joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013cf
Capabilities:
Encode data using xor

Disassembly:
jmp 0x411f5d
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x412080
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebx, str.Soviet_aristo_baristo
mov ebp, 0x503778
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x28
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x16
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x73
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0x5e
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x20
push ebx
push ebp
call fcn.00403490
add esp, 0x44
push eax
call fcn.004013b6
xor byte [esi + edi], 0x46
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xb1
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xd0
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0x5b
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0xfc
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xbd
add esp, 0x40
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xf9
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x59
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x56
add esp, 0x24
inc esi
cmp esi, dword [esp + 0x18]
jb 0x411f7b
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x402946
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x412674
sub esp, 0x20
mov eax, dword [0x501358]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x78]
add edi, esi
mov ebx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
add ebx, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4126f3
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401e2e
push str.Hardline
push 0x503860
call fcn.00402d60
push eax
call fcn.00406082
lea eax, [esp + 0x20]
push 0x36c
push eax
call fcn.00402cc5
add esp, 0x14
cmp eax, dword [esp + 0x38]
je 0x41270d
lea ecx, [esp + 0x14]
add ebx, 4
call fcn.00402982
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x4126a5
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403030
add esp, 0x20
ret 8
mov eax, dword [edi + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402982
jmp 0x4126f5
Function at 0x401064
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
xor esi, esi
push ebx
push 0x80
push 4
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
inc esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4010a2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 3
jl 0x401072
jmp 0x4010e3
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4010dc
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x4228a8
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40203a
Capabilities:
Create raw socket
Create thread
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x42a43c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x4021a9
push 1
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x429004], eax
cmp eax, 0xffffffff
je 0x4021a9
push ebx
push ebx
push 0x401fb0
mov dword [0x42b564], ebx
call fcn.0040eb96
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4020a0
push str.can_create_thread_for_ping_Range
push 1
call fcn.004010eb
pop ecx
pop ecx
jmp 0x4021a9
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi]
push 2
mov dword [ebp - 0x10], eax
pop eax
mov word [ebp - 0x14], ax
xor eax, eax
push pe_nt_image_headers32
mov word [ebp - 0x12], ax
mov byte [ebp - 0x44], 8
mov byte [ebp - 0x43], al
mov word [ebp - 0x42], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x40], ax
xor eax, eax
mov cl, al
add cl, 0x20
mov byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0x20
jl 0x4020d8
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x48], ebx
cmp dword [ebp + 0xc], ebx
jbe 0x402184
mov edi, dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [sym.imp.WS2_32.dll_sendto]
push dword [ebp - 0x48]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x3e], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call edi
mov dword [ebp - 0x3b], eax
xor eax, eax
mov word [ebp - 0x42], ax
lea eax, [ebp - 0x44]
push 0x2d
push eax
call fcn.0040c334
pop ecx
pop ecx
push 0x10
mov word [ebp - 0x42], ax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2d
lea eax, [ebp - 0x44]
push eax
push dword [0x429004]
call ebx
push 5
call esi
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2d
lea eax, [ebp - 0x44]
push eax
push dword [0x429004]
call ebx
push dword [ebp - 0x10]
call fcn.00407344
pop ecx
push eax
call edi
push 0x14
mov dword [ebp - 0x10], eax
call esi
inc dword [ebp - 0x48]
movzx eax, word [ebp - 0x48]
cmp eax, dword [ebp + 0xc]
jb 0x402105
push 0x1388
call esi
push dword [0x429004]
mov dword [0x42b564], 1
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [0x429004], 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e208
leave
ret
Function at 0x403789
Capabilities:
Set environment variable

