joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000daf0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1000db36
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push esi
push eax
push 2
call fcn.1000da20
add esp, 0x10
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1000db68
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push esi
push eax
push 0x17
call fcn.1000da20
add esp, 0x10
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100526c8
mov esp, ebp
pop ebp
ret

Function at 0x1000e760
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x1000e793
push 0x2e
push edi
call fcn.100542b0
add esp, 8
test eax, eax
je 0x1000e791
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x1000ec90
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1000ed28
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x18], xmm0
push edi
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.1000ed90
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.1000dc30
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1000ed3a
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100526c8
mov esp, ebp
pop ebp
ret
Function at 0x10010990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.10054f3f
add esp, 0x18
test eax, eax
je 0x100109b2
cmp eax, 0xffffffff
jne 0x100109b4
xor eax, eax
pop ebp
ret

Function at 0x10010a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x68a], 0
je 0x10010aa7
cmp dword [esi + 0x194], 0
je 0x10010a71
push esi
call fcn.10030300
push 1
push esi
mov byte [ebp + 8], al
call fcn.100307e0
push dword [esi + 0x144]
mov eax, dword [esi + 0x194]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
push dword [ebp + 8]
push esi
call fcn.100307e0
add esp, 0x28
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x10010aa7
push dword [esi + 0x140]
lea eax, [eax + eax*2]
push 1
add eax, 0x1006bdc0
push 2
push eax
call fcn.100552c5
push dword [esi + 0x140]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.100552c5
add esp, 0x20
pop esi
pop ebp
ret

Function at 0x10013840
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, eax
lea esp, [esp]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
call esi
sub eax, edi
cmp eax, 0x1f4
jb 0x10013860
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10013bd0
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1006c2d8
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
push 0x1007fc24
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
cmp dword [0x1007fc28], 0
jne 0x10013c2a
push 1
push 3
call fcn.100144c0
add esp, 8
test eax, eax
je 0x10013c2a
push 0x1007fc24
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
push 0x1007fc24
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea eax, [ebp - 0x14]
push eax
call fcn.1004a560
add esp, 4
test eax, eax
jne 0x10013c1a
push str.global_init_lock
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1007fc24
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x42413656
push eax
mov dword [ebp - 0xc], 0x34414244
mov word [ebp - 8], 0x30
call fcn.10001210
add esp, 4
call fcn.10013840
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
Function at 0x10016f80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
mov ebx, dword [edi + 0x18]
mov esi, dword [ebx + 0x1a4]
push esi
mov dword [ebp - 0x88], 0xffffffff
mov dword [ebp - 0x8c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x10016ff6
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 0x88], eax
jmp 0x10016ffc
mov eax, dword [ebp - 0x88]
cmp eax, 0xffffffff
jne 0x10017025
push str.Error_accept__ing_server_connect
push edi
call fcn.10010ab0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server
push edi
call fcn.10010b70
mov byte [ebx + 0x24d], 0
push 1
push dword [ebp - 0x88]
call fcn.10034570
lea eax, [ebp - 0x88]
push eax
push 1
push ebx
push edi
call fcn.10006de0
mov esi, eax
add esp, 0x20
test esi, esi
je 0x1001707c
push dword [ebp - 0x88]
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x19c], 0
je 0x100170d4
push 1
push edi
call fcn.100307e0
mov eax, dword [edi + 0x19c]
push 1
push dword [ebp - 0x88]
push dword [edi + 0x1a0]
call eax
push 0
push edi
mov esi, eax
call fcn.100307e0
add esp, 0x1c
test esi, esi
je 0x100170d4
push ebx
push edi
call fcn.100176b0
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100526c8
mov esp, ebp
pop ebp
ret

Function at 0x10019c40
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, 0x51eb851f
imul ecx
push ebx
sar edx, 5
push esi
mov esi, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
mov ebx, dword [esi + 0x18]
cmp eax, 2
je 0x10019c7d
push str.Couldnt_set_desired_mode
push esi
call fcn.10010ab0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x10019c94
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.10010b70
add esp, 0xc
mov al, byte [ebp + 0x10]
cmp al, 0x13
jne 0x10019cac
push ebx
push esi
call fcn.10019850
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x14
jne 0x10019cc0
push esi
call fcn.10018730
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x15
jne 0x10019cd8
push 0xd
push 1
push esi
call fcn.10019320
add esp, 0xc
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x16
jne 0x10019ceb
push 0xe
push 1
push esi
call fcn.10019320
add esp, 0xc
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001c910
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001c880

Function at 0x1001e450
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x1007d2a0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1001e47d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x1001e4c4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x1001e4ca
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x1001e52a
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0x1001e4f0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x1001e557
nop
mov eax, dword [esi + 4]
push 1
push str.6:_u
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x1006ebe7
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x1001e530
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001e870
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1001e8b7
lea eax, [ebp - 0x14]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1001e8b7
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100526c8
mov esp, ebp
pop ebp
ret

Function at 0x1001e8d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1001e8f1
cmp dword [esi + 0x84], 0
je 0x1001e8f1
push 2
push 3
push esi
call fcn.1003e8f0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.1001d930
add esp, 4
test esi, esi
je 0x1001e914
cmp dword [esi + 0x84], 0
je 0x1001e914
push 3
push esi
call fcn.1003e930
add esp, 8
pop esi
pop ebp
ret
Function at 0x1001ea20
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1001ea63
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x10c], 0
jne 0x1001ea51
push 0
call fcn.1001ea20
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x10c], cl
mov ecx, dword [esi + 0x7c]
xor eax, eax
pop esi
cmp byte [ecx + 0x10c], 2
sete al
pop ebp
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x1001ea80
xor esi, esi
xor eax, eax
test esi, esi
pop esi
setg al
pop ebp
ret
push eax
mov esi, 1
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
test esi, esi
pop esi
setg al
pop ebp
ret
Function at 0x1001f7a0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1001f7b0
push dword [ebp + 8]
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebp - 0x14], xmm0
sub esi, ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 4]
push eax
push str.127.0.0.1
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jge 0x1001f7f5
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x31]
push eax
push 1
call dword [0x1007d2b0]
mov esi, eax
add esp, 8
test esi, esi
je 0x1001f7ed
movdqu xmm0, xmmword [ebp - 0x14]
lea eax, [esi + 0x20]
mov dword [esi], 0
mov dword [esi + 0x18], eax
mov edx, edi
mov dword [esi + 4], 2
mov dword [esi + 8], 1
mov dword [esi + 0xc], 6
mov dword [esi + 0x10], 0x10
movdqu xmmword [eax], xmm0
mov ecx, dword [esi + 0x18]
add ecx, 0x10
mov dword [esi + 0x14], ecx
lea esp, [esp]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x1001f850
push edi
push dword [ebp + 8]
call fcn.1001f880
add esp, 8
test eax, eax
jne 0x1001f876
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov dword [eax + 0x1c], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001f880
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001f8a0
sub ecx, edx
lea eax, [ecx + 0x3d]
push eax
push 1
call dword [0x1007d2b0]
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001f8d0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov eax, 0x17
mov word [ebp - 0x30], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x14]
push eax
push 0x1006ec68
push 0x17
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jl 0x1001f8be
movdqu xmm0, xmmword [ebp - 0x14]
push 0x1c
lea ecx, [ebp - 0x30]
mov dword [edi], 0
lea eax, [edi + 0x20]
mov dword [edi + 4], 0x17
push ecx
push eax
movdqu xmmword [ebp - 0x28], xmm0
mov dword [edi + 8], 1
mov dword [edi + 0xc], 6
mov dword [edi + 0x10], 0x1c
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
call fcn.100538f0
mov ecx, dword [edi + 0x18]
add esp, 0xc
add ecx, 0x1c
mov dword [edi + 0x14], ecx
jmp 0x1001f960
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x1001f960
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.100526c8
mov esp, ebp
pop ebp
ret
Function at 0x1001f9e0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0x48], eax
cmp byte [eax + 0x68a], 0
mov dword [ebp - 0x4c], esi
je 0x1001fbad
cmp byte [esi + 0x18], 0
push ebx
lea ebx, [esi + 0x18]
je 0x1001fbac
lea eax, [ebp - 0x70]
push eax
push ebx
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1001fbac
lea eax, [ebp - 0x44]
push eax
push ebx
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1001fbac
mov ecx, dword [ebp - 0x4c]
mov eax, str._none_
cmp byte [ebx], 0
mov esi, dword [esi]
cmovne eax, ebx
mov ebx, dword [ebp - 0x48]
push dword [ecx + 0x14]
push eax
push str.Host__s:_d_was_resolved.
push ebx
call fcn.10010b70
lea eax, [ebp - 0x6c]
push 0x400
push eax
call fcn.10013120
lea eax, [ebp - 0x5c]
push 0x400
push eax
call fcn.10013120
add esp, 0x20
test esi, esi
je 0x1001fb24
mov edi, edi
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x1001fa9d
cmp ecx, 2
jne 0x1001fb16
xor eax, eax
mov byte [ebp - 0x34], 0
cmp ecx, 2
lea ebx, [ebp - 0x6c]
setne al
shl eax, 4
add ebx, eax
sub ecx, 2
je 0x1001facc
sub ecx, 0x15
jne 0x1001fae0
push 0x2e
lea eax, [ebp - 0x34]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x1001fadb
push 0x2e
lea eax, [ebp - 0x34]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call sub.WS2_32.dll_inet_ntop
push ebx
call fcn.10013150
add esp, 4
test eax, eax
je 0x1001faff
push 2
push 0x1006be00
push ebx
call fcn.100130e0
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x1001fb42
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.10013080
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001fb42
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x1001fa90
mov ebx, dword [ebp - 0x48]
lea eax, [ebp - 0x5c]
push eax
call fcn.10013150
add esp, 4
test eax, eax
je 0x1001fb54
lea eax, [ebp - 0x5c]
push eax
call fcn.10013210
add esp, 4
jmp 0x1001fb59
push str.too_many_IP__cant_show
push dword [ebp - 0x48]
call fcn.10010b70
add esp, 8
jmp 0x1001fb97
mov eax, str._none_
push eax
push str.IPv6:__s
push ebx
call fcn.10010b70
lea eax, [ebp - 0x6c]
push eax
call fcn.10013150
add esp, 0x10
test eax, eax
je 0x1001fb83
lea eax, [ebp - 0x6c]
push eax
call fcn.10013210
add esp, 4
jmp 0x1001fb88
mov eax, str._none_
push eax
push str.IPv4:__s
push ebx
call fcn.10010b70
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
call fcn.100130f0
lea eax, [ebp - 0x5c]
push eax
call fcn.100130f0
add esp, 8
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100526c8
mov esp, ebp
pop ebp
ret
Function at 0x1002ad80
Capabilities:
Create new key via cryptacquirecontext
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1002add1
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1002adda
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
call fcn.1004fdb0
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.1002ae10
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10034870
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp ebx, 0x20
jbe 0x10034894
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
call esi
cmp eax, 1
jne 0x100348bb
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push 2
call esi
cmp eax, 1
je 0x100348c3
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x100348f9
cmp ebx, 0x20
je 0x100348f9
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push edi
push dword [ebp - 4]
call esi
push dword [ebp - 8]
mov edi, eax
call esi
mov ecx, 0x20
or edx, 0xffffffff
sub ecx, ebx
xor eax, edi
shl edx, cl
pop edi
test edx, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
cmp ecx, dword [ebp - 8]
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10034910
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
mov dword [ebp - 0x28], ecx
mov ecx, 0x80
push edi
cmove ebx, ecx
lea ecx, [ebp - 0x24]
push ecx
push eax
mov edi, ebx
and ebx, 7
push 0x17
shr edi, 3
call esi
cmp eax, 1
jne 0x10034970
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x28]
push 0x17
call esi
cmp eax, 1
jne 0x10034970
cmp edi, 0x10
jg 0x10034970
jne 0x10034983
test ebx, ebx
je 0x10034987
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x100349d7
mov esi, edi
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x14]
sub esi, 4
jb 0x100349a5
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100349aa
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10034994
cmp esi, 0xfffffffc
je 0x100349d7
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10034970
cmp esi, 0xfffffffd
je 0x100349d7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10034970
cmp esi, 0xfffffffe
je 0x100349d7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10034970
cmp esi, 0xffffffff
je 0x100349d7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x10034970
test ebx, ebx
je 0x100349fd
movzx eax, byte [ebp + edi - 0x24]
mov ecx, 8
movzx edx, byte [ebp + edi - 0x14]
sub ecx, ebx
xor edx, eax
mov eax, 0xff
shl eax, cl
test eax, edx
je 0x10034970
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100526c8
mov esp, ebp
pop ebp
ret