joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcd9642
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0xcd96dd
lea eax, [ebp - 0x22c]
push 0xcfcc40
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd96cb
lea eax, [ebp - 0x22c]
push 0xd26b7c
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd96cb
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov eax, dword [ebp + 0x10]
or ecx, dword [ebp + 0xc]
not eax
and ecx, eax
lea eax, [ebp - 0x22c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0xcd978e
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0xcd966c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0x14], 0
je 0xcd9785
lea eax, [ebp - 0x258]
push eax
push 0xd26b74
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0xcd977c
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0xcd976a
lea eax, [ebp - 0x22c]
push 0xcfcc40
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd976a
lea eax, [ebp - 0x22c]
push 0xd26b7c
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd976a
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00cd9642
test al, al
je 0xcd9799
push 0xd26b7c
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0xcd970c
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0xcd9787
xor ebx, ebx
jmp 0xcd977e
Function at 0xcd979d
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0xcd9823
lea eax, [ebp - 0x22c]
push 0xcfcc40
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd9811
lea eax, [ebp - 0x22c]
push 0xd26b7c
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd9811
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x22c]
call fcn.00ccdae5
pop ecx
test al, al
je 0xcd98d4
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0xcd97c7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0x14], 0
je 0xcd98cb
lea eax, [ebp - 0x258]
push eax
push 0xd26b74
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0xcd98c2
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0xcd98b0
lea eax, [ebp - 0x22c]
push 0xcfcc40
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd98b0
lea eax, [ebp - 0x22c]
push 0xd26b7c
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd98b0
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00cd979d
test al, al
je 0xcd98df
push 0xd26b7c
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0xcd9852
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0xcd98cd
xor ebx, ebx
jmp 0xcd98c4
Function at 0xcd9b2b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x14]
call fcn.00c69cb3
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push 0xd26b74
mov dword [ebp - 0x18], eax
inc dword [eax]
call fcn.00c633c6
lea eax, [ebp - 0x278]
mov bl, 1
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0xcd9c8a
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
call fcn.00cd3874
cmp eax, 1
je 0xcd9c85
cmp eax, 0xb
jne 0xcd9bb0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0xcd9b90
lea eax, [ebp - 0x24c]
push 0xcfcc40
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd9c6b
lea eax, [ebp - 0x24c]
push 0xd26b7c
push eax
call fcn.00c85232
pop ecx
pop ecx
test eax, eax
je 0xcd9c6b
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.00c6a8c7
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00c633c6
test byte [ebp - 0x278], 0x10
je 0xcd9c48
cmp byte [ebp + 0x18], 0
je 0xcd9c17
add dword [esi], 1
adc dword [esi + 4], 0
cmp byte [ebp + 0x1c], 0
je 0xcd9c6b
push 0xcfcb68
lea ecx, [ebp - 0x14]
call fcn.00c633c6
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 4]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call fcn.00cd9b2b
mov bl, al
test bl, bl
je 0xcd9c87
jmp 0xcd9c6b
mov edx, dword [ebp + 0xc]
xor eax, eax
or eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x25c]
add dword [edx], eax
adc dword [edx + 4], ecx
cmp byte [ebp + 0x18], 0
je 0xcd9c6b
add dword [edi], 1
adc dword [edi + 4], 0
lea eax, [ebp - 0x278]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0xcd9b90
jmp 0xcd9c87
xor bl, bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x24]
call fcn.00c6988f
lea ecx, [ebp - 0x14]
call fcn.00c6988f
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x18
Function at 0xcdc476
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [edi + 0x74], 4
mov eax, dword [esi + 0x54]
mov dword [ebp - 4], eax
jne 0xcdc498
or eax, 0x800000
mov dword [ebp - 4], eax
movzx eax, word [edi + 0x78]
xor ebx, ebx
push ebx
push ebx
push dword [edi + 0x70]
push dword [edi + 0x30]
push dword [edi + 0x20]
push eax
push dword [edi + 0x10]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi], eax
test eax, eax
jne 0xcdc4e4
mov dword [esi + 0x18], 0xb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0xcdc4dd
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor al, al
jmp 0xcdc603
push ebx
push dword [ebp - 4]
push ebx
push ebx
push ebx
push dword [edi + 0x60]
push ebx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
test edi, edi
jne 0xcdc508
mov dword [esi + 0x18], 0xc
jmp 0xcdc5dc
cmp byte [ebp + 0xc], bl
je 0xcdc518
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.00cdd001
test dword [ebp - 4], 0x1000
je 0xcdc54f
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1f
push edi
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [ebp + 0xc], 0x100
lea eax, [ebp + 0xc]
push 4
push eax
push 0x1f
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0xcdc5d5
push edi
call fcn.00cdc437
cmp eax, 0xc8
jne 0xcdc5d5
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x20
push eax
lea eax, [ebp - 0x24]
push eax
push 5
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x24]
push eax
call fcn.00c862fb
pop ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
cmp byte [ebp + 0x10], bl
je 0xcdc5bd
mov ecx, esi
push edi
cmp byte [esi + 0x30], bl
je 0xcdc5b4
call fcn.00cdcf1a
jmp 0xcdc5b9
call fcn.00cdce44
mov bl, al
jmp 0xcdc5f6
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0xd4]
test eax, eax
je 0xcdc5d1
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov bl, 1
jmp 0xcdc5f6
mov dword [esi + 0x18], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0xcdc5f6
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test edi, edi
je 0xcdc601
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0xcdcd1e
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
inc ebx
push edi
mov edi, ecx
cmp eax, ebx
jne 0xcdcd3b
movzx ecx, word [edi + 0x8c]
jmp 0xcdcd3f
movzx ecx, word [edi + 0x58]
movzx edx, cx
mov ecx, dword [edi + 0xc0]
cmp dx, bx
jne 0xcdcd55
xor esi, esi
push esi
push esi
push esi
push ebx
jmp 0xcdcd7c
cmp dx, 2
jne 0xcdcd76
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffcc
xor esi, esi
push esi
push str._local_
push dword [eax + edi + 0xb0]
push 3
jmp 0xcdcd7c
xor esi, esi
push esi
push esi
push esi
push esi
push ecx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 4], eax
test eax, eax
jne 0xcdcd8e
xor al, al
jmp 0xcdcdae
cmp byte [edi + 0xdc], 0
je 0xcdcdac
push 8
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push 0x32
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0xcdce44
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, ecx
push edi
push 0xd26a94
push dword [esi + 0x34]
call fcn.00c8e5eb
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0xcdce70
mov dword [esi + 0x18], 0x1f
jmp 0xcdceea
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0xcdcee3
cmp dword [ebp - 4], 0
je 0xcdcebb
push edi
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x404]
push eax
call fcn.00c8dbb3
