joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001e28
cmp byte [esi + ebx - 1], 0xa
je 0x10001dfc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100030f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x10001e93
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebx + 0x60]
mov eax, dword [esi + 0xc]
cmp eax, 0xb0027
ja 0x10001ee0
cmp eax, 0xb0002
ja 0x10001ec8
mov esi, dword [ebx + 0x18]
test byte [section..data], 1
jne 0x10001f3f
mov dword [esp], ebx
mov dword [esp + 4], 0
call sym._IoCompleteRequest_8
mov eax, esi
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
lea edx, [eax - 0xb0003]
cmp edx, 0x24
ja case.0x10001ed3.720900
jmp dword [edx*4 + 0x1000405c]
cmp eax, 0xb01a2
ja 0x10001f28
cmp eax, 0xb0190
jbe case.0x10001ed3.720900
lea ecx, [eax - 0xb0191]
mov edx, 1
shl edx, cl
and edx, 0x20213
je case.0x10001ed3.720900
add esi, 0x24
inc byte [ebx + 0x23]
mov dword [ebx + 0x60], esi
mov dword [ebp + 0xc], ebx
mov eax, dword [edi + 0x28]
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._IoCallDriver_8
cmp eax, 0xb01e2
je case.0x10001ed3.720899
mov esi, dword [ebx + 0x18]
test byte [section..data], 1
je 0x10001ea3
mov edx, eax
mov dword [esp + 0x10], eax
and edx, 3
mov dword [esp + 0xc], str.Unsupported_ioctl__lx__device_lx_access_lx_func_lx_method_lx__n
mov dword [esp + 0x20], edx
mov edx, eax
shr edx, 2
mov dword [esp + 8], str.internal_ioctl
and edx, 0xfff
mov dword [esp + 4], 0x10003000
mov dword [esp + 0x1c], edx
mov edx, eax
shr edx, 0xe
mov dword [esp], 0
and edx, 3
mov dword [esp + 0x18], edx
mov edx, eax
shr edx, 0x10
mov dword [esp + 0x14], edx
call sym._wine_dbg_log.constprop.0
jmp 0x10001ea3
Function at 0x402530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40255c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x402584
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40258a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x4025f2
jg 0x4025a1
test esi, esi
je 0x4025f2
test ecx, ecx
jl 0x4025ed
jg 0x4025ab
test eax, eax
je 0x4025ed
cmp edi, ecx
jg 0x4025bf
jl 0x4025b5
cmp esi, eax
jae 0x4025bf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4025f5
mov ecx, dword [ebp + 8]
jmp 0x4025ff
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x402619
jg 0x4025ff
test esi, esi
je 0x402619
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x402619
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x40265c
jl 0x402650
test ecx, ecx
jne 0x40265c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x402675
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x4026c3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x4026c9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x4026c9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x402736
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4026f2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x402724
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x402736
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x402700
test edi, edi
je 0x402736
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x476400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x402ae0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e62e
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x402b1c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x402b1c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e62e
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x402bf3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x402b44
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402b50
movsx eax, bl
jmp 0x402b88
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x402bb2
sub eax, 1
je 0x402bb2
sub eax, 2
jne 0x402bf3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e62e
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402bd0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x402bf3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e62e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045e62e
mov esp, ebp
pop ebp
ret 4
Function at 0x402fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x476400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40309c
cmp byte [esi + 0x3d], 0
je 0x40309c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40308a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x403051
sub eax, 1
je 0x403055
sub eax, 2
jne 0x40308a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e62e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403073
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40308a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e62e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e62e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0045e62e
mov esp, ebp
pop ebp
ret
Function at 0x40e220
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40e2cf
push esi
call fcn.004244e0
add esp, 4
test al, al
jne 0x40e2cf
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x40e247
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0042d8e0
add esp, 0xc
test eax, eax
je 0x40e27b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0042d8e0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40e27d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x40e2ae
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.00421340
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x40e290
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x414c60
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x14
mov eax, dword [0x476400]
xor eax, esp
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x28]
mov eax, dword [eax + 4]
and eax, 0xa
cmp al, 0xa
mov eax, dword [ecx + 0xc]
jne 0x414c97
mov esi, dword [eax + 0x78]
mov ebx, dword [eax + 0x7c]
mov ebp, dword [eax + 0x80]
jmp 0x414ca3
mov esi, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
mov ebp, dword [eax + 0x4c0]
test esi, esi
je 0x414d84
mov eax, dword [edi]
test eax, eax
je 0x414ce0
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414cd3
test dl, dl
je 0x414ccf
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414cd3
add ecx, 2
add eax, 2
test dl, dl
jne 0x414cb3
xor eax, eax
jmp 0x414cd8
sbb eax, eax
or eax, 1
test eax, eax
je 0x414d84
push edi
call fcn.00414c10
push esi
call dword [0x47600c]
mov edx, eax
add esp, 8
mov dword [edi], edx
test edx, edx
je 0x414d3a
test ebx, ebx
je 0x414d5b
mov ecx, ebx
nop
mov al, byte [esi]
cmp al, byte [ecx]
jne 0x414d20
test al, al
je 0x414d1c
mov al, byte [esi + 1]
cmp al, byte [ecx + 1]
jne 0x414d20
add esi, 2
add ecx, 2
test al, al
jne 0x414d00
xor eax, eax
jmp 0x414d25
sbb eax, eax
or eax, 1
test eax, eax
je 0x414d5b
push ebx
call dword [0x47600c]
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jne 0x414d5e
push edi
call fcn.00414c10
add esp, 4
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0045e62e
add esp, 0x14
ret
mov dword [edi + 4], edx
mov esi, dword [edi]
test esi, esi
je 0x414dba
cmp byte [esi], 0
je 0x414dba
mov ebx, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [esp + 0x10]
push eax
push esi
push 2
call ebx
test eax, eax
je 0x414da3
mov dword [edi + 0xc], 1
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045e62e
add esp, 0x14
ret
lea eax, [esp + 0x10]
push eax
push esi
push 0x17
call ebx
test eax, eax
je 0x414dba
mov dword [edi + 0xc], 2
jmp 0x414d84
mov ecx, dword [edi]
mov dword [edi + 0xc], 0
cmp byte [ecx], 0
je 0x414d84
mov esi, ecx
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x414dd0
sub esi, edx
je 0x414de3
cmp byte [ecx + esi - 1], 0x2e
jne 0x414de3
dec esi
cmp esi, 0xffff
jae 0x414d84
lea eax, [esi + 1]
push eax
push 1
call dword [0x476010]
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x414d3a
push esi
push dword [edi]
push eax
call fcn.004213a0
mov eax, dword [edi + 8]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x414d84
Function at 0x41a820
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x68a], 0
je 0x41a8bd
cmp dword [esi + 0x194], 0
je 0x41a877
push esi
call fcn.00408f10
push 1
push esi
mov byte [esp + 0x14], al
call fcn.004093b0
push dword [esi + 0x144]
mov eax, dword [esi + 0x194]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call eax
push dword [esp + 0x28]
push esi
call fcn.004093b0
add esp, 0x28
pop esi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x41a88c
sub eax, 1
je 0x41a88c
sub eax, 1
jne 0x41a8bd
push dword [esi + 0x140]
lea eax, [ecx*2 + 0x463dbc]
push 1
add eax, ecx
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
push dword [esi + 0x140]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x20
pop esi
ret

Function at 0x41de20
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
jne 0x41de3a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x464710
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcspbrk
add esp, 8
test eax, eax
je 0x41de82
test ebp, ebp
je 0x41de73
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x41dea8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41dea8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x41df82
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41dec5
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41df78
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41df78
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41df06
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41df21
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x41df40
test ebp, ebp
je 0x41df6f
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x476004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x476004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x4244e0
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x476400]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x424528
lea eax, [esp + 8]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
pop esi
setg al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0045e62e
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov al, 1
pop esi
xor ecx, esp
call fcn.0045e62e
add esp, 0x18
ret

Function at 0x424680
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4246be
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x114], 0
jne 0x4246af
push 0
call fcn.00424680
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x114], cl
mov eax, dword [esi + 0x7c]
pop esi
cmp byte [eax + 0x114], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4246d3
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret
Function at 0x425410
Capabilities:
Convert ip address from string
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x476400]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x78]
push edi
xor edi, edi
mov dword [esp + 8], eax
cmp byte [eax + 0x68a], 0
je 0x4255e9
cmp byte [ebp + 0x18], 0
push ebx
lea ebx, [ebp + 0x18]
je 0x4255e8
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [esp + 0x34]
push eax
push ebx
push 2
call esi
test eax, eax
jg 0x4255e7
lea eax, [esp + 0x38]
push eax
push ebx
push 0x17
call esi
test eax, eax
jg 0x4255e7
push dword [ebp + 0x14]
cmp byte [ebx], 0
mov eax, str._none_
mov esi, dword [ebp]
mov ebp, dword [esp + 0x14]
cmovne eax, ebx
push eax
push str.Host__s:_d_was_resolved.
