joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4449c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov ecx, 0x911000
mov dword [ebp - 0x18], ebx
movzx eax, word [esi + 0xc]
push eax
call fcn.00440910
imul eax, eax, 0x11c
mov dword [ebp - 0x1c], 0x200
add eax, dword [0x91275c]
cmp dword [ebx + 0x1520], 0
mov dword [ebp - 0x20], eax
je 0x444a13
cmp dword [esi + 0x50], 0
je 0x444b3d
push 0
push 0
push 0x83ef
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esi + 0x50], 0
mov ebx, eax
jne 0x444a4a
test ebx, ebx
jne 0x444a4e
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x1518]
test ecx, ecx
je 0x444a5b
push ecx
mov ecx, eax
jmp 0x444a56
test ebx, ebx
je 0x444a5b
cmp ebx, esi
je 0x444a5b
mov ecx, dword [ebp - 0x18]
push esi
call fcn.0043d710
mov edi, dword [ebp - 0x20]
test dword [edi + 0xc], 0x8000
jne 0x444aaa
push dword [esi + 4]
call fcn.0042e480
add esp, 4
test al, al
je 0x444aaa
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x444aa3
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x444aa3
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x444aaa
mov dword [ebp - 0x1c], 0x600
cmp word [edi + 2], 3
jne 0x444aed
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x151c], 0
je 0x444aed
cmp ebx, esi
je 0x444aed
test dword [edi + 0xc], 0x1000000
je 0x444ad5
mov ecx, esi
call fcn.00453660
test al, al
je 0x444aed
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00453d40
movzx eax, word [esi + 0xc]
mov ecx, 0x911000
push eax
call fcn.00440910
cmp eax, 0xffffffff
je 0x444b3d
imul edx, eax, 0x11c
mov eax, dword [edi + 0xc]
shr eax, 5
not eax
and eax, 0x400
add edx, dword [0x91275c]
or eax, 0x200
not eax
mov ecx, dword [edx + 0xc]
and eax, ecx
or eax, dword [ebp - 0x1c]
mov dword [edx + 0xc], eax
cmp ecx, eax
je 0x444b3d
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
Function at 0x444d60
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00509970
lea eax, [ebp - 0x108]
push eax
call fcn.0042e770
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x444dd5
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.0042d490
add esp, 8
test eax, eax
je 0x444dd5
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
push str.DFCWriteTest.tmp
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00511c6f
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x444e27
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
Function at 0x44b710
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
push ebx
push 0x5a4e28
push 0x104
push eax
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x254], ebx
call fcn.00407c20
add esp, 0x10
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x250], edi
cmp edi, 0xffffffff
je 0x44b8ab
push esi
nop dword [eax]
nop dword [eax + eax]
test byte [ebp - 0x248], 0x10
je 0x44b894
mov ecx, 0x5a1750
lea eax, [ebp - 0x21c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44b7b8
test dl, dl
je 0x44b7b4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44b7b8
add eax, 2
add ecx, 2
test dl, dl
jne 0x44b798
xor eax, eax
jmp 0x44b7bd
sbb eax, eax
or eax, 1
test eax, eax
je 0x44b894
mov eax, 0x5a4e30
lea ecx, [ebp - 0x21c]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44b7f0
test dl, dl
je 0x44b7ec
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44b7f0
add ecx, 2
add eax, 2
test dl, dl
jne 0x44b7d0
xor eax, eax
jmp 0x44b7f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x44b894
lea eax, [ebp - 0x21c]
push eax
push ebx
push str._s_s
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00407c20
mov eax, dword [ebp - 0x24c]
xor esi, esi
lea ebx, [eax + 0xb44]
add esp, 0x14
cmp dword [ebx], esi
jle 0x44b865
xor edi, edi
mov eax, dword [eax + 0xb48]
lea ecx, [ebp - 0x108]
add eax, edi
push ecx
push eax
call fcn.00505203
add esp, 8
test eax, eax
je 0x44b85f
mov eax, dword [ebp - 0x24c]
inc esi
add edi, 0x104
cmp esi, dword [ebx]
jl 0x44b832
mov edi, dword [ebp - 0x250]
mov eax, dword [ebx]
cmp esi, eax
jne 0x44b87c
push 1
push eax
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
call fcn.00442880
mov ecx, dword [ebp - 0x24c]
lea eax, [ebp - 0x108]
push eax
call fcn.0044b710
mov ebx, dword [ebp - 0x254]
lea eax, [ebp - 0x248]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44b780
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
Function at 0x44b8d0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push ebx
push str._s.
push 0x104
push eax
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x468], ebx
call fcn.0044c120
add esp, 0x10
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x464], edi
cmp edi, 0xffffffff
je 0x44ba79
push esi
nop dword [eax]
nop dword [eax + eax]
test byte [ebp - 0x45c], 0x10
je 0x44ba62
mov ecx, 0x5a4e44
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44b97e
test dx, dx
je 0x44b97a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44b97e
add eax, 4
add ecx, 4
test dx, dx
jne 0x44b958
xor eax, eax
jmp 0x44b983
sbb eax, eax
or eax, 1
test eax, eax
je 0x44ba62
mov eax, 0x5a4e48
lea ecx, [ebp - 0x430]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x44b9bc
test dx, dx
je 0x44b9b8
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x44b9bc
add ecx, 4
add eax, 4
test dx, dx
jne 0x44b996
xor eax, eax
jmp 0x44b9c1
sbb eax, eax
or eax, 1
test eax, eax
je 0x44ba62
lea eax, [ebp - 0x430]
push eax
push ebx
push 0x5a4e50
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044c120
mov eax, dword [ebp - 0x460]
xor esi, esi
lea ebx, [eax + 0x1670]
add esp, 0x14
cmp dword [ebx], esi
jle 0x44ba33
xor edi, edi
nop
mov eax, dword [eax + 0x1674]
lea ecx, [ebp - 0x20c]
add eax, edi
push ecx
push eax
call fcn.00513599
add esp, 8
test eax, eax
je 0x44ba2d
mov eax, dword [ebp - 0x460]
inc esi
add edi, 0x208
cmp esi, dword [ebx]
jl 0x44ba00
mov edi, dword [ebp - 0x464]
mov eax, dword [ebx]
cmp esi, eax
jne 0x44ba4a
push 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.0044baa0
mov ecx, dword [ebp - 0x460]
lea eax, [ebp - 0x20c]
push eax
call fcn.0044b8d0
mov ebx, dword [ebp - 0x468]
lea eax, [ebp - 0x45c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44b940
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
Function at 0x44bc50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc84
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0xc78], edi
cmp byte [edi], 0
jne 0x44bc85
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
cmp byte [edi + 0x104], 0
jne 0x44bca1
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp + 8], 0
je 0x44bcbb
mov dword [edi + 0xb44], 0
mov dword [edi + 0xb30], 0
push ebx
push esi
mov esi, dword [edi + 0xb44]
lea ecx, [edi + 0xb44]
push 1
push esi
push edi
mov dword [ebp - 0xc80], esi
call fcn.00442880
push edi
mov ecx, edi
call fcn.0044b710
cmp esi, dword [edi + 0xb44]
jge 0x44be96
imul ebx, esi, 0x104
mov dword [ebp - 0xc74], ebx
nop dword [eax + eax]
push 0xffffffffffffffff
lea eax, [edi + 0x104]
push eax
lea eax, [ebp - 0xb30]
push 0xa28
push eax
call fcn.00509970
add esp, 0x10
lea esi, [ebp - 0xb30]
cmp byte [ebp - 0xb30], 0
je 0x44be71
movsx eax, byte [edi + 0xb2c]
push eax
push esi
call fcn.00500e00
mov ebx, eax
add esp, 8
mov dword [ebp - 0xc84], ebx
test ebx, ebx
je 0x44bd50
mov byte [ebx], 0
mov eax, dword [edi + 0xb48]
push esi
mov esi, dword [ebp - 0xc74]
add eax, esi
push eax
push str._s_s
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00407c20
add esp, 0x14
lea eax, [ebp - 0xc70]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xc7c], eax
cmp eax, 0xffffffff
je 0x44be53
lea ebx, [edi + 0xb30]
lea eax, [ebp - 0xc44]
push eax
mov eax, dword [edi + 0xb48]
add eax, esi
push eax
push str._s_s
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00407c20
xor esi, esi
add esp, 0x14
cmp dword [ebx], esi
jle 0x44be06
xor edi, edi
mov eax, dword [ebp - 0xc78]
lea ecx, [ebp - 0x108]
push ecx
mov eax, dword [eax + 0xb34]
add eax, edi
push eax
call fcn.00505203
add esp, 8
test eax, eax
je 0x44be00
inc esi
add edi, 0x104
cmp esi, dword [ebx]
jl 0x44bdd3
mov edi, dword [ebp - 0xc78]
mov eax, dword [ebx]
cmp esi, eax
jne 0x44be26
test byte [ebp - 0xc70], 0x10
jne 0x44be26
push 1
push eax
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
call fcn.00442880
lea eax, [ebp - 0xc70]
push eax
push dword [ebp - 0xc7c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, dword [ebp - 0xc74]
test eax, eax
jne 0x44bda2
mov eax, dword [ebp - 0xc7c]
mov ebx, dword [ebp - 0xc84]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x44be6b
cmp byte [ebx + 1], 0
lea esi, [ebx + 1]
jne 0x44bd30
mov ebx, dword [ebp - 0xc74]
mov eax, dword [ebp - 0xc80]
add ebx, 0x104
inc eax
mov dword [ebp - 0xc74], ebx
mov dword [ebp - 0xc80], eax
cmp eax, dword [edi + 0xb44]
jl 0x44bd00
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0xb30]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
Function at 0x44beb0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18c0
call fcn.004ffc70
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0x18b4], edi
cmp word [edi], 0
jne 0x44beea
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
cmp word [edi + 0x208], 0
jne 0x44bf07
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp + 8], 0
je 0x44bf21
mov dword [edi + 0x1670], 0
mov dword [edi + 0x165c], 0
push ebx
push esi
mov esi, dword [edi + 0x1670]
lea ecx, [edi + 0x1670]
push 1
push esi
push edi
mov dword [ebp - 0x18bc], esi
call fcn.0044baa0
push edi
mov ecx, edi
call fcn.0044b8d0
cmp esi, dword [edi + 0x1670]
jge 0x44c105
imul ebx, esi, 0x208
mov dword [ebp - 0x18b0], ebx
nop
push 0xffffffffffffffff
lea eax, [edi + 0x208]
push eax
lea eax, [ebp - 0x165c]
push 0xa28
push eax
call fcn.00513512
add esp, 0x10
lea esi, [ebp - 0x165c]
cmp word [ebp - 0x165c], 0
je 0x44c0e0
movzx eax, word [edi + 0x1658]
push eax
push esi
call fcn.005017ba
mov ebx, eax
add esp, 8
mov dword [ebp - 0x18c0], ebx
test ebx, ebx
je 0x44bfb3
xor eax, eax
mov word [ebx], ax
mov eax, dword [edi + 0x1674]
push esi
mov esi, dword [ebp - 0x18b0]
add eax, esi
push eax
push 0x5a4e50
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044c120
add esp, 0x14
lea eax, [ebp - 0x18ac]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x18b8], eax
cmp eax, 0xffffffff
je 0x44c0c1
lea ebx, [edi + 0x165c]
nop word [eax + eax]
lea eax, [ebp - 0x1880]
push eax
mov eax, dword [edi + 0x1674]
add eax, esi
push eax
push 0x5a4e50
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044c120
xor esi, esi
add esp, 0x14
cmp dword [ebx], esi
jle 0x44c074
xor edi, edi
mov eax, dword [ebp - 0x18b4]
lea ecx, [ebp - 0x20c]
push ecx
mov eax, dword [eax + 0x1660]
add eax, edi
push eax
call fcn.00513599
add esp, 8
test eax, eax
je 0x44c06e
inc esi
add edi, 0x208
cmp esi, dword [ebx]
jl 0x44c041
mov edi, dword [ebp - 0x18b4]
mov eax, dword [ebx]
cmp esi, eax
jne 0x44c094
test byte [ebp - 0x18ac], 0x10
jne 0x44c094
push 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.0044baa0
lea eax, [ebp - 0x18ac]
push eax
push dword [ebp - 0x18b8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, dword [ebp - 0x18b0]
test eax, eax
jne 0x44c010
mov eax, dword [ebp - 0x18b8]
mov ebx, dword [ebp - 0x18c0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x44c0da
cmp word [ebx + 2], 0
lea esi, [ebx + 2]
jne 0x44bf91
mov ebx, dword [ebp - 0x18b0]
mov eax, dword [ebp - 0x18bc]
add ebx, 0x208
inc eax
mov dword [ebp - 0x18b0], ebx
mov dword [ebp - 0x18bc], eax
cmp eax, dword [edi + 0x1670]
jl 0x44bf60
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0x165c]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 4
Function at 0x44c8a0
Capabilities:
Create thread

Disassembly:
push 0
push 0x118
push 0x9134a8
push 0xffffffffffffffff
push str._DFC_UpdateCheck
call fcn.0042d6f0
mov eax, dword [0x9135bc]
add esp, 0x14
test eax, eax
jne 0x44c8cd
mov byte [0x9135b9], 1
jmp 0x44c8d2
cmp eax, 7
jg 0x44c8dc
mov dword [0x9135bc], 7
cmp byte [0x9135b9], 0
je 0x44c920
push 0
call fcn.0050e3e0
add esp, 4
sub eax, dword [0x9135b0]
mov ecx, eax
sbb edx, dword [0x9135b4]
call fcn.004ffd90
movd xmm1, dword [0x9135bc]
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x618268]
comisd xmm0, xmm1
ja fcn.0044c7e0
ret

Function at 0x44ccd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0044d700
cmp byte [0x9137d8], 0
je 0x44cd68
push 0
call fcn.0050e3e0
add esp, 4
sub eax, dword [0x9137d0]
mov ecx, eax
sbb edx, dword [0x9137d4]
call fcn.004ffd90
movd xmm2, dword [0x9137dc]
cvtdq2pd xmm2, xmm2
mulsd xmm2, qword [0x618138]
mulsd xmm2, qword [0x618160]
mulsd xmm2, qword [0x618160]
comisd xmm0, xmm2
jbe 0x44cd68
cmp byte [0x9137e9], 0
jne 0x44cd68
lea eax, [ebp - 4]
mov byte [0x9137e9], 1
push eax
push 0
push 0
push fcn.0044cd70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x44cd61
mov byte [0x9137e9], al
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x44dca0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor eax, eax
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], eax
je 0x44de3b
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x44de3b
mov ecx, dword [ebx]
test ecx, ecx
je 0x44de3b
add ecx, 2
mov eax, 0x55555556
imul ecx
mov eax, 0x6bca1af3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shl ecx, 2
imul ecx
add ecx, 2
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [ecx + eax*2]
push eax
call fcn.0050491e
mov ecx, eax
add esp, 4
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x44de31
push edi
mov edi, dword [ebx]
test edi, edi
jle 0x44de2c
mov ebx, dword [ebp + 8]
mov eax, ebx
not eax
mov dword [ebp - 8], 2
mov dword [ebp - 0x18], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + 3]
mov dword [ebp - 0x14], 0xfffffffe
lea edx, [ebx + 2]
sub dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov bl, byte [edx - 2]
mov ecx, dword [ebp - 0x18]
add ecx, edx
mov byte [ebp - 1], bl
xor bl, bl
mov byte [ebp + 0xb], 0
cmp ecx, edi
mov ecx, dword [ebp - 0xc]
jge 0x44dd6c
mov bl, byte [edx - 1]
mov byte [ebp + 0xb], bl
xor bl, bl
cmp eax, edi
jge 0x44dd6c
mov bl, byte [edx]
mov bh, byte [ebp + 0xb]
mov al, bl
shr al, 6
and bh, 0xf
shl bh, 2
and bl, 0x3f
or bh, al
movzx eax, byte [ebp - 1]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
mov al, byte [ebp - 1]
and al, 3
shl al, 4
movzx ecx, al
movzx eax, byte [ebp + 0xb]
shr eax, 4
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + esi], al
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
add ecx, 2
add ecx, esi
add eax, edx
mov dword [ebp + 8], ecx
cmp eax, edi
jge 0x44ddd0
movzx eax, bh
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x44ddd2
mov al, 0x3d
mov ecx, dword [ebp + 8]
mov byte [ecx], al
cmp dword [ebp - 8], edi
jge 0x44dde7
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x44dde9
mov al, 0x3d
mov ecx, dword [ebp - 0x20]
mov byte [ecx + esi], al
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, 0x13
mov ecx, dword [ebp - 0xc]
jne 0x44de0d
mov word [ecx + esi + 4], 0xa0d
add esi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 0xc]
add edx, 3
mov eax, dword [ebp - 0x14]
add esi, 4
add dword [ebp - 8], 3
add eax, edx
mov edi, dword [ebx]
cmp eax, edi
mov eax, dword [ebp - 8]
jl 0x44dd46
mov byte [ecx + esi], 0
pop edi
mov dword [ebx], esi
mov eax, ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e690
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, dword [esi + 0x608]
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], edx
mov ebx, eax
test edi, edi
jg 0x44e7b1
cmp dword [esi + 0x10], 0
jle 0x44e764
push 0x5dc
push ecx
push dword [esi + 0x610]
xor edi, edi
call fcn.00459380
add esp, 0xc
mov dword [esi + 0x608], eax
test eax, eax
jg 0x44e6ff
push eax
push dword [esi + 0x610]
call fcn.00458d70
mov edi, eax
add esp, 8
cmp edi, 2
jne 0x44e6ff
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [ebp - 4]
cmp edx, ecx
ja 0x44e723
jb 0x44e712
cmp eax, ebx
jae 0x44e723
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
sub eax, ebx
sbb edx, ecx
test edx, edx
ja 0x44e798
jb 0x44e732
cmp eax, dword [esi + 0x1c]
ja 0x44e798
mov eax, dword [esi + 0x28]
test eax, eax
je 0x44e73e
cmp byte [eax], 0
jne 0x44e758
mov eax, dword [esi + 0x608]
test eax, eax
jg 0x44e754
lea ecx, [esi + 0x2c]
cmp edi, 2
je 0x44e6c1
test edi, edi
je 0x44e78f
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xa
mov ecx, esi
call fcn.0044e220
cmp eax, 0xffffffff
je 0x44e758
test eax, eax
je 0x44e7a6
push 0
push 0x5dc
lea eax, [esi + 0x2c]
push eax
push dword [esi + 0x18]
call sub.WSOCK32.dll_recv
mov dword [esi + 0x608], eax
test eax, eax
jle 0x44e758
jmp 0x44e69b
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp edi, dword [ebp + 0xc]
cmovg edi, dword [ebp + 0xc]
push edi
push ecx
push dword [ebp + 8]
call fcn.005010e0
mov ecx, dword [esi + 0x608]
lea eax, [esi + 0x2c]
sub ecx, edi
push ecx
lea ecx, [esi + 0x2c]
add ecx, edi
push ecx
push eax
call fcn.005010e0
add esp, 0x18
mov eax, edi
sub dword [esi + 0x608], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44fa20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
add eax, 0xfffffdff
xor edi, edi
cmp eax, 7
ja case.0x44fa35.515
jmp dword [eax*4 + 0x44fa94]
mov edi, 1
jmp case.0x44fa35.515
mov edi, 2
jmp case.0x44fa35.515
mov edi, 4
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebx
shr eax, 0xf
mov esi, edi
or esi, 1
and al, 1
push 2
cmove esi, edi
call ebx
shr eax, 0xf
mov edi, esi
or edi, 2
test al, 1
push 4
cmove edi, esi
call ebx
movzx ecx, ax
mov eax, edi
shr ecx, 0xf
or eax, 4
test cl, 1
cmove eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x451ef0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x18]
mov ecx, 0x911000
mov dword [ebp - 0x2c], eax
movzx eax, ax
push eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], 0
call fcn.0043d610
mov dword [ebp - 0x28], eax
test eax, eax
je 0x451f3b
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
jmp 0x451f3d
xor eax, eax
mov dword [ebp - 0x1c], 0x46000000
test eax, eax
jne 0x451f5c
test byte [ebx + 0x1e], 0x10
mov ecx, 0x86c40000
mov edx, 0x86cc0000
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
cmp byte [ebp + 0x1c], 0
je 0x45202b
test byte [ebx + 0x1e], 8
je 0x451f82
mov ecx, dword [ebx + 0x24]
cmp ecx, 2
je 0x451f79
cmp ecx, 3
jne 0x451f82
mov eax, esi
mov esi, edi
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebx + 0x24]
cmp ecx, 2
je 0x451f8f
cmp ecx, 3
jne 0x451fa8
test eax, eax
jne 0x451fa8
push 0
push dword [ebx]
mov eax, esi
mov esi, edi
mov edi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
or eax, 0xffffffff
jmp 0x451fc3
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp - 0x18], 0
jne 0x451fbd
or eax, 0xffffffff
jmp 0x451fc3
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
push dword [ebp - 0x1c]
mov dword [ebx + 0x24], eax
push 0xfffffffffffffff0
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push dword [ebp - 0x18]
push dword [ebx]
call dword [sym.imp.USER32.dll_SetParent]
push 0
push edi
push esi
mov ecx, ebx
call fcn.004511a0
cmp dword [ebx + 0x24], 0xffffffff
movzx esi, word [ebx + 0x14]
movzx edi, word [ebx + 0x16]
mov dword [ebp + 0x14], esi
mov dword [ebp - 0x24], esi
mov dword [ebp + 0x18], edi
mov dword [ebp - 0x20], edi
jne 0x452017
movzx eax, word [ebx + 0xa]
mov ecx, 0x911000
push eax
call fcn.00444d10
mov eax, dword [eax + 0x5c]
jmp 0x452019
xor eax, eax
push 0
push eax
push dword [ebx]
mov ecx, 0x911000
call fcn.00443c70
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x452074
push edi
push esi
push eax
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push dword [ebx]
mov ecx, 0x911000
call fcn.00440270
push eax
push 0x80
push 0
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov ecx, 0x911000
push eax
call fcn.0043d590
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
movzx eax, word [ebx + 0x1e]
mov edi, dword [ebp + 0x10]
and eax, 0x20
mov esi, dword [ebp + 0xc]
or eax, 2
add eax, eax
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push edi
push esi
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov word [ebx + 0x14], ax
xor ecx, ebp
mov eax, dword [ebp + 0x18]
mov word [ebx + 0x12], di
pop edi
mov word [ebx + 0x10], si
mov word [ebx + 0x16], ax
mov eax, dword [ebp - 0x2c]
pop esi
mov word [ebx + 0xc], ax
pop ebx
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 0x18