joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448daf
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
push 0x4a83d8
call fcn.0044213b
test al, al
je case.0x448e38.8
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4a8438]
mov edx, dword [ecx + eax*4]
mov eax, dword [esp + 0x14]
mov ebx, dword [edx]
mov ecx, dword [0x4a844c]
mov edx, dword [ecx + eax*4]
mov esi, dword [edx]
mov al, byte [esi + 0x88]
mov edi, dword [esi]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x24], al
call fcn.00435bc8
mov eax, dword [esi + 0x44]
add esp, 4
test eax, eax
jl 0x448e1f
push eax
call fcn.004419ed
movzx eax, byte [esp + 0x20]
cmp eax, 0x1b
ja case.0x448e38.8
movzx edx, byte [eax + 0x448fdf]
mov ebp, dword [esp + 0x24]
jmp dword [edx*4 + 0x448fbb]
mov ebp, dword [esp + 0x24]
cmp ebp, 0xfffffffe
je case.0x448e38.8
cmp ebp, 0xfe000000
jne 0x448e64
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.00441a7a
jmp 0x448f83
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push 0
push 0x1001
push edi
call ebx
push ebp
push 0
push 0x1026
push edi
call ebx
mov eax, dword [esp + 0x18]
push 1
push esi
push eax
call fcn.0043401c
jmp 0x448f83
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x448e38.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.00441a7a
jmp 0x448f83
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x448e38.8
push eax
push 0
push 0x2001
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x448f83
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x448e38.8
push eax
push 0
push 0x111d
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x448f83
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x448e38.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.00441a7a
mov ecx, dword [esi + 0x30]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x448f83
test ebp, ebp
jl case.0x448e38.8
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.00441a7a
push 1
push esi
push ebx
call fcn.0043401c
jmp 0x448f83
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
jl case.0x448e38.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.00441a7a
test byte [esi + 0x8a], 0x20
jne 0x448f83
mov edx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call edi
mov eax, dword [esi]
push 5
push eax
call edi
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [0x4972c4], 0
je 0x448fa0
cmp byte [esp + 0x20], 8
jne 0x448fa0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x44a919
Capabilities:
Connect to http server

Disassembly:
sub esp, 0xc
cmp byte [esp + 0x18], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
je 0x44a945
mov eax, dword [esp + 0x2c]
push eax
push esi
push edi
call fcn.0044a7dc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
mov ebp, dword [edi + 0x54]
push 0
push 0
push ebx
push eax
push ecx
movzx ecx, word [esi + 0x78]
push ecx
push edx
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44a98a
push 0xdeadbeef
push 0x15
push edi
call fcn.0044286a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov esi, dword [esi + 0x60]
push ebp
push accept
push esi
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileW]
mov esi, eax
mov eax, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
test esi, esi
jne 0x44a9b8
push esi
push 0xdeadbeef
push 0x16
jmp 0x44aa01
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.WININET.dll_FtpGetFileSize]
mov edx, dword [esp + 0x28]
xor ecx, ecx
xor ebx, ebx
or ecx, eax
or edx, ebx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], edx
cmp byte [esp + 0x2c], bl
je 0x44a9fb
push esi
push edi
call fcn.00442a81
mov bl, al
lea eax, [esp + 0x14]
push eax
call fcn.004349c7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
push 1
push 0
push 0
push edi
call fcn.0044286a
lea ecx, [esp + 0x14]
push ecx
mov bl, al
call fcn.004349c7
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret 0x10
Function at 0x44aa1f
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
cmp dword [esi + 0x74], 4
push edi
mov edi, dword [esp + 0x40]
mov ebp, dword [edi + 0x54]
jne 0x44aa3d
or ebp, 0x800000
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
push 0
push 0
push ebx
push eax
movzx eax, word [esi + 0x78]
push ecx
mov ecx, dword [edi + 4]
push eax
push edx
push ecx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44aa7f
push 0xdeadbeef
push 0xb
push edi
call fcn.0044286a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ecx, dword [esi + 0x60]
push ebp
push 0
push 0
push 0
push ecx
push 0
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
test ebx, ebx
jne 0x44aacd
push eax
push 0xdeadbeef
push 0xc
push edi
call fcn.0044286a
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004349c7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
cmp byte [esp + 0x48], 0
je 0x44aadc
push esi
push ebx
push edi
call fcn.00442aa9
test ebp, 0x1000
je 0x44ab17
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0x1f
push ebx
mov dword [esp + 0x54], 4
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [esp + 0x48], 0x100
push 4
lea eax, [esp + 0x4c]
push eax
push 0x1f
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x44abc4
push ebx
call fcn.00434a55
cmp eax, 0xc8
jne 0x44abc4
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x20]
push eax
push 5
push ebx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0x20
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea ecx, [esp + 0x18]
push ecx
call fcn.0041343c
add esp, 4
cmp byte [esp + 0x4c], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
je 0x44aba0
push ebx
push edi
call fcn.00442a81
lea edx, [esp + 0x10]
push edx
mov bl, al
call fcn.004349c7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 1
push 0
push 0
push edi
call fcn.0044286a
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004349c7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 0
push 0xdeadbeef
push 0xd
push edi
call fcn.0044286a
lea ecx, [esp + 0x10]
push ecx
mov bl, al
call fcn.004349c7
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x2c
ret 0x10

Function at 0x44afdc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp + 0xe4]
push esi
push edi
mov edi, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push eax
call fcn.004431e0
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0044313a
xor esi, esi
test edi, edi
jbe 0x44b02e
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call fcn.004431b2
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44b01c
pop edi
pop esi
pop ebx
add esp, 0xdc
ret 0xc
Function at 0x44b7a4
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44b7b6
push eax
call fcn.0044b64f
mov eax, dword [esi + 0x24]
pop esi
test eax, eax
je 0x44b7c7
mov dword [esp + 4], eax
jmp fcn.0044b64f
ret 4

Function at 0x44b7ca
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x20], 0
jne 0x44b7f4
push esi
call fcn.0043572f
test al, al
je 0x44b7f4
mov eax, dword [esi + 8]
push eax
call fcn.004437fa
add esp, 4
push eax
mov dword [esi + 0x20], eax
call fcn.0044b6bc
cmp dword [esi + 0x24], 0
jne 0x44b827
push esi
call fcn.00435713
test al, al
je 0x44b827
push esi
call fcn.00435703
test al, al
jne 0x44b827
mov ecx, dword [esi + 0x10]
push ecx
call fcn.004437fa
add esp, 4
mov dword [esi + 0x24], eax
pop esi
mov dword [esp + 4], eax
jmp fcn.0044b6bc
pop esi
ret 4

Function at 0x44bb20
Capabilities:
Delete directory
Delete file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x22c
lea eax, [esp + 0x20]
call fcn.0040ffb0
lea eax, [esp + 0x20]
push eax
call fcn.00436ac4
add esp, 4
test al, al
jne 0x44bb4b
add esp, 0x22c
ret
push ebx
xor ebx, ebx
cmp byte [esp + 0x238], bl
jne 0x44bb6f
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x24]
push edx
call fcn.004112d5
xor ecx, ecx
mov word [esp + eax*2 + 0x2a], cx
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x22c
ret
Function at 0x44bbc9
Capabilities:
Copy file
Move file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x438
push ebx
mov bl, byte [esp + 0x448]
lea eax, [esp + 0x230]
call fcn.0040ffb0
mov ecx, dword [esp + 0x444]
lea eax, [esp + 0x24]
call fcn.0040ffb0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44bc48
test bl, bl
je 0x44bc71
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x234]
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x44bc3e
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
pop ebx
add esp, 0x438
ret
lea eax, [esp + 0x230]
push eax
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bc71
lea ecx, [esp + 0x24]
push ecx
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bc7b
test bl, bl
jne 0x44bc9d
xor al, al
pop ebx
add esp, 0x438
ret
lea edx, [esp + 0x24]
push edx
call fcn.004366be
add esp, 4
test al, al
je 0x44bc71
lea eax, [esp + 0x24]
push eax
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bc71
lea ecx, [esp + 0x230]
push str..
push ecx
call fcn.00411663
lea edx, [esp + 0x238]
push edx
call fcn.004112d5
lea edx, [esp + 0x30]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x242], cx
call fcn.004112d5
xor ecx, ecx
mov word [esp + eax*2 + 0x36], cx
lea edx, [esp + 0x240]
lea eax, [esp + 0x34]
mov dword [esp + 0x1c], edx
add esp, 0x10
mov dword [esp + 0x10], eax
xor eax, eax
lea edx, [esp + 4]
mov ecx, 0x614
push edx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x438
ret
Function at 0x44bd29
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10b4
call fcn.00425210
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea eax, [esp + 0x438]
xor bl, bl
call fcn.0040ffb0
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x648]
call fcn.0040ffb0
lea eax, [esp + 0x648]
push eax
lea ecx, [esp + 0x43c]
push ecx
call fcn.00436a1d
lea edx, [esp + 0x440]
push edx
mov byte [esp + 0x1b], al
call fcn.00436ac4
add esp, 0xc
test al, al
je 0x44bd9e
lea eax, [esp + 0x438]
push str..
push eax
call fcn.00411663
add esp, 8
lea ecx, [esp + 0x648]
push ecx
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bdc7
lea edx, [esp + 0x648]
push str..
push edx
call fcn.00411663
add esp, 8
lea eax, [esp + 0xcb0]
push eax
lea ecx, [esp + 0xebc]
push ecx
lea edx, [esp + 0xab0]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x448]
push ecx
call fcn.00413db0
add esp, 0x14
lea edx, [esp + 0x858]
push edx
lea eax, [esp + 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov byte [esp + 0xe], 1
cmp esi, 0xffffffff
je 0x44bf7d
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp byte [esp + 0xe], 1
jne 0x44bf7d
test byte [esp + 0x858], 0x10
jne 0x44bf5d
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x64c]
push edx
lea eax, [esp + 0xcb8]
push eax
lea ecx, [esp + 0xec4]
push ecx
lea edx, [esp + 0x894]
push edx
call fcn.00436879
add esp, 0x14
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00411691
lea edx, [esp + 0xab0]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00411663
lea ecx, [esp + 0x894]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00411663
lea eax, [esp + 0x240]
push eax
call fcn.00436b22
add esp, 0x1c
test al, al
je 0x44bedb
cmp byte [ebp + 0x10], 0
je 0x44bf34
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x44bf44
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp + 0x14], 1
jne 0x44bf1f
cmp byte [esp + 0xf], 0
jne 0x44befd
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x44bf30
push 0
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
je 0x44bf34
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x44bf30
push 0
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
jne 0x44bf5b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x44bf34
mov bl, 1
lea ecx, [esp + 0x858]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44be20
mov byte [esp + 0xe], al
jmp 0x44be20
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44bf8d
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa88
mov ecx, dword [ebp + 8]
push ebx
push esi
lea eax, [esp + 0x18]
mov byte [esp + 0xf], 0
call fcn.0040ffb0
lea eax, [esp + 0x18]
push eax
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bfcf
lea ecx, [esp + 0x18]
push str..
push ecx
call fcn.00411663
add esp, 8
lea edx, [esp + 0x680]
push edx
lea eax, [esp + 0x88c]
push eax
lea ecx, [esp + 0x480]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00413db0
add esp, 0x14
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov bl, 1
cmp esi, 0xffffffff
je 0x44c094
cmp bl, 1
jne 0x44c094
test byte [esp + 0x228], 0x10
jne 0x44c06e
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x17], bl
call fcn.00411691
lea edx, [esp + 0x480]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00411663
lea ecx, [esp + 0x264]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00411663
add esp, 0x18
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x44c085
lea ecx, [esp + 0x228]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44c015
xor bl, bl
jmp 0x44c015
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [esp + 0xf]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c379
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x124
push ebx
push ebp
mov ebp, dword [esp + 0x130]
cmp dword [ebp + 0x20], 0
push esi
push edi
mov edi, dword [esp + 0x13c]
mov bl, byte [edi]
mov al, byte [edi + 7]
movzx esi, word [edi + 8]
mov byte [esp + 0x10], bl
mov byte [esp + 0x14], al
je 0x44c47e
cmp bl, 0x14
je 0x44c47e
cmp bl, 0x90
je 0x44c47e
cmp bl, 0x91
je 0x44c47e
push edi
call fcn.00437a22
test al, al
je 0x44c50f
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
movzx ebx, bl
xor byte [esp + ebx + 0x34], 0x80
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx esi, byte [esp + 0x14]
shl esi, 0x10
push edi
or esi, 0xc0000001
call fcn.00444ef7
cmp al, 1
jne 0x44c411
or esi, 0x1000000
cmp byte [ebp + 0x17], 0
jne 0x44c424
cmp byte [ebp + 0x1d], 0
jne 0x44c424
cmp byte [esp + 0x10], 0x12
jne 0x44c45a
cmp byte [ebp + 0x16], 0
jne 0x44c45a
cmp byte [ebp + 0x1c], 0
jne 0x44c45a
mov eax, dword [ebp + 0x20]
or esi, 0x20000000
push esi
push ebx
push 0x105
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
mov ecx, dword [ebp + 0x20]
push esi
push ebx
push 0x101
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
push edi
call fcn.00437a22
test al, al
je 0x44c4dc
push edi
call fcn.00444ef7
cmp al, 1
jne 0x44c4b7
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 3
push edx
push eax
push ebp
call fcn.004378b5
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 2
push ecx
push edx
push ebp
call fcn.004378b5
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
push 0x1c
lea ecx, [esp + 0x1c]
xor eax, eax
push ecx
push 1
mov dword [esp + 0x24], 1
mov word [esp + 0x28], ax
mov word [esp + 0x2a], si
mov dword [esp + 0x2c], 6
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_SendInput]
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
Function at 0x44c522
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x128
push ebx
push ebp
mov ebp, dword [esp + 0x134]
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, dword [esp + 0x140]
movzx ecx, word [edi + 8]
mov bl, byte [edi]
mov al, byte [edi + 7]
mov byte [esp + 0x14], bl
mov byte [esp + 0x10], al
mov dword [esp + 0x18], ecx
test esi, esi
je 0x44c650
cmp bl, 0x14
je 0x44c650
cmp bl, 0x90
je 0x44c650
cmp bl, 0x91
je 0x44c650
push edi
call fcn.00437a22
test al, al
je 0x44c629
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
movzx ebx, bl
or byte [esp + ebx + 0x38], 0x80
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx esi, byte [esp + 0x10]
shl esi, 0x10
push edi
or esi, 1
call fcn.00444ef7
cmp al, 1
jne 0x44c5bc
or esi, 0x1000000
cmp byte [ebp + 0x17], 0
jne 0x44c5cf
cmp byte [ebp + 0x1d], 0
jne 0x44c5cf
cmp byte [esp + 0x14], 0x12
jne 0x44c605
cmp byte [ebp + 0x16], 0
jne 0x44c605
cmp byte [ebp + 0x1c], 0
jne 0x44c605
mov ecx, dword [ebp + 0x20]
or esi, 0x20000000
push esi
push ebx
push 0x104
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.0043792a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 8
mov edx, dword [ebp + 0x20]
push esi
push ebx
push 0x100
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.0043792a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 8
movzx eax, word [esp + 0x18]
push 1
push eax
push 0x102
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.0043792a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 8
push edi
call fcn.00437a22
test al, al
je 0x44c6ae
push edi
call fcn.00444ef7
cmp al, 1
jne 0x44c689
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 1
push ecx
push edx
push ebp
call fcn.004378b5
push ebp
call fcn.0043792a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push eax
push ecx
push ebp
call fcn.004378b5
push ebp
call fcn.0043792a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 8
mov ax, word [esp + 0x18]
push 0x1c
lea ecx, [esp + 0x20]
mov word [esp + 0x26], ax
xor eax, eax
push ecx
xor edx, edx
push 1
mov dword [esp + 0x28], 1
mov word [esp + 0x2c], dx
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_SendInput]
push ebp
call fcn.0043792a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 8
Function at 0x44c718
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
mov byte [esi + 7], 0
mov byte [esi], 0xff
push edi
mov edi, dword [esp + 0x10]
mov byte [esi + 1], 0
mov byte [esi + 2], 0
mov byte [esi + 3], 0
mov byte [esi + 4], 0
mov byte [esi + 5], 0
mov byte [esi + 6], 0
push esi
mov byte [esi + 0xa], 0
mov word [esi + 8], di
call fcn.00437a12
test al, al
je 0x44c763
push edi
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
jne 0x44c76a
xor al, al
pop edi
pop esi
ret 8
push ebx
mov ebx, eax
mov byte [esi], al
movzx eax, al
push 0
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
mov al, 1
test al, bl
je 0x44c78a
mov byte [esi + 1], al
test bl, 2
je 0x44c792
mov byte [esi + 3], al
test bl, 4
pop ebx
je 0x44c765
pop edi
mov byte [esi + 4], al
pop esi
ret 8

Function at 0x44c7a0
Capabilities:
Log keystrokes

Disassembly:
mov cl, byte [esp + 8]
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0xc]
mov byte [esi + 7], bl
xor eax, eax
mov word [esi + 8], ax
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov byte [esi + 6], bl
push esi
mov byte [esi + 0xa], bl
mov byte [esi], cl
call fcn.00437a22
test al, al
jne 0x44c7db
pop esi
pop ebx
ret 8
movzx edx, byte [esp + 0x10]
push ebx
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
pop esi
mov al, 1
pop ebx
ret 8
Function at 0x4523ce
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
xor ebp, ebp
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004151b0
add esp, 0x10
push 0x2b3cea11
push 4
lea edx, [esp + 0x1c]
push edx
call fcn.0044afdc
lea eax, [esp + 0x14]
push 0x487704
push eax
mov byte [esp + 0x20], 0
call fcn.004151d0
add esp, 8
test eax, eax
jne 0x452562
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
inc ebp
call fcn.004151b0
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
xor edi, 0x5b155d07
lea ebx, [edi + edi]
push ebx
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.004151b0
add esp, 0x20
add edi, 0xf6775ef6
push edi
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0044afdc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
xor eax, eax
push edx
mov word [esp + ebx + 0x28], ax
call fcn.00411691
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.004151b0
mov edi, dword [esp + 0x28]
mov edx, dword [esi]
push edx
xor edi, 0xac14fa72
lea ebx, [edi + edi]
push ebx
lea eax, [esp + 0x40]
push 1
push eax
call fcn.004151b0
add esp, 0x28
add edi, 0xbdffa596
push edi
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0044afdc
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x20]
push eax
xor edx, edx
push ecx
mov word [esp + ebx + 0x28], dx
call fcn.00411691
mov edi, dword [esp + 0x450]
lea edx, [esp + 0x238]
push edi
push edx
call fcn.004133e4
add esp, 0x10
test eax, eax
je 0x452553
push 0x4876f8
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x452510
test ebp, ebp
je 0x452553
mov eax, dword [esi]
push 1
push 1
push eax
call fcn.0041557c
mov ecx, dword [esi]
add esp, 0xc
push ecx
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004151b0
mov eax, dword [esp + 0x2c]
xor eax, 0x87bc
mov dword [esp + 0x2c], eax
add eax, 0x18
push 1
push eax
mov eax, dword [esi]
push eax
call fcn.0041557c
add esp, 0x1c
jmp 0x4523e1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x430
ret 0xc