joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421034
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x18], eax
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x421182
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
push eax
push 0x18
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DestroyWindow
test bl, bl
je 0x421096
push 0
push 1
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_CreateBitmap
mov dword [ebp - 0x10], eax
jmp 0x4210f8
push 0
call fcn.004066d0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4210ab
call fcn.00420f7c
xor eax, eax
push ebp
push 0x4210f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4210d8
call fcn.00420f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4210f8
mov eax, dword [ebp - 0x14]
push eax
push 0
call fcn.00406910
ret
cmp dword [ebp - 0x10], 0
je 0x421162
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetClassInfoA
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetClassInfoA
mov esi, eax
push 0xcc0020
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetKeyboardLayoutList
test ebx, ebx
je 0x421154
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetClassInfoA
test esi, esi
je 0x421162
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetClassInfoA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421189
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_CharNextA
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_CharNextA
ret
Function at 0x423890
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, esi
call fcn.0042372c
lea edx, [ebp - 0x22]
mov ecx, 0x16
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x22], 0x9ac6cdd7
jne 0x4238d2
lea eax, [ebp - 0x22]
call fcn.00421d6c
cmp ax, word [ebp - 0xe]
je 0x4238d7
call fcn.00420f1c
sub dword [ebp - 8], 0x16
mov eax, dword [ebp - 8]
call fcn.0040271c
mov dword [ebp - 0xc], eax
mov ebx, dword [esi + 0x28]
xor eax, eax
push ebp
push 0x4239ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi + 0x28]
mov dx, word [ebp - 0x14]
mov word [eax + 0x18], dx
cmp word [ebp - 0x14], 0
jne 0x42391d
mov word [ebp - 0x14], 0x60
movzx eax, word [ebp - 0x14]
push eax
push 0x9ec
movsx eax, word [ebp - 0x18]
movsx edx, word [ebp - 0x1c]
sub eax, edx
push eax
call sub.user32.dll_RegisterClassA
mov dword [ebx + 0xc], eax
movzx eax, word [ebp - 0x14]
push eax
push 0x9ec
movsx eax, word [ebp - 0x16]
movsx edx, word [ebp - 0x1a]
sub eax, edx
push eax
call sub.user32.dll_RegisterClassA
mov dword [ebx + 0x10], eax
mov dword [ebp - 0x32], 8
xor eax, eax
mov dword [ebp - 0x2e], eax
xor eax, eax
mov dword [ebp - 0x2a], eax
xor eax, eax
mov dword [ebp - 0x26], eax
lea eax, [ebp - 0x32]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyState
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x42398e
call fcn.00420f1c
lea eax, [ebp - 0x96]
push eax
push 0x64
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_DestroyIcon
mov dword [ebp - 0x32], 8
mov eax, dword [ebp - 0x76]
mov dword [ebp - 0x2e], eax
mov eax, dword [ebp - 0x72]
mov dword [ebp - 0x2a], eax
xor eax, eax
mov dword [ebp - 0x26], eax
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_BeginPaint
lea eax, [ebp - 0x32]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyState
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x4239e2
call fcn.00420f1c
mov byte [esi + 0x2c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423a06
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040273c
ret

Function at 0x43075c
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push esp
push ebx
call sub.user32.dll_EnableMenuItem
push 0
mov eax, dword [esp + 8]
sub eax, edi
push eax
mov eax, dword [esp + 8]
sub eax, esi
push eax
push ebx
call sub.user32.dll_GetKeyboardLayout
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x10014866
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10014875
pop dword [ebp - 0x44]
mov eax, 0x171d214a
add eax, 0xf8e4272b
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x240ac012
sub dword [ebp - 0x54], 0xd5b87ac7
mov dword [ebp - 0x50], 0x4c59bd88
sub dword [ebp - 0x50], 0x1a267143
mov dword [ebp - 0x4c], 0xf6c78cbb
add dword [ebp - 0x4c], 0x5584b773
mov dword [ebp - 0x48], 0x9f2974f4
add dword [ebp - 0x48], 0x60d68b0c
lea eax, [ebp - 0x54]
push eax
mov eax, 0xb564534
sub eax, 0xfb5454ec
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xddbb7cf6
add dword [ebp - 0x54], 0x96b6ec60
mov dword [ebp - 0x50], 0x1536b533
sub dword [ebp - 0x50], 0xd3ca53be
mov dword [ebp - 0x4c], 0x92ef8425
sub dword [ebp - 0x4c], 0x2f8017b9
mov dword [ebp - 0x48], 0x12b928d1
sub dword [ebp - 0x48], 0x12b928d1
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3c18c
push 0
call eax
mov ecx, 0x2438e8b0
sub ecx, 0x2438a703
mov ebx, eax
mov edx, 0x4e79be02
sub edx, 0x3e771202
add edx, dword [ebp - 0x44]
mov edi, 0x55f60a98
add edi, 0x658192e4
xor dword [ebp - 0x28], ebx
mov esi, dword [edx]
add dword [ebp - 0x40], edx
add esi, edi
add dword [ebp - 0x38], 0x39224f17
mov dword [ebx], esi
xor dword [ebp - 0x10], 0x125a4173
add ebx, 0x8ca9dbcf
add ebx, 0x73562435
add edx, 0x80363d76
sub edx, 0x80363d72
loop 0x10014992
add eax, 0xb1969cc6
add eax, 0x4e6a5cc1
xor ebx, ebx
add ebx, eax
add eax, 0xd1cf896b
sub eax, 0xd1cf8966
mov ecx, 0xf77659dc
sub ecx, 0xe77659dc
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x1001d7ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10026200]
jne 0x1001d7b6
repz ret
jmp fcn.1001dc29
Function at 0x40143c
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00417110
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
push 0x104
push eax
call fcn.00401678
test al, al
jne 0x4014a3
push esi
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00419744
pop ecx
test eax, eax
je 0x40151e
push ebx
mov ebx, 0x42f46c
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004196f1
lea eax, [ebp - 0x20c]
push str.DFInput
push eax
call fcn.004196f1
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004196f1
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
test eax, eax
jne 0x4014f6
lea eax, [ebp - 0x20c]
push eax
call fcn.00403c83
pop ecx
cmp word [ebp - 0x20c], si
je 0x40150e
lea eax, [ebp - 0x20c]
push eax
call fcn.00419744
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [edi + 0x3c]
call fcn.004032c0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00409ec6
mov esp, ebp
pop ebp
ret

Function at 0x40152e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00417110
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
push 0x104
push eax
call fcn.00401678
test al, al
jne 0x401595
push esi
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00419744
pop ecx
test eax, eax
je 0x401610
push ebx
mov ebx, 0x42f46c
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004196f1
lea eax, [ebp - 0x20c]
push str.DFInput.users
push eax
call fcn.004196f1
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004196f1
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
test eax, eax
jne 0x4015e8
lea eax, [ebp - 0x20c]
push eax
call fcn.00403c83
pop ecx
cmp word [ebp - 0x20c], si
je 0x401600
lea eax, [ebp - 0x20c]
push eax
call fcn.00419744
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [edi + 0x24]
call fcn.004032c0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00409ec6
mov esp, ebp
pop ebp
ret
Function at 0x401739
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.00417110
add esi, 0x3c
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x401770
mov esi, dword [esi]
push str.AllSkin
push esi
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.0040342b
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
test eax, eax
jne 0x4017a9
lea eax, [ebp - 0x20c]
push eax
call fcn.00403c83
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409ec6
mov esp, ebp
pop ebp
ret

