joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov byte [ebp - 1], 1
mov dword [ebp - 0x38], str.windows
mov dword [ebp - 0x34], str.boot
mov dword [ebp - 0x30], str.system
mov dword [ebp - 0x2c], str.programdata
mov dword [ebp - 0x28], str.program_files
mov dword [ebp - 0x24], str.appdata
mov dword [ebp - 0x20], str.application_data
mov dword [ebp - 0x1c], str.intel
mov dword [ebp - 0x18], str.default
mov dword [ebp - 0x14], str.msocache
mov dword [ebp - 0x10], str.config.msi
mov dword [ebp - 0xc], str.perflogs
mov dword [ebp - 8], str._recycle.bin
push 0x250
push 0
lea eax, [ebp - 0x498]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x240]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x405428
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
je 0x402b45
mov eax, dword [ebp - 0x498]
and eax, 0x10
je 0x402a24
push 0x40542c
lea ecx, [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402a1f
push 0x405430
lea edx, [ebp - 0x46c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402a1f
lea eax, [ebp - 0x46c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x240]
push eax
call fcn.004028f0
add esp, 4
jmp 0x402b29
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x248], ecx
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov dword [ebp - 0x49c], 0
jmp 0x402a58
mov eax, dword [ebp - 0x49c]
add eax, 1
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0xd
jae 0x402a85
mov ecx, dword [ebp - 0x49c]
mov edx, dword [ebp + ecx*4 - 0x38]
push edx
mov eax, dword [ebp - 0x248]
push eax
call fcn.00402b60
add esp, 8
test eax, eax
je 0x402a83
mov byte [ebp - 1], 0
jmp 0x402a49
movzx ecx, byte [ebp - 1]
cmp ecx, 1
jne 0x402b29
push str..exe
lea edx, [ebp - 0x46c]
push edx
call fcn.00402b60
add esp, 8
test eax, eax
je 0x402b29
lea eax, [ebp - 0x46c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x405444
lea eax, [ebp - 0x46c]
push eax
call fcn.00402b60
add esp, 8
test eax, eax
jne 0x402b29
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40544c
lea ecx, [ebp - 0x46c]
push ecx
call fcn.00402b60
add esp, 8
test eax, eax
jne 0x402b29
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.VolDrv
lea edx, [ebp - 0x46c]
push edx
call fcn.00402b60
add esp, 8
test eax, eax
jne 0x402b29
lea eax, [ebp - 0x240]
push eax
call fcn.00402450
add esp, 4
lea ecx, [ebp - 0x498]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4029c1
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x100119c
Capabilities:
Resolve dns
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_getnameinfo]
xor ebx, ebx
cmp byte [ebp + 0x10], bl
push edi
mov byte [ebp - 1], bl
mov edi, 0x401
je 0x10011ef
push 4
push ebx
push ebx
push edi
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x10011ef
lea eax, [ebp - 0x408]
push eax
push 0x273a
push 1
mov byte [ebp - 1], 1
call fcn.0100308e
add esp, 0xc
push 2
push ebx
push ebx
push edi
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x100121d
push 0x2724
push 1
call fcn.0100308e
pop ecx
pop ecx
push 1
call dword [sym.imp.msvcrt.dll_exit]
cmp byte [ebp - 1], bl
pop edi
pop esi
pop ebx
lea eax, [ebp - 0x408]
push eax
je 0x1001233
push 0x2710
jmp 0x1001238
push 0x273d
push 1
call fcn.0100308e
add esp, 0xc
leave
ret 0xc

Function at 0x1001315
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x18]
and byte [eax], 0
push esi
mov esi, dword [sym.imp.WS2_32.dll_getaddrinfo]
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 4
call esi
test eax, eax
jne 0x1001399
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov dword [edx], ecx
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x18]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp byte [ebp + 0x20], 0
rep movsb byte es:[edi], byte [esi]
je 0x1001396
push 4
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [eax + 0x10]
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov eax, dword [ebp + 8]
push eax
jmp 0x10013ed
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 2
call esi
test eax, eax
jne 0x10013f7
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov esi, dword [edx + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x14]
test ecx, ecx
jne 0x10013df
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov al, byte [ecx]
inc ecx
mov byte [esi], al
inc esi
test al, al
jne 0x10013e2
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov al, 1
jmp 0x10013f9
xor al, al
pop edi
pop esi
leave
ret 0x1c
Function at 0x10014df
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
movzx esi, byte [eax]
cmp esi, 1
push edi
mov dword [ebp - 0xc], esi
jb 0x1001516
mov edi, 0x1004558
mov ebx, esi
push dword [0x100400c]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
add edi, 0x98
dec ebx
jne 0x10014fd
mov ecx, dword [0x1004008]
and dword [ebp - 4], 0
test ecx, ecx
jbe 0x10015c1
mov ebx, 0x10042e0
mov edi, 0x100142d
cmp esi, 1
jb 0x10015a7
mov eax, dword [ebp - 0xc]
mov esi, 0x1004558
mov dword [ebp - 8], eax
push dword [section..data]
lea eax, [esi + 8]
cmp word [eax], 2
push dword [0x100400c]
push dword [esi]
push dword [ebp + 8]
push 0x40
push ebx
jne 0x1001573
push dword [eax + 4]
push esi
push edi
push 0
push dword [0x1004220]
call sub.iphlpapi.dll_IcmpSendEcho2
jmp 0x1001588
push eax
push 0x1004228
push esi
push edi
push 0
push dword [0x1004220]
call sub.iphlpapi.dll_Icmp6SendEcho2
push dword [0x1004004]
call fcn.010013ff
add esi, 0x98
dec dword [ebp - 8]
jne 0x1001542
mov ecx, dword [0x1004008]
mov esi, dword [ebp - 0xc]
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jb 0x1001532
jmp 0x10015c1
push 1
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov ecx, dword [0x1004008]
mov eax, ecx
imul eax, esi
cmp dword [0x10042b0], eax
jb 0x10015b1
mov eax, esi
imul eax, eax, 0x98
mov edx, dword [eax + 0x1004548]
dec esi
test esi, esi
mov dword [eax + 0x100454c], edx
jbe 0x1001610
mov eax, esi
imul eax, eax, 0x98
add eax, 0x10045e4
mov edx, dword [eax - 0x9c]
mov edi, dword [eax]
cmp edx, edi
ja 0x1001602
mov edx, edi
mov dword [eax - 0x98], edx
sub eax, 0x98
dec esi
jne 0x10015f4
pop edi
pop esi
mov dword [0x100454c], ecx
pop ebx
leave
ret 4
Function at 0x10021cd
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push 0x11
push 2
push 2
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002231
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push ebx
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0xc8000014
push esi
mov word [ebp - 0x14], 2
mov word [ebp - 0x12], bx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
pop edi
jne 0x100222a
mov ebx, dword [ebp - 0x20]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x1002e9a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001170
call fcn.01003038
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002ed5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002ed5
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002eed
cmp eax, 0x20b
je 0x1002eda
mov dword [ebp - 0x1c], edi
jmp 0x1002f01
cmp dword [ecx + 0x84], 0xe
jbe 0x1002ed5
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002efb
cmp dword [ecx + 0x74], 0xe
jbe 0x1002ed5
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100dcb0], 0xffffffff
or dword [0x100dcb4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10042c0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10042bc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100dcb8], eax
call fcn.01003032
cmp dword [0x1004204], edi
jne 0x1002f5c
push fcn.01003032
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01003020
push 0x1001128
push 0x1001124
call sub.msvcrt.dll__initterm
mov eax, dword [0x10042b8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x10042b4]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001120
push 0x100111c
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.010017ab
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1002fd3
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1003008
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01003071
ret
Function at 0x4010be
Capabilities:
Terminate process

Disassembly:
jmp 0x40d420
push 0
push 0
push dword [0x464408]
push 0
push 0
push dword [0x464404]
call fcn.00424ed0
add esp, 0x18
test eax, eax
je 0x40d481
push 0xffffffffffffffff
push dword [0x464404]
call fcn.00425c50
add esp, 8
test eax, eax
je 0x40d481
push 0xffffffffffffffff
push dword [0x464408]
push dword [0x464404]
call fcn.00425550
push 0xfffffffffffffffe
push dword [0x464404]
call fcn.00425850
add esp, 0x14
push str.Error_running_the_Lua_script
call fcn.0040d590
cmp dword [0x463c18], 0
je 0x40d49d
push dword [0x463cb8]
push str._s_returned_successfully._n
call fcn.004011ea
add esp, 8
push dword [0x464404]
call fcn.00423e10
add esp, 4
push 0
call dword [sym.imp.MSVCR120.dll_exit]
int3

Function at 0x4015d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 3
jl 0x401665
mov eax, 0xaaaaaaab
mul edi
mov ebx, edx
shr ebx, 1
lea eax, [ebx*4]
sub eax, ebx
neg eax
add edi, eax
mov edi, edi
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
dec ebx
jne 0x401600
mov ebx, dword [ebp + 0x10]
test edi, edi
jle 0x4016da
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
cmp edi, 1
jle 0x4016bd
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
pop edi
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
and eax, 0xf
pop esi
movzx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
mov byte [ecx], 0
sub ecx, ebx
mov eax, ecx
pop ebx
pop ebp
ret
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
add ecx, 4
pop edi
mov byte [ecx], 0
sub ecx, ebx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x408520
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x4635a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xdc], 0x80
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x408688
mov eax, dword [0x463d84]
mov esi, dword [ebp - 0xdc]
test eax, eax
jne 0x40857b
push 1
call fcn.004010fa
mov dword [0x463d84], eax
push 0xa
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push 0x41
lea ecx, [ebp - 0x58]
push ecx
push esi
lea ecx, [ebp - 0xd8]
push ecx
call eax
mov esi, eax
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
test esi, esi
jne 0x4086ba
lea eax, [ebp - 0x58]
push eax
push str.NCAT_REMOTE_ADDR
call fcn.004010d7
lea eax, [ebp - 0x14]
push eax
push str.NCAT_REMOTE_PORT
call fcn.004010d7
add esp, 0x10
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xd8]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x4086a1
mov eax, dword [0x463d84]
mov esi, dword [ebp - 0xdc]
test eax, eax
jne 0x4085fc
push 1
call fcn.004010fa
mov dword [0x463d84], eax
push 0xa
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push 0x41
lea ecx, [ebp - 0x58]
push ecx
push esi
lea ecx, [ebp - 0xd8]
push ecx
call eax
mov esi, eax
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
test esi, esi
pop esi
jne 0x4086ba
lea eax, [ebp - 0x58]
push eax
push str.NCAT_LOCAL_ADDR
call fcn.004010d7
lea eax, [ebp - 0x14]
push eax
push str.NCAT_LOCAL_PORT
call fcn.004010d7
mov eax, dword [0x463c24]
add esp, 0x10
sub eax, 6
je 0x408681
sub eax, 0xb
je 0x40867a
sub eax, 0x73
jne 0x40866c
push str.SCTP
push str.NCAT_PROTO
call fcn.004010d7
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044590e
mov esp, ebp
pop ebp
ret
push 0x456c1c
jmp 0x40865f
push 0x456c00
jmp 0x40865f
call sub.WS2_32.dll_WSAGetLastError
push eax
call fcn.0041fbf0
add esp, 4
push eax
push str.getpeername_failed:__s
call fcn.004010f0
call sub.WS2_32.dll_WSAGetLastError
push eax
call fcn.0041fbf0
add esp, 4
push eax
push str.getsockname_failed:__s
call fcn.004010f0
call sub.WS2_32.dll_WSAGetLastError
push eax
call fcn.0041fbf0
add esp, 4
push eax
push str.getnameinfo_failed:__s
call fcn.004010f0
int3
Function at 0x408f80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4635a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x463d7c], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x401280
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x401122
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.00401096
jne 0x409105
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4090fb
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call dword [sym.imp.MSVCR120.dll_strcpy_s]
push str.ws2_32
lea eax, [ebp - 0x110]
push 0x10c
push eax
call dword [sym.imp.MSVCR120.dll_strcat_s]
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x40905a
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x4090b1
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call dword [sym.imp.MSVCR120.dll_strcpy_s]
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call dword [sym.imp.MSVCR120.dll_strcat_s]
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4090f8
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x4090b1
push edi
call esi
jmp 0x4090f8
xor esi, esi
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x4090f1
inc esi
cmp esi, 3
jl 0x4090b3
mov eax, dword [ebp - 0x22c]
mov dword [0x46302c], eax
mov eax, dword [ebp - 0x224]
mov dword [0x463034], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.00401096], eax
jmp 0x4090f8
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x463d7c], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx eax, ax
xor ecx, ebp
mov eax, dword [eax*8 + 0x46302c]
call fcn.0044590e
mov esp, ebp
pop ebp
ret 4

Function at 0x409610
Capabilities:
Get comspec environment variable
Query environment variable

Disassembly:
push str.COMSPEC
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
mov ecx, str.cmd.exe
test eax, eax
cmovne ecx, eax
mov eax, ecx
ret
Function at 0x409820
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x463d94]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
jne 0x409848
push 0
push 0
push 0
call esi
mov dword [0x463d94], eax
