joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001fbce
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
clc
mov eax, 0x10c4
call fcn.10092a1e
mov eax, dword [0x100bd044]
xor eax, esp
mov dword [esp + 0x10c0], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor eax, eax
push 0x1000
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xd0]
and al, 0xd0
add byte [eax], al
add byte [eax - 0x18], dl
mov al, byte [0x83000741]
les ecx, [ecx*4 + 0xc82484]
enter 0, 0
push 0x800
push eax
push 0
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetModuleFileNameW
push esi
lea ecx, [esp + 0xb4]
call fcn.10024a8d
push 5
pop edx
lea ecx, [esp + 0x98]
add byte [eax], al
call fcn.1003a1d7
lea eax, [esp + 0x98]
push eax
lea edx, [esp + 0xb4]
lea ecx, [esp + 0x6c]
call fcn.10039ab2
pop ecx
push 8
pop esi
cmp dword [esp + 0x7c], esi
lea eax, [esp + 0x68]

Function at 0x1001fc0b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
clc
mov eax, 0x10c4
call fcn.10092a1e
mov eax, dword [0x100bd044]
xor eax, esp
mov dword [esp + 0x10c0], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor eax, eax
push 0x1000
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xd0]
and al, 0xd0
add byte [eax], al
add byte [eax - 0x18], dl
mov al, byte [0x83000741]
les ecx, [ecx*4 + 0xc82484]
enter 0, 0
push 0x800
push eax
push 0
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetModuleFileNameW
push esi
lea ecx, [esp + 0xb4]
call fcn.10024a8d
push 5
pop edx
lea ecx, [esp + 0x98]
add byte [eax], al
call fcn.1003a1d7
lea eax, [esp + 0x98]
push eax
lea edx, [esp + 0xb4]
lea ecx, [esp + 0x6c]
call fcn.10039ab2
pop ecx
push 8
pop esi
cmp dword [esp + 0x7c], esi
lea eax, [esp + 0x68]

Function at 0x1001fc43
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
clc
mov eax, 0x10c4
call fcn.10092a1e
mov eax, dword [0x100bd044]
xor eax, esp
mov dword [esp + 0x10c0], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor eax, eax
push 0x1000
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xd0]
and al, 0xd0
add byte [eax], al
add byte [eax - 0x18], dl
mov al, byte [0x83000741]
les ecx, [ecx*4 + 0xc82484]
enter 0, 0
push 0x800
push eax
push 0
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetModuleFileNameW
push esi
lea ecx, [esp + 0xb4]
call fcn.10024a8d
push 5
pop edx
lea ecx, [esp + 0x98]
add byte [eax], al
call fcn.1003a1d7
lea eax, [esp + 0x98]
push eax
lea edx, [esp + 0xb4]
lea ecx, [esp + 0x6c]
call fcn.10039ab2
pop ecx
push 8
pop esi
cmp dword [esp + 0x7c], esi
lea eax, [esp + 0x68]
Function at 0x1001fc84
Capabilities:
Check if file exists

Disassembly:
push ebx
cmovae eax, dword [esp + 0x6c]
push 0x100b69f8
push edi
push str._u__d
push eax
lea eax, [esp + 0x94]
add byte [eax], al
add byte [eax + 0xc], ch
push 0xb
adc byte [eax - 0x18], dl
out 0x59, eax
add byte [eax], al
add esp, 0x1c
lea eax, [esp + 0x68]
cmp dword [esp + 0x7c], esi
cmovae eax, dword [esp + 0x68]
inc ebx
inc esp
and al, 0x68
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001fd13
push 0x44
xor ebx, ebx

Function at 0x1001fcb1
Capabilities:
Create process on windows

Disassembly:
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.10093e5c
add esp, 0xc
lea edx, [esp + 0x10]
invalid
mov ah, 0x24
xchg esp, eax

Function at 0x1001fdba
Capabilities:
Query environment variable

Disassembly:
xor edi, edi
lea eax, [esp + 0x94]
push edi
push eax
call fcn.10093f6a
add esp, 0xc
les ecx, [ecx*4 - 0x4587dbb4]
test eax, 0xe8000001
lea esp, [ebp + 0x78830001]
adc al, 8
jb 0x1001fde3
mov eax, dword [eax]
invalid
add byte [ecx], al

