joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fe70
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
test ecx, ecx
je 0x42ff35
cmp word [ecx], 0
je 0x42ff35
push 0
push 0
push 3
push 0
push 1
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42ff35
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jg 0x42fecb
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
cmp dword [esi + 4], edi
jne 0x42fee4
test eax, eax
je 0x42fefe
push edi
push 0
push eax
call fcn.004d0100
add esp, 0xc
jmp 0x42ff0e
test eax, eax
je 0x42fefe
push eax
call fcn.004d2e43
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 1
push edi
call fcn.004d8c4a
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], edi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push edi
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42ff40
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [edx]
test edi, edi
je 0x42ff54
cmp word [edi], 0
jne 0x42ff59
mov edi, 0x628fa4
mov esi, dword [ecx]
test esi, esi
je 0x42ff65
cmp word [esi], 0
jne 0x42ff6a
mov esi, 0x628fa4
test edi, edi
je 0x42ffe3
push ebx
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push esi
lea ecx, [ebp - 0x18]
movups xmmword [ebp - 0x18], xmm0
call fcn.00406c40
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x42ff97
cmp word [ebx], 0
mov eax, ebx
jne 0x42ff9c
mov eax, 0x628fa4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
setne byte [ebp - 1]
test ebx, ebx
je 0x42ffb7
push ebx
call fcn.004d2e43
add esp, 4
mov eax, dword [ebp - 0xc]
pop ebx
test eax, eax
je 0x42ffc8
push eax
call fcn.004d2e43
add esp, 4
cmp byte [ebp - 1], 0
jne 0x42ffe3
push edi
push esi
call fcn.004e1e96
add esp, 8
test eax, eax
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431950
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x6441a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
lea eax, [ebp - 0x158]
push edi
push eax
mov edi, ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x431b8a
mov eax, dword [ebp - 0x11c]
xorps xmm0, xmm0
mov dword [ebp - 0x124], 0
movups xmmword [ebp - 0x134], xmm0
sub eax, 4
je 0x431aee
sub eax, 1
je 0x431a55
sub eax, 1
jne 0x431b02
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x134]
mov dword [esi], 3
sub eax, 0
je 0x431a3b
sub eax, 1
je 0x431a16
sub eax, 1
je 0x431a01
mov dword [esi], 0
push str.Windows_unknow
jmp 0x431b3f
push str.Windows_8
call fcn.00406d80
mov dword [esi], 5
jmp 0x431b44
cmp byte [ebp - 6], 1
jne 0x431a31
push str.Windows_7
call fcn.00406d80
mov dword [esi], 4
jmp 0x431b44
push str.Windows_Server_2008_R2
jmp 0x431b3f
cmp byte [ebp - 6], 1
jne 0x431a4b
push str.Windows_Vista
jmp 0x431b3f
push str.Windows_Server_2008
jmp 0x431b3f
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x431ad6
sub eax, 1
je 0x431acf
sub eax, 1
je 0x431a85
push str.Windows_unknow
lea ecx, [ebp - 0x134]
call fcn.00406d80
mov dword [esi], 0
jmp 0x431b44
cmp byte [ebp - 6], 1
jne 0x431aa0
cmp word [ebp - 0x158], 9
jne 0x431aa0
mov ecx, str.Windows_XP_Professional_x64_Edition
push ecx
jmp 0x431b39
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x431ab9
mov ecx, str.Windows_Server_2003
push ecx
jmp 0x431b39
push 0x59
call esi
test eax, eax
mov ecx, str.Windows_Server_2003_R2
mov edx, str.Windows_Server
cmove ecx, edx
push ecx
jmp 0x431b39
push str.Windows_XP
jmp 0x431b39
push str.Windows_2000
lea ecx, [ebp - 0x134]
call fcn.00406d80
mov dword [esi], 2
jmp 0x431b44
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x431b1d
cmp eax, 0xa
je 0x431b16
cmp eax, 0x5a
je 0x431b0f
mov dword [esi], 0
push str.Windows_UnKnow
jmp 0x431b39
push str.Windows_Me
jmp 0x431b39
push str.Windows_98
jmp 0x431b39
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x431b2f
push str.Windows_NT_4.0
jmp 0x431b39
cmp eax, 1
jne 0x431b44
push str.Windows_95
lea ecx, [ebp - 0x134]
call fcn.00406d80
lea eax, [ebp - 0x134]
mov ecx, edi
push eax
call fcn.00406930
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x431b65
push eax
call fcn.004d2e43
add esp, 4
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x431bc0
push eax
call fcn.004d2e43
add esp, 4
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cdf5d
mov esp, ebp
pop ebp
ret
mov dword [esi], 0
mov ecx, edi
push 0xffffffffffffffff
push str.Windows_UnKnow
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.00406c40
