joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418ed0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47016b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x48e084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push 0x104
push 0
push eax
mov dword [ebp - 0x130], esi
call fcn.0044c770
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x12c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418f54
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.0040a6b0
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 0
push eax
push esi
call fcn.00417560
mov edx, dword [ebp - 0x118]
add esp, 8
cmp edx, 0x10
jb 0x418fbd
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x418fb3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418fdb
push edx
push ecx
call fcn.00434483
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004349bf
mov esp, ebp
pop ebp
ret 4
call fcn.0044f769
int3
Function at 0x419130
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470200
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x48e084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
call dword [eax + 0x1c]
mov ecx, 3
mov dword [ebp - 4], 0
cmp dword [ebp - 0x48], ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x30], 0
cmovb ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x44], 0x10
push ecx
cmovae eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.0040a6b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041d990
mov edx, dword [ebp - 0x2c]
add esp, 8
cmp edx, 0x10
jb 0x4191e5
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4191db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4192bd
push edx
push ecx
call fcn.00434483
add esp, 8
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x419217
xorps xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x60]
jmp 0x419224
mov edi, dword [ebp - 0x68]
mov esi, dword [ebp - 0x64]
shrd edi, esi, 0x14
shr esi, 0x14
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41925a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419250
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4192c2
push edx
push ecx
call fcn.00434483
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 0x10
jb 0x41929e
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x419294
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4192c7
push edx
push ecx
call fcn.00434483
add esp, 8
mov eax, edi
mov edx, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004349bf
mov esp, ebp
pop ebp
ret
call fcn.0044f769
call fcn.0044f769
call fcn.0044f769
int3
Function at 0x4192d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x24]
cmp eax, 0xe
ja case.default.0x4192ee
jmp dword [eax*4 + 0x4193a0]
push 5
push str.INTEL
jmp 0x41937a
push 4
push str.MIPS
jmp 0x41937a
push 5
push str.ALPHA
jmp 0x41937a
push 3
push 0x475308
jmp 0x41937a
push 3
push 0x47530c
jmp 0x41937a
push 3
push 0x475310
jmp 0x41937a
push 4
push str.IA64
jmp 0x41937a
push 7
push str.ALPHA64
jmp 0x41937a
push 4
push str.MSIL
jmp 0x41937a
push 5
push str.AMD64
jmp 0x41937a
push 4
push str.IA32
jmp 0x41937a
push 7
push str.NEUTRAL
jmp 0x41937a
push 5
push str.ARM64
jmp 0x41937a
push 5
push str.ARM32
jmp 0x41937a
push 7
push str.UNKNOWN
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.0040a6b0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4193e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x24]
cmp eax, 6
je 0x419419
cmp eax, 9
je 0x419419
mov eax, dword [ebp - 0xc]
cmp eax, 0x898
je 0x419419
cmp eax, 0x21d8
je 0x419419
push 2
push 0x4752ec
jmp 0x419420
push 2
push 0x4752e8
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.0040a6b0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x419470
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4194c7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.MHz
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x4194cf
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
xor edx, edx
mov esp, ebp
pop ebp
ret
Function at 0x41a540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47016b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x48e084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push 0x104
push 0
push eax
mov dword [ebp - 0x130], esi
call fcn.0044c770
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x12c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a5c4
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.0040a6b0
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 0
push eax
push esi
call fcn.00417560
mov edx, dword [ebp - 0x118]
add esp, 8
cmp edx, 0x10
jb 0x41a62d
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41a623
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a64b
push edx
push ecx
call fcn.00434483
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004349bf
mov esp, ebp
pop ebp
ret 4
call fcn.0044f769
int3
Function at 0x41b3b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4703e6
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x48e084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x90]
push 0x80
push 0
push eax
mov dword [ebp - 0xe0], esi
call fcn.0044c770
add esp, 0xc
mov dword [ebp - 0xe0], 0x80
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
mov byte [ebp - 0xa8], 0
push 7
push str.Windows
call fcn.0040a6b0
lea eax, [ebp - 0xdc]
mov dword [ebp - 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41b483
movups xmm0, xmmword [ebp - 0xa8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x98]
movq qword [esi + 0x10], xmm0
jmp 0x41b60e
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x90]
push eax
push 0
push 0
push str.ProductName
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xdc]
test eax, eax
je 0x41b4db
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [ebp - 0xa8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x98]
jmp 0x41b5e3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b507
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xc0]
call fcn.0040a7a0
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.0041df20
mov edi, eax
add esp, 8
lea eax, [ebp - 0xa8]
cmp eax, edi
je 0x41b58f
mov ecx, eax
call fcn.00404b50
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0xf8], xmm0
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [edi + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
movq qword [ebp - 0xe8], xmm0
movq qword [ebp - 0x98], xmm0
mov byte [edi], 0
jmp 0x41b5ad
movq xmm0, qword [ebp - 0x98]
movq qword [ebp - 0xe8], xmm0
movups xmm0, xmmword [ebp - 0xa8]
movups xmmword [ebp - 0xf8], xmm0
lea ecx, [ebp - 0xd8]
call fcn.00404b50
lea ecx, [ebp - 0xc0]
call fcn.00404ba0
movups xmm0, xmmword [ebp - 0xf8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0xe8]
lea ecx, [ebp - 0xa8]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
mov byte [ebp - 0xa8], 0
call fcn.00404b50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004349bf
mov esp, ebp
pop ebp
ret 4
Function at 0x41cab0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4705b1
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x48e084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x5c], 1
call dword [eax + 0x1c]
mov ecx, 3
mov dword [ebp - 4], 1
cmp dword [ebp - 0x48], ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x18], 0
cmovb ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x44], 0x10
push ecx
cmovae eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x28]
push eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.0040a6b0
mov dword [ebp - 0x5c], 3
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0041d990
add esp, 8
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
cmp edx, 0x10
jb 0x41cb9b
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41cb91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ccb1
push edx
push ecx
call fcn.00434483
add esp, 8
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], 0
cmovae eax, dword [ebp - 0x40]
push eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je case.default.0x41cbcc
add eax, 0xfffffffe
cmp eax, 4
ja case.default.0x41cbcc
jmp dword [eax*4 + 0x41ccc0]
push 8
push str.harddisk
jmp 0x41cbfe
push 9
push str.removable
jmp 0x41cbfe
push 5
push str.cdrom
jmp 0x41cbfe
push 7
push str.ramdisk
jmp 0x41cbfe
push 0xa
push str.remotedisk
mov ecx, esi
call fcn.0040a160
cmp dword [esi + 0x10], 0
jne 0x41cc19
push 7
push str.unknown
mov ecx, esi
call fcn.0040a160
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x41cc4f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41cc45
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ccb6
push edx
push ecx
call fcn.00434483
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 0x10
jb 0x41cc93
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41cc89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ccbb
push edx
push ecx
call fcn.00434483
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004349bf
mov esp, ebp
pop ebp
ret 4
call fcn.0044f769
call fcn.0044f769
call fcn.0044f769
fmul st(3), st(0)
inc ecx
add bl, dl
retf
Function at 0x41d090
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470200
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x48e084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
call dword [eax + 0x1c]
mov ecx, 3
mov dword [ebp - 4], 0
cmp dword [ebp - 0x48], ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x30], 0
cmovb ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x44], 0x10
push ecx
cmovae eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.0040a6b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041d990
mov edx, dword [ebp - 0x2c]
add esp, 8
cmp edx, 0x10
jb 0x41d145
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41d13b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d21d
push edx
push ecx
call fcn.00434483
add esp, 8
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x78]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x41d177
xorps xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x60]
jmp 0x41d184
mov edi, dword [ebp - 0x68]
mov esi, dword [ebp - 0x64]
shrd edi, esi, 0x14
shr esi, 0x14
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41d1ba
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d1b0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d222
push edx
push ecx
call fcn.00434483
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 0x10
jb 0x41d1fe
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41d1f4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d227
push edx
push ecx
call fcn.00434483
add esp, 8
mov eax, edi
mov edx, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004349bf
mov esp, ebp
pop ebp
ret
call fcn.0044f769
call fcn.0044f769
call fcn.0044f769
int3
Function at 0x41d2c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470646
mov eax, dword fs:[0]
push eax
sub esp, 0x9c4
mov eax, dword [0x48e084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 3
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x41d326
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x41d32d
call dword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
jmp 0x41d4c3
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.0044c770
add esp, 0xc
lea eax, [ebp - 0x9d0]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x41d3e9
push eax
lea eax, [ebp - 0x810]
push 0x474fe8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x818], 0
xor eax, eax
mov dword [ebp - 0x814], 7
lea ecx, [ebp - 0x810]
mov word [ebp - 0x828], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d3a0
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x828]
call fcn.0040a7a0
mov eax, dword [esi]
lea ecx, [ebp - 0x828]
push ecx
mov ecx, esi
mov dword [ebp - 4], 0
call dword [eax + 0x24]
lea ecx, [ebp - 0x828]
call fcn.00404ba0
xor al, al
jmp 0x41d4c3
mov eax, dword [ebp - 0x9d0]
cmp al, 2
jne 0x41d3fe
shr eax, 8
cmp al, 2
je 0x41d4a2
push str.Could_not_find_a_usable_version_of_Winsock.dll_n
call fcn.00411450
mov ecx, dword [ebp - 0x9d0]
xor eax, eax
cmp cl, 2
setne al
push eax
movzx eax, cx
shr eax, 8
push eax
lea eax, [ebp - 0x810]
push str._WinSock_DLL
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov dword [ebp - 0x830], 0
xor eax, eax
mov dword [ebp - 0x82c], 7
lea ecx, [ebp - 0x810]
mov word [ebp - 0x840], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d460
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x840]
call fcn.0040a7a0
mov eax, dword [esi]
lea ecx, [ebp - 0x840]
push ecx
mov ecx, esi
mov dword [ebp - 4], 1
call dword [eax + 0x24]
lea ecx, [ebp - 0x840]
call fcn.00404ba0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x8000
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004349bf
mov esp, ebp
pop ebp
ret
Function at 0x41da50
Capabilities:
Create directory
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x48e084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
push 0
push eax
mov dword [ebp - 0x418], 0
call fcn.0044c770
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push str.iotsdk
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x20c]
push 0
push eax
call esi
push str.exception
lea eax, [ebp - 0x20c]
push eax
call edi
push 0
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0044c770
lea eax, [ebp - 0x414]
push str._sdk_exception
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
push 0
push 0x80
push 2
push 0
push 2
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x41db88
cmp esi, 0xffffffff
je 0x41db88
cmp dword [ebx + 0x14], 8
mov ecx, ebx
jb 0x41db4a
mov ecx, dword [ebx]
mov ebx, ecx
push 0
lea eax, [ebp - 0x418]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004349bf
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004349bf
mov esp, ebp
pop ebp
ret 4
Function at 0x41e0a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.0044c770
mov eax, dword [ebp + 8]
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x10], xmm0
cmp dword [eax + 0x14], 0x10
jb 0x41e0c8
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41e104
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
or edx, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x41e110
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x41e11e
mov eax, dword [eax]
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
cmp eax, 0xb7
jne 0x41e145
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
pop ebp
ret

Function at 0x41e150
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x41e15e
mov eax, dword [eax]
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41e188
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x65
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
ret

Function at 0x4376d2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x465ca2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00465962

Function at 0x46b49c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046b31b
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
test ecx, ecx
je 0x40105d
cmp byte [ecx], 0
je 0x40105d
push esi
test ebx, ebx
je 0x401057
mov esi, dword [ebp + 8]
test esi, esi
jle 0x401057
push edi
push 0x41a4c8
push ecx
call fcn.004034b8
mov edi, eax
add esp, 8
test edi, edi
jne 0x401035
pop edi
pop esi
pop ebx
pop ebp
ret
push edi
push esi
push 1
push ebx
call fcn.00403707
push edi
mov esi, eax
call fcn.004038ed
push edi
call fcn.004039bc
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
pop esi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x401070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
test ecx, ecx
je 0x4010c7
cmp byte [ecx], 0
je 0x4010c7
push esi
test ebx, ebx
je 0x4010c1
mov esi, dword [ebp + 8]
test esi, esi
jle 0x4010c1
push edi
push 0x41a4cc
push ecx
call fcn.004034b8
mov edi, eax
add esp, 8
test edi, edi
jne 0x4010a5
pop edi
pop esi
pop ebx
pop ebp
ret
push edi
push esi
push 1
push ebx
call fcn.00403c08
push edi
mov esi, eax
call fcn.004039bc
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
pop esi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x408d58
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00408bd7

Function at 0x40c859
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040c519