Function at 0x1001fdcb
Capabilities:
Query environment variable

Disassembly:
xor edi, edi
lea eax, [esp + 0x94]
push edi
push eax
call fcn.10093f6a
add esp, 0xc
les ecx, [ecx*4 - 0x4587dbb4]
test eax, 0xe8000001
lea esp, [ebp + 0x78830001]
adc al, 8
jb 0x1001fde3
mov eax, dword [eax]
invalid
add byte [ecx], al

Function at 0x1001fe2f
Capabilities:
Create process on windows

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [esp + 0x78]
call fcn.10024cf8
push 0x44
pop esi
push esi
lea eax, [esp + 0x1c]
mov dword [0x100c14d0], 0x92ba8
push edi
push eax
call fcn.10093fb9
add esp, 0xc
mov dword [esp + 0x18], esi
lea ecx, [esp + 8]
mov dword [esp + 0x44], 1
xor eax, eax
cmp dword [esp + 0x74], 8
jl fcn.1001fe55
je 0x1001fe3b
mov word [esp + 0x48], ax
lea eax, [esp + 0x60]
cmovae eax, dword [esp + 0x60]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
lea eax, [esp + 0xb4]

Function at 0x10020fdc
Capabilities:
Check for software breakpoints

Disassembly:
fist dword [edi - 0x75]
jge 0x10020fe9
cmp ecx, 0xd2
jg 0x10021c14
daa
or al, 0
add byte [edi], cl
test byte [0x8d00000c], al
inc ecx
std
je 0x10021bf8
lea eax, [ecx - 3]
cmp eax, 0xcc
ja case.0x10021008.1
movzx eax, byte [eax + 0x10023a84]
jmp dword [eax*4 + 0x10023934]
and al, 0x85
xor al, 0x39
add dl, byte [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
js 0x100237e2
mov dword [edi + 0x6ac], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp dword [eax], ebx
setne al
mov byte [edi + 0x6fb], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp dword [eax], ebx
invalid
xchg ebp, eax
Function at 0x10026ff0
Capabilities:
Send data
Send data on socket

Disassembly:
inc ebp
adc byte [ebx], al
mov dword [eax - 0x72ffdf83], 0x440f0148
enter 0xfffffffffffff983, 0xa
jbe 0x1002703b
lea eax, [ecx*8]
push eax
call dword [section..data]
mov esi, eax
add esp, 4
mov dword [ebp - 0xb4], esi
test esi, esi
jne 0x10027034
pop ebx
pop edi
lea eax, [esi + 3]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100993ff
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x95], 1
xor ebx, ebx
mov dword [ebp - 0x9c], ebx
test edi, edi
je 0x1002716d
invalid
invalid

Function at 0x10027125
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
test eax, eax
jne 0x100272a6
mov edx, dword [ebp - 0xa0]
inc esi
cmp esi, 5
jb 0x10027080

Function at 0x10027e5e
Capabilities:
Send data
Send data on socket

Disassembly:
ja 0x10027e6c
call dword [0x100bd004]
push esi
call dword [0x100bd00c]
add esp, 8
mov dword [edi + 0xc], eax
test eax, eax
je 0x10027d9b
adc byte [ebx + 0x478908c4], al
or al, 0x85
ror byte [edi], 0x84
and bh, bh
invalid
push dword [edi + 0x10]
call dword [0x100bd004]
add al, 0xd0
or edx, dword [eax]

Function at 0x10027f25
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10027f47
test dl, dl
je 0x10027f43
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10027f47
add eax, 2
add ecx, 2
test dl, dl
sal byte [ebp - 0x1c], cl
xor eax, eax
jmp 0x10027f4c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10027f8d
push dword [edi + 0x14]
call dword [0x100bd004]
push esi
call dword [0x100bd00c]
add esp, 8
mov dword [edi + 0x14], eax
mov byte [ebp - 0x200c], 1
jmp 0x1004f3c2
sub dword [edx + eax], esi
or dl, byte ss:[eax]

Function at 0x10028126
Capabilities:
Send data
Send data on socket

Disassembly:
add bl, ch
adc dword [ebp + 0x7c147fc9], eax
add al, 0x85
sal byte [ebx + 0xe], cl

Function at 0x1002833f
Capabilities:
Send data
Send data on socket

Disassembly:
cmp eax, 0xc15ff56
ror byte [ebx], 1
adc byte [ebx + 0x478904c4], al
or al, 0x85
sal byte [ebp + 0xc], 0xc6
test esp, esi
invalid

Function at 0x10028390
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [edi + 0xc], eax
mov eax, 1
movzx ebx, cl
push 0x100b6158
cmove ebx, eax
call dword [0x100bd00c]
add esp, 8
mov dword [edi + 0x10], eax
test eax, eax
movzx ecx, bl
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0x200c], ecx
lea ebx, [eax + 2]
push str.TRUE
test byte [ecx], 0x10
push esi
mov byte [edi + 0x2d], 0
call fcn.1005f644
jb 0x100283d6
add byte [ebx - 0x3f7af73c], al
je case.default.0x10028297
cmp byte [ebp + 0x24], 0
jne 0x10028400
mov eax, dword [ebp - 0x2018]
cmp byte [eax + 0x408], 0
jne 0x10028400
mov byte [ebp - 0x200c], 1
jmp 0x1004fca4
mov byte [edi + 0x2d], 1
jmp 0x1004fcad
Function at 0x10028467
Capabilities:
Send data
Send data on socket

Disassembly:
cmp byte [ebp - 0x200c], 0
jne 0x100284c5
cmp ebx, 6
ja case.default.0x10028297
jmp dword [ebx*4 + 0x10028844]
cmp byte [esi], 0x2e
jne 0x100282a4
inc esi
push esi
call dword [0x100bd00c]
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
jne case.default.0x10028297
mov byte [ebp - 0x200c], 1
jmp 0x1004fb69
push str.TRUE
push esi
call fcn.1005f540
add esp, 8
test eax, eax
setne al
mov byte [edi + 0x2c], al
jmp 0x1004fb84
js 0x100282e1
invalid
mov ecx, esi
mov eax, str.TRUE
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10028307
test dl, dl
je 0x10028303
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10028307
add eax, 2
add ecx, 2
test dl, dl
jne 0x100282e7
xor eax, eax
jmp 0x1002830c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1002837d
mov ecx, esi
mov eax, str.FALSE
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10028337
test dl, dl
je 0x10028333
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10028337
add eax, 2
add ecx, 2
test dl, dl
jne 0x10028317
xor eax, eax
jmp 0x1002833c
sbb eax, eax
or eax, 1
test eax, eax
invalid
push str.__Host_
call 0x1005f731
add esp, 0xc
test eax, eax
je case.default.0x10028297
or byte [edi + 0x34], 2
jmp case.default.0x10028297
lea eax, [ebp - 0x201c]
push eax
push 0x1009f6b8
push 0
call fcn.1006eaa7
mov esi, eax
add esp, 0xc
inc ebx
test esi, esi
test byte [edi], 0x85
invalid
std
invalid
invalid
cmp ebx, 6
jne 0x100284e8
push 0x100b6131
call dword [0x100bd00c]
add esp, 4
cmp byte [ebp - 0x200c], 0
jne 0x10028821
cmp ebx, 7
jne 0x10028821
mov al, byte [edi + 0x34]
test al, 1
je 0x1002850f
cmp byte [edi + 0x2d], 0
je 0x10028821
test al, 2
je 0x10028566
cmp byte [edi + 0x2d], 0
je 0x10028821
mov eax, dword [edi + 0xc]
test eax, eax
je 0x10028821
mov ecx, 0x100b6158
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10028550
test dl, dl
je 0x1002854c
xor eax, eax
jmp 0x10028555

Function at 0x1002975b
Capabilities:
Hash data using djb2

Disassembly:
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x1002978e
nop dword [eax]
Function at 0x1002a6d0
Capabilities:
Encode data using base64

Disassembly:
cmp dword [edi], 0x48
jbe 0x1002a648
cmp ebx, 2
jb 0x1002a6ea
invalid
add byte [eax], al
invalid
mov word [eax], 0xa0d
add edx, 2
add eax, 2
mov dword [edi], 0
mov dword [ebp + 0x14], edx
sub ebx, 2
cmp ebx, 4
jb 0x1002a6ea
mov ecx, dword [edi + 8]
mov esi, dword [edi + 4]
sub ecx, esi
cmp ecx, 3
jb 0x1002a6ee
movzx ecx, byte [esi + edi + 0xc]
lea edx, [esi + 1]
shl ecx, 8
sub ebx, 4
mov dword [edi + 4], edx
movzx esi, byte [edx + edi + 0xc]
or esi, ecx
lea ecx, [edx + 1]
mov dword [edi + 4], ecx
movzx edx, byte [ecx + edi + 0xc]
inc ecx
mov dword [edi + 4], ecx
shl esi, 8
out 8, al
or edx, esi
mov ecx, edx
shr ecx, 0x12
movzx ecx, byte [ecx + 0x1009f800]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x1009f800]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and edx, 0x3f
and ecx, 0x3f
movzx ecx, byte [ecx + 0x1009f800]
mov byte [eax + 2], cl
movzx ecx, byte [edx + 0x1009f800]
mov edx, dword [ebp + 0x14]
mov byte [eax + 3], cl
add edx, 4
add dword [edi], 4
add eax, 4
mov ecx, dword [edi + 4]
mov dword [ebp + 0x14], edx
cmp ecx, dword [edi + 8]
jb 0x1002a623
jmp 0x1002a6ee
test edx, edx
je 0x1002a701
cmp byte [ebp + 0x10], 0
je 0x1002a779
cmp ebx, 4
jae 0x1002a70b
test edx, edx
jne 0x1002a779
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
pop ebp
ret
mov word [eax + 2], 0x3d3d
xor ebx, ebx
mov esi, dword [edi + 8]
mov ecx, dword [edi + 4]
cmp esi, ecx
je 0x1002a779
sub esi, ecx
add ecx, edi
cmp esi, 2
jne 0x1002a72d
movzx ebx, byte [ecx + 0xd]
shl ebx, 8
movzx esi, byte [ecx + 0xc]
shl esi, 0x10
or esi, ebx
mov ecx, esi
shr ecx, 0x12
movzx ecx, byte [ecx + 0x1009f800]
mov byte [eax], cl
mov ecx, esi
shr ecx, 0xc
or al, 0x83
loope 0x1002a78b
movzx ecx, byte [ecx + 0x1009f800]
mov byte [eax + 1], cl
inc dword [edi + 4]
mov ecx, dword [edi + 4]
cmp ecx, dword [edi + 8]
je 0x1002a773
shr esi, 6
and esi, 0x3f
mov cl, byte [esi + 0x1009f800]
mov byte [eax + 2], cl
inc dword [edi + 4]
add edx, 4
add dword [edi], 4
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x10035490
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ecx
push edi
push edx
call 0x100ba678
add esp, 0xc
test eax, eax
jne 0x10035539
mov ecx, dword [0x100bd020]
lea edx, [ecx + 1]
nop dword [eax]
inc eax
invalid
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100354b0
sub ecx, edx
mov byte [ebp - 0x285], 1
add edi, ecx
mov ecx, dword [ebp - 0x298]
lea eax, [ebp - 0x104]
push 0x100
push eax
push edi
push dword [ecx + 0x54]
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0x14]
push ecx
call fcn.100446d4
add esp, 0x18
sub eax, 0
je 0x1003558d
sub eax, 1
je 0x10035647
sub eax, 1
je 0x1003565d
cmp byte [ebp - 0x285], 0
jne 0x100356f7
mov ecx, dword [ebp - 0x298]
mov al, byte [ecx + 0x100]
mov byte [ebp - 0x285], al
mov eax, dword [ebp + 0x10]
cmp eax, 2
jne 0x100355bf
invalid
invalid
add byte [ecx], al
add byte [eax], al
Function at 0x100354ae
Capabilities:
Convert ip address from string
Get local ipv4 addresses
Get socket information

Disassembly:
push ecx
push edi
push edx
call 0x100ba678
add esp, 0xc
test eax, eax
jne 0x10035539
mov ecx, dword [0x100bd020]
lea edx, [ecx + 1]
nop dword [eax]
inc eax
invalid
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100354b0
sub ecx, edx
mov byte [ebp - 0x285], 1
add edi, ecx
mov ecx, dword [ebp - 0x298]
lea eax, [ebp - 0x104]
push 0x100
push eax
push edi
push dword [ecx + 0x54]
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0x14]
push ecx
call fcn.100446d4
add esp, 0x18
sub eax, 0
je 0x1003558d
sub eax, 1
je 0x10035647
sub eax, 1
je 0x1003565d
cmp byte [ebp - 0x285], 0
jne 0x100356f7
mov ecx, dword [ebp - 0x298]
mov al, byte [ecx + 0x100]
mov byte [ebp - 0x285], al
mov eax, dword [ebp + 0x10]
cmp eax, 2
jne 0x100355bf
invalid
invalid
add byte [ecx], al
add byte [eax], al

Function at 0x10035729
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jne 0x1003574d
push esi
mov word [ebp - 0x284], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x282], ax
mov eax, 0x1c
mov dword [ebp - 0x290], eax
jmp 0x10035776
cmp eax, 2
jne 0x10035774
push esi
mov word [ebp - 0x284], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x282], ax
mov eax, 0x10
invalid
invalid
invalid
Function at 0x1003651f
Capabilities:
Get common file path

Disassembly:
jmp 0x100364ad
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x100364c6
mov dword [0x100c1af4], esi
jmp 0x1006becb
push ebx
push str.LoadLibraryExA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100a03f4
push str.iphlpapi.dll
mov ebx, eax
call 0x100bbe5a
add esp, 8
test eax, eax
je 0x10036513
test ebx, ebx
je 0x10036501
push 8
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x1006bede
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x1006bef0
test ebx, ebx
je 0x1003653c
push str.AddDllDirectory
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lock or dword [eax], edx
test eax, eax
je 0x1003653c
push 0x800
push 0
push str.iphlpapi.dll
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x198], eax
test eax, eax
je 0x100365dd
lea ecx, [eax + 0xd]
push ecx
call dword [section..data]
mov edi, eax
add esp, 4
add al, 0x85
invalid
je 0x100365d3
push dword [ebp - 0x198]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100365d3
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10036580
sub ecx, edx
mov eax, 0x5c
mov edx, edi
mov word [ecx + edi], ax
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10036597
sub edx, ecx
mov ecx, str.iphlpapi.dll
sub edx, ecx
add edx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100365b0
test ebx, ebx
je 0x100365ca
push 8
push 0
push edi
call ebx
jmp 0x100365d1
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
call dword [0x100bd004]
add esp, 4
mov dword [0x100c1af4], esi
pop ebx
test esi, esi
je 0x10036605
push str.if_nametoindex
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x100c1af0]
test eax, eax
cmovne ecx, eax
mov dword [0x100c1af0], ecx
sbb cl, byte [eax + edx]
or byte [eax], al
add byte [eax], al
add cl, ch
movsd dword es:[edi], dword [esi]
mov bh, 6
add byte [eax - 0x47fcf15], al
or dword [edi], ecx
xchg edx, ecx
sti
invalid
jmp 0x1006bf22
add al, 0
add byte [ebx - 0x37fce7b2], cl
Function at 0x10039a2c
Capabilities:
Convert ip address from string

Disassembly:
lds ecx, [ecx - 0x74a903bb]
jne 0x10039a3c
lea eax, [ebp - 0x18]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
adc eax, sym.imp.WS2_32.dll_inet_pton
test eax, eax
jg 0x10039a66
lea eax, [ebp - 0x14]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
pop esi
setg al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x100abe31
mov esp, ebp
pop ebp
ret
invalid
dec ebp

Function at 0x1003a31d
Capabilities:
Convert ip address from string

Disassembly:
adc al, 0xf3
movd dword [str.localhost], mm0

Function at 0x1003a368
Capabilities:
Convert ip address from string

Disassembly:
push eax
push 0x100a09d0
push 0x17
mov dword [ebp - 0x60], 0
Function at 0x1003d68a
Capabilities:
Check http status code

Disassembly:
je 0x1003d6bb
push 5
push str.close
push 0x11
push str.Proxy_Connection:
push edi
call 0x10078f00
add esp, 0x14
test al, al
je 0x1003d6bb
push 1
push ebx
call fcn.10070d6f
add esp, 8
cmp byte [ebx + 0x118], 0xa
jne 0x1003d6f3
push 0xa
push str.keep_alive
push 0xb
push str.Connection:
push edi
call fcn.10078f38
add esp, 0x14
test al, al
je 0x1003d6f3
push 0
push ebx
call fcn.10070da7
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push str.close
push 0xb
push str.Connection:
push edi
call fcn.10078f67
add esp, 0x14
test al, al
je 0x1003d722
push 2
push ebx
call 0x10070dd6
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0x141], 0
jne 0x1003d7c5
push 0x12
push str.Transfer_Encoding:
push edi
call fcn.10074b1c
add esp, 0xc
test eax, eax
je 0x1003d781
push 1
lea eax, [edi + 0x12]
push eax
push esi
call fcn.100752cf
add esp, 0xc
test eax, eax
jne 0x1003d6b4
cmp byte [esi + 0x142], al
jne 0x1003d6b2
push 1
push ebx
call fcn.10070e2e
cmp byte [esi + 0x141], 0
jne 0x1003d7c5
push 0x11
push str.Content_Encoding:
push edi
call fcn.10074b77
add esp, 0xc
test eax, eax
je 0x1003d7c5
cmp dword [esi + 0x53c], 0
je 0x1003d7c5
push 0
lea eax, [edi + 0x11]
push eax
push esi
call fcn.10075333
add esp, 0xc
test eax, eax
je 0x1003d6b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xc
push str.Retry_After:
push edi
call fcn.10074bb2
add esp, 0xc
test eax, eax
je 0x1003d84e
lea eax, [edi + 0xc]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 8], xmm0
cmp byte [esi + 0x141], 0
jne fcn.1003d913
push 0xe
push str.Content_Range:
push edi
call fcn.10074c48
add esp, 0xc
test eax, eax
je fcn.1003d913
mov al, byte [edi + 0xe]
add edi, 0xe
test al, al
je 0x1003d89d
nop dword [eax]
movzx eax, al
push eax
call fcn.1009bc19
add esp, 4
test eax, eax
jne 0x1003d89d
cmp byte [edi], 0x2a
je 0x1003d89d
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003d880
movzx eax, byte [edi]
push eax
call fcn.1009bc36
add esp, 4
test eax, eax
je 0x1003d8f6
lea ebx, [esi + 0xe8]
push ebx
push 0xa
push 0
push edi
call fcn.10083f2e
add esp, 0x10
test eax, eax
jne 0x1003d6b2
mov eax, dword [esi + 0xc20]
cmp eax, dword [ebx]
jne 0x1003d6b2
mov eax, dword [esi + 0xc24]
cmp eax, dword [ebx + 4]
jne 0x1003d6b2
pop edi
mov byte [esi + 0x13e], 1
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi + 0xc20], 0
xor eax, eax
mov dword [esi + 0xc24], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100431f3
Capabilities:
Get socket status

Disassembly:
dec dword [ecx - 0x20b4b]
dec dword [ecx - 0x3137b]
dec dword [ecx - 0x31b6b]
dec dword [ecx - 0x31773]
dec dword [edi]
pop ds
inc eax
add byte [ebx], dh
fisttp dword [ecx - 0x31f7b]
jmp dword [esi - 0x77]

Function at 0x10043224
Capabilities:
Get socket status

Disassembly:
pop es
add dword [eax], eax
add byte [edi], cl
add dword [ecx + 1], 0
add byte [ebx - 0x3177b], cl
dec dword [edi]
mov bh, 0
Function at 0x1004325e
Capabilities:
Get socket status

Disassembly:
xor ebx, ebx
mov dword [ebp - 0x320], eax
mov word [ecx + 2], bx
mov ecx, dword [ecx - 4]
cmp ecx, 0xffffffff
je 0x1004332f
pop es
add dword [eax], eax
invalid
jae 0x1004336f
mov eax, dword [ebp - 0x318]
movzx eax, word [eax]
movzx ebx, ax
mov dword [ebp - 0x330], ebx
mov ebx, dword [ebp - 0x320]
mov dword [ebp - 0x324], eax
test eax, 0x710
je 0x10043329
cmp ecx, ebx
mov eax, ecx
cmovbe eax, ebx
test dword [ebp - 0x324], 0x300
mov dword [ebp - 0x314], eax
je 0x100432a1
xor eax, eax
test edi, edi
je 0x10043284
cmp dword [ebp + eax*4 - 0x104], ecx
je 0x10043284
inc eax
cmp eax, edi
jb 0x10043276
cmp eax, edi
jne 0x100432a1
cmp edi, 0x40
jae 0x100432a1
mov dword [ebp + eax*4 - 0x104], ecx
mov edi, dword [ebp - 0x108]
inc edi
mov dword [ebp - 0x108], edi
mov ebx, dword [ebp - 0x330]
test bl, 0x10
je 0x100432dd
xor eax, eax
test esi, esi
je 0x100432c0
cmp dword [ebp + eax*4 - 0x208], ecx
je 0x100432c0
inc eax
cmp eax, esi
jb 0x100432b2
cmp eax, esi
jne 0x100432dd
cmp esi, 0x40
jae 0x100432dd
mov dword [ebp + eax*4 - 0x208], ecx
mov esi, dword [ebp - 0x20c]
inc esi
mov dword [ebp - 0x20c], esi
test ebx, 0x600
je 0x10043329
xor eax, eax
test edx, edx
je 0x100432fe
nop dword [eax + eax]
cmp dword [ebp + eax*4 - 0x30c], ecx
je 0x100432fe
inc eax
cmp eax, edx
jne 0x1004331b
cmp edx, 0x40
jae 0x1004331b
mov dword [ebp + eax*4 - 0x30c], ecx
mov edx, dword [ebp - 0x310]
inc edx
mov dword [ebp - 0x310], edx
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x314], eax
cld
invalid
invalid
jmp 0x1004332f
mov eax, dword [ebp - 0x314]
mov ecx, dword [ebp + 0x42732e8]
add byte [ebp - 0x31c], al
add ecx, 8
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x318], ecx
cmp dword [ebp - 0x31c], ebx
jb 0x10043210
invalid
invalid
invalid
invalid
invalid
test edi, edi
jne 0x1004338e
test esi, esi
jne 0x1004338e
test edx, edx
jne 0x1004338e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10085daa
add esp, 8
les ecx, [eax]
jmp 0x100433e6
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x100b5759
pop es
invalid
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
lea eax, [ebp - 0x334]
push dword [ebp + 0x10]
push eax
call 0x100a7430
add esp, 0xc
lea esi, [ebp - 0x310]
lea ecx, [ebp - 0x20c]
push eax
xor eax, eax
cmp dword [ebp - 0x310], eax
cmove esi, eax
cmp dword [ebp - 0x20c], eax
push esi
cmove ecx, eax
xor edi, edi
cmp dword [ebp - 0x108], edi
lea eax, [ebp - 0x108]
push ecx
cmove eax, edi
push eax
mov eax, dword [ebp - 0x314]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jg 0x10043414
cmp esi, 0xffffffff
mov esi, dword [ebp - 0x328]
xor edi, edi
add esi, 6
nop
xor eax, eax
mov word [esi], ax
mov eax, dword [esi - 6]
invalid

Function at 0x10043388
Capabilities:
Get socket status

Disassembly:
pop es
add byte [ebx - 0x3ca21b], cl
jne 0x100433a5
invalid