joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 1
push 0
push 0
push dword [ebp + 8]
push 0x4068e7
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop edi
leave
ret

Function at 0x406ab8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 1
push 0
push 0
push dword [ebp + 8]
push 0x4069e5
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop edi
leave
ret
Function at 0x408090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, 6
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40809b
push edi
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 4]
push edi
push 0xb0
push dword [ebp + 8]
call sub.USER32.DLL_SendMessageA
mov edi, dword [ebp - 4]
cmp dword [ebp - 8], edi
je 0x408178
lea edi, [ebp - 0xc]
push edi
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00407897
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp eax, 0
je 0x408178
push dword [ebp - 0xc]
push 0x429018
call fcn.00407e6f
add esp, 8
mov dword [ebp - 0x14], eax
cmp eax, 0
je 0x408170
cmp dword [ebp - 0x14], 5
jae 0x40811d
movzx edi, word [ebp - 0x14]
push edi
lea edi, [ebp - 0xc]
push edi
lea edi, [ebp - 0x10]
push edi
call fcn.004079b0
add esp, 0xc
jmp 0x408138
cmp dword [ebp - 0x14], 5
jbe 0x408138
movzx edi, word [ebp - 0x14]
push edi
lea edi, [ebp - 0xc]
push edi
lea edi, [ebp - 0x10]
push edi
call fcn.00407bb8
add esp, 0xc
push 0x435fde
push 0x429018
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0x18], eax
cmp eax, 0
je 0x408170
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
push dword [ebp - 0x18]
call sub.CRTDLL.DLL_fclose
add esp, 4
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GlobalFree
pop edi
leave
ret
Function at 0x40822d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov ecx, 0x82
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40823b
push esi
push edi
mov dword [ebp - 0x104], 2
mov dword [0x424c84], 0
call fcn.00402028
cmp eax, 0
je 0x4083c8
push str.The_hardcopy_is_put_into_Clipboard
push 0
call fcn.00406df0
add esp, 8
push 0x433c18
lea edi, [ebp - 0x204]
push edi
call fcn.0041aecd
add esp, 8
push 0x2e
lea edi, [ebp - 0x204]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x208], eax
cmp eax, 0
je 0x4082b1
mov edi, dword [ebp - 0x208]
mov byte [edi], 0
lea edi, [ebp - 0x204]
push edi
push str._s.bmp
lea edi, [ebp - 0x100]
push edi
call fcn.0041ae51
add esp, 0xc
jmp 0x4082fb
mov edi, dword [ebp - 0x104]
mov esi, edi
add esi, 1
mov dword [ebp - 0x104], esi
push edi
lea edi, [ebp - 0x204]
push edi
push str._s__d_.bmp
lea edi, [ebp - 0x100]
push edi
call fcn.0041ae51
add esp, 0x10
lea edi, [ebp - 0x100]
push edi
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4082ce
lea edi, [ebp - 0x100]
push edi
call fcn.0040817b
add esp, 4
cmp eax, 0
je 0x4083c8
lea edi, [ebp - 0x100]
push edi
push 0x42053c
call fcn.0040475f
add esp, 8
push 0x2e
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x208], eax
cmp eax, 0
je 0x40835d
mov edi, dword [ebp - 0x208]
mov byte [edi], 0
lea edi, [ebp - 0x100]
push edi
call fcn.0041af44
add esp, 4
mov edi, eax
sub edi, 1
cmp byte [ebp + edi - 0x100], 0x29
jne 0x4083a0
push 0x28
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x208], eax
cmp eax, 0
je 0x4083a0
mov edi, dword [ebp - 0x208]
mov byte [edi], 0
push str..bmp
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
lea edi, [ebp - 0x100]
push edi
push 0x433c18
call fcn.0041aecd
add esp, 8
cmp dword [0x42053c], 0
je 0x4083e6
push dword [0x42053c]
call sub.KERNEL32.dll_GlobalFree
mov dword [0x42053c], 0
mov dword [0x424c84], 1
pop edi
pop esi
leave
ret
Function at 0x408a50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov ecx, 0x45
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x408a5e
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x10c], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x108], 0
je 0x408a9f
mov edi, dword [ebp + 8]
push dword [edi + 0x108]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x108], 0
mov edi, dword [ebp + 8]
cmp byte [edi], 0
je 0x408c8d
push 0x433d18
push dword [ebp + 8]
lea edi, [ebp - 0x104]
push edi
call fcn.00411bb6
add esp, 0xc
push 0x435eb0
lea edi, [ebp - 0x104]
push edi
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
je 0x408c7b
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 0x108], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
cmp dword [ebp - 0x108], 0
je 0x408c70
mov edi, dword [ebp - 0x108]
add edi, 1
push edi
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov esi, dword [ebp + 8]
mov dword [esi + 0x108], eax
cmp eax, 0
je 0x408c70
push dword [ebp - 4]
push dword [ebp - 0x108]
push 1
mov edi, dword [ebp + 8]
push dword [edi + 0x108]
call sub.CRTDLL.DLL_fread
add esp, 0x10
cmp eax, dword [ebp - 0x108]
je 0x408b81
mov edi, dword [ebp + 8]
push dword [edi + 0x108]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x108], 0
jmp 0x408c70
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x108]
mov dword [ebp - 0x10c], edi
mov edi, dword [ebp - 0x108]
mov esi, dword [ebp - 0x10c]
mov byte [esi + edi], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x10c], 0
mov edi, dword [ebp + 8]
add edi, 0x100
push edi
lea edi, [ebp - 0x104]
push edi
call fcn.004089e7
add esp, 8
jmp 0x408c61
mov edi, dword [ebp - 0x10c]
mov dword [ebp - 0x110], edi
jmp 0x408be0
add dword [ebp - 0x10c], 1
mov edi, dword [ebp - 0x10c]
movsx ebx, byte [edi]
cmp ebx, 0
je 0x408bf3
cmp ebx, 0xa
jne 0x408bd9
mov edi, dword [ebp - 0x10c]
cmp byte [edi], 0xa
jne 0x408c12
mov edi, dword [ebp - 0x10c]
mov esi, edi
add esi, 1
mov dword [ebp - 0x10c], esi
mov byte [edi], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10c], 0x1f3
jge 0x408c61
mov edi, dword [ebp + 8]
mov eax, 0xc
mul dword [edi + 0x10c]
mov dword [ebp - 0x114], eax
mov esi, dword [ebp - 0x114]
lea edi, [esi + edi + 0x110]
push edi
push dword [ebp - 0x110]
call fcn.0040873d
add esp, 8
cmp eax, 0
je 0x408c61
mov edi, dword [ebp + 8]
add edi, 0x10c
inc dword [edi]
mov edi, dword [ebp - 0x10c]
cmp byte [edi], 0
jne 0x408bcb
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10c], 0
jne 0x408c8d
mov edi, dword [ebp + 8]
mov byte [edi], 0
push 0
mov edi, dword [ebp + 8]
push dword [edi + 0x10c]
push 0x445
push dword [0x420f28]
call sub.USER32.DLL_SetDlgItemInt
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d35a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov ecx, 0x85
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40d368
push edi
lea edi, [ebp - 0x10c]
push edi
push 1
push 0
push dword [ebp + 8]
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp eax, 0
jne 0x40d44d
mov dword [ebp - 8], 0x100
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 0x20c]
push edi
lea edi, [ebp - 0x210]
push edi
push 0
push str.Count
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x40d442
mov edi, dword [ebp - 0x20c]
mov dword [ebp - 0x214], edi
mov dword [ebp - 4], 0
jmp 0x40d437
push dword [ebp - 4]
push 0x43681b
lea edi, [ebp - 0x108]
push edi
call fcn.0041ae51
add esp, 0xc
mov dword [ebp - 8], 0x100
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 0x20c]
push edi
lea edi, [ebp - 0x210]
push edi
push 0
lea edi, [ebp - 0x108]
push edi
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x40d434
push dword [ebp + 0xc]
lea edi, [ebp - 0x20c]
push edi
call fcn.0040d075
add esp, 8
inc dword [ebp - 4]
mov edi, dword [ebp - 0x214]
cmp dword [ebp - 4], edi
jb 0x40d3d9
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
leave
ret
Function at 0x40da02
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov ecx, 0x40
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40da10
push ebx
push edi
cmp dword [ebp + 0xc], 0
jne 0x40da2b
lea edi, [ebp - 0x100]
mov dword [ebp + 0xc], edi
push 0x433d18
push dword [ebp + 0xc]
call fcn.0041aecd
add esp, 8
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str..exe
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp + 0xc]
call sub.KERNEL32.dll_GetFileAttributesA
mov edi, eax
cmp edi, 0xffffffff
je 0x40da6f
mov ebx, 1
jmp 0x40da74
mov ebx, 0
mov eax, ebx
pop edi
pop ebx
leave
ret

Function at 0x40df4d
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 5
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40df58
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40dfac
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40dfac
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0xffffffff
je 0x40e08f
cmp dword [ebp - 4], 0
je 0x40e08f
push dword [ebp - 4]
push dword [0x420238]
push str.send__s_with__ld_bytes_r_n
push dword [0x420228]
call fcn.0040f754
add esp, 0x10
cmp dword [0x4254ac], 0
jl 0x40e031
push 0
mov edi, dword [0x4254ac]
shl edi, 7
lea edi, [edi + 0x429128]
push edi
call sub.USER32.DLL_FindWindowA
mov dword [0x420f18], eax
cmp eax, 0
je 0x40e08f
push dword [ebp + 8]
push dword [0x420f18]
call fcn.0041167a
add esp, 8
mov edi, dword [0x42022c]
mov dword [0x420230], edi
mov dword [ebp - 8], 1
jmp 0x40e08f
push dword [ebp - 4]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp eax, 0
jne 0x40e04d
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
jmp 0x40e08f
push 0
lea edi, [ebp - 0x14]
push edi
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call sub.KERNEL32.dll_ReadFile
cmp eax, 0
je 0x40e07f
mov edi, dword [ebp - 4]
cmp dword [ebp - 0x14], edi
jne 0x40e07f
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.0040dd5d
add esp, 8
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GlobalFree
cmp dword [ebp - 8], 0
jne 0x40e09f
mov dword [0x420230], 0xffffffff
mov eax, dword [ebp - 8]
pop edi
leave
ret
Function at 0x40f328
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40f333
push edi
push 0x436679
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
je 0x40f3cf
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
push dword [ebp - 0xc]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp eax, 0
je 0x40f3b8
push dword [ebp - 4]
push dword [ebp - 0xc]
push 1
push dword [ebp - 8]
call sub.CRTDLL.DLL_fread
add esp, 0x10
push dword [ebp - 8]
call fcn.0040f12c
add esp, 4
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalFree
jmp 0x40f3c2
mov dword [0x420230], 0xffffffff
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
jmp 0x40f3d9
mov dword [0x420230], 0xffffffff
pop edi
leave
ret
Function at 0x411300
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
mov ecx, 2
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x41130a
push edi
mov dword [ebp - 4], 3
jmp 0x411325
push 0x32
call sub.KERNEL32.dll_Sleep
push 0
call sub.USER32.DLL_OpenClipboard
mov dword [ebp - 8], eax
cmp eax, 0
jne 0x411342
mov edi, dword [ebp - 4]
sub edi, 1
mov dword [ebp - 4], edi
cmp edi, 0
jg 0x41131e
mov eax, dword [ebp - 8]
pop edi
leave
ret

Function at 0x411348
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x411353
push edi
mov dword [ebp - 4], 0
call fcn.00411300
cmp eax, 0
je 0x4113ce
push dword [ebp + 8]
call fcn.0041af44
add esp, 4
mov edi, eax
add edi, 1
push edi
push 0x2000
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp eax, 0
je 0x4113c9
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0041aecd
add esp, 8
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.DLL_EmptyClipboard
push dword [ebp - 8]
push 1
call sub.USER32.DLL_SetClipboardData
mov dword [ebp - 4], 1
call sub.USER32.DLL_CloseClipboard
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x4113d4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4113df
push edi
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_RtlZeroMemory
call fcn.00411300
cmp eax, 0
je 0x411446
push 1
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411441
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalUnlock
mov dword [ebp - 4], 1
call sub.USER32.DLL_CloseClipboard
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x4119a8
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov ecx, 0x84
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4119b6
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp + 0xc], di
call sub.KERNEL32.dll_GetCommandLineA
mov dword [ebp - 4], eax
mov edi, dword [ebp - 4]
cmp byte [edi], 0x22
jne 0x4119ef
mov edi, dword [ebp - 4]
mov esi, edi
add esi, 1
mov dword [ebp - 4], esi
mov bl, byte [edi]
mov byte [ebp - 0x209], bl
jmp 0x4119f6
mov byte [ebp - 0x209], 0x20
mov dword [ebp - 8], 0
dec word [ebp + 0xc]
jmp 0x411a22
mov edi, dword [ebp - 8]
mov esi, edi
add esi, 1
mov dword [ebp - 8], esi
mov esi, dword [ebp - 4]
mov ebx, esi
add ebx, 1
mov dword [ebp - 4], ebx
mov bl, byte [esi]
mov byte [ebp + edi - 0x208], bl
mov edi, dword [ebp - 4]
movsx ebx, byte [edi]
cmp ebx, 0
je 0x411a41
movsx edx, byte [ebp - 0x209]
cmp ebx, edx
je 0x411a41
movzx edi, word [ebp + 0xc]
cmp dword [ebp - 8], edi
jl 0x411a03
mov edi, dword [ebp - 8]
mov byte [ebp + edi - 0x208], 0
push 0x3a
lea edi, [ebp - 0x208]
push edi
call sub.CRTDLL.DLL_strchr
add esp, 8
cmp eax, 0
jne 0x411a74
cmp byte [ebp - 0x208], 0x5c
jne 0x411a8b
cmp byte [ebp - 0x207], 0x5c
jne 0x411a8b
lea edi, [ebp - 0x208]
push edi
push dword [ebp + 8]
call fcn.0041aecd
add esp, 8
jmp 0x411b94
push dword [ebp + 8]
push 0x100
call sub.KERNEL32.dll_GetCurrentDirectoryA
cmp byte [ebp - 0x208], 0x5c
jne 0x411ad4
push 0x5c
push dword [ebp + 8]
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x411abd
mov edi, dword [ebp - 4]
mov byte [edi], 0
lea edi, [ebp - 0x208]
push edi
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
jmp 0x411b94
cmp byte [ebp - 0x208], 0x2e
jne 0x411b57
cmp byte [ebp - 0x207], 0x2e
jne 0x411b57
cmp byte [ebp - 0x206], 0x5c
jne 0x411b57
lea edi, [ebp - 0x208]
mov dword [ebp - 4], edi
jmp 0x411b23
push 0x5c
push dword [ebp + 8]
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x411b1f
mov edi, dword [ebp - 0x210]
mov byte [edi], 0
add dword [ebp - 4], 3
mov edi, dword [ebp - 4]
cmp byte [edi], 0x2e
jne 0x411b37
cmp byte [edi + 1], 0x2e
jne 0x411b37
cmp byte [edi + 2], 0x5c
je 0x411afa
push 0x45f7c8
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp - 4]
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
jmp 0x411b94
lea edi, [ebp - 0x208]
mov dword [ebp - 4], edi
cmp byte [ebp - 0x208], 0x2e
jne 0x411b76
cmp byte [ebp - 0x207], 0x5c
jne 0x411b76
add dword [ebp - 4], 2
push 0x45f7c8
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp - 4]
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x5c
push dword [ebp + 8]
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x411bb1
mov edi, dword [ebp - 4]
mov byte [edi + 1], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4121c5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov ecx, 0xd8
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4121d3
push edi
push 0x44
push 0
lea edi, [ebp - 0x44]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 0xa
mov word [ebp - 0x14], 4
push 0x10
push 0
lea edi, [ebp - 0x258]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
push dword [ebp + 8]
lea edi, [ebp - 0x358]
push edi
call fcn.0041aecd
add esp, 8
push 0x5c
lea edi, [ebp - 0x358]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
je 0x412250
mov edi, dword [ebp - 0x360]
mov byte [edi], 0
push dword [ebp + 8]
lea edi, [ebp - 0x248]
push edi
call sub.KERNEL32.dll_lstrcpyA
lea edi, [ebp - 0x248]
push edi
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0x48], eax
mov edi, dword [ebp - 0x48]
mov byte [ebp + edi - 0x248], 0x20
inc dword [ebp - 0x48]
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x48]
lea edi, [ebp + edi - 0x248]
push edi
call sub.KERNEL32.dll_lstrcpyA
lea edi, [ebp - 0x258]
push edi
lea edi, [ebp - 0x44]
push edi
lea edi, [ebp - 0x358]
push edi
push 0
push 0x20
push 0
push 0
push 0
lea edi, [ebp - 0x248]
push edi
push 0
call sub.KERNEL32.dll_CreateProcessA
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
je 0x412300
mov edi, dword [ebp - 0x258]
cmp edi, 0
je 0x4122e3
cmp edi, 0xffffffff
je 0x4122e3
push dword [ebp - 0x258]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x254], 0
je 0x412300
cmp dword [ebp - 0x254], 0xffffffff
je 0x412300
push dword [ebp - 0x254]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x35c]
pop edi
leave
ret

Function at 0x412393
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push esi
push edi
mov edi, dword [ebp + 8]
push 6
push 1
push 2
call sub.WS2_32.DLL_socket
mov dword [edi + 8], eax
and dword [edi + 0x14], 0
and dword [edi + 0x18], 0
cmp dword [edi + 8], 0xffffffff
jne 0x41240a
call sub.WS2_32.DLL_WSAGetLastError
mov dword [edi + 0x14], eax
cmp dword [edi + 0x14], 0x276d
jne 0x412405
lea eax, [ebp - 0x1a0]
push eax
push 0x102
call sub.WS2_32.DLL_WSAStartup
or eax, eax
je 0x4123ed
call sub.KERNEL32.dll_GetLastError
mov dword [edi + 0x14], eax
jmp 0x412455
or byte [edi + 0x18], 1
and dword [edi + 0x14], 0
push 6
push 1
push 2
call sub.WS2_32.DLL_socket
mov dword [edi + 8], eax
jmp 0x41240a
mov eax, dword [edi + 0x14]
jmp 0x412455
mov word [ebp - 0x10], 2
push dword [edi]
call sub.WS2_32.DLL_inet_addr
mov dword [ebp - 0xc], eax
movzx eax, word [edi + 4]
push eax
call sub.WS2_32.DLL_htons
mov esi, eax
mov word [ebp - 0xe], si
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [edi + 8]
call sub.WS2_32.DLL_connect
cmp eax, 0xffffffff
jne 0x412445
call sub.KERNEL32.dll_GetLastError
mov dword [edi + 0x14], eax
cmp dword [edi + 0x14], 0
je 0x412452
push edi
call fcn.00412368
pop ecx
mov eax, dword [edi + 0x14]
pop edi
pop esi
leave
ret
Function at 0x412459
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
or ebx, ebx
jle 0x41246f
cmp dword [ebp + 0x10], 0
jne 0x412476
mov dword [esi + 0x14], 0x2726
cmp dword [esi + 8], 0xffffffff
jne 0x412483
mov dword [esi + 0x14], 0x2749
cmp dword [esi + 0x14], 0
jne 0x4124c7
and dword [esi + 0x10], 0
push 0
push ebx
push dword [ebp + 0x10]
push dword [esi + 8]
call sub.WS2_32.DLL_send
mov edi, eax
cmp edi, 0xffffffff
je 0x4124af
add dword [esi + 0x10], edi
mov eax, edi
add eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
jmp 0x4124b9
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0x14], eax
jmp 0x4124c7
or edi, edi
je 0x4124c7
cmp edi, 0xffffffff
je 0x4124c7
cmp dword [esi + 0x10], ebx
jl 0x41248d
mov eax, dword [esi + 0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4124cf
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
jle 0x4124e2
cmp dword [ebp + 0x10], 0
jne 0x4124e9
mov dword [edi + 0x14], 0x2726
cmp dword [edi + 8], 0xffffffff
jne 0x4124f6
mov dword [edi + 0x14], 0x2749
cmp dword [edi + 0x14], 0
jne 0x412511
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [edi + 8]
call sub.WS2_32.DLL_recv
mov dword [edi + 0xc], eax
jmp 0x412515
and dword [edi + 0xc], 0
mov eax, dword [edi + 0xc]
cmp eax, 0x2746
je 0x412524
cmp eax, 0xffffffff
jne 0x412530
call sub.KERNEL32.dll_GetLastError
mov dword [edi + 0x14], eax
and dword [edi + 0xc], 0
mov eax, dword [edi + 0x14]
pop edi
pop ebp
ret

Function at 0x417570
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x4175a4
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x4175bf
mov edi, eax
inc edi
jmp 0x41759c
inc edi
cmp byte [edi], 0x20
je 0x41759b
jmp 0x4175bf
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x4175b0
cmp eax, 0x20
jne 0x4175a3
jmp 0x4175b3
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x4175bf
cmp eax, 0x20
je 0x4175b2
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.0041115f
pop edi
leave
ret