Disassembly:
push esi
push 0x1ff
push dword [esp + 0xc]
mov esi, 0x42b568
push esi
call fcn.0040f200
add esp, 0xc
mov ecx, esi
call fcn.0040371d
xor esi, esi
inc esi
cmp dword [0x42b7e8], esi
jle 0x403816
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [esi*4 + 0x42b768]
cmp byte [eax], 0x2d
jne 0x40380c
cmp dword [esi*4 + 0x42b76c], 0
je 0x40380c
mov al, byte [eax + 1]
cmp al, 0x69
je 0x4037fd
cmp al, 0x6c
je 0x4037ee
cmp al, 0x73
jne 0x40380c
push dword [esi*4 + 0x42b76c]
inc esi
push str.TFTP_DIR
jmp 0x40380a
push dword [esi*4 + 0x42b76c]
inc esi
push str.TFTP_LOG
jmp 0x40380a
push dword [esi*4 + 0x42b76c]
inc esi
push str.TFTP_INI
call edi
inc esi
cmp esi, dword [0x42b7e8]
jl 0x4037ba
pop edi
mov eax, esi
pop esi
ret

Function at 0x40388b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x14]
lea eax, [edi + 4]
push eax
call dword [sym.imp.WS2_32.dll_htons]
cmp dword [ebp + 0x10], 0
movzx eax, ax
mov dword [ebp + 0x14], eax
jne 0x4038aa
xor edi, edi
push esi
mov esi, dword [sym.imp.WS2_32.dll_send]
push 0
push 2
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 8]
call esi
push 0
push 4
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call esi
pop esi
test edi, edi
jle 0x4038e1
push 0
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040cbea
add esp, 0x10
pop edi
pop ebp
ret
Function at 0x40453f
Capabilities:
Hide graphical window

Disassembly:
push ebp
lea ebp, [esp - 0xa4]
sub esp, 0x124
mov eax, dword [0x42a43c]
xor eax, ebp
mov dword [ebp + 0xa0], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [ebp - 0x80], ebx
test esi, esi
jne 0x40457f
push 0x92
push str.._guigui_gauges.c
push str.pTftpGui_NULL
call fcn.0040f6b6
add esp, 0xc
cmp dword [esi + 0x18], 1
mov edi, 0x42349c
je 0x40458f
mov edi, 0x423494
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push edi
push dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x7c]
push str._s__s__s
push eax
call edi
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
call ebx
mov esi, dword [esi + 0x2c]
lea eax, [ebp - 0x7c]
test esi, esi
je 0x4045d6
push esi
push 0x423478
push eax
call edi
add esp, 0xc
jmp 0x404637
push 0x423464
push eax
call edi
pop ecx
pop ecx
push 0
push 0x4b0
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetDialogBaseUnits]
push 0x206
call esi
shr eax, 0x10
imul eax, eax, 0x23
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
call esi
movzx eax, ax
imul eax, eax, 0x82
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [ebp - 0x7c]
push eax
push 0x4b1
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call ebx
push 5
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0xa0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e208
add ebp, 0xa4
leave
ret
Function at 0x4057b2
Capabilities:
Query environment variable

Disassembly:
mov ax, word [0x44053c]
push esi
push edi
xor edi, edi
cmp ax, di
jne 0x4057c8
mov eax, 0x7ca
jmp 0x4057cb
movzx eax, ax
push eax
mov esi, 0x423914
push esi
push dword [esp + 0x14]
call fcn.0040cd4d
add esp, 0xc
mov dword [0x431c0c], eax
cmp eax, 0xffffffff
je 0x4058c3
push str.connected_to_console_n
call fcn.0040c69d
pop ecx
push esi
mov esi, 0x44041c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [0x423da0], 0xb
jne 0x40581b
push 0xc
push esi
push str.TFTP_PWD
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push 0xc
push 0xf3271
push dword [0x431c0c]
call fcn.0040d58a
add esp, 0x10
cmp eax, edi
jge 0x40585a
cmp eax, 0xfffffff0
mov eax, str.Bad_Password
je 0x405844
mov eax, str.Console_version_does_not_match_services
push 0x10
push 0x422f98
push eax
push edi
call fcn.0040bf58
add esp, 0x10
jmp 0x4058e4
push str.GUI_Version_check_OK_n
call fcn.0040c69d
xor esi, esi
inc esi
push esi
push dword [0x431c0c]
push edi
call fcn.004041bd
push dword [0x431c0c]
call fcn.00403ece
push esi
push dword [0x431c0c]
push edi
call fcn.004041bd
push dword [0x431c0c]
call fcn.00403eab
push esi
push dword [0x431c0c]
push edi
call fcn.004041bd
push dword [0x431c0c]
call fcn.00403f94
push esi
push dword [0x431c0c]
push edi
call fcn.004041bd
add esp, 0x40
mov eax, esi
jmp 0x4058e6
call fcn.0040c636
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x422f98
push str.Cant_connect_to_the_service_nError__d___s_
push edi
call fcn.0040bf58
add esp, 0x18
xor eax, eax
pop edi
pop esi
ret

