joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dc40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ecx]
mov bl, byte [edi + 0x1ec]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 8]
lea ecx, [edi + 0x190]
mov dword [ebp - 8], eax
call fcn.0040b710
test al, al
jne 0x41dc9f
mov eax, dword [ebp - 4]
cmp eax, 3
jne 0x41dcb0
lea ecx, [edi - 0x28]
mov byte [edi + 0x1ec], 1
call fcn.0041e590
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp byte [edi + 0x1ec], 0
je 0x41dd7f
mov byte [edi + 0x1ec], bl
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x73
jne 0x41dd7c
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0x14
jne 0x41dd7c
mov byte [edi + 0x1ec], 1
mov ecx, dword [eax]
lea eax, [edi + 0x2b0]
cmp ecx, eax
jne 0x41dce4
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 0x14]
jmp 0x41dc89
lea eax, [edi + 0x1f0]
cmp ecx, eax
jne 0x41dcf8
lea ecx, [edi - 0x28]
call fcn.004200e0
jmp 0x41dc89
lea eax, [edi + 0x370]
cmp ecx, eax
jne 0x41dc89
cmp dword [edi + 0x9a0], 0
je 0x41dc89
cmp dword [edi + 0x9a4], 8
lea eax, [edi + 0x990]
jb 0x41dd20
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push 0x4b7338
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
je 0x41dd58
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 0x14]
push 0
push 0
push 0x10
push dword [edi + 0x170]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x41dc89
cmp dword [edi + 0x9a8], 5
je 0x41dc89
lea ecx, [edi - 0x28]
mov dword [edi + 0x9a8], 5
call fcn.0041fc60
jmp 0x41dc89
mov eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.0040b8a0
mov byte [edi + 0x1ec], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x420c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420c9b
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x420c5d
cmp eax, 2
jne 0x420c79
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x420c95
test ecx, ecx
je 0x420c90
test cl, 1
jne 0x420c79
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x420c95
pop edi
mov eax, 0xd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045cf38
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4234e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x614]
push 0x402
push ebx
push eax
mov edi, ecx
mov dword [ebp - 0x620], ebx
call fcn.0045f220
push 0x20a
lea eax, [ebp - 0x210]
mov dword [ebp - 0x61c], 0x400
push ebx
push eax
call fcn.0045f220
add esp, 0x18
mov ecx, edi
call fcn.00423b90
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x618], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x423579
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x618]
jmp 0x42357f
mov ecx, dword [ebp - 0x618]
lea eax, [ebp - 0x620]
test ecx, ecx
push eax
mov edx, 0x201
mov eax, 1
cmovne eax, edx
push eax
push 0
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423628
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x614]
push eax
push 0
push 0
push str.InstallDir
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42361c
push 0xffffffffffffffff
lea eax, [ebp - 0x614]
mov ebx, 1
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x624], ebx
push 0x104
push eax
call fcn.00465b54
lea esi, [ebp - 0x210]
add esp, 0x10
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x423604
sub esi, ecx
sar esi, 1
jne 0x42363b
mov ecx, edi
call fcn.00423b90
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
lea ebx, [ebp - 0x210]
sub ebx, ecx
sar ebx, 1
mov eax, dword [ecx - 0xc]
mov dword [ebp - 0x618], eax
test esi, esi
js 0x4236f3
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
sub eax, esi
or edx, eax
jge 0x423673
push esi
mov ecx, edi
call fcn.00423aa0
mov ecx, dword [edi]
cmp ebx, dword [ebp - 0x618]
ja 0x4236c3
mov eax, dword [ecx - 8]
lea edx, [esi + esi]
lea ebx, [ecx + ebx*2]
test edx, edx
je 0x4236d6
test ebx, ebx
jne 0x42369e
call fcn.00465bd8
mov dword [eax], 0x16
call fcn.004626b9
jmp 0x4236d6
add eax, eax
cmp eax, edx
jae 0x4236b6
call fcn.00465bd8
mov dword [eax], 0x22
call fcn.004626b9
jmp 0x4236d6
push edx
push ebx
push ecx
call fcn.0045f380
add esp, 0xc
jmp 0x4236d6
mov edx, dword [ecx - 8]
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00423b00
add esp, 8
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x4236f3
mov ebx, dword [ebp - 0x624]
xor ecx, ecx
mov dword [eax - 0xc], esi
mov eax, dword [edi]
mov word [eax + esi*2], cx
jmp 0x42361c
push 0x80070057
call fcn.00404cf0
int3
Function at 0x423700
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4967a0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x70
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00420740
mov ecx, eax
test ecx, ecx
je 0x423887
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.004234e0
mov edi, dword [ebp - 0x1c]
test eax, eax
jne 0x423779
mov byte [ebp - 0x79], 0
jmp 0x423847
call fcn.00420740
mov ecx, eax
test ecx, ecx
je 0x423891
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push str.__sQQPCClinic.exe___from20__autorepair1608
push eax
call fcn.004238a0
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x44
push 0
push eax
call fcn.0045f220
mov esi, dword [ebp - 0x18]
xorps xmm0, xmm0
movups xmmword [ebp - 0x78], xmm0
mov dword [ebp - 0x68], 0x44
mov ecx, 1
mov dword [ebp - 0x3c], 0x80
add esp, 0xc
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
or eax, ecx
jge 0x4237ef
push 0
lea ecx, [ebp - 0x18]
call fcn.00423aa0
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x423815
mov byte [ebp - 0x79], al
jmp 0x42382b
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x79], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x423847
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x423866
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0x79]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x80004005
call fcn.00404cf0
push 0x80004005
call fcn.00404cf0
int3
Function at 0x428e00
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496ffb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0045f220
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428e80
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00405220
push 0x12
push str.driversetchosts
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
call fcn.00404430
call fcn.0044bbae
cmp eax, 7
jl 0x428ed1
mov eax, 0x337
mov edx, str._Copyright_c__1993___2009_Microsoft_Corp._r_n_r_n_This_is_a_sample_HOSTS_file_used_by_Microsoft_TCP___IP_for_Windows._r_n_r_n_This_file_contains_the_mappings_of_IP_addresses_to_host_names.Each_r_n_entry_should_be_kept_on_an_individual_line.The_IP_address_should_r_n_be_placed_in_the_first_column_followed_by_the_corresponding_host_name._r_n_The_IP_address_and_the_host_name_should_be_separated_by_at_least_one_r_n_space._r_n_r_n_Additionally__comments_such_as_these__may_be_inserted_on_individual_r_n_lines_or_following_the_machine_name_denoted_by_a__symbol._r_n_r_n_For_example_:_r_n_r_n______102.54.94.97_____rhino.acme.com___________source_server_r_n_______38.25.63.10_____x.acme.com_______________x_client_host_r_n_r_n_localhost_name_resolution_is_handled_within_DNS_itself._r_n127.0.0.1_______localhost_r_n::1_____________localhost_r_n
jmp 0x428edb
mov eax, 0x2df
mov edx, str._Copyright_c__1993___1999_Microsoft_Corp._r_n_r_n_This_is_a_sample_HOSTS_file_used_by_Microsoft_TCP___IP_for_Windows._r_n_r_n_This_file_contains_the_mappings_of_IP_addresses_to_host_names.Each_r_n_entry_should_be_kept_on_an_individual_line.The_IP_address_should_r_n_be_placed_in_the_first_column_followed_by_the_corresponding_host_name._r_n_The_IP_address_and_the_host_name_should_be_separated_by_at_least_one_r_n_space._r_n_r_n_Additionally__comments_such_as_these__may_be_inserted_on_individual_r_n_lines_or_following_the_machine_name_denoted_by_a__symbol._r_n_r_n_For_example_:_r_n_r_n______102.54.94.97_____rhino.acme.com___________source_server_r_n_______38.25.63.10_____x.acme.com_______________x_client_host_r_n_r_n127.0.0.1_______localhost_r_n
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
push eax
cmovae ecx, dword [ebp - 0x230]
call fcn.00450ab5
add esp, 4
test al, al
jne 0x428f00
xor bl, bl
jmp 0x428f07
call fcn.00427f90
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.004054f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
Function at 0x429f00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497280
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x40]
call fcn.00433930
push ecx
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0040ad70
add esp, 4
push 0x66
push str.http:__ie.sogou.com_bbs_forum.php_modpostactionnewthreadsortid86fid33cedityesextrapage_3D1
push 0
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00420960
