joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b9b8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.0042bf7f
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 0xc]
call fcn.0042bf7f
lea eax, [ebp - 0x128]
push eax
call fcn.0042c03d
add esp, 0x14
test al, al
jne 0x42b9f4
leave
ret
lea eax, [ebp - 0x230]
push ebx
push eax
call fcn.0042c03d
xor ebx, ebx
test al, al
pop ecx
je 0x42ba14
cmp byte [ebp + 0x10], bl
jne 0x42ba25
xor al, al
jmp 0x42ba9a
lea eax, [ebp - 0x230]
push eax
call fcn.0042bcbd
pop ecx
test al, al
jmp 0x42ba0b
lea eax, [ebp - 0x128]
push str..
push eax
call fcn.004538e0
lea eax, [ebp - 0x128]
push eax
call fcn.00453b00
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x230]
push eax
call fcn.00453b00
mov byte [ebp + eax - 0x22f], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x14], eax
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 2
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb al, al
inc al
pop ebx
leave
ret
Function at 0x42ba9d
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a4
push esi
lea eax, [ebp - 0x33c]
push eax
push dword [ebp + 8]
call fcn.0042bf7f
lea eax, [ebp - 0x584]
push eax
push dword [ebp + 0xc]
call fcn.0042bf7f
lea eax, [ebp - 0x33c]
push eax
call fcn.0042c03d
add esp, 0x14
test al, al
mov esi, str..
je 0x42baec
lea eax, [ebp - 0x33c]
push esi
push eax
call fcn.004538e0
pop ecx
pop ecx
lea eax, [ebp - 0x584]
push eax
call fcn.0042c03d
test al, al
pop ecx
je 0x42bb0c
lea eax, [ebp - 0x584]
push esi
push eax
call fcn.004538e0
pop ecx
pop ecx
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x42bb2f
xor eax, eax
jmp 0x42bcba
push ebx
push edi
lea eax, [ebp - 0x9a4]
push eax
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x794]
push eax
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x33c]
push eax
call fcn.00441047
lea eax, [ebp - 0x794]
push eax
lea eax, [ebp - 0x68c]
push eax
push str._s_s
lea eax, [ebp - 0x12c]
push 0x105
push eax
call fcn.0040a9c1
lea eax, [ebp - 0x12c]
push eax
call fcn.00453b00
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, 0x104
add esp, 0x2c
sub esi, eax
and dword [ebp - 4], 0
lea ebx, [ebp + eax - 0x12c]
call edi
sub eax, dword [0x4642ac]
cmp eax, dword [0x463340]
jbe 0x42bbda
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42bbd3
push 1
push 0xffffffffffffffff
call fcn.0040bd90
pop ecx
pop ecx
call edi
mov dword [0x4642ac], eax
test byte [ebp - 0x47c], 0x10
jne 0x42bc94
lea eax, [ebp - 0x450]
push eax
call fcn.00453b00
cmp eax, esi
pop ecx
ja 0x42bc91
lea eax, [ebp - 0x450]
push eax
push ebx
call fcn.004538d0
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.0042bd99
add esp, 0x14
cmp byte [ebp + 0x14], 0
je 0x42bc70
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
test eax, eax
jne 0x42bc94
cmp byte [ebp + 0x10], al
je 0x42bc91
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x42bc91
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
jmp 0x42bc8d
xor eax, eax
cmp byte [ebp + 0x10], al
sete al
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jne 0x42bc94
inc dword [ebp - 4]
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42bba4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42bcbd
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42bd2d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
dec eax
dec eax
je 0x42bd1d
dec eax
jne 0x42bd35
push edi
call fcn.00453b00
cmp eax, 0x104
pop ecx
ja 0x42bd35
add eax, 4
and eax, 0xfffffffc
call fcn.004540a0
mov esi, esp
push edi
push esi
call fcn.004538d0
push 0x5c
push esi
call fcn.00454340
add esp, 0x10
test eax, eax
je 0x42bd35
push esi
mov byte [eax], 0
call fcn.0042bcbd
test al, al
pop ecx
je 0x42bd35
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
setne al
jmp 0x42bd37
test al, 0x10
je 0x42bd35
mov al, 1
jmp 0x42bd37
xor al, al
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret

Function at 0x42bd3e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
mov esi, dword [ebp + 8]
push 0x2a
push esi
call fcn.00453c30
test eax, eax
pop ecx
pop ecx
jne 0x42bd76
push 0x3f
push esi
call fcn.00453c30
test eax, eax
pop ecx
pop ecx
jne 0x42bd76
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
jmp 0x42bd96
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x42bd8d
xor al, al
jmp 0x42bd96
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, 1
pop esi
leave
ret

Function at 0x42c03d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42c054
test al, 0x10
je 0x42c054
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x42c191
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.0042bf7f
lea eax, [ebp - 0x128]
push eax
call fcn.0042c03d
add esp, 0xc
test al, al
jne 0x42c1be
leave
ret
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
lea eax, [ebp - 0x128]
push eax
jne 0x42c1da
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
setne al
jmp 0x42c21b
call fcn.00453b00
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop ebx
leave
ret
Function at 0x42c21e
Capabilities:
Enumerate gui resources
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp byte [0x464498], bl
je 0x42c283
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42c27f
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x42c283
xor al, al
jmp 0x42c2b0
cmp byte [0x464499], bl
je 0x42c2a1
test byte [ebp + 8], 4
je 0x42c2a1
xor dword [ebp + 8], 4
push ebx
push 0x42c2b3
call dword [sym.imp.USER32.dll_EnumWindows]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
pop ebx
leave
ret

Function at 0x42c2eb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x1f4
push 2
xor esi, esi
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x42c344
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, esi
je 0x42c32e
push eax
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
jmp 0x42c330
xor edi, edi
cmp edi, esi
je 0x42c343
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x42ea03
Capabilities:
Hide graphical window

Disassembly:
cmp dword [ecx + 0x1c], 0
jne 0x42ea0e
jmp fcn.0042e9f0
push 0
push 0x2af80006
push 0x414
push dword [ecx]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
ret
Function at 0x42f39a
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 4]
sub eax, 9
push edi
push 0
mov dword [ebp - 0x10], CreateStatusWindowA
pop ebx
je 0x42f42d
dec eax
je 0x42f402
dec eax
je 0x42f3dc
sub eax, 6
jne 0x42f45a
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x419
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x42f451
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 9
push 0x110a
push dword [esi]
call edi
cmp eax, ebx
je 0x42f451
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0x1104
jmp 0x42f44d
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [esi]
call edi
cmp eax, 0xffffffff
je 0x42f451
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 0x10], 2
push 0x100e
jmp 0x42f44d
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x19f
push dword [esi]
call edi
cmp eax, 0xffffffff
je 0x42f451
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x198
push dword [esi]
call edi
cmp dword [ebp - 0x10], 0x80000000
jne 0x42f468
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x42f477
push 2
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
pop edi
lea eax, [eax + esi + 2]
pop esi
mov dword [ecx + 4], eax
pop ebx
leave
ret 8
Function at 0x4319cc
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x63
jb 0x4319d8
xor eax, eax
ret
push ebx
push ebp
lea ebx, [eax*4 + 0x463a80]
push esi
mov esi, dword [ebx]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0x10], ebx
je 0x431b43
cmp dword [esi], ebp
push edi
je 0x431a9d
xor edi, edi
mov eax, dword [edi*4 + 0x463a80]
test eax, eax
je 0x431a1f
mov eax, dword [eax + 0x40]
cmp eax, dword [esi]
jne 0x431a16
push edi
call fcn.004319cc
pop ecx
inc ebp
cmp dword [0x467428], ebp
je 0x431a25
inc edi
cmp edi, 0x63
jb 0x4319fd
mov eax, dword [esi + 4]
test eax, eax
je 0x431a67
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x406
push eax
call edi
mov ebx, eax
xor ebp, ebp
test ebx, ebx
jle 0x431a63
push 0
push ebp
push 0x414
push dword [esi + 4]
call edi
test eax, eax
je 0x431a5e
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
inc ebp
cmp ebp, ebx
jl 0x431a46
mov ebx, dword [esp + 0x14]
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x431a9d
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_SetMenu]
lea eax, [esi + 0xb7]
cmp byte [eax], 0
jne 0x431a9d
push dword [esi]
mov byte [eax], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x60]
test eax, eax
je 0x431aab
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x431ab9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x431ac7
push eax
call dword [sym.imp.SHELL32.dll_DragFinish]
xor ebp, ebp
xor edi, edi
cmp dword [esi + 0xc], ebp
jbe 0x431b12
mov eax, dword [esi + 0x14]
add eax, ebp
mov dl, byte [eax + 4]
cmp dl, 2
jne 0x431afb
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x431afb
test byte [eax + 5], 0x80
push ecx
je 0x431af3
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x431b09
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x431b09
cmp dl, 0xa
jne 0x431b09
push dword [eax + 0x10]
call fcn.0043dfa7
pop ecx
inc edi
add ebp, 0x14
cmp edi, dword [esi + 0xc]
jb 0x431ad0
push dword [esi + 0x14]
mov edi, dword [esi + 0x70]
call fcn.0043dfa7
push dword [ebx]
call fcn.0043dae3
and dword [ebx], 0
dec dword [0x467428]
test edi, edi
pop ecx
pop ecx
je 0x431b42
cmp edi, dword [0x4642bc]
je 0x431b42
push edi
call fcn.00431b4a
pop ecx
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret
Function at 0x435ca4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
xor ecx, ecx
cmp dword [esi], ecx
je 0x435df4
push ebx
xor ebx, ebx
cmp dword [esi + 0xc], ecx
push edi
jbe 0x435cf2
xor edi, edi
mov eax, dword [esi + 0x14]
add eax, edi
cmp dword [eax + 8], ecx
je 0x435ce7
cmp byte [eax + 4], 6
je 0x435ce7
mov eax, dword [esi + 0x14]
add eax, edi
push str.Submit
push eax
push dword [eax + 8]
mov ecx, esi
call fcn.0042ecae
inc ebx
add edi, 0x14
xor ecx, ecx
cmp ebx, dword [esi + 0xc]
jb 0x435cc2
xor edi, edi
xor ebx, ebx
cmp edi, dword [esi + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ecx
je 0x435d22
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 0xc]
push 0xfffffffffffffff0
push dword [eax + ecx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x20000
je 0x435d67
cmp dword [ebp - 8], 1
jne 0x435d56
cmp dword [ebp - 4], 1
jle 0x435d56
cmp ebx, 0xffffffff
jne 0x435d35
xor ebx, ebx
push 0xa
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.004017e2
mov ecx, dword [ebp - 0x10]
add esp, 0xc
push 1
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
call fcn.00401525
cmp edi, dword [esi + 0xc]
je 0x435de2
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 0xc]
add eax, ecx
cmp byte [eax + 4], 6
jne 0x435dce
mov edi, dword [eax + 8]
inc dword [ebp - 4]
test edi, edi
je 0x435d85
inc dword [ebp - 8]
mov dword [ebp - 0x10], edi
push 0
push 0
push 0xf0
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x435db8
test ebx, ebx
je 0x435da4
or ebx, 0xffffffff
jmp 0x435da7
mov ebx, dword [ebp - 4]
test edi, edi
je 0x435dce
push 1
push 0
push 0xffffffffffffffff
push 0x457f24
jmp 0x435dc7
test edi, edi
je 0x435dce
push 1
push 0
push 0xffffffffffffffff
push 0x45671c
mov ecx, edi
call fcn.00401525
mov edi, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x14
inc edi
cmp edi, dword [esi + 0xc]
mov dword [ebp - 0x14], edi
jbe 0x435d08
cmp byte [ebp + 8], 0
pop edi
pop ebx
je 0x435df4
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
pop esi
leave
ret 4

Function at 0x435e7a
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov byte [ebp - 1], bl
jmp 0x435ea7
cmp al, 0x21
je 0x435ea2
cmp al, 0x2b
je 0x435e9c
cmp al, 0x5e
jne 0x435ead
or byte [ebp - 1], 2
jmp 0x435ea6
or byte [ebp - 1], 1
jmp 0x435ea6
or byte [ebp - 1], 4
inc esi
mov al, byte [esi]
cmp al, bl
jne 0x435e8a
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push ebx
push ebx
push esi
call fcn.00413b50
add esp, 0x14
cmp al, bl
mov byte [ebp + 8], al
jne 0x435ece
xor ax, ax
jmp 0x435ef6
push esi
call fcn.004138f8
cmp ax, bx
pop ecx
jne 0x435ee5
push ebx
push dword [ebp + 8]
call fcn.00412065
pop ecx
pop ecx
test ah, 1
je 0x435eee
or byte [ebp - 1], 8
xor eax, eax
mov ah, byte [ebp - 1]
mov al, byte [ebp + 8]
pop esi
pop ebx
leave
ret
Function at 0x43897c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x14]
push eax
push 1
push 0
push dword [ebp + 0xc]
mov byte [esi], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4389a3
xor eax, eax
jmp 0x4389d0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret

Function at 0x4393ae
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x439437
cmp byte [esi], 0
je 0x439437
push 4
push 0x45c638
push esi
call fcn.00454370
add esp, 0xc
test eax, eax
mov eax, esi
jne 0x4393dd
lea eax, [esi + 4]
push 0x45b17c
push eax
call fcn.00438ef0
test eax, eax
pop ecx
pop ecx
je 0x43941b
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
je 0x439437
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x439417
mov ecx, dword [ebp - 0x140]
mov dword [eax], ecx
mov al, 1
jmp 0x439439
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43942b
mov dword [ecx], eax
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x439439
xor al, al
pop esi
leave
ret
Function at 0x43b752
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
jne 0x43b76a
xor eax, eax
jmp 0x43b8cd
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebx
push edi
call esi
cmp eax, dword [0x463d9c]
mov dword [ebp - 0xc], eax
je 0x43b78f
push edi
call fcn.0043b4d6
test al, al
pop ecx
jne 0x43b8ca
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x43b7ab
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jne 0x43b7b7
mov eax, edi
jmp 0x43b8cc
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x43b7cb
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x46349d], bl
jne 0x43b7e6
push dword [ebp - 8]
push edi
call fcn.0043a581
cmp eax, ebx
pop ecx
pop ecx
jne 0x43b8cc
cmp dword [ebp - 8], ebx
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov byte [ebp - 1], bl
mov byte [ebp - 2], bl
je 0x43b846
push ebx
push dword [ebp - 8]
call esi
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x18], esi
je 0x43b849
cmp dword [0x463d9c], esi
je 0x43b82c
push dword [ebp - 8]
call fcn.0043b4d6
test al, al
pop ecx
jne 0x43b82c
push 1
push esi
push dword [0x463d9c]
call edi
test eax, eax
setne byte [ebp - 1]
cmp dword [ebp - 0xc], ebx
je 0x43b849
cmp esi, dword [ebp - 0xc]
je 0x43b849
push 1
push dword [ebp - 0xc]
push esi
call edi
test eax, eax
setne byte [ebp - 2]
jmp 0x43b849
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0043a581
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
jne 0x43b89c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jl 0x43b84c
mov esi, 0xffc3d44d
push esi
push ebx
push ebx
push ebx
push 0x12
push 2
call fcn.00410f1f
push esi
push ebx
push ebx
push ebx
push 0x12
push 2
call fcn.00410f1f
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0043a581
mov esi, dword [ebp - 0x18]
add esp, 0x38
mov dword [ebp - 0x14], eax
cmp byte [ebp - 1], bl
je 0x43b8ab
push ebx
push esi
push dword [0x463d9c]
call edi
cmp byte [ebp - 2], bl
je 0x43b8b7
push ebx
push dword [ebp - 0xc]
push esi
call edi
cmp dword [ebp - 0x14], ebx
je 0x43b8ca
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 0x14]
jmp 0x43b8cc
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x43b8d1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x801c
call fcn.004540a0
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
je 0x43b8fc
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401525
mov eax, 0x457f24
jmp 0x43b901
mov eax, 0x457b9c
mov ecx, dword [0x463c78]
xor esi, esi
inc esi
push esi
push ebx
push 0xffffffffffffffff
push eax
call fcn.00401525
cmp dword [ebp + 0x18], ebx
jne 0x43b920
mov dword [ebp + 0x18], 0x1f4
cmp dword [ebp + 0x1c], esi
jge 0x43b92c
mov dword [ebp + 0x1c], 0x32
cmp dword [ebp + 0x10], esi
jge 0x43b934
mov dword [ebp + 0x10], esi
cmp dword [ebp + 0xc], ebx
je 0x43bab6
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [ebp - 0x18]
push eax
mov edi, 0x7d0
push edi
push 2
push ebx
push ebx
push 0x406
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x43bab6
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x18]
jg 0x43bab6
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push 0x8000
push eax
call fcn.00437999
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x43bab6
mov al, byte [0x464499]
mov byte [ebp - 1], al
cmp al, bl
mov eax, dword [ebp - 0xc]
jne 0x43b9a3
lea eax, [ebp - 0x801c]
dec dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov byte [eax], bl
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
push edi
push 2
push ebx
push dword [ebp + 0x10]
push 0x403
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x43ba24
cmp word [ebp - 0x10], 0x7fff
ja 0x43ba89
lea eax, [ebp - 0x10]
push eax
push edi
push 2
push dword [ebp - 0xc]
push dword [ebp + 0x10]
push 0x402
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x43ba24
cmp byte [ebp - 1], bl
jne 0x43ba13
movzx eax, word [ebp - 0x10]
push ebx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
test eax, eax
je 0x43ba61
push dword [ebp + 0x14]
push dword [ebp - 8]
call fcn.0043b143
test al, al
pop ecx
pop ecx
jne 0x43ba68
cmp dword [ebp + 8], ebx
jne 0x43ba8e
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43baa2
cmp dword [ebp + 0x18], ebx
jl 0x43ba50
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x18]
add ecx, edx
sub ecx, eax
cmp ecx, 5
jle 0x43ba74
push 1
push dword [ebp + 0x1c]
call fcn.0040bd90
pop ecx
pop ecx
jmp 0x43b9b4
mov eax, dword [ebp - 8]
mov byte [eax], bl
jmp 0x43ba89
push 1
push ebx
push 0xffffffffffffffff
push 0x45671c
jmp 0x43ba7e
push 1
push ebx
push 0xffffffffffffffff
push 0x457f24
mov ecx, dword [0x463c78]
call fcn.00401525
cmp dword [ebp + 8], ebx
je 0x43baa2
mov ecx, dword [ebp + 8]
push 1
push ebx
push 0xffffffffffffffff
push dword [ebp - 8]
call fcn.00401525
mov esi, eax
jmp 0x43baa5
xor esi, esi
inc esi
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call fcn.00437eab
pop ecx
pop ecx
mov eax, esi
jmp 0x43bab9
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43bd60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [ebp + 0x10], bl
je 0x43bd76
push dword [ebp + 8]
call fcn.0042c2eb
pop ecx
jmp 0x43bd83
push ebx
push ebx
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [ebp + 0xc], ebx
jge 0x43bd8d
mov dword [ebp + 0xc], ebx
cmp ebx, ebx
je 0x43bde6
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push esi
push edi
call ebx
push 1
mov edi, 0x8000012f
push edi
mov dword [ebp + 0x10], eax
call fcn.0040bd90
mov esi, dword [sym.imp.USER32.dll_IsWindow]
pop ecx
pop ecx
push dword [ebp + 8]
call esi
test eax, eax
je 0x43bde4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
add eax, ecx
mov dword [ebp + 0x10], eax
call ebx
mov ecx, dword [ebp + 0x10]
sub ecx, eax
cmp ecx, 5
jle 0x43bde4
push 1
push edi
call fcn.0040bd90
pop ecx
pop ecx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x43bdc5
pop edi
pop esi
mov eax, dword [ebp + 8]
pop ebx
pop ebp
ret