Function at 0x4017b7
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x3c]
cmp dword [eax + 0x14], 8
jb 0x4017d8
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.0040342b
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401810
lea eax, [ebp - 0x20c]
push eax
call fcn.00403c83
pop ecx
lea eax, [ebp - 0x20c]
push str.Related.ini
push eax
call fcn.004196f1
cmp word [ebp - 0x20c], 0
pop ecx
pop ecx
jne 0x401831
xor eax, eax
jmp 0x40183e
lea eax, [ebp - 0x20c]
push eax
call fcn.00419744
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xcc]
call fcn.004032c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409ec6
mov esp, ebp
pop ebp
ret
Function at 0x401860
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0xc34]
push esi
xor edi, edi
mov ebx, ecx
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00417110
add esp, 0x48
lea eax, [ebp - 0xc34]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00419722
lea eax, [ebp - 0x20c]
push eax
call fcn.00419744
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0041726a
add esp, 0x14
test eax, eax
je 0x401a67
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.00419722
lea eax, [ebp - 0x824]
push str.Local
push eax
call fcn.004196f1
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov esi, edi
inc ecx
test eax, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
cmovne esi, ecx
push eax
call fcn.00419722
lea eax, [ebp - 0x61c]
push str.LocalLow
push eax
call fcn.004196f1
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc38], ecx
push eax
call fcn.00419722
lea eax, [ebp - 0xa2c]
push str.Roaming
push eax
call fcn.004196f1
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x401a67
cmp dword [ebp - 0xc38], edi
je 0x401a67
test ecx, ecx
je 0x401a67
mov ecx, ebx
call fcn.00402bf3
test eax, eax
je 0x401a67
push str.DFInput
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x42f3ec
push eax
call fcn.0040342b
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401a3d
lea eax, [ebp - 0x414]
push eax
call fcn.00403c83
pop ecx
cmp word [ebp - 0x414], di
je 0x401a55
lea eax, [ebp - 0x414]
push eax
call fcn.00419744
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebx + 0x3c]
call fcn.004032c0
jmp 0x401a6e
mov ecx, ebx
call fcn.0040143c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409ec6
mov esp, ebp
pop ebp
ret
Function at 0x401a7f
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0xc34]
push esi
xor edi, edi
mov ebx, ecx
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00417110
push esi
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00417110
add esp, 0x48
lea eax, [ebp - 0xc34]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00419722
lea eax, [ebp - 0x20c]
push eax
call fcn.00419744
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0041726a
add esp, 0x14
test eax, eax
je 0x401c86
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.00419722
lea eax, [ebp - 0x824]
push str.Local
push eax
call fcn.004196f1
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov esi, edi
inc ecx
test eax, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
cmovne esi, ecx
push eax
call fcn.00419722
lea eax, [ebp - 0x61c]
push str.LocalLow
push eax
call fcn.004196f1
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc38], ecx
push eax
call fcn.00419722
lea eax, [ebp - 0xa2c]
push str.Roaming
push eax
call fcn.004196f1
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x401c86
cmp dword [ebp - 0xc38], edi
je 0x401c86
test ecx, ecx
je 0x401c86
mov ecx, ebx
call fcn.00402bf3
test eax, eax
je 0x401c86
push str.DFInput.users
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x42f3ec
push eax
call fcn.0040342b
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401c5c
lea eax, [ebp - 0x414]
push eax
call fcn.00403c83
pop ecx
cmp word [ebp - 0x414], di
je 0x401c74
lea eax, [ebp - 0x414]
push eax
call fcn.00419744
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebx + 0x24]
call fcn.004032c0
jmp 0x401c8d
mov ecx, ebx
call fcn.0040152e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409ec6
mov esp, ebp
pop ebp
ret
Function at 0x401c9e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x3c]
cmp dword [eax + 0x14], 8
jb 0x401cbf
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.0040342b
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401cf7
lea eax, [ebp - 0x20c]
push eax
call fcn.00403c83
pop ecx
lea eax, [ebp - 0x20c]
push str.Config.ini
push eax
call fcn.004196f1
cmp word [ebp - 0x20c], 0
pop ecx
pop ecx
jne 0x401d18
xor eax, eax
jmp 0x401d25
lea eax, [ebp - 0x20c]
push eax
call fcn.00419744
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x54]
call fcn.004032c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409ec6
mov esp, ebp
pop ebp
ret
Function at 0x4022da
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov ebx, ecx
call fcn.00417110
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x22c
mov edi, eax
lea eax, [ebp - 0x438]
push esi
push eax
call fcn.00417110
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40239e
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x402363
cmp dword [ebp - 0x430], edi
je 0x402369
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40234e
jmp 0x40237e
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00419722
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041998b
pop ecx
push eax
lea ecx, [ebx + 0x15c]
call fcn.00403299
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409ec6
mov esp, ebp
pop ebp
ret
Function at 0x40299a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x3c]
cmp dword [eax + 0x14], 8
jb 0x4029bb
mov eax, dword [eax]
push str.UseData
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.0040342b
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4029f3
lea eax, [ebp - 0x20c]
push eax
call fcn.00403c83
pop ecx
cmp word [ebp - 0x20c], 0
jne 0x402a01
xor eax, eax
jmp 0x402a0e
lea eax, [ebp - 0x20c]
push eax
call fcn.00419744
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x144]
call fcn.004032c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409ec6
mov esp, ebp
pop ebp
ret

Function at 0x402a30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.00404767
mov dword [edi], eax
call fcn.004047d7
mov dword [edi + 8], eax
call fcn.00404808
mov dword [edi + 0xc], eax
call fcn.00404707
mov dword [edi + 0x10], eax
call fcn.004046a7
mov dword [edi + 0x18], eax
call fcn.00404647
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [edi + 0x1c], eax
mov eax, dword [edi]
mov dword [edi + 4], eax
lea eax, [edi + 0x180]
push eax
call esi
lea eax, [edi + 0x198]
push eax
call esi
lea eax, [edi + 0x188]
push eax
call esi
lea eax, [edi + 0x1c8]
push eax
call esi
lea eax, [edi + 0x1a8]
push eax
call esi
lea eax, [edi + 0x1b8]
push eax
call esi
mov eax, dword [0x441ec8]
mov dword [edi + 0x174], eax
pop edi
pop esi
ret

Function at 0x402b2f
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.00417110
add esi, 0x24
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x402b68
mov eax, dword [esi]
jmp 0x402b6a
mov eax, esi
push 0x42f4e0
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.0040342b
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402ba3
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x14], 8
jb 0x402bab
mov esi, dword [esi]
push str.Dict
push esi
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.0040342b
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
test eax, eax
jne 0x402be5
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409ec6
mov esp, ebp
pop ebp
ret