push ebp
call fcn.0041a990
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.0040e860
lea eax, [esp + 0x3c]
push 0x400
push eax
call fcn.0040e860
add esp, 0x20
test esi, esi
je 0x42555b
lea edx, [edi + 0x10]
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x4254d2
cmp ecx, 2
jne 0x425550
xor eax, eax
mov byte [esp + 0x48], 0
cmp ecx, 2
lea ebx, [esp + 0x14]
cmovne eax, edx
add ebx, eax
sub ecx, 2
je 0x425501
sub ecx, 0x15
jne 0x425516
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x425511
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call sub.WS2_32.dll_inet_ntop
push ebx
call fcn.0040e880
add esp, 4
test eax, eax
je 0x425535
push 2
push 0x463dfc
push ebx
call fcn.0040e820
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x42557b
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.0040e7c0
mov edi, eax
add esp, 8
test edi, edi
jne 0x42557b
lea edx, [eax + 0x10]
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4254c1
lea eax, [esp + 0x24]
push eax
call fcn.0040e880
add esp, 4
test eax, eax
je 0x42558b
lea eax, [esp + 0x24]
push eax
call fcn.0040e890
add esp, 4
jmp 0x425590
push str.too_many_IP__cant_show
push ebp
call fcn.0041a990
add esp, 8
jmp 0x4255d0
mov eax, str._none_
push eax
push str.IPv6:__s
push ebp
call fcn.0041a990
lea eax, [esp + 0x20]
push eax
call fcn.0040e880
add esp, 0x10
test eax, eax
je 0x4255bc
lea eax, [esp + 0x14]
push eax
call fcn.0040e890
add esp, 4
jmp 0x4255c1
mov eax, str._none_
push eax
push str.IPv4:__s
push ebp
call fcn.0041a990
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call fcn.0040e830
lea eax, [esp + 0x28]
push eax
call fcn.0040e830
add esp, 8
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
pop edi
pop ebp
xor ecx, esp
call fcn.0045e62e
add esp, 0x6c
ret
Function at 0x42e040
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0040e580
push dword [esp + 0x38]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call fcn.0042d3c0
push dword [esp + 0x40]
mov edi, eax
call fcn.0042d3c0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x42e0d5
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.0040e580
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.0040e630
add esp, 0x20
test edx, edx
ja 0x42e0f9
jb 0x42e0c7
cmp eax, 0x3e8
ja 0x42e0f9
push 1
call ebp
push 1
push esi
push edi
call ebx
test eax, eax
je 0x42e090
test edi, edi
je 0x42e0e2
push edi
call fcn.0045f7e8
add esp, 4
test esi, esi
je 0x42e0ef
push esi
call fcn.0045f7e8
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edi, edi
je 0x42e106
push edi
call fcn.0045f7e8
add esp, 4
test esi, esi
je 0x42e113
push esi
call fcn.0045f7e8
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret