joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007c60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10007cb0
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.100419a0
push eax
push str.Could_not_set_TCP_NODELAY:__s
push dword [ebp + 8]
call fcn.1000ff60
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1000c520
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
add eax, esi
mov ecx, eax
sub ecx, esi
cmp esi, eax
push edi
cmova ecx, edx
mov edi, 0x1505
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x1000c569
mov al, byte [esi]
push eax
call fcn.10041650
movsx ecx, al
lea esi, [esi + 1]
mov eax, edi
inc ebx
shl eax, 5
add esp, 4
add eax, edi
xor ecx, eax
mov edi, ecx
cmp ebx, dword [ebp + 8]
jb 0x1000c547
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000d010
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000d1a7
push esi
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1000d193
push edi
lea esp, [esp]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1000d06e
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000d060
sub eax, edx
lea ecx, [eax + 1]
jmp 0x1000d070
xor ecx, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], ecx
cmp eax, 2
jne 0x1000d082
mov eax, 0x10
jmp 0x1000d090
cmp eax, 0x17
jne 0x1000d135
mov eax, 0x1c
cmp dword [esi + 0x18], 0
mov dword [ebp - 4], eax
je 0x1000d135
mov edx, dword [esi + 0x10]
test edx, edx
je 0x1000d135
cmp edx, eax
jb 0x1000d135
add eax, 0x20
add eax, ecx
push eax
call dword [0x1007b2e4]
mov edi, eax
add esp, 4
test edi, edi
je 0x1000d185
mov ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x20]
push ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
push dword [esi + 0x18]
push eax
call fcn.10050b30
mov edx, dword [ebp - 0xc]
add esp, 0xc
test edx, edx
je 0x1000d123
mov eax, dword [edi + 0x18]
add eax, dword [ebp - 4]
push edx
mov dword [edi + 0x14], eax
push dword [esi + 0x14]
push eax
call fcn.10050b30
add esp, 0xc
mov eax, dword [ebp - 0x10]
test ebx, ebx
cmove ebx, edi
test eax, eax
je 0x1000d132
mov dword [eax + 0x1c], edi
mov dword [ebp - 0x10], edi
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x1000d050
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
pop edi
test eax, eax
je 0x1000d152
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x1000d18f
test ebx, ebx
je 0x1000d176
lea ebx, [ebx]
mov esi, dword [ebx + 0x1c]
push ebx
call dword [0x1007b2e8]
add esp, 4
mov ebx, esi
test esi, esi
jne 0x1000d160
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 8
mov dword [ebp - 8], esi
jmp 0x1000d143
test ebx, ebx
jne 0x1000d19f
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d3c0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
mov esi, dword [ebp + 8]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1000d3f2
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push esi
push eax
push 2
call fcn.1000d2f0
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1000d41a
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push esi
push eax
push 0x17
call fcn.1000d2f0
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000df20
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x1000df53
push 0x2e
push edi
call fcn.10051a80
add esp, 8
test eax, eax
je 0x1000df51
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x1000e3e0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 8], 8
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1000e468
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp + 0x10]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x20], 0x208
mov dword [ebp - 0x1c], 0x6601
mov dword [ebp - 0x18], 8
call fcn.1000e4b0
lea eax, [ebp - 0x14]
push 8
push eax
call fcn.1000d4e0
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1000e46e
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push dword [ebp - 8]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
lea eax, [ebp - 8]
push eax
push edx
push 0
push 0
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000fda0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.1005270f
add esp, 0x18
test eax, eax
je 0x1000fdc2
cmp eax, 0xffffffff
jne 0x1000fdc4
xor eax, eax
pop ebp
ret

Function at 0x1000fe30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x68a], 0
je 0x1000feb7
cmp dword [esi + 0x194], 0
je 0x1000fe81
push esi
call fcn.1002e740
push 1
push esi
mov byte [ebp + 8], al
call fcn.1002ec20
push dword [esi + 0x144]
mov eax, dword [esi + 0x194]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
push dword [ebp + 8]
push esi
call fcn.1002ec20
add esp, 0x28
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x1000feb7
push dword [esi + 0x140]
lea eax, [eax + eax*2]
push 1
add eax, 0x10069df0
push 2
push eax
call fcn.10052a95
push dword [esi + 0x140]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10052a95
add esp, 0x20
pop esi
pop ebp
ret

Function at 0x100102d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x804
push esi
xor esi, esi
push edi
test eax, eax
je 0x10010301
push dword [eax]
lea eax, [ebp - 0x804]
push 0x10069e1c
push 0x800
push eax
call sym.libcurl.dll_curl_msnprintf
add esp, 0x10
mov esi, eax
push dword [ebp + 0x14]
mov ecx, 0x800
lea eax, [ebp - 0x804]
push dword [ebp + 0x10]
sub ecx, esi
add eax, esi
push ecx
push eax
call sym.libcurl.dll_curl_mvsnprintf
mov edi, dword [ebp + 8]
add esi, eax
add esp, 0x10
mov byte [ebp + esi - 0x804], 0xa
inc esi
cmp byte [edi + 0x68a], 0
mov byte [ebp + esi - 0x804], 0
je 0x100103b0
cmp dword [edi + 0x194], 0
je 0x10010384
push edi
call fcn.1002e740
push 1
push edi
mov byte [ebp + 0xc], al
call fcn.1002ec20
push dword [edi + 0x144]
lea eax, [ebp - 0x804]
push esi
push eax
mov eax, dword [edi + 0x194]
push 0
push edi
call eax
push dword [ebp + 0xc]
push edi
call fcn.1002ec20
add esp, 0x28
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [edi + 0x140]
push 1
push 2
push 0x10069df0
call fcn.10052a95
push dword [edi + 0x140]
lea eax, [ebp - 0x804]
push 1
push esi
push eax
call fcn.10052a95
add esp, 0x20
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10012b70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, eax
lea esp, [esp]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
call esi
sub eax, edi
cmp eax, 0x1f4
jb 0x10012b90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100160f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push eax
mov ebx, dword [edi + 0x18]
mov esi, dword [ebx + 0x1a4]
push esi
mov dword [ebp + 8], 0xffffffff
mov dword [ebp - 4], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1001614a
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp + 8], eax
jmp 0x1001614d
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x1001616c
push str.Error_accept__ing_server_connect
push edi
call fcn.1000fec0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server
push edi
call fcn.1000ff60
mov byte [ebx + 0x24d], 0
push 1
push dword [ebp + 8]
call fcn.10032700
lea eax, [ebp + 8]
push eax
push 1
push ebx
push edi
call fcn.10006ae0
mov esi, eax
add esp, 0x20
test esi, esi
je 0x100161b0
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x19c], 0
je 0x100161fb
push 1
push edi
call fcn.1002ec20
mov eax, dword [edi + 0x19c]
push 1
push dword [ebp + 8]
push dword [edi + 0x1a0]
call eax
push 0
push edi
mov esi, eax
call fcn.1002ec20
add esp, 0x1c
test esi, esi
je 0x100161fb
push ebx
push edi
call fcn.100167d0
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10018ba0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, 0x51eb851f
imul ecx
push ebx
sar edx, 5
push esi
mov esi, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
mov ebx, dword [esi + 0x18]
cmp eax, 2
je 0x10018bdd
push str.Couldnt_set_desired_mode
push esi
call fcn.1000fec0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x10018bf4
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.1000ff60
add esp, 0xc
mov al, byte [ebp + 0x10]
cmp al, 0x13
jne 0x10018c0c
push ebx
push esi
call fcn.10018820
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x14
jne 0x10018c20
push esi
call fcn.10017840
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x15
jne 0x10018c38
push 0xd
push 1
push esi
call fcn.10018300
add esp, 0xc
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x16
jne 0x10018c4b
push 0xe
push 1
push esi
call fcn.10018300
add esp, 0xc
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001b6d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001b640

Function at 0x1001d210
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x1007b2e4]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1001d23d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x1001d284
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x1001d28a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x1001d2ea
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0x1001d2b0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x1001d317
nop
mov eax, dword [esi + 4]
push 1
push str.6:_u
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x1006cbf7
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x1001d2f0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001d5c0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1001d5f2
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1001d5f2
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x1001d600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1001d621
cmp dword [esi + 0x84], 0
je 0x1001d621
push 2
push 3
push esi
call fcn.1003ccf0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.1001c6f0
add esp, 4
test esi, esi
je 0x1001d644
cmp dword [esi + 0x84], 0
je 0x1001d644
push 3
push esi
call fcn.1003cd30
add esp, 8
pop esi
pop ebp
ret
Function at 0x1001d730
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1001d773
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x10c], 0
jne 0x1001d761
push 0
call fcn.1001d730
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x10c], cl
mov ecx, dword [esi + 0x7c]
xor eax, eax
pop esi
cmp byte [ecx + 0x10c], 2
sete al
pop ebp
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x1001d790
xor esi, esi
xor eax, eax
test esi, esi
pop esi
setg al
pop ebp
ret
push eax
mov esi, 1
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
test esi, esi
pop esi
setg al
pop ebp
ret
Function at 0x1001e3c0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1001e3d0
push dword [ebp + 8]
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebp - 0x14], xmm0
sub esi, ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 4]
push eax
push str.127.0.0.1
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jge 0x1001e415
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x31]
push eax
push 1
call dword [0x1007b2f4]
mov esi, eax
add esp, 8
test esi, esi
je 0x1001e40d
movdqu xmm0, xmmword [ebp - 0x14]
lea eax, [esi + 0x20]
mov dword [esi], 0
mov dword [esi + 0x18], eax
mov edx, edi
mov dword [esi + 4], 2
mov dword [esi + 8], 1
mov dword [esi + 0xc], 6
mov dword [esi + 0x10], 0x10
movdqu xmmword [eax], xmm0
mov ecx, dword [esi + 0x18]
add ecx, 0x10
mov dword [esi + 0x14], ecx
lea esp, [esp]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x1001e470
push edi
push dword [ebp + 8]
call fcn.1001e4a0
add esp, 8
test eax, eax
jne 0x1001e496
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov dword [eax + 0x1c], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001e4a0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e4b0
sub ecx, edx
lea eax, [ecx + 0x3d]
push eax
push 1
call dword [0x1007b2f4]
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001e4d6
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov eax, 0x17
mov word [ebp - 0x2c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x10]
push eax
push 0x1006cc78
push 0x17
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jl 0x1001e4ce
movdqu xmm0, xmmword [ebp - 0x10]
push 0x1c
lea ecx, [ebp - 0x2c]
mov dword [edi], 0
lea eax, [edi + 0x20]
mov dword [edi + 4], 0x17
push ecx
push eax
movdqu xmmword [ebp - 0x24], xmm0
mov dword [edi + 8], 1
mov dword [edi + 0xc], 6
mov dword [edi + 0x10], 0x1c
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
call fcn.10050b30
mov ecx, dword [edi + 0x18]
add esp, 0xc
add ecx, 0x1c
mov dword [edi + 0x14], ecx
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x1001e561
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001e5e0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x64
push edi
xor edi, edi
cmp byte [eax + 0x68a], 0
je 0x1001e79f
push ebx
mov ebx, dword [ebp + 0xc]
add ebx, 0x18
cmp byte [ebx], 0
je 0x1001e79e
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [ebp - 4]
push eax
push ebx
push 2
call esi
test eax, eax
jg 0x1001e79d
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x17
call esi
test eax, eax
jg 0x1001e79d
mov ecx, dword [ebp + 0xc]
mov eax, str._none_
cmp byte [ebx], 0
cmovne eax, ebx
mov ebx, dword [ebp + 8]
push dword [ecx + 0x14]
mov esi, dword [ecx]
push eax
push str.Host__s:_d_was_resolved.
push ebx
call fcn.1000ff60
lea eax, [ebp - 0x34]
push 0x400
push eax
call fcn.10012450
lea eax, [ebp - 0x24]
push 0x400
push eax
call fcn.10012450
add esp, 0x20
test esi, esi
je 0x1001e714
jmp 0x1001e680
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x1001e68d
cmp ecx, 2
jne 0x1001e706
xor eax, eax
mov byte [ebp - 0x64], 0
cmp ecx, 2
lea ebx, [ebp - 0x34]
setne al
shl eax, 4
add ebx, eax
sub ecx, 2
je 0x1001e6bc
sub ecx, 0x15
jne 0x1001e6d0
push 0x2e
lea eax, [ebp - 0x64]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x1001e6cb
push 0x2e
lea eax, [ebp - 0x64]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call sub.WS2_32.dll_inet_ntop
push ebx
call fcn.10012480
add esp, 4
test eax, eax
je 0x1001e6ef
push 2
push 0x10069e30
push ebx
call fcn.10012410
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x1001e732
lea eax, [ebp - 0x64]
push eax
push ebx
call fcn.100123b0
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001e732
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x1001e680
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.10012480
add esp, 4
test eax, eax
je 0x1001e745
lea eax, [ebp - 0x24]
push eax
call fcn.10012490
add esp, 4
jmp 0x1001e74a
mov eax, dword [ebp + 8]
push str.too_many_IP__cant_show
push eax
call fcn.1000ff60
add esp, 8
jmp 0x1001e788
mov eax, str._none_
push eax
push str.IPv6:__s
push ebx
call fcn.1000ff60
lea eax, [ebp - 0x34]
push eax
call fcn.10012480
add esp, 0x10
test eax, eax
je 0x1001e774
lea eax, [ebp - 0x34]
push eax
call fcn.10012490
add esp, 4
jmp 0x1001e779
mov eax, str._none_
push eax
push str.IPv4:__s
push ebx
call fcn.1000ff60
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
call fcn.10012420
lea eax, [ebp - 0x24]
push eax
call fcn.10012420
add esp, 8
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100295e0
Capabilities:
Create new key via cryptacquirecontext
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10029631
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1002963a
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
call fcn.1004d9e0
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.10029670
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret