joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452e1c
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x452eb7
lea eax, [ebp - 0x22c]
push 0x49eaa0
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x452ea5
lea eax, [ebp - 0x22c]
push 0x4b4a70
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x452ea5
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, eax
or ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
not eax
and ecx, eax
push ecx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
je 0x452f68
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x452e46
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x14], 0
je 0x452f5f
lea eax, [ebp - 0x258]
push eax
push 0x4b4a68
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x452f56
mov edi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x452f44
lea eax, [ebp - 0x22c]
push 0x49eaa0
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x452f44
lea eax, [ebp - 0x22c]
push 0x4b4a70
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x452f44
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00452e1c
test al, al
je 0x452f73
push 0x4b4a70
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x452ee6
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
jmp 0x452f61
xor ebx, ebx
jmp 0x452f58
Function at 0x452f77
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x452ffd
lea eax, [ebp - 0x22c]
push 0x49eaa0
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x452feb
lea eax, [ebp - 0x22c]
push 0x4b4a70
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x452feb
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x22c]
call fcn.00448276
pop ecx
test al, al
je 0x4530ae
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x452fa1
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x14], 0
je 0x4530a5
lea eax, [ebp - 0x258]
push eax
push 0x4b4a68
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45309c
mov edi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x45308a
lea eax, [ebp - 0x22c]
push 0x49eaa0
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x45308a
lea eax, [ebp - 0x22c]
push 0x4b4a70
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x45308a
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00452f77
test al, al
je 0x4530b9
push 0x4b4a70
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45302c
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
jmp 0x4530a7
xor ebx, ebx
jmp 0x45309e
Function at 0x453281
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call fcn.0040df29
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
push 0x4b4a68
inc dword [eax]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
call fcn.00405f15
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x10]
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x4533e0
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.0041f315
cmp eax, 1
je 0x4533db
cmp eax, 0xb
jne 0x453306
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4532e6
lea eax, [ebp - 0x24c]
push 0x49eaa0
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x4533c1
lea eax, [ebp - 0x24c]
push 0x4b4a70
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x4533c1
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040da0c
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00405f15
test byte [ebp - 0x278], 0x10
je 0x45339e
cmp byte [ebp + 0x18], 0
je 0x45336d
add dword [esi], 1
adc dword [esi + 4], 0
cmp byte [ebp + 0x1c], 0
je 0x4533c1
push 0x49ec84
lea ecx, [ebp - 0x10]
call fcn.00405f15
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.00453281
mov bl, al
test bl, bl
je 0x4533dd
jmp 0x4533c1
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x25c]
xor eax, eax
or eax, dword [ebp - 0x258]
add dword [edx], eax
adc dword [edx + 4], ecx
cmp byte [ebp + 0x18], 0
je 0x4533c1
add dword [edi], 1
adc dword [edi + 4], 0
lea eax, [ebp - 0x278]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4532e6
jmp 0x4533dd
xor bl, bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x24]
call fcn.00408d6e
lea ecx, [ebp - 0x10]
call fcn.00408d6e
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x18
Function at 0x4559f7
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
cmp dword [ebx + 0x74], 4
push edi
mov edi, ecx
mov esi, dword [edi + 0x54]
mov dword [ebp - 4], esi
jne 0x455a1a
or esi, 0x800000
mov dword [ebp - 4], esi
movzx eax, word [ebx + 0x78]
push 0
push 0
push dword [ebx + 0x70]
push dword [ebx + 0x30]
push dword [ebx + 0x20]
push eax
push dword [ebx + 0x10]
push dword [edi + 4]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
test eax, eax
jne 0x455a52
push eax
push 0xdeadbeef
push 0xb
mov ecx, edi
call fcn.0045647e
jmp 0x455b41
xor ecx, ecx
push ecx
push esi
push ecx
push ecx
push ecx
push dword [ebx + 0x60]
push ecx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
test esi, esi
jne 0x455a77
push eax
push 0xdeadbeef
push 0xc
jmp 0x455b2b
cmp byte [ebp + 0xc], 0
je 0x455a86
push ebx
push esi
mov ecx, edi
call fcn.004564d8
test dword [ebp - 4], 0x1000
je 0x455abb
push 4
pop ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1f
push esi
mov dword [ebp + 8], ebx
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [ebp + 0xc], 0x100
push ebx
lea eax, [ebp + 0xc]
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x455b23
push esi
call fcn.004559b9
cmp eax, 0xc8
jne 0x455b23
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
push 5
push esi
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], 0x20
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x24]
push eax
call fcn.00422eba
pop ecx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov ecx, edi
cmp byte [ebp + 0x10], bl
je 0x455b1d
push esi
call fcn.004562e0
jmp 0x455b32
push 1
push ebx
push ebx
jmp 0x455b2d
push ebx
push 0xdeadbeef
push 0xd
mov ecx, edi
call fcn.0045647e
mov bl, al
test esi, esi
je 0x455b3f
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4561ca
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
inc ebx
push edi
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x4561e5
movzx eax, word [edi + 0x8c]
jmp 0x4561e9
movzx eax, word [edi + 0x58]
movsx ecx, ax
lea edx, [edi + 0xb0]
cmp dword [ebp + 8], ebx
je 0x4561fa
lea edx, [edi + 0x7c]
mov eax, dword [edi + 0xc0]
xor esi, esi
push esi
cmp ecx, ebx
jne 0x45620c
push esi
push esi
push ebx
jmp 0x45621f
cmp ecx, 2
jne 0x45621c
push str._local_
push dword [edx]
push 3
jmp 0x45621f
push esi
push esi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 4], eax
cmp eax, esi
jne 0x456231
xor al, al
jmp 0x456251
cmp byte [edi + 0xdc], 0
je 0x45624f
push 8
lea ecx, [ebp - 8]
push ecx
push 0x32
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4562e0
Capabilities:
Download and write a file
Query remote server for available data
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x30], 0
je 0x4562ef
pop ebp
jmp fcn.004563ae
pop ebp
jmp fcn.004562f5

Function at 0x4565ac
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push 0x38
xor esi, esi
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.004225e0
xor eax, eax
inc eax
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0x4c], 0x7c
call fcn.0042256b
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x456603
xor al, al
jmp 0x4566b3
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push dword [ebp - 0x44]
mov ecx, ebx
push esi
push dword [ebp - 0x48]
call fcn.0040942a
push dword [ebp - 0x38]
lea ecx, [ebx + 0x10]
push esi
push dword [ebp - 0x3c]
call fcn.0040942a
push dword [ebp - 0x2c]
lea ecx, [ebx + 0x20]
push esi
push dword [ebp - 0x30]
call fcn.0040942a
push dword [ebp - 0x24]
lea ecx, [ebx + 0x30]
push esi
push dword [ebp - 0x28]
call fcn.0040942a
push dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
push esi
push dword [ebp - 0x20]
call fcn.0040942a
push dword [ebp - 0x14]
lea esi, [ebx + 0x50]
push 0
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0040942a
push esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x40]
call fcn.0043cd0c
push eax
lea ecx, [ebx + 0x60]
call fcn.0040da0c
lea ecx, [ebp - 0x10]
call fcn.00408d6e
mov ax, word [ebp - 0x34]
mov word [ebx + 0x78], ax
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0x74], eax
dec eax
je 0x4566a8
dec eax
je 0x45669f
mov dword [ebx + 0x70], 3
jmp 0x4566af
mov dword [ebx + 0x70], 2
jmp 0x4566af
mov dword [ebx + 0x70], 1
pop edi
mov al, 1
pop ebx
pop esi
leave
ret 8
Function at 0x4566b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xd0], 0
je 0x4566f5
cmp byte [ebp + 8], 0
je 0x4566f5
sub esp, 0x10
lea ecx, [esi + 0xd4]
call fcn.00455723
push esi
push 0
push 0x456786
call fcn.004257bd
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
jmp 0x4566fd
push dword [ebp + 8]
call fcn.004558f5
pop esi
pop ebp
ret 4

Function at 0x45b025
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov ebx, eax
imul ebx, dword [ebp + 0x14]
lea eax, [esi + eax*4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
or edx, 0xffffffff
shl ebx, 2
shl eax, 2
push edi
mov dword [ebp + 0xc], eax
mov edi, esi
movzx eax, byte [esi + 2]
movzx ecx, dl
xor ecx, eax
movzx eax, byte [esi + 1]
shr edx, 8
xor edx, dword [ecx*4 + 0x4c0b70]
movzx ecx, dl
xor ecx, eax
movzx eax, byte [esi]
shr edx, 8
xor edx, dword [ecx*4 + 0x4c0b70]
add esi, ebx
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4c0b70]
cmp esi, dword [ebp + 8]
jb 0x45b09a
add edi, dword [ebp + 0xc]
mov esi, edi
cmp edi, dword [ebp + 0x10]
jb 0x45b056
not edx
movd xmm0, edx
cvtdq2pd xmm0, xmm0
pop edi
shr edx, 0x1f
pop esi
addsd xmm0, qword [edx*8 + 0x4b7590]
pop ebx
pop ebp
ret 0x10
Function at 0x45b0bc
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [esi + 8]
mov edx, dword [esi]
mov edi, dword [esi + 4]
cmp eax, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
setl bl
cmp ecx, edi
setl bh
mov byte [ebp - 1], bl
mov byte [ebp + 0xf], bh
test bl, bl
je 0x45b0ef
mov dword [esi], eax
mov dword [esi + 8], edx
test bh, bh
je 0x45b0f9
mov dword [esi + 4], ecx
mov dword [esi + 0xc], edi
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0x108]
call fcn.00457958
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add dword [esi + 8], ecx
add dword [esi + 0xc], eax
add dword [esi], ecx
add dword [esi + 4], eax
mov edi, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub edi, dword [esi]
sub ebx, dword [esi + 4]
inc edi
inc ebx
push 0
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push dword [ebp - 8]
mov dword [ebp + 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dh, byte [ebp + 0xf]
mov dword [ebp - 0x14], eax
mov ecx, ebx
test dh, dh
je 0x45b16a
neg ecx
mov dl, byte [ebp - 1]
mov eax, edi
test dl, dl
je 0x45b175
neg eax
test dh, dh
je 0x45b17e
mov ebx, dword [esi + 0xc]
jmp 0x45b181
mov ebx, dword [esi + 4]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 0xc]
test dl, dl
je 0x45b190
mov edx, dword [esi + 8]
jmp 0x45b192
mov edx, dword [esi]
mov esi, dword [ebp - 0x10]
push 0xcc0020
push ecx
push eax
push dword [ebp + 0xc]
push edx
push dword [ebp - 8]
push ebx
push edi
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, ebx
neg eax
mov dword [ebp - 0x40], eax
push 0x20
xor eax, eax
inc eax
xor ecx, ecx
mov word [ebp - 0x3c], ax
pop eax
push ecx
mov word [ebp - 0x3a], ax
lea eax, [ebp - 0x48]
push eax
push ecx
push ecx
push ecx
push dword [ebp + 8]
mov dword [ebp - 0x48], 0x28
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDIBits]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x38], ecx
call esi
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp + 0x10]
push ecx
mov dword [eax], ecx
call fcn.00420d7a
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x48]
push eax
push edi
push ebx
mov ebx, dword [ebp - 0x10]
push 0
push dword [ebp + 8]
push ebx
call esi
push dword [ebp - 0x14]
mov esi, eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
test esi, esi
je 0x45b23b
mov eax, edi
jmp 0x45b244
push edi
call fcn.00420dee
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45bb17
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 2
pop eax
mov word [edi], ax
lea eax, [ebp - 0x10]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0045bc7f
push dword [eax]
call dword [sym.imp.WSOCK32.dll_inet_addr]
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00408d6e
cmp ebx, 0xffffffff
jne 0x45bb65
mov ecx, dword [ebp + 0xc]
mov edx, str.255.255.255.255
call fcn.0043e27e
test al, al
je 0x45bb65
push 0
push 1
jmp 0x45bb88
mov ecx, dword [ebp + 0x10]
mov dword [edi + 4], ebx
lea eax, [ecx - 1]
cmp eax, 0xfffe
ja 0x45bb84
push ecx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [edi + 2], ax
mov al, 1
jmp 0x45bb96
push 0
push 2
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0044e58a
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x464b28
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
mov esi, ecx
xor ecx, ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x228]
push eax
push ecx
mov ebx, edx
push esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x464c27
mov eax, ebx
or eax, 0x20019
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x464c3c
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.00464b28
push dword [ebp - 8]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x464c3c
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call fcn.0046497f
test al, al
lea eax, [ebp - 0x228]
je 0x464bd9
push ebx
mov ebx, dword [ebp - 0xc]
push ebx
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.004638b3
call eax
jmp 0x464be4
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [ebp - 0xc]
test eax, eax
jne 0x464c2d
cmp dword [ebp - 0x18], eax
je 0x464bf6
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor ecx, ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x228]
push eax
push ecx
push esi
mov dword [ebp - 4], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov eax, dword [ebp - 0x1c]
jne 0x464b72
mov al, 1
pop esi
pop ebx
leave
ret
cmp dword [ebp - 0x18], 0
je 0x464c3c
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor al, al
jmp 0x464c29
Function at 0x46bf96
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov ecx, 0x4c2810
call fcn.0040dde8
test al, al
jne 0x46bfbf
xor eax, eax
jmp 0x46c199
mov ecx, dword [ebp - 4]
mov eax, dword [0x4c2870]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [0x4c2884]
mov eax, dword [eax + ecx*4]
lea ecx, [ebp + 0xc]
mov edi, dword [eax]
mov esi, dword [edi]
mov bl, byte [edi + 0x90]
mov dword [ebp - 8], esi
mov byte [ebp + 0xb], bl
call fcn.0041c7d2
cmp dword [edi + 0x48], 0
jl 0x46c000
push dword [edi + 0x48]
call fcn.0046dd89
movzx eax, bl
mov ebx, dword [ebp + 0xc]
cmp eax, 0x12
jg 0x46c0e4
je 0x46c0a1
test eax, eax
je 0x46c091
jle 0x46bfb8
cmp eax, 4
jle 0x46c12a
cmp eax, 8
je 0x46c071
cmp eax, 0x10
je 0x46c05b
cmp eax, 0x11
jne 0x46bfb8
mov eax, dword [ebp + 0xc]
test eax, eax
js 0x46bfb8
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.0041d660
push 1
push 0
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x46c182
cmp dword [ebp + 0xc], 0
jl 0x46bfb8
push dword [ebp + 0xc]
push 0
push 0x111d
jmp 0x46c085
cmp dword [ebp + 0xc], 0
jl 0x46bfb8
push dword [ebp + 0xc]
push 0
push 0x2001
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x46c182
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x46c14c
jmp 0x46bfb8
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jl 0x46bfb8
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.0041d660
test byte [edi + 0x92], 0x20
jne 0x46c182
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi]
call esi
push 5
push dword [edi]
call esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x46c182
cmp eax, 0x13
je 0x46c137
cmp eax, 0x14
je 0x46c033
cmp eax, 0x17
je 0x46c12a
cmp eax, 0x18
je 0x46c10c
jle 0x46bfb8
cmp eax, 0x1b
jle 0x46c12a
jmp 0x46bfb8
test ebx, ebx
js 0x46bfb8
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push ebx
mov dword [edi + 0x48], ebx
call fcn.0041d660
jmp 0x46c177
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xfffffffe
je 0x46bfb8
mov eax, 0xfe000000
cmp ebx, eax
jne 0x46c159
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.0041d660
jmp 0x46c182
push ebx
push 0
push 0x1001
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push ebx
push 0
push 0x1026
push dword [ebp - 8]
call esi
push 1
push edi
push dword [ebp - 4]
call fcn.0046ec1f
cmp dword [0x4c20ec], 0
je 0x46c196
cmp byte [ebp + 0xb], 8
jne 0x46c196
or eax, 0xffffffff
jmp 0x46c199
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x46d942
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov ecx, 0x4c2810
call fcn.0040dde8
test al, al
jne 0x46d96c
xor eax, eax
jmp 0x46da9f
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x4c2870]
push ebx
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov eax, dword [0x4c2884]
push esi
mov eax, dword [eax + ecx*4]
mov esi, dword [ebp + 0xc]
mov ecx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov edi, dword [eax]
mov ebx, dword [edi]
cmp esi, 0xffffffff
je 0x46da07
movzx eax, byte [edi + 0x90]
dec eax
dec eax
je 0x46d9d3
dec eax
je 0x46d9d6
sub eax, 3
je 0x46d9ce
dec eax
je 0x46d9c9
sub eax, 3
je 0x46d9c1
sub eax, 0xc
jne 0x46d9f4
jmp 0x46da9c
or esi, 0x4000000
jmp 0x46d9f4
or esi, 3
jmp 0x46d9f4
or esi, 0xe
jmp 0x46d9f4
or esi, 4
push 0
test esi, 0x800
je 0x46d9e4
push 1
jmp 0x46d9ec
or esi, 0x10000
push 0
push 0xcf
push ebx
call ecx
or esi, 0x50000000
push esi
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
cmp esi, 0xffffffff
je 0x46da44
push esi
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [0x4c2884]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax]
cmp byte [eax + 0x90], 0x13
jne 0x46da44
push esi
push 0
push 0x1036
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], eax
mov al, byte [edi + 0x93]
mov ecx, dword [ebp + 8]
cmp al, 0xff
je 0x46da67
movzx eax, al
cmp eax, dword [ecx + 0x190]
je 0x46da67
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x46da70
push 1
push edi
push ecx
call fcn.0046ec1f
mov al, byte [edi + 0x90]
cmp al, 2
je 0x46da83
cmp al, 3
je 0x46da83
cmp esi, 0xffffffff
je 0x46da94
push 0x27
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
pop edi
pop esi
pop ebx
leave
ret 0xc