joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435299
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push 1
mov edi, ecx
pop esi
push 3
mov dword [0x4b4144], esi
pop ebx
push ebx
push ecx
mov ecx, esp
push 0x4b2904
mov dword [0x4b4118], ebx
call fcn.00403927
mov ecx, edi
call fcn.00435223
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
cmp dword [0x4c42d0], ecx
mov dword [0x4b4118], eax
mov dword [esp + 0x14], eax
jne 0x43533d
cmp eax, ebx
mov dword [esp + 0x10], eax
jne 0x435312
push ecx
push ecx
mov dword [0x4b4118], ecx
mov ecx, esp
push 0x4b28fc
call fcn.00403927
mov ecx, edi
call fcn.00435223
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
mov dword [0x4b4118], eax
mov ecx, dword [0x4c7a60]
cmp eax, esi
jne 0x43531e
mov ecx, ebx
cmp dword [esp + 0x10], 0
lea esi, [edi + 4]
jne 0x435330
push 5
push dword [esi]
call ebp
jmp 0x43535f
push ecx
sub esp, 0x10
mov ecx, esp
push 0x4c3d28
jmp 0x435350
push dword [0x4c3d24]
lea esi, [edi + 4]
sub esp, 0x10
mov ecx, esp
push 0x4c3d38
call fcn.004263cc
push dword [esi]
call fcn.00440e44
add esp, 0x18
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x435370
push ebx
push dword [esi]
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 7
mov dword [0x4b4118], eax
jne 0x43538e
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, esi
call fcn.004035ec
xor ecx, ecx
cmp dword [0x4c4254], ecx
je 0x4353ce
push 1
mov dword [0x4c4254], ecx
pop eax
mov ebx, 0x80
push eax
push ecx
push ecx
mov dword [0x4c42bc], eax
mov ecx, esp
push ebx
call fcn.00403927
push dword [edi + 0x1ec]
lea ecx, [edi + 0x1cc]
push ebx
call fcn.00495a6f
push 0
push dword [esi]
call ebp
and dword [0x4b4144], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x435417
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x10]
push esi
push edi
push 1
mov esi, ecx
pop edi
mov dword [eax], edi
mov dword [esi + 0x1c8], edi
call fcn.00436849
push 0
push dword [esi + 0x1f4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00435299
mov ecx, esi
call fcn.0043547e
lea ecx, [esi + 0x49c0]
call fcn.0046e147
lea ecx, [esi + 0x506c]
call fcn.0046e147
lea ecx, [esi + 0x5718]
call fcn.0046e147
lea ecx, [esi + 0x5dc4]
call fcn.0046e147
mov eax, edi
pop edi
pop esi
ret 0x10
Function at 0x43547e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 1
pop eax
mov esi, ecx
push eax
mov dword [0x4c4328], eax
mov dword [0x4b4144], eax
call fcn.0043bd0d
lea eax, [ebp - 0x18]
xor edi, edi
push eax
lea eax, [esi + 0x6470]
neg eax
lea ebx, [esi + 0x6474]
mov dword [0x4b4144], edi
sbb eax, eax
and eax, ebx
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x1f4]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x4354e6
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x1f4]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x40
push 0x14
push 0x14
push edi
push edi
push edi
push dword [ebx]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
call edi
mov eax, dword [ebp - 0xc]
push 0x40
sub eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0
push dword [ebx]
call edi
push 5
push dword [esi + 0x1f4]
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0x4c4320]
mov ecx, dword [0x4b0550]
mov dword [ebp - 4], ecx
push eax
lea eax, [ebp - 4]
push str._0d_msek
push eax
call fcn.00403d66
add esp, 0xc
lea ecx, [ebp - 4]
push 0
call fcn.00403c58
push eax
push 1
pop edi
push edi
push 0x40b
push dword [0x4c42e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xfa0
push 0x30e26
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [ebp - 8]
mov dword [0x4c432c], edi
call fcn.00446c93
lea ecx, [ebp - 8]
call fcn.004289e3
lea ecx, [ebp - 8]
call fcn.00446cb8
lea ecx, [ebp - 4]
call fcn.004038fb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436453
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
cmp dword [0x4c4304], esi
push edi
jne 0x43646a