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004cdf5d
mov esp, ebp
pop ebp
ret
Function at 0x432520
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bafb0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
mov eax, dword [0x6441a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x62cb0c
mov dword [ebp - 4], 0
call fcn.00406d80
lea ecx, [ebp - 0x6c]
call fcn.0042e970
mov byte [ebp - 4], 1
mov edx, dword [eax]
test edx, edx
je 0x432589
cmp word [edx], 0
jne 0x43258e
mov edx, 0x628fa4
mov ecx, edx
mov dword [ebp - 0x54], 0
xor eax, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 7
mov word [ebp - 0x54], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4325b0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x54]
call fcn.00402460
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x4325e4
push eax
call fcn.004d2e43
add esp, 4
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
test eax, eax
je 0x432610
push eax
call fcn.004d2e43
add esp, 4
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
push 9
push str.All_Users
lea ecx, [ebp - 0x54]
call fcn.00403e30
push 8
push str.config_
lea ecx, [ebp - 0x54]
call fcn.00403e30
push 0xc
push str.configEx.ini
lea ecx, [ebp - 0x54]
call fcn.00403e30
cmp dword [ebp - 0x40], 8
lea eax, [ebp - 0x54]
cmovae eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x432658
mov byte [ebp - 0x55], al
jmp 0x4326af
cmp dword [ebp - 0x40], 8
lea ecx, [ebp - 0x54]
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
cmovae ecx, dword [ebp - 0x54]
movq qword [ebp - 0x1c], xmm0
movups xmmword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x2c], xmm0
test eax, eax
je 0x432680
cmp word [eax], 0
jne 0x432685
mov eax, 0x628fa4
push ecx
push 0x100
lea ecx, [ebp - 0x3c]
push ecx
push 0x62cb50
push eax
push 0x62cba8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x3c]
mov ecx, edi
push eax
call fcn.00406d80
mov byte [ebp - 0x55], 1
mov edx, dword [ebp - 0x40]
cmp edx, 8
jb 0x4326e5
mov ecx, dword [ebp - 0x54]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4326db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43274f
push edx
push ecx
call fcn.004ce3c6
add esp, 8
xor eax, eax
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x40], 7
test eax, eax
je 0x432710
push eax
call fcn.004d2e43
add esp, 4
mov dword [ebx + 8], 0
mov ecx, dword [ebx + 0x14]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
test ecx, ecx
je 0x43272e
push ecx
call fcn.004d2e43
add esp, 4
mov al, byte [ebp - 0x55]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cdf5d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004d8605
int3
Function at 0x432760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5baffd
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6441a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x14
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00406930
mov ecx, esi
call fcn.00432cc0
add esp, 0x14
lea eax, [ebp - 0x30]
push 0xa
push 0x19
push eax
push esi
call fcn.004daa77
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x48], 0
add esp, 0x10
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4327d8
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00402570
push ecx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406ae0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x432833
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x432829
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432974
push edx
push ecx
call fcn.004ce3c6
add esp, 8
lea ecx, [ebp - 0x44]
call fcn.0042e970
push str.All_Users
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00406cf0
push str.config_
lea ecx, [ebp - 0x44]
call fcn.00406cf0
mov eax, dword [ebp - 0x44]
mov edi, dword [ebp - 0x2c]
test eax, eax
je 0x43287c
cmp word [eax], 0
je 0x43287c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43287c
shr eax, 4
and al, 1
jne 0x432888
lea ecx, [ebp - 0x44]
call fcn.00432d70
test al, al
je 0x4328e2
push str.configEx.ini
lea ecx, [ebp - 0x44]
call fcn.00406cf0
mov esi, dword [ebp - 0x44]
test esi, esi
je 0x4328a4
cmp word [esi], 0
mov ecx, esi
jne 0x4328a9
mov ecx, 0x628fa4
test edi, edi
je 0x4328b5
cmp word [edi], 0
mov edx, edi
jne 0x4328ba
mov edx, 0x628fa4
mov eax, dword [ebp + 8]
test eax, eax
je 0x4328c7
cmp word [eax], 0
jne 0x4328cc
mov eax, 0x628fa4
push ecx
push edx
push eax
push 0x62cba8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
je 0x4328e5
mov bl, 1
jmp 0x4328e7
mov esi, dword [ebp - 0x44]
xor bl, bl
test esi, esi
je 0x4328f4
push esi
call fcn.004d2e43
add esp, 4
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x432904
push eax
call fcn.004d2e43
add esp, 4
test edi, edi
je 0x432911
push edi
call fcn.004d2e43
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x432921
push eax
call fcn.004d2e43
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x432938
push eax
call fcn.004d2e43
add esp, 4
mov dword [ebp + 8], 0
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
test ecx, ecx
je 0x432956
push ecx
call fcn.004d2e43
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cdf5d
mov esp, ebp
pop ebp
ret
call fcn.004d8605
int3
Function at 0x432c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0xf003f
push 0
push str.SoftwareTencentWeChat
push closesocket
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432c76
mov eax, dword [ebp + 8]
test eax, eax
je 0x432c4d
cmp word [eax], 0
jne 0x432c52
mov eax, 0x628fa4
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x432c76
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x432c81
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov eax, dword [ebp + 8]
test eax, eax
je 0x432c98
push eax
call fcn.004d2e43
add esp, 4
mov dword [ebp + 8], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
test eax, eax
je 0x432cb6
push eax
call fcn.004d2e43
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432cc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
push 0xf003f
push 0
push str.SoftwareTencentWeChat
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432d1c
mov eax, dword [ebp + 8]
test eax, eax
je 0x432cf6
cmp word [eax], 0
jne 0x432cfb
mov eax, 0x628fa4
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
je 0x432d5a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov eax, dword [ebp + 8]
test eax, eax
je 0x432d35
push eax
call fcn.004d2e43
add esp, 4
mov dword [ebp + 8], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
test eax, eax
je 0x432d53
push eax
call fcn.004d2e43
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x432d1e
Function at 0x432d70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
jg 0x432de5
movups xmm0, xmmword [0x628d68]
sub esp, 0x10
mov edx, str.D:Tools_agentworkspaceWeChatUpdateWechatUpdateutilsUtils.cpp
mov eax, esp
mov ecx, 4
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
push str.create_dir_is_empty
push str.Utils
push str.Utils::mkDirEx
push 0x6ad
movups xmmword [eax], xmm0
call fcn.00403890
add esp, 0x70
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, 1
jl 0x432e06
mov eax, dword [esi]
push 1
push 0x6294f0
lea eax, [eax + ecx*2]
add eax, 0xfffffffe
push eax
call fcn.004d9259
add esp, 0xc
test eax, eax
je 0x432e36
mov ecx, dword [esi + 4]
cmp ecx, 1
jl 0x432e2a
mov eax, dword [esi]
push 1
push 0x6294f8
lea eax, [eax + ecx*2]
add eax, 0xfffffffe
push eax
call fcn.004d9259
add esp, 0xc
test eax, eax
je 0x432e36
push 0x6294f0
mov ecx, esi
call fcn.00406cf0
mov eax, dword [esi]
test eax, eax
je 0x432e42
cmp word [eax], 0
jne 0x432e47
mov eax, 0x628fa4
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4332b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x6441a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x110
lea eax, [ebp - 0x114]
mov ebx, edx
push 0
push eax
mov dword [ebp - 0x128], ebx
mov edi, ecx
call fcn.004d0100
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jae 0x433317
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cdf5d
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
mov dword [ebx], 0x3000
push edi
push esi
push 0x1fffff
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x433429
lea eax, [ebp - 0x120]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x433426
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], esi
push eax
push esi
push esi
push 0x19
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x43341e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43341e
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x43341e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x43341c
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x11c]
push esi
push 0x19
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x433404
