joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f20
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x534
mov eax, dword [0x405018]
xor eax, esp
mov dword [esp + 0x52c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x13d]
push ebx
push eax
mov esi, ecx
mov byte [esp + 0x144], bl
call sub.MSVCR80.dll_memset
push esi
push str._s.exe
mov eax, 0x400
lea edi, [esp + 0x14c]
call fcn.00401000
add esp, 0x14
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x401fdd
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401fd6
mov edi, dword [sym.imp.MSVCR80.dll__stricmp]
mov ebp, dword [sym.imp.MSVCR80.dll__getpid]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x13c]
push eax
call edi
add esp, 8
test eax, eax
jne 0x401fc0
call ebp
cmp dword [esp + 0x18], eax
jne 0x401fd1
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401fa2
jmp 0x401fd6
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x53c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004025a0
add esp, 0x534
ret

Function at 0x402130
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x130
mov eax, dword [0x405018]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x13c]
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4021ba
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4021b3
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x34]
push ecx
push ebp
call dword [sym.imp.MSVCR80.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4021a4
mov edx, dword [esp + 0x18]
push edx
push eax
push 1
call esi
push 4
push eax
call edi
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402182
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004025a0
add esp, 0x130
ret 4
Function at 0x402320
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40c
mov eax, dword [0x405018]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
push edi
push 0x400
push 0
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x400
lea ebx, [esi + 0x400]
push 0
push ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x3ff
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.kernel.ini
push ecx
call fcn.004021e0
add esp, 4
push eax
push str._s_s
mov eax, 0x400
lea edi, [esp + 0x14]
call fcn.00401000
add esp, 0xc
mov ecx, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
push 0x400
push esi
push str.QQPenguin
push str.productname
push str.kernel
call edi
lea edx, [esp + 8]
push edx
push 0x400
push ebx
push 0x40335c
push str.fullname
push str.kernel
call edi
mov ecx, dword [esp + 0x40c]
pop edi
pop ebx
xor ecx, esp
mov eax, esi
call fcn.004025a0
add esp, 0x40c
ret

Function at 0x4025a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x405018]
jne 0x4025aa
repz ret
jmp fcn.004029c5
Function at 0x4012de
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
mov ecx, dword [0x472b14]
mov eax, 0x8000
test word [ecx + 4], ax
je 0x401358
mov byte [ebp - 8], 0x10
mov byte [ebp - 7], 0x11
mov byte [ebp - 6], 0x12
mov byte [ebp - 5], 1
mov byte [ebp - 4], 2
xor edi, edi
xor esi, esi
movzx eax, byte [ebp + esi - 8]
push eax
call fcn.00434865
test al, al
jne 0x401342
inc esi
cmp esi, 5
jb 0x40132b
jmp 0x40134a
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 5
je 0x401358
inc edi
cmp edi, 0xc8
jl 0x401329
mov eax, dword [0x472b14]
movzx esi, word [eax + 4]
and esi, 0x19
je 0x40140f
push dword [0x472b10]
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x472b08], eax
cmp eax, ebx
jne 0x401389
push 0xfffffffffffffffe
call fcn.0044dc05
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40140f
dec esi
je 0x401382
sub esi, 7
je 0x4013f8
sub esi, 8
jne 0x40140f
push dword [0x472b10]
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
mov edi, 0x45f92c
push edi
call esi
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jne 0x4013df
push 0x19
push dword [0x472b08]
call ebx
cmp eax, 0x102
jne 0x401406
push dword [0x472b10]
push edi
call esi
test eax, eax
je 0x4013c1
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xffffffffffffffff
push dword [0x472b08]
call ebx
jmp 0x401406
push 0xffffffffffffffff
push dword [0x472b08]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x401382
push 2
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401ad8
Capabilities:
Allocate or change rwx memory

