joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434f9b
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [esp + 4], 0
je 0x434fcf
cmp dword [0x469e90], 0
jne 0x434fca
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push sym.DEMO32.EXE_KeyboardHookProc
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [0x469e90], eax
jne 0x434fe6
xor eax, eax
ret 4
mov eax, dword [0x469e90]
test eax, eax
je 0x434fca
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x469e90], 0
push 1
pop eax
jmp 0x434fcc

Function at 0x4350d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
push edi
jl 0x4351c6
cmp ecx, 3
je 0x4351c6
cmp dword [0x469ea0], edx
jne 0x4351c6
cmp dword [0x469e98], edx
mov edi, dword [ebp + 0xc]
je 0x4351a5
cmp edi, 0x12
je 0x4351a5
mov eax, dword [ebp + 0x10]
test eax, 0x80000000
jne 0x4351a5
cmp dword [0x469ea4], edx
je 0x43513a
cmp dword [0x469e80], edi
jne 0x43513a
push eax
push edi
jmp 0x4351cc
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [0x469ea4], edx
mov dword [0x469e80], edi
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], eax
mov dword [ebp + 0xc], edx
call esi
test ah, 0x80
je 0x43516d
mov dword [ebp + 0xc], 2
push 0x11
call esi
test ah, 0x80
je 0x43517a
or dword [ebp + 0xc], 1
push 0x12
call esi
test ah, 0x80
pop esi
je 0x435188
or dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x469e9c]
test eax, eax
je 0x4351a5
lea ecx, [ebp - 0x30]
push ecx
push 9
push dword [0x469e98]
call eax
cmp dword [0x4657f0], 0
je 0x4351c1
mov eax, dword [0x469e90]
test eax, eax
je 0x4351c1
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
push eax
jmp 0x4351d3
push 1
pop eax
jmp 0x4351d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
push dword [0x469e90]
call dword [sym.imp.USER32.dll_CallNextHookEx]
pop edi
leave
ret 0xc
Function at 0x43531f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
jge 0x435342
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x469e8c]
call dword [sym.imp.USER32.dll_CallNextHookEx]
jmp 0x435397
mov edi, dword [ebp + 0x10]
mov ecx, 0x100
mov edx, 0x104
mov eax, dword [edi]
cmp eax, ecx
je 0x435359
cmp eax, edx
jne 0x43538f
cmp dword [0x469e78], ebx
jne 0x43539e
mov eax, dword [edi + 4]
and eax, 0xff
cmp eax, dword [0x469e7c]
jne 0x435397
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov dword [0x469e84], eax
mov dword [0x469e78], 1
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x435397
cmp dword [0x469e78], ebx
jne 0x43539e
xor eax, eax
jmp 0x43548f
cmp eax, ecx
push esi
je 0x4353a7
cmp eax, edx
jne 0x4353d5
mov eax, dword [edi + 4]
and eax, 0xff
cmp eax, dword [0x469e7c]
jne 0x4353d5
push dword [0x469e8c]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push ebx
mov dword [0x469e8c], ebx
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x43548c
mov eax, dword [0x469e6c]
mov edx, dword [0x469e70]
lea ecx, [eax + eax*4]
inc eax
mov dword [0x469e6c], eax
lea esi, [edx + ecx*4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x469e84]
mov dword [esi + 0xc], eax
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ecx, dword [0x469e6c]
mov eax, dword [0x469e74]
lea edx, [ecx + ecx*4 + 0x19]
shl edx, 2
cmp edx, eax
jb 0x43548c
cmp eax, 0x100000
jb 0x435433
sub ecx, 0x32
mov dword [0x469e6c], ecx
jmp 0x43548c
add eax, 0x3e8
mov esi, 0x7ffe
push eax
push esi
mov dword [0x469e74], eax
call fcn.004341c8
mov ecx, dword [0x469e74]
mov edi, eax
add ecx, 0xfffffc18
xor eax, eax
test ecx, ecx
jbe 0x43547a
mov ecx, dword [0x469e70]
mov cl, byte [ecx + eax]
mov byte [eax + edi], cl
