joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f4db
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x46f576
lea eax, [ebp - 0x22c]
push 0x490b80
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46f564
lea eax, [ebp - 0x22c]
push 0x4bb5b0
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46f564
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, eax
mov eax, dword [ebp + 0x10]
or ecx, dword [ebp + 0xc]
not eax
and ecx, eax
lea eax, [ebp - 0x22c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
je 0x46f629
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x46f505
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x14], 0
je 0x46f61e
lea eax, [ebp - 0x258]
push eax
push 0x4bb5a8
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x46f615
mov edi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x46f603
lea eax, [ebp - 0x22c]
push 0x490b80
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46f603
lea eax, [ebp - 0x22c]
push 0x4bb5b0
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46f603
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046f4db
test al, al
je 0x46f634
push 0x4bb5b0
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x46f5a5
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
jmp 0x46f620
xor ebx, ebx
jmp 0x46f617
Function at 0x46f638
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x46f6be
lea eax, [ebp - 0x22c]
push 0x490b80
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46f6ac
lea eax, [ebp - 0x22c]
push 0x4bb5b0
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46f6ac
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x22c]
call fcn.0046491c
pop ecx
test al, al
je 0x46f771
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x46f662
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x14], 0
je 0x46f766
lea eax, [ebp - 0x258]
push eax
push 0x4bb5a8
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x46f75d
mov edi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x46f74b
lea eax, [ebp - 0x22c]
push 0x490b80
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46f74b
lea eax, [ebp - 0x22c]
push 0x4bb5b0
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46f74b
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046f638
test al, al
je 0x46f77c
push 0x4bb5b0
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x46f6ed
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
jmp 0x46f768
xor ebx, ebx
jmp 0x46f75f
Function at 0x46f939
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call fcn.00407da1
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
push 0x4bb5a8
mov dword [ebp - 0x18], eax
inc dword [eax]
call fcn.00407c6b
lea eax, [ebp - 0x278]
mov bl, 1
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x46fa98
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.00456f64
cmp eax, 1
je 0x46fa93
cmp eax, 0xb
jne 0x46f9be
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x46f99e
lea eax, [ebp - 0x24c]
push 0x490b80
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46fa79
lea eax, [ebp - 0x24c]
push 0x4bb5b0
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46fa79
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.00408007
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00407c6b
test byte [ebp - 0x278], 0x10
je 0x46fa56
cmp byte [ebp + 0x18], 0
je 0x46fa25
add dword [esi], 1
adc dword [esi + 4], 0
cmp byte [ebp + 0x1c], 0
je 0x46fa79
push 0x490ac0
lea ecx, [ebp - 0x10]
call fcn.00407c6b
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.0046f939
mov bl, al
test bl, bl
je 0x46fa95
jmp 0x46fa79
mov edx, dword [ebp + 0xc]
xor eax, eax
or eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x25c]
add dword [edx], eax
adc dword [edx + 4], ecx
cmp byte [ebp + 0x18], 0
je 0x46fa79
add dword [edi], 1
adc dword [edi + 4], 0
lea eax, [ebp - 0x278]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x46f99e
jmp 0x46fa95
xor bl, bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x24]
call fcn.004058c4
lea ecx, [ebp - 0x10]
call fcn.004058c4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x471f5b
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [ebx + 0x74], 4
mov esi, dword [edi + 0x54]
mov dword [ebp - 4], esi
jne 0x471f7e
or esi, 0x800000
mov dword [ebp - 4], esi
movzx eax, word [ebx + 0x78]
push 0
push 0
push dword [ebx + 0x70]
push dword [ebx + 0x30]
push dword [ebx + 0x20]
push eax
push dword [ebx + 0x10]
push dword [edi + 4]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
test eax, eax
jne 0x471fb6
push eax
push 0xdeadbeef
push 0xb
mov ecx, edi
call fcn.004729c9
jmp 0x4720a5
xor ecx, ecx
push ecx
push esi
push ecx
push ecx
push ecx
push dword [ebx + 0x60]
push ecx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
test esi, esi
jne 0x471fdb
push eax
push 0xdeadbeef
push 0xc
jmp 0x47208f
cmp byte [ebp + 0xc], 0
je 0x471fea
push ebx
push esi
mov ecx, edi
call fcn.00472a00
test dword [ebp - 4], 0x1000
je 0x47201f
push 4
pop ebx
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [ebp + 0xc], 0x100
lea eax, [ebp + 0xc]
push ebx
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x472087
push esi
call fcn.00471f1a
cmp eax, 0xc8
jne 0x472087
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x20
push eax
lea eax, [ebp - 0x24]
push eax
push 5
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x24]
push eax
call fcn.004240a3
pop ecx
mov ecx, edi
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
cmp byte [ebp + 0x10], bl
je 0x472081
push esi
call fcn.00472834
jmp 0x472096
push 1
push ebx
push ebx
jmp 0x472091
push ebx
push 0xdeadbeef
push 0xd
mov ecx, edi
call fcn.004729c9
mov bl, al
test esi, esi
je 0x4720a3
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47271c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
inc ebx
push edi
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x472737
movzx eax, word [edi + 0x8c]
jmp 0x47273b
movzx eax, word [edi + 0x58]
lea edx, [edi + 0xb0]
movsx ecx, ax
cmp dword [ebp + 8], ebx
je 0x47274c
lea edx, [edi + 0x7c]
mov eax, dword [edi + 0xc0]
xor esi, esi
push esi
cmp ecx, ebx
jne 0x47275e
push esi
push esi
push ebx
jmp 0x472771
cmp ecx, 2
jne 0x47276e
push str._local_
push dword [edx]
push 3
jmp 0x472771
push esi
push esi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 4], eax
cmp eax, esi
jne 0x472783
xor al, al
jmp 0x4727a3
cmp byte [edi + 0xdc], 0
je 0x4727a1
push 8
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push 0x32
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x472834
Capabilities:
Download and write a file
Query remote server for available data
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x30], 0
je 0x472843
pop ebp
jmp fcn.00472904
pop ebp
jmp fcn.00472849

Function at 0x472ad4
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push 0x38
xor esi, esi
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.004238f0
xor eax, eax
mov dword [ebp - 0x4c], 0x7c
inc eax
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp + 8]
call fcn.0042370c
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x472b2b
xor al, al
jmp 0x472bdb
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push edi
push dword [ebp - 0x44]
push esi
push dword [ebp - 0x48]
call fcn.0040770d
push dword [ebp - 0x38]
lea ecx, [ebx + 0x10]
push esi
push dword [ebp - 0x3c]
call fcn.0040770d
push dword [ebp - 0x2c]
lea ecx, [ebx + 0x20]
push esi
push dword [ebp - 0x30]
call fcn.0040770d
push dword [ebp - 0x24]
lea ecx, [ebx + 0x30]
push esi
push dword [ebp - 0x28]
call fcn.0040770d
push dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
push esi
push dword [ebp - 0x20]
call fcn.0040770d
push dword [ebp - 0x14]
lea esi, [ebx + 0x50]
push 0
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0040770d
push esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x40]
call fcn.0045876c
push eax
lea ecx, [ebx + 0x60]
call fcn.00408007
lea ecx, [ebp - 0x10]
call fcn.004058c4
mov ax, word [ebp - 0x34]
mov word [ebx + 0x78], ax
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0x74], eax
dec eax
je 0x472bd0
dec eax
je 0x472bc7
mov dword [ebx + 0x70], 3
jmp 0x472bd7
mov dword [ebx + 0x70], 2
jmp 0x472bd7
mov dword [ebx + 0x70], 1
pop edi
mov al, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x472be2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xd0], 0
je 0x472c1f
cmp byte [ebp + 8], 0
je 0x472c1f
sub esp, 0x10
lea ecx, [esi + 0xd4]
call fcn.00471c80
push esi
push 0
push 0x472cb2
call fcn.004267dc
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
jmp 0x472c27
push dword [ebp + 8]
call fcn.00471e54
pop esi
pop ebp
ret 4

Function at 0x4777e2
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
