joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b5fe
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp byte [esi], 0
mov byte [ebp - 1], 1
mov dword [ebp - 8], edi
jne 0x43b61d
xor al, al
jmp 0x43b74e
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
and byte [ebx], 0
and byte [eax], 0
mov eax, dword [ebp + 0x14]
and byte [eax], 0
mov eax, dword [ebp + 0x10]
and byte [eax], 0
call fcn.00441580
inc eax
push eax
call fcn.00441226
pop ecx
mov dword [ebp + 8], eax
pop ecx
mov al, byte [edi + esi]
cmp al, 0x2b
je 0x43b65f
cmp al, 0x5e
je 0x43b65b
cmp al, 0x21
je 0x43b65b
cmp al, 0x23
jne 0x43b683
cmp al, 0x2b
jne 0x43b667
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x43b680
cmp al, 0x5e
jne 0x43b670
mov eax, dword [ebp + 0x14]
jmp 0x43b662
cmp al, 0x21
jne 0x43b679
mov eax, dword [ebp + 0x18]
jmp 0x43b662
cmp al, 0x23
jne 0x43b680
mov byte [ebx], 1
inc edi
jmp 0x43b648
mov al, byte [edi + esi]
inc edi
cmp al, 0x7b
mov byte [ebp + 0x1c], al
jne 0x43b704
push 1
xor edx, edx
pop ebx
lea ecx, [edi + esi]
mov al, byte [ecx]
test al, al
je 0x43b6b3
cmp ebx, 1
jne 0x43b6b3
cmp al, 0x7d
jne 0x43b6a9
xor ebx, ebx
jmp 0x43b6b0
mov esi, dword [ebp + 8]
mov byte [edx + esi], al
inc edx
inc ecx
jmp 0x43b696
mov edi, dword [ebp + 8]
and byte [edx + edi], 0
test ebx, ebx
jne 0x43b6f0
mov esi, 0x458ee0
push edi
push dword [esi]
call fcn.00442c20
pop ecx
test eax, eax
pop ecx
je 0x43b6df
inc dword [ebp - 8]
add esi, 4
cmp esi, 0x459054
jl 0x43b6c3
mov eax, dword [ebp - 8]
cmp eax, 0x5d
je 0x43b6f0
cmp byte [eax + 0x459054], 0
je 0x43b6f6
and byte [ebp - 1], 0
jmp 0x43b738
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax*4 + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [ecx], eax
jmp 0x43b738
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov ecx, dword [ebp + 0xc]
movsx eax, ax
test ah, 2
mov dword [ecx], eax
je 0x43b720
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
test byte [ecx + 1], 4
je 0x43b72c
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
test byte [ecx + 1], 1
je 0x43b738
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
and dword [eax], 0xff
call fcn.004415fb
mov al, byte [ebp - 1]
pop ecx
pop ebx
pop edi
pop esi
leave
ret 0x18
Function at 0x43b7ca
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x43b7ec
push ebp
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
mov edi, dword [esp + 0x1c]
cmp edi, esi
je 0x43b8d2
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x43b80c
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x43b8d2
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebp
mov ebx, eax
push dword [esp + 0x24]
mov dword [esp + 0x20], ebx
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push ebx
mov dword [esp + 0x1c], eax
call esi
push 1
push edi
push ebx
call esi
push 1
push dword [esp + 0x14]
push edi
call esi
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x43b8bc
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebp
push ebp
push ebp
push 0x12
call edi
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call ebx
push ebp
push 2
push ebp
push 0x12
call edi
push eax
push 0x12
call ebx
push ebp
push ebp
push ebp
push 0x12
call edi
push eax
push 0x12
call ebx
push ebp
push 2
push ebp
push 0x12
call edi
push eax
push 0x12
call ebx
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push ebp
push dword [esp + 0x14]
push ebx
call esi
push ebp
push edi
push ebx
call esi
push ebp
push dword [esp + 0x14]
push edi
call esi
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4

Function at 0x43b9ae
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
xor edi, edi
lea eax, [esi + 0x10]
cmp dword [eax], ebx
je 0x43b9ca
inc edi
add eax, 8
cmp edi, 0x10
jl 0x43b9bd
cmp edi, 0x10
jne 0x43b9d3
xor eax, eax
jmp 0x43ba36
cmp byte [esi + 8], 1
jne 0x43ba0d
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp + 0xc]
push ebx
push 0x438
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 4
push 0x1000
push dword [ebp + 8]
mov dword [esi + edi*8 + 0xc], eax
lea edi, [esi + edi*8 + 0x10]
push ebx
push eax
call dword [esi]
jmp 0x43ba34
push ebx
push dword [ebp + 8]
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
push ebx
push ebx
push 0xf001f
mov dword [esi + edi*8 + 0xc], eax
push eax
lea edi, [esi + edi*8 + 0x10]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x43d4e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x18]
push eax
push 1
push 0
push dword [ebp + 0xc]
and byte [esi], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43d524
lea eax, [ebp + 0x14]
push eax
push esi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret

Function at 0x43d527
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [ebp - 4]
push eax
push 0x1f4
push 2
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x43d586
lea eax, [ebp + 8]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp + 8]
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret

Function at 0x43d877
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
xor esi, esi
cmp edi, ebx
mov byte [0x46e538], bl
je 0x43d8bd
mov byte [0x46e539], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 8]
push ebx
push eax
push 0x43d900
push ebx
push ebx
mov dword [ebp - 4], edi
call fcn.00444281
add esp, 0x18
mov esi, eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, ebx
mov edi, eax
je 0x43d8eb
push 0xffffffffffffffff
push esi
mov byte [0x46e539], bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x46e538], 1
jne 0x43d8f9
or eax, 0xffffffff
jmp 0x43d8fb
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43da4f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x43da70
test al, 0x10
je 0x43da70
cmp byte [0x464ad5], bl
jne 0x43dabe
push ebx
push 0x2000080
push 3
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43da94
xor al, al
jmp 0x43dac0
cmp dword [ebp + 0x10], ebx
jne 0x43da9f
push dword [ebp + 0xc]
push ebx
jmp 0x43daaf
cmp dword [ebp + 0x10], 1
push ebx
jne 0x43daac
push ebx
push dword [ebp + 0xc]
jmp 0x43dab0
push dword [ebp + 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x43dac4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 8]
push esi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x43db4a
push edi
push esi
call fcn.00441226
pop ecx
mov edi, eax
push edi
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x456b28
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x43db3e
mov ecx, dword [ebp - 4]
mov edx, 0xffff
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov esi, ecx
and esi, edx
shr ecx, 0x10
push esi
push ecx
mov ecx, eax
and ecx, edx
shr eax, 0x10
push ecx
push eax
push str._u._u._u._u
push dword [ebp + 0xc]
call fcn.00442173
add esp, 0x18
mov bl, 1
push edi
call fcn.004415fb
pop ecx
mov al, bl
pop edi
jmp 0x43db4c
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x43db50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
mov esi, dword [ebp + 8]
push 0x2a
push esi
call fcn.00443960
pop ecx
test eax, eax
pop ecx
jne 0x43db88
push 0x3f
push esi
call fcn.00443960
pop ecx
test eax, eax
pop ecx
jne 0x43db88
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
jmp 0x43dba8
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x43db9f
xor al, al
jmp 0x43dba8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop esi
leave
ret