Function at 0x4058e9
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x10]
call fcn.00403789
mov dword [esp], str._Tftpd32__by_Ph._Jounin_MutEx
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str._kill
push dword [ebp + 0x10]
mov edi, eax
call fcn.0040efc0
pop ecx
pop ecx
test eax, eax
jne 0x4059ad
cmp edi, esi
je 0x405934
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4059ad
push 0x43f880
push str.Tftpd32.chm
call fcn.004078d5
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], 1
mov dword [ebp - 8], 8
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push str.127.0.0.1
call fcn.004057b2
pop ecx
test eax, eax
je 0x4059b8
push dword [ebp + 8]
push esi
push 0x40517e
push 0x65
push esi
call fcn.0040cdd4
mov esi, dword [sym.imp.USER32.dll_UnregisterClassA]
add esp, 0x14
push dword [ebp + 8]
push str.TftpAddIpBackGround
call esi
push dword [ebp + 8]
push str.Ttftpd32ClientBackGround
call esi
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x4059ba
push dword [ebp + 0x10]
push edi
call fcn.0040571a
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4068c6
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x9c
mov eax, dword [0x42a43c]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
or dword [ebp - 0x14], 0xffffffff
push esi
push edi
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push str._d__d__d__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
xor edi, edi
push edi
push 0x20006
push edi
push edi
push edi
push str.SOFTWARETFTPD32
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
lea eax, [ebp - 0x10]
sbb esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push edi
push str.LastWindowPos
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
and esi, eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x40696e
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x70]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040e208
add ebp, 0x74
leave
ret
Function at 0x406981
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa8
mov eax, dword [0x42a43c]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
or dword [ebp - 0x18], 0xffffffff
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWARETFTPD32
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push str.LastWindowPos
push dword [ebp - 0x18]
mov dword [ebp - 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x18], 0xffffffff
je 0x4069f1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
mov byte [ebp + 0x6f], 0
mov esi, ecx
je 0x406ab0
push ebx
mov ebx, dword [ebp - 0x28]
push edi
mov edi, dword [ebp - 0x2c]
cmp byte [esi], 0x20
jne 0x406a54
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
sub eax, 0
mov byte [esi], 0
je 0x406a47
dec eax
je 0x406a3c
dec eax
je 0x406a32
dec eax
jne 0x406a51
push ecx
call fcn.0040f13b
mov ebx, eax
jmp 0x406a50
push ecx
call fcn.0040f13b
mov edi, eax
jmp 0x406a50
push ecx
call fcn.0040f13b
mov dword [ebp - 0x30], eax
jmp 0x406a50
push ecx
call fcn.0040f13b
mov dword [ebp - 0x34], eax
pop ecx
lea ecx, [esi + 1]
inc esi
cmp byte [esi], 0
jne 0x406a0c
cmp dword [ebp - 0x14], 4
jne 0x406aae
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
mov ecx, dword [ebp - 0x34]
add ecx, 0x96
cmp ecx, eax
jge 0x406aae
push 1
call esi
mov ecx, dword [ebp - 0x30]
lea edx, [ecx + 0x96]
cmp edx, eax
jge 0x406aae
mov eax, dword [ebp - 0x34]
cmp eax, edi
jge 0x406aae
cmp ecx, ebx
jge 0x406aae
test eax, eax
jl 0x406aae
test ecx, ecx
jl 0x406aae
push 1
sub ebx, ecx
push ebx
sub edi, eax
push edi
push ecx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop ebx
mov ecx, dword [ebp + 0x70]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop esi
call fcn.0040e208
add ebp, 0x74
leave
ret

Function at 0x406c07
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xec]
sub esp, 0x16c
mov eax, dword [0x42a43c]
xor eax, ebp
mov dword [ebp + 0xe8], eax
push esi
push edi
push str.explorer.exe
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1f]
push 0x104
push eax
call fcn.00404a21
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0040ed20
add esp, 0x14
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
mov dword [ebp - 0x80], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0xe8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0040e208
add ebp, 0xec
leave
ret
Function at 0x40725a
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0xf8]
sub esp, 0x178
mov eax, dword [0x42a43c]
xor eax, ebp
mov dword [ebp + 0xf4], eax
push ebx
push esi
push edi
mov ebx, 0xf4
push ebx
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0040ed20
add esp, 0xc
push 0x80
lea eax, [ebp + 0x74]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4072cf
lea eax, [ebp + 0x74]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4072cf
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4072cf
xor ecx, ecx
cmp dword [eax], 0
je 0x4072cc
mov edx, dword [eax]
mov edx, dword [edx]
mov dword [ebp + ecx*8 - 0x7c], edx
inc ecx
add eax, 4
cmp ecx, 0x1e
jl 0x4072b6
mov dword [ebp - 0x80], ecx
push 0x3d
mov eax, 0x4321e8
pop ecx
mov edi, eax
lea esi, [ebp - 0x80]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x4072fa
push 0x3d
pop ecx
push edx
push edx
push ebx
push eax
mov edi, eax
lea esi, [ebp - 0x80]
push 0x6d
rep movsd dword es:[edi], dword [esi]
call fcn.0040b6b0
add esp, 0x14
mov ecx, dword [ebp + 0xf4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0040e208
add ebp, 0xf8
leave
ret

Function at 0x4073d1
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x42a43c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
je 0x40744a
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x108], eax
test eax, eax
je 0x40744a
mov esi, dword [eax + 0xc]
test esi, esi
je 0x40744a
xor edi, edi
cmp dword [esi], edi
je 0x40743e
mov eax, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [eax]
call fcn.004073b3
add esp, 0xc
test eax, eax
jne 0x40743e
inc edi
lea eax, [esi + edi*4]
cmp dword [eax], 0
jne 0x407421
lea eax, [esi + edi*4]
cmp dword [eax], 0
je 0x407450
mov eax, dword [eax]
jmp 0x40746e
mov edi, dword [ebp - 0x108]
cmp dword [ebp + 0x10], 0
je 0x40745a
xor eax, eax
jmp 0x40746e
test edi, edi
jle 0x407469
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0xc]
jmp 0x407446
mov eax, 0x429ad8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040e208
leave
ret
Function at 0x4075d2
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x42a43c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push esi
push str._uninstall
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407608
call fcn.00407aea
jmp 0x40767e
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x407646
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x276c
mov eax, str.Error:_Tftpd32_now_requires_winsock_version_2
je 0x407632
mov eax, str.Error:_Cant_init_Winsocket
push 0x10
push 0x422f98
push eax
push 0
call fcn.0040bf58
add esp, 0x10
jmp 0x40767e
push 0
push 0
push 0x407837
call fcn.0040eb96
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x14]
push esi
push ebx
push edi
call fcn.004058e9
add esp, 0x10
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Thats_all_folks_n
call fcn.0040c69d
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040e208
leave
ret 0x10

Function at 0x4079ab
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x42a43c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x43f760
push dword [esi + 0x429fa8]
push dword [esi + 0x429fac]
push dword [esi + 0x429fa4]
push dword [esi + 0x429fa0]
push str.SOFTWARETFTPD32
call fcn.0040c032
add esi, 0x10
add esp, 0x18
cmp esi, 0x1f0
jb 0x4079c1
cmp dword [0x429c34], 0
jne 0x407a09
mov dword [0x429c34], 0xf
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
push str.TFTP_DIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x407a4d
lea eax, [ebp - 0x108]
push eax
call fcn.0040c8fc
pop ecx
test eax, eax
je 0x407a4d
push 0
push 0x429e90
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x407a7c
push edi
mov edi, 0x429ae0
push edi
call fcn.0040c8fc
pop ecx
test eax, eax
je 0x407a6f
push 0
push 0x429e90
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x407a7b
push 0x429e90
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0040e208
leave
ret