or edx, 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov ebx, eax
imul ebx, dword [ebp + 0x14]
push edi
mov edi, esi
lea eax, [esi + eax*4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
shl ebx, 2
shl eax, 2
mov dword [ebp + 0xc], eax
movzx eax, byte [esi + 2]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi + 1]
xor edx, dword [ecx*4 + 0x4b80c0]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi]
add esi, ebx
xor edx, dword [ecx*4 + 0x4b80c0]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4b80c0]
cmp esi, dword [ebp + 8]
jb 0x477859
add edi, dword [ebp + 0xc]
mov esi, edi
cmp edi, dword [ebp + 0x10]
jb 0x477815
not edx
mov dword [ebp + 8], edx
fild dword [ebp + 8]
test edx, edx
jns 0x477870
fadd qword [0x4bcad8]
pop edi
fstp qword [ebp - 8]
fld qword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47787f
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [esi + 8]
mov edx, dword [esi]
cmp eax, edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esi + 4]
setl bl
cmp ecx, edi
mov byte [ebp - 1], bl
setl bh
mov byte [ebp + 0xf], bh
test bl, bl
je 0x4778b2
mov dword [esi], eax
mov dword [esi + 8], edx
test bh, bh
je 0x4778bc
mov dword [esi + 4], ecx
mov dword [esi + 0xc], edi
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0x104]
call fcn.00473ee6
mov ecx, dword [ebp - 0x1c]
add dword [esi + 8], ecx
mov eax, dword [ebp - 0x18]
add dword [esi + 0xc], eax
add dword [esi], ecx
add dword [esi + 4], eax
mov edi, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub edi, dword [esi]
sub ebx, dword [esi + 4]
inc edi
inc ebx
push 0
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push dword [ebp - 8]
mov dword [ebp + 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dh, byte [ebp + 0xf]
mov ecx, ebx
mov dword [ebp - 0x14], eax
test dh, dh
je 0x47792d
neg ecx
mov dl, byte [ebp - 1]
mov eax, edi
test dl, dl
je 0x477938
neg eax
test dh, dh
je 0x477941
mov ebx, dword [esi + 0xc]
jmp 0x477944
mov ebx, dword [esi + 4]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 0xc]
test dl, dl
je 0x477953
mov edx, dword [esi + 8]
jmp 0x477955
mov edx, dword [esi]
mov esi, dword [ebp - 0x10]
push 0xcc0020
push ecx
push eax
push dword [ebp + 0xc]
push edx
push dword [ebp - 8]
push ebx
push edi
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, ebx
mov dword [ebp - 0x48], 0x28
neg eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], eax
xor ecx, ecx
push 0x20
xor eax, eax
mov dword [ebp - 0x38], ecx
inc eax
mov word [ebp - 0x3c], ax
pop eax
push ecx
mov word [ebp - 0x3a], ax
lea eax, [ebp - 0x48]
push eax
push ecx
push ecx
push ecx
push dword [ebp + 8]
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDIBits]
call esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x34]
push ecx
mov dword [eax], ecx
call fcn.004218c6
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x48]
push eax
push edi
push ebx
mov ebx, dword [ebp - 0x10]
push 0
push dword [ebp + 8]
push ebx
call esi
push dword [ebp - 0x14]
mov esi, eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
test esi, esi
je 0x4779fe
mov eax, edi
jmp 0x477a07
push edi
call fcn.0042193c
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4782f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 2
pop eax
lea ecx, [ebp - 0x10]
mov word [edi], ax
call fcn.00405a78
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0047855b
push dword [ebp - 0x10]
call dword [sym.imp.WSOCK32.dll_inet_addr]
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004058c4
cmp ebx, 0xffffffff
jne 0x478347
mov ecx, dword [ebp + 0xc]
mov edx, str.255.255.255.255
call fcn.0045a9b6
test al, al
je 0x478347
push 0
push 1
jmp 0x47836a
mov ecx, dword [ebp + 0x10]
mov dword [edi + 4], ebx
lea eax, [ecx - 1]
cmp eax, 0xfffe
ja 0x478366
push ecx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [edi + 2], ax
mov al, 1
jmp 0x478378
push 0
push 2
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004570e7
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x478381
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
and dword [ebx], 0
mov edi, ecx
mov dword [ebx + 4], eax
mov ecx, 0x3e8
mov eax, esi
inc dword [ebx]
cdq
idiv ecx
mov dword [ebp - 8], eax
imul eax, eax, 0x3e8
sub esi, eax
imul eax, esi, 0x3e8
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
cmp byte [ebp + 0x14], al
je 0x4783ca
push ebx
push eax
jmp 0x4783cc
push eax
push ebx
push eax
call dword [sym.imp.WSOCK32.dll_select]
mov esi, eax
test esi, esi
jne 0x4783e6
cmp byte [ebp + 0x14], al
je 0x478412
push eax
push 0x274c
jmp 0x478406
jle 0x4783fd
push ebx
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll___WSAFDIsSet]
test eax, eax
jne 0x478412
push 0xfffffffffffffffe
pop esi
push eax
push esi
jmp 0x478406
push 0
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004570e7
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x481254
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0xff
xor ecx, ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
mov ebx, edx
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0xc], ebx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x481353
mov eax, ebx
or eax, 0x20019
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48136a
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.00481254
push dword [ebp - 8]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x48136a
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call fcn.00481099
test al, al
lea eax, [ebp - 0x228]
je 0x481305
push ebx
mov ebx, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ebx
push eax
push esi
call fcn.0047ffaa
call eax
jmp 0x481310
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [ebp - 0xc]
test eax, eax
jne 0x48135b
cmp dword [ebp - 0x18], eax
je 0x481322
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor ecx, ecx
mov dword [ebp - 4], 0xff
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x228]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov eax, dword [ebp - 0x1c]
jne 0x48129e
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x18], 0
je 0x48136a
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor al, al
jmp 0x481355
Function at 0x4888bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
mov ecx, 0x4c77b0
push ebx
push esi
push edi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00402382
test al, al
jne 0x4888e5
xor eax, eax
jmp 0x488abf
mov ecx, dword [ebp - 4]
mov eax, dword [0x4c7810]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [0x4c7824]
mov eax, dword [eax + ecx*4]
lea ecx, [ebp + 0xc]
mov edi, dword [eax]
mov bl, byte [edi + 0x90]
mov esi, dword [edi]
mov dword [ebp - 8], esi
mov byte [ebp + 0xb], bl
call fcn.004031b1
cmp dword [edi + 0x48], 0
jl 0x488926
push dword [edi + 0x48]
call fcn.0048a726
movzx eax, bl
mov ebx, dword [ebp + 0xc]
cmp eax, 0x12
jg 0x488a0a
je 0x4889c7
test eax, eax
je 0x4889b7
jle 0x4888de
cmp eax, 4
jle 0x488a50
cmp eax, 8
je 0x488997
cmp eax, 0x10
je 0x488981
cmp eax, 0x11
jne 0x4888de
mov eax, dword [ebp + 0xc]
test eax, eax
js 0x4888de
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00402250
push 1
push 0
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x488aa8
cmp dword [ebp + 0xc], 0
jl 0x4888de
push dword [ebp + 0xc]
push 0
push 0x111d
jmp 0x4889ab
cmp dword [ebp + 0xc], 0
jl 0x4888de
push dword [ebp + 0xc]
push 0
push 0x2001
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x488aa8
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x488a72
jmp 0x4888de
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jl 0x4888de
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00402250
test byte [edi + 0x92], 0x20
jne 0x488aa8
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi]
call esi
push 5
push dword [edi]
call esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x488aa8
cmp eax, 0x13
je 0x488a5d
cmp eax, 0x14
je 0x488959
cmp eax, 0x17
je 0x488a50
cmp eax, 0x18
je 0x488a32
jle 0x4888de
cmp eax, 0x1b
jle 0x488a50
jmp 0x4888de
test ebx, ebx
js 0x4888de
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push ebx
mov dword [edi + 0x48], ebx
call fcn.00402250
jmp 0x488a9d
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xfffffffe
je 0x4888de
mov eax, 0xfe000000
cmp ebx, eax
jne 0x488a7f
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00402250
jmp 0x488aa8
push ebx
push 0
push 0x1001
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push ebx
push 0
push 0x1026
push dword [ebp - 8]
call esi
push 1
push edi
push dword [ebp - 4]
call fcn.0048b587
cmp dword [0x4c72b0], 0
je 0x488abc
cmp byte [ebp + 0xb], 8
jne 0x488abc
or eax, 0xffffffff
jmp 0x488abf
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8