joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001166
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x107e2140]
jne 0x10001170
repz ret
jmp fcn.100014af

Function at 0x10007328
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x107e2140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10002976
and dword [ebp - 0x14], 0
cmp dword [0x107e5b2c], 0
mov dword [ebp - 0x18], eax
jne 0x100073db
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10007483
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10007483
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x107e5b2c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x107e5b30], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x107e5b34], eax
call edi
push eax
call esi
mov dword [0x107e5b3c], eax
test eax, eax
je 0x100073db
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x107e5b38], eax
mov eax, dword [0x107e5b38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x10007434
cmp dword [0x107e5b3c], ecx
je 0x10007434
push eax
call esi
push dword [0x107e5b3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10007434
test ebx, ebx
je 0x10007434
call edi
test eax, eax
je 0x1000742b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000742b
test byte [ebp - 8], 1
jne 0x10007434
or dword [ebp + 0x10], 0x200000
jmp 0x10007467
mov eax, dword [0x107e5b30]
cmp eax, dword [ebp - 0x18]
je 0x10007467
push eax
call esi
test eax, eax
je 0x10007467
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10007467
mov eax, dword [0x107e5b34]
cmp eax, dword [ebp - 0x18]
je 0x10007467
push eax
call esi
test eax, eax
je 0x10007467
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x107e5b2c]
call esi
test eax, eax
je 0x10007483
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10007485
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001166
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80b004]
jne 0x40100a
repz ret
jmp fcn.0040151b

Function at 0x4067a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x80b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403d19
and dword [ebp - 0x14], 0
cmp dword [0x80de80], 0
mov dword [ebp - 0x18], eax
jne 0x40685a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406902
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406902
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x80de80], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x80de84], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x80de88], eax
call edi
push eax
call esi
mov dword [0x80de90], eax
test eax, eax
je 0x40685a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x80de8c], eax
mov eax, dword [0x80de8c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4068b3
cmp dword [0x80de90], ecx
je 0x4068b3
push eax
call esi
push dword [0x80de90]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4068b3
test ebx, ebx
je 0x4068b3
call edi
test eax, eax
je 0x4068aa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4068aa
test byte [ebp - 8], 1
jne 0x4068b3
or dword [ebp + 0x10], 0x200000
jmp 0x4068e6
mov eax, dword [0x80de84]
cmp eax, dword [ebp - 0x18]
je 0x4068e6
push eax
call esi
test eax, eax
je 0x4068e6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4068e6
mov eax, dword [0x80de88]
cmp eax, dword [ebp - 0x18]
je 0x4068e6
push eax
call esi
test eax, eax
je 0x4068e6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x80de80]
call esi
test eax, eax
je 0x406902
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406904
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x802840
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x408
mov eax, dword [0x80b004]
xor eax, esp
mov dword [esp + 0x404], eax
cmp dword [0x22e068c], 0xfc7
jne 0x80286f
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x80e3a4]
imul eax, eax, 0x343fd
cmp dword [0x22e068c], 0x139e
mov dword [0x80e3a4], eax
jne 0x80289e
mov ecx, dword [esp]
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x80e3a4]
add eax, 0x269ec3
push esi
mov dword [0x80e3a4], eax
movzx esi, word [0x80e3a6]
and esi, 0x7fff
cmp dword [0x22e068c], 0x8e7
jne 0x8028d3
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [esp + 0x408]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x408
ret

Function at 0x8029a0
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x80bec0]
sub esp, 0x14
push ebx
mov ebx, dword [0x22e0030]
push edi
mov edi, dword [0x22e068c]
call fcn.008028f0
cmp dword [0x22e068c], 0x2f
jne 0x8029fa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00802920
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x802cc0
Capabilities:
Get disk information
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.004095e0
mov eax, dword [0x80b004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x802ce9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x802d91
cmp dword [0x22e068c], 0xa5f
jne 0x802d35
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push 0x809a90
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x802d5a
mov eax, dword [0x80cce0]
mov dword [0x22e068c], eax
mov ecx, dword [0x22e068c]
add ecx, 0xa231
mov dword [0x22e068c], ecx
cmp dword [0x22e068c], 0x141
jne 0x802d8c
push str.jisaxivemuvanacucoxoxobo_necogoduhutevepipojomaji_kadesezimini_joretevigusopibiyigibiga_wemakihumovuyo
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x80e3a8], 0xec58acac
mov dword [0x80e3ac], 0xffffffff
jmp 0x802ce0
call fcn.00802a10
jmp dword [0x22e0030]
Function at 0x4019b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x4019c6
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jge 0x401a09
push 0x4254b8
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x401a07
push 0x41
push 0x42fab8
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x401a07
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + edx*4], 0x42fab8
jmp 0x4019bd
mov esp, ebp
pop ebp
ret

