joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x2068
call fcn.00407310
mov eax, 0x50
mov byte [esp + 3], 0
push ebx
mov bh, byte [esp + 0x2078]
mov word [esp + 0x14], ax
mov eax, 0x2000
push esi
mov word [esp + 0x6c], ax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x2078]
call sym.hf32.exe__string_copy_8
lea eax, [esp + 0x18]
push eax
call sym.hf32.exe__string_terminate_null_4
mov esi, dword [esp + 0x2080]
lea eax, [esp + 0xc]
push esi
push eax
push 3
call fcn.00405630
push esi
call sym.hf32.exe__sys_error_4
test al, al
jne 0x405a7c
movsx eax, word [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov word [esp + 0x6e], cx
cmp eax, 0xea
jne 0x40595c
push esi
call sym.hf32.exe__sys_error_none_4
jmp 0x405978
test cx, cx
jle 0x405978
movsx eax, cx
mov al, byte [esp + eax + 0x6f]
cmp al, byte [0x434a0e]
jne 0x405978
lea eax, [ecx - 1]
mov word [esp + 0x6e], ax
mov bl, bh
push esi
and bl, 1
call sym.hf32.exe__sys_error_4
test al, al
je 0x405991
mov dword [esp + 0x10], 1
jmp 0x4059c1
mov eax, dword [esp + 0x10]
test bl, bl
je 0x40599e
cmp eax, 1
jne 0x4059c1
test bh, 2
je 0x4059a8
cmp eax, 2
jne 0x4059c1
push dword [esp + 0x2078]
lea eax, [esp + 0x70]
push eax
call sym.hf32.exe__string_equal_8
test al, al
jne 0x405a73
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x207c]
call sym.hf32.exe__string_copy_8
lea eax, [esp + 0x6c]
push eax
call sym.hf32.exe__string_terminate_null_4
mov ecx, dword [esp + 0x10]
test bl, bl
mov eax, 1
cmovne ecx, eax
test bh, 2
mov eax, 2
cmovne ecx, eax
movsx eax, word [esp + 0x6e]
inc eax
mov dword [esp + 0x10], ecx
push eax
lea eax, [esp + 0x74]
push eax
push ecx
push dword [0x434a10]
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegSetValueExA
push esi
mov dword [esi + 0xc], eax
call sym.hf32.exe__sys_error_4
test al, al
jne 0x405a5b
push dword [esp + 0xc]
mov byte [esp + 0xf], 1
call sub.ADVAPI32.dll_RegFlushKey
push esi
mov dword [esi + 0xc], eax
call sym.hf32.exe__sys_error_4
test al, al
jne 0x405a5b
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [esi + 0xc], eax
mov al, 1
pop esi
pop ebx
add esp, 0x2068
ret 0x10
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x2068
ret 0x10
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
pop esi
xor al, al
pop ebx
add esp, 0x2068
ret 0x10
Function at 0x405a90
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x884
push esi
mov esi, dword [esp + 0x894]
push esi
call sym.hf32.exe__sys_error_none_4
push 0x84
lea eax, [esp + 8]
push eax
push dword [esp + 0x894]
call sym.hf32.exe__string_t_c_12
push 0x800
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x898]
call sym.hf32.exe__string_t_c_12
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x405af1
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x884
ret 0xc

Function at 0x405b00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
cmp byte [0x43497c], 0
mov eax, 0x20
mov word [esp + 4], ax
jne 0x405b1b
call sym.hf32.exe__sys_read_env_global_0
push esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x34]
call sym.hf32.exe__string_copy_8
lea eax, [esp + 8]
push eax
call sym.hf32.exe__string_upcase_4
mov eax, dword [0x437e6c]
mov esi, 0x437e6c
mov dword [esp + 4], eax
test eax, eax
je 0x405b66
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.hf32.exe__string_equal_8
test al, al
jne 0x405bc7
mov esi, dword [esp + 4]
mov eax, dword [esi]
mov dword [esp + 4], eax
test eax, eax
jne 0x405b46
lea eax, [esp + 4]
push eax
push 0x108
call sym.hf32.exe__sys_mem_alloc_8
mov eax, dword [esp + 4]
test eax, eax
jne 0x405ba9
push 1
call fcn.0040a6ac
push eax
push 0x3a
push 1
push str.Unable_to_allocate_more_virtual_memory.__The_disk_is_full.
call fcn.0040a941
push 0x43184c
call fcn.00401130
add esp, 0x18
call sym.hf32.exe__sys_bomb_0
mov eax, dword [esp + 4]
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.hf32.exe__sys_read_env_lang_8
mov eax, dword [esp + 4]
mov dword [eax], 0
mov eax, dword [esp + 4]
mov dword [esi], eax
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x34]
add ecx, 4
pop esi
mov dword [eax], ecx
add esp, 0x28
ret 8
Function at 0x406030
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040a6ac
push eax
push 0xe
push 1
push str.Error_reading
call fcn.0040a941
mov edi, dword [esp + 0x43c]
add esp, 0x14
movzx ecx, word [edi + 2]
mov eax, ecx
cmp cx, 0x20
jle 0x406096
movsx eax, cx
push 0x434ada
sub eax, 0x20
push eax
push 0x431b20
call fcn.00401130
movzx eax, word [edi + 2]
add esp, 0xc
test ax, ax
jle 0x4060ad
cmp ax, 0x20
jge 0x4060a6
movsx esi, ax
jmp 0x4060af
mov esi, 0x20
jmp 0x4060af
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0040a941
push 1
call fcn.0040a6ac
push eax
push 0x22
push 1
push str..lan_language_descriptor_file_set.
call fcn.0040a941
push 0x431b48
call fcn.00401130
add esp, 0x2c
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x431a70
push eax
call sym.hf32.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.hf32.exe__string_append1_8
mov edi, dword [esp + 0x42c]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.hf32.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.hf32.exe__string_append_8
push 0x431ac0
lea eax, [esp + 0x24]
push eax
call sym.hf32.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x406165
cwde
push 0x434adb
sub eax, 0x400
push eax
push 0x431b4c
call fcn.00401130
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x406178
cmp ax, bx
jge 0x406174
movsx esi, ax
jmp 0x40617a
mov esi, ebx
jmp 0x40617a
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040a941
push 0x431b50
call fcn.00401130
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x4061cc
movsx eax, cx
push 0x434adc
sub eax, 0x400
push eax
push 0x431b54
call fcn.00401130
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x4061df
cmp ax, bx
jge 0x4061db
movsx esi, ax
jmp 0x4061e1
mov esi, ebx
jmp 0x4061e1
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040a941
push 0x431b58
call fcn.00401130
add esp, 0x18
call sym.hf32.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 8
Function at 0x41b5e0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x208c
call fcn.00407310
push esi
push edi
mov eax, 0x2000
mov edi, 0x84
mov word [esp + 0x90], ax
lea eax, [esp + 8]
push str.Syntax_error_occurred_on_line
push eax
mov dword [esp + 0x10], edi
call sym.hf32.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.hf32.exe__string_append1_8
mov esi, dword [esp + 0x2098]
mov eax, dword [esi]
push dword [eax + 0x970]
lea eax, [esp + 0x94]
push eax
call sym.hf32.exe__string_f_int_8
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
call sym.hf32.exe__string_append_8
push 0x432840
lea eax, [esp + 0xc]
push eax
call sym.hf32.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.hf32.exe__string_append1_8
mov eax, dword [esi]
add eax, 0x568
push eax
lea eax, [esp + 0xc]
push eax
call sym.hf32.exe__string_append_8
mov ax, word [esp + 0xa]
cmp ax, di
jle 0x41b69d
cwde
push 0x4355b6
sub eax, edi
push eax
push 0x4327ec
call fcn.00401130
mov ax, word [esp + 0x16]
add esp, 0xc
test ax, ax
jle 0x41b6b0
cmp ax, di
jge 0x41b6ac
movsx esi, ax
jmp 0x41b6b2
mov esi, edi
jmp 0x41b6b2
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0040a941
push 0x432890
call fcn.00401130
add esp, 0x18
call sym.hf32.exe__sys_bomb_0
pop edi
pop esi
add esp, 0x208c
ret 4
Function at 0x41bfa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
mov eax, 0x20
mov ebx, 0x400
mov word [esp + 0xc], ax
lea eax, [esp + 0x30]
push str.Error_on_line
push eax
mov dword [esp + 0x38], ebx
call sym.hf32.exe__string_appends_8
push 0x20
lea eax, [esp + 0x34]
push eax
call sym.hf32.exe__string_append1_8
mov edi, dword [esp + 0x438]
mov eax, dword [edi]
push dword [eax + 0x970]
lea eax, [esp + 0x10]
push eax
call sym.hf32.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
call sym.hf32.exe__string_append_8
push str._of_file
lea eax, [esp + 0x34]
push eax
call sym.hf32.exe__string_appends_8
mov ax, word [esp + 0x32]
cmp ax, bx
jle 0x41c033
cwde
push 0x4355bf
sub eax, ebx
push eax
push 0x432a7c
call fcn.00401130
mov ax, word [esp + 0x3e]
add esp, 0xc
test ax, ax
jle 0x41c046
cmp ax, bx
jge 0x41c042
movsx esi, ax
jmp 0x41c048
mov esi, ebx
jmp 0x41c048
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
lea eax, [esp + 0x40]
push 1
push eax
call fcn.0040a941
push 0x432b20
call fcn.00401130
mov eax, dword [edi]
add esp, 0x18
movzx ecx, word [eax + 0x56a]
cmp cx, bx
jle 0x41c095
movsx eax, cx
push 0x4355c0
sub eax, 0x400
push eax
push 0x432b24
call fcn.00401130
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 0x56a]
test ax, ax
jle 0x41c0af
cmp ax, bx
jge 0x41c0ab
movsx esi, ax
jmp 0x41c0b1
mov esi, ebx
jmp 0x41c0b1
xor esi, esi
push 1
call fcn.0040a6ac
push eax
mov eax, dword [edi]
push esi
add eax, 0x56c
push 1
push eax
call fcn.0040a941
push 0x432b28
call fcn.00401130
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x428
ret 4

Function at 0x41c0f0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0041bfa0
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
movzx ecx, word [eax + 2]
cmp cx, 0x50
jle 0x41c126
movsx eax, cx
push 0x4355bb
sub eax, 0x50
push eax
push 0x432a68
call fcn.00401130
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 2]
test ax, ax
jle 0x41c141
cmp ax, 0x50
jge 0x41c13a
movsx esi, ax
jmp 0x41c143
mov esi, 0x50
jmp 0x41c143
xor esi, esi
push 1
call fcn.0040a6ac
push eax
mov eax, dword [edi]
push esi
add eax, 4
push 1
push eax
call fcn.0040a941
push 0x432a6c
call fcn.00401130
mov eax, dword [esp + 0x2c]
add esp, 0x18
movsx eax, word [eax]
pop edi
pop esi
cmp eax, 2
jle 0x41c18a
push 0x4355be
add eax, 0xfffffffe
push eax
push 0x432a70
call fcn.00401130
add esp, 0xc
push 0x20
push 0x432a74
call fcn.00401130
push 0x5e
push 0x432a78
call fcn.00401130
add esp, 0x10
ret 0xc
Function at 0x41c250
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0xc], 0x20
mov ax, word [edi]
mov word [ebx], ax
movzx eax, word [edi]
cmp ax, word [esi + 2]
jg 0x41c2ab
nop dword [eax]
cwde
mov cl, byte [eax + esi + 3]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x41c2ab
push ecx
lea eax, [esp + 0x10]
push eax
call sym.hf32.exe__string_append1_8
mov ax, word [edi]
inc ax
movzx ecx, ax
mov word [edi], ax
mov eax, ecx
cmp cx, word [esi + 2]
jle 0x41c280
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push esi
push dword [esp + 0x44]
push eax
call sym.hf32.exe__string_t_int_12
push esi
call sym.hf32.exe__sys_error_4
test al, al
je 0x41c385
cmp byte [esp + 0x34], 0
je 0x41c37f
push 1
call fcn.0040a6ac
push eax
push 0xd
push 1
push str.Bad_integer__
call fcn.0040a941
mov ax, word [esp + 0x22]
add esp, 0x14
cmp ax, 0x20
jle 0x41c317
cwde
push 0x4355ba
sub eax, 0x20
push eax
push 0x432a5c
call fcn.00401130
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x41c32e
cmp ax, 0x20
jge 0x41c327
movsx esi, ax
jmp 0x41c330
mov esi, 0x20
jmp 0x41c330
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040a941
push 1
call fcn.0040a6ac
push eax
push 2
push 1
push 0x432a60
call fcn.0040a941
push 0x432a64
call fcn.00401130
add esp, 0x2c
push ebx
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0041c0f0
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
mov ax, word [ebx]
mov word [edi], ax
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
Function at 0x41cd50
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x91c]
test eax, eax
jne 0x41cdbb
test byte [esi], 2
je 0x41cd8e
cmp byte [esi + 1], al
jne 0x41cd8e
push dword [esi + 0x920]
call sub.KERNEL32.dll_SetEndOfFile
test al, al
jne 0x41cd8e
push 0
push 0x4355c4
push str.truncate
push 0x432b30
call sym.hf32.exe__sys_sys_error_bomb_16
cmp byte [esi + 1], 6
je 0x41cdc8
push dword [esi + 0x920]
call fcn.00407c58
test al, al
jne 0x41cdc8
push 0
push 0x4355c4
push str.close
push 0x432b30
call sym.hf32.exe__sys_sys_error_bomb_16
jmp 0x41cdc8
push esi
call eax
mov dword [esi + 0x91c], 0
add esi, 0x918
cmp dword [esi], 0
je 0x41cdd9
push esi
call sym.hf32.exe__sys_mem_dealloc_4
pop esi
ret 4

Function at 0x41d180
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x918]
cmp byte [eax], 0
jne 0x41d19b
add eax, 8
mov dword [esp + 4], eax
jmp sym.hf32.exe__file_close_4
ret 4

Function at 0x41d510
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call sym.hf32.exe__sys_error_none_4
mov edi, dword [esp + 0x10]
test edi, edi
je 0x41d5a9
push ebx
push dword [0x43566c]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push edi
push dword [esp + 0x24]
push dword [eax + 0x920]
call sub.KERNEL32.dll_ReadFile
mov ebx, dword [esp + 0x1c]
test al, al
jne 0x41d56b
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6d
je 0x41d575
mov dword [esi + 0xc], eax
mov eax, ebx
pop ebx
pop edi
pop esi
mov dword [eax], 0
ret 0x14
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
test eax, eax
jne 0x41d58b
push esi
push 1
push 0xfffffffffffffffd
mov dword [ebx], 0
call sym.hf32.exe__sys_stat_set_12
pop ebx
pop edi
pop esi
ret 0x14
cmp eax, edi
jae 0x41d5a8
push esi
push 0xa
push 0xfffffffffffffffd
call sym.hf32.exe__sys_stat_set_12
push esi
push edi
call sym.hf32.exe__sys_stat_parm_int_8
push esi
push dword [ebx]
call sym.hf32.exe__sys_stat_parm_int_8
pop ebx
pop edi
pop esi
ret 0x14
Function at 0x41fb70
Capabilities:
Get disk information

Disassembly:
push ecx
cmp byte [0x435840], 0
jne 0x41fc4f
mov al, byte [0x435841]
push ebx
mov ebx, 0x41
mov dword [0x435844], 0x30004
mov word [0x435849], 0x5c3a
mov byte [0x43584b], al
mov byte [0x435840], 1
mov byte [esp + 7], 0x20
mov byte [esp + 6], 0x20
mov byte [0x435848], bl
nop dword [eax + eax]
push 0x435848
call sub.KERNEL32.dll_GetDriveTypeA
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x41fbd2
jmp dword [eax*4 + 0x41fc64]
mov al, byte [esp + 7]
mov dl, byte [esp + 6]
cmp al, 0x20
jne 0x41fc12
mov al, byte [0x435848]
mov byte [esp + 7], al
jmp 0x41fc12
cmp byte [esp + 6], 0x20
movzx edx, byte [esp + 6]
movzx eax, byte [0x435848]
cmove edx, eax
mov byte [esp + 6], dl
jmp 0x41fc0e
mov dl, byte [esp + 6]
mov al, byte [esp + 7]
inc ebx
mov byte [0x435848], bl
cmp ebx, 0x5a
jle 0x41fbc0
cmp al, 0x20
je 0x41fc3a
pop ebx
push dword [esp + 8]
mov byte [0x435848], al
push 0x435844
call sym.hf32.exe__string_copy_8
pop ecx
ret 4
cmp dl, 0x20
movzx eax, dl
mov ecx, 0x43
cmovne ecx, eax
mov byte [0x435848], cl
pop ebx
push dword [esp + 8]
push 0x435844
call sym.hf32.exe__string_copy_8
pop ecx
ret 4

Function at 0x41fc80
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x106c
call fcn.00407310
cmp byte [0x4356a0], 0
jne 0x41fda9
lea eax, [esp + 4]
push eax
call sym.hf32.exe__sys_error_none_4
push 0x4356a4
mov word [esp + 4], 0x7f7f
push dword [esp + 4]
mov word [0x4356a6], 0
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
call sym.hf32.exe__sys_error_4
test al, al
je 0x41fda2
push ebx
mov word [esp + 4], 1
mov ebx, 1
push 0x4356a4
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push eax
call sym.hf32.exe__sys_error_4
test al, al
jne 0x41fd2f
call sub.WS2_32.dll_WSACleanup
test eax, eax
je 0x41fd2f
call sub.WS2_32.dll_WSAGetLastError
push 0
push 0x43584c
push str.err_netclose
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x4331a0
push eax
call sym.hf32.exe__sys_error_abort_20
mov al, byte [0x4356a6]
test al, al
jne 0x41fd67
inc ebx
mov byte [esp + 4], bl
cmp ebx, 0x7f
jle 0x41fce2
push 0
push 0x43584c
push str.err_netversion
push 0x4331a0
call sym.hf32.exe__sys_message_bomb_16
pop ebx
mov byte [0x4356a0], 1
add esp, 0x106c
ret
mov byte [esp + 4], al
mov al, byte [0x4356a7]
push 0x4356a4
mov byte [esp + 9], al
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
push 0
push 0x43584c
push str.err_netstart
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x4331a0
push eax
call sym.hf32.exe__sys_error_abort_20
pop ebx
mov byte [0x4356a0], 1
add esp, 0x106c
ret
Function at 0x41fe70
Capabilities:
Get hostname

Disassembly:
mov eax, 0x146c
call fcn.00407310
lea eax, [esp]
mov dword [esp], 0x400
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetComputerNameA
test al, al
jne 0x41feca
lea eax, [esp + 0x404]
push eax
call sym.hf32.exe__sys_error_none_4
call sub.KERNEL32.dll_GetLastError
push 0
push 0x4358b4
push str.node_name_get
mov dword [esp + 0x41c], eax
lea eax, [esp + 0x410]
push 0x433498
push eax
call sym.hf32.exe__sys_error_abort_20
push dword [esp]
lea eax, [esp + 8]
push eax
push dword [esp + 0x1478]
call sym.hf32.exe__string_vstring_12
push dword [esp + 0x1470]
call sym.hf32.exe__string_downcase_4
add esp, 0x146c
ret 4

Function at 0x420000
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x480c
call fcn.00407310
push esi
mov esi, dword [esp + 0x4818]
mov eax, 0x400
push edi
mov edi, dword [esp + 0x4818]
mov word [esp + 0xc], ax
mov eax, 0x2000
mov word [esp + 0x2810], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push edi
call sym.hf32.exe__string_token_16
push esi
call sym.hf32.exe__sys_error_4
test al, al
jne 0x420149
lea eax, [esp + 0x2810]
push eax
lea eax, [esp + 0x10]
push eax
call sym.hf32.exe__string_treename_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.hf32.exe__string_token_make_8
push 0x400
lea eax, [esp + 0x414]
push eax
lea eax, [esp + 0x14]
push eax
call sym.hf32.exe__string_t_c_12
xor eax, eax
mov word [esp + 0x2812], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.hf32.exe__string_token_16
push esi
call sym.hf32.exe__string_eos_4
test al, al
jne 0x4200f3
push esi
call sym.hf32.exe__sys_error_4
test al, al
jne 0x420149
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.hf32.exe__string_append_token_8
push esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.hf32.exe__string_token_16
push esi
call sym.hf32.exe__string_eos_4
test al, al
je 0x4200b8
push 0x2000
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x2818]
push eax
call sym.hf32.exe__string_t_c_12
push dword [0x433660]
lea eax, [esp + 0x814]
push 0x4358c4
push eax
lea eax, [esp + 0x41c]
push eax
push 0x4358c4
push dword [0x4358c0]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x420149
push esi
add eax, 0x64
push eax
push 0xffffffffffffffff
call sym.hf32.exe__sys_stat_set_12
pop edi
pop esi
add esp, 0x480c
ret 8
Function at 0x4205a0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
call sym.hf32.exe__sys_error_none_4
push dword [0x43355c]
push dword [esp + 0xc]
call sub.KERNEL32.dll_TerminateProcess
test al, al
jne 0x4205c6
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 8

Function at 0x420e10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push esi
call sym.hf32.exe__sys_error_none_4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x10
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push dword [eax + 0x920]
call sub.WS2_32.dll_getsockname
test eax, eax
je 0x420e52
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
push 4
lea eax, [esp + 0xc]
push eax
call sym.hf32.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xa]
push eax
call sym.hf32.exe__sys_order_flip_8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
pop esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 2]
mov word [ecx], ax
add esp, 0x10
ret 0x10

Function at 0x420ee0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push edi
push esi
call sym.hf32.exe__sys_error_none_4
call sym.hf32.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x420f16
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.hf32.exe__file_inet_sockaddr_init_4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
lea eax, [esp + 0xc]
push 4
push eax
call sym.hf32.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.hf32.exe__sys_order_flip_8
push dword [0x433678]
lea eax, [esp + 0xc]
push eax
push edi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x420f06
mov esi, dword [esp + 0x24]
push esi
call fcn.00421480
mov dword [esi + 0x920], edi
pop edi
pop esi
add esp, 0x10
ret 0x10