joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1cd470
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00206040
test al, al
je 0x1cd64e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.001fd9e0
test al, al
je 0x1cd649
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x8245f0fd
mov dword [esp + 8], 0xd6e8a2d6
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x1cd4f6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.001cd660
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x1cd4d0
mov dword [esp + 4], 0x6ac10f4f
mov dword [esp + 8], 0xa4f91641
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x1cd546
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.001cd6f0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x1cd520
test esi, esi
je 0x1cd5e6
mov dword [esp + 4], 0x13121131
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x1cd596
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.001cd780
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x1cd570
mov dword [esp + 4], 0xc9679d33
mov dword [esp + 8], 0xa3b8acea
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x1cd5e6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.001cd810
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x1cd5c0
mov dword [esp + 4], 0x72737071
mov dword [esp + 8], 0x6e6f6c6d
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x1cd636
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.001cd880
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x1cd610
call fcn.001cefe0
test al, al
je 0x1cd649
call fcn.001d2450
call fcn.001d0680
call fcn.00207110
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1cd960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x1cda8a
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x1cd99c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x1cd9cd
cmp cx, 0x7f
jbe 0x1cd990
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x1cd9c0
add ebx, 2
jmp 0x1cd991
mov ecx, ebx
xor ecx, 3
and ebx, 3
lea ebx, [ecx + ebx*2]
jmp 0x1cd991
lea esi, [ebx + 1]
push esi
call fcn.001ccc70
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x1cda98
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x1cda08
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x1cda9a
movzx edx, word [edi]
test dx, dx
je 0x1cda9a
cmp dx, 0x7f
jbe 0x1cd9f0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x1cda50
cmp esi, 0x7ff
ja 0x1cda50
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x1cd9f7
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x1cd9f7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x1cd9f7
push 1
call fcn.001ccc70
add esp, 4
mov ebp, eax
jmp 0x1cda9a
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x1cdab5
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x1cdab0
test eax, eax
je 0x1cdac9
mov ebx, eax
jmp 0x1cdab0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.001c91e0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x1dd610
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa50
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x1dd630
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x217270]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x1dd664
mov eax, 0xffffffff
jmp 0x1dd667
lea eax, [ebx + ebx]
push eax
call fcn.001ccc70
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x217270]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x1dd69c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.001ccc70
add esp, 4
mov esi, eax
mov dword [esp + 0x228], 0x9fd299c4
mov dword [esp + 0x22c], 0xa3d59dfd
mov dword [esp + 0x230], 0xa786a1d4
mov dword [esp + 0x234], 0xabcfa5fe
mov dword [esp + 0x238], 0xafd9a9de
mov dword [esp + 0x23c], 0xb3c1adc5
mov dword [esp + 0x240], 0xb7b6b1c2
mov word [esp + 0x244], 0
mov byte [esp + 0x246], 0
mov dword [esp + 0x668], 0
mov eax, dword [esp + 0x668]
cmp eax, 0x1e
ja 0x1dd760
nop
nop
nop
mov eax, dword [esp + 0x668]
movzx eax, byte [esp + eax + 0x228]
push dword [esp + 0x668]
push eax
call fcn.001e2610
add esp, 8
mov ecx, dword [esp + 0x668]
mov byte [esp + ecx + 0x228], al
inc dword [esp + 0x668]
mov eax, dword [esp + 0x668]
cmp eax, 0x1f
jb 0x1dd720
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x1dd791
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1dd780
mov word [eax], 0
movzx ecx, word [esp + 0x228]
test cx, cx
je 0x1dd7c1
lea edx, [esp + 0x22a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1dd7b0
mov word [eax], 0
lea eax, [esp + 0x108]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0020abe0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x212078]
Function at 0x1e4cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x1e4cf0
cmp eax, 0xffffffdd
jge 0x1e4d07
mov eax, 0xffffffff
jmp 0x1e4d0a
add eax, 0x22
push eax
call fcn.001ccc70
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0xff69f904
mov dword [esp + 0x1c], 0xe371fd68
mov dword [esp + 0x20], 0xe707e176
mov dword [esp + 0x24], 0xeb0fe50f
mov dword [esp + 0x28], 0xef0ae914
mov dword [esp + 0x2c], 0x9378ed09
mov dword [esp + 0x30], 0x97039171
mov dword [esp + 0x34], 0x9b0e9578
mov word [esp + 0x38], 0x9998
mov dword [esp + 0x3a], 0
mov byte [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x26
ja 0x1e4dab
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.001e5b70
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x27
jb 0x1e4d80
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x1e4dd1
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x1e4dc0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x1e4e01
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1e4df0
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0xf345f145
mov dword [esp + 0x1c], 0xff8bfd46
mov dword [esp + 0x20], 0xfb42f955
mov dword [esp + 0x24], 0xc76bc578
mov dword [esp + 0x28], 0xc371c176
mov dword [esp + 0x2c], 0xcf79cd65
mov dword [esp + 0x30], 0xcba1c97e
mov dword [esp + 0x34], 0xd7bdd5bf
mov dword [esp + 0x38], 0xd374d1ba
mov dword [esp + 0x3c], 0xdf6ddd61
mov dword [esp + 0x40], 0xdb68d975
mov dword [esp + 0x44], 0x27912567
mov dword [esp + 0x48], 0x239e2196
mov dword [esp + 0x4c], 0x2f962d81
mov dword [esp + 0x50], 0x2b632994
mov dword [esp + 0x54], 0x37733598
mov dword [esp + 0x58], 0x3332315a
mov word [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x45
ja 0x1e4ee6
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.001e5bf0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x46
jb 0x1e4ec0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x1e51d0
push ecx
push esi
call fcn.001e5fd0
add esp, 0x10
jmp dword [0x21252c]
Function at 0x1f9bd0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x1f9d2b
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x1f9d25
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.001cce90
mov ebp, eax
cmp ebp, 0
setne al
xor ebx, ebx
test al, 1
jne 0x1f9c54
jmp 0x1f9d19
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0xa3
mov byte [esp + 0x19], 0x7d
mov byte [esp + 0x1a], 0x7b
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1d], 0x7a
mov byte [esp + 0x1e], 0x47
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x7c
mov byte [esp + 0x21], 0x87
mov byte [esp + 0x22], 0x4e
mov byte [esp + 0x23], 0x53
mov byte [esp + 0x24], 0x48
mov byte [esp + 0x25], 0xdd
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x11
jne 0x1f9ca7
jmp 0x1f9cb6
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x11
jae 0x1f9cf3
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.001fd8f0
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x1f9cbe
jmp 0x1f9cf5
jmp 0x1f9cf7
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.001cdb10
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x1f9d19
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a06d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
mov dword [0x456b0c], 1
cmp dword [0x456b08], 0
je 0x40a09d
mov eax, dword [0x456b08]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40a133
call fcn.00409f94
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [0x456b04]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x454a24]
add esp, 8
mov dword [0x456b08], eax
lea ecx, [ebp - 0x874]
call fcn.0040bb00
lea eax, [ebp - 0x5f8]
push eax
call fcn.0041b25a
add esp, 4
and eax, 0xff
test eax, eax
je 0x40a118
lea ecx, [ebp - 0x874]
push ecx
push 0
push 0x12dd
mov edx, dword [0x456b08]
push edx
call dword [sym.imp.SQLUNIRL.dll__SendMessage_16]
cmp dword [0x456b08], 0
je 0x40a133
mov eax, dword [0x456b08]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a3c3
add esp, 8
cmp dword [0x456b10], 0
je 0x40a14d
mov edx, dword [0x456b10]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40a16d
mov eax, dword [0x4562a8]
push eax
push 0x52000000
push 0x67
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004036e1
add esp, 0x14
mov dword [0x456b10], eax
cmp dword [0x454ad8], 0
jne 0x40a193
push 0
mov edx, dword [0x456b10]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x456b08]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x456b24], 0
je 0x40a1b4
mov ecx, dword [0x454ad8]
push ecx
push 0xff1
mov ecx, dword [0x456b24]
call dword [sym.imp.SEMSFC.dll_public:_int___thiscall_SToolBarCtrl::CheckButton_int__int_]
cmp dword [0x454ad8], 0
jne 0x40a1da
mov edx, dword [0x456b18]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40a1da
mov eax, dword [0x456b18]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor ecx, ecx
cmp dword [0x454ad8], 0
sete cl
mov dword [0x454ad8], ecx
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.SEMSFC.dll_public:_void___thiscall_SRect::constructor_int__int__int__int_]
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x456298]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x10]
call dword [sym.imp.SEMSFC.dll_public:_int___thiscall_SRect::Height_void_const]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.SEMSFC.dll_public:_int___thiscall_SRect::Width_void_const]
push eax
mov ecx, dword [0x456298]
push ecx
call fcn.0040916d
add esp, 0xc
xor eax, eax
cmp dword [0x456b08], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x40c6e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
mov byte [ebp - 0x108], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
cmp dword [0x4579fc], 0
je 0x40c71b
xor eax, eax
cmp dword [0x457a00], 0
setne al
jmp 0x40c7ef
push 0x105
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x40c7b0
lea ecx, [ebp - 0x108]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov esi, 0x104
sub esi, eax
push 0x452898
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
cmp esi, eax
jbe 0x40c7ae
push str.HHCTRL.OCX
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4579fc], eax
cmp dword [0x4579fc], 0
je 0x40c7aa
push str.HtmlHelpA
mov ecx, dword [0x4579fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x457a00], eax
cmp dword [0x457a00], 0
jne 0x40c7ae
xor eax, eax
jmp 0x40c7ef
jmp 0x40c7b4
xor eax, eax
jmp 0x40c7ef
push 0x104
push 0
push 0x457a04
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0x457a04
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.HELP_
push 0x457a04
call sub.MSVCRT.dll_strcat
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f120
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x40f139
cmp dword [ebp + 0xc], 0
jne 0x40f13d
xor eax, eax
jmp 0x40f194
mov eax, dword [ebp + 8]
mov byte [eax], 0
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f192