test eax, eax
je 0x409904
cmp dword [0x463da0], 0
jne 0x40986b
push 0
push 0
push 0
call esi
mov dword [0x463da0], eax
test eax, eax
je 0x409913
mov eax, dword [0x463d94]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x409922
call fcn.00409640
mov esi, eax
cmp esi, 0xffffffff
jne 0x4098a0
cmp dword [0x463c14], 0
je 0x4098ef
push str.No_free_process_slots_for_termination_handler._n
call fcn.004011ea
add esp, 4
jmp 0x4098ef
cmp dword [0x463c18], 1
mov eax, dword [ebp + 8]
mov dword [esi*4 + 0x463da8], eax
jle 0x4098c2
push esi
push eax
push str.Register_subprocess__p_at_index__d._n
call fcn.004011ea
add esp, 0xc
cmp dword [0x463d98], 0
jne 0x4098ef
push fcn.0040a5b0
call fcn.00445a4f
push 0x409e00
push 2
call dword [sym.imp.MSVCR120.dll_signal]
add esp, 0xc
mov dword [0x463d98], 1
push dword [0x463d94]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x409931
mov eax, esi
pop esi
pop ebp
ret
push str.subprocesses_mutex___NULL
push str.assertion_failed:__s
call fcn.004010f0
push str.pseudo_sigchld_mutex___NULL
push str.assertion_failed:__s
call fcn.004010f0
push str.rc__WAIT_OBJECT_0
push str.assertion_failed:__s
call fcn.004010f0
push str.rc___0
push str.assertion_failed:__s
call fcn.004010f0
int3
Function at 0x409e20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.00445a80
mov eax, dword [0x4635a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x463cbc]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2010], edi
cmp eax, 1
jne 0x409ea5
call fcn.00409610
mov edx, eax
mov dword [ebp - 0x200c], eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x409e60
mov ecx, edi
sub edx, esi
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409e70
sub ecx, esi
lea esi, [edx + 0x20]
add esi, ecx
push esi
call fcn.0041e970
push edi
push dword [ebp - 0x200c]
mov dword [ebp - 0x2008], eax
push str._s__C__s
push esi
push eax
call fcn.0041ea20
add esp, 0x18
jmp 0x409f54
cmp eax, 2
jne 0x409f4e
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x409f06
cmp eax, 0x2000
je 0x409f06
push edi
call fcn.0041eb10
mov edi, eax
add esp, 4
test edi, edi
je 0x409f06
lea eax, [ebp - 0x2004]
push eax
call fcn.0041eb10
add esp, 4
mov dword [ebp - 0x200c], eax
push edi
test eax, eax
jne 0x409f1a
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044590e
mov esp, ebp
pop ebp
ret
push eax
lea eax, [ebp - 0x2008]
push str._s___lua_exec_internal__s
push eax
call fcn.00421b30
push edi
mov edi, dword [sym.imp.MSVCR120.dll_free]
mov esi, eax
call edi
push dword [ebp - 0x200c]
call edi
add esp, 0x18
test esi, esi
js 0x409f06
mov edi, dword [ebp - 0x2010]
jmp 0x409f54
mov dword [ebp - 0x2008], edi
cmp dword [0x463c18], 0
je 0x409f70
push dword [ebp - 0x2008]
push str.Executing:__s_n
call fcn.004011ea
add esp, 8
push ebx
push dword [ebp - 0x2008]
call fcn.00409990
mov esi, eax
add esp, 8
mov eax, dword [ebp - 0x2008]
cmp eax, edi
je 0x409f95
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
cmp esi, 0xffffffff
je 0x409f06
push dword [ebx]
call fcn.00409820
add esp, 4
cmp eax, 0xffffffff
jne 0x409fea
cmp dword [0x463c14], 0
je 0x409fc3
push str.Couldnt_register_subprocess_with_termination_handler__not_executing._n
call fcn.004011ea
add esp, 4
push 2
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
call fcn.0040a080
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044590e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044590e
mov esp, ebp
pop ebp
ret
Function at 0x40a5b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x463c18], 0
je 0x40a5ca
push str.Terminating_subprocesses_n
call fcn.004011ea
add esp, 4
push 0xffffffffffffffff
push dword [0x463d94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40a677
cmp dword [0x463c18], 1
jle 0x40a5fc
push dword [0x463d90]
push str.max_index__d_n
call fcn.004011ea
add esp, 8
mov eax, dword [0x463d90]
push esi
xor esi, esi
test eax, eax
jle 0x40a662
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [esi*4 + 0x463da8]
test edi, edi
je 0x40a65b
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 4], 0x103
jne 0x40a64b
cmp dword [0x463c18], 1
jle 0x40a646
push esi
push str.kill_index__d_n
call fcn.004011ea
add esp, 8
push 0
push edi
call ebx
mov eax, dword [0x463d90]
mov dword [esi*4 + 0x463da8], 0
inc esi
cmp esi, eax
jl 0x40a610
pop edi
pop ebx
push dword [0x463d94]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
test eax, eax
je 0x40a686
mov esp, ebp
pop ebp
ret
push str.rc__WAIT_OBJECT_0
push str.assertion_failed:__s
call fcn.004010f0
push str.rc___0
push str.assertion_failed:__s
call fcn.004010f0
int3