joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ae00
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [0x45de54]
push ebx
push esi
push edi
push 0
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
mov ecx, dword [esp + 0x14]
mov al, byte [ecx]
cmp al, 0x41
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
je 0x42ae31
cmp al, 0x61
jne 0x42ae71
mov bl, byte [ecx + 1]
test bl, bl
jne 0x42ae71
cmp byte [edi], 0
jne 0x42ae71
cmp byte [esi], 0
jne 0x42ae71
cmp byte [edx], 0
jne 0x42ae71
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x42af97
mov al, byte [0x45d5fd]
test al, al
jne 0x42aedd
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42af97
jmp 0x42aedd
test al, al
jne 0x42aec5
cmp byte [edi], 0
jne 0x42aec5
cmp byte [esi], 0
jne 0x42aec5
cmp byte [edx], 0
jne 0x42aec5
mov eax, dword [0x45d6d0]
test eax, eax
je 0x42af97
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42af97
mov al, byte [0x45d5fd]
test al, al
jne 0x42aebd
mov eax, dword [0x45d6d0]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42af97
mov esi, dword [0x45d6d0]
jmp 0x42aedd
push 0
push 0
push 0
push 0
push 0
push edx
push esi
push edi
push ecx
call fcn.004417e0
add esp, 0x24
mov esi, eax
test esi, esi
je 0x42af97
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.004410f0
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
je 0x42af97
push ebp
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test edi, edi
je 0x42af39
cmp edi, ebp
je 0x42af39
push esi
call fcn.004407a0
add esp, 4
test al, al
jne 0x42af39
push 1
push edi
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x42af88
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
mov eax, dword [0x45d61c]
test eax, eax
jl 0x42af88
cmp eax, 0x19
jge 0x42af7d
mov cl, byte [0x45f111]
test cl, cl
je 0x42af7d
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x42af88
push 0
push eax
call fcn.00401650
add esp, 8
test bl, bl
je 0x42af96
push 0
push edi
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
ret 0x14
Function at 0x42ce00
Capabilities:
Get graphical window text

Disassembly:
push edi
push 1
push 0
call fcn.00415da0
mov edi, eax
test edi, edi
jne 0x42ce14
pop edi
ret 0x10
mov ecx, dword [esp + 8]
mov al, byte [ecx]
cmp al, 0x41
mov edx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
je 0x42ce31
cmp al, 0x61
jne 0x42ce96
cmp byte [ecx + 1], 0
jne 0x42ce96
cmp byte [ebx], 0
jne 0x42ce96
cmp byte [esi], 0
jne 0x42ce96
cmp byte [edx], 0
jne 0x42ce96
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x42ce70
mov al, byte [0x45d5fd]
test al, al
jne 0x42cef6
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42cef6
xor esi, esi
mov ebp, 1
push 0
lea ecx, [ebp - 1]
push ecx
push 0
mov ecx, edi
call fcn.0043e8a0
cmp eax, 1
je 0x42cf0d
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
ret 0x10
test al, al
jne 0x42cede
cmp byte [ebx], 0
jne 0x42cede
cmp byte [esi], 0
jne 0x42cede
cmp byte [edx], 0
jne 0x42cede
mov eax, dword [0x45d6d0]
test eax, eax
je 0x42ce6e
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42ce6e
mov al, byte [0x45d5fd]
test al, al
jne 0x42ced6
mov eax, dword [0x45d6d0]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42ce6e
mov esi, dword [0x45d6d0]
jmp 0x42cef6
push 0
push 0
push 0
push 0
push 0
push edx
push esi
push ebx
push ecx
call fcn.004417e0
add esp, 0x24
mov esi, eax
test esi, esi
je 0x42ce70
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebp, eax
inc ebp
jmp 0x42ce75
test esi, esi
mov al, byte [edi + 0x14]
je 0x42cf6b
test al, al
jne 0x42cf1c
mov eax, dword [edi]
jmp 0x42cf31
cmp al, 1
jne 0x42cf2c
mov ecx, 0x45ef58
call section..text
jmp 0x42cf31
mov eax, str.Unsupported_script_variable_type.
mov cl, byte [edi + 0x14]
test cl, cl
lea ebx, [edi + 4]
je 0x42cf40
mov ebx, 0x461128
push ebp
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebx], eax
mov al, byte [edi + 0x14]
test al, al
lea eax, [edi + 4]
je 0x42cf5a
mov eax, 0x461128
cmp dword [eax], 0
jne 0x42cfa0
mov ecx, edi
call fcn.00401080
mov byte [eax], 0
jmp 0x42cfa0
test al, al
jne 0x42cf73
mov eax, dword [edi]
jmp 0x42cf88
cmp al, 1
jne 0x42cf83
mov ecx, 0x45ef58
call section..text
jmp 0x42cf88
mov eax, str.Unsupported_script_variable_type.
mov byte [eax], 0
mov al, byte [edi + 0x14]
test al, al
lea eax, [edi + 4]
je 0x42cf9a
mov eax, 0x461128
mov dword [eax], 0
cmp byte [edi + 0x14], 1
jne 0x42cfc0
mov eax, dword [0x45ef64]
test eax, eax
je 0x42cfc0
mov ecx, 0x45ef58
call fcn.00402af0
pop esi
pop ebp
pop ebx
pop edi
ret 0x10
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
ret 0x10
Function at 0x42dd80
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREAutoHotkey
push 0x80000002
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ddd8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push esi
push eax
push eax
push str.InstallDir
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42dddd
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x42e2d0
Capabilities:
Write clipboard data

Disassembly:
push esi
push edi
push 1
push 0
mov edi, ecx
call fcn.00415da0
mov esi, eax
test esi, esi
jne 0x42e2e6
pop edi
pop esi
ret
mov al, byte [esi + 0x14]
push ebx
xor bl, bl
cmp al, 1
je 0x42e30f
cmp byte [edi + 0x1c], 1
jbe 0x42e30f
mov eax, dword [edi + 0x20]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x42e30f
cmp dword [eax], 0
je 0x42e30f
cmp dword [eax + 4], esi
je 0x42e336
add eax, 0xc
jne 0x42e300
push 0
mov ecx, edi
call fcn.0041ce20
cmp eax, 0xffffffff
je 0x42e344
cmp eax, 1
ja 0x42e36c
push 0
push 0xffffffffffffffff
push 0x44f4f8
mov ecx, esi
call fcn.0043e8a0
pop ebx
pop edi
pop esi
ret
mov ecx, edi
mov bl, 1
call fcn.0041cf80
cmp eax, 1
je 0x42e34a
pop ebx
pop edi
xor eax, eax
pop esi
ret
cmp byte [edi + 0x1c], 1
mov eax, dword [0x460684]
ja 0x42e35a
mov eax, 0x44f4f8
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42e360
sub eax, edx
inc eax
jmp 0x42e31d
test bl, bl
je 0x42e398
cmp byte [edi + 0x1c], 1
mov ecx, dword [0x460684]
ja 0x42e381
mov ecx, 0x44f4f8
xor edx, edx
mov dl, byte [0x45d62b]
dec eax
push edx
push eax
push ecx
mov ecx, esi
call fcn.0043e8a0
pop ebx
pop edi
pop esi
ret
push 0
dec eax
push eax
push 0
mov ecx, esi
call fcn.0043e8a0
cmp eax, 1
jne 0x42e344
mov al, byte [esi + 0x14]
test al, al
jne 0x42e3b5
mov eax, dword [esi]
jmp 0x42e3ca
cmp al, 1
jne 0x42e3c5
mov ecx, 0x45ef58
call section..text
jmp 0x42e3ca
mov eax, str.Unsupported_script_variable_type.
push 1
push eax
mov ecx, edi
call fcn.0041cca0
mov edi, eax
test edi, edi
je 0x42e344
mov al, byte [esi + 0x14]
test al, al
lea ebx, [esi + 4]
je 0x42e3ed
mov ebx, 0x461128
mov ecx, esi
call fcn.00401080
sub edi, eax
dec edi
mov dword [ebx], edi
mov al, byte [0x45d62b]
test al, al
je 0x42e43a
mov ecx, esi
call fcn.00401080
push eax
call fcn.0040e3c0
add esp, 4
mov ecx, esi
call fcn.00401080
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42e420
mov cl, byte [esi + 0x14]
sub eax, edx
test cl, cl
lea ecx, [esi + 4]
je 0x42e438
mov ecx, 0x461128
mov dword [ecx], eax
pop ebx
pop edi
mov ecx, esi
pop esi
jmp fcn.0040e480

Function at 0x42e450
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x42e4ad
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 4]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
add esp, 8
ret
Function at 0x42ef00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test bl, bl
jne 0x42ef0f
xor al, al
pop ebx
ret 8
mov eax, dword [esp + 0xc]
dec eax
je 0x42ef7d
dec eax
je 0x42ef6c
mov al, byte [0x45f111]
test al, al
jne 0x42ef3e
mov al, byte [0x45f112]
test al, al
jne 0x42ef3e
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
pop ebx
shr eax, 0xf
and al, 1
ret 8
push esi
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
js 0x42ef62
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
js 0x42ef62
pop esi
xor eax, eax
pop ebx
ret 8
pop esi
mov eax, 1
pop ebx
ret 8
movzx edx, bl
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
pop ebx
and eax, 1
ret 8
cmp bl, 1
je 0x42efea
cmp bl, 2
je 0x42efea
cmp bl, 4
je 0x42efea
cmp bl, 5
je 0x42efea
cmp bl, 6
je 0x42efea
cmp bl, 0x9e
je 0x42efea
cmp bl, 0x9f
je 0x42efea
mov eax, dword [0x45d800]
test eax, eax
je 0x42efd4
push 0
push 0
push ebx
call fcn.0040a2f0
add esp, 0xc
test al, al
je 0x42efc4
push 1
call fcn.0040a080
add esp, 4
movzx eax, bl
mov al, byte [eax + 0x45d700]
shr al, 7
pop ebx
ret 8
movzx ecx, bl
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
shr eax, 0x1f
and al, 1
pop ebx
ret 8
mov eax, dword [0x45d804]
test eax, eax
je 0x42f003
movzx edx, bl
mov al, byte [edx + 0x45d700]
shr al, 7
pop ebx
ret 8
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
shr eax, 0x1f
and al, 1
pop ebx
ret 8
Function at 0x42f4e0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x224
push esi
push 1
push 0
call fcn.00415da0
mov esi, eax
test esi, esi
jne 0x42f500
pop esi
add esp, 0x224
ret 8
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
push 0
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0043e8a0
mov eax, dword [esp + 0x22c]
test eax, eax
je 0x42f6a4
cmp byte [eax], 0
je 0x42f6a4
push 0x207
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00443880
lea eax, [esp + 0x2c]
add esp, 0xc
mov byte [esp + 0x227], 0
lea edx, [eax + 1]
jmp 0x42f560
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42f560
sub eax, edx
cmp byte [esp + eax + 0x1f], 0x5c
je 0x42f589
lea ecx, [eax + 1]
cmp ecx, 0x208
jae 0x42f6a4
mov byte [esp + eax + 0x20], 0x5c
mov byte [esp + eax + 0x21], 0
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
test byte [0x4612cc], 1
jne 0x42f5c7
mov ecx, dword [0x4612cc]
push str.GetDiskFreeSpaceExA
or ecx, 1
push str.kernel32.dll
mov dword [0x4612cc], ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4612c8], eax
jmp 0x42f5cc
mov eax, dword [0x4612c8]
test eax, eax
je 0x42f639
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x2c]
push ecx
call eax
test eax, eax
je 0x42f6a4
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
mov al, byte [esp + 0x230]
test al, al
je 0x42f617
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
jmp 0x42f61f
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
mov ecx, esi
call fcn.0043fb10
pop esi
add esp, 0x224
ret 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x42f6a4
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
mov al, byte [esp + 0x230]
test al, al
mov eax, dword [esp + 0x14]
jne 0x42f683
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 4]
imul eax, dword [esp + 0xc]
shr eax, 0x14
push 0
push eax
mov ecx, esi
call fcn.0043fb10
pop esi
add esp, 0x224
ret 8
mov eax, 1
pop esi
add esp, 0x224
ret 8
Function at 0x4304b0
Capabilities:
Check for time delay via gettickcount
Delete file

Disassembly:
mov eax, 0x2050
call fcn.004444f0
push ebx
push str.wininet.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x4304e9
mov ecx, dword [0x45de54]
push eax
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
pop ebx
add esp, 0x2050
ret 8
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edi
push str.InternetOpenA
push ebx
call esi
push str.InternetOpenUrlA
push ebx
mov edi, eax
call esi
push str.InternetCloseHandle
push ebx
mov ebp, eax
call esi
push str.InternetReadFileExA
push ebx
mov dword [esp + 0x18], eax
call esi
test edi, edi
mov dword [esp + 0x14], eax
je 0x4306b5
test ebp, ebp
je 0x4306b5
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4306b5
test eax, eax
je 0x4306b5
push 0
push 0
push 0
push 4
push 0
call edi
mov esi, eax
test esi, esi
mov dword [esp + 0x18], esi
je 0x4305a7
mov eax, dword [esp + 0x2064]
push 0
push 0
push 0
push 0
push eax
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x430582
push esi
call dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
jmp 0x4306b5
mov ecx, dword [esp + 0x2068]
push 0x45661c
push ecx
call fcn.004453e9
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4305b3
push edi
mov edi, dword [esp + 0x14]
call edi
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
jmp 0x4306b5
xor edx, edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
push edx
push 8
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x6c]
push edi
mov dword [esp + 0x50], edx
mov dword [esp + 0x2c], 0x28
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0x2000
call dword [esp + 0x24]
mov esi, eax
test esi, esi
je 0x43067a
mov eax, dword [esp + 0x34]
test eax, eax
je 0x43067a
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call esi
sub eax, dword [0x45ef34]
cmp eax, 5
jbe 0x430649
push 0
push 0
push 0
push 0
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x430642
push 0
push 0xffffffffffffffff
call fcn.00401650
add esp, 8
call esi
mov dword [0x45ef34], eax
mov eax, dword [esp + 0x34]
push ebp
push 1
push eax
lea ecx, [esp + 0x6c]
push ecx
call fcn.004455fa
add esp, 0x10
push 0
push 8
lea edx, [esp + 0x24]
push edx
push edi
mov dword [esp + 0x44], 0x2000
call dword [esp + 0x24]
mov esi, eax
test esi, esi
jne 0x430604
push edi
mov edi, dword [esp + 0x14]
call edi
mov eax, dword [esp + 0x18]
push eax
call edi
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push ebp
call fcn.00445369
add esp, 4
test esi, esi
je 0x4306a7
push 0
push 0xffffffffffffffff
push 0x44f664
jmp 0x4306be
mov ecx, dword [esp + 0x2068]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0
push 0xffffffffffffffff
push 0x452c78
mov ecx, dword [0x45de54]
call fcn.0043e8a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2050
ret 8
Function at 0x430df0
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov ecx, dword [0x45de54]
sub esp, 0x210
push 0
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp]
push eax
push 0x457b34
push 1
push 0
push 0x457b44
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x430f51
mov edx, dword [esp + 0x214]
mov eax, dword [esp]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x430e5d
cmp byte [eax], 0
je 0x430e5d
mov ecx, dword [esp]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
mov eax, dword [esp + 0x220]
test eax, eax
je 0x430e77
cmp byte [eax], 0
je 0x430e77
mov ecx, dword [esp]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x2c]
mov eax, dword [esp + 0x224]
test eax, eax
je 0x430e91
cmp byte [eax], 0
je 0x430e91
mov ecx, dword [esp]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
mov eax, dword [esp + 0x228]
test eax, eax
je 0x430ead
cmp byte [eax], 0
je 0x430ead
mov ecx, dword [esp]
mov edx, dword [ecx]
push 0
push eax
push ecx
call dword [edx + 0x44]
mov eax, dword [esp + 0x22c]
test eax, eax
je 0x430ee1
cmp byte [eax], 0
je 0x430ee1
push 0
push 0
push eax
