joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e424
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x46bf0c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x41e4e8
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x41e45c
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x41e4ff
dec edx
je 0x41e540
jmp 0x41e59d
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x41e59d
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41e600
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x41e61d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x41e72f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x41e650
je 0x41e69c
sub ecx, 0x2b
je 0x41e692
sub ecx, 4
je 0x41e697
dec ecx
sub ecx, 0xa
jb 0x41e681
jmp 0x41e69f
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x41e662
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x41e670
jmp 0x41e69f
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x41e69f
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x41e69f
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x41e69f
mov byte [eax], 0x3e
jmp 0x41e69f
mov byte [eax], 0x3f
jmp 0x41e69f
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x41e62f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x41e6ef
cmp byte [esp + 3], 0xff
jne 0x41e6ef
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x41e727
cmp dl, 0xff
je 0x41e727
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x41e628
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x41f42c
Capabilities:
Encode data using xor

Disassembly:
push ebx
add esp, 0xfffffff8
mov dword [esp], eax
mov dword [esp + 4], edx
mov edx, ecx
dec edx
test edx, edx
jb 0x41f452
inc edx
xor eax, eax
mov ecx, dword [esp + 4]
mov cl, byte [ecx + eax]
mov ebx, dword [esp]
xor byte [ebx + eax], cl
inc eax
dec edx
jne 0x41f441
pop ecx
pop edx
pop ebx
ret

Function at 0x42033c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jb 0x420390
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x46e14c]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x46e54c]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x46e94c]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x46ed4c]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x42034b
pop edi
pop esi
pop ebx
ret
Function at 0x423eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x38]
sub edi, dword [ebx + 0x70]
sub edi, dword [ebx + 0x68]
jmp 0x423edf
mov eax, dword [ebx + 0x28]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x68]
ja 0x423f5e
push esi
mov eax, dword [ebx + 0x34]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00422878
add esp, 0xc
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x58], ebp
mov eax, dword [ebx + 0x48]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x423f2c
mov cx, word [esp]
sub cx, si
jmp 0x423f2e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x423f15
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x423f54
mov cx, word [esp]
sub cx, si
jmp 0x423f56
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x423f3d
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x423fbb
mov edx, dword [ebx + 0x34]
mov ecx, edi
add edx, dword [ebx + 0x68]
mov eax, ebp
add edx, dword [ebx + 0x70]
call fcn.00423ba0
add dword [ebx + 0x70], eax
cmp dword [ebx + 0x70], 3
jb 0x423fa6
mov eax, dword [ebx + 0x34]
mov edx, dword [ebx + 0x68]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x44], eax
mov ecx, dword [ebx + 0x54]
shl eax, cl
mov edx, dword [ebx + 0x34]
mov ecx, dword [ebx + 0x68]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x50]
mov dword [ebx + 0x44], eax
cmp dword [ebx + 0x70], 0x106
jae 0x423fbb
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x423eba
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x434da8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x434dae
ret

