joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d5e0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
push 0x430
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x40d5fd
jmp fcn.00408a80
push 0x430
push 0
push esi
call sub.MSVCR80.dll_memset
lea ecx, [esp + 0x14]
add esp, 0xc
mov eax, 4
add dword [edi + 8], eax
push ecx
call fcn.004078a0
mov eax, dword [esp + 0xc]
add esp, 4
test eax, eax
jge 0x40d62c
neg eax
mov edx, dword [0x5424f0]
and eax, 0xff
mov dword [esi + 0x14], eax
mov eax, dword [0x5424f4]
mov dword [esi + 0xc], eax
mov dword [esi], 1
mov dword [esi + 4], 5
mov dword [esi + 8], edx
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x40e280
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
xor ebx, ebx
xor ebp, ebp
cmp dword [esp + 0x20], ebx
push edi
mov esi, eax
mov edi, 0x80
je 0x40e32e
push 0x84
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x40e2b5
jmp fcn.00408a80
mov edx, dword [esp + 0x24]
mov edx, dword [edx]
mov dword [ecx], edx
mov edx, dword [esp + 0x24]
lea eax, [ecx + 4]
mov dword [edx], ecx
mov byte [eax], bl
mov dword [esp + 0x1c], eax
xor eax, eax
test esi, esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
jle 0x40e2ef
cmp esi, 0x20
jg 0x40e2ef
mov ecx, 0x20
sub ecx, esi
or eax, 0xffffffff
shl eax, cl
push esi
push ecx
push 0
push eax
mov eax, dword [esp + 0x34]
call fcn.004420a0
add esp, 0xc
push eax
push str._s____d_
lea esi, [esp + 0x1c]
call fcn.00402ff0
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
je 0x40e345
cmp dword [esp + 0x18], ebx
jl 0x40e345
mov ecx, dword [esp + 0x14]
add eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x80
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x40e2c6
jmp fcn.00408a80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x40e350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
push edi
mov edi, 0x80
je 0x40e405
push 0x84
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x40e386
jmp fcn.00408a80
mov edx, dword [esi]
mov dword [ecx], edx
lea eax, [ecx + 4]
mov dword [esi], ecx
mov dword [esp + 0x10], edi
mov edi, dword [ebp + 8]
xor ecx, ecx
test edi, edi
mov byte [eax], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
jne 0x40e3ce
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x40e3ce
push 0x33
push str..helper.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
push 0
push edi
mov eax, esi
call fcn.004420a0
push eax
push str.route_gateway__s
lea esi, [esp + 0x20]
call fcn.00402ff0
mov eax, dword [esp + 0x2c]
add esp, 0x10
test eax, eax
je 0x40e420
cmp dword [esp + 0x18], ebx
jl 0x40e420
mov ecx, dword [esp + 0x14]
add eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x40e38f
jmp fcn.00408a80
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e430
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, eax
xor ebx, ebx
xor ebp, ebp
test esi, esi
push edi
mov edi, 0x20
je 0x40e4a4
push 0x24
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x40e45c
jmp fcn.00408a80
mov edx, dword [esi]
mov dword [ecx], edx
lea eax, [ecx + 4]
mov dword [esi], ecx
push str.route_gateway_dhcp
lea esi, [esp + 0x14]
mov byte [eax], bl
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
call fcn.00402ff0
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
je 0x40e4b8
cmp dword [esp + 0x18], ebx
jl 0x40e4b8
mov ecx, dword [esp + 0x14]
add eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 0x20
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x40e465
jmp fcn.00408a80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret

Function at 0x40e4d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
push edi
mov edi, 0x80
je 0x40e585
push 0x84
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x40e506
jmp fcn.00408a80
mov edx, dword [esi]
mov dword [ecx], edx
lea eax, [ecx + 4]
mov dword [esi], ecx
mov dword [esp + 0x10], edi
mov edi, dword [ebp + 8]
xor ecx, ecx
test edi, edi
mov byte [eax], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
jne 0x40e54e
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x40e54e
push 0x44
push str..helper.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
mov eax, dword [ebp + 0xc]
test eax, eax
push 0
je 0x40e5a0
push eax
mov eax, esi
call fcn.004420a0
add esp, 8
push eax
push ecx
push 0
push edi
mov eax, esi
call fcn.004420a0
add esp, 0xc
push eax
push str.route__s__s
lea esi, [esp + 0x1c]
call fcn.00402ff0
add esp, 0xc
jmp 0x40e5ba
push 0x80
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x40e50f
jmp fcn.00408a80
push edi
mov eax, esi
call fcn.004420a0
push eax
push 0x512d7c
lea esi, [esp + 0x20]
call fcn.00402ff0
add esp, 0x10
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40e5d5
cmp dword [esp + 0x18], ebx
jl 0x40e5d5
mov ecx, dword [esp + 0x14]
add eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e5e0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, eax
xor ebx, ebx
xor ebp, ebp
test esi, esi
push edi
mov edi, 0x80
je 0x40e63a
push 0x84
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x40e60f
jmp fcn.00408a80
mov edx, dword [esi]
mov dword [ecx], edx
lea eax, [ecx + 4]
mov dword [esi], ecx
mov byte [eax], bl
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
cmp eax, 3
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
ja case.default.0x40e633
jmp dword [eax*4 + 0x40e6ac]
push 0x80
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x40e618
jmp fcn.00408a80
mov eax, str.undef
jmp 0x40e672
mov eax, str.net30
jmp 0x40e672
mov eax, 0x51ad80
jmp 0x40e672
mov eax, str.subnet
jmp 0x40e672
mov eax, str.unknown
push eax
push str.topology__s
lea esi, [esp + 0x18]
call fcn.00402ff0
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40e6a0
cmp dword [esp + 0x18], ebx
jl 0x40e6a0
mov ecx, dword [esp + 0x14]
add eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x40e6c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, eax
xor ebx, ebx
xor ebp, ebp
test esi, esi
push edi
mov edi, 0x80
je 0x40e741
push 0x84
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x40e6ef
jmp fcn.00408a80
mov edx, dword [esi]
mov dword [ecx], edx
lea eax, [ecx + 4]
mov dword [esi], ecx
mov ecx, dword [esp + 0x28]
mov byte [eax], bl
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push 0x512d94
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebp
call fcn.00402ff0
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
je 0x40e758
cmp dword [esp + 0x18], ebx
jl 0x40e758
mov edx, dword [esp + 0x14]
add eax, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 0x80
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x40e6f8
jmp fcn.00408a80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x40e770
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, eax
xor ebx, ebx
xor ebp, ebp
test esi, esi
push edi
mov edi, 0x80
je 0x40e7ec
push 0x84
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x40e79f
jmp fcn.00408a80
mov edx, dword [esi]
mov dword [ecx], edx
lea eax, [ecx + 4]
mov dword [esi], ecx
push str.socket_flags_TCP_NODELAY
push 0x5103a4
lea esi, [esp + 0x18]
mov byte [eax], bl
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], eax
call fcn.00402ff0
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40e803
cmp dword [esp + 0x18], ebx
jl 0x40e803
mov ecx, dword [esp + 0x14]
add eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 0x80
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x40e7a8
jmp fcn.00408a80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret

Function at 0x40faa0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
xor edi, edi
xor ebx, ebx
test ebp, ebp
mov esi, 0x100
je 0x40fb52
push 0x104
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x40fad5
jmp fcn.00408a80
mov edx, dword [ebp]
lea eax, [ecx + 4]
mov dword [ecx], edx
mov dword [ebp], ecx
mov ecx, dword [esp + 0x28]
mov byte [eax], bl
mov ecx, dword [ecx + 0x7d4]
test ecx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
je 0x40fb3a
mov ecx, dword [ecx + 0x1b0]
test ecx, ecx
je 0x40fb1f
mov eax, ecx
lea esi, [eax + 1]
nop
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x40fb10
sub eax, esi
mov eax, ecx
jne 0x40fb24
mov eax, str.UNDEF
push eax
push 0x513480
lea esi, [esp + 0x18]
call fcn.00402ff0
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40fb6d
cmp dword [esp + 0x18], ebx
jl 0x40fb6d
mov edx, dword [esp + 0x14]
add eax, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 0x100
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x40fae0
jmp fcn.00408a80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x4122a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [edi + 0x674], 0
push esi
je 0x4122d8
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x4122d8
push 0x87a
push str..init.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
push 0x1c4
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4122f1
jmp fcn.00408a80
push 0x1c4
push 0
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
or eax, 0xffffffff
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [edi + 0x674], esi
mov dword [edi + 0x678], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, eax
cmp dword [ebx + 0x56c], 0
push esi
push edi
je 0x4127a6
cmp dword [ebx + 0x588], 0
jne 0x4127a6
cmp dword [ebx + 0x590], 0
jne 0x4127a6
lea edi, [ebx + 0x574]
test edi, edi
je 0x412745
push 0x1c
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x4126a5
jmp fcn.00408a80
mov ecx, dword [edi]
mov dword [eax], ecx
lea esi, [eax + 4]
mov dword [edi], eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, dword [ebx + 0x1b4]
test edi, edi
mov dword [ebx + 0x590], esi
mov dword [esi + 0x14], eax
je 0x4126f2
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x4126f2
push edi
push str.cannot_get_GID_for_group__s____platform_lacks_getgrnam___or_setgid___system_calls
push 0x10
call fcn.00408640
add esp, 0xc
mov edi, dword [ebx + 0x1b0]
test edi, edi
mov dword [esi + 0x10], 0
je 0x412721
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x412721
push edi
push str.cannot_get_UID_for_user__s____platform_lacks_getpwname___or_setuid___system_calls
push 0x10
call fcn.00408640
add esp, 0xc
mov dword [esi + 8], 0
mov edi, dword [ebx + 0x1c0]
call fcn.00419bb0
cmp dword [ebx + 0x56c], 0
je 0x41275f
mov ecx, ebx
call fcn.0040f960
jmp 0x412761
push 0x18
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4126ae
jmp fcn.00408a80
xor eax, eax
cmp dword [ebx + 0xe0], 0
mov dword [ebx + 0x588], eax
je 0x412779
test eax, eax
je 0x412779
call fcn.00419c60
call fcn.00419c00
mov ebx, dword [ebx + 0x1ec]
test ebx, ebx
je 0x4127a6
push 0x40
call fcn.00408960
add esp, 4
test eax, eax
je 0x4127a6
push ebx
push str.WARNING:_nice__d_failed__function_not_implemented_
push 0x40
call fcn.00408640
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4129f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [eax + 0x62c], ebx
push esi
push edi
jne 0x412bd1
mov edi, dword [eax + 0x1fc]
mov ecx, dword [eax + 0x204]
xor esi, esi
cmp edi, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edi
je 0x412bc1
push 0x40
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x412a41
jmp fcn.00408a80
push 0x40
push ebx
push esi
call sub.MSVCR80.dll_memset
mov dword [esi], 2
mov dword [esi + 0x10], ebx
or eax, 0xffffffff
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, dword [esi]
add esp, 0xc
sub eax, 1
je 0x412ac6
sub eax, 1
je 0x412aba
sub eax, 1
je 0x412aae
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x412ad9
push 0x6b
push str.._status.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
jmp 0x412ad9
push 0x180
push 0x102
jmp 0x412acc
push 0x180
push 0x301
jmp 0x412acc
push 0x180
push ebx
push edi
call dword [sym.imp.MSVCR80.dll__open]
add esp, 0xc
mov dword [esi + 8], eax
cmp dword [esi + 8], ebx
jl 0x412b50
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x412ae3
sub eax, edx
lea ebx, [eax + 1]
push ebx
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x412b06
jmp fcn.00408a80
mov edx, dword [esp + 0x10]
push ebx
push edx
push edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
xor ebx, ebx
test byte [esi], 1
mov dword [esi + 4], edi
je 0x412ba1
mov edi, 0x200
push edi
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x412b3b
jmp fcn.00408a80
mov byte [eax], 0
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], ebx
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], eax
xor ebx, ebx
jmp 0x412ba1
push 0x40
call fcn.00408960
add esp, 4
test eax, eax
je 0x412b9a
mov eax, dword [esi]
sub eax, 1
je 0x412b84
sub eax, 1
je 0x412b7d
sub eax, 1
je 0x412b76
mov eax, str.UNDEF
jmp 0x412b89
mov eax, str.READ_WRITE
jmp 0x412b89
mov eax, str.WRITE
jmp 0x412b89
mov eax, str.READ
push eax
push edi
push str.Note:_cannot_open__s_for__s
push 0x40
call fcn.00408640
add esp, 0x10
mov dword [esi + 0x38], 1
test byte [esi], 2
je 0x412bbe
mov eax, dword [esp + 0x14]
cmp eax, ebx
jle 0x412bbe
mov dword [esi + 0x28], 1
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, dword [ebp + 8]
mov dword [eax + 0x62c], esi
mov dword [eax + 0x630], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, eax
test edi, edi
jg 0x413db4
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x413db4
push 0x2b
push str..list.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
push 0x1c
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x413dca
jmp fcn.00408a80
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 0x18], eax
call fcn.0041baf0
mov ecx, dword [ebp + 8]
mov edi, eax
lea eax, [edi - 1]
mov dword [esi + 8], eax
mov eax, edi
mov edx, 8
mul edx
cmp edi, 0xffffffff
mov dword [esi], edi
mov dword [esi + 0x10], 0x41cc30
mov dword [esi + 0x14], 0x41cc50
mov dword [esi + 0xc], ecx
mov ebx, eax
ja 0x413e0e
test edx, edx
ja 0x413e0e
cmp ebx, 0xffffffff
jbe 0x413e2b
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x413e2b
push str.attemped_allocation_of_excessively_large_array
push 0x10
call fcn.00408640
add esp, 8
push ebx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
mov dword [esi + 0x18], eax
jne 0x413e41
jmp fcn.00408a80
test edi, edi
jle 0x413e5e
add eax, 4
mov ecx, edi
lea ebx, [ebx]
mov dword [eax], 0
add eax, 8
sub ecx, 1
jne 0x413e50
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413f90
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
push eax
push ebp
mov dword [esp + 0x14], 0
call ecx
mov edx, dword [esi + 8]
mov edi, eax
mov eax, dword [esi + 0x18]
push edi
and edx, edi
push ebp
lea ebx, [eax + edx*8]
push esi
call fcn.00413ec0
add esp, 0x14
test eax, eax
jne 0x413ffc
push 0x10
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x413fda
jmp fcn.00408a80
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], ebp
mov dword [eax + 8], edi
mov dword [eax], ecx
mov edx, dword [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [ebx + 4], eax
pop edi
mov eax, 1
add dword [esi + 4], eax
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x414250
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
cmp edx, 0xc
push ebx
push ebp
push esi
push edi
mov edi, 0x9e3779b9
mov ebp, edx
mov ebx, edi
mov esi, eax
jb 0x41435c
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
mov dword [esp + 0x10], edx
jmp 0x414280
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, edi
shl eax, 8
lea edi, [edx + eax]
movzx eax, byte [ecx + 0xb]
movzx edx, byte [ecx + 0xa]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, esi
shl eax, 8
lea esi, [edx + eax]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 2]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 1]
shl eax, 8
add eax, edx
movzx edx, byte [ecx]
shl eax, 8
add eax, edx
sub eax, esi
sub eax, edi
sub edi, esi
mov edx, esi
shr edx, 0xd
add eax, ebx
xor eax, edx
sub edi, eax
mov edx, eax
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 0xd
xor esi, edx
sub eax, esi
sub eax, edi
mov edx, esi
shr edx, 0xc
xor eax, edx
sub edi, esi
sub edi, eax
mov edx, eax
shl edx, 0x10
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 5
xor esi, edx
sub eax, esi
sub eax, edi
mov edx, esi
shr edx, 3
xor eax, edx
sub edi, esi
mov ebx, eax
sub edi, ebx
shl eax, 0xa
xor edi, eax
sub esi, edi
mov edx, edi
sub esi, ebx
shr edx, 0xf
xor esi, edx
add ecx, 0xc
sub ebp, 0xc
sub dword [esp + 0x10], 1
jne 0x414280
mov edx, dword [esp + 0x18]
add ebp, 0xffffffff
add esi, edx
cmp ebp, 0xa
ja case.default.0x414366
jmp dword [ebp*4 + 0x414434]
movzx eax, byte [ecx + 0xa]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 9]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 8]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 7]
shl edx, 0x18
add edi, edx
movzx eax, byte [ecx + 6]
shl eax, 0x10
add edi, eax
movzx edx, byte [ecx + 5]
shl edx, 8
add edi, edx
movzx eax, byte [ecx + 4]
add edi, eax
movzx edx, byte [ecx + 3]
shl edx, 0x18
add ebx, edx
movzx eax, byte [ecx + 2]
shl eax, 0x10
add ebx, eax
movzx edx, byte [ecx + 1]
shl edx, 8
add ebx, edx
movzx eax, byte [ecx]
add ebx, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xd
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, ebx
mov eax, edi
shr eax, 0xd
xor esi, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xc
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0x10
xor edi, edx
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 5
xor esi, eax
mov eax, esi
sub ebx, eax
sub ebx, edi
mov ecx, eax
sub edi, eax
shr ecx, 3
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0xa
xor edi, edx
sub eax, edi
sub eax, ebx
shr edi, 0xf
xor eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4145a0
Capabilities:
Terminate process

Disassembly:
push 0x48
push 0
push esi
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x10]
push 0x18
push 4
push 4
push 4
push 4
push 4
push 4
push 4
push 2
push 0x2030
mov dword [esi + 4], 0x20000
mov dword [esi + 0x20], eax
call fcn.00454ac0
add esp, 0x34
test eax, eax
je 0x4145f8
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x4145f8
push str.Cannot_initialize_LZO_compression_library
push 0x10
call fcn.00408640
add esp, 8
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
mov dword [esi], eax
jne 0x414610
jmp fcn.00408a80
cmp dword [0x5426d0], 1
jb 0x414636
push 1
call fcn.00408960
add esp, 4
test eax, eax
je 0x414636
push str.LZO_compression_initialized
push 1
call fcn.00408640
add esp, 8
mov dword [esi + 0x24], 1
ret

Function at 0x416e60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x24
mov eax, dword [0x535df0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
mov edi, ecx
cmp dword [edi + 0x2088], eax
mov dword [esp + 0x14], eax
je 0x416f9e
mov ecx, dword [edi + 0x20a0]
cmp ecx, 0xffffffff
je 0x416f2b
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x20]
push edx
mov esi, 0x10
push ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x416f2b
cmp dword [esp + 0x18], esi
jne 0x416f2b
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0x1e]
push ecx
mov ebx, eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [edi + 0x2088]
push 0x511af4
push edx
movzx ebp, ax
call dword [sym.imp.MSVCR80.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x416f2b
push ebp
push ecx
push 0
push ebx
lea eax, [esp + 0x24]
call fcn.004420a0
add esp, 0xc
push eax
push str._s_n_d_n
push esi
call dword [sym.imp.MSVCR80.dll_fprintf]
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0x14
test eax, eax
je 0x416f7c
cmp dword [0x5426d0], 3
jb 0x416f5e
push 0x28000003
call fcn.00408960
add esp, 4
test eax, eax
je 0x416f5e
mov eax, dword [edi + 0x2088]
push eax
push str.MANAGEMENT:_failed_to_write_peer_info_to_file__s
push 0x28000003
call fcn.00408640
add esp, 0xc
mov dword [0x542690], 4
mov dword [0x542694], 0
mov dword [0x542698], 0x515938
mov eax, dword [esp + 0x14]
test eax, eax
je 0x416f9e
mov edi, dword [sym.imp.MSVCR80.dll_free]
lea ebx, [ebx]
mov esi, dword [eax]
push eax
call edi
add esp, 4
test esi, esi
mov eax, esi
jne 0x416f90
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004dcaae
add esp, 0x24
ret