joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a8b8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, edx
mov esi, eax
xor ebx, ebx
mov eax, ecx
mov edi, 0x3e8
cdq
idiv edi
mov dword [ebp - 0xc], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 8], eax
mov dword [ebp - 0x114], 1
mov eax, dword [esi + 4]
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x114]
push eax
push 0
call sub.WS2_32.DLL_select
mov edi, eax
mov eax, edi
call fcn.00459b78
test al, al
je 0x45a978
test edi, edi
jle 0x45a978
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x124]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [esi + 4]
push eax
call sub.WS2_32.DLL_recvfrom
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jle 0x45a978
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x120]
mov dword [eax], edx
mov ax, word [ebp - 0x122]
call fcn.00459b5c
mov edx, dword [ebp + 8]
mov word [edx], ax
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45a9c0
Capabilities:
Create udp socket

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x45a9cf
add esp, 0xfffffff0
call fcn.00403f9c
mov ebx, edx
mov edi, eax
push 0x11
push 2
push 0x17
call sub.WS2_32.DLL_socket
mov esi, eax
mov dword [edi + 4], esi
mov eax, esi
call fcn.00459b70
test al, al
jne 0x45aa04
mov ecx, 0x45aa28
mov dl, 1
mov eax, dword [0x407bac]
call fcn.0040c914
call fcn.00404404
mov eax, edi
test bl, bl
je 0x45aa19
call fcn.00403ff4
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x45ac10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x45ad17
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x1c
call fcn.00403490
mov word [ebp - 0x30], 0x17
push esi
push edi
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, esi
call fcn.00459b5c
mov word [ebp - 0x2e], ax
push 0x1c
lea eax, [ebp - 0x30]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 4]
push eax
call sub.WS2_32.DLL_sendto
call fcn.00459b78
test al, al
jne 0x45acfc
push 0x45ad30
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x14]
mov eax, dword [0x459778]
call fcn.0045a168
push dword [ebp - 0x38]
push 0x45ad74
lea edx, [ebp - 0x3c]
movzx eax, si
call fcn.00408cc0
push dword [ebp - 0x3c]
push 0x45ad88
call sub.WS2_32.DLL_WSAGetLastError
lea edx, [ebp - 0x40]
call fcn.00408cc0
push dword [ebp - 0x40]
push 0x45adbc
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00404df4
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x407bac]
call fcn.0040c914
call fcn.00404404
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad1e
lea eax, [ebp - 0x40]
mov edx, 4
call fcn.00404a98
ret

Function at 0x45adc0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, edx
mov esi, eax
xor ebx, ebx
mov eax, ecx
mov edi, 0x3e8
cdq
idiv edi
mov dword [ebp - 0xc], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 8], eax
mov dword [ebp - 0x114], 1
mov eax, dword [esi + 4]
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x114]
push eax
push 0
call sub.WS2_32.DLL_select
mov edi, eax
mov eax, edi
call fcn.00459b78
test al, al
je 0x45ae84
test edi, edi
jle 0x45ae84
mov dword [ebp - 0x10], 0x1c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x130]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [esi + 4]
push eax
call sub.WS2_32.DLL_recvfrom
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jle 0x45ae84
mov eax, dword [ebp + 0xc]
mov edi, eax
lea esi, [ebp - 0x128]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ax, word [ebp - 0x12e]
call fcn.00459b5c
mov edx, dword [ebp + 8]
mov word [edx], ax
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45b2a4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x11]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45b492
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x11], 0
je 0x45b3bc
mov eax, dword [ebx + 8]
call fcn.00459b70
test al, al
je 0x45b477
lea eax, [ebp - 0x3d]
xor ecx, ecx
mov edx, 0x1c
call fcn.00403490
mov word [ebp - 0x3d], 0x17
push esi
push edi
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x35]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov ax, word [ebp + 8]
call fcn.00459b5c
mov word [ebp - 0x3b], ax
push 0x1c
lea eax, [ebp - 0x3d]
push eax
push 0
push edi
push esi
mov eax, dword [ebx + 8]
push eax
call sub.WS2_32.DLL_sendto
call fcn.00459b78
test al, al
jne 0x45b477
push 0x45b4ac
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x10]
mov eax, dword [0x459778]
call fcn.0045a168
push dword [ebp - 0x48]
push 0x45b4f4
lea edx, [ebp - 0x4c]
movzx eax, word [ebp + 8]
call fcn.00408cc0
push dword [ebp - 0x4c]
push 0x45b508
call sub.WS2_32.DLL_WSAGetLastError
lea edx, [ebp - 0x50]
call fcn.00408cc0
push dword [ebp - 0x50]
push 0x45b53c
lea eax, [ebp - 0x44]
mov edx, 7
call fcn.00404df4
mov ecx, dword [ebp - 0x44]
mov dl, 1
mov eax, dword [0x407bac]
call fcn.0040c914
call fcn.00404404
jmp 0x45b477
mov eax, dword [ebx + 4]
call fcn.00459b70
test al, al
je 0x45b477
lea eax, [ebp - 0x21]
xor ecx, ecx
mov edx, 0x10
call fcn.00403490
mov word [ebp - 0x21], 2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1d], eax
mov ax, word [ebp + 8]
call fcn.00459b5c
mov word [ebp - 0x1f], ax
push 0x10
lea eax, [ebp - 0x21]
push eax
push 0
push edi
push esi
mov eax, dword [ebx + 4]
push eax
call sub.WS2_32.DLL_sendto
call fcn.00459b78
test al, al
jne 0x45b477
push 0x45b548
lea ecx, [ebp - 0x58]
mov edx, dword [ebp - 0x10]
mov eax, dword [0x459718]
call fcn.0045a0dc
push dword [ebp - 0x58]
push 0x45b4f4
lea edx, [ebp - 0x5c]
movzx eax, word [ebp + 8]
call fcn.00408cc0
push dword [ebp - 0x5c]
push 0x45b508
call sub.WS2_32.DLL_WSAGetLastError
lea edx, [ebp - 0x60]
call fcn.00408cc0
push dword [ebp - 0x60]
push 0x45b53c
lea eax, [ebp - 0x54]
mov edx, 7
call fcn.00404df4
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x407bac]
call fcn.0040c914
call fcn.00404404
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b499
lea eax, [ebp - 0x60]
mov edx, 8
call fcn.00404a98
ret
Function at 0x45b9ac
Capabilities:
Create tcp socket

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x45b9bb
add esp, 0xfffffff0
call fcn.00403f9c
mov ebx, edx
mov edi, eax
push 6
push 1
push 2
call sub.WS2_32.DLL_socket
mov esi, eax
mov dword [edi + 4], esi
mov eax, esi
call fcn.00459b70
test al, al
jne 0x45b9f0
mov ecx, 0x45ba14
mov dl, 1
mov eax, dword [0x407bac]
call fcn.0040c914
call fcn.00404404
mov eax, edi
test bl, bl
je 0x45ba05
call fcn.00403ff4
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x45bd10
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x128], ecx
mov ecx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45be62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ecx
mov ebx, 0x3e8
cdq
idiv ebx
mov dword [ebp - 8], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], 1
mov eax, dword [esi + 4]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call sub.WS2_32.DLL_select
mov ebx, eax
mov eax, ebx
call fcn.00459b78
test al, al
je 0x45be42
test ebx, ebx
jle 0x45be42
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00403490
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x120]
push eax
mov eax, dword [esi + 4]
push eax
call sub.WS2_32.DLL_accept
mov ebx, eax
mov eax, ebx
call fcn.00459b70
test al, al
jne 0x45be1c
push 0x45be7c
call sub.WS2_32.DLL_WSAGetLastError
lea edx, [ebp - 0x128]
call fcn.00408cc0
push dword [ebp - 0x128]
push 0x45bee4
lea eax, [ebp - 0x124]
mov edx, 3
call fcn.00404df4
mov ecx, dword [ebp - 0x124]
mov dl, 1
mov eax, dword [0x407bac]
call fcn.0040c914
call fcn.00404404
mov eax, dword [ebp - 0x11c]
push eax
mov ax, word [ebp - 0x11e]
call fcn.00459b5c
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4599e4]
call fcn.0045ba54
mov ebx, eax
jmp 0x45be44
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45be69
lea eax, [ebp - 0x128]
mov edx, 2
call fcn.00404a98
ret
Function at 0x45bee8
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45bfd5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.00403490
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], esi
mov eax, edi
call fcn.00459b5c
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.WS2_32.DLL_connect
call fcn.00459b78
test al, al
jne 0x45bfb3
push 0x45bfec
lea ecx, [ebp - 0x18]
mov edx, esi
mov eax, dword [0x459718]
call fcn.0045a0dc
push dword [ebp - 0x18]
push 0x45c034
lea edx, [ebp - 0x1c]
movzx eax, di
call fcn.00408cc0
push dword [ebp - 0x1c]
push 0x45c048
call sub.WS2_32.DLL_WSAGetLastError
lea edx, [ebp - 0x20]
call fcn.00408cc0
push dword [ebp - 0x20]
push 0x45c07c
lea eax, [ebp - 0x14]
mov edx, 7
call fcn.00404df4
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x407bac]
call fcn.0040c914
call fcn.00404404
mov dword [ebx + 8], esi
mov word [ebx + 0xc], di
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bfdc
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404a98
ret

Function at 0x45c080
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45c13a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push edi
push esi
mov eax, dword [ebx + 4]
push eax
call sub.WS2_32.DLL_send
call fcn.00459b78
test al, al
jne 0x45c11f
push 0x45c150
lea ecx, [ebp - 8]
mov edx, dword [ebx + 8]
mov eax, dword [0x459718]
call fcn.0045a0dc
push dword [ebp - 8]
push 0x45c190
lea edx, [ebp - 0xc]
movzx eax, word [ebx + 0xc]
call fcn.00408cc0
push dword [ebp - 0xc]
push 0x45c1a4
call sub.WS2_32.DLL_WSAGetLastError
lea edx, [ebp - 0x10]
call fcn.00408cc0
push dword [ebp - 0x10]
push 0x45c1d8
lea eax, [ebp - 4]
mov edx, 7
call fcn.00404df4
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x407bac]
call fcn.0040c914
call fcn.00404404
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c141
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404a98
ret
Function at 0x45c1dc
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, edx
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, ecx
mov ebx, 0x3e8
cdq
idiv ebx
mov dword [ebp - 0xc], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 8], eax
mov dword [ebp - 0x110], 1
mov eax, dword [esi + 4]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call sub.WS2_32.DLL_select
mov ebx, eax
mov eax, ebx
call fcn.00459b78
test al, al
je 0x45c269
test ebx, ebx
jle 0x45c269
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 4]
push eax
call sub.WS2_32.DLL_recv
mov dword [edi], eax
cmp dword [edi], 0
setg al
jmp 0x45c26b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45c358
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x45c45f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x1c
call fcn.00403490
mov word [ebp - 0x2c], 0x17
push esi
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov eax, esi
call fcn.00459b5c
mov word [ebp - 0x2a], ax
push 0x1c
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.WS2_32.DLL_connect
call fcn.00459b78
test al, al
jne 0x45c434
push 0x45c478
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x10]
mov eax, dword [0x459778]
call fcn.0045a168
push dword [ebp - 0x34]
push 0x45c4c0
lea edx, [ebp - 0x38]
movzx eax, si
call fcn.00408cc0
push dword [ebp - 0x38]
push 0x45c4d4
call sub.WS2_32.DLL_WSAGetLastError
lea edx, [ebp - 0x3c]
call fcn.00408cc0
push dword [ebp - 0x3c]
push 0x45c508
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.00404df4
mov ecx, dword [ebp - 0x30]
mov dl, 1
mov eax, dword [0x407bac]
call fcn.0040c914
call fcn.00404404
push esi
lea esi, [ebp - 0x10]
lea edi, [ebx + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov word [ebx + 0x18], si
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c466
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00404a98
ret
Function at 0x45c668
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, edx
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, ecx
mov ebx, 0x3e8
cdq
idiv ebx
mov dword [ebp - 0xc], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 8], eax
mov dword [ebp - 0x110], 1
mov eax, dword [esi + 4]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call sub.WS2_32.DLL_select
mov ebx, eax
mov eax, ebx
call fcn.00459b78
test al, al
je 0x45c6f5
test ebx, ebx
jle 0x45c6f5
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 4]
push eax
call sub.WS2_32.DLL_recv
mov dword [edi], eax
cmp dword [edi], 0
setg al
jmp 0x45c6f7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45f894
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x45fbb8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, 0x110
call fcn.004050c0
mov eax, dword [ebp - 8]
call fcn.00404f34
push eax
push 0x110
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 8]
call fcn.00408aac
mov edx, dword [ebp - 0x244]
lea eax, [ebp - 8]
call fcn.00404b0c
lea eax, [ebp - 0xc]
mov edx, 0x110
call fcn.004050c0
mov eax, dword [ebp - 0xc]
call fcn.00404f34
push eax
push 0
push 0x45fbc8
mov eax, dword [ebp - 8]
call fcn.00404f34
push eax
call sub.kernel32.dll_GetTempFileNameA
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0xc]
call fcn.00408aac
mov edx, dword [ebp - 0x248]
lea eax, [ebp - 0xc]
call fcn.00404b0c
xor eax, eax
push ebp
push 0x45fb7c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 0xc]
call fcn.00404f34
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45fadc
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetHandleInformation
lea eax, [ebp - 0x1ec]
xor ecx, ecx
mov edx, 0xc
call fcn.00403490
mov dword [ebp - 0x1ec], 0xc
mov dword [ebp - 0x1e4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0x230]
xor ecx, ecx
mov edx, 0x44
call fcn.00403490
mov dword [ebp - 0x230], 0x44
mov word [ebp - 0x200], 0
mov dword [ebp - 0x204], 0x101
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1f4], eax
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x10
call fcn.00403490
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x1ec]
push eax
mov eax, esi
call fcn.00404f34
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x45fa61
call fcn.004044b0
call fcn.004044b0
jmp 0x45fb85
xor eax, eax
push ebp
push 0x45fabe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1388
mov eax, dword [ebp - 0x240]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x45fa98
call fcn.004044b0
call fcn.004044b0
call fcn.004044b0
jmp 0x45fb85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fac5
mov eax, dword [ebp - 0x240]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x23c]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fbbf
lea eax, [ebp - 0x248]
mov edx, 2
call fcn.00404a98
lea eax, [ebp - 0x14]
call fcn.00404a74
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404a98
ret
Function at 0x4782e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404f24
mov eax, dword [ebp - 8]
call fcn.00404f24
xor eax, eax
push ebp
push 0x47837b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f34
mov esi, eax
push esi
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
test ebx, ebx
jg 0x47833b
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00404ac8
jmp 0x478360
mov edx, ebx
dec edx
lea eax, [ebp - 0xc]
call fcn.004050c0
push ebx
mov eax, dword [ebp - 0xc]
call fcn.00404f34
push eax
push esi
call sub.kernel32.dll_GetEnvironmentVariableA
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00404ac8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478382
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a98
ret
Function at 0x401840
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x414
mov eax, dword [0x41c270]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x418]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
call dword [0x4170cc]
mov esi, eax
cmp esi, 0xffffffff
je 0x401916
push edi
push 0x3ff
lea ecx, [esp + 0x21]
push ebx
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x28], bl
call fcn.004069c0
add esp, 0xc
push ebx
lea edx, [esp + 0x10]
push edx
push 0x400
lea eax, [esp + 0x28]
push eax
push 0xc
lea ecx, [esp + 0x24]
push ecx
push 0x2d1400
push esi
mov dword [esp + 0x40], 0x400
call dword [0x4170c8]
push esi
mov edi, eax
call dword [0x4170ec]
cmp edi, ebx
pop edi
je 0x401916
mov eax, dword [esp + 0x420]
mov esi, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4018fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004053e1
add esp, 0x414
ret
mov eax, dword [esp + 0x420]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401939
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x418]
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.004053e1
add esp, 0x414
ret
Function at 0xdd1058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00dd11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xdd107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd106a
add dl, dl
jne 0xdd1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd10dc
xor eax, eax
add dl, dl
jne 0xdd1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd117d
add dl, dl
jne 0xdd10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdd10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdd1075
mov eax, 1
add dl, dl
jne 0xdd10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd10e1
sub eax, ebx
mov ebx, 1
jne 0xdd1128
mov ecx, 1
add dl, dl
jne 0xdd110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdd1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdd113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdd114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd1136
cmp eax, 0x7d00
jae 0xdd116d
cmp eax, 0x500
jb 0xdd1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd1075
cmp eax, 0x7f
ja 0xdd1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdd119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdd1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10