mov eax, dword [ebp - 4]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0xcdce76
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0xcdcecc
mov dword [esi + 0x18], 0x21
jmp 0xcdceea
and dword [esi + 0x18], 0
mov eax, dword [esi + 0xd4]
test eax, eax
je 0xcdcf06
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0xcdcf06
mov dword [esi + 0x18], 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0xcdcf04
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor bl, bl
test edi, edi
je 0xcdcf11
push edi
call fcn.00c8e678
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4
Function at 0xcdcf1a
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
inc eax
mov esi, ecx
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov eax, dword [ebp - 8]
test eax, eax
jne 0xcdcf4d
mov eax, 0x400
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
je 0xcdcfa5
test eax, eax
jne 0xcdcf5a
mov edi, ebx
jmp 0xcdcf66
push eax
call fcn.00c7fe0b
mov edi, eax
mov eax, dword [ebp - 8]
pop ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0xcdcfd2
cmp dword [ebp - 4], ebx
je 0xcdcf9c
push dword [ebp - 4]
lea ecx, [esi + 0x44]
push edi
call fcn.00cdd27e
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
adc dword [esi + 0xc], ebx
test eax, eax
je 0xcdcfa5
mov eax, dword [ebp - 8]
jmp 0xcdcf52
push ebx
push edi
call fcn.00c7fdcd
pop ecx
pop ecx
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0xcdcfe4
mov dword [esi + 0x18], 0x21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0xcdcfce
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor al, al
jmp 0xcdcffa
push ebx
push edi
call fcn.00c7fdcd
pop ecx
pop ecx
mov dword [esi + 0x18], 0x20
jmp 0xcdcfb4
mov dword [esi + 0x18], ebx
mov ecx, dword [esi + 0xd4]
test ecx, ecx
je 0xcdcff8
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xcdd0f4
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push 0x3c
xor esi, esi
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.00c82340
xor eax, eax
mov dword [ebp - 0x4c], 0x7c
inc eax
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp + 8]
call fcn.00c84963
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0xcdd14b
xor al, al
jmp 0xcdd203
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push edi
push dword [ebp - 0x44]
push esi
push dword [ebp - 0x48]
call fcn.00c66e90
push dword [ebp - 0x38]
lea ecx, [ebx + 0x10]
push esi
push dword [ebp - 0x3c]
call fcn.00c66e90
push dword [ebp - 0x2c]
lea ecx, [ebx + 0x20]
push esi
push dword [ebp - 0x30]
call fcn.00c66e90
push dword [ebp - 0x24]
lea ecx, [ebx + 0x30]
push esi
push dword [ebp - 0x28]
call fcn.00c66e90
push dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
push esi
push dword [ebp - 0x20]
call fcn.00c66e90
push dword [ebp - 0x14]
lea esi, [ebx + 0x50]
push 0
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00c66e90
push esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x40]
call fcn.00c64a88
lea ecx, [ebx + 0x60]
cmp ecx, eax
je 0xcdd1c6
push eax
call fcn.00c6a8c7
lea ecx, [ebp - 0x10]
call fcn.00c6988f
mov ax, word [ebp - 0x34]
mov word [ebx + 0x78], ax
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0x74], eax
sub eax, 1
je 0xcdd1f8
sub eax, 1
je 0xcdd1ef
mov dword [ebx + 0x70], 3
jmp 0xcdd1ff
mov dword [ebx + 0x70], 2
jmp 0xcdd1ff
mov dword [ebx + 0x70], 1
pop edi
mov al, 1
pop ebx
pop esi
leave
ret 8

Function at 0xcdd208
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xd0], 0
je 0xcdd244
cmp byte [ebp + 8], 0
je 0xcdd244
sub esp, 0x10
lea ecx, [esi + 0xd4]
call fcn.00cdc118
push esi
push 0
push 0xcdd2d8
call fcn.00c8d1cc
add esp, 0xc
cmp dword [esi + 0x18], 0
sete al
jmp 0xcdd24c
push dword [ebp + 8]
call fcn.00cdc364
pop esi
pop ebp
ret 4
Function at 0xce24c1
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