Function at 0x407ea0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x426334
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x407ec5
call fcn.00408620
jmp 0x407fc4
push str.WNCZONE
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x407edf
call fcn.00408b40
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x407efd
mov eax, dword [ebp - 4]
jmp 0x407fc4
cmp dword [0x42fb98], 0
jne 0x407f0b
call fcn.00407fd0
push 0x426340
mov eax, dword [0x42fb98]
push eax
call fcn.0040ae70
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x407f31
xor eax, eax
jmp 0x407fc4
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x42fb98]
push ecx
call fcn.0040b530
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x407fc1
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x407f63
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x407f6f
jmp 0x407f5a
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x407f83
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 4]
jb 0x407fa2
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x407fa2
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
jl 0x407fa2
jmp 0x407f7a
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x407fc1
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x408b60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x426344
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x408ba2
push str.WNCTMPDIR
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x408ba0
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x408be0
jmp 0x408bc9
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x408bc9
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x408be0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x42fb98]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ade0
add esp, 0xc
pop ebp
ret

Function at 0x408c60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x42f520]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x408c80
xor eax, eax
jmp 0x408db8
mov eax, dword [ebp + 8]
push eax
push 0x426390
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408cba
mov eax, dword [ebp - 4]
jmp 0x408db8
cmp dword [0x42fb98], 0
jne 0x408cc8
call fcn.00407fd0
push 0x426398
mov eax, dword [0x42fb98]
push eax
call fcn.0040ae70
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x408cee
xor eax, eax
jmp 0x408db8
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x42fb98]
push ecx
call fcn.0040b530
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408db5
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x408d2d
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x408d3c
jmp 0x408d1e
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x408d5c
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x408d84
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x408d84
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x408d84
jmp 0x408d4d
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x408db5
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041d016
mov esp, ebp
pop ebp
ret
Function at 0x408dd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x42f520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x408e21
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x408e37
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x42fb98]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040ade0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d016
mov esp, ebp
pop ebp
ret

