joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4391fe
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esp + 8]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x439260
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 4]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 8
ret

Function at 0x439956
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ecx
push ebp
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [esp + 0x10]
mov esi, eax
cmp ebp, esi
jne 0x439974
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
test esi, esi
jne 0x439986
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebp
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x43999a
push 9
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x439a8d
push ebx
push edi
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebp
mov ebx, eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebp, eax
push ebp
push ebx
call esi
push 1
push edi
push ebx
call esi
push 1
push ebp
push edi
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x439a67
push eax
push eax
push eax
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x439a6f
mov dword [esp + 0x10], 4
jmp 0x439a6f
mov dword [esp + 0x10], 3
push 0
push ebp
push ebx
call esi
push 0
push edi
push ebx
call esi
push 0
push ebp
push edi
call esi
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret 4
pop esi
mov eax, 2
pop ebp
pop ecx
ret 4

Function at 0x43b2bf
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 8], 0
mov eax, dword [esp + 4]
je 0x43b2da
mov eax, dword [eax]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
ret 8
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
ret 8
Function at 0x43b397
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
push esi
mov esi, dword [esp + 8]
jne 0x43b3c4
lea eax, [esp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x43b3dd
push 1
jmp 0x43b3c6
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
ret 8

Function at 0x43ba2d
Capabilities:
Get token privileges

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
push esi
push 0
push eax
push 3
push edi
call ebx
test eax, eax
jne 0x43ba7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43ba8a
mov ecx, dword [esi]
push ecx
call fcn.0043b987
add esp, 4
mov dword [ebp], eax
test eax, eax
je 0x43ba8a
mov edx, dword [esi]
push esi
push edx
push eax
push 3
push edi
call ebx
test eax, eax
je 0x43ba8a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc

Function at 0x43bad3
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
call fcn.0043b9b5
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
mov esi, eax
push 0
push esi
call edi
push eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebx
push 2
push 0
push 0
lea edx, [esi + 8]
push edx
call edi
push eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push ecx
call edi
push eax
call ebx
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push 0
push 0
push esi
push 0x43ba93
push 0
push 0
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x43bb3b
Capabilities:
Impersonate user

Disassembly:
movsx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
and eax, 2
or eax, 4
push 0
shr eax, 1
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
neg eax
sbb eax, eax
neg eax
ret 0x14
Function at 0x43bcf7
Capabilities:
Create process on windows

Disassembly:
mov al, byte [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x1c], ecx
test al, 1
je 0x43bd13
lea edi, [ecx + 1]
jmp 0x43bd1c
test al, 2
je 0x43bd1c
mov edi, 2
xor bl, bl
test al, 4
je 0x43bd5f
push ebp
lea eax, [esp + 0x28]
push eax
push 0xa
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, dword [esp + 0x28]
push 1
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebp, eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
pop ebp
je 0x43bd9c
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
or esi, 0x400
push esi
push edx
mov edx, dword [esp + 0x28]
push 0
push edi
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
setne bl
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43bdab
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
pop edi
pop esi
mov al, bl
pop ebx
ret 0x24
Function at 0x44549b
Capabilities:
Create http request

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp ecx, 1
jne 0x4454b5
movzx eax, word [esi + 0x8c]
jmp 0x4454b9
movzx eax, word [esi + 0x58]
cmp ecx, 1
movsx edx, ax
lea ecx, [esi + 0xb0]
je 0x4454ca
lea ecx, [esi + 0x7c]
mov eax, dword [esi + 0xc0]
push 0
cmp edx, 1
jne 0x4454de
push 0
push 0
push edx
jmp 0x445528
cmp edx, 2
jne 0x445522
mov ecx, dword [ecx]
push str._local_
push ecx
push 3
jmp 0x445528
cmp byte [esi + 0xdc], 0
je 0x445519
push 8
lea eax, [esp + 8]
push eax
push 0x32
push 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, 1
pop esi
add esp, 8
ret 8
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 4], eax
test eax, eax
jne 0x4454ef
xor al, al
pop esi
add esp, 8
ret 8

Function at 0x4457b4
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
mov ebp, ecx
mov ecx, dword [esp + 0x268]
push eax
push ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x445843
lea ebx, [ebx]
lea edx, [esp + 0x3c]
push 0x487fa4
push edx
call fcn.00414774
add esp, 8
test eax, eax
je 0x445833
lea eax, [esp + 0x3c]
push 0x48ae74
push eax
call fcn.00414774
add esp, 8
test eax, eax
je 0x445833
mov ecx, dword [esp + 0x270]
mov edx, dword [esp + 0x26c]
push ecx
push edx
lea eax, [esp + 0x44]
push eax
call fcn.00438e13
add esp, 0xc
test al, al
je 0x445865
mov bl, 1
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4457e4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
call esi
cmp byte [esp + 0x274], 0
jne 0x44587b
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
lea edx, [esp + 0x10]
push edx
push 0x48ae6c
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x445914
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test byte [esp + 0x10], 0x10
je 0x445904
lea eax, [esp + 0x3c]
push 0x487fa4
push eax
call fcn.00414774
add esp, 8
test eax, eax
je 0x445904
lea ecx, [esp + 0x3c]
push 0x48ae74
push ecx
call fcn.00414774
add esp, 8
test eax, eax
je 0x445904
lea edx, [esp + 0x3c]
push edx
call ebx
mov eax, dword [esp + 0x274]
mov ecx, dword [esp + 0x270]
mov edx, dword [esp + 0x26c]
push eax
mov eax, dword [esp + 0x26c]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.004457b4
test al, al
je 0x445926
push 0x48ae74
call ebx
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x445898
push edi
call esi
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x254
ret 0x10
Function at 0x446126
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a56b8], 0
push esi
push edi
mov esi, 0x4a4ce8
jne 0x446146
push 0
call fcn.004171d4
push eax
call fcn.00437298
add esp, 8
mov dword [0x49321c], 0x270
mov dword [0x4a4ce4], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x44615b
mov edx, 0x18c
mov edi, edi
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x446196
mov ecx, dword [0x4a4ce8]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret

Function at 0x446725
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x44680a
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446777
push 1
push esi
push eax
call fcn.004377a3
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0xc
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 8]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4467e5
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0xc
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x4467ba
cmp eax, 0xffffffff
jne 0x446762
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 1
push accept
push 0x4883e4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446777
test eax, eax
je 0x446777
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.004377a3
push esi
call fcn.004377d3
mov eax, dword [esp + 0x28]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0xc
test al, 1
je 0x4467a7
mov eax, dword [esi]
test eax, eax
je 0x446786
pop esi
add esp, 0xc
ret 0xc
Function at 0x44681f
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x446906
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446874
push 1
push esi
push eax
call fcn.004377a3
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0x14
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0x14
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 8]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4468e1
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x4468b6
cmp eax, 0xffffffff
jne 0x44685f
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 2
push 0x40000000
push 0x4883e4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446874
test eax, eax
je 0x446874
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.004377a3
push esi
call fcn.004377d3
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0x14
test dword [esp + 0x18], eax
je 0x4468a4
mov eax, dword [esi]
test eax, eax
je 0x446883
pop esi
add esp, 0xc
ret 0x14

Function at 0x446930
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x446942
push eax
call fcn.0044657f
mov eax, dword [esi + 0x24]
pop esi
test eax, eax
je 0x446953
mov dword [esp + 4], eax
jmp fcn.0044657f
ret 4

Function at 0x446956
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x20], 0
jne 0x446980
push esi
call fcn.00437835
test al, al
je 0x446980
mov eax, dword [esi + 8]
push eax
call fcn.004465ec
add esp, 4
push eax
mov dword [esi + 0x20], eax
call fcn.0043777a
cmp dword [esi + 0x24], 0
jne 0x4469b3
push esi
call fcn.00437819
test al, al
je 0x4469b3
push esi
call fcn.00437809
test al, al
jne 0x4469b3
mov ecx, dword [esi + 0x10]
push ecx
call fcn.004465ec
add esp, 4
mov dword [esi + 0x24], eax
pop esi
mov dword [esp + 4], eax
jmp fcn.0043777a
pop esi
ret 4

Function at 0x4469de
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
xor edx, edx
push ecx
mov dword [esp + 0x18], edx
call fcn.004377ed
test al, al
je 0x446a30
test ebx, ebx
je 0x446a30
test edi, edi
je 0x446a30
push esi
push edx
lea eax, [esp + 0x1c]
push eax
lea esi, [ecx + 0x18]
mov ecx, dword [esi]
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x446a26
push esi
call fcn.004377d3
add esp, 4
mov eax, dword [esp + 0x18]
pop esi
pop edi
pop ebx
ret 0xc
pop edi
mov eax, edx
pop ebx
ret 0xc
Function at 0x446ea1
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
push esi
mov esi, dword [esp + 8]
jne 0x446ebe
push esi
call fcn.0043856b
add esp, 4
test al, al
jne 0x446ed7
push 1
jmp 0x446ec0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
ret

Function at 0x44782c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
xor esi, esi
xor edi, edi
mov byte [esp + 0x2c], 1
cmp word [eax], si
jne 0x447853
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret 0x18
push ebp
push eax
or eax, 0xffffffff
call fcn.00410190
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ebp, eax
mov eax, dword [esp + 0x30]
push ebp
mov byte [ebx], 0
mov byte [eax], 0
mov byte [ecx], 0
mov byte [edx], 0
call fcn.00414b70
inc eax
push eax
call fcn.00412aaa
mov ecx, eax
add esp, 0xc
mov dword [esp + 0x1c], ecx
mov al, byte [esi + ebp]
cmp al, 0x2b
je 0x4478a4
cmp al, 0x5e
je 0x4478a0
cmp al, 0x21
je 0x4478a0
cmp al, 0x23
jne 0x4478d4
cmp al, 0x2b
jne 0x4478ae
mov eax, dword [esp + 0x24]
mov byte [eax], 1
inc esi
jmp 0x44788d
cmp al, 0x5e
jne 0x4478bc
mov edx, dword [esp + 0x28]
mov byte [edx], 1
inc esi
jmp 0x44788d
cmp al, 0x21
jne 0x4478ca
mov eax, dword [esp + 0x2c]
mov byte [eax], 1
inc esi
jmp 0x44788d
cmp al, 0x23
jne 0x4478d1
mov byte [ebx], 1
inc esi
jmp 0x44788d
mov al, byte [esi + ebp]
inc esi
mov byte [esp + 0x14], al
mov dword [esp + 0x10], esi
cmp al, 0x7b
jne 0x447985
lea edx, [esp + 0x10]
push edx
push ecx
push ebp
push 0x7d
call fcn.00439bc9
test eax, eax
je 0x44790c
mov byte [esp + 0x30], 0
jmp 0x4479c1
mov esi, dword [esp + 0x1c]
mov eax, dword [edi*4 + 0x493af0]
push esi
push eax
call fcn.004280ba
add esp, 8
test eax, eax
je 0x44792b
inc edi
cmp edi, 0x62
jl 0x44790c
cmp edi, 0x62
jne 0x44796d
movzx ecx, byte [esi]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov edx, dword [esp + 0x20]
cwde
mov dword [edx], eax
test eax, 0x200
je 0x44794f
mov ecx, dword [esp + 0x28]
mov byte [ecx], 1
test eax, 0x400
je 0x44795d
mov edx, dword [esp + 0x2c]
mov byte [edx], 1
test eax, 0x100
je 0x4479c1
mov eax, dword [esp + 0x24]
mov byte [eax], 1
jmp 0x4479c1
cmp byte [edi + 0x493c78], 0
jne 0x4478fa
mov ecx, dword [edi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
jmp 0x4479c1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov ecx, dword [esp + 0x20]
cwde
mov dword [ecx], eax
test eax, 0x200
je 0x4479a5
mov edx, dword [esp + 0x28]
mov byte [edx], 1
test eax, 0x400
je 0x4479b3
mov ecx, dword [esp + 0x2c]
mov byte [ecx], 1
test eax, 0x100
je 0x4479c1
mov edx, dword [esp + 0x24]
mov byte [edx], 1
mov eax, dword [esp + 0x20]
and dword [eax], 0xff
push ebp
call fcn.004127bd
mov eax, dword [esp + 0x20]
push eax
call fcn.004127bd
mov al, byte [esp + 0x38]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 0x18
Function at 0x448f91
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
push edi
push 1
push eax
call fcn.00448bea
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x25
call ebx
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x18], 0
push eax
jge 0x448ff4
mov ecx, dword [esi]
push 0x25
push 0x100
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov edx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
push 0x101
push edx
jmp 0x449023
mov eax, dword [esi]
push 0x27
push 0x100
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov ecx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push ecx
call ebp
push 0
call edi
mov edx, dword [esi]
push 0
push edx
call fcn.00448bea
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x44dbe1
Capabilities:
Connect to http server

Disassembly:
sub esp, 0xc
cmp byte [esp + 0x18], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
je 0x44dc0d
mov eax, dword [esp + 0x2c]
push eax
push esi
push edi
call fcn.0044daa4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
mov ebp, dword [edi + 0x54]
push 0
push 0
push ebx
push eax
push ecx
movzx ecx, word [esi + 0x78]
push ecx
push edx
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44dc52
push 0xdeadbeef
push 0x15
push edi
call fcn.00445207
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov esi, dword [esi + 0x60]
push ebp
push accept
push esi
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileW]
mov esi, eax
mov eax, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
test esi, esi
jne 0x44dc80
push esi
push 0xdeadbeef
push 0x16
jmp 0x44dcc9
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.WININET.dll_FtpGetFileSize]
mov edx, dword [esp + 0x28]
xor ecx, ecx
xor ebx, ebx
or ecx, eax
or edx, ebx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], edx
cmp byte [esp + 0x2c], bl
je 0x44dcc3
push esi
push edi
call fcn.0044541e
mov bl, al
lea eax, [esp + 0x14]
push eax
call fcn.004368c7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
push 1
push 0
push 0
push edi
call fcn.00445207
lea ecx, [esp + 0x14]
push ecx
mov bl, al
call fcn.004368c7
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret 0x10
Function at 0x44e4d4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
sub dword [0x49321c], 1
jne 0x44e4e3
call fcn.00446126
mov ecx, dword [0x4a4ce4]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a4ce4], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
test edx, edx
jge 0x44e52c
fadd qword [0x48d2f0]
fmul qword [0x48d2f8]
pop ecx
ret

Function at 0x44e918
Capabilities:
Delete directory
Delete file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x22c
lea eax, [esp + 0x20]
call fcn.0040fdc0
lea eax, [esp + 0x20]
push eax
call fcn.00438baa
add esp, 4
test al, al
jne 0x44e943
add esp, 0x22c
ret
push ebx
xor ebx, ebx
cmp byte [esp + 0x238], bl
jne 0x44e967
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x24]
push edx
call fcn.00412665
xor ecx, ecx
mov word [esp + eax*2 + 0x2a], cx
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x22c
ret