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea ecx, [ebp - 0x58]
call fcn.004054f0
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x429fb5
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x429fab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x429ff5
push edx
push ecx
call fcn.0045cf49
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 5
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
push 0x4b7338
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x28]
call fcn.004054f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
call fcn.004626c9
int3
Function at 0x430a30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49795c
mov eax, dword fs:[0]
push eax
mov eax, dword [0x4d406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4e0310]
cmp eax, dword [ecx + 4]
jle 0x430ab4
push 0x4e0310
call fcn.0045d4bf
add esp, 4
cmp dword [0x4e0310], 0xffffffff
jne 0x430ab4
push 0x64
push 0
push 0x4e0318
mov dword [ebp - 4], 0
call fcn.0045f220
add esp, 0xc
call fcn.00430af0
push 0x49b8f0
call fcn.0045d20c
add esp, 4
push 0x4e0310
call fcn.0045d475
add esp, 4
cmp dword [0x4e031c], 0
jne 0x430ada
push 0
push 0
push 0x4e0318
push 0x432190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e031c], eax
mov eax, 0x4e0318
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4319b0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x431a04
push 0
push 1
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x431a04
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4319f4
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
pop esi
ret
Function at 0x432d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0045e2e0
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1010]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push 0x80000002
mov dword [ebp - 0x1010], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432e41
push 0x1000
push eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x100c], 1
push eax
call fcn.0045f220
add esp, 0xc
mov dword [ebp - 0x1008], 0x800
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0
push str.Version
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x432e41
lea edx, [ebp - 0x1004]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x432e06
sub edx, ecx
lea eax, [ebp - 0x1004]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.00405220
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
Function at 0x4331b0
Capabilities:
Create process on windows
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497d92
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push 0
push str.SE_SogouExplorerFrame
call edi
test eax, eax
jne 0x4332fb
mov esi, dword [0x4df2d8]
test esi, esi
jne 0x433236
push 0x108
call fcn.0045cf57
mov esi, eax
add esp, 4
mov dword [ebp - 0x2c], esi
push 0x405550
push 0x40ad50
push 0xb
push 0x18
push esi
mov dword [ebp - 4], 0
call fcn.0045d5d6
mov dword [ebp - 4], 0xffffffff
mov dword [0x4df2d8], esi
push 0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00421b60
cmp dword [ebp - 0x18], 0
je 0x43326b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 5
cmovae eax, dword [ebp - 0x28]
push 0
push str._Manual
push eax
push 0x4b7338
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push str.SE_SogouExplorerFrame
mov esi, 0x32
call edi
test eax, eax
jne 0x43329b
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
dec esi
test eax, eax
je 0x43329b
push 0x1e
call ebx
push 0
push str.SE_SogouExplorerFrame
call edi
test eax, eax
je 0x433283
mov edi, dword [0x4df2dc]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
test edi, edi
je 0x4332e9
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4332e9
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x2c], eax
cmp eax, esi
je 0x4332e9
push 1
push esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push edi
call ebx
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call esi
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push edi
call ebx
lea ecx, [ebp - 0x28]
call fcn.004054f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
Function at 0x433780
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov byte [ebp - 0x19], cl
push eax
push 0
push 8
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov word [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4337fc
call esi
