joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d3b5f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.100d303e
mov edi, dword [ebp + 8]
test edi, edi
je 0x100d3bb0
cmp dword [esi + 0x4c], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
je 0x100d3b89
push edi
push dword [esi + 0x4c]
call ebx
test eax, eax
jne 0x100d3b99
cmp dword [esi + 0x50], 0
je 0x100d3b9d
push edi
push dword [esi + 0x50]
call ebx
test eax, eax
je 0x100d3b9d
mov al, 1
jmp 0x100d3bb2
cmp dword [esi + 0x54], 0
je 0x100d3bb0
push edi
push dword [esi + 0x54]
call ebx
test eax, eax
setne al
jmp 0x100d3bb2
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100d7805
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x100ed0ef
call fcn.10001371
mov esi, ecx
mov dword [ebp - 0x10], esi
push 1
push 1
xor ebx, ebx
push ebx
push ebx
call fcn.10047e8b
mov eax, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [esi + 0x50], eax
mov al, byte [ebp + 0xc]
push ebx
mov byte [esi + 0x54], al
mov al, byte [ebp + 0x14]
push ebx
push 8
mov dword [esi], vtable.SMP_HEAP.0
mov byte [esi + 0x55], 1
mov byte [esi + 0x56], al
mov word [esi + 0x34], bx
call fcn.100d57cc
push ebx
push ebx
push 0x14
mov ecx, esi
mov dword [esi + 0x38], eax
call fcn.100d57cc
push ebx
push ebx
push 8
mov ecx, esi
mov dword [esi + 0x3c], eax
call fcn.100d57cc
push ebx
push ebx
push 0xc
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
call fcn.100d57cc
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x48], eax
test ecx, ecx
je 0x100d78d1
cmp dword [esi + 0x3c], ebx
je 0x100d78d1
cmp dword [esi + 0x40], ebx
je 0x100d78d1
test eax, eax
je 0x100d78d1
mov dword [ecx + 4], ebx
mov dword [ecx], ebx
mov eax, dword [esi + 0x40]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov edi, dword [esi + 0x48]
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
setne cl
mov byte [edi], cl
je 0x100d78db
cmp eax, 0x40000000
jge 0x100d78db
lea eax, [eax*4 + 0xe10]
mov dword [edi + 8], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x34], 1
mov eax, esi
call fcn.1000140a
ret 0x14
mov ecx, str.No_TLS_available
call fcn.10047e8b
int3

Function at 0x100d7dbc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x100d7df6
mov eax, dword [esi + 0x48]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100d7de4
lea ecx, [eax + 8]
mov eax, dword [ecx]
pop esi
mov eax, dword [eax + 0xc]
pop ebp
jmp eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100d56ca
jmp 0x100d7df8
xor al, al
pop esi
pop ebp
ret 0xc
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40b720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40b72f
pop dword [ebp - 0x18]
mov eax, 0x40b72f
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x37abe
push 0
mov eax, 0xd280b94
add eax, 0xf318d58c
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xc492b371
sub ecx, 0xc4927218
mov edx, eax
mov ebx, 0x94a51d63
add ebx, 0x6b9c5a9d
add ebx, dword [ebp - 0x18]
mov esi, 0xa9c152b3
mov dword [ebp - 4], 0x6281c932
mov edi, dword [ebx]
xor dword [ebp - 4], 0x393af8c3
add edi, esi
sub dword [ebp - 0x10], ebx
mov dword [edx], edi
add dword [ebp - 0x14], 0x6db272c3
add edx, 4
add ebx, 4
loop 0x40b783
add eax, 0xe4cfcb47
sub eax, 0xe4ced310
mov ebx, eax
add eax, 5
mov ecx, 0x84bedb5a
add ecx, 0x7b8124a6
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x407e17
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407e86
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407e62
push ebx
push edi
push eax
call fcn.0040ba60
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407e7d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x419a2f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x419a3e
pop dword [ebp - 0x4c]
mov eax, 0xea1b92cb
sub eax, 0xe9d9f88d
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x408ce
push 0
mov eax, 0x36213589
sub eax, 0x35df535d
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4ff4f367
sub ecx, 0x4ff49fd8
mov edx, eax
mov esi, 0x43b200
add esi, dword [ebp - 0x4c]
mov ebx, 0xf09287bb
sub ebx, 0xb3ab3141
xor dword [ebp - 0x40], ecx
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
xor dword [ebp - 0x1c], 0xd3f9c23b
add edx, 0xa194b863
sub edx, 0xa194b85f
add esi, 0xe99d022d
sub esi, 0xe99d0229
loop 0x419a97
add eax, 0x5a07a3e5
add eax, 0xa5f99d2a
mov ebx, eax
add eax, 0xdbe38118
sub eax, 0xdbe38113
mov ecx, 0xc7e24c49
sub ecx, 0xc7a24c49
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4158d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x4158df
pop dword [ebp - 0x34]
mov eax, 0x53e30f1e
add eax, 0xac5e49c1
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x732258a8
add dword [ebp - 0x44], 0xdb2feca3
mov dword [ebp - 0x40], 0x5ec9f203
add dword [ebp - 0x40], 0xd3695a42
mov dword [ebp - 0x3c], 0x70920cc8
sub dword [ebp - 0x3c], 0x2445c89a
mov dword [ebp - 0x38], 0xe3f24d54
sub dword [ebp - 0x38], 0xe3f24d54
lea eax, [ebp - 0x44]
push eax
mov eax, 0xc9202de3
sub eax, 0xc8dccd2f
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9ffb102c
sub dword [ebp - 0x44], 0x2b88a6d6
mov dword [ebp - 0x40], 0x464a3a98
sub dword [ebp - 0x40], 0x4ddd923
mov dword [ebp - 0x3c], 0x60542d31
sub dword [ebp - 0x3c], 0xfce4c0c5
mov dword [ebp - 0x38], 0x3b37efaa
sub dword [ebp - 0x38], 0x3b37efaa
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xec1e06ae
add eax, 0x14255a9e
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3fa79
push 0
call eax
mov ecx, 0x58ab
mov edx, eax
mov ebx, 0x446000
add ebx, dword [ebp - 0x34]
mov esi, 0x965fcaef
mov edi, dword [ebx]
add dword [ebp - 0x30], ebx
add edi, esi
mov dword [edx], edi
xor dword [ebp - 0x2c], 0x666f1a34
add edx, 4
add ebx, 4
loop 0x4159ef
add eax, 0x1557f
xor ebx, ebx
add ebx, eax
add eax, 0xe050becb
sub eax, 0xe050bec6
mov ecx, 0x314c7cf1
sub ecx, 0x310c7cf1
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x416dc0
Capabilities:
Hash data using sha1

Disassembly:
call fcn.0040de00
add eax, 0xfffffffd
cmp eax, 0x25
ja case.0x416dd4.8
movzx eax, byte [eax + 0x416e5c]
jmp dword [eax*4 + 0x416e48]
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x41bff8
jmp 0x416e1a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x41aec0
jmp 0x416e1a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x419e10
jmp 0x416e1a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x416d90
jmp 0x416e1a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x40a940
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x1000ce60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000ce6f
pop dword [ebp - 0x4c]
mov eax, 0xeac798d9
add eax, 0x25393596
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3d6ae
push 0
mov eax, 0x8936b7f0
add eax, 0x86caa950
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xd4b0ab73
sub ecx, 0xd4b0570f
mov ebx, eax
mov esi, 0xdb37d97d
add esi, 0x34ca6a83
add esi, dword [ebp - 0x4c]
mov edi, 0x3acc9c5f
sub edi, 0x6f429610
sub dword [ebp - 0x2c], edi
mov edx, dword [esi]
add dword [ebp - 4], ecx
sub edx, edi
xor dword [ebp - 0x10], 0x3a8af2b8
mov dword [ebx], edx
sub dword [ebp - 0x40], edx
add ebx, 4
add esi, 0x9e46b8b6
sub esi, 0x9e46b8b2
loop 0x1000cece
add eax, 0xdc7b4033
add eax, 0x23860430
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbd4cfd2b
add ecx, 0x52b302d5
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4070d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4070e3
pop dword [ebp - 0x28]
mov eax, 0x4070e3
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x1cfa6311
sub dword [ebp - 0x38], 0xcea81dc6
mov dword [ebp - 0x34], 0xb689779f
add dword [ebp - 0x34], 0x7ba9d4a6
mov dword [ebp - 0x30], 0x36c1ac
sub dword [ebp - 0x30], 0xb3ea7d7e
mov dword [ebp - 0x2c], 0x5e111fdf
sub dword [ebp - 0x2c], 0x5e111fdf
lea eax, [ebp - 0x38]
push eax
mov eax, 0x3e95ce18
add eax, 0xc1aab2ec
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd4c74295
add dword [ebp - 0x38], 0x9fab26c1
mov dword [ebp - 0x34], 0x61506b34
add dword [ebp - 0x34], 0xe01bf641
mov dword [ebp - 0x30], 0x71dae930
sub dword [ebp - 0x30], 0xe6b7cc4
mov dword [ebp - 0x2c], 0xf58ddaa0
sub dword [ebp - 0x2c], 0xf58ddaa0
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38f14
push 0
call eax
mov ecx, 0x2e232419
sub ecx, 0x2e22d48f
mov edx, eax
mov esi, 0xf5606831
add esi, 0xae4d9cf
add esi, dword [ebp - 0x28]
mov ebx, 0xc7d829f5
mov edi, dword [esi]
xor edi, ebx
xor dword [ebp - 0x10], ecx
mov dword [edx], edi
mov dword [ebp - 0x20], 0x8379df34
add edx, 4
add esi, 4
loop 0x4071f5
add eax, 0x353aa985
sub eax, 0x3539788a
xor ebx, ebx
add ebx, eax
add eax, 0xf16a2dd0
sub eax, 0xf16a2dcb
mov ecx, 0xc802b9af
sub ecx, 0xc7c2b9af
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x6d301a40
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d301a8e
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d301a9f
push 0xd
pop eax
jmp 0x6d301ac9
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d301aa2
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d301fbb
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7b0]
sub esp, 0x830
mov eax, dword [0x6d33e258]
xor eax, ebp
mov dword [ebp + 0x7ac], eax
push esi
xor esi, esi
push 0x20019
push 0x6d32f894
push SysReAllocString
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
call fcn.6d32a027
test eax, eax
je 0x6d30202f
lea ecx, [ebp - 0x64]
call fcn.6d30196e
lea ecx, [ebp - 0x7c]
call fcn.6d30196e
lea ecx, [ebp - 0x70]
call fcn.6d30196e
jmp 0x6d302120
push edi
mov edi, str.CAFEEFAC_DEC7_0000_0001_ABCDEFFEDCBA
push edi
lea ecx, [ebp - 0x70]
call fcn.6d3023c7
push esi
push esi
push 0x2001f
push esi
push esi
push edi
push dword [ebp - 0x70]
lea ecx, [ebp - 0x7c]
call fcn.6d32a027
test eax, eax
je 0x6d302074
lea ecx, [ebp - 0x64]
call fcn.6d30196e
lea ecx, [ebp - 0x7c]
call fcn.6d30196e
lea ecx, [ebp - 0x70]
call fcn.6d30196e
jmp 0x6d30211f
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
push 4
pop ebx
push ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push esi
push 0x6d33c078
push dword [ebp - 0x7c]
mov dword [ebp - 0x58], esi
call edi
lea ecx, [ebp - 0x64]
test eax, eax
jne 0x6d302109
push esi
push esi
push 0x2001f
push esi
push esi
push str.InprocServer32
push dword [ebp - 0x7c]
call fcn.6d32a027
test eax, eax
jne 0x6d302106
push 0x800
lea eax, [ebp - 0x54]
push eax
push dword [0x6d343750]
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
je 0x6d302106
push ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push esi
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x64]
mov dword [ebp - 0x58], esi
call edi
test eax, eax
jne 0x6d302106
push ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push esi
push str.Apartment
push dword [ebp - 0x64]
mov dword [ebp - 0x58], str.ThreadingModel
call edi
test eax, eax
jne 0x6d302106
mov dword [ebp - 0x80], 1
lea ecx, [ebp - 0x64]
call fcn.6d30196e
lea ecx, [ebp - 0x7c]
call fcn.6d30196e
lea ecx, [ebp - 0x70]
call fcn.6d30196e
pop ebx
pop edi
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x7ac]
neg eax
sbb eax, eax
and eax, 0x7ffbfdff
xor ecx, ebp
add eax, 0x80040201
pop esi
call fcn.6d31a065
add ebp, 0x7b0
leave
ret
Function at 0x6d3023c7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d33e258]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d32a027
mov ebx, eax
cmp ebx, esi
je 0x6d30243a
lea ecx, [ebp - 0x74]
call fcn.6d30196e
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d31a065
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d302452
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d3023c7
cmp eax, esi
jne 0x6d302484
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x6d302442
lea ecx, [ebp - 0x74]
call fcn.6d30196e
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d3018ff
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d30196e
mov eax, esi
jmp 0x6d302420
Function at 0x6d304ece
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x6d304ed8
lea esi, [ecx - 0x78]
jmp 0x6d304eda
xor esi, esi
lea eax, [esi + 0x8c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x6d304ef6
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x6d3060bd
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x6d3060cf
add eax, 0xffffff84
jmp 0x6d3060d1
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x6d32ffe4
lea ecx, [eax + 4]
call fcn.6d304ba0
test eax, eax
js 0x6d30613a
cmp dword [ebp + 8], 0
je 0x6d306137
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x6d30610f
inc edi
push 0x11
call esi
test ax, ax
jns 0x6d30611b
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x6d306127
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x6d30613a
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x6d306150
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x6d308b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x790]
sub esp, 0x810
mov eax, dword [0x6d33e258]
xor eax, ebp
mov dword [ebp + 0x78c], eax
mov eax, dword [ebp + 0x79c]
push esi
mov esi, dword [ebp + 0x7a0]
push edi
test eax, eax
jne 0x6d308bc1
xor edi, edi
jmp 0x6d308bde
cmp word [eax], 8
jne 0x6d308c9a
push dword [eax + 8]
call fcn.6d30b748
mov edi, eax
pop ecx
test edi, edi
je 0x6d308c9a
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push 0x6d330364
lea eax, [ebp + 0x38c]
push 0x6d330388
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
push 0x6d33038c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d308c62
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0x6d3303b8
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], 0
jne 0x6d308c62
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x38c]
push 0x6d3303c4
push eax
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x38c]
push eax
push edi
call fcn.6d30e197
push edi
mov ebx, eax
call fcn.6d32a027
add esp, 0x10
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0xb
pop eax
mov word [esi], ax
xor eax, eax
cmp ebx, 1
setne al
pop ebx
dec eax
mov dword [esi + 8], eax
xor eax, eax
jmp 0x6d308c9f
mov eax, 0x80070057
mov ecx, dword [ebp + 0x78c]
pop edi
xor ecx, ebp
pop esi
call fcn.6d31a065
add ebp, 0x790
leave
ret 0xc
Function at 0x6d308cb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x790]
sub esp, 0x810
mov eax, dword [0x6d33e258]
xor eax, ebp
mov dword [ebp + 0x78c], eax
push ebx
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push str.http:__java.com_inc_dtoolkit.xml
lea eax, [ebp + 0x38c]
push 0x6d3303ec
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x6d3303f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d308d5d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push str.URLOverride
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], ebx
jne 0x6d308d5d
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x38c]
push 0x6d330428
push eax
call edi
add esp, 0xc
push ebx
lea eax, [ebp + 0x38c]
push eax
push ebx
call fcn.6d30e197
add esp, 0xc
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [ebp + 0x78c]
push 0xb
pop eax
mov word [esi], ax
xor eax, eax
cmp edi, 1
setne al
pop edi
xor ecx, ebp
dec eax
mov dword [esi + 8], eax
pop esi
xor eax, eax
pop ebx
call fcn.6d31a065
add ebp, 0x790
leave
ret 8
Function at 0x6d30b555
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x6d33e258]
xor eax, ebp
mov dword [ebp + 0x2a4], eax
mov eax, dword [ebp + 0x2b0]
push ebx
push esi
push edi
mov esi, 0x104
push esi
mov dword [ebp - 0x7c], eax
xor edi, edi
lea eax, [ebp + 0x9c]
push edi
push eax
call fcn.6d31a0b0
push esi
lea eax, [ebp + 0x1a0]
push edi
push eax
call fcn.6d31a0b0
push esi
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.6d31a0b0
mov dword [ebp - 0x78], edi
xor eax, eax
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x9c]
push eax
push str.CLSID08B0E5C0_4FCB_11CF_AAA5_00401C608501TreatAs
mov ebx, SysReAllocString
push ebx
mov dword [ebp - 0x80], esi
call edi
test eax, eax
jne 0x6d30b724
push 0x6d330af4
lea eax, [ebp + 0x1a0]
push esi
push eax
call fcn.6d32a027
push 0x6d330afc
lea eax, [ebp + 0x1a0]
push esi
push eax
call fcn.6d32a027
lea eax, [ebp + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push esi
push eax
call fcn.6d32a027
push 0x6d330b00
lea eax, [ebp + 0x1a0]
push esi
push eax
call fcn.6d32a027
push 0x6d330b04
lea eax, [ebp + 0x1a0]
push esi
push eax
call fcn.6d32a027
add esp, 0x3c
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x1a0]
push eax
push ebx
mov dword [ebp - 0x80], esi
call edi
test eax, eax
jne 0x6d30b724
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x6d30b724
lea eax, [ebp + 0x9c]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x6d30b68b
xor eax, eax
jmp 0x6d30b6a5
lea eax, [edi + edi]
call fcn.6d31a080
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x9c]
push ecx
push eax
call fcn.6d32a027
lea ecx, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov edi, eax
movzx eax, byte [ebp - 0x6f]
push 0x10
cdq
pop ecx
idiv ecx
lea ecx, [eax + edx]
test edi, edi
jne 0x6d30b724
movzx eax, word [ebp - 0x74]
test ecx, ecx
je 0x6d30b6f8
push ecx
movzx ecx, word [ebp - 0x72]
push ecx
mov ecx, eax
and ecx, 0x8000000f
jns 0x6d30b6e0
dec ecx
or ecx, 0xfffffff0
inc ecx
push ecx
shr eax, 4
push eax
push str._1d._1d._1d__02d
push esi
push dword [ebp - 0x7c]
call fcn.6d32a027
add esp, 0x1c
jmp 0x6d30b72a
movzx ecx, word [ebp - 0x72]
push ecx
mov ecx, eax
and ecx, 0x8000000f
jns 0x6d30b70c
dec ecx
or ecx, 0xfffffff0
inc ecx
push ecx
shr eax, 4
push eax
push str._1d._1d._1d
push esi
push dword [ebp - 0x7c]
call fcn.6d32a027
add esp, 0x18
jmp 0x6d30b72a
mov eax, dword [ebp - 0x7c]
mov byte [eax], 0
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2a4]
xor ecx, ebp
call fcn.6d31a065
add ebp, 0x2a8
leave
ret