joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x58
push esi
mov esi, dword [esp + 0x68]
mov eax, 0x50
push edi
mov word [esp + 0xc], ax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x68]
mov byte [esi], 0
call sym.test_usbprog.exe__string_copy_8
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__string_terminate_null_4
mov edi, dword [esp + 0x70]
lea eax, [esp + 0x64]
push edi
push eax
push 1
call fcn.004062f0
push edi
call sym.test_usbprog.exe__sys_error_4
test al, al
jne 0x4064be
push ebx
mov ebx, dword [esp + 0x6c]
movsx eax, word [ebx]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x70]
push eax
lea eax, [ebx + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x7c]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x70]
mov dword [edi + 0xc], eax
mov word [ebx + 2], cx
cmp dword [edi + 0xc], 0xea
jne 0x406473
push edi
call sym.test_usbprog.exe__sys_error_none_4
jmp 0x40648e
test cx, cx
jle 0x40648e
movsx eax, cx
mov al, byte [eax + ebx + 3]
cmp al, byte [0x437881]
jne 0x40648e
lea eax, [ecx - 1]
mov word [ebx + 2], ax
push dword [esp + 0x68]
call sub.ADVAPI32.dll_RegCloseKey
push edi
call sym.test_usbprog.exe__sys_error_4
pop ebx
test al, al
jne 0x4064be
mov eax, dword [esp + 8]
sub eax, 1
je 0x4064bb
sub eax, 1
jne 0x4064be
or byte [esi], 2
pop edi
pop esi
add esp, 0x58
ret 0x10
or byte [esi], 1
pop edi
pop esi
add esp, 0x58
ret 0x10

Function at 0x4064d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x884
lea eax, [esp]
push dword [0x433938]
push eax
push dword [esp + 0x890]
call sym.test_usbprog.exe__string_t_c_12
push dword [0x43393c]
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x406534
push dword [esp + 0x890]
push 2
push 0xffffffffffffffff
call sym.test_usbprog.exe__sys_stat_set_12
push dword [esp + 0x890]
push dword [esp + 0x88c]
call sym.test_usbprog.exe__sys_stat_parm_vstr_8
add esp, 0x884
ret 0xc
movzx eax, word [0x433940]
push eax
lea eax, [esp + 0x88]
push eax
push dword [esp + 0x894]
call sym.test_usbprog.exe__string_vstring_12
push dword [esp + 0x890]
call sym.test_usbprog.exe__sys_error_none_4
add esp, 0x884
ret 0xc

Function at 0x406570
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x884
push esi
mov esi, dword [esp + 0x894]
push esi
call sym.test_usbprog.exe__sys_error_none_4
push 0x84
lea eax, [esp + 8]
push eax
push dword [esp + 0x894]
call sym.test_usbprog.exe__string_t_c_12
push 0x800
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x898]
call sym.test_usbprog.exe__string_t_c_12
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x4065d1
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x884
ret 0xc
Function at 0x4065e0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x54
mov eax, 0x50
push esi
mov word [esp + 4], ax
lea eax, [esp + 4]
push eax
push dword [esp + 0x60]
call sym.test_usbprog.exe__string_copy_8
lea eax, [esp + 4]
push eax
call sym.test_usbprog.exe__string_terminate_null_4
mov esi, dword [esp + 0x60]
lea eax, [esp + 0x5c]
push esi
push eax
push 2
call fcn.004062f0
push esi
call sym.test_usbprog.exe__sys_error_4
test al, al
jne 0x406638
push esi
call sym.test_usbprog.exe__sys_error_none_4
lea eax, [esp + 8]
push eax
push dword [esp + 0x60]
call sub.ADVAPI32.dll_RegDeleteValueA
mov dword [esi + 0xc], eax
pop esi
add esp, 0x54
ret 8

Function at 0x406640
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x88
push esi
push dword [0x433934]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x98]
call sym.test_usbprog.exe__string_t_c_12
mov al, byte [0x437880]
mov esi, dword [esp + 0x94]
push esi
mov byte [esp + 0xb], al
call sym.test_usbprog.exe__sys_error_none_4
lea eax, [esp + 7]
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x40668f
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x88
ret 8
Function at 0x4066a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x2068
call fcn.00406cc0
mov eax, 0x50
mov byte [esp + 3], 0
push ebx
mov bh, byte [esp + 0x2078]
mov word [esp + 0x14], ax
mov eax, 0x2000
push esi
mov word [esp + 0x6c], ax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x2078]
call sym.test_usbprog.exe__string_copy_8
lea eax, [esp + 0x18]
push eax
call sym.test_usbprog.exe__string_terminate_null_4
mov esi, dword [esp + 0x2080]
lea eax, [esp + 0xc]
push esi
push eax
push 3
call fcn.004062f0
push esi
call sym.test_usbprog.exe__sys_error_4
test al, al
jne 0x40686c
movsx eax, word [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov word [esp + 0x6e], cx
cmp eax, 0xea
jne 0x40674c
push esi
call sym.test_usbprog.exe__sys_error_none_4
jmp 0x406768
test cx, cx
jle 0x406768
movsx eax, cx
mov al, byte [esp + eax + 0x6f]
cmp al, byte [0x437882]
jne 0x406768
lea eax, [ecx - 1]
mov word [esp + 0x6e], ax
mov bl, bh
push esi
and bl, 1
call sym.test_usbprog.exe__sys_error_4
test al, al
je 0x406781
mov dword [esp + 0x10], 1
jmp 0x4067b1
mov eax, dword [esp + 0x10]
test bl, bl
je 0x40678e
cmp eax, 1
jne 0x4067b1
test bh, 2
je 0x406798
cmp eax, 2
jne 0x4067b1
push dword [esp + 0x2078]
lea eax, [esp + 0x70]
push eax
call sym.test_usbprog.exe__string_equal_8
test al, al
jne 0x406863
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x207c]
call sym.test_usbprog.exe__string_copy_8
lea eax, [esp + 0x6c]
push eax
call sym.test_usbprog.exe__string_terminate_null_4
mov ecx, dword [esp + 0x10]
test bl, bl
mov eax, 1
cmovne ecx, eax
test bh, 2
mov eax, 2
cmovne ecx, eax
movsx eax, word [esp + 0x6e]
inc eax
mov dword [esp + 0x10], ecx
push eax
lea eax, [esp + 0x74]
push eax
push ecx
push dword [0x437884]
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegSetValueExA
push esi
mov dword [esi + 0xc], eax
call sym.test_usbprog.exe__sys_error_4
test al, al
jne 0x40684b
push dword [esp + 0xc]
mov byte [esp + 0xf], 1
call sub.ADVAPI32.dll_RegFlushKey
push esi
mov dword [esi + 0xc], eax
call sym.test_usbprog.exe__sys_error_4
test al, al
jne 0x40684b
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [esi + 0xc], eax
mov al, 1
pop esi
pop ebx
add esp, 0x2068
ret 0x10
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x2068
ret 0x10
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
pop esi
xor al, al
pop ebx
add esp, 0x2068
ret 0x10
Function at 0x419b60
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push ebp
call sym.test_usbprog.exe__sys_error_none_4
mov esi, dword [esp + 0x14]
mov ebx, 0x40
mov edi, dword [esi + 0x918]
add edi, 0x14
cmp dword [esp + 0x18], ebx
cmovb ebx, dword [esp + 0x18]
nop dword [eax]
push edi
lea eax, [esp + 0x28]
push eax
push ebx
push dword [esp + 0x28]
push dword [esi + 0x920]
call sub.KERNEL32.dll_ReadFile
test al, al
jne 0x419bcd