mov ecx, dword [0x469e74]
inc eax
add ecx, 0xfffffc18
cmp eax, ecx
jb 0x43545d
push dword [0x469e70]
push esi
call fcn.004342a3
mov dword [0x469e70], edi
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x435a96
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 4], ebx
je 0x435ad4
mov eax, dword [esi]
push ebx
push 0x11
mov byte [eax], bl
mov eax, dword [esi]
mov byte [eax + 1], 1
mov eax, dword [esi]
mov byte [eax + 2], 0x11
call edi
mov ecx, dword [esi]
mov dword [ebp - 4], 1
mov byte [ecx + 3], al
add dword [esi], 4
cmp dword [ebp + 0xc], ebx
je 0x435b03
cmp dword [ebp + 0x10], ebx
mov eax, dword [esi]
je 0x435ae4
mov byte [eax], bl
jmp 0x435ae7
mov byte [eax], 4
mov eax, dword [esi]
push ebx
push 0x12
mov byte [eax + 1], 1
mov eax, dword [esi]
mov byte [eax + 2], 0x12
call edi
mov ecx, dword [esi]
mov byte [ecx + 3], al
add dword [esi], 4
inc dword [ebp - 4]
cmp dword [ebp + 0x14], ebx
je 0x435b43
cmp dword [ebp + 0x10], ebx
jne 0x435b19
cmp dword [ebp + 0xc], ebx
je 0x435b19
mov eax, dword [esi]
mov byte [eax], 4
jmp 0x435b1d
mov eax, dword [esi]
mov byte [eax], bl
mov eax, dword [esi]
push ebx
push 0x10
mov byte [eax + 1], 1
mov eax, dword [esi]
mov byte [eax], bl
mov eax, dword [esi]
mov byte [eax + 1], 1
mov eax, dword [esi]
mov byte [eax + 2], 0x10
call edi
mov ecx, dword [esi]
mov byte [ecx + 3], al
add dword [esi], 4
inc dword [ebp - 4]
cmp dword [ebp + 0x10], ebx
jne 0x435b54
cmp dword [ebp + 0xc], ebx
je 0x435b54
mov eax, dword [esi]
mov byte [eax], 4
jmp 0x435b58
mov eax, dword [esi]
mov byte [eax], bl
mov eax, dword [esi]
push ebx
mov byte [eax + 1], 1
mov ecx, dword [esi]
mov eax, dword [ebp + 0x18]
push eax
mov byte [ecx + 2], al
call edi
mov ecx, dword [esi]
mov byte [ecx + 3], al
add dword [esi], 4
inc dword [ebp - 4]
cmp dword [ebp + 0x10], ebx
mov eax, dword [esi]
jne 0x435b86
cmp dword [ebp + 0xc], ebx
je 0x435b86
mov byte [eax], 5
jmp 0x435b89
mov byte [eax], 1
mov eax, dword [esi]
push ebx
mov byte [eax + 1], 1
mov ecx, dword [esi]
mov eax, dword [ebp + 0x18]
push eax
mov byte [ecx + 2], al
call edi
mov ecx, dword [esi]
mov byte [ecx + 3], al
add dword [esi], 4
inc dword [ebp - 4]
cmp dword [ebp + 0x14], ebx
mov eax, dword [esi]
je 0x435bdd
cmp dword [ebp + 0x10], ebx
jne 0x435bbc
cmp dword [ebp + 0xc], ebx
je 0x435bbc
mov byte [eax], 5
jmp 0x435bbf
mov byte [eax], 1
mov eax, dword [esi]
push ebx
push 0x10
mov byte [eax + 1], 1
mov eax, dword [esi]
mov byte [eax + 2], 0x10
call edi
mov ecx, dword [esi]
mov byte [ecx + 3], al
add dword [esi], 4
mov eax, dword [esi]
inc dword [ebp - 4]
cmp dword [ebp + 0xc], ebx
je 0x435c03
mov byte [eax], 1
mov eax, dword [esi]
push ebx
push 0x12
mov byte [eax + 1], 1
mov eax, dword [esi]
mov byte [eax + 2], 0x12
call edi
mov ecx, dword [esi]
mov byte [ecx + 3], al
add dword [esi], 4
mov eax, dword [esi]
inc dword [ebp - 4]
cmp dword [ebp + 0x10], ebx
je 0x435c27
mov byte [eax], 1
mov eax, dword [esi]
push ebx
push 0x11
mov byte [eax + 1], 1
mov eax, dword [esi]
mov byte [eax + 2], 0x11
call edi
mov ecx, dword [esi]
mov byte [ecx + 3], al
add dword [esi], 4
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436820
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push str.QuickTime.qts
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x436868
lea ecx, [esp + 0x10]
push 0x104
push ecx
push eax
call esi
test eax, eax
jbe 0x436868
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea eax, [esp + 0x10]
push 0x104
push eax
push 0
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jbe 0x4368fc
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0xf]
lea ecx, [esp + 0x10]
cmp eax, ecx
jb 0x4368fc
mov cl, byte [eax]
cmp cl, 0x5c
je 0x4368b1
cmp cl, 0x2f
je 0x4368b1
dec eax
lea edx, [esp + 0x10]
cmp eax, edx
jae 0x43689a
jmp 0x4368fc
lea ecx, [esp + 0x10]
cmp eax, ecx
jb 0x4368fc
mov byte [eax + 1], 0
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
mov ebx, eax
test ebx, ebx
jne 0x43697c
lea ecx, [esp + 0x10]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x43697c
mov edi, 0x4644d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x43a1df
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
push ebx
push esi
push edi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x43a3dd
xor ebx, ebx
push ebx
push 9
push dword [ebp + 8]
call fcn.0040684e
push ebx
push 0xb
push dword [ebp + 8]
mov esi, eax
call fcn.0040684e
cmp dword [esi + 0x10], 1
mov dword [ebp - 8], ebx
je 0x43a232
push 1
push 4
push eax
call fcn.004036c1
push eax
call fcn.004444be
mov dword [ebp - 8], eax
push dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x174]
push eax
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x174]
push eax
call fcn.0043b6bb
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.0043b5a6
mov esi, eax
cmp esi, 0xffffffff
jne 0x43a285
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x37c]
push eax
call edi
jmp 0x43a327
lea eax, [ebp - 0x174]
mov byte [ebp + esi - 0x174], bl
push eax
lea eax, [ebp - 0x37c]
push eax
call edi
mov eax, dword [ebp - 4]
push ebx
add eax, esi
push ebx
lea eax, [ebp + eax - 0x174]
push eax
call fcn.0043b5a6
mov edi, eax
cmp edi, 0xffffffff
je 0x43a2c3
mov eax, dword [ebp - 4]
add eax, edi
mov byte [ebp + eax - 0x174], bl
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0043b758
mov eax, dword [ebp - 4]
add eax, esi
lea eax, [ebp + eax - 0x174]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0043b505
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x37c]
push eax
call esi
mov eax, dword [ebp - 4]
add edi, eax
cmp byte [ebp + edi - 0x174], bl
lea eax, [ebp + edi - 0x174]
je 0x43a321
push eax
lea eax, [ebp - 0x37c]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x37c]
pop esi
push esi
push ebx
push ebx
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x43a3e1
cmp dword [ebp + 0x10], 0xc2
je 0x43a3dd
lea eax, [ebp - 0x278]
push str.iexplore.exe
push eax
call edi
lea eax, [ebp - 0x278]
push eax
call fcn.004344fb
test eax, eax
jne 0x43a390
lea eax, [ebp - 0x278]
push str.netscape.exe
push eax
call edi
lea eax, [ebp - 0x278]
push eax
call fcn.004344fb
test eax, eax
je 0x43a3dd
push 0x44
lea eax, [ebp - 0x70]
pop edi
push edi
push ebx
push eax
call fcn.0044bf00
push 0x10
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0044bf00
add esp, 0x18
lea eax, [ebp - 0x18]
mov word [ebp - 0x40], si
mov dword [ebp - 0x70], edi
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x37c]
push ebx
push eax
lea eax, [ebp - 0x278]
push eax
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x43a3e1
xor eax, eax
jmp 0x43a3e3
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x43aec5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
push 0x44
pop edi
xor esi, esi
push edi
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.0044bf00
add esp, 0xc
mov dword [ebp - 0x70], edi
lea eax, [ebp - 0x10]
push 1
pop edi
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov word [ebp - 0x40], di
push dword [ebp + 0x10]
mov dword [ebp - 0x44], edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x43afc6
cmp dword [ebp + 0x14], esi
jne 0x43afae
push dword [ebp + 0xc]
call fcn.00402ca8
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp + 0x14], eax
push 0x1ff
push 0xffffffffffffffff
lea eax, [ebp + 0x14]
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, edi
mov dword [ebp + 0x10], eax
jne 0x43af9a
push edi
push esi
push esi
lea eax, [ebp - 0x2c]
push esi
push eax
call ebx
test eax, eax
je 0x43af2b
mov eax, dword [ebp - 0x28]
cmp eax, 0x12
je 0x43afa7
cmp eax, 0x400
jb 0x43af69
cmp eax, 0xffff
jbe 0x43af78
cmp eax, 0xf
je 0x43af78
cmp eax, 0x11
je 0x43af78
cmp eax, 0x16
jne 0x43af8c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
push esi
push esi
lea eax, [ebp - 0x2c]
push esi
push eax
call ebx
test eax, eax
jne 0x43af53
cmp dword [ebp + 0x10], 0xffffffff
je 0x43afae
cmp dword [ebp + 0x10], esi
je 0x43afae
jmp 0x43af2b
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
push dword [ebp + 0xc]
call fcn.00402c78
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b758
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edi
mov edi, dword [ebp + 0xc]
push str._path_
push edi
call esi
test eax, eax
jne 0x43b786
push 0x104
push dword [ebp + 8]
call fcn.00433532
jmp 0x43b8a9
push str._temp_
push edi
call esi
test eax, eax
jne 0x43b7a4
push 0x104
push dword [ebp + 8]
call fcn.00433597
jmp 0x43b8a9
push str._cd_
push edi
call esi
test eax, eax
jne 0x43b7dd
mov esi, dword [ebp + 8]
push 0x41
pop ebx
and byte [esi + 3], al
mov byte [esi + 1], 0x3a
mov byte [esi + 2], 0x5c
push esi
mov byte [esi], bl
call fcn.0043b8b3
test eax, eax
pop ecx
jne 0x43b8a9
inc ebx
cmp ebx, 0x5b
jl 0x43b7c1
jmp 0x43b8ac
push str._wind_
push edi
call esi
test eax, eax
je 0x43b89b
push str._windir_
push edi
call esi
test eax, eax
je 0x43b89b
push str._winsysdir_
push edi
call esi
test eax, eax
jne 0x43b81c
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x43b8a9
push str._programfilesdir_
push edi
call esi
test eax, eax
mov ebx, str._commonfilesdir_
je 0x43b841
push ebx
push edi
call esi
test eax, eax
je 0x43b841
push str._desktopdir_
push edi
call esi
test eax, eax
jne 0x43b8a9
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 4], eax
je 0x43b8a9
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x43b890
push str._programfilesdir_
push edi
call esi
test eax, eax
jne 0x43b877
push 0x26
pop eax
jmp 0x43b884
push ebx
push edi
call esi
neg eax
sbb eax, eax
and al, 0xe5
add eax, 0x2b
push dword [ebp + 8]
xor ecx, ecx
push ecx
push ecx
push eax
push ecx
call dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x43b8a9
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43fb49
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 9
push dword [ebp + 8]
call fcn.0040684e
push ebx
push 0xb
push dword [ebp + 8]
call fcn.0040684e
push 1
push 4
push eax
mov dword [ebp - 4], eax
call fcn.004036c1
push eax
call fcn.004444be
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
cmp si, 0x10e1
mov dword [ebp + 8], eax
jne 0x43fbe2
cmp di, 0x4d2
jne 0x43fbe2
cmp dword [ebp + 0xc], ebx
je 0x43fbc7
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.0040e581
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
mov esi, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
sar esi, 1
add esi, dword [ebp - 0x20]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
add edi, dword [ebp - 0x1c]
jmp 0x43fbe2
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call edi
cdq
sub eax, edx
push 1
mov esi, eax
sar esi, 1
call edi
cdq
sub eax, edx
mov edi, eax
sar edi, 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
movzx ecx, word [ebp + 0x10]
imul ecx, ecx, 0xfa
mov dword [ebp + 0x18], ecx
mov dword [ebp + 0xc], eax
add ecx, eax
lea eax, [ebp - 8]
push eax
push 0
push 0x22
mov dword [ebp + 0x10], ecx
push dword [ebp - 4]
call fcn.0040382e
cmp dword [ebp - 8], 1
jne 0x43fc3d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43fc3d
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ClientToScreen]
add esi, dword [ebp - 0x10]
add edi, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
movzx esi, si
movzx edi, di
mov dword [ebp - 4], esi
sub esi, dword [ebp - 0x10]
mov dword [ebp + 0x14], edi
sub edi, dword [ebp - 0xc]
call ebx
cmp eax, dword [ebp + 0x10]
jae 0x43fca2
mov ecx, dword [ebp + 0xc]
imul ecx, ecx, 0x64
mov dword [ebp + 8], ecx
jmp 0x43fc6e
mov ecx, dword [ebp + 8]
imul eax, eax, 0x64
sub eax, ecx
xor edx, edx
div dword [ebp + 0x18]
push 0x64
pop ecx
mov dword [ebp + 0xc], eax
imul eax, edi
cdq
idiv ecx
add eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
imul eax, esi
cdq
idiv ecx
add eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
call ebx
cmp eax, dword [ebp + 0x10]
jb 0x43fc6b
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43fdaa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x110]
push edi
push eax
push dword [ebp + 0xc]
call fcn.00433c39
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x110]
push 0x4663ec
push eax
call esi
test eax, eax
je 0x43fdf5
lea eax, [ebp - 0x110]
push 0x4663e8
push eax
call esi
test eax, eax
mov dword [ebp - 4], edi
jne 0x43fdfc
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.004100e7
mov ebx, eax
cmp ebx, edi
je 0x43fe2d
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43fe31
xor eax, eax
jmp 0x43fe78
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call fcn.0043fcb6
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0xc]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x7ffe
push ebx
push esi
call fcn.004342a3
push edi
push esi
call fcn.004342a3
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43fec9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push esi
push edi
xor edi, edi
push edi
push 0xb
push dword [ebp + 8]
call fcn.0040684e
push 4
pop ebx
push ebx
push eax
call fcn.004036c1
push 1
pop esi
push esi
push eax
call fcn.004444be
mov dword [ebp - 4], eax
push 0x18
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0044bf00
add esp, 0xc
lea eax, [ebp - 0x194]
mov dword [ebp - 0x28], esi
push str.SMTP:
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x194]
push 0x30
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x194]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.0044bf00
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x2c]
cmp ebx, edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], eax
je 0x43ff8c
push 0x18
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.0044bf00
lea eax, [ebp - 0x74]
add esp, 0xc
or dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x68], ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push edi
push eax
push 0x43fe7d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp + 8], eax
push 0x1ff
push 0xffffffffffffffff
lea eax, [ebp + 8]
push edi
push eax
push esi
call ebx
test eax, eax
je 0x440010
push esi
push edi
push edi
lea eax, [ebp - 0x90]
push edi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x440001
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x43ffd0
push 0x1ff
push 0xffffffffffffffff
lea eax, [ebp + 8]
push edi
push eax
push esi
jmp 0x43ffca
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x1c