Function at 0x40a6c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a702
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x40a702
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x40c7d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c809
push 0x4267f4
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x40c809
mov eax, 1
jmp 0x40c80b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40d2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40d30b
xor eax, eax
jmp 0x40d317
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x40d400
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll__mkdir]
add esp, 4
test eax, eax
je 0x40d424
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0xd
je 0x40d424
or eax, 0xffffffff
jmp 0x40d426
xor eax, eax
pop ebp
ret
Function at 0x40d6b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x42f520]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x426848
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40d6e2
mov eax, dword [ebp - 4]
jmp 0x40d869
push str.WNCHOME_LS
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40d82d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40d721
xor eax, eax
jmp 0x40d869
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x40d73e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40d764
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x40d762
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x40d72f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0040d880
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40d785
xor eax, eax
jmp 0x40d869
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0040d880
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40d7b5
xor eax, eax
jmp 0x40d869
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0040d880
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40d7e5
xor eax, eax
jmp 0x40d869
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x42685c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40d820
push 0x426860
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x40d824
xor eax, eax
jmp 0x40d869
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x40d866
push str.WNCHOME
push 0x42fbc8
call sub.MSVCR100.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x42fbc8
call sub.MSVCR100.dll_strcat
add esp, 8
push 0x42fbc8
call dword [sym.imp.MSVCR100.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0041d016
mov esp, ebp
pop ebp
ret
Function at 0x4139f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x404
push 0
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x400
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_recv
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x400], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x400], 0xffffffff
jne 0x413a53
call fcn.00413c00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x413a47
mov eax, dword [ebp - 4]
imul eax, eax, 0xffffffff
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x400], edx
push 0
mov eax, dword [0x4305f8]
push eax
call dword [0x42efa4]
add esp, 8
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x400], 0
jg 0x413a77
mov eax, 0xfffffe6c
jmp 0x413a79
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x413a80
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x10
push 0
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jmp 0x413aae
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x413adc
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
push eax
push str.0123456789.
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
test eax, eax
jne 0x413ada
mov dword [ebp - 4], 1
jmp 0x413adc
jmp 0x413aa5
cmp dword [ebp - 4], 0
je 0x413b1d
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x413afb
mov eax, 0xfffffe0b
jmp 0x413b6c
mov edx, dword [ebp - 0xc]
movsx eax, word [edx + 0xa]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
jmp 0x413b4e
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
cmp dword [ebp - 0x10], 0xffff
jne 0x413b4e
mov eax, 0xfffffe09
jmp 0x413b6c
mov edx, 2
mov eax, dword [ebp + 0x10]
mov word [eax], dx
movzx ecx, word [ebp + 0xc]
push ecx
call sub.WS2_32.dll_htons
mov edx, dword [ebp + 0x10]
mov word [edx + 2], ax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x413c20
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x413c33
mov eax, dword [ebp + 8]
mov dword [eax], 0x430eb0
cmp dword [0x4305f4], 0
je 0x413c40
xor eax, eax
jmp 0x413c9f
push 0x430d20
push 0x202
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413c76
mov ecx, dword [ebp - 4]
push ecx
push str.WSAStartup_error__d
push 0x430eb0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
mov eax, 0xfffffb49
jmp 0x413c9f
mov dword [0x4305f4], 1
push 0x430e25
push 0x430d24
push str.DLL_s___STATUS_s
push 0x430eb0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x417260
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4172b3
mov ecx, dword [ebp + 0x10]
push ecx
push str.PC_user
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov byte [eax - 1], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x417330
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x42f520]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor eax, eax
je 0x41736b
push 0x4288a4
lea ecx, [ebp - 0xc]
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x4173fb
push 0x4288a8
lea edx, [ebp - 0xc]
push edx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xc], 0x41
jmp 0x417392
mov al, byte [ebp - 0xc]
add al, 1
mov byte [ebp - 0xc], al
movsx ecx, byte [ebp - 0xc]
cmp ecx, 0x5a
jg 0x4173e5
movsx edx, byte [ebp - 0xe]
test edx, edx
jne 0x4173e5
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xd4], ecx
cmp dword [ebp - 0xd4], 2
je 0x4173d5
cmp dword [ebp - 0xd4], 3
je 0x4173cd
jmp 0x4173e3
mov dl, byte [ebp - 0xc]
mov byte [ebp - 0xe], dl
jmp 0x4173e3
movsx eax, byte [ebp - 0xd]
test eax, eax
jne 0x4173e3
mov cl, byte [ebp - 0xc]
mov byte [ebp - 0xd], cl
jmp 0x41738a
movsx edx, byte [ebp - 0xe]
test edx, edx
jne 0x4173f5
mov al, byte [ebp - 0xd]
mov byte [ebp - 0xc], al
jmp 0x4173fb
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0xc], cl
movsx edx, byte [ebp - 0xc]
test edx, edx
jne 0x417413
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0xfffffc19
jmp 0x417459
push 0x50
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x74]
push eax
push 0x50
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x417453
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
jmp 0x417459
mov eax, dword [ebp - 0x74]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jne 0x417465
cmp dword [ebp - 4], 0
jl 0x417471
cmp dword [ebp - 8], 0
je 0x417479
cmp dword [ebp - 4], 0
jle 0x417479
mov ecx, dword [ebp - 4]
neg ecx
mov dword [ebp - 4], ecx
cmp dword [0x432474], 0
je 0x4174e1
cmp dword [0x42f1e0], 0
jle 0x4174e1
cmp dword [0x432480], 0
je 0x4174a9
mov edx, dword [ebp - 4]
mov dword [0x432484], edx
mov dword [0x432480], 0
jmp 0x4174be
mov eax, dword [ebp - 4]
cmp eax, dword [0x432484]
je 0x4174be
mov dword [0x42f1e0], 0
mov ecx, dword [0x42f1e0]
sub ecx, 1
mov dword [0x42f1e0], ecx
jne 0x4174e1
lea edx, [ebp - 4]
push edx
push 0x43247c
call dword [0x432474]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041d016
mov esp, ebp
pop ebp
ret