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
jne 0x419be2
push 1
lea eax, [esp + 0x28]
push eax
push edi
push dword [esi + 0x920]
call sub.KERNEL32.dll_GetOverlappedResult
test al, al
je 0x419be2
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x419b90
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
ret 0x14
call sub.KERNEL32.dll_GetLastError
pop edi
pop esi
mov dword [ebp + 0xc], eax
pop ebp
pop ebx
ret 0x14

Function at 0x419c50
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x24]
call sym.test_usbprog.exe__sys_error_none_4
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov ebp, dword [ebx + 0x918]
test esi, esi
je 0x419cd6
push ebp
lea eax, [esp + 0x14]
push eax
mov eax, 0x40
cmp esi, eax
cmovb eax, esi
push eax
push edi
push dword [ebx + 0x920]
call sub.KERNEL32.dll_WriteFile
test al, al
jne 0x419cb8
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
jne 0x419cca
push 1
lea eax, [esp + 0x14]
push eax
push ebp
push dword [ebx + 0x920]
call sub.KERNEL32.dll_GetOverlappedResult
test al, al
je 0x419cca
add edi, dword [esp + 0x10]
sub esi, dword [esp + 0x10]
jne 0x419c74
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [esp + 0x24]
mov dword [ecx + 0xc], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x419ff0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
mov eax, 0x20
mov ebx, 0x400
mov word [esp + 0xc], ax
lea eax, [esp + 0x30]
push 0x434598
push eax
mov dword [esp + 0x38], ebx
call sym.test_usbprog.exe__string_appends_8
push 0x20
lea eax, [esp + 0x34]
push eax
call sym.test_usbprog.exe__string_append1_8
mov edi, dword [esp + 0x438]
mov eax, dword [edi]
push dword [eax + 0x970]
lea eax, [esp + 0x10]
push eax
call sym.test_usbprog.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
call sym.test_usbprog.exe__string_append_8
push 0x4345e8
lea eax, [esp + 0x34]
push eax
call sym.test_usbprog.exe__string_appends_8
mov ax, word [esp + 0x32]
cmp ax, bx
jle 0x41a083
cwde
push 0x438313
sub eax, ebx
push eax
push 0x434594
call fcn.00401f00
mov ax, word [esp + 0x3e]
add esp, 0xc
test ax, ax
jle 0x41a096
cmp ax, bx
jge 0x41a092
movsx esi, ax
jmp 0x41a098
mov esi, ebx
jmp 0x41a098
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
lea eax, [esp + 0x40]
push 1
push eax
call fcn.0040a631
push 0x434638
call fcn.00401f00
mov eax, dword [edi]
add esp, 0x18
movzx ecx, word [eax + 0x56a]
cmp cx, bx
jle 0x41a0e5
movsx eax, cx
push 0x438314
sub eax, 0x400
push eax
push 0x43463c
call fcn.00401f00
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 0x56a]
test ax, ax
jle 0x41a0ff
cmp ax, bx
jge 0x41a0fb
movsx esi, ax
jmp 0x41a101
mov esi, ebx
jmp 0x41a101
xor esi, esi
push 1
call fcn.0040a39c
push eax
mov eax, dword [edi]
push esi
add eax, 0x56c
push 1
push eax
call fcn.0040a631
push 0x434640
call fcn.00401f00
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x428
ret 4

Function at 0x41a140
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00419ff0
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
movzx ecx, word [eax + 2]
cmp cx, 0x50
jle 0x41a176
movsx eax, cx
push 0x43830f
sub eax, 0x50
push eax
push 0x434580
call fcn.00401f00
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 2]
test ax, ax
jle 0x41a191
cmp ax, 0x50
jge 0x41a18a
movsx esi, ax
jmp 0x41a193
mov esi, 0x50
jmp 0x41a193
xor esi, esi
push 1
call fcn.0040a39c
push eax
mov eax, dword [edi]
push esi
add eax, 4
push 1
push eax
call fcn.0040a631
push 0x434584
call fcn.00401f00
mov eax, dword [esp + 0x2c]
add esp, 0x18
movsx eax, word [eax]
pop edi
pop esi
cmp eax, 2
jle 0x41a1da
push 0x438312
add eax, 0xfffffffe
push eax
push 0x434588
call fcn.00401f00
add esp, 0xc
push 0x20
push 0x43458c
call fcn.00401f00
push 0x5e
push 0x434590
call fcn.00401f00
add esp, 0x10
ret 0xc
Function at 0x41a2a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0xc], 0x20
mov ax, word [edi]
mov word [ebx], ax
movzx eax, word [edi]
cmp ax, word [esi + 2]
jg 0x41a2fb
nop dword [eax]
cwde
mov cl, byte [eax + esi + 3]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x41a2fb
push ecx
lea eax, [esp + 0x10]
push eax
call sym.test_usbprog.exe__string_append1_8
mov ax, word [edi]
inc ax
movzx ecx, ax
mov word [edi], ax
mov eax, ecx
cmp cx, word [esi + 2]
jle 0x41a2d0
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push esi
push dword [esp + 0x44]
push eax
call sym.test_usbprog.exe__string_t_int_12
push esi
call sym.test_usbprog.exe__sys_error_4
test al, al
je 0x41a3d5
cmp byte [esp + 0x34], 0
je 0x41a3cf
push 1
call fcn.0040a39c
push eax
push 0xd
push 1
push str.Bad_integer__
call fcn.0040a631
mov ax, word [esp + 0x22]
add esp, 0x14
cmp ax, 0x20
jle 0x41a367
cwde
push 0x43830e
sub eax, 0x20
push eax
push 0x434574
call fcn.00401f00
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x41a37e
cmp ax, 0x20
jge 0x41a377
movsx esi, ax
jmp 0x41a380
mov esi, 0x20
jmp 0x41a380
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040a631
push 1
call fcn.0040a39c
push eax
push 2
push 1
push 0x434578
call fcn.0040a631
push 0x43457c
call fcn.00401f00
add esp, 0x2c
push ebx
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0041a140
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
mov ax, word [ebx]
mov word [edi], ax
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
Function at 0x41afd0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x208c
call fcn.00406cc0
push esi
push edi
mov eax, 0x2000
mov edi, 0x84
mov word [esp + 0x90], ax
lea eax, [esp + 8]
push str.Syntax_error_occurred_on_line
push eax
mov dword [esp + 0x10], edi
call sym.test_usbprog.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__string_append1_8
mov esi, dword [esp + 0x2098]
mov eax, dword [esi]
push dword [eax + 0x970]
lea eax, [esp + 0x94]
push eax
call sym.test_usbprog.exe__string_f_int_8
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__string_append_8
push 0x434858
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__string_append1_8
mov eax, dword [esi]
add eax, 0x568
push eax
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__string_append_8
mov ax, word [esp + 0xa]
cmp ax, di
jle 0x41b08d
cwde
push 0x43836e
sub eax, edi
push eax
push 0x434804
call fcn.00401f00
mov ax, word [esp + 0x16]
add esp, 0xc
test ax, ax
jle 0x41b0a0
cmp ax, di
jge 0x41b09c
movsx esi, ax
jmp 0x41b0a2
mov esi, edi
jmp 0x41b0a2
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0040a631
push 0x4348a8
call fcn.00401f00
add esp, 0x18
call sym.test_usbprog.exe__sys_bomb_0
pop edi
pop esi
add esp, 0x208c
ret 4
Function at 0x41c490
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x918]
cmp byte [eax], 0
jne 0x41c4ab
add eax, 8
mov dword [esp + 4], eax