or edx, 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov ebx, eax
imul ebx, dword [ebp + 0x14]
push edi
mov edi, esi
lea eax, [esi + eax*4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
shl ebx, 2
shl eax, 2
mov dword [ebp + 0xc], eax
movzx eax, byte [esi + 2]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi + 1]
xor edx, dword [ecx*4 + 0xd23640]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi]
add esi, ebx
xor edx, dword [ecx*4 + 0xd23640]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0xd23640]
cmp esi, dword [ebp + 8]
jb 0xce2538
add edi, dword [ebp + 0xc]
mov esi, edi
cmp edi, dword [ebp + 0x10]
jb 0xce24f4
not edx
mov dword [ebp + 8], edx
fild dword [ebp + 8]
test edx, edx
jns 0xce254f
fadd qword [0xd281c0]
pop edi
fstp qword [ebp - 8]
fld qword [ebp - 8]
pop esi
pop ebx
leave
ret 0x10
Function at 0xce304e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push 2
pop ecx
mov word [eax], cx
lea ecx, [ebp - 0x14]
call fcn.00c69ad3
mov ebx, dword [ebp + 0xc]
lea edx, [ebp - 0x14]
mov ecx, ebx
call fcn.00ce335b
push dword [ebp - 0x14]
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov edi, eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.00c6988f
cmp edi, 0xffffffff
jne 0xce30f1
mov ebx, dword [ebx + 4]
mov edi, str.255.255.255.255
push edi
call fcn.00c84963
pop ecx
cmp ebx, eax
jne 0xce30ca
test ebx, ebx
je 0xce30c4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
sub eax, edi
movzx ecx, word [eax + edi]
movzx edx, word [edi]
cmp cx, dx
jne 0xce30e6
add edi, 2
sub ebx, 1
jne 0xce30b0
xor eax, eax
test eax, eax
je 0xce30ee
mov eax, dword [esi]
mov ecx, dword [eax + 4]
cmp byte [ecx + esi + 0xd], 0
mov eax, dword [ecx + esi + 8]
je 0xce30dd
mov eax, dword [eax + 0x38]
mov dword [eax + 0x14], 1
jmp 0xce312e
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0xce30c6
mov edi, dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 4], edi
test eax, eax
jle 0xce3114
cmp eax, 0xffff
jg 0xce3114
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebx + 2], ax
mov al, 1
jmp 0xce3142
mov eax, dword [esi]
mov ecx, dword [eax + 4]
cmp byte [ecx + esi + 0xd], 0
mov eax, dword [ecx + esi + 8]
je 0xce3127
mov eax, dword [eax + 0x38]
mov dword [eax + 0x14], 2
cmp byte [ecx + esi + 0xd], 0
mov eax, dword [ecx + esi + 8]
je 0xce313c
mov eax, dword [eax + 0x38]
mov byte [eax + 0x18], 0
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0xce3149
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
and dword [ebx], 0
mov edi, ecx
mov dword [ebx + 4], eax
mov ecx, 0x3e8
mov eax, esi
inc dword [ebx]
cdq
idiv ecx
mov dword [ebp - 8], eax
imul eax, eax, 0x3e8
sub esi, eax
imul eax, esi, 0x3e8
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
cmp byte [ebp + 0x14], al
je 0xce3192
push ebx
push eax
jmp 0xce3194
push eax
push ebx
push eax
call dword [sym.imp.WSOCK32.dll_select]
mov esi, eax
test esi, esi
jne 0xce31c2
cmp byte [ebp + 0x14], al
je 0xce321b
mov eax, dword [edi]
mov ecx, dword [eax + 4]
cmp byte [ecx + edi + 0xd], 0
mov eax, dword [ecx + edi + 8]
je 0xce31b9
mov eax, dword [eax + 0x38]
mov dword [eax + 0x14], 0x274c
jmp 0xce3209
jle 0xce31ed
push ebx
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll___WSAFDIsSet]
test eax, eax
jne 0xce321b
mov eax, dword [edi]
push 0xfffffffffffffffe
pop esi
mov ecx, dword [eax + 4]
cmp byte [ecx + edi + 0xd], 0
mov eax, dword [ecx + edi + 8]
je 0xce31e8
mov eax, dword [eax + 0x38]
mov dword [eax + 0x14], esi
jmp 0xce3209
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
cmp byte [ecx + edi + 0xd], 0
mov edx, dword [ecx + edi + 8]
je 0xce3206
mov edx, dword [edx + 0x38]
mov dword [edx + 0x14], eax
cmp byte [ecx + edi + 0xd], 0
mov eax, dword [ecx + edi + 8]
je 0xce3217
mov eax, dword [eax + 0x38]
mov byte [eax + 0x18], 0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0xcecc34
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0xff
push eax
xor esi, esi
lea eax, [ebp - 4]
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x218]
mov edi, ecx
push eax
push esi
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0xcecd3c
mov eax, ebx
or eax, 0x20019
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 8]
push ecx
push eax
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcecd4e
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.00cecc34
push dword [ebp - 8]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0xcecd4e
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0xcecceb
push str.RegDeleteKeyExW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xcecceb
mov ebx, dword [ebp - 0xc]
lea ecx, [ebp - 0x218]
push 0
push ebx
push ecx
push edi
call eax
jmp 0xceccfc
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [ebp - 0xc]
test eax, eax
jne 0xcecd43
test esi, esi
je 0xcecd0b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0xff
push eax
xor esi, esi
lea eax, [ebp - 4]
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov eax, dword [ebp - 0x10]
jne 0xcecc7f
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
test esi, esi
je 0xcecd4e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0xcecd3e
Function at 0xcf50d4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00c6abdf
test al, al
je 0xcf515a
mov ecx, dword [ebp - 4]
mov eax, dword [0xd31910]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov eax, dword [0xd31924]
mov eax, dword [eax + ecx*4]
lea ecx, [ebp + 0xc]
mov edi, dword [eax]
mov esi, dword [edi]
mov bl, byte [edi + 0x90]
mov dword [ebp - 8], esi
call fcn.00c79bd8
cmp dword [edi + 0x48], 0
jl 0xcf512f
push dword [edi + 0x48]
call fcn.00cf6fba
cmp bl, 0x12
ja 0xcf51dc
je 0xcf519d
test bl, bl
je 0xcf5191
cmp bl, 4
jbe 0xcf5220
cmp bl, 8
je 0xcf5175
cmp bl, 0x10
je 0xcf5163
cmp bl, 0x11
je 0xcf5230
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
cmp dword [ebp + 0xc], 0
jl 0xcf515a
push dword [ebp + 0xc]
push 0
push 0x111d
jmp 0xcf5185
cmp dword [ebp + 0xc], 0
jl 0xcf515a
push dword [ebp + 0xc]
push 0
push 0x2001
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0xcf52a3
mov eax, dword [ebp + 0xc]
test eax, eax
js 0xcf515a
jmp 0xcf5269
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jl 0xcf515a
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00c79700
test byte [edi + 0x92], 0x20
jne 0xcf52a3
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi]
call esi
push 5
push dword [edi]
call esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0xcf52a3
cmp bl, 0x13
je 0xcf5255
cmp bl, 0x14
je 0xcf5230
cmp bl, 0x17
je 0xcf5220
cmp bl, 0x18
je 0xcf5200
jbe 0xcf515a
cmp bl, 0x1b
jbe 0xcf5220
jmp 0xcf515a
cmp dword [ebp + 0xc], 0
jl 0xcf515a
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp + 0xc]
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00c79700
jmp 0xcf5298
mov eax, dword [ebp + 0xc]
test eax, eax
js 0xcf515a
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00c79700
push 1
push 0
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0xcf52a3
cmp dword [ebp + 0xc], 0xfffffffe
je 0xcf515a
mov eax, 0xfe000000
cmp dword [ebp + 0xc], eax
jne 0xcf5276
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00c79700
jmp 0xcf52a3
push dword [ebp + 0xc]
push 0
push 0x1001
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push dword [ebp + 0xc]
push 0
push 0x1026
push dword [ebp - 8]
call esi
push 1
push edi
push dword [ebp + 8]
call fcn.00cf7e14
cmp dword [0xd31390], 0
je 0xcf52b9
cmp bl, 8
jne 0xcf52b9
or eax, 0xffffffff
jmp 0xcf515c
xor eax, eax
inc eax
jmp 0xcf515c