cmp eax, 0x3f0
jne 0x433911
lea eax, [ebp - 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x433911
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x433911
call esi
cmp eax, 0x7a
jne 0x433911
mov esi, dword [ebp - 0x10]
mov eax, esi
call fcn.0045dc60
mov ebx, esp
test ebx, ebx
je 0x433911
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x433911
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x433911
xor esi, esi
cmp dword [ebx], esi
jbe 0x4338f1
lea edi, [ebx + 4]
push dword [ebp - 0x18]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4338b8
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x433881
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, byte [ebp - 0x20]
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x19], 0
je 0x4338ed
mov eax, dword [ebx + esi*8 + 8]
push dword [ebp - 0x18]
shr eax, 2
and eax, 0xffffff01
mov dword [ebp - 0x20], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, byte [ebp - 0x20]
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x20], 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, byte [ebp - 0x20]
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
xor al, al
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
Function at 0x4357d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x208
mov dword [ebp - 0x224], eax
mov edi, edx
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 0x104
push 0
push eax
mov esi, ecx
call fcn.0045f220
add esp, 0xc
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
xor bl, bl
push eax
push 1
push 0
push str.SoftwareSogouExplorer
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4358cf
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x4358cf
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push ecx
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x220]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4358cf
cmp word [ebp - 0x214], 0
je 0x4358cf
cmp dword [ebp - 0x218], 0
je 0x4358cf
push dword [ebp - 0x224]
mov edx, edi
lea ecx, [ebp - 0x214]
call fcn.004351a0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cf38
mov esp, ebp
pop ebp
ret
Function at 0x43ebd9
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x14
mov eax, 0x498927
call fcn.0045dae3
mov edi, ecx
push dword [edi + 0xb0]
lea ecx, [ebp - 0x20]
call fcn.00436319
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
cmp ebx, 9
jne 0x43ec39
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x43ecf7
mov ecx, dword [edi + 0xc0]
test ecx, ecx
je 0x43ec31
push esi
push esi
push esi
push 0xc
call fcn.00437ca7
test eax, eax
jne 0x43ecf7
xor esi, esi
inc esi
jmp 0x43ecf7
cmp ebx, 0x25
je 0x43ec51
cmp ebx, 0x27
je 0x43ec51
cmp ebx, 0x26
je 0x43ec51
cmp ebx, 0x28
jne 0x43ecf7
mov ecx, dword [edi + 0xc0]
test ecx, ecx
je 0x43ecf7
push esi
push esi
push esi
push 0xb
call fcn.00437ca7
test eax, eax
jne 0x43ecf7
mov eax, dword [edi + 0xc0]
cmp dword [eax + 0x2c], esi
je 0x43ecf7
cmp ebx, 0x25
jb 0x43ecf7
cmp ebx, 0x26
jbe 0x43ec95
cmp ebx, 0x28
ja 0x43ecf7
push eax
mov ecx, edi
call 0x43d777
jmp 0x43ec9d
push eax
mov ecx, edi
call 0x43d827
mov ebx, eax
test ebx, ebx
je 0x43ecf7
push ebx
mov ecx, edi
call fcn.0043c7de
push esi
push esi
push esi
push 0x11
mov ecx, ebx
call fcn.00437ca7
cmp eax, 4
jne 0x43ecd2
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0xac]
mov dword [ebp - 0x14], esi
call fcn.0043bdf7
mov ecx, dword [edi + 0xb0]
push esi
push esi
push esi
push 0x6e
call fcn.00437ca7
cmp eax, 1
jne 0x43ecf7
mov ecx, dword [edi + 0xb0]
push esi
push esi
push esi
push 0x6f
call fcn.00437ca7
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], vtable.CTrackFinalEvent.0
call fcn.00439204
mov eax, esi
call fcn.0045daac
ret 8

Function at 0x43ed17
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xc
mov eax, 0x498904
call fcn.0045dae3
mov edi, ecx
push dword [edi + 0xb0]
lea ecx, [ebp - 0x18]
call fcn.00436319
xor esi, esi
cmp dword [ebp + 8], 9
mov dword [ebp - 4], esi
jne 0x43ed68
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x43ed68
mov ecx, dword [edi + 0xc0]
test ecx, ecx
je 0x43ed65
push esi
push esi
push esi
push 0xc
call fcn.00437ca7
test eax, eax
jne 0x43ed68
xor esi, esi
inc esi
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CTrackFinalEvent.0
call fcn.00439204
mov eax, esi
call fcn.0045daac
ret 8