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
test eax, eax
je 0x433404
movzx eax, byte [eax]
dec eax
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x124], 1
mov eax, dword [eax]
mov dword [ecx], eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x124]
jmp 0x43341e
xor esi, esi
push dword [ebp - 0x120]
call ebx
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004cdf5d
mov esp, ebp
pop ebp
ret
Function at 0x433830
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb0bd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x6441a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x24]
call fcn.0042e7f0
push str.check.dat
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00406cf0
lea ecx, [ebp - 0x24]
call fcn.0042fd00
mov esi, dword [ebp - 0x24]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, 0xffffffff
je 0x4338c8
push 1
mov edx, 0x62bf00
lea ecx, [ebp - 0x10]
call fcn.0042fdc0
add esp, 4
mov ebx, eax
test edi, edi
je 0x4338a8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jle 0x4338c8
test esi, esi
je 0x4338b8
cmp word [esi], 0
mov eax, esi
jne 0x4338bd
mov eax, 0x628fa4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
jmp 0x4338ca
mov bl, 1
test esi, esi
je 0x4338d7
push esi
call fcn.004d2e43
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4338e7
push eax
call fcn.004d2e43
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433900
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push edi
mov eax, dword [esi]
test eax, eax
je 0x43391e
cmp word [eax], 0
jne 0x433923
mov eax, 0x628fa4
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
xor edi, edi
lea ecx, [ebx*2 + 2]
test ecx, ecx
jle 0x43394a
push 1
push ecx
call fcn.004d8c4a
add esp, 8
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x433956
cmp word [eax], 0
jne 0x43395b
mov eax, 0x628fa4
push edi
push ebx
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x433993
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x6294f0
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4339c7
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test edi, edi
je 0x4339be
push edi
call fcn.004d2e43
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 8]
movzx esi, word [eax + 8]
movzx edx, word [eax + 0xe]
movzx ecx, word [eax + 0xc]
movzx eax, word [eax + 0xa]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], ecx
test edi, edi
je 0x4339f2
push edi
call fcn.004d2e43
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a3dc
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x43a3ff
or esi, 1
push 1
call edi
test ax, ax
jns 0x43a40b
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x43a417
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x43a423
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret

Function at 0x43ad16
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0xd8]
call fcn.0043edd0
mov edi, dword [ebp + 8]
test eax, eax
jle 0x43ad66
push ebx
mov byte [ebp + 0xb], 0
call fcn.0043f929
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x43adc1
lea ecx, [esi + 0xd8]
inc ebx
call fcn.0043edd0
cmp ebx, eax
jl 0x43ad35
sub edi, 0x100
je 0x43ae1b
sub edi, 4
je 0x43adc5
dec edi
sub edi, 1
jne 0x43ae12
push dword [ebp + 0xc]
and dword [ebp + 8], edi
call fcn.004e1781
pop ecx
mov ecx, dword [esi + 0x50]
lea edx, [ebp + 8]
push 0x8000000a
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x43d9dc
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x43ae12
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x43ae14
cmp dword [esi + 0x54], 0
je 0x43ae12
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov ecx, dword [esi + 0x68]
and dword [ebp - 0x1c], 0
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x64]
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
call fcn.0043a3dc
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x43ae12
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x43ae68
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x43ae68
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x43ae68
mov ecx, dword [esi + 0x54]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.004cfb85
pop ecx
pop ecx
test eax, eax
je 0x43ae68
mov ecx, dword [esi + 0x54]
call fcn.00448748
test al, al
jne 0x43ae12
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.0043cd50
jmp 0x43adc1