Function at 0x43dbab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43dbc1
test al, 0x10
je 0x43dbc1
mov al, 1
ret
xor al, al
ret
Function at 0x43dd82
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
lea eax, [ebp + 8]
and byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 0x108]
push eax
call fcn.0043da36
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43ddde
test al, 0x10
je 0x43ddde
lea eax, [ebp - 0x108]
push str..
push eax
call fcn.00441df0
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x668]
push esi
push eax
lea eax, [ebp - 0x560]
push eax
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0044250d
add esp, 0x14
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov bl, 1
cmp esi, 0xffffffff
je 0x43dea5
cmp bl, 1
jne 0x43dea5
mov eax, dword [ebp - 0x248]
and eax, 0x10
cmp al, 0x10
je 0x43de8b
lea eax, [ebp - 0x458]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00441de0
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00441df0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00441df0
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
jne 0x43dea1
lea eax, [ebp - 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43de28
xor bl, bl
jmp 0x43de28
xor bl, bl
jmp 0x43dea8
mov bl, byte [ebp - 1]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x43deb5
Capabilities:
Check if file exists
Copy file
Delete file
Enumerate files on windows
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x980
push ebx
push esi
lea eax, [ebp + 8]
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
and byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x210]
mov edi, 0x104
push eax
push edi
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.0043da36
pop ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x420]
push eax
push edi
push dword [ebp + 0xc]
call esi
lea eax, [ebp - 0x420]
push eax
call fcn.0043da36
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0043dcb1
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
mov byte [ebp + 0xb], al
lea eax, [ebp - 0x210]
push eax
call esi
cmp eax, 0xffffffff
mov edi, str..
je 0x43df50
test al, 0x10
je 0x43df50
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.00441df0
pop ecx
pop ecx
lea eax, [ebp - 0x420]
push eax
call esi
cmp eax, 0xffffffff
je 0x43df71
test al, 0x10
je 0x43df71
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00441df0
pop ecx
pop ecx
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0044250d
add esp, 0x14
lea eax, [ebp - 0x560]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
mov bl, 1
je 0x43e0f5
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp bl, 1
jne 0x43e0f5
mov eax, dword [ebp - 0x560]
mov byte [ebp - 1], bl
and eax, 0x10
cmp al, 0x10
je 0x43e0d2
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.0043e108
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00441de0
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00441df0
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00441df0
lea eax, [ebp - 0x318]
push eax
call fcn.0043db50
add esp, 0x28
test al, al
je 0x43e079
cmp byte [ebp + 0x10], 0
je 0x43e0f1
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00441f20
pop ecx
test eax, eax
pop ecx
je 0x43e0d2
lea eax, [ebp - 0x318]
push eax
call edi
cmp byte [ebp + 0x14], 1
jne 0x43e0bc
cmp byte [ebp + 0xb], 0
jne 0x43e09b
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x43e0ce
lea eax, [ebp - 0x318]
push 0
push eax
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x43e0f1
lea eax, [ebp - 0x108]
push eax
call edi
jmp 0x43e0ce
lea eax, [ebp - 0x318]
push 0
push eax
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x43e0f1
lea eax, [ebp - 0x560]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43dfca
xor bl, bl
jmp 0x43dfca
xor bl, bl
jmp 0x43e0f8
mov bl, byte [ebp - 1]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x43e2ef
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.00441580
dec eax
pop ecx
add eax, esi
cmp byte [eax], 0x5c
jne 0x43e308
and byte [eax], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43e380
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 2
jne 0x43e330
push 0
push esi
call ebp
test eax, eax
je 0x43e335
jmp 0x43e384
cmp eax, 3
jne 0x43e353
push esi
call fcn.0043f057
mov edi, eax
push 0x5c
push edi
call fcn.004443f0
add esp, 0xc
test eax, eax
jne 0x43e359
push edi
call fcn.004415fb
pop ecx
xor al, al
pop edi
pop esi
pop ebp
ret
and byte [eax], 0
push ebx
push edi
call fcn.0043e2ef
push edi
mov bl, al
call fcn.004415fb
pop ecx
pop ecx
test bl, bl
je 0x43e37b
push 0
push esi
call ebp
test eax, eax
setne bl
mov al, bl
pop ebx
jmp 0x43e355
test al, 0x10
je 0x43e353
mov al, 1
jmp 0x43e355

Function at 0x43e388
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
lea eax, [ebp + 8]
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push eax
lea eax, [ebp - 0x128]
mov edi, 0x104
push eax
push edi
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x128]
push eax
call fcn.0043da36
pop ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x230]
push eax
push edi
push dword [ebp + 0xc]
call esi
lea eax, [ebp - 0x230]
push eax
call fcn.0043da36
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00441f20
add esp, 0xc
test eax, eax
jne 0x43e3ff
cmp byte [ebp + 0x10], al
setne al
jmp 0x43e4bd
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x128]
push eax
call esi
cmp eax, 0xffffffff
je 0x43e417
test al, 0x10
jne 0x43e41e
xor al, al
jmp 0x43e4bd
lea eax, [ebp - 0x230]
push eax
call esi
xor ebx, ebx
cmp eax, 0xffffffff
je 0x43e437
test al, 0x10
je 0x43e437
cmp byte [ebp + 0x10], bl
jmp 0x43e446
lea eax, [ebp - 0x230]
push eax
call fcn.0043e2ef
pop ecx
test al, al
je 0x43e417
lea eax, [ebp - 0x128]
push str..
push eax
call fcn.00441df0
lea eax, [ebp - 0x128]
push eax
call fcn.00441580
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x230]
push eax
call fcn.00441580
mov byte [ebp + eax - 0x22f], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
add esp, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0xa], ebx
push eax
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 2
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e4c2
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
lea eax, [ebp + 8]
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push eax
lea eax, [ebp - 0x128]
mov edi, 0x104
push eax
push edi
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x128]
push eax
call fcn.0043da36
pop ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x230]
push eax
push edi
push dword [ebp + 0xc]
call esi
lea eax, [ebp - 0x230]
push eax
call fcn.0043da36
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ecx
lea eax, [ebp - 0x128]
push eax
call esi
cmp eax, 0xffffffff
je 0x43e57b
test al, 0x10
je 0x43e57b
lea eax, [ebp - 0x230]
push eax
call esi
xor ebx, ebx
cmp eax, 0xffffffff
je 0x43e546
test al, 0x10
je 0x43e546
cmp byte [ebp + 0x10], bl
je 0x43e57b
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0043dcb1
pop ecx
test al, al
pop ecx
je 0x43e596
lea eax, [ebp - 0x230]
push 1
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0043e388
add esp, 0xc
test al, al
jne 0x43e57f
xor al, al
jmp 0x43e5f9
lea eax, [ebp - 0x128]
push 1
push eax
call fcn.0043e5fe
pop ecx
test al, al
pop ecx
setne al
jmp 0x43e5f9
lea eax, [ebp - 0x128]
push eax
call fcn.00441580
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x230]
push eax
call fcn.00441580
mov byte [ebp + eax - 0x22f], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
pop ecx
mov dword [ebp - 0x14], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43e5fe
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
lea eax, [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x128]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 0x128]
push eax
call fcn.0043da36
pop ecx
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43e644
test al, 0x10
jne 0x43e648
xor al, al
jmp 0x43e6a5
xor ebx, ebx
lea eax, [ebp - 0x128]
cmp byte [ebp + 0xc], bl
push eax
jne 0x43e663
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
jmp 0x43e6a5
call fcn.00441580
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
push eax
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb al, al
inc al
pop ebx
leave
ret
Function at 0x43e7a2
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
lea eax, [ebp - 0x294]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x43e82f
lea eax, [ebp - 0x104]
push 0x100
push eax
call sub.WSOCK32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x43e82f
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x43e7f5
mov ecx, eax
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x43e7ec
mov ecx, dword [ebp + 8]
cmp ecx, edx
jle 0x43e803
push 0x456cc4
jmp 0x43e81e
push 4
push dword [eax + ecx*4 - 4]
lea eax, [ebp - 4]
push eax
call fcn.00441240
add esp, 0xc
push dword [ebp - 4]
call sub.WSOCK32.dll_inet_ntoa
push eax
push dword [ebp + 0xc]
call fcn.00441de0
pop ecx
pop ecx
call sub.WSOCK32.dll_WSACleanup
leave
ret
push 0x45cb90
push dword [ebp + 0xc]
call fcn.00441de0
pop ecx
pop ecx
leave
ret

Function at 0x43e9cd
Capabilities:
Enumerate gui resources
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp byte [0x464ad4], bl
je 0x43ea32
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43ea2e
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43ea32
xor eax, eax
jmp 0x43ea76
cmp byte [0x464ad5], bl
je 0x43ea50
test byte [ebp + 8], 4
je 0x43ea50
xor dword [ebp + 8], 4
push ebx
push 0x43ea79
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp + 8]
cmp eax, 0x20
je 0x43ea67
cmp eax, 0x40
je 0x43ea67
push ebx
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x43ea76
xor ecx, ecx
cmp eax, 0x20
sete cl
push ebx
push ecx
call sub.KERNEL32.dll_SetSystemPowerState
pop ebx
leave
ret

Function at 0x43ec09
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x43ec34
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x43ec4f
push 1
jmp 0x43ec36
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret