joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a11b0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73b0c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.005a0fe0
mov ebx, eax
mov dword [ebp - 0x14], ebx
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov esi, dword [ebp + 8]
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov edi, eax
shr edi, 0x10
xor edi, eax
xor ecx, ecx
nop dword [eax]
lea eax, [ecx + edi]
and eax, 0x3fff
lea edx, [ebx + eax*8]
mov eax, dword [edx + 8]
test eax, eax
je 0x5a122f
cmp eax, esi
je 0x5a1247
inc ecx
cmp ecx, 0x4000
jb 0x5a1210
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
mov edi, 1
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], edi
je 0x5a125d
mov edi, eax
mov dword [ebp - 0x10], edi
sub eax, edi
mov dword [edx + 0xc], eax
jne 0x5a126b
mov dword [edx + 8], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x5a1236
mov ecx, dword [0x155fab8]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0x18], ecx
nop dword [eax + eax]
mov eax, dword [0x151c5b4]
mov ebx, dword [ebx + 4]
cmp eax, dword [ecx + 0x78c]
jg 0x5a12cd
push 0
push 0
push esi
push ebx
call dword [0x151c5b0]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test eax, eax
js 0x5a1290
sub dword [ebp - 0x10], 1
jne 0x5a1290
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x151c5b4
call fcn.006fee91
add esp, 4
cmp dword [0x151c5b4], 0xffffffff
jne 0x5a12a0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.NtReleaseKeyedEvent
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x151c5b4
mov dword [0x151c5b0], esi
call fcn.006fee47
mov esi, dword [ebp + 8]
add esp, 4
jmp 0x5a12a0
Function at 0x5a1490
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73b0c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
call fcn.005a1430
mov edi, eax
mov dword [ebp - 0x10], edi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx]
cmp edx, dword [ecx]
jne 0x5a1538
mov eax, ebx
shr eax, 0x10
xor eax, ebx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
xor esi, esi
mov dword [ebp + 8], ecx
nop word [eax + eax]
lea eax, [esi + ecx]
and eax, 0x3fff
lea edi, [edi + eax*8]
add edi, 8
mov edx, dword [edi]
test edx, edx
je 0x5a1519
cmp edx, 0xffffffff
jne 0x5a1528
mov ecx, ebx
mov eax, edx
lock cmpxchg dword [edi], ecx
cmp eax, edx
je 0x5a1550
mov ecx, dword [ebp + 8]
cmp edx, ebx
je 0x5a1550
mov edi, dword [ebp - 0x10]
inc esi
cmp esi, 0x4000
jb 0x5a1500
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lock inc dword [edi + 4]
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov eax, dword [esi + 4]
mov ecx, dword [0x155fab8]
mov dword [ebp + 8], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x153c5d4]
cmp eax, dword [ecx + 0x78c]
jg 0x5a159f
push 0
push 0
push ebx
push dword [ebp + 8]
call dword [0x153c5d0]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x153c5d4
call fcn.006fee91
add esp, 4
cmp dword [0x153c5d4], 0xffffffff
jne 0x5a1580
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.NtWaitForKeyedEvent
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x153c5d4
mov dword [0x153c5d0], esi
call fcn.006fee47
add esp, 4
jmp 0x5a1580
Function at 0x5a1600
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73b0c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.005a1430
mov ebx, eax
mov dword [ebp - 0x14], ebx
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov esi, dword [ebp + 8]
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov edi, eax
shr edi, 0x10
xor edi, eax
xor ecx, ecx
nop dword [eax]
lea eax, [ecx + edi]
and eax, 0x3fff
lea edx, [ebx + eax*8]
mov eax, dword [edx + 8]
test eax, eax
je 0x5a167f
cmp eax, esi
je 0x5a1697
inc ecx
cmp ecx, 0x4000
jb 0x5a1660
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
mov edi, 1
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], edi
je 0x5a16ad
mov edi, eax
mov dword [ebp - 0x10], edi
sub eax, edi
mov dword [edx + 0xc], eax
jne 0x5a16bb
mov dword [edx + 8], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x5a1686
mov ecx, dword [0x155fab8]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0x18], ecx
nop dword [eax + eax]
mov eax, dword [0x153c5dc]
mov ebx, dword [ebx + 4]
cmp eax, dword [ecx + 0x78c]
jg 0x5a171d
push 0
push 0
push esi
push ebx
call dword [0x153c5d8]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test eax, eax
js 0x5a16e0
sub dword [ebp - 0x10], 1
jne 0x5a16e0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x153c5dc
call fcn.006fee91
add esp, 4
cmp dword [0x153c5dc], 0xffffffff
jne 0x5a16f0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.NtReleaseKeyedEvent
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x153c5dc
mov dword [0x153c5d8], esi
call fcn.006fee47
mov esi, dword [ebp + 8]
add esp, 4
jmp 0x5a16f0
Function at 0x5aaa90
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5aab45
push esi
call fcn.005bb8b0
add esp, 4
test al, al
jne 0x5aab45
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x5aaac0
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.005c7e30
add esp, 0xc
test eax, eax
je 0x5aaaf4
sub eax, esi
push eax
push 0x2e
push esi
call fcn.005c7e30
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x5aaaf6
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x5aab23
mov al, byte [esi]
push eax
call fcn.005bdef0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x5aab05
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x5b9720
Capabilities:
Get common file path
Initialize winsock library
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
test byte [ebp + 8], 2
je 0x5b9765
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5b975c
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x5b9756
shr eax, 8
cmp al, 2
je 0x5b9765
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x78ac00
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 8], eax
test eax, eax
jne 0x5b978c
mov dword [0x155c6e4], esi
jmp 0x5b98b9
push ebx
push str.LoadLibraryExA
push eax
call edi
push 0x79d2b8
push str.iphlpapi.dll
mov ebx, eax
call fcn.0071dca0
add esp, 8
test eax, eax
je 0x5b97d5
test ebx, ebx
je 0x5b97c3
push 8
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x5b9895
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x5b9895
test ebx, ebx
je 0x5b97fc
push str.AddDllDirectory
push dword [ebp + 8]
call edi
test eax, eax
je 0x5b97fc
push 0x800
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x5b9895
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp + 8], eax
test eax, eax
je 0x5b9895
lea ecx, [eax + 0xd]
push ecx
call dword [0x8f1cac]
mov edi, eax
add esp, 4
test edi, edi
je 0x5b9885
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x5b9885
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b9837
sub ecx, edx
mov eax, 0x5c
mov edx, edi
mov word [ecx + edi], ax
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x5b9850
sub edx, ecx
mov ecx, str.iphlpapi.dll
sub edx, ecx
add edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x5b9862
test ebx, ebx
je 0x5b987c
push 8
push 0
push edi
call ebx
jmp 0x5b9883
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
call dword [0x8f1cb0]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov dword [0x155c6e4], esi
pop ebx
test esi, esi
je 0x5b98b9
push str.if_nametoindex
push esi
call edi
mov ecx, dword [0x155c6d4]
test eax, eax
cmovne ecx, eax
mov dword [0x155c6d4], ecx
push str.ws2_32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x5b98f1
push str.FreeAddrInfoExW
push esi
call edi
push str.GetAddrInfoExCancel
push esi
mov dword [0x155c6d8], eax
call edi
push str.GetAddrInfoExW
push esi
mov dword [0x155c6dc], eax
call edi
mov dword [0x155c6e0], eax
push 3
push 2
push 0
push 0
push 6
call fcn.005d70f0
push 3
push 2
push 0
test al, al
push 2
push 6
setne byte [0x15608c1]
call fcn.005d70f0
add esp, 0x28
test al, al
setne byte [0x15608c0]
push 0x15608c8
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bb8b0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x5bb8e2
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x5bb8e2
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x5bba30
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5bba71
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x104], 0
jne 0x5bba64
push 0
call fcn.005bba30
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x104], cl
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x104], 2
pop esi
sete al
pop ebp
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x5bba87
xor al, al
pop esi
pop ebp
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
pop ebp
ret
Function at 0x5bc7a0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x64
push edi
xor edi, edi
cmp byte [eax + 0x673], 0
je 0x5bc95f
push ebx
mov ebx, dword [ebp + 0xc]
add ebx, 0x18
cmp byte [ebx], 0
je 0x5bc95e
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [ebp - 4]
push eax
push ebx
push 2
call esi
test eax, eax
jg 0x5bc95d
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x17
call esi
test eax, eax
jg 0x5bc95d
mov ecx, dword [ebp + 0xc]
mov eax, str._none_
cmp byte [ebx], 0
cmovne eax, ebx
mov ebx, dword [ebp + 8]
push dword [ecx + 0x14]
mov esi, dword [ecx]
push eax
push str.Host__s:_d_was_resolved.
push ebx
call fcn.005b6fd0
lea eax, [ebp - 0x34]
push 0x400
push eax
call fcn.005ab0f0
lea eax, [ebp - 0x24]
push 0x400
push eax
call fcn.005ab0f0
add esp, 0x20
test esi, esi
je 0x5bc8d4
lea edx, [edi + 0x10]
nop
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x5bc84d
cmp ecx, 2
jne 0x5bc8c6
xor eax, eax
mov byte [ebp - 0x64], 0
cmp ecx, 2
lea ebx, [ebp - 0x34]
cmovne eax, edx
add ebx, eax
sub ecx, 2
je 0x5bc879
sub ecx, 0x15
jne 0x5bc88d
push 0x2e
lea eax, [ebp - 0x64]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x5bc888
push 0x2e
lea eax, [ebp - 0x64]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call sub.WS2_32.dll_inet_ntop
push ebx
call fcn.005ab120
add esp, 4
test eax, eax
je 0x5bc8ac
push 2
push 0x761cd8
push ebx
call fcn.005ab0b0
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x5bc8f2
lea eax, [ebp - 0x64]
push eax
push ebx
call fcn.005ab050
mov edi, eax
add esp, 8
test edi, edi
jne 0x5bc8f2
lea edx, [eax + 0x10]
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x5bc840
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.005ab120
add esp, 4
test eax, eax
je 0x5bc905
lea eax, [ebp - 0x24]
push eax
call fcn.0056d520
add esp, 4
jmp 0x5bc90a
mov eax, dword [ebp + 8]
push str.too_many_IP__cant_show
push eax
call fcn.005b6fd0
add esp, 8
jmp 0x5bc948
mov eax, str._none_
push eax
push str.IPv6:__s
push ebx
call fcn.005b6fd0
lea eax, [ebp - 0x34]
push eax
call fcn.005ab120
add esp, 0x10
test eax, eax
je 0x5bc934
lea eax, [ebp - 0x34]
push eax
call fcn.0056d520
add esp, 4
jmp 0x5bc939
mov eax, str._none_
push eax
push str.IPv4:__s
push ebx
call fcn.005b6fd0
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
call fcn.005ab0c0
lea eax, [ebp - 0x24]
push eax
call fcn.005ab0c0
add esp, 8
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5c8540
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.005aae10
push dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10], xmm0
call fcn.0072160f
push dword [ebp + 0xc]
mov edi, eax
call fcn.0072160f
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x5c85c7
lea eax, [ebp - 0x20]
push eax
call fcn.005aae10
movups xmm0, xmmword [ebp - 0x10]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.005aaec0
add esp, 0x20
test edx, edx
ja 0x5c85ea
jb 0x5c85b5
cmp eax, 0x3e8
ja 0x5c85ea
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x5c8580
test edi, edi
je 0x5c85d4
push edi
call fcn.0071033c
add esp, 4
test esi, esi
je 0x5c85e1
push esi
call fcn.0071033c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x5c85f7
push edi
call fcn.0071033c
add esp, 4
test esi, esi
je 0x5c8604
push esi
call fcn.0071033c
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c8a70
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
test eax, eax
jne 0x5c8c07
push esi
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x5c8bf3
push edi
nop dword [eax]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5c8ace
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5c8ac0
sub eax, edx
lea ecx, [eax + 1]
jmp 0x5c8ad0
xor ecx, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], ecx
cmp eax, 2
jne 0x5c8ae2
mov eax, 0x10
jmp 0x5c8af0
cmp eax, 0x17
jne 0x5c8b95
mov eax, 0x1c
cmp dword [esi + 0x18], 0
mov dword [ebp - 4], eax
je 0x5c8b95
mov edx, dword [esi + 0x10]
test edx, edx
je 0x5c8b95
cmp edx, eax
jb 0x5c8b95
add ecx, 0x20
add eax, ecx
push eax
call dword [0x8f1cac]
mov edi, eax
add esp, 4
test edi, edi
je 0x5c8be5
mov ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x20]
push ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
push dword [esi + 0x18]
push eax
call fcn.00700d60
mov edx, dword [ebp - 0xc]
add esp, 0xc
test edx, edx
je 0x5c8b83
mov eax, dword [edi + 0x18]
add eax, dword [ebp - 4]
push edx
mov dword [edi + 0x14], eax
push dword [esi + 0x14]
push eax
call fcn.00700d60
add esp, 0xc
mov eax, dword [ebp - 0x10]
test ebx, ebx
cmove ebx, edi
test eax, eax
je 0x5c8b92
mov dword [eax + 0x1c], edi
mov dword [ebp - 0x10], edi
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x5c8ab0
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
pop edi
test eax, eax
je 0x5c8bb2
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x5c8bef
test ebx, ebx
je 0x5c8bd6
nop word [eax + eax]
mov esi, dword [ebx + 0x1c]
push ebx
call dword [0x8f1cb0]
add esp, 4
mov ebx, esi
test esi, esi
jne 0x5c8bc0
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 8
mov dword [ebp - 8], esi
jmp 0x5c8ba3
test ebx, ebx
jne 0x5c8bff
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c8e00
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
mov esi, dword [ebp + 8]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x5c8e32
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push esi
push eax
push 2
call fcn.005c8c10
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x5c8e5a
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push esi
push eax
push 0x17
call fcn.005c8c10
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5c8fd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.007116bf
add esp, 0x18
test eax, eax
je 0x5c8ff2
cmp eax, 0xffffffff
jne 0x5c8ff4
xor eax, eax
pop ebp
ret

Function at 0x5c9040
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, 0x2b
test edi, edi
je 0x5c90e7
mov esi, dword [ebp + 0xc]
nop dword [eax]
push 4
lea eax, [ebp + 0x10]
mov ebx, 4
push eax
push dword [ebp + 8]
cmp edi, ebx
cmovb ebx, edi
call fcn.005b0c30
add esp, 0xc
cmp eax, 4
jne 0x5c90a5
cmp byte [0x155c6ec], 0
jne 0x5c90b0
push 2
push eax
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x5c90e9
mov eax, dword [ebp + 0x10]
jmp 0x5c90cc
imul eax, dword [0x155c6e8], 0x41c64e6d
add eax, 0x3039
mov dword [0x155c6e8], eax
rol eax, 0x10
xor ecx, ecx
mov dword [ebp + 0x10], eax
test ebx, ebx
je 0x5c90df
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x5c90d0
mov dword [ebp + 0x10], eax
test edi, edi
jne 0x5c9060
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5c90f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
sub ebx, 1
je 0x5c9188
mov esi, dword [ebp + 8]
push 4
lea eax, [ebp + 0x10]
push eax
push esi
call fcn.005b0c30
add esp, 0xc
cmp eax, 4
je 0x5c9122
test eax, eax
jne 0x5c918d
jmp 0x5c9169
cmp byte [0x155c6ec], 0
jne 0x5c914f
push 2
push 4
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
je 0x5c9169
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret
imul eax, dword [0x155c6e8], 0x41c64e6d
add eax, 0x3039
mov dword [0x155c6e8], eax
rol eax, 0x10
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0xfffffffc
jae 0x5c9108
xor edx, edx
mov ecx, 0x3e
div ecx
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x5c9108
mov byte [edi], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5c91a0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x88
mov eax, edx
and eax, 0xfffffffe
cmp eax, 0x100
jae 0x5c9293
test dl, 1
je 0x5c9293
push ebx
push esi
push edi
lea edi, [edx - 1]
mov ecx, 0x2b
shr edi, 1
lea esi, [ebp - 0x88]
mov dword [ebp - 8], edi
mov ebx, edi
je 0x5c9270
push 4
lea eax, [ebp - 4]
mov edi, 4
push eax
push dword [ebp + 8]
cmp ebx, edi
cmovb edi, ebx
call fcn.005b0c30
add esp, 0xc
cmp eax, 4
jne 0x5c9228
cmp byte [0x155c6ec], 0
jne 0x5c9233
push 2
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x5c928c
mov eax, dword [ebp - 4]
jmp 0x5c924f
imul eax, dword [0x155c6e8], 0x41c64e6d
add eax, 0x3039
mov dword [0x155c6e8], eax
rol eax, 0x10
xor ecx, ecx
mov dword [ebp - 4], eax
test edi, edi
je 0x5c9262
mov byte [esi], al
dec ebx
inc esi
shr eax, 8
sub edi, 1
jne 0x5c9253
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x5c91e3
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp - 8]
mov eax, ecx
test eax, eax
jne 0x5c928c
push edx
push dword [ebp + 0xc]
lea eax, [ebp - 0x88]
push edi
push eax
call fcn.005d0ce0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x2b
mov esp, ebp
pop ebp
ret