joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x14], ecx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x10014f36
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push edi
nop dword [eax]
test esi, esi
je 0x10014dbc
cmp eax, esi
jae 0x10014f31
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x10014f31
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x10048310]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
test esi, esi
jne 0x10014deb
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x10014e03
mov ch, byte [esi]
mov byte [ebp + 0xf], ch
jmp 0x10014e07
mov byte [ebp + 0xf], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x10014e12
mov ch, byte [esi]
jmp 0x10014e14
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x10014e22
mov al, byte [esi]
jmp 0x10014e24
xor al, al
movzx esi, byte [ebp + 0xf]
movzx edx, ch
movzx ecx, cl
movzx edi, al
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x10048330]
and eax, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], eax
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov eax, dword [ebp - 8]
and ecx, 0x3f
or eax, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10048358]
shr eax, cl
mov esi, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp esi, dword [eax*4 + 0x10048344]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [eax*4 + 0x1004836c]
mov eax, dword [ebp - 0x10]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x10014f14
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp + 0xf], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
mov ecx, dword [ebp - 0x14]
add eax, ebx
mov dword [ebp - 0x10], eax
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x10014db0
mov ebx, dword [ebp + 8]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x10014f44
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x5e24], 0
lea ecx, [esi + 0x5e28]
je 0x10016b85
push 0
call fcn.100232c0
push dword [ebp + 0x10]
lea ecx, [esi + 0x5e28]
push dword [ebp + 0xc]
call fcn.10022bb0
mov edx, dword [esi + 0x5e28]
mov ecx, 0x100512fc
push dword [esi + 0x5e24]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x5e30]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebp
ret
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10022bb0
pop edi
pop esi
pop ebp
ret
Function at 0x1001dfe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10051300]
push esi
mov esi, dword [ebp + 8]
mov dword [eax + 0x5db8], 0
test esi, esi
je 0x1001e039
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push edi
push eax
call fcn.1001e040
push 0x100490b8
push esi
mov edi, eax
call fcn.10014540
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1001e038
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
ret
Function at 0x1002abc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x1002abe7
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.10016ca0
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1002ac0c
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.10016ca0
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1002ac31
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.10016ca0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1002ac72
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.10016ca0
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1002ac97
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.10016ca0
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1002acbc
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.10016ca0
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10026530
Function at 0x10042b70
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push esi
call fcn.10013a50
test eax, eax
je 0x10042b84
call fcn.10013c00
mov esi, dword [eax + 0x6c]
jmp 0x10042b86
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10042ba9
mov dword [esi], eax
pop esi
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x405044], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x405228
push 0x405290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40114b
xor eax, eax
jmp 0x401166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401f40
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x91c]
test eax, eax
jne 0x401fab
test byte [esi], 2
je 0x401f7e
cmp byte [esi + 1], al
jne 0x401f7e
push dword [esi + 0x920]
call sub.KERNEL32.dll_SetEndOfFile
test al, al
jne 0x401f7e
push 0
push 0x437104
push str.truncate
push 0x430bf0
call sym.test_usbprog.exe__sys_sys_error_bomb_16
cmp byte [esi + 1], 6
je 0x401fb8
push dword [esi + 0x920]
call sub.KERNEL32.dll_CloseHandle
test al, al
jne 0x401fb8
push 0
push 0x437104
push str.close
push 0x430bf0
call sym.test_usbprog.exe__sys_sys_error_bomb_16
jmp 0x401fb8
push esi
call eax
mov dword [esi + 0x91c], 0
add esi, 0x918
cmp dword [esi], 0
je 0x401fc9
push esi
call sym.test_usbprog.exe__sys_mem_dealloc_4
pop esi
ret 4

Function at 0x4023d0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x106c
call fcn.00406cc0
push esi
push edi
push dword [0x430cf4]
call sub.KERNEL32.dll_GetStdHandle
mov edi, eax
cmp edi, 0xffffffff
jne 0x402421
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__sys_error_none_4
call sub.KERNEL32.dll_GetLastError
push 0
push 0x437158
push 0x437108
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push 0x437108
push eax
call sym.test_usbprog.exe__sys_error_abort_20
call sym.test_usbprog.exe__sys_bomb_0
mov eax, dword [esp + 0x1078]
movsx esi, word [eax + 2]
test esi, esi
je 0x402485
push ebx
lea ebx, [eax + 4]
push dword [0x43715c]
lea eax, [esp + 0x10]
push eax
push esi
push ebx
push edi
call sub.KERNEL32.dll_WriteFile
test al, al
jne 0x40247e
lea eax, [esp + 0x10]
push eax
call sym.test_usbprog.exe__sys_error_none_4
call sub.KERNEL32.dll_GetLastError
push 0
push 0x437158
push 0x437108
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push 0x437108
push eax
call sym.test_usbprog.exe__sys_error_abort_20
call sym.test_usbprog.exe__sys_bomb_0
sub esi, dword [esp + 0xc]
jne 0x402434
pop ebx
push edi
call sub.KERNEL32.dll_FlushFileBuffers
pop edi
pop esi
add esp, 0x106c
ret 4
Function at 0x402db0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1090
call fcn.00406cc0
push ebx
push esi
push edi
lea eax, [esp + 0x34]
push eax
call sym.test_usbprog.exe__sys_error_none_4
push dword [0x430db8]
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402dfe
push 0x430dbc
lea eax, [esp + 0x2c]
push eax
call sym.test_usbprog.exe__sys_msg_parm_int_8
push 1
lea eax, [esp + 0x2c]
push eax
push str.open_stream
push 0x430dc0
call sym.test_usbprog.exe__sys_sys_error_bomb_16
push 0x43756c
push 0
push 1
push dword [0x437568]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call sub.KERNEL32.dll_CreateEventA
mov edi, dword [esp + 0x10a0]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x402e5a
call sub.KERNEL32.dll_GetLastError
push 0
push 0x43756c
push 0x437570
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x40]
push 0x437570
push eax
call sym.test_usbprog.exe__sys_error_abort_20
call sym.test_usbprog.exe__sys_bomb_0
xor eax, eax
xor esi, esi
mov word [edi + 2], ax
mov ecx, dword [0x437160]
mov eax, dword [0x437164]
nop dword [eax]
test eax, eax
jne 0x402ed9
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push dword [0x430e60]
push 0x437168
push ebx
call sub.KERNEL32.dll_ReadFile
test al, al
jne 0x402ecf
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
je 0x402eb5
push 0
push 0x43756c
push str.err_readin
push 0x430e68
call sym.test_usbprog.exe__sys_sys_error_bomb_16
push 1
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
call sub.KERNEL32.dll_GetOverlappedResult
test al, al
je 0x402e31
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402f20
xor ecx, ecx
mov dl, byte [ecx + 0x437168]
dec eax
inc ecx
mov byte [esp + 0x10], dl
mov dword [0x437160], ecx
mov dword [0x437164], eax
cmp dl, 0xa
je 0x402f20
cmp dl, 0x20
jne 0x402f00
inc esi
jmp 0x402e70
test esi, esi
jle 0x402f11
push 0x20
push edi
call sym.test_usbprog.exe__string_append1_8
dec esi
test esi, esi
jg 0x402f04
push dword [esp + 0x10]
push edi
call sym.test_usbprog.exe__string_append1_8
jmp 0x402e62
push dword [esp + 0x24]
call sub.KERNEL32.dll_CloseHandle
movzx ecx, word [edi + 2]
test cx, cx
jle 0x402f43
movsx eax, cx
cmp byte [eax + edi + 3], 0xd
jne 0x402f43
lea eax, [ecx - 1]
mov word [edi + 2], ax
pop edi
pop esi
pop ebx
add esp, 0x1090
ret 4
Function at 0x403250
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1070
call fcn.00406cc0
call sym.test_usbprog.exe__sys_init_0
call sym.test_usbprog.exe__util_init_0
mov eax, 4
mov dword [0x43a6a4], 0x400
mov word [esp], ax
movzx eax, word [0x430fa8]
push eax
push dword [esp + 0x1080]
mov dword [0x43aaa8], 0x100
push 0x43aaa8
mov dword [0x43abac], 0x20
mov dword [0x438680], 0x2000
call sym.test_usbprog.exe__string_vstring_12
mov byte [0x4375c0], 1
call sub.KERNEL32.dll_GetCommandLineA
test eax, eax
je 0x4032d1
movzx ecx, word [0x430fa8]
push ecx
push eax
push 0x438680
call sym.test_usbprog.exe__string_vstring_12
mov eax, 1
mov word [0x43a684], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x43a684
push 0x438680
call sym.test_usbprog.exe__string_token_16
mov ax, word [0x43a684]
mov word [0x43a686], ax
mov dword [0x43a6a0], 1
mov byte [0x43abd0], 0
add esp, 0x1070
ret 0xc

Function at 0x4037c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push esi
call sym.test_usbprog.exe__sys_error_none_4
cmp byte [0x437861], 0
jne 0x4037e5
push 0x43abf0
call sub.KERNEL32.dll_InitializeCriticalSection
mov byte [0x437861], 1
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [0x4375c8]
push dword [0x4375c4]
call sub.KERNEL32.dll_CreateThread
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x403817
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 0x10
Function at 0x4044b0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1a14
call fcn.00406cc0
mov eax, dword [0x43785c]
inc eax
mov dword [0x43785c], eax
push ebx
mov ebx, 0x84
mov word [esp + 4], bx
cmp eax, 1
jle 0x404510
cmp byte [0x432c6c], 0
jne 0x404510
push 0x433074
call fcn.00401f00
push 1
call fcn.0040a39c
push eax
push 0x35
push 1
push str.Recursive_call_to_message_routine.__Original_message:
call fcn.0040a631
push 0x4331a0
call fcn.00401f00
add esp, 0x1c
call fcn.00404750
push 0x432c18
push 0x432c70
push dword [esp + 0x1a28]
push dword [esp + 0x1a28]
call sym.test_usbprog.exe__sys_message_resolve_16
cmp word [0x432c72], 0
mov byte [0x432c6c], 0
jle 0x40473f
cmp word [0x432c1a], 0
jle 0x40473f
cmp dword [0x43785c], 1
jle 0x40459b
push 0x4331a4
call fcn.00401f00
push 1
call fcn.0040a39c
push eax
push 0x3d
push 1
push str.Message_requested_while_attempting_to_print_previous_message:
call fcn.0040a631
push 0x4331e8
call fcn.00401f00
add esp, 0x1c
call fcn.00404750
dec dword [0x43785c]
pop ebx
add esp, 0x1a14
ret 0x10
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x10f8]
push eax
push dword [esp + 0x1a30]
push dword [esp + 0x1a30]
push 0x432c18
push 0x432c70
call sym.test_usbprog.exe__file_open_read_msg_24
lea eax, [esp + 0x8c]
push eax
call sym.test_usbprog.exe__file_not_found_4
test al, al
jne 0x404586
lea eax, [esp + 0x8c]
push eax
call sym.test_usbprog.exe__sys_error_4
test al, al
je 0x40461d
call fcn.00404750
push 0
push 0x4375d8
push str.open_msg
push 0x433078
lea eax, [esp + 0x9c]
push eax
call sym.test_usbprog.exe__sys_error_print_20
dec dword [0x43785c]
pop ebx
add esp, 0x1a14
ret 0x10
push edi
call sym.test_usbprog.exe__sys_width_stdout_0
lea edi, [eax - 1]
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
push edi
lea eax, [esp + 0x1104]
push eax
call sym.test_usbprog.exe__file_read_msg_16
lea eax, [esp + 0x90]
push eax
call sym.test_usbprog.exe__file_eof_4
test al, al
jne 0x40472a
push esi
nop word [eax + eax]
lea eax, [esp + 0x94]
push eax
call sym.test_usbprog.exe__sys_error_4
test al, al
jne 0x404706
mov ax, word [esp + 0xe]
cmp ax, bx
jle 0x40469d
cwde
push 0x4375dc
sub eax, 0x84
push eax
push 0x4331ec
call fcn.00401f00
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x4046b0
cmp ax, bx
jge 0x4046ac
movsx esi, ax
jmp 0x4046b2
mov esi, ebx
jmp 0x4046b2
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040a631
push 0x4331f0
call fcn.00401f00
add esp, 0x18
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x10]
push eax
push edi
lea eax, [esp + 0x1108]
push eax
call sym.test_usbprog.exe__file_read_msg_16
lea eax, [esp + 0x94]
push eax
call sym.test_usbprog.exe__file_eof_4
test al, al
je 0x404660
jmp 0x404729
call fcn.00404750
push 0
push 0x4375d8
push str.read_msg
push 0x433078
lea eax, [esp + 0xa4]
push eax
call sym.test_usbprog.exe__sys_error_print_20
pop esi
lea eax, [esp + 0x10f8]
mov byte [0x432c6c], 1
push eax
call sym.test_usbprog.exe__file_close_4
pop edi
dec dword [0x43785c]
pop ebx
add esp, 0x1a14
ret 0x10
Function at 0x404750
Capabilities:
Write file on windows

Disassembly:
push 0x432c70
call sym.test_usbprog.exe__string_upcase_4
push 0x432c18
call sym.test_usbprog.exe__string_upcase_4
push 1
call fcn.0040a39c
push eax
push 8
push 1
push str.Status__
call fcn.0040a631
mov ax, word [0x432c1a]
add esp, 0x14
cmp ax, 0x50
jle 0x4047a6
cwde
push 0x4375dd
sub eax, 0x50
push eax
push 0x433200
call fcn.00401f00
mov ax, word [0x432c1a]
add esp, 0xc
push esi
test ax, ax
jle 0x4047be
cmp ax, 0x50
jge 0x4047b7
movsx esi, ax
jmp 0x4047c0
mov esi, 0x50
jmp 0x4047c0
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
push 1
push 0x432c1c
call fcn.0040a631
push 1
call fcn.0040a39c
push eax
push 0x10
push 1
push str.__in_subsystem__
call fcn.0040a631
mov ax, word [0x432c72]
mov esi, 0x400
add esp, 0x28
cmp ax, si
jle 0x40481a
cwde
push 0x4375de
sub eax, esi
push eax
push 0x433218
call fcn.00401f00
mov ax, word [0x432c72]
add esp, 0xc
test ax, ax
jle 0x404829
cmp ax, si
jge 0x40482b
movsx esi, ax
jmp 0x40482b
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
push 1
push 0x432c74
call fcn.0040a631
push 1
call fcn.0040a39c
push eax
push 2
push 1
push 0x43321c
call fcn.0040a631
push 0x433220
call fcn.00401f00
add esp, 0x2c
mov byte [0x432c6c], 1
pop esi
ret

Function at 0x4048d0
Capabilities:
Get disk information

Disassembly:
push ecx
cmp byte [0x437780], 0
jne 0x4049af
mov al, byte [0x437781]
push ebx
mov ebx, 0x41
mov dword [0x437784], 0x30004
mov word [0x437789], 0x5c3a
mov byte [0x43778b], al
mov byte [0x437780], 1
mov byte [esp + 7], 0x20
mov byte [esp + 6], 0x20
mov byte [0x437788], bl
nop dword [eax + eax]
push 0x437788
call sub.KERNEL32.dll_GetDriveTypeA
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x404932
jmp dword [eax*4 + 0x4049c4]
mov al, byte [esp + 7]
mov dl, byte [esp + 6]
cmp al, 0x20
jne 0x404972
mov al, byte [0x437788]
mov byte [esp + 7], al
jmp 0x404972
cmp byte [esp + 6], 0x20
movzx edx, byte [esp + 6]
movzx eax, byte [0x437788]
cmove edx, eax
mov byte [esp + 6], dl
jmp 0x40496e
mov dl, byte [esp + 6]
mov al, byte [esp + 7]
inc ebx
mov byte [0x437788], bl
cmp ebx, 0x5a
jle 0x404920
cmp al, 0x20
je 0x40499a
pop ebx
push dword [esp + 8]
mov byte [0x437788], al
push 0x437784
call sym.test_usbprog.exe__string_copy_8
pop ecx
ret 4
cmp dl, 0x20
movzx eax, dl
mov ecx, 0x43
cmovne ecx, eax
mov byte [0x437788], cl
pop ebx
push dword [esp + 8]
push 0x437784
call sym.test_usbprog.exe__string_copy_8
pop ecx
ret 4
Function at 0x404f80
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x106c
call fcn.00406cc0
cmp byte [0x4375e0], 0
jne 0x4050a9
lea eax, [esp + 4]
push eax
call sym.test_usbprog.exe__sys_error_none_4
push 0x4375e4
mov word [esp + 4], 0x7f7f
push dword [esp + 4]
mov word [0x4375e6], 0
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
call sym.test_usbprog.exe__sys_error_4
test al, al
je 0x4050a2
push ebx
mov word [esp + 4], 1
mov ebx, 1
push 0x4375e4
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push eax
call sym.test_usbprog.exe__sys_error_4
test al, al
jne 0x40502f
call sub.WS2_32.dll_WSACleanup
test eax, eax
je 0x40502f
call sub.WS2_32.dll_WSAGetLastError
push 0
push 0x43778c
push str.err_netclose
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x433228
push eax
call sym.test_usbprog.exe__sys_error_abort_20
mov al, byte [0x4375e6]
test al, al
jne 0x405067
inc ebx
mov byte [esp + 4], bl
cmp ebx, 0x7f
jle 0x404fe2
push 0
push 0x43778c
push str.err_netversion
push 0x433228
call sym.test_usbprog.exe__sys_message_bomb_16
pop ebx
mov byte [0x4375e0], 1
add esp, 0x106c
ret
mov byte [esp + 4], al
mov al, byte [0x4375e7]
push 0x4375e4
mov byte [esp + 9], al
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
push 0
push 0x43778c
push str.err_netstart
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x433228
push eax
call sym.test_usbprog.exe__sys_error_abort_20
pop ebx
mov byte [0x4375e0], 1
add esp, 0x106c
ret

Function at 0x405230
Capabilities:
Write file on windows

Disassembly:
push 1
call fcn.0040a39c
push eax
push 0x21
push 1
push str._Program_aborted_on_error._
call fcn.0040a631
push 0x433540
call fcn.00401f00
add esp, 0x18
jmp sym.test_usbprog.exe__sys_exit_error_0
Function at 0x405410
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
xor eax, eax
push ebx
mov ebx, dword [esp + 0x10c]
push esi
mov esi, dword [esp + 0x114]
mov word [esi + 2], ax
test ebx, ebx
jne 0x40543d
pop esi
xor al, al
pop ebx
add esp, 0x104
ret 8
push ebp
push edi
cmp word [esi], ax
jle 0x405543
push 0
push dword [0x437864]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push dword [0x433598]
push ebx
push 0
push 0x11ff
call sub.KERNEL32.dll_FormatMessageA
test eax, eax
je 0x405489
push eax
push dword [esp + 0x14]
push esi
call sym.test_usbprog.exe__string_vstring_12
push dword [esp + 0x10]
call sub.KERNEL32.dll_LocalFree
jmp 0x40553d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405497
push eax
call sub.KERNEL32.dll_LocalFree
push str.RASAPI32.DLL
mov ebp, 1
call sub.KERNEL32.dll_LoadLibraryA
mov edi, eax
test edi, edi
jne 0x4054dc
push ebp
call fcn.0040a39c
push eax
push 0x1c
push ebp
push str.Could_not_load_RASAIP32.DLL.
call fcn.0040a631
push 0x4335d4
call fcn.00401f00
add esp, 0x18
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x104
ret 8
push str.RasGetErrorStringA
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
jne 0x405510
push 1
call fcn.0040a39c
push eax
push 0x2e
push 1
push str.Could_not_find_RasGetErrorStringA_entry_point.
call fcn.0040a631
push 0x433608
call fcn.00401f00
add esp, 0x18
jmp 0x405520
push dword [0x4335ac]
lea ecx, [esp + 0x18]
push ecx
push ebx
call eax
mov ebp, eax
push edi
call sub.KERNEL32.dll_FreeLibrary
test ebp, ebp
jne 0x405543
movzx eax, word [0x4335b0]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call sym.test_usbprog.exe__string_vstring_12
push esi
call sym.test_usbprog.exe__string_unpad_4
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
add esp, 0x104
ret 8
Function at 0x406060
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x480c
call fcn.00406cc0
push esi
mov esi, dword [esp + 0x4818]
mov eax, 0x400
push edi
mov edi, dword [esp + 0x4818]
mov word [esp + 0xc], ax
mov eax, 0x2000
mov word [esp + 0x2810], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push edi
call sym.test_usbprog.exe__string_token_16
push esi
call sym.test_usbprog.exe__sys_error_4
test al, al
jne 0x4061a9
lea eax, [esp + 0x2810]
push eax
lea eax, [esp + 0x10]
push eax
call sym.test_usbprog.exe__string_treename_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.test_usbprog.exe__string_token_make_8
push 0x400
lea eax, [esp + 0x414]
push eax
lea eax, [esp + 0x14]
push eax
call sym.test_usbprog.exe__string_t_c_12
xor eax, eax
mov word [esp + 0x2812], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.test_usbprog.exe__string_token_16
push esi
call sym.test_usbprog.exe__string_eos_4
test al, al
jne 0x406153
push esi
call sym.test_usbprog.exe__sys_error_4
test al, al
jne 0x4061a9
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.test_usbprog.exe__string_append_token_8
push esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.test_usbprog.exe__string_token_16
push esi
call sym.test_usbprog.exe__string_eos_4
test al, al
je 0x406118
push 0x2000
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x2818]
push eax
call sym.test_usbprog.exe__string_t_c_12
push dword [0x433930]
lea eax, [esp + 0x814]
push 0x437878
push eax
lea eax, [esp + 0x41c]
push eax
push 0x437878
push dword [0x437874]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x4061a9
push esi
add eax, 0x64
push eax
push 0xffffffffffffffff
call sym.test_usbprog.exe__sys_stat_set_12
pop edi
pop esi
add esp, 0x480c
ret 8

Function at 0x4061f0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
call sym.test_usbprog.exe__sys_error_none_4
push dword [0x43382c]
push dword [esp + 0xc]
call sub.KERNEL32.dll_TerminateProcess
test al, al
jne 0x406216
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 8