joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cba0
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x808
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x42cbc0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [esp + 0x824]
mov ebp, dword [esp + 0x820]
mov esi, dword [esp + 0x81c]
cmp al, 0x30
jne 0x42cc07
lea eax, [esi + esi*2]
lea eax, [eax + eax*8]
lea eax, [esi + eax*8]
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*2]
lea edx, [eax + eax*4]
lea eax, [ebp + edx*8]
mov ecx, dword [eax*4 + 0x65847c]
mov dword [esp + 0x10], ecx
jmp 0x42cc5d
cmp al, 0x31
jne 0x42cc2e
lea eax, [esi + esi*2]
lea edx, [eax + eax*8]
lea eax, [esi + edx*8]
lea eax, [eax + eax*2]
lea eax, [esi + eax*2]
lea ecx, [eax + eax*4]
lea edx, [ebp + ecx*8]
mov eax, dword [edx*4 + 0x6584fc]
mov dword [esp + 0x10], eax
jmp 0x42cc5d
cmp al, 0x32
jne 0x42cc55
lea eax, [esi + esi*2]
lea ecx, [eax + eax*8]
lea eax, [esi + ecx*8]
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
lea eax, [eax + eax*4]
lea ecx, [ebp + eax*8]
mov edx, dword [ecx*4 + 0x65857c]
mov dword [esp + 0x10], edx
jmp 0x42cc5d
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0x476ed38
push str.SELECT_flenabmax_numtomax_flonlyenab_FROM_GATC__sAREE_WHERE_idarea_d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0x18]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, eax
xor eax, eax
test edi, edi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x42cd26
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x24]
test al, al
jne 0x42cd26
mov al, byte [edi + 4]
test al, al
jne 0x42cd13
lea eax, [esi + esi*2]
push 1
lea eax, [eax + eax*8]
lea eax, [esi + eax*8]
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*2]
mov ecx, edi
lea edx, [eax + eax*4]
mov eax, dword [edi]
lea ebx, [ebp + edx*8]
shl ebx, 2
call dword [eax + 0x10]
call fcn.0045f9d8
mov dword [ebx + 0x6586fc], eax
mov edx, dword [edi]
push 2
mov ecx, edi
call dword [edx + 0x10]
call fcn.0045f9d8
mov dword [ebx + 0x6588fc], eax
mov eax, dword [edi]
push 3
mov ecx, edi
call dword [eax + 0x10]
call fcn.0045f9d8
mov dword [ebx + 0x65877c], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x1c]
test edi, edi
je 0x42cd26
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
lea eax, [esi + esi*2]
mov ebx, 1
lea ecx, [eax + eax*8]
lea eax, [esi + ecx*8]
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
lea eax, [eax + eax*4]
lea edi, [ebp + eax*8]
shl edi, 2
mov eax, dword [edi + 0x6586fc]
test eax, eax
je 0x42cd7d
mov ecx, dword [esp + 0x828]
mov edx, dword [esp + 0x10]
push ecx
push 0
push edx
push ebp
push esi
call fcn.0042d120
add esp, 0x14
test eax, eax
je 0x42cd7d
mov eax, dword [edi + 0x65887c]
mov ecx, dword [edi + 0x6588fc]
cmp eax, ecx
jl 0x42cd7d
xor ebx, ebx
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x42d3b0
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x804
test eax, eax
push ebp
push esi
push edi
je 0x42d3ce
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x804
ret
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x824]
xor ebp, ebp
test eax, eax
mov eax, dword [esp + 0x814]
lea ecx, [eax + eax*2]
je 0x42d414
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*8]
lea edx, [ecx + ecx*2]
mov ecx, dword [esp + 0x818]
lea eax, [eax + edx*2]
lea eax, [eax + eax*4]
lea esi, [ecx + eax*8]
shl esi, 2
mov dword [esi + 0x6589fc], ebp
jmp 0x42d43a
lea edx, [ecx + ecx*8]
lea ecx, [eax + edx*8]
lea ecx, [ecx + ecx*2]
lea eax, [eax + ecx*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x818]
lea esi, [eax + edx*8]
shl esi, 2
mov dword [esi + 0x658a7c], 0
mov ecx, dword [esp + 0x820]
mov edx, dword [esp + 0x81c]
push ecx
push edx
push 0x476ed38
lea eax, [esp + 0x1c]
push str.SELECT_count___FROM_GATC__sBADGE_WHERE_area_d_AND_modacc_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea edx, [esp + 0x10]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, eax
xor eax, eax
test edi, edi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x42d4f3
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x24]
test al, al
jne 0x42d4f3
mov al, byte [edi + 4]
test al, al
jne 0x42d4e0
mov eax, dword [esp + 0x824]
test eax, eax
je 0x42d4c7
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0x10]
call fcn.0045f9d8
mov dword [esi + 0x6589fc], eax
jmp 0x42d4db
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx + 0x10]
call fcn.0045f9d8
mov dword [esi + 0x658a7c], eax
mov ebp, 1
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
test edi, edi
je 0x42d4f3
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x804
ret
Function at 0x42d510
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x804
test eax, eax
push esi
push edi
je 0x42d52d
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x804
ret
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x810]
or edi, 0xffffffff
push 0x476ed38
push 0x476ed38
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*8]
lea edx, [ecx + ecx*2]
mov ecx, dword [esp + 0x81c]
lea eax, [eax + edx*2]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*8]
mov ecx, dword [esp + 0x820]
mov eax, dword [edx*4 + 0x65877c]
test eax, eax
mov eax, dword [esp + 0x824]
push eax
push 0x476ed38
push ecx
push 0x476ed38
push 0x476ed38
push 0x476ed38
je 0x42d600
push 0x476ed38
mov eax, dword [esp + 0x844]
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push eax
push 0x476ed38
push eax
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
lea edx, [esp + 0x70]
push str.SELECT_count___FROM_GATC__sAREACOUNTER_GATC__sBADGE_codd__ssubject15_WHERE_codd__ssubject15.dtactivat__s_AND_codd__ssubject15.dtexpirat__s_AND_codd__ssubject15.idcompanyGATC__sBADGE.idcompany_AND_codd__ssubject15.idsubjectGATC__sBADGE.idsubject_AND_codd__ssubject15.idsystemGATC__sBADGE.idsystem_AND_codd__ssubject15.idticketGATC__sBADGE.idticket_AND_codd__ssubject15.dtactivatGATC__sBADGE.dtactivat_AND_codd__ssubject15.lgokticket1_AND_codd__ssubject15.lgokaccess1_AND_GATC__sBADGE.area_d_AND_GATC__sAREACOUNTER.idcounter_d_AND_GATC__sAREACOUNTER.causalGATC__sBADGE.ultcausal
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x6c
jmp 0x42d613
lea edx, [esp + 0x2c]
push str.SELECT_count___FROM_GATC__sAREACOUNTER_GATC__sBADGE_WHERE_GATC__sBADGE.area_d_AND_GATC__sAREACOUNTER.idcounter_d_AND_GATC__sAREACOUNTER.causalGATC__sBADGE.ultcausal
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x28
push 1
lea eax, [esp + 0x10]
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00445210
mov ecx, dword [0x516f90]
mov edx, dword [ecx]
call dword [edx + 0xc]
mov esi, eax
xor eax, eax
test esi, esi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x42d685
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
test al, al
jne 0x42d685
mov al, byte [esi + 4]
test al, al
jne 0x42d672
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
test al, al
jne 0x42d672
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x10]
call fcn.0045f9d8
mov edi, eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
test esi, esi
je 0x42d685
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
add esp, 0x804
ret
Function at 0x436420
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x804
test eax, eax
push esi
push edi
je 0x43643c
xor eax, eax
pop edi
pop esi
add esp, 0x804
ret
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x810]
lea ecx, [esp + 0xc]
push eax
push 0x476ed38
push str.SELECT_idstmt_FROM_GATC__sSTMT_WHERE_idstmt_s
push ecx
xor edi, edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0xc]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
xor eax, eax
test esi, esi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x4364c5
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
test al, al
jne 0x4364c5
mov al, byte [esi + 4]
test al, al
jne 0x4364b2
mov edi, 1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
test esi, esi
je 0x4364c5
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
add esp, 0x804
ret
Function at 0x436ef0
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x804
test eax, eax
push esi
push edi
je 0x436f0c
xor eax, eax
pop edi
pop esi
add esp, 0x804
ret
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x810]
xor edi, edi
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*8]
lea edx, [ecx + ecx*2]
lea ecx, [eax + edx*2]
mov edx, dword [esp + 0x814]
lea ecx, [ecx + ecx*4]
lea ecx, [edx + ecx*8]
mov edx, dword [ecx*4 + 0x643948]
lea ecx, [eax + eax*2]
push edx
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*8]
lea edx, [ecx + ecx*2]
lea eax, [eax + edx*2]
mov edx, dword [0x476edd0]
lea eax, [eax + eax*4]
shl eax, 5
mov ecx, dword [eax + 0x643944]
lea eax, [esp + 0x10]
push ecx
push edx
push 0x476ed38
push str.SELECT_flsetauth_FROM_GATD__sDEVICE_WHERE_idkcom_d_AND_cntchannel_d_AND_cproword_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea edx, [esp + 0xc]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
xor eax, eax
test esi, esi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x436fdf
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
test al, al
jne 0x436fdf
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x10]
call fcn.0045f9d8
mov edx, dword [esi]
mov ecx, esi
mov edi, eax
call dword [edx + 0x1c]
test esi, esi
je 0x436fdf
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
add esp, 0x804
ret
Function at 0x437000
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x804
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x437020
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x804
ret
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esp + 0x818]
xor ebp, ebp
lea eax, [esi + esi*2]
lea eax, [eax + eax*8]
lea eax, [esi + eax*8]
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x81c]
lea ebx, [eax + edx*8]
lea eax, [esi + esi*2]
shl ebx, 2
lea edx, [eax + eax*8]
mov ecx, dword [ebx + 0x643948]
lea eax, [esi + edx*8]
push ecx
push 0x476ed38
lea eax, [eax + eax*2]
lea eax, [esi + eax*2]
lea ecx, [eax + eax*4]
mov eax, dword [0x476edd0]
shl ecx, 5
mov edx, dword [ecx + 0x643944]
mov ecx, dword [esp + 0x828]
push edx
push 0x476ed38
push eax
push 0x476ed38
push 0x476ed38
push 0x476ed38
push ecx
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
lea edx, [esp + 0x4c]
push str.SELECT_GATC__sMODE.time_GATC__sMODE.idmodout_FROM_GATC__sGRPMODE_GATC__sMODE_WHERE_GATC__sGRPMODE.idgrpmode_d_AND_GATC__sGRPMODE.idmodeGATC__sMODE.idmode_AND_GATC__sMODE.kcom_d_AND_GATC__sMODE.channel_d_AND_GATC__sMODE.device_d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x40
lea eax, [esp + 0x14]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00445210
mov ecx, dword [0x516f90]
mov edx, dword [ecx]
call dword [edx + 0xc]
mov edi, eax
xor eax, eax
test edi, edi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x437177
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
test al, al
jne 0x437177
mov al, byte [edi + 4]
test al, al
jne 0x437164
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx + 0x10]
call fcn.0045f9d8
push eax
mov eax, dword [esp + 0x820]
push eax
push esi
call fcn.0042c330
mov ebp, eax
add esp, 0xc
test ebp, ebp
jne 0x437143
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x20]
mov al, byte [edi + 4]
test al, al
je 0x43710d
jmp 0x437164
mov eax, dword [esp + 0x820]
push 2
mov dword [ebx + 0x676660], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x10]
call fcn.0045f9d8
mov dword [ebx + 0x6766e0], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
test edi, edi
je 0x437177
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x804
ret
Function at 0x437190
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x804
push esi
push edi
push 0x46054d8
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x476ed38
mov eax, dword [esp + 0x81c]
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push eax
push 0x476ed38
push eax
mov eax, dword [esp + 0x850]
push 0x476ed38
push eax
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
lea ecx, [esp + 0x58]
push str.SELECT_GATC__sBADGE.flnotenabwithalarmon_FROM_codd__ssubject15_GATC__sBADGE_WHERE_GATC__sBADGE.hextessera_s_AND_codd__ssubject15.dtactivat__s_AND_codd__ssubject15.dtexpirat__s_AND_codd__ssubject15.idcompanyGATC__sBADGE.idcompany_AND_codd__ssubject15.idsubjectGATC__sBADGE.idsubject_AND_codd__ssubject15.idsystemGATC__sBADGE.idsystem_AND_codd__ssubject15.idticketGATC__sBADGE.idticket_AND_codd__ssubject15.dtactivatGATC__sBADGE.dtactivat
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x54
lea edx, [esp + 0xc]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
xor eax, eax
test esi, esi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x437280
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
test al, al
jne 0x437280
mov al, byte [esi + 4]
test al, al
jne 0x43726d
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x10]
call fcn.0045f9d8
mov edi, eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
test esi, esi
je 0x437280
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
add esp, 0x804
ret
Function at 0x4372e0
Capabilities:
Create mailslot

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push edi
mov edi, dword [esp + 0x28]
push 0x80
push 0x46023d4
push 1
push edi
mov dword [0x45fa7b4], edi
call esi
push 0x80
push 0x45ed428
push 0x9c42
push edi
call esi
push 0x45ed420
mov dword [0x45ed420], 8
mov dword [0x45ed424], 0x800
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
jne 0x437356
push 0x10
push str.Error_Message
push str.FATAL_ERROR:_init_common_controls_failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x46054d8
call esi
push 0x4602cb8
call esi
push 0x45fb4b8
call esi
push 0x60b8ac0
call esi
push 0x45eda58
call esi
mov eax, dword [esp + 0x30]
push eax
call fcn.00443d50
add esp, 4
test eax, eax
jne 0x43746b
mov ecx, dword [str..mailslotkcom]
push eax
push 0xffffffffffffffff
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
cmp eax, 0xffffffff
mov dword [0x6438f8], eax
jne 0x4373e5
push 0x46023d4
push 0x45ed428
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x9c42
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
push edi
call fcn.004374a0
mov edx, dword [esp + 0x38]
push edx
push edi
call fcn.00437530
add esp, 0xc
test eax, eax
jne 0x437405
pop edi
pop esi
add esp, 0x1c
ret 0x10
push 0x65
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
mov esi, eax
push 0
push 0
lea eax, [esp + 0x10]
push 0
push eax
call edi
test eax, eax
je 0x43746b
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x437458
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
lea edx, [esp + 0x18]
push 0
push edx
call edi
test eax, eax
jne 0x437435
pop ebp
pop ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x46054d8
call esi
push 0x4602cb8
call esi
push 0x45fb4b8
call esi
push 0x60b8ac0
call esi
push 0x45eda58
call esi
pop edi
pop esi
mov eax, dword [esp + 8]
add esp, 0x1c
ret 0x10
Function at 0x437530
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
mov eax, dword [0x45fa7b4]
push 0
push eax
push 0
push 0
push 0
push bind
push 0
push bind
push 0
push 0x46023d4
push 0x45ed428
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x523aac], eax
jne 0x437568
ret
mov ecx, dword [0x45fa7b4]
push 0xa
push 0
push 0
push 0
push 0
push 0x6d
push 0x6c
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [0x523aac]
push eax
mov eax, dword [0x45fa7b4]
push 0x46023d4
push 0x800a
push edx
push eax
mov ecx, 0x45fa578
call fcn.00445780
test eax, eax
jne 0x4375bf
push 0x10
push str.Error_Message
push str.FATAL_ERROR:_system_tray_icon_failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
ret
mov ecx, dword [0x523aac]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x523aac]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x523aac]
push 0
push 0x9c43
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
ret
Function at 0x43f9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x20]
xor esi, esi
test edi, edi
mov byte [esp + 8], 0x30
mov byte [esp + 9], 0x31
mov byte [esp + 0xa], 0x32
mov byte [esp + 0xb], 0x33
mov byte [esp + 0xc], 0x34
mov byte [esp + 0xd], 0x35
mov byte [esp + 0xe], 0x36
mov byte [esp + 0xf], 0x37
mov byte [esp + 0x10], 0x38
mov byte [esp + 0x11], 0x39
mov byte [esp + 0x12], 0x61
mov byte [esp + 0x13], 0x62
mov byte [esp + 0x14], 0x63
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x16], 0x65
mov byte [esp + 0x17], 0x66
jle 0x43fa2c
push ebx
mov ebx, dword [esp + 0x20]
call fcn.0045fe77
and eax, 0x8000000f
jns 0x43fa15
dec eax
or eax, 0xfffffff0
inc eax
mov al, byte [esp + eax + 0xc]
mov byte [esi + ebx], al
inc esi
cmp esi, edi
jl 0x43fa04
mov byte [ebx + edi], 0
pop ebx
pop edi
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov byte [ecx + edi], 0
pop edi
pop esi
add esp, 0x10
ret
Function at 0x442020
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push esi
push edi
push 0x46f4c0
call fcn.004062d0
add esp, 0xc
mov byte [edi + esi - 2], al
mov eax, dword [esp + 0xc]
push 0
push esi
mov ecx, dword [eax]
push edi
push ecx
call sub.WSOCK32.dll_send
mov eax, esi
pop edi
pop esi
ret

Function at 0x442060
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
add edi, 0x1f4
xor esi, esi
call ebx
add edi, eax
mov dword [esp + 0x10], edi
call ebx
mov ebp, dword [esp + 0x1c]
cmp eax, edi
ja 0x4420f5
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx]
lea eax, [esp + 0x24]
push eax
push 0x4004667f
push ecx
call sub.WSOCK32.dll_ioctlsocket
test eax, eax
je 0x4420ad
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4420eb
mov edi, dword [esp + 0x24]
test edi, edi
jbe 0x4420df
mov eax, dword [esp + 0x20]
sub eax, esi
cmp edi, eax
jb 0x4420c1
mov edi, eax
mov eax, dword [ebx]
push 0
lea edx, [esi + ebp]
push edi
push edx
push eax
call sub.WSOCK32.dll_recv
add esi, edi
cmp byte [esi + ebp - 1], 0xd
je 0x4420f5
cmp esi, dword [esp + 0x20]
je 0x4420f5
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x44208d
cmp byte [ebp], 1
je 0x442105
mov eax, esi
pop edi
pop esi
pop ebp
neg eax
pop ebx
pop ecx
ret
cmp byte [esi + ebp - 1], 0xd
je 0x442116
mov eax, esi
pop edi
pop esi
pop ebp
neg eax
pop ebx
pop ecx
ret
push esi
push ebp
push 0x46f4c0
call fcn.004062d0
mov cl, byte [esi + ebp - 2]
add esp, 0xc
cmp cl, al
mov eax, esi
je 0x442131
neg eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x444160
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
sub esp, 0x4a4
lea eax, [esp + 0xa4]
push esi
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x444188
pop esi
add esp, 0x4a4
ret
push ebx
push ebp
push edi
mov edi, str.__s
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xb4]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x4b8]
and ecx, 3
lea edx, [esp + 0xb4]
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push str.KCOM__s
and ecx, 3
push 0x60933b4
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
call esi
push ebx
lea eax, [esp + 0x24]
push str.KCOM_on_port__s
push eax
call esi
push ebx
call fcn.0045f57e
dec eax
lea ecx, [esp + 0x50]
push eax
push ebx
push str.KCOM_service_listening_on_port__s___KMON_client_can_connect_on_port__d
push ecx
call esi
add esp, 0x2c
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
pop edi
pop ebp
test eax, eax
pop ebx
jne 0x444245
pop esi
add esp, 0x4a4
ret
push 0
push 0
push 0
push 0
lea edx, [esp + 0xb8]
push 0
push edx
push 1
push 2
push 0x110
lea ecx, [esp + 0x2c]
push 0xf01ff
push ecx
push 0x60933b4
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x444284
pop esi
add esp, 0x4a4
ret
lea eax, [esp + 4]
lea edx, [esp + 0x28]
push eax
push 1
push esi
mov dword [esp + 0x10], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop esi
add esp, 0x4a4
ret

Function at 0x4442b0
Capabilities:
Delete service

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push str.KCOM__s
push 0x60933b4
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
jne 0x4442de
pop esi
ret
push 0xf01ff
push 0x60933b4
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4442f7
pop esi
ret
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x444304
pop esi
ret
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
neg eax
sbb eax, eax
pop esi
neg eax
ret