joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444b8b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
test bl, 0x1f
je 0x444d9b
mov eax, dword [esi + 0x18]
push ebp
push edi
test eax, eax
je 0x444d29
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x444d29
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, ebx
and edi, 0x10
mov cl, 0x80
je 0x444bde
or byte [esp + 0x77], cl
mov eax, ebx
and eax, 2
mov dword [esp + 0x14], eax
je 0x444bf4
or byte [esp + 0x2c], cl
or byte [esp + 0xbc], cl
mov eax, ebx
and eax, 4
mov dword [esp + 0x18], eax
je 0x444c0a
or byte [esp + 0x2c], cl
or byte [esp + 0xbd], cl
mov eax, ebx
and eax, 8
mov dword [esp + 0x10], eax
je 0x444c19
or byte [esp + 0x2d], cl
mov ebp, ebx
and ebp, 1
je 0x444c24
or byte [esp + 0x2e], cl
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
test edi, edi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
je 0x444c51
movzx edx, byte [esi + 0x21]
mov eax, dword [esi + 0x18]
shl edx, 0x10
or edx, 1
push edx
push 0x5b
push 0x100
push eax
call edi
cmp dword [esp + 0x14], 0
je 0x444c73
movzx ecx, byte [esi + 0x1f]
mov edx, dword [esi + 0x18]
shl ecx, 0x10
or ecx, 1
push ecx
push 0xa0
push 0x100
push edx
call edi
cmp dword [esp + 0x18], 0
je 0x444c92
movzx eax, byte [esi + 0x20]
mov ecx, dword [esi + 0x18]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push ecx
call edi
cmp dword [esp + 0x10], 0
je 0x444cb1
movzx edx, byte [esi + 0x1c]
mov eax, dword [esi + 0x18]
shl edx, 0x10
or edx, 1
push edx
push 0x11
push 0x100
push eax
call edi
test ebp, ebp
je 0x444d93
cmp dword [esp + 0x10], 0
jne 0x444cf6
test ebx, 0x800
jne 0x444cf6
movzx ecx, byte [esi + 0x1d]
mov edx, dword [esi + 0x18]
shl ecx, 0x10
or ecx, 0x20000001
push ecx
push 0x12
push 0x104
push edx
call edi
push esi
call fcn.004374ab
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 8
test ebp, ebp
je 0x444d93
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x18]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push ecx
call edi
push esi
call fcn.004374ab
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 8
test bl, 0x10
je 0x444d3d
movzx edx, byte [esi + 0x21]
push 0
push edx
push 0x5b
push esi
call fcn.00437335
test bl, 2
je 0x444d54
movzx eax, byte [esi + 0x1f]
push 0
push eax
push 0xa0
push esi
call fcn.00437335
test bl, 4
je 0x444d6b
movzx ecx, byte [esi + 0x20]
push 0
push ecx
push 0xa1
push esi
call fcn.00437335
test bl, 8
je 0x444d7f
movzx edx, byte [esi + 0x1c]
push 0
push edx
push 0x11
push esi
call fcn.00437335
test bl, 1
je 0x444d93
movzx eax, byte [esi + 0x1d]
push 0
push eax
push 0x12
push esi
call fcn.00437335
push esi
call fcn.004374ab
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x444da6
Capabilities:
Log keystrokes via polling

Disassembly:
mov al, byte [esp + 8]
sub esp, 0x100
push ebx
push esi
mov esi, dword [esp + 0x10c]
test al, 1
je 0x444dc1
or dword [esi + 0x14], 2
test al, 2
je 0x444dc9
or dword [esi + 0x14], 8
test al, 4
je 0x444dd1
or dword [esi + 0x14], 1
mov eax, dword [esi + 0x14]
test al, 8
je 0x444de5
test eax, 0x800
je 0x444de5
xor eax, 8
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
test al, 1
je 0x444df9
test eax, 0x100
je 0x444df9
xor eax, 1
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
test al, 2
je 0x444e0d
test eax, 0x200
je 0x444e0d
xor eax, 2
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
test al, 0x10
je 0x444e21
test eax, 0x1000
je 0x444e21
xor eax, 0x10
mov dword [esi + 0x14], eax
xor ebx, ebx
cmp dword [esi + 0x18], ebx
je 0x444e83
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esi, dword [esi + 0x14]
test esi, 0x800
jne 0x444e42
mov byte [esp + 0x19], bl
test esi, 0x100
jne 0x444e4e
mov byte [esp + 0x1a], bl
test esi, 0x200
jne 0x444e61
mov byte [esp + 0x18], bl
mov byte [esp + 0xa8], bl
test esi, 0x1000