Function at 0x436c90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x436ce1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x436cc8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x436cb8
jmp 0x436ce1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x436cc9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a204
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
xor eax, eax
push ebp
push 0x43a3bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.004047ac
add eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp + 8]
call fcn.004044d0
test esi, esi
jbe 0x43a38a
push esi
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x43a38a
mov esi, dword [ebp - 0x38]
jmp 0x43a363
push 0x1c
lea eax, [ebp - 0x5c]
push eax
push esi
push edi
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x43a2a0
call sub.kernel32.dll_GetLastError
add esi, dword [ebp - 0x3c]
jmp 0x43a363
cmp ebx, dword [ebp - 0x50]
jae 0x43a2d1
mov eax, dword [ebp - 0x50]
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.0041dac4
mov ebx, eax
push ebx
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x43a1e0]
call fcn.00405a28
add esp, 4
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x50]
xor edx, edx
push edx
push eax
call fcn.0041dac4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x43a35a
cmp dword [ebp - 0x10], 0x400
jbe 0x43a35a
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.004047ac
push eax
mov eax, dword [ebp - 4]
call fcn.004049ac
mov ecx, dword [ebp - 0x14]
pop edx
call fcn.0043a0e8
test eax, eax
je 0x43a35a
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
call fcn.004047b4
mov eax, dword [ebp + 8]
cmp dword [ebp - 8], 0
je 0x43a35a
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.00404a94
test eax, eax
jg 0x43a38a
lea eax, [ebx + esi]
cmp esi, eax
ja 0x43a36c
add esi, ebx
cmp esi, dword [ebp - 0x34]
jb 0x43a282
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x43a1e0]
call fcn.00405a28
add esp, 4
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a3c2
lea eax, [ebp - 0x18]
call fcn.004044d0
lea eax, [ebp - 0x14]
mov edx, dword [0x43a1e0]
call fcn.00405a34
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044f4
ret
Function at 0x43ae4c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040499c
xor eax, eax
push ebp
push 0x43af76
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x43af4b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004049ac
push eax
push esi
mov eax, dword [0x4715b8]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43aead
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43af60
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
cmp al, 0xe9
jne 0x43aec5
pop dword fs:[0]
add esp, 8
jmp 0x43af60
cmp al, 0xff
jne 0x43aed6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43af60
mov edi, ebx
sub edi, dword [ebp - 0x10]
sub edi, 5
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, 0xff
call fcn.00402a48
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov edx, ebx
add edx, 5
mov eax, dword [ebp - 0x10]
call fcn.0043b010
mov edx, ebx
add edx, 4
mov byte [edx], al
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x10]
inc eax
mov dword [eax], edi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
add ebx, 5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
push esi
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43af5c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43af7d
lea eax, [ebp - 4]
call fcn.004044d0
ret

Function at 0x43af8c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, eax
mov bl, 1
xor edx, edx
push ebp
push 0x43affb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
mov edx, eax
sub edx, 5
mov edx, dword [edx]
mov dword [ebp - 8], edx
dec eax
movzx edi, byte [eax]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.0040705c
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, esi
sub eax, 5
call fcn.00402a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43b007
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43b2d4
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x43b2e3
or edx, 0x200
test eax, 0x20000000
je 0x43b317
test eax, 0x40000000
je 0x43b302
test eax, 0x80000000
je 0x43b2fd
or edx, 0x40
jmp 0x43b33e
or edx, 0x20
jmp 0x43b33e
test eax, 0x80000000
je 0x43b311
or edx, 0x80
jmp 0x43b33e
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x43b32f
test eax, 0x80000000
je 0x43b32a
or edx, 4
jmp 0x43b33e
or edx, 2
jmp 0x43b33e
test eax, 0x80000000
je 0x43b33b
or edx, 8
jmp 0x43b33e
or edx, 1
mov eax, edx
ret

Function at 0x43dbe8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
xor eax, eax
push ebp
push 0x43dd19
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403114
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 1
lea edx, [ebp - 0x60]
mov eax, 0x43dd30
call fcn.00457a04
mov eax, dword [ebp - 0x60]
call fcn.004049ac
mov dword [ebp - 0x44], eax
lea edx, [ebp - 0x68]
mov eax, 0x43dd48
call fcn.00457a04
push dword [ebp - 0x68]
push dword [ebp - 4]
push 0x43dd6c
push dword [ebp - 8]
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.0040486c
mov eax, dword [ebp - 0x64]
call fcn.0044a0e4
cmp dword [ebp - 8], 0
jne 0x43dc9d
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404568
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004049ac
push eax
mov eax, dword [ebp - 4]
call fcn.004049ac
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x43dcd1
mov ebx, dword [ebp - 0x54]
jmp 0x43dcf1
lea edx, [ebp - 0x6c]
mov eax, 0x43dd84
call fcn.00457a04
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 4]
call fcn.004047b4
mov eax, dword [ebp - 0x6c]
call fcn.0044a0e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dd20
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.004044f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044f4
ret
Function at 0x43ddac
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43de4a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00407064
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x43de64
mov edx, ebx
call fcn.004047f8
mov eax, dword [ebp - 0x24]
call fcn.004049ac
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
mov ecx, 0x43de64
mov edx, esi
call fcn.004047f8
mov eax, dword [ebp - 0x28]
call fcn.004049ac
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x614
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43de51
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004044f4
ret

Function at 0x43ee74
Capabilities:
Log keystrokes

Disassembly:
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
ret
Function at 0x43f200
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f2d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 0x43f2e8
call fcn.00457a04
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00457660
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
pop ecx
call fcn.004047f8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0045e318
test al, al
jne 0x43f2b9
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43f29a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0040551c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f2a1
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f2db
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004044f4
ret

Function at 0x43f428
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f4f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 0x43f508
call fcn.00457a04
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0045e9d8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0045e318
test al, al
jne 0x43f4c0
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43f4b9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 5
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0040551c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f4c0
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040ca18
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f4fa
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004044f4
ret
Function at 0x43fa68
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040499c
xor eax, eax
push ebp
push 0x43fbb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004044d0
cmp dword [ebp - 4], 0
jne 0x43faaa
push 0
call sub.user32.dll_GetDC
mov ebx, eax
jmp 0x43fac0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004049ac
push eax
call sub.gdi32.dll_CreateDCA
mov ebx, eax
test ebx, ebx
jne 0x43fad3
mov eax, 0x43fbcc
call fcn.0044a0e4
jmp 0x43fb9d
push 8
push ebx
call sub.gdi32.dll_GetDeviceCaps
push 0xa
push ebx
call sub.gdi32.dll_GetDeviceCaps
push ebx
push 0
call sub.user32.dll_ReleaseDC
mov dl, 1
mov eax, dword [0x434c4c]
call fcn.0043827c
mov ebx, eax
xor ecx, ecx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.0043f128
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, esi
call fcn.0043f550
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 1
call sub.kernel32.dll_Sleep_1
cmp byte [0x472cc6], 0
jne 0x43fb24
mov byte [0x472cc5], 1
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x471628]
push eax
mov ecx, 0x43f5f0
xor edx, edx
xor eax, eax
call fcn.00404484
mov esi, eax
mov edx, 0x1770
mov eax, esi
call fcn.0045cab4
mov byte [0x472cc5], 0
sub eax, 1
jae 0x43fb86
mov esi, dword [ebp - 0x24]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.004045c0
jmp 0x43fb8e
push 0
push esi
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.004036fc
mov eax, dword [ebp - 0x24]
call fcn.004036fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fbba
lea eax, [ebp - 4]
call fcn.004044d0
ret

Function at 0x440500
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x472cc8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov byte [0x472cc4], 0
push 0
mov eax, dword [0x472cd0]
push eax
call sub.kernel32.dll_TerminateThread
ret
Function at 0x44069c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4407e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004044d0
mov eax, dword [ebp - 4]
call fcn.0045dc94
test al, al
je 0x4407bf
mov al, 2
call fcn.0043f8e8
mov ebx, 0x50
mov esi, 0x9d
mov edi, 0x8c
push 1
mov eax, dword [ebp - 4]
call fcn.004049ac
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.0043f550
push 0
push 0
mov eax, dword [ebp - 0x28]
call fcn.0041934c
lea eax, [ebp - 0x28]
push eax
push 0
push 0x472cf4
mov ecx, 0x43f5a8
xor edx, edx
xor eax, eax
call fcn.00404484
mov ebx, eax
mov edx, 0xbb8
mov eax, ebx
call fcn.0045cab4
xor edx, edx
push ebp
push 0x4407b8
push dword fs:[edx]
mov dword fs:[edx], esp
sub eax, 1
jae 0x44079a
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x44076a
cmp eax, 0
jbe 0x4407a2
jmp 0x44076c
jle 0x4407a2
mov ebx, dword [ebp - 0x28]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
lea eax, [ebp - 0xc]
call fcn.004045c0
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.00428670
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 8]
call fcn.00456de8
jmp 0x4407a2
push 0
push ebx
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4407bf
mov eax, dword [ebp - 0x28]
call fcn.004036fc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4407ec
lea eax, [ebp - 0x2c]
call fcn.004044d0
lea eax, [ebp - 0xc]
call fcn.004044d0
lea eax, [ebp - 4]
call fcn.004044d0
ret