call fcn.004331ef
cmp dword [0x4c39a4], 6
jb 0x436681
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jl 0x436490
mov dword [ebp + 8], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4364a2
mov ecx, dword [0x4b0550]
push eax
mov dword [ebp + 8], ecx
lea ecx, [ebp + 8]
call fcn.0040a70f
push esi
push 0x4b4fe0
lea ecx, [ebp + 8]
call fcn.00403d34
test eax, eax
jne 0x4365f7
mov eax, dword [0x4b0550]
push 0x3e
push 1
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
call fcn.0048eeb4
push 0x3e
push 2
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0048eeb4
add esp, 0x20
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
call fcn.00403a8c
mov eax, dword [ebp - 4]
cmp dword [eax - 8], esi
lea eax, [ebp - 4]
jne 0x436506
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00403a8c
push esi
push str._select
lea ecx, [ebp + 8]
call fcn.00403d34
cmp eax, esi
jl 0x4365cc
mov ecx, dword [ebp + 8]
add eax, 8
mov ecx, dword [ecx - 8]
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 8]
lea ecx, [ebp + 8]
push eax
call fcn.0040acb2
lea ecx, [ebp - 8]
call fcn.0040ae23
lea ecx, [ebp - 8]
call fcn.0040add3
push 0x4bd5d8
push 0x4b28ec
lea ecx, [ebp - 8]
call fcn.004040f7
push esi
lea ecx, [ebp - 0x28]
push dword [ebp - 8]
call fcn.00489f86
lea eax, [ebp - 0x20]
push 0x8000
push eax
lea ecx, [ebp - 0x28]
call fcn.0048a019
mov esi, 0x4c41e0
push eax
mov ecx, esi
call fcn.00403a8c
lea ecx, [ebp - 0x20]
call fcn.004038fb
push esi
mov ecx, 0x4c41e4
call fcn.00403a8c
lea ecx, [ebp - 0x28]
call fcn.0048996a
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 0x10]
jmp 0x436674
push edi
mov ecx, 0x4c41e4
call fcn.00403a8c
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
push str.::26EE0668_A00A_44D7_9371_BEB064C98683
lea ecx, [ebp - 0x18]
call fcn.00403927
push edi
lea ecx, [ebp - 0xc]
call fcn.004038b5
lea ecx, [ebp - 0xc]
call fcn.00403cfb
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_CharUpperW]
push esi
lea ecx, [ebp - 0xc]
push dword [ebp - 0x18]
call fcn.00403d34
test eax, eax
jl 0x436669
push 1
push esi
push esi
push dword [edi]
push str.explore
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x4bd614
mov ecx, edi
call fcn.00403adc
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
push 1
pop eax
jmp 0x436683
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4367bd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea edx, [ebp - 4]
xor eax, eax
push edx
push eax
push ecx
push 0x4367db
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret
Function at 0x43749e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4b0550]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x210]
push 0x104
push eax
push dword [0x4c7a90]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
lea ecx, [ebp - 4]
push eax
call fcn.0040a4e8
cmp dword [0x4c4348], 2
jne 0x4374f7
and dword [0x4c4348], 0
push 5
push 0
push dword [ebp - 4]
push str.explorer.exe
jmp 0x437501
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
mov esi, eax
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
mov eax, esi
pop esi
leave
ret 4

Function at 0x437644
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov esi, 0x4bd614
push esi
lea ecx, [ebp - 4]
call fcn.00403927
push esi
lea ecx, [ebp - 8]
call fcn.00403927
call fcn.00482e4b
test eax, eax
jne 0x4376e8
lea eax, [ebp - 0xc]
push 0x46
push eax
call fcn.00461770
lea eax, [ebp - 0x14]
push 0xbf
push eax
call fcn.00461770
mov eax, dword [eax]
add esp, 0x10
push 0x43
push eax
push dword [ebp - 0xc]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.004038fb
cmp esi, 2
jne 0x4376c9
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
xor eax, eax
jmp 0x437785
cmp esi, 6
jne 0x4376e0
call fcn.0043318d
cmp eax, 1
jne 0x4376e0
push 0
call fcn.00482e54
pop ecx
lea ecx, [ebp - 0xc]
call fcn.004038fb
cmp word [ebp + 0xc], 0x8034
jne 0x437732
lea eax, [ebp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x437732
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0048994a
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.00489fbf
push eax
lea ecx, [ebp - 8]
call fcn.00403a8c
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.0048996a
mov eax, dword [ebp - 4]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], 0
jl 0x43774f
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x43775e
mov eax, dword [0x4b0550]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.0040a70f
push ecx
lea eax, [ebp - 8]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, edi
call fcn.0043778b
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
mov eax, esi
pop edi
pop esi
leave
ret 0x10
Function at 0x438133
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, ecx
push 8
push dword [esi + 4]
call edi
test eax, eax
jne 0x43816d
push 5
push dword [esi + 4]
call edi
lea ecx, [esi + 0x1cc]
call fcn.004957af
and dword [0x4c42bc], 0
push dword [esi + 4]
call fcn.0048ef49
pop ecx
jmp 0x4381a4
push 1
mov ebx, 0x80
pop eax
lea edi, [esi + 0x1cc]
push eax
push 0
push ecx
mov dword [0x4c42bc], eax
mov ecx, esp
push ebx
call fcn.00403927
push dword [esi + 0x1ec]
mov ecx, edi
push ebx
call fcn.00495a6f
push dword [esi + 4]
mov ecx, edi
call fcn.004959d3
pop edi
pop esi
pop ebx
ret
Function at 0x43a317
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b4148]
cmp eax, 0xffffffff
jne 0x43a3c0
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
push 2
push esi
push esi
mov ebx, str.Q_Dir_Admin_Test
push esi
mov edi, SHChangeNotifyRegister
push ebx
push edi
mov dword [0x4b4148], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x43a3a7
xor eax, eax
cmp dword [ebp - 4], esi
je 0x43a370
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
cmp eax, esi
mov dword [ebp - 4], ecx
jne 0x43a3a7
push 0xf003f
push esi
push edi
lea ecx, [ebp - 4]
mov dword [0x4b4148], 1
call fcn.00405cf0
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x43a3a7
mov dword [0x4b4148], esi
cmp dword [ebp - 4], esi
mov edi, dword [0x4b4148]
je 0x43a3bb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43ad6a
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, esi
neg eax
sbb eax, eax
and eax, 4
push eax
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
push 0xe801
lea ecx, [edi + 0x3c]
call fcn.00426225
push 1
mov ecx, edi
call fcn.0043bd0d
push esi
push ecx
mov ecx, esp
push str.StatusBar
call fcn.0040a4e8
mov ecx, edi
call fcn.004351d3
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x43af55
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
and dword [esi], 0
mov eax, dword [0x4b0550]
cmp word [ebp + 0xc], 0x8045
mov dword [ebp + 0x14], eax
jne 0x43af77
push str.Connect
jmp 0x43af84
cmp word [ebp + 0xc], 0x8046
jne 0x43af8c
push str.Disconnect
lea ecx, [ebp + 0x14]
call fcn.00403adc
mov eax, dword [ebp + 0x14]
cmp dword [eax - 8], 0
jne 0x43af99
xor edi, edi
jmp 0x43afd1
push 1
lea eax, [ebp + 0x14]
pop edi
push eax
lea eax, [ebp + 0xc]
push str.shell32.dll_SHHelpShortcuts_RunDLL
push eax
mov dword [esi], edi
call fcn.0040a961
mov eax, dword [eax]
push 5
push 0
push eax
push str.rundll32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 0xc]
call fcn.004038fb
lea ecx, [ebp + 0x14]
call fcn.004038fb
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x43b60c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x4c430c], 0
push edi
mov edi, ecx
je 0x43b690
push ebx
push esi
lea eax, [ebp - 8]
push 0xea60
push eax
call fcn.00461770
mov esi, dword [eax]
lea eax, [ebp - 4]
push 0xb7
push eax
call fcn.00461770
mov eax, dword [eax]
add esp, 0x10
push 0x31
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
lea ecx, [ebp - 4]
sete bl
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
pop esi
test bl, bl
pop ebx
je 0x43b68b
mov ecx, edi
call fcn.004348f3
lea ecx, [edi + 0x1cc]
call fcn.004957af
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 1
pop eax
jmp 0x43b692
xor eax, eax
pop edi
leave
ret

Function at 0x43be61
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
test byte [0x4c37b4], 1
push ebx
push esi
push edi
mov esi, ecx
jne 0x43be91
mov eax, dword [0x4b0550]
or byte [0x4c37b4], 1
push 0x43bfc4
mov dword [0x4c37b0], eax
call fcn.0049d371
pop ecx
mov eax, dword [ebp + 8]
mov edi, 0x4c37b0
cmp dword [eax - 8], 0
jne 0x43bea8
push edi
lea ecx, [ebp + 8]
call fcn.00403a8c
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00403a8c
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x8496
push 0x419
push dword [esi + 0x4988]
call ebx
cmp eax, 0xffffffff
jne 0x43bed9
xor esi, esi
jmp 0x43bf6f
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0xff
lea ecx, [ebp + 8]
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x1c], 0x4a
call fcn.00403c58
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [0x4b4130], eax
mov word [ebp - 0xe], 0x5a
mov byte [ebp - 0xf], 0x80
jne 0x43bf3a
mov edi, 0x4bd5d8
mov ecx, edi
test ecx, ecx
je 0x43bf27
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
lea ecx, [ebp + 8]
call fcn.004039ec
and word [ebp - 0xe], 0
mov byte [ebp - 0xf], 0x90
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x4a
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x8496
push 0x440
push dword [esi + 0x4988]
call ebx
cmp dword [ebp + 0x10], 0
je 0x43bf7b
push 1
mov ecx, esi
call fcn.0043bcd6
push 1
pop esi
lea ecx, [ebp + 8]
call fcn.004038fb
mov eax, esi
jmp 0x43bfbd
mov eax, dword [0x4b414c]
cmp eax, dword [0x4b4130]
je 0x43bfb2
lea eax, [esi + 0x88c]
lea ecx, [esi + 0x890]
neg eax
sbb eax, eax
and eax, ecx
cmp dword [eax], 0
je 0x43bfb2
push 1
mov ecx, esi
call fcn.0043bcd6
mov eax, dword [0x4b4130]
mov dword [0x4b414c], eax
lea ecx, [ebp + 8]
call fcn.004038fb
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43ee3a
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov dword [ebx], 1
mov esi, ecx
test byte [0x4c3798], 1
jne 0x43ee76
mov eax, dword [0x4b0550]
or byte [0x4c3798], 1
push 0x43efec
mov dword [0x4c3794], eax
call fcn.0049d371
pop ecx
lea ecx, [ebp - 0xe8]
call fcn.0043efcd
lea eax, [ebp - 0xe8]
lea edi, [esi + 0x65cc]
push eax
mov ecx, edi
movzx eax, word [ebp + 0xc]
push eax
call fcn.0048832d
test eax, eax
je 0x43efc3
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00488372
mov edi, 0x4c3794
push eax
mov ecx, edi
call fcn.00403a8c
lea ecx, [ebp + 0xc]
call fcn.004038fb
mov eax, dword [0x4c3794]
cmp dword [eax - 8], 0
je 0x43efc3
push 0x11
mov dword [ebx], 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0x8000
test ebx, eax
je 0x43ef15
push edi
lea ecx, [esi + 0x838]
call fcn.00403a8c
push 0
push 0x12c
push 0x2711
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x43efc3
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ebx, eax
je 0x43ef74
push ecx
mov ecx, esp
push edi
call fcn.004038b5
lea eax, [ebp + 0x14]
push eax
call fcn.004604b6
pop ecx
mov ecx, esp
push edi
call fcn.004038b5
lea eax, [ebp + 0xc]
push eax
call fcn.00460514
pop ecx
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.004038b5
push ecx
lea eax, [ebp + 0x14]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, esi
call fcn.0043778b
lea ecx, [ebp + 0xc]
call fcn.004038fb
lea ecx, [ebp + 0x14]
call fcn.004038fb
push 0x2e
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ebx, eax
je 0x43ef95
push ecx
mov ecx, esp
push edi
call fcn.004038b5
push dword [esi + 4]
call fcn.0043eff6
pop ecx
pop ecx
jmp 0x43efc3
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x1f4]
call ebx
push 1
push 1
push ecx
mov ecx, esp
push edi
call fcn.004038b5
mov ecx, esi
call fcn.004411dc
push 5
push dword [esi + 0x1f4]
call ebx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x43eff6
Capabilities:
Delete file
Log keystrokes via polling
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, dword [eax - 8]
lea ecx, [ebp + 0xc]
lea eax, [esi + 1]
push eax
call fcn.00403c58
push 0
push 0xa
lea ecx, [ebp + 0xc]
mov ebx, eax
call fcn.0043f075
and word [ebx + esi*2], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
push 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setge cl
dec ecx
lea eax, [ebp - 0x20]
and ecx, 0xffffffc0
push eax
add ecx, 0x40
mov word [ebp - 0x10], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea ecx, [ebp + 0xc]
call fcn.004038fb
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44317e
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 1
pop ebx
mov dword [0x4b412c], ebx
call edi
mov si, ax
and esi, 0x3ff
call edi
push 7
pop edi
shr ax, 0xa
cmp si, di
jne 0x4431b5
and dword [0x4b412c], 0
jmp 0x443397
push 9
pop ecx
cmp si, cx
jne 0x4431c8
mov dword [0x4b412c], ebx
jmp 0x443397
cmp si, 0xc
jne 0x4431dd
mov dword [0x4b412c], 2
jmp 0x443397
cmp si, 0x10
jne 0x4431f2
mov dword [0x4b412c], 3
jmp 0x443397
push 0xa
pop edx
cmp si, dx
jne 0x44321d
cmp ax, 0xb
mov dword [0x4b412c], 4
jne 0x443397
mov dword [0x4b412c], 0xe
jmp 0x443397
cmp si, 4
jne 0x443241
cmp ax, bx
mov dword [0x4b412c], ecx
jne 0x443397
mov dword [0x4b412c], 5
jmp 0x443397
cmp si, 0x11
jne 0x443256
mov dword [0x4b412c], 6
jmp 0x443397
push 0x12
pop eax
cmp si, ax
jne 0x443269
mov dword [0x4b412c], edi
jmp 0x443397
cmp si, 0x15
jne 0x44327e
mov dword [0x4b412c], 8
jmp 0x443397
cmp si, 0x19
jne 0x44328f
mov dword [0x4b412c], edx
jmp 0x443397
push 0x13
pop ecx
cmp si, cx
jne 0x4432a6
mov dword [0x4b412c], 0xb
jmp 0x443397
cmp si, 0x1f
jne 0x4432bb
mov dword [0x4b412c], 0xc
jmp 0x443397
cmp si, 8
jne 0x4432d0
mov dword [0x4b412c], 0xd
jmp 0x443397
push 0x1b
pop edi
cmp si, di
jne 0x4432e7
mov dword [0x4b412c], 0xf
jmp 0x443397
cmp si, 5
jne 0x4432fc
mov dword [0x4b412c], 0x10
jmp 0x443397
cmp si, 6
jne 0x443311
mov dword [0x4b412c], 0x11
jmp 0x443397
push 0x16
pop edx
cmp si, dx
jne 0x443320
mov dword [0x4b412c], eax
jmp 0x443397
push 0x18
pop eax
cmp si, ax
jne 0x443330
mov dword [0x4b412c], ecx
jmp 0x443397
push 0x1a
pop ecx
cmp si, cx
jne 0x443344
mov dword [0x4b412c], 0x17
jmp 0x443397
cmp si, 0x24
je 0x443319
cmp si, 0xb
jne 0x44335c
mov dword [0x4b412c], 0x15
jmp 0x443397
cmp si, bx
jne 0x44336d
mov dword [0x4b412c], 0x19
jmp 0x443397
cmp si, 0xe
je 0x443284
cmp si, 0x22
je 0x443328
cmp si, 0x25
je 0x44325e
cmp si, 0x14
jne 0x443397
mov dword [0x4b412c], 0x1d
pop edi
pop esi
pop ebx
ret
Function at 0x44449f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
push 0x4bd614
lea ecx, [ebp - 4]
call fcn.00403927
push str.VerionChk
lea ecx, [ebp - 0xc]
call fcn.00403927
push str.Download
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 0xc]
push 0x4c67d0
push eax
lea eax, [ebp - 8]
push 0x4c67d8
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045eb8c
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00403b20
push 5
push 0
push 0
push dword [eax]
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
xor eax, eax
pop esi
leave
ret

Function at 0x44601d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push edi
lea eax, [ebp - 0x248]
push 0x104
push eax
push dword [0x4c7a90]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
lea ecx, [ebp - 4]
push eax
mov dword [ebp - 0x40], 0x3c
call fcn.0040a4e8
and dword [ebp - 0x3c], 0
push 0
lea ecx, [ebp - 4]
call fcn.00403c58
and dword [ebp - 0x18], 0
and dword [ebp - 0x38], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
mov dword [ebp - 0x24], 1
and eax, 0x4b1138
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop edi
je 0x4460ae
push 0xfefe
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp + 0xc]
call fcn.004038fb
leave
ret