call fcn.0040aa90
add esp, 0xc
test al, al
je 0x430ee1
mov ecx, dword [esp]
mov edx, dword [ecx]
movzx ax, al
or eax, 0x600
push eax
push ecx
call dword [edx + 0x34]
mov eax, dword [esp]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0x457b64
push eax
call dword [ecx]
test eax, eax
jl 0x430f48
mov ecx, dword [esp + 0x218]
push 0x104
lea eax, [esp + 0xc]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [esp + 4]
mov edx, dword [eax]
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [edx + 0x18]
test eax, eax
jl 0x430f3e
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
mov eax, dword [esp + 4]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
add esp, 0x210
ret 0x1c
Function at 0x430f70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x208
push ebx
push esi
push 0
push 0xffffffffffffffff
mov ebx, ecx
mov ecx, dword [0x45de54]
push 0x452c78
call fcn.0043e8a0
mov esi, dword [esp + 0x214]
test esi, esi
je 0x430fc2
cmp byte [esi], 0
je 0x430fc2
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x430fd2
test al, 0x10
je 0x430fc2
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret 4
push 0x5c
push esi
call fcn.00444bf0
add esp, 8
test eax, eax
je 0x431027
mov ecx, esi
push edi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x430fe7
sub ecx, edi
cmp ecx, 0x208
pop edi
jae 0x430fc2
sub eax, esi
inc eax
push eax
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00401050
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov ecx, ebx
call fcn.00430f70
mov ecx, dword [0x45de54]
call fcn.00401080
cmp byte [eax], 0x31
je 0x430fc2
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
mov eax, 0x44f664
jne 0x43103e
mov eax, 0x452c78
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push eax
call fcn.0043e8a0
pop esi
pop ebx
add esp, 0x208
ret 4
Function at 0x431060
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1002c
call fcn.004444f0
push 1
push 0
call fcn.00415da0
test eax, eax
mov dword [esp + 4], eax
jne 0x431084
add esp, 0x1002c
ret 8
mov ecx, dword [0x45de54]
push ebp
push esi
push edi
push 0
push 0xffffffffffffffff
push 0x452c78
call fcn.0043e8a0
mov esi, dword [esp + 0x10040]
push esi
call fcn.00407b50
add esp, 4
test al, al
je 0x4310c4
push 0x10
push 0
push esi
call fcn.00444f6b
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x14], ebp
jmp 0x4310d3
push esi
call fcn.00444638
add esp, 4
mov dword [esp + 0x14], eax
mov ebp, eax
mov edi, edx
test edi, edi
jg 0x4310f0
jl 0x4310df
test ebp, ebp
ja 0x4310f0
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1002c
ret 8
mov eax, dword [esp + 0x1003c]
push 0x4531dc
push eax
call fcn.004453e9
add esp, 8
test eax, eax
mov dword [esp + 0xc], eax
je 0x4310df
push ebx
xor ebx, ebx
xor esi, esi
test edi, edi
jl 0x43118e
jg 0x43111c
test ebp, ebp
jbe 0x43118e
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x40]
push 0xffff
push edx
call fcn.00444f99
add esp, 0xc
test eax, eax
je 0x4311dc
call ebp
sub eax, dword [0x45ef34]
cmp eax, 5
jbe 0x431178
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x431171
push 0
push 0xffffffffffffffff
call fcn.00401650
add esp, 8
call ebp
mov dword [0x45ef34], eax
add ebx, 1
adc esi, 0
cmp esi, edi
jl 0x431122
jg 0x43118a
cmp ebx, dword [esp + 0x18]
jb 0x431122
mov eax, dword [esp + 0x10]
push eax
call fcn.00445369
lea eax, [esp + 0x40]
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4311a0
sub eax, edx
je 0x4311bc
cmp byte [esp + eax + 0x3b], 0xa
jne 0x4311b8
dec eax
mov byte [esp + eax + 0x3c], 0
test eax, eax
jne 0x4311fb
push 0
push 0xffffffffffffffff
push 0
mov ecx, dword [esp + 0x20]
call fcn.0043e8a0
test eax, eax
jne 0x431205
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x1002c
ret 8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00445369
add esp, 4
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1002c
ret 8
push 0
push eax
lea edx, [esp + 0x44]
push edx
jmp 0x4311c2
mov ecx, dword [0x45de54]
push 0
push 0xffffffffffffffff
push 0x44f664
call fcn.0043e8a0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x1002c
ret 8