jmp sym.test_usbprog.exe__file_close_4
ret 4

Function at 0x41c4f0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call sym.test_usbprog.exe__sys_error_none_4
mov edi, dword [esp + 0x10]
test edi, edi
je 0x41c589
push ebx
push dword [0x438414]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push edi
push dword [esp + 0x24]
push dword [eax + 0x920]
call sub.KERNEL32.dll_ReadFile
mov ebx, dword [esp + 0x1c]
test al, al
jne 0x41c54b
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6d
je 0x41c555
mov dword [esi + 0xc], eax
mov eax, ebx
pop ebx
pop edi
pop esi
mov dword [eax], 0
ret 0x14
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
test eax, eax
jne 0x41c56b
push esi
push 1
push 0xfffffffffffffffd
mov dword [ebx], 0
call sym.test_usbprog.exe__sys_stat_set_12
pop ebx
pop edi
pop esi
ret 0x14
cmp eax, edi
jae 0x41c588
push esi
push 0xa
push 0xfffffffffffffffd
call sym.test_usbprog.exe__sys_stat_set_12
push esi
push edi
call sym.test_usbprog.exe__sys_stat_parm_int_8
push esi
push dword [ebx]
call sym.test_usbprog.exe__sys_stat_parm_int_8
pop ebx
pop edi
pop esi
ret 0x14
Function at 0x41eb20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
cmp byte [0x437860], 0
mov eax, 0x20
mov word [esp + 4], ax
jne 0x41eb3b
call sym.test_usbprog.exe__sys_read_env_global_0
push esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x34]
call sym.test_usbprog.exe__string_copy_8
lea eax, [esp + 8]
push eax
call sym.test_usbprog.exe__string_upcase_4
mov eax, dword [0x43abec]
mov esi, 0x43abec
mov dword [esp + 4], eax
test eax, eax
je 0x41eb86
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__string_equal_8
test al, al
jne 0x41ebe7
mov esi, dword [esp + 4]
mov eax, dword [esi]
mov dword [esp + 4], eax
test eax, eax
jne 0x41eb66
lea eax, [esp + 4]
push eax
push 0x108
call sym.test_usbprog.exe__sys_mem_alloc_8
mov eax, dword [esp + 4]
test eax, eax
jne 0x41ebc9
push 1
call fcn.0040a39c
push eax
push 0x3a
push 1
push str.Unable_to_allocate_more_virtual_memory.__The_disk_is_full.
call fcn.0040a631
push 0x434dd0
call fcn.00401f00
add esp, 0x18
call sym.test_usbprog.exe__sys_bomb_0
mov eax, dword [esp + 4]
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__sys_read_env_lang_8
mov eax, dword [esp + 4]
mov dword [eax], 0
mov eax, dword [esp + 4]
mov dword [esi], eax
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x34]
add ecx, 4
pop esi
mov dword [eax], ecx
add esp, 0x28
ret 8

Function at 0x41ed30
Capabilities:
Get hostname

Disassembly:
mov eax, 0x146c
call fcn.00406cc0
lea eax, [esp]
mov dword [esp], 0x400
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetComputerNameA
test al, al
jne 0x41ed8a
lea eax, [esp + 0x404]
push eax
call sym.test_usbprog.exe__sys_error_none_4
call sub.KERNEL32.dll_GetLastError
push 0
push 0x438558
push str.node_name_get
mov dword [esp + 0x41c], eax
lea eax, [esp + 0x410]
push 0x434e80
push eax
call sym.test_usbprog.exe__sys_error_abort_20
push dword [esp]
lea eax, [esp + 8]
push eax
push dword [esp + 0x1478]
call sym.test_usbprog.exe__string_vstring_12
push dword [esp + 0x1470]
call sym.test_usbprog.exe__string_downcase_4
add esp, 0x146c
ret 4
Function at 0x41f1c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040a39c
push eax
push 0x2e
push 1
push str.Error_reading_global.env_environment_file_set.
call fcn.0040a631
push 0x435248
call fcn.00401f00
add esp, 0x18
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x435178
push eax
call sym.test_usbprog.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.test_usbprog.exe__string_append1_8
mov edi, dword [esp + 0x428]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.test_usbprog.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.test_usbprog.exe__string_append_8
push 0x4351c8
lea eax, [esp + 0x24]
push eax
call sym.test_usbprog.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41f27c
cwde
push 0x4385da
sub eax, ebx
push eax
push 0x43524c
call fcn.00401f00
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41f28f
cmp ax, bx
jge 0x41f28b
movsx esi, ax
jmp 0x41f291
mov esi, ebx
jmp 0x41f291
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040a631
push 0x435250
call fcn.00401f00
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41f2e3
movsx eax, cx
push 0x4385db
sub eax, 0x400
push eax
push 0x435254
call fcn.00401f00
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41f2f6
cmp ax, bx
jge 0x41f2f2
movsx esi, ax
jmp 0x41f2f8
mov esi, ebx
jmp 0x41f2f8
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040a631
push 0x435258
call fcn.00401f00
add esp, 0x18
call sym.test_usbprog.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 4
Function at 0x41fc80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040a39c
push eax
push 0xe
push 1
push str.Error_reading
call fcn.0040a631
mov edi, dword [esp + 0x43c]
add esp, 0x14
movzx ecx, word [edi + 2]
mov eax, ecx
cmp cx, 0x20
jle 0x41fce6
movsx eax, cx
push 0x43863a
sub eax, 0x20
push eax
push 0x435490
call fcn.00401f00
movzx eax, word [edi + 2]
add esp, 0xc
test ax, ax
jle 0x41fcfd
cmp ax, 0x20
jge 0x41fcf6
movsx esi, ax
jmp 0x41fcff
mov esi, 0x20
jmp 0x41fcff
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0040a631
push 1
call fcn.0040a39c
push eax
push 0x22
push 1
push str..lan_language_descriptor_file_set.
call fcn.0040a631
push 0x4354b8
call fcn.00401f00
add esp, 0x2c
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push str.Error_on_line
push eax
call sym.test_usbprog.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.test_usbprog.exe__string_append1_8
mov edi, dword [esp + 0x42c]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.test_usbprog.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.test_usbprog.exe__string_append_8
push str._of_file
lea eax, [esp + 0x24]
push eax
call sym.test_usbprog.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41fdb5
cwde
push 0x43863b
sub eax, 0x400
push eax
push 0x4354bc
call fcn.00401f00
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41fdc8
cmp ax, bx
jge 0x41fdc4
movsx esi, ax
jmp 0x41fdca
mov esi, ebx
jmp 0x41fdca
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040a631
push 0x4354c0
call fcn.00401f00
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41fe1c
movsx eax, cx
push 0x43863c
sub eax, 0x400
push eax
push 0x4354c4
call fcn.00401f00
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41fe2f
cmp ax, bx
jge 0x41fe2b
movsx esi, ax
jmp 0x41fe31
mov esi, ebx
jmp 0x41fe31
xor esi, esi
push 1
call fcn.0040a39c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040a631
push 0x4354c8
call fcn.00401f00
add esp, 0x18
call sym.test_usbprog.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 8
Function at 0x421050
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push esi
call sym.test_usbprog.exe__sys_error_none_4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x10
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push dword [eax + 0x920]
call sub.WS2_32.dll_getsockname
test eax, eax
je 0x421092
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
push 4
lea eax, [esp + 0xc]
push eax
call sym.test_usbprog.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xa]
push eax
call sym.test_usbprog.exe__sys_order_flip_8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
pop esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 2]
mov word [ecx], ax
add esp, 0x10
ret 0x10

Function at 0x4210d0
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call sym.test_usbprog.exe__sys_error_none_4
call sym.test_usbprog.exe__sys_sys_netstart_0
push 0
push 2
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x421100
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
ret 0x10
lea eax, [esp + 0x18]
push eax
push 0x10
call sym.test_usbprog.exe__sys_mem_alloc_8
mov eax, dword [esp + 0x18]
mov ecx, 2
push 4
mov word [eax], cx
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 0x14]
mov word [ecx + 2], ax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
add eax, 4
push eax
call sym.test_usbprog.exe__sys_order_flip_8
mov eax, dword [esp + 0x18]
push 2
add eax, 2
push eax
call sym.test_usbprog.exe__sys_order_flip_8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x920], edi
pop edi
mov word [ecx], 0xa03
mov byte [ecx + 2], 0
mov dword [ecx + 4], 0x400
mov dword [ecx + 0x408], 0x100
mov dword [ecx + 0x50c], 0x400
mov dword [ecx + 0x910], 0
mov dword [ecx + 0x914], 0xfffffffe
mov dword [ecx + 0x918], eax
mov dword [ecx + 0x91c], 0x4219f0
pop esi
ret 0x10