joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4468c9
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
mov bl, byte [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x118]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [ebp + 0x14], 0
mov esi, eax
je 0x4469b0
cmp edi, 0x14
je 0x4469b0
cmp edi, 0x90
je 0x4469b0
cmp edi, 0x91
je 0x4469b0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
shl esi, 0x10
or esi, 0xc0000001
cmp bl, 1
je 0x446941
push edi
call fcn.00439387
cmp al, 1
jne 0x446947
or esi, 0x1000000
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x44695a
test eax, 0x100
jne 0x44695a
cmp edi, 0x12
jne 0x446978
test al, 8
jne 0x446978
test eax, 0x800
jne 0x446978
mov ecx, dword [ebp + 0x14]
or esi, 0x20000000
push esi
push edi
push 0x105
push ecx
jmp 0x446983
mov edx, dword [ebp + 0x14]
push esi
push edi
push 0x101
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
xor byte [esp + edi + 0x10], 0x80
lea eax, [esp + edi + 0x10]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
push ebp
call fcn.0043975d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
cmp bl, 1
je 0x4469c5
push edi
call fcn.00439387
cmp al, 1
je 0x4469c5
push 0
push 2
jmp 0x4469c9
push 0
push 3
push esi
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push ebp
call fcn.0043975d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc

Function at 0x4469e4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
mov bl, byte [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x118]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [ebp + 0x14], 0
mov esi, eax
je 0x446adb
cmp edi, 0x14
je 0x446adb
cmp edi, 0x90
je 0x446adb
cmp edi, 0x91
je 0x446adb
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
or byte [esp + edi + 0x10], 0x80
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
shl esi, 0x10
or esi, 1
cmp bl, 1
je 0x446a69
push edi
call fcn.00439387
cmp al, 1
jne 0x446a6f
or esi, 0x1000000
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x446a82
test eax, 0x100
jne 0x446a82
cmp edi, 0x12
jne 0x446ab7
test al, 8
jne 0x446ab7
test eax, 0x800
jne 0x446ab7
mov edx, dword [ebp + 0x14]
or esi, 0x20000000
push esi
push edi
push 0x104
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.00439746
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
mov eax, dword [ebp + 0x14]
push esi
push edi
push 0x100
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.00439746
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
cmp bl, 1
je 0x446af0
push edi
call fcn.00439387
cmp al, 1
je 0x446af0
push 0
push 0
jmp 0x446af4
push 0
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push ebp
call fcn.00439746
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
Function at 0x446b34
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
test bl, 0x1f
je 0x446d30
mov eax, dword [esi + 0x14]
push edi
test eax, eax
je 0x446cc3
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x446cc3
push ebp
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, ebx
and ebp, 1
je 0x446baf
test bl, 8
jne 0x446baf
test ebx, 0x800
jne 0x446baf
movzx ecx, byte [esi + 0x19]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xe0000001
push ecx
push 0x12
push 0x105
push edx
jmp 0x446bcb
test ebp, ebp
je 0x446bcd
movzx eax, byte [esi + 0x19]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push ecx
call edi
mov eax, ebx
and eax, 8
mov dword [esp + 0x14], eax
je 0x446bf3
movzx edx, byte [esi + 0x18]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 0xc0000001
push edx
push 0x11
push 0x101
push eax
call edi
mov eax, ebx
and eax, 2
mov dword [esp + 0x18], eax
je 0x446c1b
movzx ecx, byte [esi + 0x1b]
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push edx
push 0x101
push eax
call edi
mov eax, ebx
and eax, 4
mov dword [esp + 0x10], eax
je 0x446c41
movzx ecx, byte [esi + 0x1c]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push 0x10
push 0x101
push edx
call edi
and ebx, 0x10
je 0x446c60
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push ecx
call edi
mov cl, 0x80
test ebx, ebx
je 0x446c6a
xor byte [esp + 0x77], cl
cmp dword [esp + 0x18], 0
je 0x446c80
mov eax, dword [esi + 0x20]
xor byte [esp + 0x2c], cl
xor byte [esp + eax + 0x1c], cl
lea eax, [esp + eax + 0x1c]
cmp dword [esp + 0x10], 0
je 0x446c92
xor byte [esp + 0x2c], cl
xor byte [esp + 0xbd], cl
cmp dword [esp + 0x14], 0
je 0x446c9d
xor byte [esp + 0x2d], cl
test ebp, ebp
pop ebp
je 0x446ca6
xor byte [esp + 0x2a], cl
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
push esi
call fcn.0043975d
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
mov edi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 1
je 0x446cdb
movzx eax, byte [esi + 0x19]
push 0
push 2
push eax
push 0x12
call edi
test bl, 8
je 0x446ced
movzx ecx, byte [esi + 0x18]
push 0
push 2
push ecx
push 0x11
call edi
test bl, 2
je 0x446d02
movzx edx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x20]
push 0
push 2
push edx
push eax
call edi
test bl, 4
je 0x446d17
movzx ecx, byte [esi + 0x1c]
push 0
push 2
push ecx
push 0xa1
call edi
test bl, 0x10
je 0x446d29
movzx edx, byte [esi + 0x1d]
push 0
push 2
push edx
push 0x5b
call edi
push esi
call fcn.0043975d
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x446d3b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
test bl, 0x1f
je 0x446f23
mov eax, dword [esi + 0x14]
push ebp
push edi
test eax, eax
je 0x446eb5
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x446eb5
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, ebx
and edi, 0x10
mov cl, 0x80
je 0x446d8e
or byte [esp + 0x77], cl
mov eax, ebx
and eax, 2
mov dword [esp + 0x14], eax
je 0x446da8
mov eax, dword [esi + 0x20]
or byte [esp + 0x2c], cl
or byte [esp + eax + 0x1c], cl
lea eax, [esp + eax + 0x1c]
mov eax, ebx
and eax, 4
mov dword [esp + 0x18], eax
je 0x446dbe
or byte [esp + 0x2c], cl
or byte [esp + 0xbd], cl
mov eax, ebx
and eax, 8
mov dword [esp + 0x10], eax
je 0x446dcd
or byte [esp + 0x2d], cl
mov ebp, ebx
and ebp, 1
je 0x446dd8
or byte [esp + 0x2e], cl
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
test edi, edi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
je 0x446e05
movzx edx, byte [esi + 0x1d]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 1
push edx
push 0x5b
push 0x100
push eax
call edi
cmp dword [esp + 0x14], 0
je 0x446e26
movzx ecx, byte [esi + 0x1b]
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push edx
push 0x100
push eax
call edi
cmp dword [esp + 0x18], 0
je 0x446e45
movzx ecx, byte [esi + 0x1c]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push 0x10
push 0x100
push edx
call edi
cmp dword [esp + 0x10], 0
je 0x446e64
movzx eax, byte [esi + 0x18]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push ecx
call edi
test ebp, ebp
je 0x446f1b
cmp dword [esp + 0x10], 0
jne 0x446e99
test ebx, 0x800
jne 0x446e99
movzx edx, byte [esi + 0x19]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 0x20000001
push edx
push 0x12
push 0x104
push eax
jmp 0x446f19
test ebp, ebp
je 0x446f1b
movzx ecx, byte [esi + 0x19]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push 0x12
push 0x100
push edx
jmp 0x446f19
mov edi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 0x10
je 0x446ecd
movzx eax, byte [esi + 0x1d]
push 0
push 0
push eax
push 0x5b
call edi
test bl, 2
je 0x446ee2
movzx ecx, byte [esi + 0x1b]
movzx edx, byte [esi + 0x20]
push 0
push 0
push ecx
push edx
call edi
test bl, 4
je 0x446ef7
movzx eax, byte [esi + 0x1c]
push 0
push 0
push eax
push 0xa1
call edi
test bl, 8
je 0x446f09
movzx ecx, byte [esi + 0x18]
push 0
push 0
push ecx
push 0x11
call edi
test bl, 1
je 0x446f1b
movzx edx, byte [esi + 0x19]
push 0
push 0
push edx
push 0x12
call edi
push esi
call fcn.00439746
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x446f2e
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x100
push ebx
push esi
mov esi, dword [esp + 0x10c]
test eax, 0x200
je 0x446f4c
or dword [esi + 0x10], 8
test eax, 0x400
je 0x446f57
or dword [esi + 0x10], 1
test eax, 0x100
je 0x446f62
or dword [esi + 0x10], 2
mov eax, dword [esi + 0x10]
test al, 8
je 0x446f76
test eax, 0x800
je 0x446f76
xor eax, 8
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test al, 1
je 0x446f8a
test eax, 0x100
je 0x446f8a
xor eax, 1
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test al, 2
je 0x446f9e
test eax, 0x200
je 0x446f9e
xor eax, 2
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test al, 0x10
je 0x446fb2
test eax, 0x1000
je 0x446fb2
xor eax, 0x10
mov dword [esi + 0x10], eax
xor ebx, ebx
cmp dword [esi + 0x14], ebx
je 0x447010
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [esi + 0x10]
test eax, 0x800
jne 0x446fd2
mov byte [esp + 0x19], bl
test eax, 0x100
jne 0x446fdd
mov byte [esp + 0x1a], bl
test eax, 0x200
jne 0x446fef
mov ecx, dword [esi + 0x20]
mov byte [esp + 0x18], bl
mov byte [esp + ecx + 8], bl
test eax, 0x1000
jne 0x446ffa
mov byte [esp + 0x63], bl
lea edx, [esp + 8]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
pop esi
pop ebx
add esp, 0x100
ret 8
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x44703a
push 0x11
call ebp
mov edx, 0x8000
test dx, ax
je 0x44704c
test dword [esi + 0x10], 0x800
jne 0x44704c
push ebx
push 0x11
push esi
call fcn.004468c9
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
jne 0x447068
push 0x12
call ebp
mov edx, 0x8000
test dx, ax
je 0x44707a
test dword [esi + 0x10], 0x100
jne 0x44707a
push ebx
push 0x12
push esi
call fcn.004468c9
mov eax, dword [esi + 0x20]
push eax
call edi
mov ecx, 0x8000
test cx, ax
jne 0x44709a
mov edx, dword [esi + 0x20]
push edx
call ebp
mov ecx, 0x8000
test cx, ax
je 0x4470ae
test dword [esi + 0x10], 0x200
jne 0x4470ae
mov edx, dword [esi + 0x20]
push ebx
push edx
push esi
call fcn.004468c9
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
jne 0x4470d0
push 0xa1
call ebp
mov edx, 0x8000
test dx, ax
je 0x4470e5
test dword [esi + 0x10], 0x400
jne 0x4470e5
push ebx
push 0xa1
push esi
call fcn.004468c9
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
jne 0x447101
push 0x5b
call ebp
mov edx, 0x8000
test dx, ax
je 0x447113
test dword [esi + 0x10], 0x1000
jne 0x447113
push ebx
push 0x5b
push esi
call fcn.004468c9
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x100
ret 8
Function at 0x447161
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [esp + 0x14], bl
je 0x4471c8
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_keybd_event]
push 0
mov byte [esp + 0x20], al
mov eax, dword [esp + 0x20]
push 0
push eax
push esi
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00439746
push 0
push esi
call edi
push 0
mov byte [esp + 0x20], al
mov edx, dword [esp + 0x20]
push 2
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
call fcn.0043975d
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
ret 0xc

Function at 0x447236
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
lea ecx, [eax + 4]
push edi
mov edi, dword [eax + edx]
mov dword [esi], ecx
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412c2a
mov ebx, eax
mov eax, dword [esi]
add eax, dword [esp + 0x18]
lea ebp, [edi + edi]
push ebp
push eax
push ebx
call fcn.00412480
add dword [esi], ebp
xor ecx, ecx
add esp, 0x10
xor eax, eax
mov word [ebx + ebp], cx
test edi, edi
jle 0x447292
xor word [ebx + eax*2], di
inc eax
cmp eax, edi
jl 0x447289
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 8

Function at 0x447855
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x447871
mov eax, dword [esp + 0x10]
cmp byte [eax + 5], 1
jne 0x4478c9
push 0
push 0
push 0xe
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jne 0x447889
mov edi, 0x7fff
push ebp
xor ecx, ecx
lea ebp, [edi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412c2a
add esp, 4
mov esi, eax
push esi
push ebp
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov word [esi + edi*2], cx
pop ebp
test eax, eax
jg 0x4478d4
push esi
call fcn.0041293d
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov edi, dword [esp + 0x10]
cmp byte [edi + 0xc], 0
jne 0x4478ef
push esi
call fcn.004127e5
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [edi + 0x24]
push eax
push esi
call fcn.00414c72
add esp, 8
push esi
test eax, eax
je 0x4478c1
mov byte [edi + 0xf0], 1
call fcn.0041293d
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x447e35
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
push edi
push 1
push eax
call fcn.00447a7a
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x25
call ebx
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x18], 0
push eax
jge 0x447e98
mov ecx, dword [esi]
push 0x25
push 0x100
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov edx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
push 0x101
push edx
jmp 0x447ec7
mov eax, dword [esi]
push 0x27
push 0x100
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov ecx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push ecx
call ebp
push 0
call edi
mov edx, dword [esi]
push 0
push edx
call fcn.00447a7a
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x44aebc
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
push 0x4a5e00
call fcn.00443fd0
test al, al
je case.0x44af45.8
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4a5e60]
mov edx, dword [ecx + eax*4]
mov eax, dword [esp + 0x14]
mov ebx, dword [edx]
mov ecx, dword [0x4a5e74]
mov edx, dword [ecx + eax*4]
mov esi, dword [edx]
mov al, byte [esi + 0x88]
mov edi, dword [esi]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x24], al
call fcn.00437738
mov eax, dword [esi + 0x44]
add esp, 4
test eax, eax
jl 0x44af2c
push eax
call fcn.00443882
movzx eax, byte [esp + 0x20]
cmp eax, 0x1b
ja case.0x44af45.8
movzx edx, byte [eax + 0x44b0ec]
mov ebp, dword [esp + 0x24]
jmp dword [edx*4 + 0x44b0c8]
mov ebp, dword [esp + 0x24]
cmp ebp, 0xfffffffe
je case.0x44af45.8
cmp ebp, 0xfe000000
jne 0x44af71
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.0044390f
jmp 0x44b090
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push 0
push 0x1001
push edi
call ebx
push ebp
push 0
push 0x1026
push edi
call ebx
mov eax, dword [esp + 0x18]
push 1
push esi
push eax
call fcn.00435c0d
jmp 0x44b090
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44af45.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.0044390f
jmp 0x44b090
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44af45.8
push eax
push 0
push 0x2001
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44b090
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44af45.8
push eax
push 0
push 0x111d
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44b090
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44af45.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.0044390f
mov ecx, dword [esi + 0x30]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x44b090
test ebp, ebp
jl case.0x44af45.8
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.0044390f
push 1
push esi
push ebx
call fcn.00435c0d
jmp 0x44b090
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
jl case.0x44af45.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.0044390f
test byte [esi + 0x8a], 0x20
jne 0x44b090
mov edx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call edi
mov eax, dword [esi]
push 5
push eax
call edi
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [0x494ce4], 0
je 0x44b0ad
cmp byte [esp + 0x20], 8
jne 0x44b0ad
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x44ca38
Capabilities:
Connect to http server

Disassembly:
sub esp, 0xc
cmp byte [esp + 0x18], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
je 0x44ca64
mov eax, dword [esp + 0x2c]
push eax
push esi
push edi
call fcn.0044c8fb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
mov ebp, dword [edi + 0x54]
push 0
push 0
push ebx
push eax
push ecx
movzx ecx, word [esi + 0x78]
push ecx
push edx
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44caa9
push 0xdeadbeef
push 0x15
push edi
call fcn.0044466e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov esi, dword [esi + 0x60]
push ebp
push accept
push esi
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileW]
mov esi, eax
mov eax, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
test esi, esi
jne 0x44cad7
push esi
push 0xdeadbeef
push 0x16
jmp 0x44cb20
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.WININET.dll_FtpGetFileSize]
mov edx, dword [esp + 0x28]
xor ecx, ecx
xor ebx, ebx
or ecx, eax
or edx, ebx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], edx
cmp byte [esp + 0x2c], bl
je 0x44cb1a
push esi
push edi
call fcn.00444885
mov bl, al
lea eax, [esp + 0x14]
push eax
call fcn.004364d7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
push 1
push 0
push 0
push edi
call fcn.0044466e
lea ecx, [esp + 0x14]
push ecx
mov bl, al
call fcn.004364d7
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret 0x10
Function at 0x44cb3e
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
cmp dword [esi + 0x74], 4
push edi
mov edi, dword [esp + 0x40]
mov ebp, dword [edi + 0x54]
jne 0x44cb5c
or ebp, 0x800000
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
push 0
push 0
push ebx
push eax
movzx eax, word [esi + 0x78]
push ecx
mov ecx, dword [edi + 4]
push eax
push edx
push ecx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44cb9e
push 0xdeadbeef
push 0xb
push edi
call fcn.0044466e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ecx, dword [esi + 0x60]
push ebp
push 0
push 0
push 0
push ecx
push 0
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
test ebx, ebx
jne 0x44cbec
push eax
push 0xdeadbeef
push 0xc
push edi
call fcn.0044466e
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004364d7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
cmp byte [esp + 0x48], 0
je 0x44cbfb
push esi
push ebx
push edi
call fcn.004448ad
test ebp, 0x1000
je 0x44cc36
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0x1f
push ebx
mov dword [esp + 0x54], 4
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [esp + 0x48], 0x100
push 4
lea eax, [esp + 0x4c]
push eax
push 0x1f
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x44cce3
push ebx
call fcn.00436565
cmp eax, 0xc8
jne 0x44cce3
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x20]
push eax
push 5
push ebx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0x20
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea ecx, [esp + 0x18]
push ecx
call fcn.0041494c
add esp, 4
cmp byte [esp + 0x4c], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
je 0x44ccbf
push ebx
push edi
call fcn.00444885
lea edx, [esp + 0x10]
push edx
mov bl, al
call fcn.004364d7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 1
push 0
push 0
push edi
call fcn.0044466e
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004364d7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 0
push 0xdeadbeef
push 0xd
push edi
call fcn.0044466e
lea ecx, [esp + 0x10]
push ecx
mov bl, al
call fcn.004364d7
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x2c
ret 0x10

Function at 0x44d0de
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp + 0xe4]
push esi
push edi
mov edi, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push eax
call fcn.00445038
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00444f92
xor esi, esi
test edi, edi
jbe 0x44d130
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call fcn.0044500a
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44d11e
pop edi
pop esi
pop ebx
add esp, 0xdc
ret 0xc