joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452e6c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x470c30]
cmp dword [eax + 0x30], 0
je 0x452f16
cmp dword [ebx + 0x94], 0
jne 0x452f10
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x452dfc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x452f10
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x452ed6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x452f10
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00415ba8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x452ee5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4539f4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x453a29
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404674
jmp 0x453a36
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004045d8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454958
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x454999
mov eax, esi
call fcn.0043b048
test al, al
je 0x454999
mov eax, dword [ebx + 0x84]
call fcn.0043ad44
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x454999
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043ad44
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x455bd4
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404a40
xor eax, eax
push ebp
push 0x455c52
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404a50
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x455c1d
mov eax, dword [ebx + 4]
call fcn.00404a50
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455c59
lea eax, [ebp - 4]
call fcn.00404584
ret
Function at 0x456c54
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x456df1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402a74
cmp word [ebx + 0xa2], 0
je 0x456c9d
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x456cb1
lea esi, [ebp - 8]
jmp 0x456cb3
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x456cc0
xor edi, edi
jmp 0x456ccd
mov eax, dword [ebx + 0x80]
call fcn.00404a50
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00404a50
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0045638c
mov eax, dword [ebp - 0x14]
call fcn.00404a50
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00404a50
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404a50
push eax
mov eax, ebx
call fcn.004564c0
push eax
mov eax, ebx
call fcn.00456494
push eax
mov eax, ebx
call fcn.00456448
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00456258
mov eax, dword [ebp - 0x18]
call fcn.00404a50
push eax
mov eax, dword [ebx + 8]
call fcn.00404a50
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x456d56
call fcn.0040cb94
xor edx, edx
push ebp
push 0x456dcf
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x456d94
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x456d8a
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456dd6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x456e00
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x456e2c
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404a50
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x456e51
call fcn.0040cb94
xor eax, eax
push ebp
push 0x456e88
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x456e71
call fcn.0040cb94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456e8f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x458348
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov ebx, eax
mov eax, 0x10000
call fcn.00402730
mov dword [ebx + 0x2e8], eax
mov edi, ebp
test edi, edi
jle 0x458384
mov esi, 1
mov eax, ebp
dec eax
call fcn.0040300c
inc eax
mov edx, dword [ebx + 0x2e8]
mov word [edx + esi*2 - 2], ax
inc esi
dec edi
jne 0x45836c
mov esi, ebp
cmp esi, 1
jl 0x4583f8
mov eax, dword [ebx + 0x2e8]
movzx eax, word [eax + esi*2 - 2]
mov ecx, dword [ebx + 0x2e0]
mov al, byte [ecx + eax - 1]
mov edx, dword [ebx + 0x2e0]
cmp al, byte [edx + esi - 1]
je 0x4583f3
mov ecx, dword [ebx + 0x2e8]
movzx ecx, word [ecx + esi*2 - 2]
mov edi, dword [ebx + 0x2e0]
xor byte [edx + esi - 1], al
mov edx, dword [ebx + 0x2e8]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2e0]
mov cl, byte [eax + esi - 1]
xor byte [eax + edx - 1], cl
mov edx, dword [ebx + 0x2e8]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2e0]
mov dl, byte [eax + edx - 1]
xor byte [eax + esi - 1], dl
dec esi
test esi, esi
jne 0x45838b
mov edx, 0x10000
mov eax, dword [ebx + 0x2e8]
call fcn.00402750
mov edi, ebp
test edi, edi
jle 0x458480
mov esi, 1
mov eax, dword [ebx + 0x2e0]
mov dl, byte [eax + esi - 1]
mov byte [eax + esi - 1], dl
mov eax, dword [ebx + 0x2e0]
mov al, byte [eax + esi - 1]
mov byte [esp], al
mov al, byte [ebx + 0x43]
xor al, byte [ebx + 0x42]
xor al, byte [ebx + 0x41]
xor al, byte [ebx + 0x40]
mov byte [esp + 1], al
mov eax, 0xff
call fcn.0040300c
mov edx, dword [ebx + 0x2e0]
mov dl, byte [edx + esi - 1]
xor dl, byte [esp + 1]
xor al, dl
mov edx, dword [ebx + 0x2e0]
mov byte [edx + esi - 1], al
xor eax, eax
mov al, byte [esp]
add eax, dword [ebx + 0x40]
add eax, dword [ebx + 0x3c]
imul dword [ebx + 0x2f8]
add eax, dword [ebx + 0x2fc]
mov dword [ebx + 0x40], eax
inc esi
dec edi
jne 0x458413
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x458dac
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 8], esi
inc esi
je 0x458eab
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 0x20
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
mov eax, dword [ebx + 0x18]
call fcn.00404a50
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 8], eax
mov dword [esp], 0x10000
push 4
lea eax, [esp + 4]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x10
call fcn.00402fec
mov word [esp + 4], 2
mov eax, dword [ebx + 0x18]
call fcn.00404a50
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 8], eax
mov ax, word [ebx + 0x14]
push eax
call sub.wsock32.dll_htons
mov word [esp + 6], ax
push 0x10
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x458e97
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [ebx + 8], 0xffffffff
jmp 0x458eab
push 1
push 0x401
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_WSAAsyncSelect
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x458fc8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov word [ebx + 0x24], 2
push 0x10
lea eax, [ebx + 0x24]
push eax
push 0
push ecx
push edx
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_sendto_1
mov esi, eax
cmp esi, 0xffffffff
jne 0x458ff3
mov eax, ebx
call fcn.00459114
mov eax, esi
pop esi
pop ebx
ret
Function at 0x45a4d8
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x45a4e1
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4010], edx
mov dword [ebp - 0x400c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a624
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045a408
lea esi, [ebp - 0x4008]
mov dword [ebp - 8], 0x4000
lea eax, [ebp - 8]
push eax
push esi
call sub.IpHlpApi.dll_GetAdaptersInfo
test eax, eax
jne 0x45a606
cmp dword [esi + 0x1a0], 6
je 0x45a54a
mov esi, dword [esi]
jmp 0x45a5fe
lea edi, [esi + 0x1ac]
test edi, edi
je 0x45a5fc
mov dl, 1
mov eax, dword [0x458844]
call fcn.00403764
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.00415a4c
mov eax, dword [esi + 0x19c]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 4]
lea edx, [esi + 8]
mov ecx, 0x104
call fcn.004047ec
lea eax, [ebx + 8]
lea edx, [esi + 0x10c]
mov ecx, 0x84
call fcn.004047ec
lea edx, [ebx + 0x10]
lea eax, [esi + 0x194]
mov ecx, 6
call fcn.004028e8
lea eax, [ebp - 0x400c]
lea edx, [edi + 4]
mov ecx, 0x10
call fcn.004047ec
mov edx, dword [ebp - 0x400c]
mov eax, ebx
call fcn.0045a3d0
lea eax, [ebp - 0x4010]
lea edx, [edi + 0x14]
mov ecx, 0x10
call fcn.004047ec
mov edx, dword [ebp - 0x4010]
mov eax, ebx
call fcn.0045a3ec
mov edi, dword [edi]
test edi, edi
jne 0x45a558
mov esi, dword [esi]
test esi, esi
jne 0x45a53a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a62b
lea eax, [ebp - 0x4010]
mov edx, 2
call fcn.004045a8
ret

Function at 0x45a724
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
mov dword [ebp - 0x108], eax
lea ebx, [ebp - 0x110]
call fcn.0040a1bc
fstp qword [ebp - 0x118]
wait
jmp 0x45a7b4
mov dword [ebx], 1
xor eax, eax
mov dword [ebx + 4], eax
push ebx
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push ebp
call fcn.0045a6ac
pop ecx
push eax
call sub.wsock32.dll_select
test eax, eax
jl 0x45a7b4
test eax, eax
jle 0x45a785
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x108]
call fcn.0045a7e4
call fcn.0040a1bc
fsub qword [ebp - 0x118]
fld xword [0x45a7d8]
fcompp
fnstsw ax
sahf
jae 0x45a7b4
call fcn.0040a1bc
fstp qword [ebp - 0x118]
wait
mov eax, dword [ebp - 0x108]
call fcn.0045a830
call fcn.00406978
cmp byte [eax + 0x10], 0
jne 0x45a7d2
mov eax, dword [ebp - 0x108]
cmp byte [eax + 0xd], 0
je 0x45a748
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ae48
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45af35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 4]
mov edx, 0x45af4c
call fcn.0040461c
mov ebx, 2
lea eax, [ebp - 4]
call fcn.00404aa8
mov edx, ebx
add dl, 0x41
mov byte [eax], dl
mov eax, dword [ebp - 4]
call fcn.00404a50
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x45af05
push 0xff
lea eax, [ebp - 0x107]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a50
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
jbe 0x45af05
push dword [ebp - 4]
push 0x45af58
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.004047ec
push dword [ebp - 0x10c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404918
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x1a
jne 0x45ae8a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45af3c
lea eax, [ebp - 0x10c]
call fcn.00404584
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045a8
ret

Function at 0x45b010
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a40
xor eax, eax
push ebp
push 0x45b0a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0040c12c
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.0040461c
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x40
call fcn.00402fec
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a50
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x4c]
call fcn.0040920c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b0ad
lea eax, [ebp - 0x50]
call fcn.00404584
lea eax, [ebp - 4]
call fcn.00404584
ret
Function at 0x45b0b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x208], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x45b188
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0x7200
push edi
call sub.kernel32.dll_SetFilePointer_1
lea ebx, [ebp - 0x204]
push 0
lea eax, [ebp - 4]
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push edi
call sub.kernel32.dll_ReadFile_1
xor edx, edx
push ebp
push 0x45b165
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 4]
test eax, eax
je 0x45b149
cmp dword [ebx + 8], 0
je 0x45b149
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x3c], eax
lea edx, [ebp - 0x208]
lea eax, [ebx + 0xc]
call fcn.0040920c
mov edx, dword [ebp - 0x208]
lea eax, [esi + 0x40]
call fcn.004045d8
jmp 0x45b15b
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
mov dword [esi + 0x3c], eax
lea eax, [esi + 0x40]
call fcn.00404584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45b16f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b18f
lea eax, [ebp - 0x208]
call fcn.00404584
ret

Function at 0x45b874
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45b9a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0x104
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_FindFirstVolumeA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45b97b
lea eax, [ebp - 4]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004047ec
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404858
mov ecx, eax
sub ecx, 5
mov edx, 5
mov eax, dword [ebp - 4]
call fcn.00404ab0
push 0x40
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a50
push eax
call sub.kernel32.dll_QueryDosDeviceA
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x148]
mov ecx, 0x40
call fcn.004047ec
mov edx, dword [ebp - 0x14c]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004047ec
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x104
lea eax, [ebp - 0x108]
push eax
push ebx
call sub.kernel32.dll_FindNextVolumeA
test eax, eax
jne 0x45b8cd
push ebx
call sub.kernel32.dll_FindVolumeClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b9a8
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.004045a8
lea eax, [ebp - 4]
call fcn.00404584
ret
Function at 0x464b30
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x464d64
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46ef80], eax
cmp dword [0x46ef80], 0
je 0x464ba2
push 0x464d74
mov eax, dword [0x46ef80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474850], eax
push 0x464d94
mov eax, dword [0x46ef80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474854], eax
push 0x464db8
mov eax, dword [0x46ef80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474858], eax
push 0x464dd4
mov eax, dword [0x46ef80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47485c], eax
push 0x464dec
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46ef7c], eax
cmp dword [0x46ef7c], 0
je 0x464ca5
push 0x464df4
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474824], eax
push 0x464e0c
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474828], eax
push 0x464e1c
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47482c], eax
push 0x464e34
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474830], eax
push 0x464e44
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474834], eax
push 0x464e54
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474838], eax
push 0x464e64
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47483c], eax
push 0x464e80
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474840], eax
push 0x464e98
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474844], eax
push 0x464eac
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474848], eax
push 0x464ebc
mov eax, dword [0x46ef7c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47484c], eax
push 0x464ed8
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46ef84], eax
cmp dword [0x46ef84], 0
je 0x464ce7
push 0x464ee8
mov eax, dword [0x46ef84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474860], eax
push 0x464efc
mov eax, dword [0x46ef84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474864], eax
call sub.kernel32.dll_GetVersion
mov dword [ebp - 8], eax
xor eax, eax
mov al, byte [ebp - 8]
mov dword [ebp - 0xc], eax
movzx eax, word [ebp - 8]
shr eax, 8
and al, 0xff
and eax, 0xff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0x80000000
jae 0x464d2a
mov eax, dword [ebp - 8]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [0x4746c0], eax
jmp 0x464d5d
cmp dword [ebp - 0xc], 4
jae 0x464d4e
mov eax, dword [ebp - 8]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
and eax, 0xffff7fff
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [0x4746c0], eax
jmp 0x464d5d
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [0x4746c0], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x465e80
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xc
lea eax, [ebp - 0x20]
push eax
push 0x2d1400
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeviceIoControl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x469b5c
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 8], esi
inc esi
je 0x469c49
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 0x20
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [esp], 0x10000
push 4
lea eax, [esp + 4]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x10
call fcn.00402fec
mov word [esp + 4], 2
mov eax, dword [ebx + 4]
test eax, eax
je 0x469bfe
mov eax, dword [eax + 0x18]
mov dword [esp + 8], eax
jmp 0x469c04
xor eax, eax
mov dword [esp + 8], eax
mov ax, word [ebx + 0xc]
push eax
call sub.wsock32.dll_htons
mov word [esp + 6], ax
push 0x10
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x469c37
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [ebx + 8], 0xffffffff
mov eax, dword [ebx + 4]
test eax, eax
je 0x469c49
mov edx, dword [eax + 4]
mov eax, dword [ebx + 8]
call fcn.00458ce4
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x469c84
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
add esp, 0xfffffff8
mov word [eax + 0x20], 2
push 0x10
lea ebx, [eax + 0x20]
push ebx
push 0
push ecx
push edx
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_sendto
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x469cc3
call fcn.0045bd3c
mov dword [esp], eax
mov byte [esp + 4], 0
mov edx, esp
xor ecx, ecx
mov eax, 0x469cd4
call fcn.0045bdfc
mov eax, ebx
pop ecx
pop edx
pop ebx
ret
Function at 0x46a7a4
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
mov dword [ebp - 0x108], eax
lea ebx, [ebp - 0x108]
lea esi, [ebp - 0x110]
call fcn.0040a1bc
fstp qword [ebp - 0x118]
wait
jmp 0x46a861
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], 0x186a0
push esi
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push ebp
call fcn.0046a730
pop ecx
push eax
call sub.wsock32.dll_select
test eax, eax
jl 0x46a861
test eax, eax
jle 0x46a81e
mov eax, dword [ebx]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx]
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.0046a888
mov eax, dword [ebx]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 4]
call fcn.0040a1bc
fsub qword [ebp - 0x118]
mov eax, dword [ebx]
fild dword [eax + 0x38]
fdiv dword [0x46a884]
fcompp
fnstsw ax
sahf
jae 0x46a861
mov eax, dword [ebx]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx]
call fcn.0040a1bc
fstp qword [ebp - 0x118]
wait
mov eax, dword [ebx]
call fcn.0046a8d4
mov eax, dword [ebx]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 4]
call fcn.00406978
cmp byte [eax + 0x10], 0
jne 0x46a87b
mov eax, dword [ebx]
cmp byte [eax + 0xd], 0
je 0x46a7d2
pop esi
pop ebx
mov esp, ebp
pop ebp
ret