joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e8dc
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x18
push ebx
add esp, 0xfffffff8
push 0x512c90
push 0x512fa0
call sub.KERNEL32.dll_lstrcpyA
add esp, 0xfffffffc
push 0x512fa0
call sub.KERNEL32.dll_lstrlenA
mov edx, eax
add esp, 0xfffffff4
push 0x41e8a3
lea eax, [edx + 0x512f9d]
push eax
call sub.KERNEL32.dll_lstrcpyA
push 0x512fa0
push 0x104
push 0x512dd0
push 0x41e8a7
push 0x41e8a8
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov edx, eax
add esp, 0x18
test edx, edx
jle 0x41e9be
mov ebx, 0x512dd0
mov al, byte [0x512dd1]
cmp byte [0x512dd0], 0x5c
jne 0x41e958
cmp al, 0x5c
je 0x41e9be
cmp al, 0x3a
jne 0x41e965
cmp byte [0x512dd2], 0x5c
je 0x41e9be
add esp, 0xfffffff8
push 0x512c90
push ebx
call sub.KERNEL32.dll_lstrcpyA
movsx eax, byte [0x41f90d]
push eax
push ebx
call fcn.0041f724
mov byte [eax + 1], 0
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edx, eax
add esp, 0xfffffff4
push 0x512fa0
mov eax, 0x104
sub eax, edx
push eax
lea eax, [edx + 0x512dd0]
push eax
push 0x41e8a7
push 0x41e8a8
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileStringA
add esp, 0x28
add esp, 0xfffffff8
push 0x512fa0
push 0x104
push 0x5132f0
push 0x41e8a7
push 0x41e8b2
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileStringA
add esp, 0xfffffff8
push 0x512fa0
push dword [0x4dff80]
push 0x41e320
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dff80], eax
push 0x512fa0
push dword [0x4dff84]
push 0x41e384
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dff84], eax
push 0x512fa0
push dword [0x4dff88]
push 0x41e419
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dff88], eax
push 0x512fa0
push dword [0x4dff90]
push 0x41e480
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dff90], eax
push 0x512fa0
push dword [0x4dff94]
push 0x41e4e8
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dff94], eax
push 0x512fa0
push dword [0x4dffa4]
push 0x41e5c0
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dffa4], eax
push 0x512fa0
push dword [0x4dffa8]
push 0x41e55b
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dffa8], eax
push 0x512fa0
push dword [0x4dffa0]
push 0x41e758
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dffa0], eax
push 0x512fa0
push dword [0x4dff98]
push 0x41e62b
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dff98], eax
push 0x512fa0
push dword [0x4dff9c]
push 0x41e7c3
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dff9c], eax
push 0x512fa0
push dword [0x4dfd20]
push 0x41e82f
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dfd20], eax
push 0x512fa0
push dword [0x4dffbc]
push 0x41e8be
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dffbc], eax
push 0x512fa0
push dword [0x4dffc0]
push 0x41e8ce
push 0x41f904
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4dffc0], eax
add esp, 0x10
pop ebx
add esp, 0x18
ret
Function at 0x41f834
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push esi
push ebx
mov ebx, dword [esp + 0x20]
add esp, 0xfffffff8
push 0x1000
push 1
call sub.crtdll.dll_calloc
mov esi, eax
lea eax, [esp + 0x34]
add esp, 0xfffffffc
push eax
push ebx
push esi
call sub.USER32.dll_wvsprintfA
add esp, 0xfffffff4
push 0x12000
push 0x41f82b
push esi
push 0
call sub.USER32.dll_MessageBoxA
add esp, 0x20
add esp, 0xfffffff4
push esi
call sub.crtdll.dll_free
add esp, 0xfffffff4
push 0xffffffffffffffff
call sub.crtdll.dll_exit
and eax, 0x25282073
sub dword fs:[eax], esp
sub eax, 0x7325202d
or al, byte [eax]
nop

Function at 0x420c98
Capabilities:
Inspect load icon resource

Disassembly:
sub esp, 0x3c
push 1
push 1
push 0
push 0
call sub.GDI32.dll_CreateRectRgn
mov dword [0x512dc0], eax
cmp dword [0x4dffb0], 0
je 0x420cc3
cmp dword [0x512c70], 0
je 0x420e41
mov dword [esp], 0x20
mov dword [esp + 4], 0x41f958
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov eax, dword [0x5131c0]
mov dword [esp + 0x10], eax
add esp, 0xfffffff8
push 2
push eax
call sub.USER32.dll_LoadIconA
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
add esp, 0xfffffffc
push 0
call sub.GDI32.dll_GetStockObject
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x420c67
lea eax, [esp + 0xc]
push eax
call sub.USER32.dll_RegisterClassA
add esp, 0xc
mov eax, dword [0x4dff74]
test eax, eax
jne 0x420d66
push 0
push dword [0x5131c0]
push 0
push 0
push 0x80000000
push 0x80000000
push 0
push 0
push 0x2cf0000
push 0x420c79
push 0x420c67
push 0x40000
jmp 0x420dac
mov dword [0x4dffb8], 1
push 0
push dword [0x5131c0]
push 0
push eax
add esp, 0xfffffff4
push 1
call sub.USER32.dll_GetSystemMetrics
add esp, 0xc
push eax
add esp, 0xfffffff4
push 0
call sub.USER32.dll_GetSystemMetrics
add esp, 0xc
push eax
push 0
push 0
push 0x42000000
push 0x420c79
push 0x420c67
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x4dff70], eax
add esp, 0xfffffffc
push 0x41f9bc
push 0xfffffffffffffffc
push dword [0x4dff70]
call sub.USER32.dll_SetWindowLongW
add esp, 0xfffffff8
push 0x420c81
call sub.USER32.dll_RegisterWindowMessageA
mov dword [0x4dffdc], eax
add esp, 0xfffffffc
push 0
push dword [0x5131c0]
push 0
push dword [0x4dff70]
push 0x80000000
push 0x80000000
push 0
push 0
push 0x40b00004
push 0x420c91
push 0x420c92
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x512b50], eax
call fcn.0041edec
call fcn.00420b9c
add esp, 0xfffffff4
push dword [0x4dff70]
call sub.USER32.dll_SetForegroundWindow
add esp, 0xfffffffc
call fcn.00458468
add esp, 0x20
call fcn.00421f2c
add esp, 0x3c
ret
Function at 0x4213d4
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x3c
push ebp
push edi
push esi
push ebx
cmp dword [esp + 0x50], 0
jne 0x4213f0
xor eax, eax
jmp 0x421543
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
mov ebp, eax
and ebp, 0x8000
mov eax, dword [esp + 0x5c]
mov edx, dword [eax + 8]
mov ebx, edx
and ebx, 4
mov edi, edx
and edi, 8
mov ecx, edx
and ecx, 1
add esp, 0xc
cmp dword [0x4dffa4], 0
je 0x421436
mov eax, edx
and eax, 0x10
or ecx, eax
and edx, 2
or ecx, edx
xor edx, edx
xor esi, esi
jmp 0x421458
cmp dword [0x4dffa8], 0
jne 0x421450
mov esi, edx
and esi, 0x10
and edx, 2
jmp 0x421458
mov esi, edx
and esi, 2
and edx, 0x10
test ecx, ecx
je 0x421482
test esi, esi
jne 0x421482
test edx, edx
jne 0x421482
test ebp, ebp
je 0x421473
test edi, edi
jne 0x421477
xor ecx, ecx
mov esi, 1
test edi, edi
je 0x421482
test ebp, ebp
jne 0x421482
xor ecx, ecx
mov edx, 1
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x50]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x50]
movsx eax, word [eax + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x50]
movsx eax, word [eax + 0xe]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0
test ecx, ecx
je 0x4214c1
mov dword [esp + 0x30], 4
mov eax, dword [esp + 0x30]
test esi, esi
je 0x4214cf
or al, 1
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
test edx, edx
je 0x4214dd
or al, 2
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0
test ebx, ebx
je 0x4214f1
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x34]
test edi, edi
je 0x4214ff
or al, 2
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
test ebp, ebp
je 0x42150d
or al, 8
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x50]
mov eax, dword [edx]
xor edx, edx
cmp eax, dword [0x4dff70]
je 0x421527
mov edx, eax
mov dword [esp + 0x3c], edx
call fcn.00421360
mov edi, eax
lea esi, [esp + 0x20]
cld
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x3c
ret

Function at 0x42154c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebp
push edi
push esi
push ebx
call fcn.00421360
mov ebp, eax
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
mov edi, eax
and edi, 0x8000
push 0x10
call sub.USER32.dll_GetKeyState
mov esi, eax
and esi, 0x8000
push 0x11
call sub.USER32.dll_GetKeyState
mov ebx, eax
and ebx, 0x8000
mov dword [ebp], 3
add esp, 0xfffffffc
call fcn.00421d34
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [ebp + 8], eax
mov edx, dword [esp + 0x38]
mov dword [ebp + 0xc], edx
mov eax, dword [esp + 0x3c]
mov dword [ebp + 0x10], eax
add esp, 0x10
test esi, esi
setne al
and eax, 0xff
test ebx, ebx
je 0x4215c4
or al, 2
test edi, edi
je 0x4215ca
or al, 8
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [ebp + 0x18], eax
xor eax, eax
mov edx, dword [esp + 0x20]
cmp edx, dword [0x4dff70]
je 0x4215e4
mov eax, edx
mov dword [ebp + 0x1c], eax
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x4215f4
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x30]
test ebp, ebp
jne 0x421610
xor eax, eax
jmp 0x421793
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
mov edx, eax
and edx, 0x8000
mov dword [esp + 0x28], edx
push 0x10
call sub.USER32.dll_GetKeyState
mov ecx, eax
and ecx, 0x8000
mov dword [esp + 0x24], ecx
push 0x11
call sub.USER32.dll_GetKeyState
mov edx, eax
and edx, 0x8000
mov dword [esp + 0x20], edx
push dword [ebp + 8]
call fcn.00421064
mov ebx, eax
mov edi, dword [ebp + 8]
add esp, 0x10
mov eax, dword [ebp + 4]
add eax, 0xffffff00
cmp eax, 6
ja case.0x421669.259
jmp dword [eax*4 + 0x421670]
test ebx, ebx
je 0x421696
mov edi, ebx
mov dword [esp + 0x10], 1
test byte [ebp + 0xf], 0x40
je 0x4216d5
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
cmp eax, 2
ja 0x4216d5
jmp 0x42178e
test ebx, ebx
je 0x4216ba
mov edi, ebx
mov dword [esp + 0x10], 2
jmp 0x4216d5
cmp edi, 0xd
je 0x42178e
mov dword [esp + 0x10], 0
cmp dword [esp + 0x14], 0
je 0x4216f3
cmp dword [esp + 0x1c], 0
je 0x4216f3
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
call fcn.00421360
mov esi, eax
mov dword [esi], 2
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov eax, edi
and eax, 0xff
movzx eax, byte [eax + 0x4dfffc]
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
cmp dword [esp + 0x1c], 0
je 0x421733
mov dword [esi + 0x10], 8
mov eax, dword [esi + 0x10]
cmp dword [esp + 0x18], 0
je 0x421742
or al, 1
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
cmp dword [esp + 0x14], 0
je 0x421751
or al, 2
mov dword [esi + 0x10], eax
mov eax, dword [ebp]
xor edx, edx
cmp eax, dword [0x4dff70]
je 0x421760
mov edx, eax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0
cmp dword [esp + 0x10], 1
jne 0x42178e
test ebx, ebx
je 0x42178e
call fcn.00421360
mov edi, eax
cld
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0xc], 0
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x1c
ret

Function at 0x421a78
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push esi
push ebx
add esp, 0xfffffff4
push 1
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
setl al
and eax, 0xff
lea ebx, [eax*4]
mov esi, ebx
add esp, 0xfffffff4
push 4
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x421ad1
cmp dword [0x4dffa4], 0
je 0x421ac0
or ebx, 4
jmp 0x421ad1
or ebx, 1
cmp dword [0x4dffa8], 0
je 0x421ad1
mov ebx, esi
or ebx, 2
add esp, 0xfffffff4
push 2
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x421b03
cmp dword [0x4dffa4], 0
je 0x421af1
or ebx, 4
jmp 0x421b03
cmp dword [0x4dffa8], 0
je 0x421b00
or ebx, 1
jmp 0x421b03
or ebx, 2
cmp ebx, 4
jne 0x421b38
add esp, 0xfffffff4
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x421b21
mov ebx, 2
jmp 0x421b38
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x421b38
mov ebx, 1
and ebx, 7
mov dword [0x4dff60], ebx
mov eax, 1
pop ebx
pop esi
add esp, 0x14
ret
Function at 0x421b4c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebx
add esp, 0xfffffff4
push 0x10
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
setl al
and eax, 0xff
lea ebx, [eax*8]
add esp, 0xfffffff4
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x421b96
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jl 0x421b96
or ebx, 0x10
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x421bbd
add esp, 0xfffffff4
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jl 0x421bbd
or ebx, 0x40
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x421be4
add esp, 0xfffffff4
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x421be4
or ebx, 0x20
mov eax, dword [0x4dff60]
and eax, 7
or ebx, eax
mov dword [0x4dff60], ebx
mov eax, 1
pop ebx
add esp, 0x18
ret

Function at 0x421cec
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov dword [0x4e0108], 1
add esp, 0xfffffff4
push 0
call sub.crtdll.dll_exit
nop
Function at 0x4224c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push esi
push ebx
mov esi, dword [esp + 0x20]
add esp, 0xfffffff4
push dword [0x4dff70]
call sub.USER32.dll_IsWindow
add esp, 0xc
test eax, eax
je 0x422501
cmp dword [0x4e0120], esi
je 0x422501
add esp, 0xfffffff4
push dword [0x4dff70]
call sub.USER32.dll_IsWindowVisible
add esp, 0xc
test eax, eax
jne 0x422510
mov dword [0x4dffd4], esi
mov eax, 1
jmp 0x42266f
test esi, esi
je 0x4225b0
mov ebx, dword [0x4dff74]
test ebx, ebx
je 0x42256f
mov dword [0x4dff74], 0
add esp, 0xfffffff4
push dword [0x4dff70]
call sub.USER32.dll_DestroyWindow
add esp, 0xfffffffc
call fcn.00420c98
add esp, 0xfffffff4
push dword [0x4dff70]
call sub.USER32.dll_SetForegroundWindow
push dword [0x4dff70]
call sub.USER32.dll_SetActiveWindow
push dword [0x4dff70]
call sub.USER32.dll_BringWindowToTop
mov dword [0x4dff74], ebx
add esp, 0x1c
add esp, 0xfffffffc
push 0x82000000
push 0xfffffffffffffff0
push dword [0x4dff70]
call sub.USER32.dll_SetWindowLongA
push 0x40000
push 0xffffffffffffffec
push dword [0x4dff70]
call sub.USER32.dll_SetWindowLongA
add esp, 0xfffffffc
push 3
push dword [0x4dff70]
call sub.USER32.dll_ShowWindow
add esp, 0xfffffffc
push 1
jmp 0x422645
add esp, 0xfffffff8
push 9
push dword [0x4dff70]
call sub.USER32.dll_ShowWindow
push 0
push dword [0x4dff70]
call sub.USER32.dll_ShowWindow
add esp, 0xfffffff4
push 0x2cf0000
push 0xfffffffffffffff0
push dword [0x4dff70]
call sub.USER32.dll_SetWindowLongA
push 0x40000
push 0xffffffffffffffec
push dword [0x4dff70]
call sub.USER32.dll_SetWindowLongA
push 0x2f
push 0
push 0
push 0
push 0
push 0
push dword [0x4dff70]
call sub.USER32.dll_SetWindowPos
add esp, 0x14
cmp dword [0x4dff74], 0
je 0x422630
add esp, 0xfffffff4
push dword [0x4dff70]
call sub.USER32.dll_DestroyWindow
add esp, 0xfffffffc
call fcn.00420c98
add esp, 0x10
add esp, 0xfffffff8
push 1
push dword [0x4dff70]
call sub.USER32.dll_ShowWindow
add esp, 0xfffffffc
push 0
call fcn.00416bac
add esp, 0x10
add esp, 0xfffffff4
push dword [0x4dff70]
call sub.USER32.dll_SetForegroundWindow
mov dword [0x4dffd4], esi
mov dword [0x4e0120], esi
mov eax, 1
add esp, 0xc
pop ebx
pop esi
add esp, 0x14
ret
Function at 0x423e6c
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
push edi
push esi
push ebx
add esp, 0xfffffff8
lea ebx, [ebp - 0x110]
push ebx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.0041f724
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x423ebb
add esp, 0xfffffff8
push 0x2f
mov eax, dword [ebp + 8]
push eax
call fcn.0041f724
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42403e
mov byte [esi], 0
inc esi
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_lstrlenA
add esp, 0xc
lea edi, [ebp - 0x230]
cmp eax, 0xc
jg 0x423ff8
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
push 0x423e60
push edi
call sub.KERNEL32.dll_lstrcatA
add esp, 0xfffffffc
push edi
call sub.KERNEL32.dll_SetCurrentDirectoryA
add esp, 0xfffffff4
lea ebx, [ebp - 0x370]
push ebx
push 0x423e62
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebp - 0x374], eax
add esp, 0x18
cmp eax, 0xffffffff
je 0x423ff8
lea eax, [ebp - 0x344]
mov dword [ebp - 0x384], eax
lea esi, [esi]
add esp, 0xfffffff8
push 0x423e66
mov eax, dword [ebp - 0x384]
push eax
call sub.KERNEL32.dll_lstrcmpA
add esp, 8
test eax, eax
je 0x423f83
add esp, 0xfffffff8
push 0x423e69
mov eax, dword [ebp - 0x384]
push eax
call sub.KERNEL32.dll_lstrcmpA
add esp, 8
test eax, eax
je 0x423f83
add esp, 0xfffffff8
lea eax, [ebp - 0x240]
push eax
lea ebx, [ebp - 0x120]
push ebx
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
mov eax, ebx
jmp 0x423f90
mov byte [ebp - 0x120], 0
lea eax, [ebp - 0x120]
add esp, 0xfffffff8
push esi
push eax
call sub.KERNEL32.dll_lstrcmpA
add esp, 8
test eax, eax
jne 0x423fc5
add esp, 0xfffffff4
mov eax, dword [ebp - 0x374]
push eax
call sub.KERNEL32.dll_FindClose
add esp, 0xfffffff4
mov eax, dword [ebp - 0x384]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
add esp, 0x18
jmp 0x424005
add esp, 0xfffffff8
lea eax, [ebp - 0x370]
push eax
mov eax, dword [ebp - 0x374]
push eax
call sub.KERNEL32.dll_FindNextFileA
add esp, 8
test eax, eax
jne 0x423f30
add esp, 0xfffffff4
mov eax, dword [ebp - 0x374]
push eax
call sub.KERNEL32.dll_FindClose
add esp, 0xc
add esp, 0xfffffff8
push esi
push edi
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
add esp, 0xfffffff4
mov eax, dword [ebp + 8]
push eax
call fcn.00423e6c
add esp, 0xfffffff8
push 0x423e60
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_lstrcatA
push edi
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_lstrcatA
add esp, 0xfffffffc
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
add esp, 0x1c
lea esp, [ebp - 0x3a8]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x424114
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x1c
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x30]
mov dword [esp + 0x18], 0
add esp, 0xfffffff8
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
add esp, 0xfffffff8
push 0
push 0
push 0
push esi
call sub.KERNEL32.dll_SetFilePointer
add esp, 0x10
test eax, eax
jne 0x424204
add esp, 0xfffffff4
push 0
lea ebp, [esp + 0x2c]
push ebp
push 4
lea edi, [esp + 0x30]
push edi
push esi
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x424204
add esp, 0xfffffff4
push dword [esp + 0x24]
call fcn.00416658
add esp, 0x10
test eax, eax
jne 0x424200
add esp, 0xfffffff4
add esp, 0xfffffff4
push dword [esp + 0x30]
call fcn.00404018
push eax
call fcn.00416658
add esp, 0x20
test eax, eax
jne 0x424200
add ebx, 0xfffffe00
push 0
push 0
push 0x200
push esi
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0x200
jne 0x424204
add esp, 0xfffffff4
push 0
push ebp
push 4
push edi
push esi
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x424204
add esp, 0xfffffff4
push dword [esp + 0x24]
call fcn.00416658
add esp, 0x10
test eax, eax
jne 0x424200
add esp, 0xfffffff4
add esp, 0xfffffff4
push dword [esp + 0x30]
call fcn.00404018
push eax
call fcn.00416658
add esp, 0x20
test eax, eax
je 0x424204
mov eax, ebx
jmp 0x424206
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x1c
ret

Function at 0x42429c
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x264
push esi
push ebx
add esp, 0xfffffff8
lea esi, [esp + 0x18]
push esi
push 0x42428c
call sub.KERNEL32.dll_FindFirstFileW
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
je 0x424304
add esp, 0xfffffff8
push esi
push ebx
call sub.KERNEL32.dll_FindNextFileW
mov esi, eax
add esp, 0xfffffffc
push ebx
call sub.KERNEL32.dll_FindClose
add esp, 0xc
test esi, esi
jne 0x424304
push 0
push 0
push 0x104
push 0x512dd0
push 0xffffffffffffffff
lea eax, [esp + 0x50]
push eax
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
mov eax, 1
jmp 0x424306
xor eax, eax
pop ebx
pop esi
add esp, 0x264
ret
Function at 0x4245c0
Capabilities:
Check if file exists
Hide graphical window
Read .ini file

Disassembly:
sub esp, 0x880
push edi
push esi
push ebx
add esp, 0xfffffff8
push 0x512fa0
push 0x400
lea ebx, [esp + 0x460]
push ebx
push 0x424563
push 0x42456e
push 0x42457b
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x512fa0
push 0x400
lea edi, [esp + 0x60]
push edi
push 0x420c79
push 0x424582
push 0x42457b
call sub.KERNEL32.dll_GetPrivateProfileStringA
add esp, 0xfffffff8
push 0x512fa0
push 0x3e8
push 0x42458e
push 0x42457b
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4f8010], eax
add esp, 0x10
cmp byte [esp + 0x450], 0
je 0x4247e2
add esp, 0xfffffff8
push 0x2010
push 0
push 0
push 0
push ebx
push 0
call sub.USER32.dll_LoadImageA
mov edx, eax
mov dword [0x4e012c], edx
add esp, 8
test edx, edx
jne 0x424690
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x4247e2
add esp, 0xfffffff4
push 0x424599
call fcn.0041f898
jmp 0x4247df
add esp, 0xfffffffc
lea eax, [esp + 0x34]
push eax
push 0x18
push edx
call sub.GDI32.dll_GetObjectA
add esp, 0xfffffff4
push 0
lea eax, [esp + 0x34]
push eax
push 0
push 0x30
call sub.USER32.dll_SystemParametersInfoA
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x38]
sub ecx, esi
mov eax, ecx
shr eax, 0x1f
add ecx, eax
sar ecx, 1
mov dword [esp + 0x20], ecx
mov ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x3c]
sub edx, ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
sar edx, 1
mov dword [esp + 0x24], edx
add ecx, esi
mov dword [esp + 0x28], ecx
add edx, ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x860], 0
mov dword [esp + 0x864], 0x4244b0
mov dword [esp + 0x868], 0
mov dword [esp + 0x86c], 0
mov eax, dword [0x5131c0]
mov dword [esp + 0x870], eax
add esp, 0xfffffff8
push 2
push eax
call sub.USER32.dll_LoadIconA
mov dword [esp + 0x87c], eax
mov dword [esp + 0x880], 0
add esp, 0xfffffffc
push 0
call sub.GDI32.dll_GetStockObject
mov dword [esp + 0x888], eax
mov dword [esp + 0x88c], 0
mov dword [esp + 0x890], 0x4245aa
lea eax, [esp + 0x86c]
push eax
call sub.USER32.dll_RegisterClassA
add esp, 0xfffffffc
push 0
push dword [0x5131c0]
push 0
push 0
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x4c]
sub eax, ecx
push eax
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x4c]
sub eax, edx
push eax
push ecx
push edx
push 0x80000000
push edi
push 0x4245aa
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x4e0130], eax
add esp, 0x20
add esp, 0xfffffff8
push 5
push eax
call sub.USER32.dll_ShowWindow
add esp, 0xfffffffc
push dword [0x4e0130]
call sub.USER32.dll_UpdateWindow
add esp, 0xfffffffc
call sub.KERNEL32.dll_GetTickCount
mov dword [0x4f8000], eax
add esp, 0x10
pop ebx
pop esi
pop edi
add esp, 0x880
ret
Function at 0x4247ec
Capabilities:
Check for time delay via gettickcount
Hide graphical window

Disassembly:
sub esp, 0xc
cmp dword [0x4e0130], 0
je 0x42484b
jmp 0x42480d
add esp, 0xfffffff4
push 0x64
call sub.KERNEL32.dll_Sleep
add esp, 0xc
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [0x4f8000]
cmp eax, dword [0x4f8010]
jb 0x424800
add esp, 0xfffffff8
push 0
push dword [0x4e0130]
call sub.USER32.dll_ShowWindow
add esp, 0xfffffffc
push dword [0x4e0130]
call sub.USER32.dll_DestroyWindow
mov dword [0x4e0130], 0
add esp, 0xc
mov eax, dword [0x4e012c]
test eax, eax
je 0x42486a
add esp, 0xfffffff4
push eax
call sub.GDI32.dll_DeleteObject
mov dword [0x4e012c], 0
add esp, 0xc
add esp, 0xc
ret