Disassembly:
cmp dword [0x472be0], 0
jne 0x401afb
push 0x40
push 0x3000
push dword [0x473120]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x472bdc], eax
mov ecx, dword [0x472be0]
mov eax, dword [0x472bdc]
mov edx, dword [0x473120]
add eax, ecx
add ecx, 0xa
add edx, 0xfffffff6
mov dword [0x472be0], ecx
cmp ecx, edx
jbe 0x401b25
and dword [0x472be0], 0
cmp byte [esp + 0xc], 0
mov cx, word [esp + 8]
mov word [eax + 1], cx
mov cx, word [esp + 4]
mov word [eax + 3], cx
mov byte [eax], 0x68
mov byte [eax + 5], 0xe9
mov ecx, 0x402ddf
jne 0x401b4f
mov ecx, 0x402dce
sub ecx, eax
sub ecx, 0xa
mov dword [eax + 6], ecx
ret 0xc
Function at 0x4024b7
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x45c016
call fcn.0044d930
sub esp, 0x34
push ebx
push esi
push 1
xor ebx, ebx
push ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.00431d56
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x4024f3
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
lea ecx, [ebp - 0x40]
call fcn.00401bf2
mov dword [ebp - 4], ebx
push dword [0x473140]
lea ecx, [ebp - 0x40]
push dword [ebp + 0xc]
call fcn.004376b1
push dword [ebp - 0x40]
call fcn.00432ac1
mov dword [esp], str.QME_temp_file
push ebx
push ebx
mov byte [ebp - 0xd], al
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x402559
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00401501
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401c02
jmp 0x4024e3
cmp byte [ebp - 0xd], bl
je 0x402589
push ebx
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x30]
call fcn.00438646
cmp eax, dword [ebp - 0x14]
jne 0x402589
push dword [ebp - 0x14]
push dword [ebp - 0x30]
push esi
call fcn.0044e185
add esp, 0xc
test eax, eax
je 0x40260f
lea ecx, [ebp - 0x20]
call fcn.0040197f
mov byte [ebp - 4], 2
push ebx
push ebx
push 2
push dword [ebp - 0x40]
lea ecx, [ebp - 0x20]
call fcn.00435a85
test eax, eax
jne 0x4025c7
test dword [ebp + 0x10], 0x100
je 0x4025b6
cmp byte [ebp - 0xd], bl
jne 0x402603
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.004019a9
jmp 0x402540
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push esi
call fcn.004353d9
test al, al
jne 0x402603
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.004019a9
xor esi, esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00401501
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401c02
mov eax, esi
jmp 0x4024e5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.004019a9
test byte [ebp + 0x10], 1
je 0x402623
push ebx
push ebx
push dword [ebp - 0x40]
call fcn.004364ac
mov esi, eax
jmp 0x4025e5
xor esi, esi
inc esi
jmp 0x4025e5
Function at 0x403a83
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
mov ecx, 0x472b70
call fcn.004039cd
test al, al
je 0x403aa6
push 3
pop ebx
jmp 0x403aaf
mov ecx, edi
call fcn.00403a19
mov ebx, eax
push 5
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.0042d450
mov esi, eax
add esp, 0xc
test esi, esi
je 0x403afb
mov ecx, esi
call fcn.004032b5
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x34], ebx
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x40], ecx
inc dword [edi + 0x18]
test byte [ebp + 0x14], 8
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x44], ecx
mov ecx, dword [edi]
mov dword [ebp - 4], eax
mov dword [ecx + ebx*4], esi
jne 0x403b12
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x403b12
cmp dword [ebp + 0x10], 0
je 0x403b12
mov ecx, dword [ebp + 0x10]
call fcn.004032dd
push dword [ebp + 0x10]
call sym.qmmacro.exe_q_free
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x404249
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x45c100
call fcn.0044d930
push ecx
mov edx, ecx
xor eax, eax
mov dword [edx], 0x45fe10
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], eax
lea edi, [edx + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 1
lea esi, [edx + 0x30]
push 7
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword fs:[0x24]
mov dword [esi + 0x14], eax
mov byte [ebp - 4], 2
movzx eax, byte [ebp + 8]
or dword [edx + 0x18], 0xffffffff
mov dword [edx + 4], 1
mov dword [edx + 0x14], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, edx
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40498f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x45d3f4
call fcn.0044d930
push ecx
xor edx, edx
push edi
mov dword [ebp - 0x10], ecx
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ebp - 4], edx
xor eax, eax
lea edi, [ecx + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 1
mov dword [ecx + 0x1c], edx
mov byte [ebp - 4], 2
xor eax, eax
lea edi, [ecx + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 3
xor eax, eax
lea edi, [ecx + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 4
xor eax, eax
lea edi, [ecx + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
or dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x4049f3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x45d3f4
call fcn.0044d930
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
call fcn.00433ec9
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.0042b5df
mov byte [ebp - 4], 2
lea ecx, [esi + 0x20]
call fcn.0042b5df
mov byte [ebp - 4], 1
push dword [esi + 0x1c]
call sym.qmmacro.exe_q_free
pop ecx
mov byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.0042b5df
or dword [ebp - 4], 0xffffffff
push dword [esi]
call sym.qmmacro.exe_q_free
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x405347
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp byte [ebp + 0xc], al
push esi
sete al
push edi
xor esi, esi
dec eax
and eax, 0x64
add eax, 0x64
mov edi, eax
test edi, edi
jle 0x405381
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x40539a
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xa]
push eax
call fcn.004052e9
inc esi
cmp esi, edi
jl 0x405363
cmp byte [ebp + 0xc], 0
je 0x405394
mov ecx, dword [ebp + 8]
push 0x212
call fcn.004052ff
xor al, al
pop edi
pop esi
pop ebp
ret
mov al, 1
jmp 0x405396

Function at 0x40539e
Capabilities:
Read clipboard data

Disassembly:
mov eax, 0x45d178
call fcn.0044d930
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4053b7
mov eax, esi
jmp 0x4053ba
push 0xd
pop eax
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x4053cf
xor al, al
jmp 0x4054a0
push ebx
mov ebx, dword [ebp + 0xc]
push edi
cmp esi, 2
jne 0x405429
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 4], 0
push 0
push dword [ebx]
push dword [ebp + 0x10]
call sym.qmmacro.exe_SaveBitmap
add esp, 0xc
test eax, eax
je 0x40540a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042b5df
jmp 0x40549c
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp + 8]
push 0x1f9
call fcn.004052ff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042b5df
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
jne 0x40543c
xor al, al
jmp 0x40549e
test esi, esi
jne 0x40544a
push edi
mov ecx, ebx
call fcn.00401027
jmp 0x405493
cmp esi, 0xd
jne 0x40545c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
jmp 0x405479
cmp esi, 1
je 0x405471
cmp esi, 7
je 0x405471
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
jmp 0x405477
push edi
call fcn.0042fb30
mov esi, eax
push 2
push esi
mov ecx, ebx
call fcn.0042b755
test esi, esi
je 0x405493
push esi
push edi
push dword [ebx]
call fcn.0044de20
add esp, 0xc
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov al, 1
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4055e6
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
push 0xd
mov byte [edi + 0x14], 1
mov dword [edi + 0x18], eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp + 8], eax
test eax, eax
je 0x405644
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x405643
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push 2
add esi, esi
push esi
mov ecx, edi
call fcn.0042b755
test esi, esi
je 0x405639
push esi
push ebx
push dword [edi]
call fcn.0044de20
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop esi
pop ebx
pop edi
pop ebp
ret 4

Function at 0x405830
Capabilities:
Write clipboard data

Disassembly:
mov eax, 0x45c1b4
call fcn.0044d930
push ecx
push ecx
push ebx
push esi
push 0xffffffffffffffff
push str.qm_mutex_key
mov esi, ecx
push 0x472b2c
lea ecx, [ebp - 0x14]
call fcn.00435da8
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push 1
push esi
call fcn.00405347
add esp, 0xc
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 8]
mov byte [ebp - 0xd], 1
cmp dword [eax], ebx
je 0x405897
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.004054ad
pop ecx
pop ecx
cmp eax, ebx
je 0x405894
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x405897
mov byte [ebp - 0xd], bl
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp byte [ebp - 0xd], bl
jne 0x4058ae
push 0x213
mov ecx, esi
call fcn.004052ff
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], ebx
pop esi
pop ebx
je 0x4058c2
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4073ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x4073f9
xor eax, eax
pop ebp
ret
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x18]
mov ecx, 0x472c50
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
call fcn.004071c9
test al, al
je 0x407421
mov eax, dword [ebp + 0x1c]
pop ebp
ret
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setl al
movzx eax, al
push eax
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406e22
add esp, 0x1c
pop ebp
ret

Function at 0x40a1d2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
mov edi, dword [esp + 0x18]
mov eax, ebx
and eax, edi
mov esi, ecx
test al, 1
je 0x40a1fa
push 0x10
call ebp
test ax, ax
jl 0x40a1fa
and ebx, 0xfffffffe
mov eax, ebx
and eax, edi
test al, 2
je 0x40a20e
push 0x11
call ebp
test ax, ax
jl 0x40a20e
and ebx, 0xfffffffd
mov eax, ebx
and eax, edi
test al, 4
je 0x40a222
push 0x12
call ebp
test ax, ax
jl 0x40a222
and ebx, 0xfffffffb
push 6
pop edi
test bl, 1
je 0x40a241
push edi
push 0x10
mov ecx, esi
call fcn.00409dee
push edi
push 0xa1
mov ecx, esi
call fcn.00409dee
test bl, 2
je 0x40a25d
push edi
push 0x11
mov ecx, esi
call fcn.00409dee
push edi
push 0xa3
mov ecx, esi
call fcn.00409dee
test bl, 4
je 0x40a288
test bl, 3
jne 0x40a271
push edi
push 0x11
mov ecx, esi
call fcn.00409dee
push edi
push 0x12
mov ecx, esi
call fcn.00409dee
push edi
push 0xa5
mov ecx, esi
call fcn.00409dee
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40a7c9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
push esi
push edi
mov esi, ecx
jne 0x40a891
mov eax, 0x80
cmp word [ebp + 8], ax
jae 0x40a891
cmp byte [ebp + 0x10], 0
jne 0x40a80e
cmp byte [esi + 0xd], 0
jne 0x40a804
call sym.qmmacro.exe_GetMod
test eax, eax
setne al
inc al
mov byte [esi + 0xd], al
cmp byte [esi + 0xd], 2
je 0x40a891
cmp dword [esi + 8], 0
jne 0x40a81c
call fcn.00409181
mov dword [esi + 8], eax
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx edi, ax
cmp di, 0xffff
je 0x40a891
push ebx
mov ebx, edi
shr ebx, 8
and bl, 7
mov byte [ebp + 0xc], bl
cmp bl, 1
ja 0x40a876
movzx eax, byte [ebp + 8]
mov ecx, 0x103
test word [eax*2 + 0x474460], cx
je 0x40a876
cmp byte [esi + 0xc], 0
jne 0x40a86a
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
inc al
mov byte [esi + 0xc], al
cmp byte [esi + 0xc], 2
jne 0x40a876
xor bl, 1
mov byte [ebp + 0xc], bl
xor eax, eax
cmp bl, 1
setne al
mov ecx, esi
dec eax
and eax, 2
push eax
push edi
push dword [ebp + 0xc]
call fcn.0040a038
pop ebx
jmp 0x40a8a4
movzx eax, word [ebp + 8]
push 0
or eax, 0x40000
push eax
mov ecx, esi
call fcn.00409dee
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x422c8b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
push edi
mov ecx, esi
call fcn.0042b7ed
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push edi
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call ebx
cmp eax, 8
jl 0x422d5f
cmp eax, 0xffffffff
je 0x422d5f
cmp eax, 0x2746
je 0x422d5f
cmp byte [ebp - 0xc], 0x51
jne 0x422d5f
cmp byte [ebp - 0xb], 0x4d
jne 0x422d5f
cmp byte [ebp - 0xa], 0
jne 0x422d5f
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x422cf4
movsx ecx, byte [ebp - 9]
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [esi + 4]
mov dword [ebp - 4], ecx
mov edi, 0x100
cmp eax, ecx
jae 0x422d52
lea ecx, [eax + edi]
cmp ecx, dword [ebp - 4]
jbe 0x422d13
mov edi, dword [ebp - 4]
sub edi, eax
push 1
add eax, edi
push eax
mov ecx, esi
call fcn.0042b755
mov eax, dword [esi + 4]
add eax, dword [esi]
push 0
push edi
push eax
push dword [ebp + 8]
call ebx
cmp eax, 0xffffffff
je 0x422d52
test eax, eax
je 0x422d52
mov ecx, dword [esi + 4]
add ecx, eax
push 0
push ecx
mov ecx, esi
call fcn.0042b7ed
mov eax, dword [esi + 4]
mov edi, 0x2000
cmp eax, dword [ebp - 4]
jb 0x422d06
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi + 4], ecx
sete al
jmp 0x422d61
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x422d66
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x422da0
push edi
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, eax
test edi, edi
je 0x422d9a
push edi
push str.WSAStartup
call fcn.00422c2e
pop ecx
pop ecx
test edi, edi
sete al
mov byte [esi], al
pop edi
mov al, byte [esi]
pop esi
add esp, 0x190
ret

Function at 0x422e0e
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x45d178
call fcn.0044d930
sub esp, 0x10
push ebx
xor ebx, ebx
cmp byte [ebp + 0x14], bl
je 0x422e59
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dl, byte [ebp + 0x10]
mov byte [ecx + 2], bl
mov ecx, dword [eax]
mov byte [ecx + 3], dl
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ebx
sub ecx, 8
mov dword [edx + 4], ecx
push dword [eax + 4]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x422eab
push esi
mov esi, dword [ebp + 0xc]
push esi
push str.QM__....
lea ecx, [ebp - 0x1c]
call fcn.00422dce
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
mov cl, byte [ebp + 0x10]
mov byte [eax + 2], bl
mov eax, dword [ebp - 0x1c]
mov byte [eax + 3], cl
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x1c]
push ebx
mov dword [ecx + 4], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042b5df
mov al, bl
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret