joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4212e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x421332
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x42135b
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x5c
idiv ecx
add edx, 3
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x421323
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x42138c
jmp 0x4213fd
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x4213b1
jmp 0x4213fd
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x4213ec
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret

Function at 0x421410
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.214904d79b05d3db7d
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.66df71a5d18598add8bbfa61
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x421460
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.0a51e2615a69a803fafdb
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.fbf78fc5743bf9971a2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x4214b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.bed73dc16effc137
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.ee9bab073d217211cd6b1947b6d30a
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x421500
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.555d95af33db2f476115eddfb5d1146
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.0c43357b894709e1d4ffca35a
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x421c90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x421ce2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x421d0e
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x97
idiv ecx
add edx, 0xd6
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x421cd3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x421d3f
jmp 0x421db0
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x421d64
jmp 0x421db0
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x421d9f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x422630
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.fe63ba83faf57987e305884dbf0fc
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.29b59d3b18fdf01da37117bde6ddf0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x4227b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.b3859779231927a9ba07dfad21d1e5f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.3c1f3ad36acdff8358dbf64
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x422800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x422852
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x42287e
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x2d
idiv ecx
add edx, 0xe3
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x422843
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x4228af
jmp 0x422920
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x4228d4
jmp 0x422920
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x42290f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x422930
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.acc3a5a3b50fbe0f0d253
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.af2d89d7d72338c113
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x422980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x4229d2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x4229fb
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0xcc
idiv ecx
add edx, 0x69
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x4229c3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x422a2c
jmp 0x422a9d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x422a51
jmp 0x422a9d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x422a8c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret

Function at 0x422ab0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.cf3dcfa99129efbba8a34675c04bd23
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.8fcf957ffb37081fc015b18df
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x422ea0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x422ec9
jmp 0x422f07
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x4232c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.960f0a41fc11875b5fa7131fc30d56
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.c6bb5a2fa3b91241
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x423570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x4235c2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x4235eb
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x8e
idiv ecx
add edx, 0x7e
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x4235b3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x42361c
jmp 0x42368d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x423641
jmp 0x42368d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x42367c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x4236a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x4236f2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x42371b
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x55
idiv ecx
add edx, 0x79
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x4236e3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x42374c
jmp 0x4237bd
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x423771
jmp 0x4237bd
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x4237ac
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x423900
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x423952
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x423981
call dword [sym.imp.MSVCR90.dll_rand]
and eax, 0x8000007f
jns 0x42396d
dec eax
or eax, 0xffffff80
inc eax
add eax, 0xeb
mov edx, dword [ebp - 0x27c]
mov byte [ebp + edx - 0x118], al
jmp 0x423943
push 0x10
push 0
lea eax, [ebp - 0x128]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x4239b2
jmp 0x423a23
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x4239d7
jmp 0x423a23
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x258]
mov dword [ebp - 4], eax
movzx ecx, byte [ebp - 0x129]
test ecx, ecx
je 0x423a12
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x424180
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.7c1fe215d6e34ecd04f5a6279f7525
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.d9f98acd523747a1784
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x4241d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.d2b7460905b97c9d6d6db
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.e1f75f2b7aaf1da5c7933737ae5b
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x424220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x424272
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x42429b
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x7a
idiv ecx
add edx, 0x3d
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x424263
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x4242cc
jmp 0x42433d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x4242f1
jmp 0x42433d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x42432c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x4246f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.c2616a07e50b9007655b635f6cb
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.b4139ff31d21e98d2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x424870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x4248c2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x4248ee
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x6a
idiv ecx
add edx, 0xf0
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x4248b3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x42491f
jmp 0x424990
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x424944
jmp 0x424990
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x42497f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret