joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403be1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0
je 0x403c16
call fcn.004b5ba0
test eax, eax
je 0x403c02
push dword [esi + 0xc]
push esi
call fcn.004042d4
pop ecx
pop ecx
push dword [esi + 8]
push esi
call fcn.004042d4
push esi
call fcn.004042f7
add esp, 0xc
jmp 0x403c47
push esi
call fcn.00403dcf
pop ecx
test eax, eax
jne 0x403c47
call fcn.004b5ba0
test eax, eax
je 0x403c35
push 1
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 1
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.004040ab
pop ecx
push esi
call fcn.00404157
pop ecx
pop esi
pop ebp
ret

Function at 0x403f7c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x4fe6f0
push esi
call fcn.00403fe6
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x403fbf
call fcn.004b5ba0
test eax, eax
je 0x403fc5
push 0x4fe6f4
push esi
call fcn.00403fe6
pop ecx
pop ecx
test eax, eax
jne 0x403fc7
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebp
ret
xor eax, eax
push esi
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
call fcn.0040428b
pop ecx
test eax, eax
jne 0x403fe1
push esi
call fcn.004042f7
pop ecx
jmp 0x403fbf
xor eax, eax
inc eax
jmp 0x403fc1

Function at 0x403fe6
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [eax]
call fcn.00447c0a
push esi
push esi
push esi
mov ebx, eax
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0x10], ebx
call fcn.0044bdbd
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push str.Frida__s_bit_helper___s_
call fcn.00447cb0
push esi
push esi
push esi
push 0xffffffffffffffff
push eax
mov dword [ebp - 0xc], eax
call fcn.0044bdbd
add esp, 0x40
mov edi, eax
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
call fcn.00403cd5
push esi
push esi
push esi
mov ebx, eax
push 0xffffffffffffffff
push ebx
call fcn.0044bdbd
add esp, 0x18
mov esi, eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push 3
push 0x10
push 0xf01ff
push edi
push dword [ebp - 4]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
push esi
mov edi, eax
call fcn.00441dce
push ebx
call fcn.00441dce
push dword [ebp - 8]
call fcn.00441dce
push dword [ebp - 0xc]
call fcn.00441dce
push dword [ebp - 4]
call fcn.00441dce
push dword [ebp - 0x10]
call fcn.00441dce
add esp, 0x18
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404182
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.004b6f20
push dword [ebp + 0xc]
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00403cd5
push esi
push esi
push esi
mov edi, eax
push 0xffffffffffffffff
push edi
call fcn.0044bdbd
push esi
push str.__STANDALONE
push edi
push 0x4fea08
mov ebx, eax
call fcn.00447c0a
push esi
push esi
push esi
push 0xffffffffffffffff
push eax
mov dword [ebp - 8], eax
call fcn.0044bdbd
add esp, 0x48
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x5c], 0x44
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40420b
push dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call fcn.00441dce
push dword [ebp - 8]
call fcn.00441dce
push ebx
call fcn.00441dce
push edi
call fcn.00441dce
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40428b
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4042a8
xor eax, eax
jmp 0x4042d0
call fcn.004b5ba0
test eax, eax
je 0x4042cd
push ebx
push ebx
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4042cd
push dword [esi + 8]
push esi
call fcn.004042d4
pop ecx
pop ecx
jmp 0x4042a4
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret

Function at 0x4042d4
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_ControlService]
pop edi
leave
ret

Function at 0x4042f7
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
inc edi
call fcn.004b5ba0
mov esi, dword [ebp + 8]
test eax, eax
je 0x404323
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [esi + 0xc]
and edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and dword [esi + 0xc], 0
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [esi + 8]
and edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and dword [esi + 8], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x40619e
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
and dword [esp], 0
cmp dword [esp + 0x1c], 0
push ebx
push ebp
push esi
lea ebx, [esp + 0x10]
mov ebp, 0x61a8
cmovne ebx, dword [esp + 0x28]
cmp dword [esp + 0x24], 0xffffffff
push edi
cmovne ebp, dword [esp + 0x28]
push 0x10
call fcn.00446395
push dword [esp + 0x3c]
mov edi, eax
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x2c]
call fcn.00409350
mov esi, eax
push fcn.0040619e
push esi
call fcn.00409828
push esi
call fcn.00409245
add esp, 0x20
test eax, eax
jne 0x40620a
push str.g_dbus_connection_send_message_with_reply_unlocked
push esi
call fcn.00409834
pop ecx
pop ecx
push 0x408472
push edi
push esi
call fcn.00409857
push esi
call fcn.0040960b
add esp, 0x10
test eax, eax
je 0x40622f
push esi
call fcn.004760d1
pop ecx
jmp 0x4062d4
lea eax, [esp + 0x10]
push eax
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.00405ffa
add esp, 0x14
test eax, eax
jne 0x40625f
push dword [esp + 0x10]
push esi
call fcn.004095f5
push esi
call fcn.004760d1
jmp 0x4062d1
cmp dword [esp + 0x30], 0
mov eax, dword [ebx]
mov dword [edi], eax
je 0x40628b
push fcn.004760d1
push esi
call fcn.00475e17
pop ecx
push eax
push 0x408480
push dword [esp + 0x3c]
call fcn.004163ab
add esp, 0x10
mov dword [edi + 4], eax
cmp ebp, 0x7fffffff
je 0x4062c2
push ebp
call fcn.00443b0e
mov dword [esp], str._gio__send_message_with_reply_unlocked
push eax
mov dword [edi + 8], eax
call fcn.0044383d
push 0x408581
push dword [edi + 8]
push esi
call fcn.00409032
push dword [edi + 8]
call fcn.00443850
add esp, 0x18
mov eax, dword [esp + 0x1c]
push esi
push dword [ebx]
push dword [eax + 0x4c]
call fcn.0044aa72
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x41d821
Capabilities:
Check os version
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0xc]
call fcn.0041d8a0
mov esi, eax
pop ecx
test esi, esi
je 0x41d896
mov ecx, dword [0x78d03c]
cmp ecx, 0xffffffff
jne 0x41d851
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
sbb ecx, ecx
inc ecx
mov dword [0x78d03c], ecx
test ecx, ecx
je 0x41d878
xor ecx, ecx
lea eax, [ebp - 4]
push ecx
push ecx
push eax
push ecx
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x41d896
mov eax, dword [ebp - 4]
shr eax, 0x13
and eax, 1
push eax
jmp 0x41d886
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x41d896
push 1
push str.filesystem::readonly
push dword [ebp + 8]
call fcn.0040dd23
add esp, 0xc
push esi
call fcn.00441dce
pop ecx
pop esi
leave
ret
Function at 0x421123
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x8c
mov eax, dword [0x78e580]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xa0]
lea eax, [esp + 0x18]
push 0x80
xor ebx, ebx
push ebx
push eax
call fcn.004b6f20
mov eax, dword [edi + 0xc]
push str.GSocket
mov esi, dword [eax + 0xc]
mov eax, dword [0x78e320]
push esi
call dword [eax]
push ebx
lea eax, [esp + 0x2c]
push eax
push 0x1008
push 0xffff
push edi
call fcn.004215fe
add esp, 0x28
test eax, eax
jne 0x421191
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
jmp 0x4212b5
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0xc]
push 1
pop ebp
sub ecx, 1
je 0x4211be
sub ecx, ebp
je 0x4211b5
push 3
pop edx
sub ecx, edx
je 0x4211b0
mov dword [eax + 4], ebx
jmp 0x4211c1
mov dword [eax + 4], edx
jmp 0x4211c1
mov dword [eax + 4], 2
jmp 0x4211c1
mov dword [eax + 4], ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x421184
cmp dword [esp + 0x10], ebx
jbe 0x4212b2
movzx ecx, word [esp + 0x18]
mov eax, ecx
sub eax, 1
je 0x42123a
sub eax, 1
je 0x421205
sub eax, 0x15
je 0x421205
mov eax, dword [edi + 0xc]
mov dword [eax], ebx
jmp 0x421245
mov eax, dword [edi + 0xc]
mov dword [eax], ecx
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx + 4]
sub eax, 1
je 0x421231
sub eax, 1
je 0x421228
sub eax, 1
jne 0x421245
mov dword [ecx + 8], 0x84
jmp 0x421245
mov dword [ecx + 8], 0x11
jmp 0x421245
mov dword [ecx + 8], 6
jmp 0x421245
mov eax, dword [edi + 0xc]
mov dword [eax], ebp
mov eax, dword [edi + 0xc]
mov dword [eax + 8], ebx
mov eax, dword [edi + 0xc]
cmp dword [eax], ebx
je 0x421277
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
js 0x421277
mov eax, dword [edi + 0xc]
or dword [eax + 0x20], 0x10
mov eax, dword [edi + 0xc]
or dword [eax + 0x20], 0x20
push ebx
lea eax, [esp + 0x18]
push eax
push 8
push 0xffff
push edi
call fcn.004215fe
mov edx, dword [edi + 0xc]
add esp, 0x14
test eax, eax
je 0x4212ac
mov ecx, dword [esp + 0x14]
mov eax, dword [edx + 0x20]
neg ecx
sbb ecx, ecx
and eax, 0xfffffffb
and ecx, 4
or ecx, eax
mov dword [edx + 0x20], ecx
jmp 0x4212e8
and dword [edx + 0x20], 0xfffffffb
jmp 0x4212e8
or ebx, 0xffffffff
push ebx
call fcn.00408e81
push ebx
mov esi, eax
call fcn.00422bca
pop ecx
pop ecx
push eax
push str.creating_GSocket_from_fd:__s
call fcn.00451b5b
pop ecx
push eax
push esi
call fcn.00408f70
push eax
mov eax, dword [edi + 0xc]
add eax, 0x18
push eax
call fcn.004418a5
add esp, 0x14
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b5ec4
add esp, 0x8c
ret
Function at 0x4214a5
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x88
mov eax, dword [0x78e580]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
lea ecx, [ebp - 0x18]
push ebx
mov ebx, dword [ebp + 0x7c]
push ecx
mov eax, dword [eax + 0xc]
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x18], 0x80
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x42151d
push esi
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
call fcn.00408e81
push esi
mov edi, eax
call fcn.00422bca
pop ecx
pop ecx
push eax
push str.could_not_get_local_address:__s
call fcn.00451b5b
pop ecx
push eax
push edi
call fcn.00408f70
push eax
push ebx
call fcn.004418a5
add esp, 0x14
xor eax, eax
pop edi
pop esi
jmp 0x42152b
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.004270c2
pop ecx
pop ecx
mov ecx, dword [ebp + 0x6c]
xor ecx, ebp
pop ebx
call fcn.004b5ec4
add ebp, 0x70
leave
ret
Function at 0x421ef9
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.00442170
mov esi, dword [esp + 0x30]
mov ebp, eax
mov edi, dword [esp + 0x18]
push esi
push edi
mov dword [esp + 0x18], edx
call fcn.00420330
pop ecx
pop ecx
test eax, eax
je 0x421f3b
push esi
push edi
call fcn.004203a6
pop ecx
pop ecx
test eax, eax
je 0x421f3b
push esi
push dword [esp + 0x30]
call fcn.00416619
pop ecx
pop ecx
test eax, eax
je 0x421f8e
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 4
je 0x421f8e
cmp ebx, 0x2733
jne 0x421fb8
push 1
push edi
call fcn.00420000
mov eax, dword [esp + 0x2c]
or eax, dword [esp + 0x30]
pop ecx
pop ecx
je 0x421fb8
push esi
push dword [esp + 0x30]
push dword [esp + 0x18]
push ebp
push dword [esp + 0x38]
push dword [esp + 0x38]
push 1
push edi
call fcn.0042013b
add esp, 0x20
test eax, eax
je 0x421f3b
mov eax, dword [edi + 0xc]
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test ebx, ebx
js 0x421f44
push 1
push edi
call fcn.00420000
pop ecx
pop ecx
mov eax, ebx
jmp 0x421f3e
push 1
push edi
call fcn.00420000
pop ecx
pop ecx
test esi, esi
je 0x421f3b
push ebx
call fcn.00408e81
push ebx
mov edi, eax
call fcn.00422bca
pop ecx
pop ecx
push eax
cmp edi, 0x1b
jne 0x421ff5
push edi
call fcn.00408f70
push eax
push esi
call fcn.004418d8
add esp, 0x10
jmp 0x421f3b
push str.Error_receiving_data:__s
call fcn.00451b5b
pop ecx
push eax
push edi
call fcn.00408f70
push eax
push esi
call fcn.004418a5
add esp, 0x14
jmp 0x421f3b
Function at 0x422468
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.00442170
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
call fcn.00420330
pop ecx
pop ecx
test eax, eax
je 0x422560
push esi
push edi
call fcn.004203a6
pop ecx
pop ecx
test eax, eax
je 0x422560
push esi
push dword [ebp + 0x1c]
call fcn.00416619
pop ecx
pop ecx
test eax, eax
jne 0x422560
jmp 0x4224fe
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 4
je 0x4224fe
cmp ebx, 0x2733
jne 0x422518
push 2
push edi
call fcn.00420000
mov eax, dword [ebp + 0x14]
or eax, dword [ebp + 0x18]
pop ecx
pop ecx
je 0x422518
push esi
push dword [ebp + 0x1c]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 4
push edi
call fcn.0042013b
add esp, 0x20
test eax, eax
je 0x422560
mov eax, dword [edi + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x4224b8
jmp 0x422563
test esi, esi
je 0x422560
push ebx
call fcn.00408e81
push ebx
mov edi, eax
call fcn.00422bca
pop ecx
pop ecx
push eax
cmp edi, 0x1b
jne 0x422544
push edi
call fcn.00408f70
push eax
push esi
call fcn.004418d8
add esp, 0x10
jmp 0x422560
push str.Error_sending_data:__s
call fcn.00451b5b
pop ecx
push eax
push edi
call fcn.00408f70
push eax
push esi
call fcn.004418a5
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4227a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
test byte [eax + 0x20], 1
je 0x4227bf
push dword [ebp + 0x18]
push esi
call fcn.00420330
pop ecx
pop ecx
test eax, eax
je 0x42280b
push 4
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
mov eax, dword [esi + 0xc]
push dword [ebp + 0xc]
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x4227de
inc eax
jmp 0x42280d
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
call fcn.00408e81
push esi
mov edi, eax
call fcn.00422bca
pop ecx
pop ecx
push eax
push edi
call fcn.00408f70
push eax
push dword [ebp + 0x18]
call fcn.004418d8
add esp, 0x10
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x422c1b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x78e580]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
test byte [eax + 0x20], 8
jne 0x422c7d
lea ecx, [ebp - 0x30]
push ecx
push dword [eax + 0x24]
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
test eax, eax
jne 0x422c7d
mov ecx, dword [esi + 0xc]
mov eax, dword [ebp - 0x30]
or dword [ecx + 0x30], eax
mov eax, dword [ebp - 0x30]
test al, 2
je 0x422c6c
cmp dword [ebp - 0x28], 0
je 0x422c6c
mov eax, dword [esi + 0xc]
or dword [eax + 0x34], 2
mov eax, dword [ebp - 0x30]
test al, 0x10
je 0x422c7d
cmp dword [ebp - 0x1c], 0
je 0x422c7d
mov eax, dword [esi + 0xc]
or dword [eax + 0x34], 0x10
mov eax, dword [esi + 0xc]
push ebx
push 0
pop edx
mov ebx, dword [eax + 0x30]
and ebx, 9
setne dl
test byte [eax + 0x30], 0x20
je 0x422cbc
push edi
push 2
push 4
lea ecx, [ebp - 0x34]
push ecx
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jns 0x422ce3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2749
jne 0x422ce7
xor edx, edx
inc edx
pop edi
mov esi, dword [esi + 0xc]
mov ecx, edx
or ecx, 0x10
pop ebx
mov eax, dword [esi + 0x20]
test al, 8
cmove ecx, edx
test cl, 0x10
jne 0x422d21
test byte [esi + 0x30], 2
je 0x422d21
test byte [esi + 0x34], 2
je 0x422d32
or ecx, 8
jmp 0x422d35
jg 0x422cb8
xor eax, eax
test edi, edi
je 0x422d15
jns 0x422d09
cmp eax, 0x274a
je 0x422d15
cmp eax, 0x2746
je 0x422d15
cmp eax, 0x2745
je 0x422d15
cmp eax, 0x2744
je 0x422d15
xor edx, edx
test ebx, ebx
setne dl
add edx, 8
jmp 0x422cbb
xor edx, edx
test ebx, ebx
setne dl
add edx, 0x10
jmp 0x422cbb
test byte [esi + 0x30], 0x10
je 0x422d35
test byte [esi + 0x34], 0x10
je 0x422d32
or ecx, 0x18
jmp 0x422d35
or ecx, 4
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b5ec4
leave
ret
Function at 0x429463
Capabilities:
Hash data using djb2

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ebx, 0x1505
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x429553
cmp dword [edi + 0x2c], 0
je 0x429553
mov esi, dword [esp + 0x20]
xor edx, edx
mov dword [esp + 0x14], edx
mov al, byte [esi]
test al, al
je 0x4294ab
imul ebx, ebx, 0x21
movsx eax, al
add ebx, eax
inc edx
mov al, byte [edx + esi]
test al, al
jne 0x429497
mov dword [esp + 0x14], edx
cmp dword [edi + 0x18], 0
je 0x4294e1
xor esi, esi
mov ecx, ebx
and ecx, 0x1f
inc esi
shl esi, cl
mov eax, ebx
mov ecx, dword [edi + 0x1c]
xor edx, edx
shr eax, cl
and eax, 0x1f
bts esi, eax
mov eax, ebx
shr eax, 5
div dword [edi + 0x18]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + edx*4]
and eax, esi
cmp eax, esi
jne 0x429553
mov ecx, dword [edi + 0x24]
xor edx, edx
mov esi, dword [edi + 0x20]
mov eax, ebx
div ecx
lea eax, [ecx - 1]
mov ebp, dword [esi + edx*4]
cmp edx, eax
je 0x429501
mov esi, dword [esi + edx*4 + 4]
mov dword [esp + 0x1c], esi
cmp esi, dword [edi + 0x2c]
jbe 0x429508
mov esi, dword [edi + 0x2c]
mov dword [esp + 0x1c], esi
cmp ebp, esi
jae 0x429553
mov eax, dword [esp + 0x1c]
imul ecx, ebp, 0x18
mov dword [esp + 0x10], ecx
mov esi, dword [edi + 0x28]
add esi, ecx
cmp ebx, dword [esi]
jne 0x429547
push dword [esp + 0x14]
push dword [esp + 0x24]
push esi
push edi
call fcn.0042927b
add esp, 0x10
test eax, eax
je 0x42953f
mov al, byte [esp + 0x24]
cmp byte [esi + 0xe], al
je 0x42955c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
inc ebp
add ecx, 0x18
mov dword [esp + 0x10], ecx
cmp ebp, eax
jb 0x429517
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
mov eax, esi
jmp 0x429555
Function at 0x42f7ae
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x78e580]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x78f6bc], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x42f2d7
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x42f5c0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x42f29c
jne 0x42f900
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x42f8f6
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
mov ebx, 0x10c
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.004c2cc7
push str.ws2_32
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.004c2d21
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x40]
add esp, 0x18
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test esi, esi
je 0x42f876
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x42f8ba
push esi
call ebp
lea eax, [esp + 0x134]
mov esi, 0x10c
push eax
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.004c2cc7
push str.wship6
lea eax, [esp + 0x38]
push esi
push eax
call fcn.004c2d21
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x42f8f2
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x42f8ef
xor edi, edi
mov ebx, edi
push dword [esp + ebx*8 + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + ebx*8 + 0x14], eax
test eax, eax
je 0x42f8ef
inc ebx
cmp ebx, 3
jl 0x42f8be
test esi, esi
je 0x42f8f2
mov eax, dword [esp + edi + 0x14]
mov dword [edi + 0x78d094], eax
add edi, 8
cmp edi, 0x18
jl 0x42f8db
jmp 0x42f8f2
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x78f6bc], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
mov eax, dword [eax*8 + 0x78d094]
call fcn.004b5ec4
add esp, 0x230
ret 4

Function at 0x42fb04
Capabilities:
Resolve dns

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
push dword [esp + 0x14]
and dword [ebp], 0
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x42fb80
cmp word [esi + 8], 2
jne 0x42fb62
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x42fb62
mov edi, dword [esi + 0xc]
jmp 0x42fb5c
push dword [eax]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.0042fa58
mov dword [ebp], eax
test eax, eax
je 0x42fb7b
lea ebp, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x42fb3c
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.004c2e3b
add esp, 0x10
xor eax, eax
jmp 0x42fba7
push 8
pop eax
jmp 0x42fba7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x42fba5
sub eax, 1
je 0x42fb9e
sub eax, 1
jne 0x42fba5
lea eax, [ecx + 2]
jmp 0x42fba7
mov eax, 0x2afa
jmp 0x42fba7
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
ret 0x18