joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10f3e94
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x10f3f05
mov eax, esi
call fcn.01023d08
test al, al
je 0x10f3f05
mov eax, dword [ebx + 0x98]
call fcn.01023938
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x10f3f05
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x10f3ef6
push 0
mov eax, dword [ebx + 0x98]
call fcn.01023938
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.0101a544
jmp 0x10f3f05
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.010f3ccc
pop esi
pop ebx
ret
Function at 0x112af94
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x112afb5
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x112afb5
xor eax, eax
ret
mov al, 1
ret

Function at 0x1143aa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x1143ab8
add esp, 0xfffffff0
call fcn.00f08040
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x1143bd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00f06a34
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x1143bbc
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.01008a8c
xor eax, eax
push ebp
push 0x1143ba9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.01008a8c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00f0a50c
jmp 0x1143b7a
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00f0a838
mov eax, dword [ebx + 4]
call fcn.00f09c20
dec eax
jle 0x1143b8e
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x1143b68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1143bb0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1143bd9
lea eax, [ebp - 4]
call fcn.00f0979c
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402c00
pop dword [ebp - 0x18]
mov eax, 0x402c00
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x74c251c7
add dword [ebp - 0x28], 0xd98ff384
mov dword [ebp - 0x24], 0xe8ab8917
sub dword [ebp - 0x24], 0xb6783cd2
mov dword [ebp - 0x20], 0x20582f63
sub dword [ebp - 0x20], 0xd40beb35
mov dword [ebp - 0x1c], 0xb3f81fdf
sub dword [ebp - 0x1c], 0xb3f81fdf
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x9d3f019b
add dword [ebp - 0x28], 0xd73367bb
mov dword [ebp - 0x24], 0x2605b5c2
sub dword [ebp - 0x24], 0xe499544d
mov dword [ebp - 0x20], 0x94f9ae6b
add dword [ebp - 0x20], 0xce75be01
mov dword [ebp - 0x1c], 0xdd4c96d5
add dword [ebp - 0x1c], 0x22b3692b
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3946a
push 0
call eax
mov ecx, 0x2b5aa748
sub ecx, 0x2b5a54ef
mov edx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x18]
mov ebx, 0x66a83a38
mov dword [ebp - 0x14], 0x78877714
mov edi, dword [esi]
xor dword [ebp - 0x14], 0xde8c37bd
add edi, ebx
add dword [ebp - 0x14], 0x133c24ee
mov dword [edx], edi
xor dword [ebp - 0x14], 0xea2d752e
add edx, 0x2fb1d4eb
add edx, 0xd04e2b19
add esi, 0xe36b8d71
sub esi, 0xe36b8d6d
loop 0x402d07
add eax, 0x13c37
mov ebx, eax
add eax, 0x5bab4fc9
sub eax, 0x5bab4fc4
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10001250
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10001304
lea eax, [esp + 8]
mov dword [esp + 8], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x100012b3
lea eax, [esp + 0x2c]
push str.360tray.exe
push eax
call fcn.10005bea
add esp, 8
test eax, eax
je 0x100012e8
lea eax, [esp + 8]
push eax
push esi
call edi
test eax, eax
jne 0x10001291
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
nop
lea eax, [esp + 0x2c]
push str.explorer.exe
push eax
call fcn.10005bea
add esp, 8
test eax, eax
je 0x100012fa
lea eax, [esp + 8]
push eax
push esi
call edi
test eax, eax
jne 0x100012c0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10001310
call fcn.10001f20
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10001920
call fcn.100020e0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001f20
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014bed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x278
push esi
lea eax, [ebp - 0x280]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
lea edx, [ecx + 2]
mov word [ebp - 0x3c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001f75
sub ecx, edx
lea eax, [ebp - 0x280]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.10002310
push str.EPPortalSB.exe
lea edx, [ebp - 0x3c]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.10002460
add esp, 4
mov dword [ebp - 0x78], 0x3c
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0x40
cmovae eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x78]
push eax
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], str.open
mov dword [ebp - 0x64], 0x1001ab40
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x58], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1000202f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_executing_file:__d_n
call fcn.10001050
add esp, 8
mov esi, 1
jmp 0x10002045
push 0xffffffffffffffff
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x1000207b
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002071
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100020d6
push edx
push ecx
call fcn.100029ba
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x100020c5
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100020bb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100020d6
push edx
push ecx
call fcn.100029ba
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1000812f
int3
Function at 0x100020e0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014bed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x278
push esi
lea eax, [ebp - 0x280]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
lea edx, [ecx + 2]
mov word [ebp - 0x3c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002135
sub ecx, edx
lea eax, [ebp - 0x280]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.10002310
push str.NXYBankAssist.exe
lea edx, [ebp - 0x3c]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.10002460
add esp, 4
mov dword [ebp - 0x78], 0x3c
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0x40
cmovae eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x78]
push eax
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], str.open
mov dword [ebp - 0x64], 0x1001ab40
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x58], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x100021ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_executing_file:__d_n
call fcn.10001050
add esp, 8
mov esi, 1
jmp 0x10002205
push 0xffffffffffffffff
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x1000223b
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002231
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002296
push edx
push ecx
call fcn.100029ba
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x10002285
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000227b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002296
push edx
push ecx
call fcn.100029ba
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1000812f
int3

Function at 0x100095c4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10016620
push 0x10016618
push 0x10015cb8
push 0x1e
call fcn.100094e2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100095f8
push dword [ebp + 8]
mov ecx, esi
call dword [0x10015170]
call esi
jmp 0x100095fe
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x10009642
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10016630
push 0x10016628
push 0x10015cdc
push 0x20
call fcn.100094e2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009679
push dword [ebp + 8]
mov ecx, esi
call dword [0x10015170]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000cdd3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000ce70
push ebx
push esi
call fcn.1000cd9c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000cce5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000ce1d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000ce6f
push edi
push eax
call fcn.1000a601
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000ce3d
call fcn.1000938f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000ce6e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000cce5
add esp, 0x20
test eax, eax
jne 0x1000ce5c
push edi
call fcn.1000938f
jmp 0x1000ce64
push ebx
call fcn.1000938f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x433ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x433eaf
pop dword [ebp - 0x4c]
mov eax, 0x433eaf
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x4f19a
push 0
mov eax, 0x641affc4
sub eax, 0x63d64d14
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4408
xor esi, esi
add esi, eax
mov edi, 0xcd3cbdc5
add edi, 0x330aa03b
add edi, dword [ebp - 0x4c]
mov ebx, 0xc153af9c
add ebx, 0xbd3b44a3
xor dword [ebp - 0x48], edi
mov edx, dword [edi]
add dword [ebp - 0x14], ebx
xor edx, ebx
add dword [ebp - 0x20], 0x22f90bc0
mov dword [esi], edx
add esi, 4
add edi, 4
loop 0x433f05
add eax, 0x8a5a66c6
add eax, 0x75a69c2d
mov ebx, eax
add eax, 0x727b3e76
sub eax, 0x727b3e71
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x409b49
Capabilities:
Reference sql statements

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004553e0
push dword [esp + 0x1c]
call fcn.0041e6b0
mov dword [esp], 0
jmp 0x409b68
push dword [0x60ac0c]
call fcn.00442133
mov ebx, eax
dec ebx
cmp ebx, dword [esp]
jl 0x409d84
push dword [esp]
push dword [0x60ac0c]
call fcn.00442160
mov ebx, eax
and ebx, ebx
jle 0x409d7b
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
push dword [esp + 8]
push dword [0x60ac0c]
call fcn.004421c7
lea eax, [esp + 8]
push eax
call fcn.004552e0
push dword [esp + 4]
call fcn.0040e943
and eax, eax
je 0x409c32
push dword [esp + 8]
mov edx, 0x57a126
pop ecx
call fcn.0041e640
je 0x409bfc
mov edx, dword [esp + 4]
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455280
lea eax, [esp + 0xc]
push eax
call fcn.004552e0
jmp 0x409c2d
mov edx, dword [esp + 8]
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455280
mov edx, 0x585882
push edx
call fcn.00455280
mov edx, dword [esp + 8]
push edx
call fcn.00455280
lea eax, [esp + 0xc]
push eax
call fcn.004552e0
jmp 0x409d7b
push edx
call fcn.00455240
pop edx
push eax
push dword [esp + 8]
call fcn.004123d1
lea eax, [esp + 0x10]
push eax
call fcn.004552e0
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
mov edx, str.SELECT_key__GROUPS__PRODUCT_FROM_keys_WHERE_NOT_key__AND_Blocked_AND_GROUPS
push edx
call fcn.00455280
mov edx, dword [esp + 0x14]
push edx
call fcn.00455280
mov edx, str._AND_PRODUCT
push edx
call fcn.00455280
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
mov eax, dword [0x60ae20]
cdq
push edx
push eax
call fcn.004533c0
pop eax
mov edx, str._ORDER_BY_GROUPS_ASC
push edx
call fcn.00455280
call fcn.00455370
push dword [0x60adb4]
call fcn.0041e692
add dword [esp + 4], edx
call fcn.0044bd6a
call fcn.0041e6b0
mov ebx, eax
and ebx, ebx
je 0x409d7b
push dword [0x60adb4]
call fcn.0044bd7c
and eax, eax
je 0x409d70
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
push 0
push dword [0x60adb4]
call fcn.0044bda4
lea eax, [esp + 0x14]
push eax
call fcn.004552e0
push dword [esp + 8]
mov edx, 0x57a126
pop ecx
call fcn.0041e640
je 0x409d3a
mov edx, dword [esp + 0x10]
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455280
lea eax, [esp + 0xc]
push eax
call fcn.004552e0
jmp 0x409d6b
mov edx, dword [esp + 8]
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455280
mov edx, 0x585882
push edx
call fcn.00455280
mov edx, dword [esp + 0x14]
push edx
call fcn.00455280
lea eax, [esp + 0xc]
push eax
call fcn.004552e0
jmp 0x409cce
push dword [0x60adb4]
call fcn.0044bdd1
inc dword [esp]
jno 0x409b68
mov edx, dword [esp + 8]
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455280
pop eax
push eax
call fcn.0041e680
pop edx
add eax, edx
jmp 0x409dac
push dword [esp + 0x10]
call fcn.00455440
push dword [esp + 0xc]
call fcn.00455440
push dword [esp + 8]
call fcn.00455440
push dword [esp + 4]
call fcn.00455440
add esp, 0x14
pop ebx
ret
Function at 0x4115fa
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.004553e0
push dword [0x60ad74]
call fcn.004421dd
mov dword [esp], 0
push 0x11
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41162d
mov dword [esp], 1
call fcn.004124d0
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
push dword [0x60ad74]
call fcn.004420cb
call fcn.00455370
mov edx, dword [0x60ac04]
pop ecx
push ecx
call fcn.0041e6c0
mov ecx, eax
call fcn.0041e640
je 0x411685
mov dword [0x60ad08], 1
push dword [0x60ad78]
push dword [0x60ad74]
call fcn.00440b46
jmp 0x4116a2
mov dword [0x60ad08], 0
mov eax, 0x57c2c0
push eax
push dword [0x60ad74]
call fcn.00440b46
jmp 0x4116cd
call fcn.0040c1e3
push dword [esp]
lea eax, [0x4139cf]
push eax
call fcn.0041f3a7
mov dword [0x60ab10], eax
push dword [0x60ad74]
call fcn.004421dd
call fcn.004124d0
xor eax, eax
add esp, 4
pop ebx
ret 4
Function at 0x412dd3
Capabilities:
Reference sql statements

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004553e0
mov edx, dword [esp + 0x1c]
lea ecx, [esp]
call fcn.0041e000
mov dword [esp + 4], 0
mov eax, str.___0_9_2._0_9_2._0_9_4__0_9_2._0_9_2._0_9_2_
push eax
push 0x17
call fcn.00420920
and eax, eax
je 0x412e58
push dword [esp]
push 0x17
call fcn.004209d0
and eax, eax
je 0x412e58
push 0x17
call fcn.00420aa0
and eax, eax
je 0x412e58
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
push 0x17
call fcn.00420b20
lea eax, [esp + 0xc]
push eax
call fcn.004552e0
mov ebx, dword [esp + 4]
inc ebx
mov dword [esp + 4], ebx
jmp 0x412e58
mov dword [esp + 0xc], 0
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
mov edx, str.SELECT_GROUPS__PRODUCT__IID__UUID__CID_FROM_backup_WHERE_PRODUCTNAME_LIKE_
push edx
call fcn.00455280
mov edx, dword [esp + 8]
push edx
call fcn.00455280
mov edx, 0x57e7a0
push edx
call fcn.00455280
call fcn.00455370
push dword [0x60adb4]
call fcn.0041e692
add dword [esp + 4], edx
call fcn.0044bd6a
call fcn.0041e6b0
mov ebx, eax
and ebx, ebx
je 0x412f16
push dword [0x60adb4]
call fcn.0044bd7c
and eax, eax
je 0x412f0b
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
push 4
push dword [0x60adb4]
call fcn.0044bda4
lea eax, [esp + 0x14]
push eax
call fcn.004552e0
push dword [esp + 0x10]
mov edx, 0x57a126
pop ecx
call fcn.0041e640
jne 0x412f07
mov ebx, dword [esp + 0xc]
inc ebx
mov dword [esp + 0xc], ebx
jmp 0x412f0b
push dword [0x60adb4]
call fcn.0044bdd1
mov ebx, dword [esp + 4]
and ebx, ebx
jg 0x412f28
mov ebx, dword [esp + 0xc]
and ebx, ebx
jg 0x412f28
jmp 0x412f2f
mov eax, 1
jmp 0x412f31
xor eax, eax
and eax, eax
je 0x412f3e
mov eax, 1
jmp 0x412f44
xor eax, eax
jmp 0x412f44
push dword [esp + 0x10]
call fcn.00455440
push dword [esp + 8]
call fcn.00455440
push dword [esp]
call fcn.00455440
add esp, 0x14
pop ebx
ret 4
Function at 0x41f3a7
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x41f43f
push edi
push 0x610b58
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x60b440]
test edi, edi
je 0x41f413
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41f40c
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x60b440
call fcn.00455108
pop ecx
pop ecx
jmp 0x41f40e
mov edi, dword [edi]
test edi, edi
jne 0x41f3e3
pop ebx
mov eax, dword [0x605510]
mov esi, eax
inc eax
push 0x10
push 0x60b440
mov dword [0x605510], eax
call fcn.00455148
pop ecx
pop ecx
push 0x610b58
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x42065e
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x4206b3
push dword [esp + 0x10]
push 0x4205dd
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x60b6a8]
test esi, esi
je 0x42070c
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4206ab
cmp byte [esi + 0x10], 0
je 0x4206ab
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x420687
jmp 0x42070c
mov esi, dword [0x60b6a8]
test esi, esi
je 0x42070c
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x420705
cmp byte [esi + 0x11], 0
je 0x4206e1
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x4206f8
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x60b6a8
call fcn.00455108
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x4206c0
pop ebp
pop edi
pop esi
pop ebx
ret 4