jne 0x444e6d
mov byte [esp + 0x63], bl
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
pop esi
pop ebx
add esp, 0x100
ret 8
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
test dx, ax
jne 0x444ead
push 0x11
call ebp
mov ecx, 0x8000
test cx, ax
je 0x444ec0
test dword [esi + 0x14], 0x800
jne 0x444ec0
push ebx
push ebx
push 0x11
push esi
call fcn.00444645
push 0x12
call edi
mov edx, 0x8000
test dx, ax
jne 0x444edc
push 0x12
call ebp
mov ecx, 0x8000
test cx, ax
je 0x444eef
test dword [esi + 0x14], 0x100
jne 0x444eef
push ebx
push ebx
push 0x12
push esi
call fcn.00444645
push 0xa0
call edi
mov edx, 0x8000
test dx, ax
jne 0x444f11
push 0xa0
call ebp
mov ecx, 0x8000
test cx, ax
je 0x444f27
test dword [esi + 0x14], 0x200
jne 0x444f27
push ebx
push ebx
push 0xa0
push esi
call fcn.00444645
push 0xa1
call edi
mov edx, 0x8000
test dx, ax
jne 0x444f49
push 0xa1
call ebp
mov ecx, 0x8000
test cx, ax
je 0x444f5f
test dword [esi + 0x14], 0x400
jne 0x444f5f
push ebx
push ebx
push 0xa1
push esi
call fcn.00444645
push 0x5b
call edi
mov edx, 0x8000
test dx, ax
jne 0x444f7b
push 0x5b
call ebp
mov ecx, 0x8000
test cx, ax
je 0x444f8e
test dword [esi + 0x14], 0x1000
jne 0x444f8e
push ebx
push ebx
push 0x5b
push esi
call fcn.00444645
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x100
ret 8
Function at 0x445075
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
movzx edi, byte [esp + 0x14]
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [esp + 0x18], bl
je 0x4450ce
push ebp
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0
push edi
call ebp
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.00437335
push esi
call fcn.004374ab
push 2
push 0
push edi
call ebp
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push esi
call fcn.00437335
push esi
call fcn.004374c2
pop ebp
pop edi
pop esi
mov al, bl
pop ebx
ret 0xc

Function at 0x4451d3
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
lea ecx, [eax + 4]
push edi
mov edi, dword [eax + edx]
mov dword [esi], ecx
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004114ca
mov ebx, eax
mov eax, dword [esi]
add eax, dword [esp + 0x18]
lea ebp, [edi + edi]
push ebp
push eax
push ebx
call fcn.00410d20
add dword [esi], ebp
xor ecx, ecx
add esp, 0x10
xor eax, eax
mov word [ebx + ebp], cx
test edi, edi
jle 0x44522f
xor word [ebx + eax*2], di
inc eax
cmp eax, edi
jl 0x445226
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 8

Function at 0x4457f2
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x44580e
mov eax, dword [esp + 0x10]
cmp byte [eax + 5], 1
jne 0x445866
push 0
push 0
push 0xe
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jne 0x445826
mov edi, 0x7fff
push ebp
xor ecx, ecx
lea ebp, [edi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004114ca
add esp, 4
mov esi, eax
push esi
push ebp
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov word [esi + edi*2], cx
pop ebp
test eax, eax
jg 0x445871
push esi
call fcn.0041109f
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov edi, dword [esp + 0x10]
cmp byte [edi + 0xc], 0
jne 0x44588c
push esi
call fcn.00411085
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [edi + 0x24]
push eax
push esi
call fcn.00413522
add esp, 8
push esi
test eax, eax
je 0x44585e
mov byte [edi + 0xf0], 1
call fcn.0041109f
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x445dd2
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
push edi
push 1
push eax
call fcn.00445a2b
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x25
call ebx
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x18], 0
push eax
jge 0x445e35
mov ecx, dword [esi]
push 0x25
push 0x100
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov edx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
push 0x101
push edx
jmp 0x445e64
mov eax, dword [esi]
push 0x27
push 0x100
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov ecx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push ecx
call ebp
push 0
call edi
mov edx, dword [esi]
push 0
push edx
call fcn.00445a2b
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x447949
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
push 0x4a73d8
call fcn.00433a0e
mov ecx, dword [0x4a7438]
mov edx, dword [ecx + eax*4]
mov edi, dword [edx]
cmp ebx, esi
jne 0x4479d0
cmp dword [edi + 0x194], 0
je 0x4479ac
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edi + 0x194]
push 0
push esi
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
movzx edx, word [esp + 0x28]
movzx eax, word [esp + 0x24]
shl edx, 0x10
or edx, eax
push edx
push ebx
push 0x7b
push esi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
push ebx
push 0x4a73d8
call fcn.00441deb
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4479ac
mov ecx, dword [0x4a744c]
mov edx, dword [ecx + ebp*4]
mov ecx, dword [edx]
mov al, byte [ecx + 0x88]
cmp al, 0xe
je 0x4479ac
cmp al, 0xf
je 0x4479ac
cmp al, 0x13
je 0x4479ac
cmp al, 0x10
je 0x4479ac
cmp dword [ecx + 8], 0
je 0x4479ac
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push ecx
mov ecx, dword [0x4a744c]
push edx
mov edx, dword [ecx + ebp*4]
push eax
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x448e59
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
push 0x4a73d8
call fcn.00441d65
test al, al
je case.0x448ee2.8
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4a7438]
mov edx, dword [ecx + eax*4]
mov eax, dword [esp + 0x14]
mov ebx, dword [edx]
mov ecx, dword [0x4a744c]
mov edx, dword [ecx + eax*4]
mov esi, dword [edx]
mov al, byte [esi + 0x88]
mov edi, dword [esi]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x24], al
call fcn.00435467
mov eax, dword [esi + 0x44]
add esp, 4
test eax, eax
jl 0x448ec9
push eax
call fcn.00441617
movzx eax, byte [esp + 0x20]
cmp eax, 0x1b
ja case.0x448ee2.8
movzx edx, byte [eax + 0x449089]
mov ebp, dword [esp + 0x24]
jmp dword [edx*4 + 0x449065]
mov ebp, dword [esp + 0x24]
cmp ebp, 0xfffffffe
je case.0x448ee2.8
cmp ebp, 0xfe000000
jne 0x448f0e
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.004416a4
jmp 0x44902d
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push 0
push 0x1001
push edi
call ebx
push ebp
push 0
push 0x1026
push edi
call ebx
mov eax, dword [esp + 0x18]
push 1
push esi
push eax
call fcn.00433978
jmp 0x44902d
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x448ee2.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.004416a4
jmp 0x44902d
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x448ee2.8
push eax
push 0
push 0x2001
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44902d
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x448ee2.8
push eax
push 0
push 0x111d
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44902d
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x448ee2.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.004416a4
mov ecx, dword [esi + 0x30]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x44902d
test ebp, ebp
jl case.0x448ee2.8
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.004416a4
push 1
push esi
push ebx
call fcn.00433978
jmp 0x44902d
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
jl case.0x448ee2.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.004416a4
test byte [esi + 0x8a], 0x20
jne 0x44902d
mov edx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call edi
mov eax, dword [esi]
push 5
push eax
call edi
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [0x4962c4], 0
je 0x44904a
cmp byte [esp + 0x20], 8
jne 0x44904a
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x4499a7
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [esp + 4]
push ebp
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x4a73d8
xor ebp, ebp
call fcn.00441d65
test al, al
jne 0x4499d3
pop esi
xor eax, eax
pop ebp
ret 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [0x4a7438]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
mov ecx, dword [0x4a744c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + edx*4]
push ebx
mov ebx, dword [eax]
push edi
mov edi, dword [ebx]
cmp esi, 0xffffffff
je 0x449a79
movzx eax, byte [ebx + 0x88]
add eax, 0xfffffffe
cmp eax, 0x14
ja case.0x449a14.4
movzx ecx, byte [eax + 0x449b3b]
jmp dword [ecx*4 + 0x449b1f]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0xc
or esi, 0xe
jmp case.0x449a14.4
or esi, 3
jmp case.0x449a14.4
or esi, 4
push 0
test esi, 0x800
je 0x449a4b
push 1
push 0xcf
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x449a14.4
push 0
push 0xcf
push edi
or esi, 0x10000
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x449a14.4
or esi, 0x4000000
or esi, 0x50000000
push esi
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ebp, eax
mov esi, dword [esp + 0x1c]
cmp esi, 0xffffffff
je 0x449ab7
push esi
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [0x4a744c]
mov ebp, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [edx + eax*4]
mov edx, dword [ecx]
cmp byte [edx + 0x88], 0x13
jne 0x449ab7
push esi
push 0
push 0x1036
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, eax
mov al, byte [ebx + 0x8b]
cmp al, 0xff
je 0x449adb
mov ecx, dword [esp + 0x14]
movzx eax, al
cmp eax, dword [ecx + 0x184]
je 0x449adb
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x449ae8
mov edx, dword [esp + 0x14]
push 1
push ebx
push edx
call fcn.00433978
mov al, byte [ebx + 0x88]
cmp al, 2
je 0x449afb
cmp al, 3
je 0x449afb
cmp esi, 0xffffffff
je 0x449b10
mov eax, dword [ebx]
push 0x27
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop ebx
xor eax, eax
test ebp, ebp
pop esi
setne al
pop ebp
ret 0xc
Function at 0x44a9fd
Capabilities:
Connect to http server

Disassembly:
sub esp, 0xc
cmp byte [esp + 0x18], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
je 0x44aa29
mov eax, dword [esp + 0x2c]
push eax
push esi
push edi
call fcn.0044a8c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
mov ebp, dword [edi + 0x54]
push 0
push 0
push ebx
push eax
push ecx
movzx ecx, word [esi + 0x78]
push ecx
push edx
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44aa6e
push 0xdeadbeef
push 0x15
push edi
call fcn.0044241e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov esi, dword [esi + 0x60]
push ebp
push accept
push esi
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileW]
mov esi, eax
mov eax, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
test esi, esi
jne 0x44aa9c
push esi
push 0xdeadbeef
push 0x16
jmp 0x44aae5
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.WININET.dll_FtpGetFileSize]
mov edx, dword [esp + 0x28]
xor ecx, ecx
xor ebx, ebx
or ecx, eax
or edx, ebx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], edx
cmp byte [esp + 0x2c], bl
je 0x44aadf
push esi
push edi
call fcn.00442635
mov bl, al
lea eax, [esp + 0x14]
push eax
call fcn.004341fa
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
push 1
push 0
push 0
push edi
call fcn.0044241e
lea ecx, [esp + 0x14]
push ecx
mov bl, al
call fcn.004341fa
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret 0x10
Function at 0x44ab03
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
cmp dword [esi + 0x74], 4
push edi
mov edi, dword [esp + 0x40]
mov ebp, dword [edi + 0x54]
jne 0x44ab21
or ebp, 0x800000
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
push 0
push 0
push ebx
push eax
movzx eax, word [esi + 0x78]
push ecx
mov ecx, dword [edi + 4]
push eax
push edx
push ecx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44ab63
push 0xdeadbeef
push 0xb
push edi
call fcn.0044241e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ecx, dword [esi + 0x60]
push ebp
push 0
push 0
push 0
push ecx
push 0
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
test ebx, ebx
jne 0x44abb1
push eax
push 0xdeadbeef
push 0xc
push edi
call fcn.0044241e
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004341fa
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
cmp byte [esp + 0x48], 0
je 0x44abc0
push esi
push ebx
push edi
call fcn.0044265d
test ebp, 0x1000
je 0x44abfb
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0x1f
push ebx
mov dword [esp + 0x54], 4
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [esp + 0x48], 0x100
push 4
lea eax, [esp + 0x4c]
push eax
push 0x1f
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x44aca8
push ebx
call fcn.00434288
cmp eax, 0xc8
jne 0x44aca8
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x20]
push eax
push 5
push ebx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0x20
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea ecx, [esp + 0x18]
push ecx
call fcn.004131ec
add esp, 4
cmp byte [esp + 0x4c], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
je 0x44ac84
push ebx
push edi
call fcn.00442635
lea edx, [esp + 0x10]
push edx
mov bl, al
call fcn.004341fa
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 1
push 0
push 0
push edi
call fcn.0044241e
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004341fa
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 0
push 0xdeadbeef
push 0xd
push edi
call fcn.0044241e
lea ecx, [esp + 0x10]
push ecx
mov bl, al
call fcn.004341fa
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x2c
ret 0x10

Function at 0x44b090
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp + 0xe4]
push esi
push edi
mov edi, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push eax
call fcn.00442dc1
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00442d1b
xor esi, esi
test edi, edi
jbe 0x44b0e2
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call fcn.00442d93
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44b0d0
pop edi
pop esi
pop ebx
add esp, 0xdc
ret 0xc
Function at 0x44b39d
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
sub dword [0x49123c], 1
jne 0x44b3ac
call fcn.00442f71
mov ecx, dword [0x4a62e4]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a62e4], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
test edx, edx
jge 0x44b3f5
fadd qword [0x48b508]
fmul qword [0x48b510]
pop ecx
ret

Function at 0x44b856
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44b868
push eax
call fcn.0044b701
mov eax, dword [esi + 0x24]
pop esi
test eax, eax
je 0x44b879
mov dword [esp + 4], eax
jmp fcn.0044b701
ret 4

Function at 0x44b87c
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x20], 0
jne 0x44b8a6
push esi
call fcn.00434f7e
test al, al
je 0x44b8a6
mov eax, dword [esi + 8]
push eax
call fcn.004433db
add esp, 4
push eax
mov dword [esi + 0x20], eax
call fcn.0044b76e
cmp dword [esi + 0x24], 0
jne 0x44b8d9
push esi
call fcn.00434f62
test al, al
je 0x44b8d9
push esi
call fcn.00434f52
test al, al
jne 0x44b8d9
mov ecx, dword [esi + 0x10]
push ecx
call fcn.004433db
add esp, 4
mov dword [esi + 0x24], eax
pop esi
mov dword [esp + 4], eax
jmp fcn.0044b76e
pop esi
ret 4

Function at 0x44bbd2
Capabilities:
Delete directory
Delete file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x22c
lea eax, [esp + 0x20]
call fcn.0040fd20
lea eax, [esp + 0x20]
push eax
call fcn.00436363
add esp, 4
test al, al
jne 0x44bbfd
add esp, 0x22c
ret
push ebx
xor ebx, ebx
cmp byte [esp + 0x238], bl
jne 0x44bc21
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x24]
push edx
call fcn.00411085
xor ecx, ecx
mov word [esp + eax*2 + 0x2a], cx
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x22c
ret