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x40f192
mov eax, dword [ebp + 8]
jmp 0x40f194
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40f1a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x40f1b9
cmp dword [ebp + 0xc], 0
jne 0x40f1bd
xor eax, eax
jmp 0x40f216
mov eax, dword [ebp + 8]
mov word [eax], 0
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f214
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x40f214
mov eax, dword [ebp + 8]
jmp 0x40f216
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x422620
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0x26
je 0x422635
cmp dword [ebp + 8], 0x28
jne 0x422685
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.SEMSFC.dll_public:_class_SWnd____thiscall_SWnd::GetParent_void_]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0xd
mov ecx, dword [ebp - 0x10]
call fcn.004223ab
cmp dword [ebp - 8], 0
je 0x422680
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
mov edx, dword [ebp + 0x10]
and edx, 0xffff
shl edx, 0x10
or ecx, edx
push ecx
mov eax, dword [ebp + 8]
push eax
push 0x100
mov ecx, dword [ebp - 8]
call fcn.00426f60
jmp 0x422715
mov byte [ebp - 4], 0
cmp dword [ebp + 8], 9
jne 0x4226ab
mov byte [ebp - 4], 1
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x4226a9
mov dword [ebp + 8], 8
jmp 0x4226bf
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004223ab
mov edx, dword [ebp - 4]
and edx, 0xff
test edx, edx
je 0x422715
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.SEMSFC.dll_public:_class_SWnd____thiscall_SWnd::GetParent_void_]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0xd
mov ecx, dword [ebp - 0x10]
call fcn.004223ab
cmp dword [ebp - 0xc], 0
je 0x422707
push 0x3b00
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.SEMSFC.dll_public:_class_SWnd____thiscall_SWnd::GetParent_void_]
mov ecx, eax
call dword [sym.imp.SEMSFC.dll_public:_class_SWnd____thiscall_SWnd::GetDlgItem_unsigned_int_]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x422715
mov ecx, dword [ebp - 0xc]
call fcn.00402690
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42ed92
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x17f8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42ee30
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x1800], 0
je 0x42edd5
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x1800]
call fcn.00435d31
mov dword [ebp - 0xc], eax
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.00431a41
cmp dword [ebp - 0xc], 0
jne 0x42ee30
mov ecx, dword [ebp - 0x1c]
add ecx, 0x78
push ecx
call dword [sym.imp.SQLSVC.dll_QSQLIsConnDead]
add esp, 4
test eax, eax
jne 0x42ee30
mov ecx, dword [ebp - 0x1c]
call fcn.00431af4
and eax, 0xff
test eax, eax
jne 0x42ee30
push 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x17f8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42ee30
mov ecx, dword [ebp - 0x1c]
add ecx, 0x78
push ecx
call dword [sym.imp.SQLSVC.dll_QSQLCancel]
add esp, 4
mov byte [ebp - 4], 0
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x17f8], 0
je 0x42eead
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x88]
push ecx
push SysReAllocString
call fcn.0042f889
add esp, 8
push 0xa
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x17f8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42ee76
jmp 0x42eead
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [ebp - 8], 0x3e8
jle 0x42eeab
mov byte [ebp - 4], 1
push 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x17f8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.00431832
jmp 0x42eead
jmp 0x42ee3b
mov ecx, dword [ebp - 0x1c]
call fcn.004355a8
mov ecx, dword [ebp - 4]
and ecx, 0xff
test ecx, ecx
jne 0x42eed2
mov edx, dword [ebp - 0x1c]
add edx, 0x78
push edx
call dword [sym.imp.SQLSVC.dll_QSQLLogoff]
add esp, 4
mov eax, dword [ebp - 0x1c]
add eax, 0xc38
push eax
call dword [sym.imp.SQLSVC.dll_QSQLLogoff]
add esp, 4
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov dl, byte [ecx + 0x17fd]
test edx, edx
je 0x42ef45
mov ecx, dword [ebp - 0x1c]
call fcn.0043134d
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x1800], 0
je 0x42ef45
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x1800]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42ef31
push 1
mov ecx, dword [ebp - 0x14]
call fcn.00437420
mov dword [ebp - 0x20], eax
jmp 0x42ef38
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x1800], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x435ea8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x20], 0
je 0x435ec1
xor eax, eax
jmp 0x435f5b
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x43572f
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x20], eax
mov dword [ebp - 8], 0
push 0xa
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x435f06
jmp 0x435f37
push 0xa
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x435f1b
jmp 0x435f37
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [ebp - 8], 0x3e8
jle 0x435f35
mov eax, 0x80004005
jmp 0x435f5b
jmp 0x435ef1
mov ecx, dword [ebp - 0xc]
call fcn.00435db5
and eax, 0xff
test eax, eax
je 0x435f59
push 0
mov ecx, dword [ebp - 0xc]
call fcn.00435d89
mov eax, 0x80004005
jmp 0x435f5b
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x435f5f
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x28], 0
je 0x435f81
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x20], 0
jne 0x435f86
mov eax, dword [ebp - 4]
jmp 0x435fca
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x2710
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x435fbf
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 4], 0x80004005
mov ecx, dword [ebp - 8]
call fcn.00436c53
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret