcn.00409c5f
add esp, 0x14
call fcn.0040f1d1
fldz
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
lea eax, [ebp - 0x80c]
push 4
push eax
mov byte [0x466eec], 1
mov byte [0x463069], bl
call fcn.0043b5df
add esp, 0x18
cmp eax, 7
jne 0x40f49a
push ebx
push ebx
push esi
mov ecx, 0x465c88
call fcn.004152c3
mov eax, dword [0x4663c8]
mov byte [0x463069], 1
mov byte [0x466eec], bl
jmp 0x40f4b5
cmp edx, esi
mov dword [ebp - 0xc], ebx
jbe 0x40f4c5
cmp dword [ebp - 0xc], ebx
mov dword [0x466ee8], ebx
mov dword [0x4663c4], eax
jne 0x40f53f
mov ecx, dword [ebp - 8]
mov al, byte [ecx + 0x11]
mov byte [0x466119], al
cmp byte [ecx + 0x1a], bl
je 0x40f50d
cmp byte [ecx + 0x1b], bl
je 0x40f50d
mov byte [ebp - 1], 1
call fcn.0040ec66
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
inc byte [esi + 0x19]
call fcn.0040595f
dec byte [esi + 0x19]
cmp byte [ebp - 1], bl
mov dword [ebp + 8], eax
je 0x40f503
mov ecx, dword [ebp - 8]
call fcn.0040f165
cmp dword [ebp + 8], ebx
jne 0x40f512
mov byte [esi + 0x1d], bl
jmp 0x40f53f
mov byte [ebp - 1], bl
jmp 0x40f4e3
cmp byte [esi + 0x1d], bl
je 0x40f53f
mov byte [esi + 0x1d], bl
call edi
sub eax, dword [esi + 4]
cmp eax, 0x3e8
ja 0x40f53f
mov eax, dword [ebp - 8]
movzx eax, word [eax]
push ebx
push eax
push 0x312
push dword [0x465208]
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x40f994
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [esp + 4], 0xa
jne 0x40f99e
mov al, 0xd
ret
push ebx
push dword [esp + 0x10]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_VkKeyScanExA]
mov ebx, eax
shr ebx, 8
cmp bl, 0xff
jne 0x40f9bf
cmp al, 0xff
jne 0x40f9bf
xor al, al
pop ebx
ret
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x40fa12
mov dl, bl
and dl, 6
cmp dl, 6
jne 0x40f9df
cmp byte [0x466349], 0
je 0x40f9df
or byte [ecx], 8
jmp 0x40fa01
test bl, 2
je 0x40f9f0
mov dl, byte [ecx]
test dl, 3
jne 0x40f9f0
or dl, 1
mov byte [ecx], dl
test bl, 4
je 0x40fa01
mov dl, byte [ecx]
test dl, 0xc
jne 0x40fa01
or dl, 4
mov byte [ecx], dl
test bl, 1
je 0x40fa12
mov dl, byte [ecx]
test dl, 0x30
jne 0x40fa12
or dl, 0x10
mov byte [ecx], dl
pop ebx
ret
Function at 0x412c22
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
push edi
lea eax, [ebp - 0x10]
jge 0x412c3b
mov byte [ebp - 0x10], 0x30
lea eax, [ebp - 0xf]
push 0xa
push eax
movzx eax, byte [ebp + 8]
push eax
call fcn.0040184f
mov edi, dword [ebp + 0xc]
add esp, 0xc
cmp edi, ebx
jle 0x412cca
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp dword [0x466f78], ebx
jne 0x412ca2
call esi
sub eax, dword [0x466154]
cmp eax, dword [0x4651e4]
jbe 0x412ca2
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x412c9b
push 1
push 0xffffffffffffffff
mov byte [0x463069], bl
call fcn.0040b5c4
pop ecx
pop ecx
mov byte [0x463069], 1
call esi
mov dword [0x466154], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041183f
cmp dword [0x466f78], 2
mov eax, dword [0x465198]
pop ecx
je 0x412cbf
mov eax, dword [0x465194]
push eax
call fcn.0040fc03
dec edi
pop ecx
jne 0x412c59
pop esi
pop edi
pop ebx
leave
ret

Function at 0x413216
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
movzx eax, byte [esp + 8]
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push eax
call edi
mov ebp, dword [esp + 0x14]
and al, 1
neg al
sbb eax, eax
inc eax
inc eax
cmp ebp, 1
mov dword [esp + 8], eax
je 0x413245
cmp ebp, 2
jne 0x413312
cmp eax, ebp
je 0x413312
push ebx
xor ebx, ebx
cmp byte [esp + 0x14], 0x90
push esi
mov esi, 0xffc3d44d
jne 0x413282
cmp byte [0x466341], bl
je 0x41326f
call fcn.00413316
jmp 0x41330c
push esi
push ebx
push ebx
push ebx
push 0x90
push 1
call fcn.00410525
add esp, 0x18
push esi
push ebx
push ebx
push ebx
push dword [esp + 0x28]
push 2
call fcn.00410525
add esp, 0x18
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x465c44]
sete byte [esp + 0x1c]
cmp byte [esp + 0x1c], bl
je 0x4132cb
push 1
push 0xffffffffffffffff
mov byte [0x463069], bl
call fcn.0040b5c4
pop ecx
pop ecx
mov byte [0x463069], 1
cmp byte [esp + 0x18], 0x14
jne 0x41330c
cmp ebp, 2
jne 0x41330c
push 0x14
call edi
test al, 1
je 0x41330c
push esi
push ebx
push ebx
push ebx
push 0x10
push ebp
call fcn.00410525
add esp, 0x18
cmp byte [esp + 0x1c], bl
je 0x41330c
push 1
push 0xffffffffffffffff
mov byte [0x463069], bl
call fcn.0040b5c4
pop ecx
pop ecx
mov byte [0x463069], 1
mov eax, dword [esp + 0x10]
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret
Function at 0x41333f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x465c34]
test eax, eax
je 0x41344d
mov ecx, dword [0x465c38]
mov dl, byte [ebp + 8]
imul ecx, ecx, 0x70
mov byte [ecx + eax + 5], dl
mov eax, dword [0x465c38]
mov ecx, dword [0x465c34]
imul eax, eax, 0x70
mov dl, byte [ebp + 0xc]
mov byte [eax + ecx], dl
mov eax, dword [0x465c38]
mov ecx, dword [0x465c34]
imul eax, eax, 0x70
mov dx, word [ebp + 0x10]
mov word [eax + ecx + 2], dx
mov eax, dword [0x465c38]
mov ecx, dword [0x465c34]
imul eax, eax, 0x70
push esi
mov byte [eax + ecx + 4], 0x69
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x465c3c], eax
sub eax, dword [0x466358]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x4133c0
fadd dword [0x459a84]
mov eax, dword [0x465c38]
fmul dword [0x459a80]
mov ecx, dword [0x465c34]
imul eax, eax, 0x70
fstp dword [eax + ecx + 8]
mov eax, dword [0x465c3c]
mov dword [0x466358], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x465c34]
mov esi, eax
mov eax, dword [0x465c38]
imul eax, eax, 0x70
test esi, esi
je 0x41341b
cmp esi, dword [0x465c40]
je 0x413414
push 0x64
lea eax, [eax + ecx + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41342c
mov byte [eax + ecx + 0xc], 0
jmp 0x41342c
lea eax, [eax + ecx + 0xc]
push 0x459a7c
push eax
call fcn.00455a20
pop ecx
pop ecx
inc dword [0x465c38]
mov eax, dword [0x465c38]
cmp eax, dword [0x46306c]
mov dword [0x465c40], esi
pop esi
jl 0x41344d
and dword [0x465c38], 0
leave
ret

Function at 0x41349c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4641d8]
jne 0x4134a9
call fcn.0044e551
mov eax, dword [0x466f90]
mov ecx, dword [eax]
add dword [0x466f90], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x4134e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4641d8]
jne 0x4134ed
call fcn.0044e551
mov eax, dword [0x466f90]
mov ecx, dword [eax]
add dword [0x466f90], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x413522
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x4641d8]
jne 0x413530
call fcn.0044e551
mov eax, dword [0x466f90]
mov eax, dword [eax]
add dword [0x466f90], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [esp], ecx
fild dword [esp]
jge 0x413576
fadd qword [0x45a078]
fmul qword [0x45a070]
pop ecx
ret
Function at 0x41357e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
inc esi
mov dword [0x466f98], eax
push edi
mov edx, esi
mov eax, 0x466f98
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x467954
jl 0x413593
pop edi
mov dword [0x4641d8], esi
mov dword [0x467958], esi
pop esi
ret

Function at 0x415268
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0
call fcn.00443312
mov eax, dword [0x465340]
test eax, eax
pop ecx
pop ecx
je 0x41528d
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x4641d0]
push esi
xor esi, esi
cmp word [eax], si
jbe 0x4152b9
mov ecx, dword [esi*4 + 0x4663d0]
test ecx, ecx
je 0x4152ac
push 1
call fcn.0040d7ee
mov eax, dword [0x4641d0]
movzx eax, word [eax]
inc esi
cmp esi, eax
jl 0x41529a
push dword [esp + 8]
call fcn.0043d4a6
pop esi

Function at 0x4152c3
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esi + 0x468], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x4152ea
cmp byte [eax], bl
mov byte [ebp + 0xb], 1
je 0x4152ed
mov byte [ebp + 0xb], bl
cmp eax, ebx
je 0x415336
cmp byte [eax], bl
je 0x415336
push eax
push str.Critical_Error:__s_n_nThe_program_will_exit.
lea eax, [ebp - 0x54c]
push 0x400
push eax
call fcn.00409c5f
add esp, 0x10
push 0x10000
push dword [0x46611c]
lea eax, [ebp - 0x54c]
push eax
push dword [0x465208]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
mov ecx, esi
call fcn.0041545a
cmp dword [esi + 0x464], ebx
je 0x415346
cmp byte [0x4686a8], bl
je 0x415350
push dword [ebp + 0x10]
mov ecx, esi
call fcn.0041545a
mov ecx, dword [0x465b20]
push 0x80
call fcn.00401d39
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00438c79
push 0xc8
lea eax, [ebp - 0x14c]
push 0x465138
push eax
call fcn.00455650
push ebx
push 1
push 1
push ebx
call fcn.0040b4ee
add esp, 0x28
cmp dword [0x46537c], ebx
je 0x4153a4
push 0x465b28
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov al, byte [0x463069]
mov byte [ebp + 0xf], al
mov al, byte [0x465351]
push ebx
mov ecx, 0x465c88
mov byte [0x463069], bl
mov byte [ebp - 1], al
call fcn.0040b419
mov ecx, dword [esi + 0x464]
mov byte [0x4686a8], 1
call fcn.0040595f
test eax, eax
jne 0x4153e5
push dword [ebp + 0x10]
mov ecx, esi
call fcn.0041545a
cmp byte [ebp + 0xb], bl
mov byte [0x4686a8], bl
je 0x4153fa
push dword [ebp + 0x10]
mov ecx, esi
call fcn.0041545a
push ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0040b337
mov al, byte [ebp + 0xf]
add esp, 0xc
cmp byte [ebp - 1], bl
mov byte [0x463069], al
je 0x415451
cmp byte [0x465351], bl
jne 0x415451
mov eax, dword [0x46614c]
cmp eax, 0xa
jge 0x415433
push 0xa
pop eax
push 0x40aea3
push eax
push 0xa
push dword [0x465208]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne al
mov byte [0x465351], al
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0xc
Function at 0x415efa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 0x2af8
jae 0x415f76
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx*4 + 0x465928]
test ecx, ecx
je 0x415f76
cmp eax, dword [ecx + 0xc]
jae 0x415f76
cmp dword [ebp + 0x10], 0
mov ecx, dword [ecx + 0x14]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
mov ecx, dword [eax + 8]
je 0x415f55
test ecx, ecx
je 0x415f46
push dword [ecx + 0x10]
push dword [ebp + 0x10]
call fcn.00455a20
push eax
call fcn.00455c50
add esp, 0xc
pop ebp
ret
push pe_nt_image_headers32
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop ebp
ret
test ecx, ecx
je 0x415f64
push dword [ecx + 0x10]
call fcn.00455c50
pop ecx
pop ebp
ret
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, 0x3f
jbe 0x415f82
push 0x3f
pop eax
pop ebp
ret
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x415f80
mov byte [eax], 0
xor eax, eax
pop ebp
ret
Function at 0x4218a4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x465b20]
push 0x459f14
call fcn.00401592
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043a541
mov esi, eax
test esi, esi
je 0x421993
push dword [ebp + 8]
push esi
call fcn.0043a622
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x421993
push ebx
push edi
push 0
push esi
mov byte [ebp + 0x1b], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
test ebx, ebx
je 0x421932
cmp ebx, dword [0x465c44]
je 0x421932
push esi
call fcn.0043b520
test al, al
pop ecx
jne 0x421932
push 1
push ebx
push dword [0x465c44]
call edi
test eax, eax
setne byte [ebp + 0x1b]
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x421980
mov ecx, dword [0x465b20]
push 1
push 0
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov eax, dword [0x465190]
cmp eax, 0xffffffff
jle 0x421980
cmp eax, 0x19
jge 0x421976
cmp byte [0x466341], 0
je 0x421976
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x421980
push 1
push eax
call fcn.0040b5c4
pop ecx
pop ecx
cmp byte [ebp + 0x1b], 0
je 0x421991
push 0
push ebx
push dword [0x465c44]
call edi
pop edi
pop ebx
xor eax, eax
inc eax
pop esi
pop ebp
ret 0x14
Function at 0x422e0a
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov ecx, dword [0x465b20]
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x459f14
call fcn.00401592
mov ecx, dword [0x467ff0]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401592
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x422f6b
cmp byte [eax], bl
je 0x422f6b
mov esi, 0x105
push esi
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00438c79
lea eax, [ebp - 0x120]
push eax
call fcn.00455c50
add esp, 0x10
cmp byte [ebp + eax - 0x121], 0x5c
je 0x422e98
lea ecx, [eax + 1]
cmp ecx, esi
jae 0x422f6b
mov byte [ebp + eax - 0x120], 0x5c
mov byte [ebp + eax - 0x11f], bl
push edi
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
test byte [0x4687d8], 1
jne 0x422eca
or dword [0x4687d8], edi
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4687d4], eax
mov eax, dword [0x4687d4]
cmp eax, ebx
je 0x422f0c
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x120]
push ecx
call eax
test eax, eax
je 0x422f6b
cmp byte [ebp + 0xc], bl
je 0x422ef9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
jmp 0x422eff
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
shrd ecx, eax, 0x14
shr eax, 0x14
mov esi, ecx
mov edi, eax
jmp 0x422f47
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x422f6b
cmp byte [ebp + 0xc], bl
mov eax, dword [ebp + 8]
jne 0x422f38
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 4]
imul eax, dword [ebp - 0xc]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x465b20]
push 1
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov ecx, dword [0x467ff0]
push edi
push esi
call fcn.00401928
jmp 0x422f6d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4231fa
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
push 0
push 0xffffffffffffffff
mov dword [ebp - 4], ecx
mov ecx, dword [0x465b20]
mov ebx, 0x459f14
push ebx
call fcn.00401592
mov esi, dword [ebp + 8]
test esi, esi
je 0x423253
cmp byte [esi], 0
je 0x423253
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42325c
test al, 0x10
je 0x423253
mov ecx, dword [0x465b20]
push edi
push 0
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
push 0x5c
push esi
call fcn.00456490
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4232ba
push esi
call fcn.00455c50
cmp eax, 0x104
pop ecx
jae 0x4232b5
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00438c79
mov ecx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.004231fa
cmp byte [edi + 1], 0
je 0x4232b5
mov ecx, dword [0x465b20]
call fcn.00401d39
cmp byte [eax], 0x31
jne 0x4232ba
xor eax, eax
inc eax
jmp 0x423255
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x4232cc
mov ebx, 0x45871c
mov ecx, dword [0x465b20]
push 1
push 0
push 0xffffffffffffffff
push ebx
call fcn.00401592
jmp 0x423255
Function at 0x4232e3
Capabilities:
Check for time delay via gettickcount
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
push esi
mov esi, dword [0x467fa0]
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x465b20]
push 0x459f14
call fcn.00401592
cmp byte [esi], bl
je 0x423355
push 0x45ce5c
push esi
call fcn.00438f35
test eax, eax
pop ecx
pop ecx
jne 0x423345
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x423355
mov ecx, dword [0x465b20]
push 1
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
jmp 0x423355
push 1
mov ecx, edi
call fcn.0041c5f5
cmp eax, 0x104
jb 0x42335d
xor eax, eax
inc eax
jmp 0x423471
lea eax, [ebp - 0x26c]
push eax
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x42337c
push ebx
jmp 0x423466
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.00455a20
lea eax, [ebp - 0x12c]
push 0x5c
push eax
call fcn.00456490
add esp, 0x10
cmp eax, ebx
je 0x4233b0
mov byte [eax + 1], bl
lea eax, [ebp - 0x12c]
push eax
call fcn.00455c50
pop ecx
jmp 0x4233b8
mov byte [ebp - 0x12c], bl
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea ecx, [ebp + eax - 0x12c]
mov esi, 0x103
mov dword [ebp - 0xc], ecx
sub esi, eax
call edi
sub eax, dword [0x466154]
cmp eax, dword [0x4651e4]
jbe 0x423403
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4233fc
push 1
push 0xffffffffffffffff
call fcn.0040b5c4
pop ecx
pop ecx
call edi
mov dword [0x466154], eax
test byte [ebp - 0x26c], 0x10
jne 0x423442
lea eax, [ebp - 0x240]
push eax
call fcn.00455c50
cmp eax, esi
pop ecx
ja 0x42343f
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0xc]
call fcn.00455a20
pop ecx
pop ecx
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x423442
inc dword [ebp - 4]
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4233cf
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp - 4]
mov ecx, dword [0x465b20]
call fcn.004018c8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423476
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov ecx, dword [0x465b20]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x459f14
call fcn.00401592
mov ecx, dword [0x467ff0]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401592
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4234f8
cmp byte [eax], bl
je 0x4234f8
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4234f8
mov ecx, dword [0x465b20]
push edi
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [ebp - 0x80]
push eax
call fcn.0043948b
pop ecx
pop ecx
mov ecx, dword [0x467ff0]
push eax
call fcn.00401592
jmp 0x4234fa
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x423a65
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10030
call fcn.004561f0
mov eax, dword [0x467ff0]
mov ecx, dword [0x465b20]
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x459f14
mov dword [ebp - 0xc], eax
call fcn.00401592
push dword [ebp + 0xc]
call fcn.00401a7c
mov edi, edx
cmp edi, ebx
pop ecx
mov dword [ebp - 0x14], eax
jg 0x423ab6
jl 0x423b90
cmp eax, esi
jb 0x423b90
push 0x45b054
push dword [ebp + 8]
call fcn.0043df32
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
je 0x423b90
cmp edi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jl 0x423b50
jg 0x423ae1
cmp dword [ebp - 0x14], ebx
jbe 0x423b50
push dword [ebp + 0xc]
lea eax, [ebp - 0x10030]
push 0xffff
push eax
call fcn.0043deb1
add esp, 0xc
test eax, eax
je 0x423b87
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x466154]
cmp eax, dword [0x4651e4]
jbe 0x423b3b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x423b30
push esi
push 0xffffffffffffffff
call fcn.0040b5c4
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x466154], eax
add dword [ebp - 8], esi
adc dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jl 0x423ae1
jg 0x423b50
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
jb 0x423ae1
push dword [ebp + 0xc]
call fcn.0043ddba
lea eax, [ebp - 0x10030]
push eax
call fcn.00455c50
cmp eax, ebx
pop ecx
pop ecx
je 0x423b80
cmp byte [ebp + eax - 0x10031], 0xa
jne 0x423b7c
dec eax
mov byte [ebp + eax - 0x10030], bl
cmp eax, ebx
jne 0x423b94
push esi
push ebx
push 0xffffffffffffffff
push ebx
jmp 0x423b9e
push dword [ebp + 0xc]
call fcn.0043ddba
pop ecx
mov eax, esi
jmp 0x423bbe
push esi
push ebx
push eax
lea eax, [ebp - 0x10030]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00401592
test eax, eax
je 0x423bbe
mov ecx, dword [0x465b20]
push esi
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
pop edi
pop esi
pop ebx
leave
ret 8