joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404160
Capabilities:
Write file on windows

Disassembly:
push 0x42d4b0
call sym.test_embusb.exe__string_upcase_4
push 0x42d458
call sym.test_embusb.exe__string_upcase_4
push 1
call fcn.0040887c
push eax
push 8
push 1
push str.Status__
call fcn.00408b11
mov ax, word [0x42d45a]
add esp, 0x14
cmp ax, 0x50
jle 0x4041b6
cwde
push 0x430f75
sub eax, 0x50
push eax
push 0x42da40
call fcn.00401350
mov ax, word [0x42d45a]
add esp, 0xc
push esi
test ax, ax
jle 0x4041ce
cmp ax, 0x50
jge 0x4041c7
movsx esi, ax
jmp 0x4041d0
mov esi, 0x50
jmp 0x4041d0
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
push 1
push 0x42d45c
call fcn.00408b11
push 1
call fcn.0040887c
push eax
push 0x10
push 1
push str.__in_subsystem__
call fcn.00408b11
mov ax, word [0x42d4b2]
mov esi, 0x400
add esp, 0x28
cmp ax, si
jle 0x40422a
cwde
push 0x430f76
sub eax, esi
push eax
push 0x42da58
call fcn.00401350
mov ax, word [0x42d4b2]
add esp, 0xc
test ax, ax
jle 0x404239
cmp ax, si
jge 0x40423b
movsx esi, ax
jmp 0x40423b
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
push 1
push 0x42d4b4
call fcn.00408b11
push 1
call fcn.0040887c
push eax
push 2
push 1
push 0x42da5c
call fcn.00408b11
push 0x42da60
call fcn.00401350
add esp, 0x2c
mov byte [0x42d4ac], 1
pop esi
ret

Function at 0x404310
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push esi
call sym.test_embusb.exe__sys_error_none_4
cmp byte [0x430f8d], 0
jne 0x404335
push 0x434590
call sub.KERNEL32.dll_InitializeCriticalSection
mov byte [0x430f8d], 1
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [0x430f7c]
push dword [0x430f78]
call sub.KERNEL32.dll_CreateThread
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x404367
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 0x10
Function at 0x4049f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x58
push esi
mov esi, dword [esp + 0x68]
mov eax, 0x50
push edi
mov word [esp + 0xc], ax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x68]
mov byte [esi], 0
call sym.test_embusb.exe__string_copy_8
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__string_terminate_null_4
mov edi, dword [esp + 0x70]
lea eax, [esp + 0x64]
push edi
push eax
push 1
call fcn.00404900
push edi
call sym.test_embusb.exe__sys_error_4
test al, al
jne 0x404ace
push ebx
mov ebx, dword [esp + 0x6c]
movsx eax, word [ebx]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x70]
push eax
lea eax, [ebx + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x7c]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x70]
mov dword [edi + 0xc], eax
mov word [ebx + 2], cx
cmp dword [edi + 0xc], 0xea
jne 0x404a83
push edi
call sym.test_embusb.exe__sys_error_none_4
jmp 0x404a9e
test cx, cx
jle 0x404a9e
movsx eax, cx
mov al, byte [eax + ebx + 3]
cmp al, byte [0x430ff5]
jne 0x404a9e
lea eax, [ecx - 1]
mov word [ebx + 2], ax
push dword [esp + 0x68]
call sub.ADVAPI32.dll_RegCloseKey
push edi
call sym.test_embusb.exe__sys_error_4
pop ebx
test al, al
jne 0x404ace
mov eax, dword [esp + 8]
sub eax, 1
je 0x404acb
sub eax, 1
jne 0x404ace
or byte [esi], 2
pop edi
pop esi
add esp, 0x58
ret 0x10
or byte [esi], 1
pop edi
pop esi
add esp, 0x58
ret 0x10

Function at 0x404ae0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x884
lea eax, [esp]
push dword [0x42dc34]
push eax
push dword [esp + 0x890]
call sym.test_embusb.exe__string_t_c_12
push dword [0x42dc38]
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x404b44
push dword [esp + 0x890]
push 2
push 0xffffffffffffffff
call sym.test_embusb.exe__sys_stat_set_12
push dword [esp + 0x890]
push dword [esp + 0x88c]
call sym.test_embusb.exe__sys_stat_parm_vstr_8
add esp, 0x884
ret 0xc
movzx eax, word [0x42dc3c]
push eax
lea eax, [esp + 0x88]
push eax
push dword [esp + 0x894]
call sym.test_embusb.exe__string_vstring_12
push dword [esp + 0x890]
call sym.test_embusb.exe__sys_error_none_4
add esp, 0x884
ret 0xc

Function at 0x404b80
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x884
push esi
mov esi, dword [esp + 0x894]
push esi
call sym.test_embusb.exe__sys_error_none_4
push 0x84
lea eax, [esp + 8]
push eax
push dword [esp + 0x894]
call sym.test_embusb.exe__string_t_c_12
push 0x800
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x898]
call sym.test_embusb.exe__string_t_c_12
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x404be1
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x884
ret 0xc
Function at 0x404bf0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x54
mov eax, 0x50
push esi
mov word [esp + 4], ax
lea eax, [esp + 4]
push eax
push dword [esp + 0x60]
call sym.test_embusb.exe__string_copy_8
lea eax, [esp + 4]
push eax
call sym.test_embusb.exe__string_terminate_null_4
mov esi, dword [esp + 0x60]
lea eax, [esp + 0x5c]
push esi
push eax
push 2
call fcn.00404900
push esi
call sym.test_embusb.exe__sys_error_4
test al, al
jne 0x404c48
push esi
call sym.test_embusb.exe__sys_error_none_4
lea eax, [esp + 8]
push eax
push dword [esp + 0x60]
call sub.ADVAPI32.dll_RegDeleteValueA
mov dword [esi + 0xc], eax
pop esi
add esp, 0x54
ret 8

Function at 0x404c50
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x88
push esi
push dword [0x42dc30]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x98]
call sym.test_embusb.exe__string_t_c_12
mov al, byte [0x430ff4]
mov esi, dword [esp + 0x94]
push esi
mov byte [esp + 0xb], al
call sym.test_embusb.exe__sys_error_none_4
lea eax, [esp + 7]
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x404c9f
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x88
ret 8
Function at 0x404cb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x2068
call fcn.004054e0
mov eax, 0x50
mov byte [esp + 3], 0
push ebx
mov bh, byte [esp + 0x2078]
mov word [esp + 0x14], ax
mov eax, 0x2000
push esi
mov word [esp + 0x6c], ax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x2078]
call sym.test_embusb.exe__string_copy_8
lea eax, [esp + 0x18]
push eax
call sym.test_embusb.exe__string_terminate_null_4
mov esi, dword [esp + 0x2080]
lea eax, [esp + 0xc]
push esi
push eax
push 3
call fcn.00404900
push esi
call sym.test_embusb.exe__sys_error_4
test al, al
jne 0x404e7c
movsx eax, word [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov word [esp + 0x6e], cx
cmp eax, 0xea
jne 0x404d5c
push esi
call sym.test_embusb.exe__sys_error_none_4
jmp 0x404d78
test cx, cx
jle 0x404d78
movsx eax, cx
mov al, byte [esp + eax + 0x6f]
cmp al, byte [0x430ff6]
jne 0x404d78
lea eax, [ecx - 1]
mov word [esp + 0x6e], ax
mov bl, bh
push esi
and bl, 1
call sym.test_embusb.exe__sys_error_4
test al, al
je 0x404d91
mov dword [esp + 0x10], 1
jmp 0x404dc1
mov eax, dword [esp + 0x10]
test bl, bl
je 0x404d9e
cmp eax, 1
jne 0x404dc1
test bh, 2
je 0x404da8
cmp eax, 2
jne 0x404dc1
push dword [esp + 0x2078]
lea eax, [esp + 0x70]
push eax
call sym.test_embusb.exe__string_equal_8
test al, al
jne 0x404e73
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x207c]
call sym.test_embusb.exe__string_copy_8
lea eax, [esp + 0x6c]
push eax
call sym.test_embusb.exe__string_terminate_null_4
mov ecx, dword [esp + 0x10]
test bl, bl
mov eax, 1
cmovne ecx, eax
test bh, 2
mov eax, 2
cmovne ecx, eax
movsx eax, word [esp + 0x6e]
inc eax
mov dword [esp + 0x10], ecx
push eax
lea eax, [esp + 0x74]
push eax
push ecx
push dword [0x430ff8]
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegSetValueExA
push esi
mov dword [esi + 0xc], eax
call sym.test_embusb.exe__sys_error_4
test al, al
jne 0x404e5b
push dword [esp + 0xc]
mov byte [esp + 0xf], 1
call sub.ADVAPI32.dll_RegFlushKey
push esi
mov dword [esi + 0xc], eax
call sym.test_embusb.exe__sys_error_4
test al, al
jne 0x404e5b
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [esi + 0xc], eax
mov al, 1
pop esi
pop ebx
add esp, 0x2068
ret 0x10
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x2068
ret 0x10
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
pop esi
xor al, al
pop ebx
add esp, 0x2068
ret 0x10
Function at 0x417d10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
mov eax, 0x20
mov ebx, 0x400
mov word [esp + 0xc], ax
lea eax, [esp + 0x30]
push 0x42e878
push eax
mov dword [esp + 0x38], ebx
call sym.test_embusb.exe__string_appends_8
push 0x20
lea eax, [esp + 0x34]
push eax
call sym.test_embusb.exe__string_append1_8
mov edi, dword [esp + 0x438]
mov eax, dword [edi]
push dword [eax + 0x970]
lea eax, [esp + 0x10]
push eax
call sym.test_embusb.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
call sym.test_embusb.exe__string_append_8
push 0x42e8c8
lea eax, [esp + 0x34]
push eax
call sym.test_embusb.exe__string_appends_8
mov ax, word [esp + 0x32]
cmp ax, bx
jle 0x417da3
cwde
push 0x431a83
sub eax, ebx
push eax
push 0x42e874
call fcn.00401350
mov ax, word [esp + 0x3e]
add esp, 0xc
test ax, ax
jle 0x417db6
cmp ax, bx
jge 0x417db2
movsx esi, ax
jmp 0x417db8
mov esi, ebx
jmp 0x417db8
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
lea eax, [esp + 0x40]
push 1
push eax
call fcn.00408b11
push 0x42e918
call fcn.00401350
mov eax, dword [edi]
add esp, 0x18
movzx ecx, word [eax + 0x56a]
cmp cx, bx
jle 0x417e05
movsx eax, cx
push 0x431a84
sub eax, 0x400
push eax
push 0x42e91c
call fcn.00401350
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 0x56a]
test ax, ax
jle 0x417e1f
cmp ax, bx
jge 0x417e1b
movsx esi, ax
jmp 0x417e21
mov esi, ebx
jmp 0x417e21
xor esi, esi
push 1
call fcn.0040887c
push eax
mov eax, dword [edi]
push esi
add eax, 0x56c
push 1
push eax
call fcn.00408b11
push 0x42e920
call fcn.00401350
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x428
ret 4

Function at 0x417e60
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00417d10
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
movzx ecx, word [eax + 2]
cmp cx, 0x50
jle 0x417e96
movsx eax, cx
push 0x431a7f
sub eax, 0x50
push eax
push 0x42e860
call fcn.00401350
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 2]
test ax, ax
jle 0x417eb1
cmp ax, 0x50
jge 0x417eaa
movsx esi, ax
jmp 0x417eb3
mov esi, 0x50
jmp 0x417eb3
xor esi, esi
push 1
call fcn.0040887c
push eax
mov eax, dword [edi]
push esi
add eax, 4
push 1
push eax
call fcn.00408b11
push 0x42e864
call fcn.00401350
mov eax, dword [esp + 0x2c]
add esp, 0x18
movsx eax, word [eax]
pop edi
pop esi
cmp eax, 2
jle 0x417efa
push 0x431a82
add eax, 0xfffffffe
push eax
push 0x42e868
call fcn.00401350
add esp, 0xc
push 0x20
push 0x42e86c
call fcn.00401350
push 0x5e
push 0x42e870
call fcn.00401350
add esp, 0x10
ret 0xc
Function at 0x417fc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0xc], 0x20
mov ax, word [edi]
mov word [ebx], ax
movzx eax, word [edi]
cmp ax, word [esi + 2]
jg 0x41801b
nop dword [eax]
cwde
mov cl, byte [eax + esi + 3]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x41801b
push ecx
lea eax, [esp + 0x10]
push eax
call sym.test_embusb.exe__string_append1_8
mov ax, word [edi]
inc ax
movzx ecx, ax
mov word [edi], ax
mov eax, ecx
cmp cx, word [esi + 2]
jle 0x417ff0
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push esi
push dword [esp + 0x44]
push eax
call sym.test_embusb.exe__string_t_int_12
push esi
call sym.test_embusb.exe__sys_error_4
test al, al
je 0x4180f5
cmp byte [esp + 0x34], 0
je 0x4180ef
push 1
call fcn.0040887c
push eax
push 0xd
push 1
push str.Bad_integer__
call fcn.00408b11
mov ax, word [esp + 0x22]
add esp, 0x14
cmp ax, 0x20
jle 0x418087
cwde
push 0x431a7e
sub eax, 0x20
push eax
push 0x42e854
call fcn.00401350
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x41809e
cmp ax, 0x20
jge 0x418097
movsx esi, ax
jmp 0x4180a0
mov esi, 0x20
jmp 0x4180a0
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.00408b11
push 1
call fcn.0040887c
push eax
push 2
push 1
push 0x42e858
call fcn.00408b11
push 0x42e85c
call fcn.00401350
add esp, 0x2c
push ebx
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.00417e60
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
mov ax, word [ebx]
mov word [edi], ax
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
Function at 0x418cd0
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x91c]
test eax, eax
jne 0x418d3b
test byte [esi], 2
je 0x418d0e
cmp byte [esi + 1], al
jne 0x418d0e
push dword [esi + 0x920]
call sub.KERNEL32.dll_SetEndOfFile
test al, al
jne 0x418d0e
push 0
push 0x431a88
push str.truncate
push 0x42e928
call sym.test_embusb.exe__sys_sys_error_bomb_16
cmp byte [esi + 1], 6
je 0x418d48
push dword [esi + 0x920]
call fcn.00405e0a
test al, al
jne 0x418d48
push 0
push 0x431a88
push str.close
push 0x42e928
call sym.test_embusb.exe__sys_sys_error_bomb_16
jmp 0x418d48
push esi
call eax
mov dword [esi + 0x91c], 0
add esi, 0x918
cmp dword [esi], 0
je 0x418d59
push esi
call sym.test_embusb.exe__sys_mem_dealloc_4
pop esi
ret 4

Function at 0x418d90
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x208c
call fcn.004054e0
push esi
push edi
mov eax, 0x2000
mov edi, 0x84
mov word [esp + 0x90], ax
lea eax, [esp + 8]
push str.Syntax_error_occurred_on_line
push eax
mov dword [esp + 0x10], edi
call sym.test_embusb.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__string_append1_8
mov esi, dword [esp + 0x2098]
mov eax, dword [esi]
push dword [eax + 0x970]
lea eax, [esp + 0x94]
push eax
call sym.test_embusb.exe__string_f_int_8
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__string_append_8
push 0x42ec28
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__string_append1_8
mov eax, dword [esi]
add eax, 0x568
push eax
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__string_append_8
mov ax, word [esp + 0xa]
cmp ax, di
jle 0x418e4d
cwde
push 0x431ae6
sub eax, edi
push eax
push 0x42ebd4
call fcn.00401350
mov ax, word [esp + 0x16]
add esp, 0xc
test ax, ax
jle 0x418e60
cmp ax, di
jge 0x418e5c
movsx esi, ax
jmp 0x418e62
mov esi, edi
jmp 0x418e62
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.00408b11
push 0x42ec78
call fcn.00401350
add esp, 0x18
call sym.test_embusb.exe__sys_bomb_0
pop edi
pop esi
add esp, 0x208c
ret 4
Function at 0x419be0
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x918]
cmp byte [eax], 0
jne 0x419bfb
add eax, 8
mov dword [esp + 4], eax
jmp sym.test_embusb.exe__file_close_4
ret 4

Function at 0x419c40
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call sym.test_embusb.exe__sys_error_none_4
mov edi, dword [esp + 0x10]
test edi, edi
je 0x419cd9
push ebx
push dword [0x431b8c]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push edi
push dword [esp + 0x24]
push dword [eax + 0x920]
call sub.KERNEL32.dll_ReadFile
mov ebx, dword [esp + 0x1c]
test al, al
jne 0x419c9b
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6d
je 0x419ca5
mov dword [esi + 0xc], eax
mov eax, ebx
pop ebx
pop edi
pop esi
mov dword [eax], 0
ret 0x14
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
test eax, eax
jne 0x419cbb
push esi
push 1
push 0xfffffffffffffffd
mov dword [ebx], 0
call sym.test_embusb.exe__sys_stat_set_12
pop ebx
pop edi
pop esi
ret 0x14
cmp eax, edi
jae 0x419cd8
push esi
push 0xa
push 0xfffffffffffffffd
call sym.test_embusb.exe__sys_stat_set_12
push esi
push edi
call sym.test_embusb.exe__sys_stat_parm_int_8
push esi
push dword [ebx]
call sym.test_embusb.exe__sys_stat_parm_int_8
pop ebx
pop edi
pop esi
ret 0x14
Function at 0x41c450
Capabilities:
Get disk information

Disassembly:
push ecx
cmp byte [0x431e68], 0
jne 0x41c52f
mov al, byte [0x431e69]
push ebx
mov ebx, 0x41
mov dword [0x431e6c], 0x30004
mov word [0x431e71], 0x5c3a
mov byte [0x431e73], al
mov byte [0x431e68], 1
mov byte [esp + 7], 0x20
mov byte [esp + 6], 0x20
mov byte [0x431e70], bl
nop dword [eax + eax]
push 0x431e70
call sub.KERNEL32.dll_GetDriveTypeA
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x41c4b2
jmp dword [eax*4 + 0x41c544]
mov al, byte [esp + 7]
mov dl, byte [esp + 6]
cmp al, 0x20
jne 0x41c4f2
mov al, byte [0x431e70]
mov byte [esp + 7], al
jmp 0x41c4f2
cmp byte [esp + 6], 0x20
movzx edx, byte [esp + 6]
movzx eax, byte [0x431e70]
cmove edx, eax
mov byte [esp + 6], dl
jmp 0x41c4ee
mov dl, byte [esp + 6]
mov al, byte [esp + 7]
inc ebx
mov byte [0x431e70], bl
cmp ebx, 0x5a
jle 0x41c4a0
cmp al, 0x20
je 0x41c51a
pop ebx
push dword [esp + 8]
mov byte [0x431e70], al
push 0x431e6c
call sym.test_embusb.exe__string_copy_8
pop ecx
ret 4
cmp dl, 0x20
movzx eax, dl
mov ecx, 0x43
cmovne ecx, eax
mov byte [0x431e70], cl
pop ebx
push dword [esp + 8]
push 0x431e6c
call sym.test_embusb.exe__string_copy_8
pop ecx
ret 4
Function at 0x41cb00
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x106c
call fcn.004054e0
cmp byte [0x431cc8], 0
jne 0x41cc29
lea eax, [esp + 4]
push eax
call sym.test_embusb.exe__sys_error_none_4
push 0x431ccc
mov word [esp + 4], 0x7f7f
push dword [esp + 4]
mov word [0x431cce], 0
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
call sym.test_embusb.exe__sys_error_4
test al, al
je 0x41cc22
push ebx
mov word [esp + 4], 1
mov ebx, 1
push 0x431ccc
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push eax
call sym.test_embusb.exe__sys_error_4
test al, al
jne 0x41cbaf
call sub.WS2_32.dll_WSACleanup
test eax, eax
je 0x41cbaf
call sub.WS2_32.dll_WSAGetLastError
push 0
push 0x431e74
push str.err_netclose
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x42f158
push eax
call sym.test_embusb.exe__sys_error_abort_20
mov al, byte [0x431cce]
test al, al
jne 0x41cbe7
inc ebx
mov byte [esp + 4], bl
cmp ebx, 0x7f
jle 0x41cb62
push 0
push 0x431e74
push str.err_netversion
push 0x42f158
call sym.test_embusb.exe__sys_message_bomb_16
pop ebx
mov byte [0x431cc8], 1
add esp, 0x106c
ret
mov byte [esp + 4], al
mov al, byte [0x431ccf]
push 0x431ccc
mov byte [esp + 9], al
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
push 0
push 0x431e74
push str.err_netstart
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x42f158
push eax
call sym.test_embusb.exe__sys_error_abort_20
pop ebx
mov byte [0x431cc8], 1
add esp, 0x106c
ret

Function at 0x41ccf0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
cmp byte [0x430f8c], 0
mov eax, 0x20
mov word [esp + 4], ax
jne 0x41cd0b
call sym.test_embusb.exe__sys_read_env_global_0
push esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x34]
call sym.test_embusb.exe__string_copy_8
lea eax, [esp + 8]
push eax
call sym.test_embusb.exe__string_upcase_4
mov eax, dword [0x43458c]
mov esi, 0x43458c
mov dword [esp + 4], eax
test eax, eax
je 0x41cd56
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__string_equal_8
test al, al
jne 0x41cdb7
mov esi, dword [esp + 4]
mov eax, dword [esi]
mov dword [esp + 4], eax
test eax, eax
jne 0x41cd36
lea eax, [esp + 4]
push eax
push 0x108
call sym.test_embusb.exe__sys_mem_alloc_8
mov eax, dword [esp + 4]
test eax, eax
jne 0x41cd99
push 1
call fcn.0040887c
push eax
push 0x3a
push 1
push str.Unable_to_allocate_more_virtual_memory.__The_disk_is_full.
call fcn.00408b11
push 0x42f484
call fcn.00401350
add esp, 0x18
call sym.test_embusb.exe__sys_bomb_0
mov eax, dword [esp + 4]
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__sys_read_env_lang_8
mov eax, dword [esp + 4]
mov dword [eax], 0
mov eax, dword [esp + 4]
mov dword [esi], eax
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x34]
add ecx, 4
pop esi
mov dword [eax], ecx
add esp, 0x28
ret 8
Function at 0x41cf00
Capabilities:
Get hostname

Disassembly:
mov eax, 0x146c
call fcn.004054e0
lea eax, [esp]
mov dword [esp], 0x400
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetComputerNameA
test al, al
jne 0x41cf5a
lea eax, [esp + 0x404]
push eax
call sym.test_embusb.exe__sys_error_none_4
call sub.KERNEL32.dll_GetLastError
push 0
push 0x431ee0
push str.node_name_get
mov dword [esp + 0x41c], eax
lea eax, [esp + 0x410]
push 0x42f530
push eax
call sym.test_embusb.exe__sys_error_abort_20
push dword [esp]
lea eax, [esp + 8]
push eax
push dword [esp + 0x1478]
call sym.test_embusb.exe__string_vstring_12
push dword [esp + 0x1470]
call sym.test_embusb.exe__string_downcase_4
add esp, 0x146c
ret 4
Function at 0x41d7a0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x480c
call fcn.004054e0
push esi
mov esi, dword [esp + 0x4818]
mov eax, 0x400
push edi
mov edi, dword [esp + 0x4818]
mov word [esp + 0xc], ax
mov eax, 0x2000
mov word [esp + 0x2810], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push edi
call sym.test_embusb.exe__string_token_16
push esi
call sym.test_embusb.exe__sys_error_4
test al, al
jne 0x41d8e9
lea eax, [esp + 0x2810]
push eax
lea eax, [esp + 0x10]
push eax
call sym.test_embusb.exe__string_treename_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.test_embusb.exe__string_token_make_8
push 0x400
lea eax, [esp + 0x414]
push eax
lea eax, [esp + 0x14]
push eax
call sym.test_embusb.exe__string_t_c_12
xor eax, eax
mov word [esp + 0x2812], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.test_embusb.exe__string_token_16
push esi
call sym.test_embusb.exe__string_eos_4
test al, al
jne 0x41d893
push esi
call sym.test_embusb.exe__sys_error_4
test al, al
jne 0x41d8e9
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.test_embusb.exe__string_append_token_8
push esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.test_embusb.exe__string_token_16
push esi
call sym.test_embusb.exe__string_eos_4
test al, al
je 0x41d858
push 0x2000
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x2818]
push eax
call sym.test_embusb.exe__string_t_c_12
push dword [0x42f790]
lea eax, [esp + 0x814]
push 0x431ef0
push eax
lea eax, [esp + 0x41c]
push eax
push 0x431ef0
push dword [0x431eec]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x41d8e9
push esi
add eax, 0x64
push eax
push 0xffffffffffffffff
call sym.test_embusb.exe__sys_stat_set_12
pop edi
pop esi
add esp, 0x480c
ret 8

Function at 0x41d930
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
call sym.test_embusb.exe__sys_error_none_4
push dword [0x42f68c]
push dword [esp + 0xc]
call sub.KERNEL32.dll_TerminateProcess
test al, al
jne 0x41d956
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 8