joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003100
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026a15
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1003300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.10003090
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10003183
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100032e6
cmp dword [0x100336b4], 0xfffffff
jne 0x1000319a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x28], 0x100336b0
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.1002564b
mov ecx, dword [ebx]
mov esi, eax
mov edx, dword [ebx + 4]
add esp, 4
mov dword [ebp - 0x24], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov ecx, dword [0x100336b4]
mov ebx, dword [0x100336c8]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10030a30]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10030a30]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x100336ac]
comiss xmm1, xmm0
jbe 0x10003293
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10026410
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10003272
cmp ebx, 0x200
jae 0x10003270
shl ebx, 3
cmp ebx, ecx
jae 0x10003272
mov ebx, ecx
push ebx
call fcn.10003590
mov edi, dword [ebp - 0x1c]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10003090
mov ecx, dword [0x100336b4]
mov edx, dword [eax]
jmp 0x10003299
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x100336b4], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x100336c4]
mov ecx, dword [0x100336b8]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x100336b0]
jne 0x100032ca
mov dword [ecx + eax*8], esi
jmp 0x100032d9
cmp edi, edx
jne 0x100032d3
mov dword [ecx + eax*8], esi
jmp 0x100032dd
cmp dword [ecx + eax*8 + 4], ebx
jne 0x100032dd
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10003590
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100035bc
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x100336b0]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100336b8
lea eax, [edi + edi]
push eax
call fcn.10002c50
mov ecx, dword [0x100336b0]
lea ebx, [edi - 1]
mov dword [0x100336c4], ebx
mov dword [0x100336c8], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x10003700
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x100336b8]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x10003656
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x100036c9
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x10003690
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x10003688
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x100036c9
mov edi, eax
cmp dword [ebp - 4], eax
je 0x100036a6
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x100036da
cmp dword [ebp - 4], eax
jne 0x10003697
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 4]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x10003700
mov ebx, dword [0x100336c4]
jmp 0x10003603
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x100036c9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10008bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x10]
mov eax, dword [esi + 0x44]
cmp eax, dword [esi + 0x40]
jb 0x10008bd2
mov ecx, edi
call fcn.10010350
mov esi, dword [edi + 0x10]
mov eax, dword [esi + 0xc]
push 0x78
push 0
push 0
push dword [esi + 0x10]
call eax
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10008d4a
add dword [esi + 0x44], 0x78
mov edx, edi
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx + 0x1c]
mov dword [ebx], eax
movzx eax, byte [ecx + 0x14]
mov dword [ecx + 0x1c], ebx
and al, 3
mov byte [ebx + 5], al
mov ecx, ebx
mov byte [ebx + 4], 8
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x36], 0x1000000
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x30], 0
mov word [ebx + 0x34], ax
mov byte [ebx + 6], al
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x50], eax
call fcn.1001c290
mov eax, dword [edi + 0x48]
mov edx, 1
mov ecx, dword [edi + 0x4c]
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x48], eax
mov eax, dword [edi + 0x50]
mov dword [ebx + 0x50], eax
movzx eax, byte [edi + 0x38]
mov byte [ebx + 0x38], al
mov ecx, dword [edi + 0x3c]
mov dword [ebx + 0x3c], ecx
mov eax, dword [edi + 0x44]
mov dword [ebx + 0x40], ecx
mov ecx, edi
mov dword [ebx + 0x44], eax
mov eax, dword [edi + 8]
mov dword [eax], ebx
mov dword [eax + 8], 8
add dword [edi + 8], 0x10
call fcn.10003bf0
cmp eax, 0x1002f070
je 0x10008cda
cmp dword [eax + 8], 6
jne 0x10008cda
mov edx, 1
mov ecx, edi
call fcn.10003bf0
cmp dword [eax + 8], 6
jne 0x10008cee
mov eax, dword [eax]
cmp byte [eax + 6], 0
je 0x10008cee
push str.Lua_function_expected
mov edx, 1
mov ecx, edi
call fcn.10004740
add esp, 4
mov edx, 1
mov ecx, edi
call fcn.10003bf0
mov esi, dword [edi + 8]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov edx, dword [edi + 8]
mov dword [esp + 0xc], edx
lea eax, [edx + 0x10]
mov dword [edi + 8], eax
cmp edi, ebx
je 0x10008d3e
mov dword [edi + 8], edx
mov esi, dword [ebx + 8]
lea ecx, [esi + 0x10]
mov dword [ebx + 8], ecx
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], edx
mov ecx, dword [ecx + 8]
mov dword [esi + 8], ecx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 4
mov ecx, edi
call fcn.1000dea0
int3
Function at 0x1000dea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x70]
test eax, eax
je 0x1000dec3
mov dword [eax + 0x44], edx
mov eax, dword [esi + 0x70]
push 1
add eax, 4
push eax
call dword [sym.imp.VCRUNTIME140.dll_longjmp]
mov eax, dword [esi + 0x10]
mov byte [esi + 6], dl
cmp dword [eax + 0x58], 0
je 0x1000dee0
call fcn.1000de20
mov eax, dword [esi + 0x10]
push esi
mov eax, dword [eax + 0x58]
call eax
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10011520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1003300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x218], edx
push edi
mov ebx, eax
mov dword [ebp - 0x21c], eax
lea edi, [ebp - 0x204]
mov dword [ebp - 0x208], ebx
mov esi, 0x200
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x214], esi
nop dword [eax]
lea eax, [ebp - 0x210]
sub edi, eax
sub edi, 0xc
je 0x100115d3
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx + 0x44]
cmp eax, dword [ecx + 0x40]
jb 0x1001158f
mov ecx, ebx
call fcn.10010350
mov esi, dword [ebx + 8]
lea edx, [ebp - 0x204]
push edi
mov ecx, ebx
call fcn.1001c5c0
mov dword [esi], eax
lea ecx, [ebp - 0x210]
mov dword [esi + 8], 4
lea eax, [ebp - 0x204]
add dword [ebx + 8], 0x10
add esp, 4
inc dword [ebp - 0x20c]
mov dword [ebp - 0x210], eax
call fcn.10005820
mov esi, dword [ebp - 0x214]
mov ebx, dword [ebp + 8]
mov eax, ebx
push dword [ebp - 0x218]
cmp esi, ebx
cmovbe eax, esi
mov esi, eax
mov dword [ebp - 0x214], eax
push esi
lea eax, [ebp - 0x204]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, dword [ebp - 0x210]
add esp, 0x10
add edi, eax
sub ebx, eax
mov dword [ebp - 0x210], edi
mov dword [ebp + 8], ebx
je 0x10011622
cmp eax, esi
jne 0x10011622
mov ebx, dword [ebp - 0x208]
jmp 0x10011570
lea eax, [ebp - 0x210]
sub edi, eax
sub edi, 0xc
je 0x10011686
mov ebx, dword [ebp - 0x208]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx + 0x44]
cmp eax, dword [ecx + 0x40]
jb 0x10011647
mov ecx, ebx
call fcn.10010350
mov esi, dword [ebx + 8]
lea edx, [ebp - 0x204]
push edi
mov ecx, ebx
call fcn.1001c5c0
mov dword [esi], eax
add esp, 4
mov dword [esi + 8], 4
lea eax, [ebp - 0x204]
add dword [ebx + 8], 0x10
mov edx, dword [ebp - 0x20c]
mov ebx, dword [ebp + 8]
inc edx
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], edx
jmp 0x1001168c
mov edx, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x208]
call fcn.100045a0
pop edi
pop esi
test ebx, ebx
mov dword [ebp - 0x20c], 1
pop ebx
je 0x100116c8
mov ecx, dword [ebp - 0x21c]
or edx, 0xffffffff
call fcn.10003d80
test eax, eax
jne 0x100116c8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10025431
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10025431
mov esp, ebp
pop ebp
ret
Function at 0x10011bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1003300c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esp + 0x14], edx
push edi
mov edi, 1
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
sar eax, 4
sub eax, edi
je 0x10011ca5
dec eax
mov edx, ebx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.10003bf0
cmp eax, 0x1002f070
je 0x10011cd4
cmp dword [eax + 8], 3
jne 0x10011cd4
test edi, edi
je 0x10011c96
mov edx, ebx
mov ecx, esi
call fcn.10003bf0
mov ecx, dword [eax + 8]
cmp ecx, 3
je 0x10011c71
cmp ecx, 4
jne 0x10011ccf
mov ecx, dword [eax]
lea edx, [esp + 0x20]
add ecx, 0x10
call fcn.10016c60
test eax, eax
je 0x10011ccf
movsd xmm0, qword [esp + 0x20]
lea eax, [esp + 0x28]
movsd qword [esp + 0x28], xmm0
mov dword [esp + 0x30], 3
movsd xmm0, qword [eax]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x24]
call fcn.10004720
add esp, 0x10
test eax, eax
jg 0x10011d99
xor edi, edi
mov eax, dword [esp + 0x1c]
inc ebx
test eax, eax
jne 0x10011c06
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [eax]
mov eax, dword [esi + 8]
test edi, edi
je 0x10011da3
mov dword [eax], 1
mov dword [eax + 8], 1
mov eax, 1
jmp 0x10011de2
xorps xmm0, xmm0
jmp 0x10011c75
mov edx, ebx
mov ecx, esi
call fcn.10003bf0
cmp dword [eax + 8], 4
je 0x10011d17
mov edx, eax
mov ecx, esi
call fcn.10022960
test eax, eax
jne 0x10011cfc
xor ecx, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
jmp 0x10011d29
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx + 0x44]
cmp eax, dword [ecx + 0x40]
jb 0x10011d0e
mov ecx, esi
call fcn.10010350
mov edx, ebx
mov ecx, esi
call fcn.10003bf0
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jne 0x10011d76
mov edx, ebx
mov ecx, esi
call fcn.10003bf0
cmp eax, 0x1002f070
je 0x10011d4a
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x10011d4a
mov eax, dword [eax*4 + 0x1002f244]
jmp 0x10011d4f
mov eax, str.no_value
push eax
push dword [0x1002f254]
push str._s_expected__got__s
push esi
call fcn.10003e80
push eax
mov edx, ebx
mov ecx, esi
call fcn.10004740
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov eax, dword [esp + 0x14]
test edi, edi
je 0x10011c96
push dword [esp + 0x18]
push ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, dword [esp + 0x10]
jne 0x10011c96
mov edi, 1
jmp 0x10011c98
mov dword [eax + 8], 0
add dword [esi + 8], 0x10
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push 0x1002e920
push esi
call fcn.10003e80
mov eax, dword [esi + 8]
add esp, 0xc
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mov dword [eax + 8], 3
movsd qword [eax], xmm0
mov eax, 3
add dword [esi + 8], 0x10
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10025431
mov esp, ebp
pop ebp
ret
Function at 0x1001c5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 8]
mov ebx, edx
mov edi, edx
mov dword [esp + 0xc], ecx
shr edi, 5
mov esi, edx
inc edi
cmp edx, edi
jb 0x1001c60e
mov edx, dword [esp + 0x10]
nop dword [eax]
movzx ecx, byte [edx + esi - 1]
mov eax, ebx
shl eax, 5
sub esi, edi
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp esi, edi
jae 0x1001c5f0
mov edx, dword [ebp + 8]
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, ebx
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x1001c6a4
cmp dword [edi + 0xc], edx
jne 0x1001c69a
mov esi, dword [ebp + 8]
lea eax, [edi + 0x10]
mov edx, dword [esp + 0x10]
sub esi, 4
jb 0x1001c651
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x1001c65a
add edx, 4
add eax, 4
sub esi, 4
jae 0x1001c640
cmp esi, 0xfffffffc
je 0x1001c74a
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x1001c697
cmp esi, 0xfffffffd
je 0x1001c74a
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x1001c697
cmp esi, 0xfffffffe
je 0x1001c74a
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x1001c697
cmp esi, 0xffffffff
je 0x1001c74a
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x1001c74a
mov edx, dword [ebp + 8]
mov edi, dword [edi]
test edi, edi
jne 0x1001c628
mov esi, dword [esp + 0xc]
lea eax, [edx + 1]
cmp eax, 0xffffffed
jbe 0x1001c6bd
push str.memory_allocation_error:_block_too_big
push esi
call fcn.1000dcd0
mov edx, dword [ebp + 8]
add esp, 8
lea eax, [edx + 0x11]
mov ecx, esi
push eax
push 0
xor edx, edx
call fcn.10014a60
mov ecx, dword [esp + 0x14]
mov edi, eax
mov esi, dword [ebp + 8]
push esi
push dword [esp + 0x1c]
mov dword [edi + 0xc], esi
lea eax, [edi + 0x10]
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x10]
push eax
mov cl, byte [ecx + 0x14]
and cl, 3
mov byte [edi + 4], 4
mov byte [edi + 5], cl
mov byte [edi + 6], 0
call sub.VCRUNTIME140.dll_memcpy
mov byte [edi + esi + 0x10], 0
add esp, 0x14
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 8]
dec eax
and eax, ebx
lea ecx, [eax*4]
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [edi], eax
mov eax, dword [edx]
mov dword [ecx + eax], edi
inc dword [edx + 4]
mov eax, dword [edx + 8]
cmp dword [edx + 4], eax
jbe 0x1001c741
cmp eax, 0x3ffffffe
jg 0x1001c741
lea edx, [eax + eax]
mov ecx, esi
call fcn.1001c4e0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov al, byte [edi + 5]
movzx edx, byte [ecx + 0x14]
not edx
movzx ecx, al
and edx, ecx
test dl, 3
je 0x1001c741
xor al, 3
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
mov ecx, 0x630712f1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, str.___
mov ebx, 0x42f314
nop
nop
mov ecx, 0x60d40240
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401540
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x28
lea eax, [ebp - 8]
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], 0x10
push ecx
call sub.WS2_32.DLL_getsockname
pop edx
test eax, eax
js 0x401590
test ebx, ebx
je 0x401583
sub esp, 0xc
mov ax, word [ebp - 0x16]
and eax, 0xffff
push eax
call sub.WS2_32.DLL_ntohs
mov word [ebx], ax
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 4]
leave
ret
mov dword [ebp - 0x14], 0xffffffff
jmp 0x401567

Function at 0x4015f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
push esi
call sub.WS2_32.DLL_inet_addr
add esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
je 0x401614
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
sub esp, 0xc
push esi
call sub.WS2_32.DLL_gethostbyname
add esp, 0xc
test eax, eax
je 0x40160b
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x401640
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov edx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x108], edx
lea eax, [ebp - 0x10c]
inc edx
push 0
mov dword [ebp - 8], 0x78
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10c], 1
push eax
push edx
call sub.WS2_32.DLL_select
add esp, 0xc
test eax, eax
setg al
and eax, 0xff
leave
dec eax
ret

Function at 0x401810
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov word [esi + 2], 0
mov word [esi], 2
push 0x11
push 2
push 2
call sub.WS2_32.DLL_socket
mov ebx, eax
mov edi, eax
test ebx, ebx
pop eax
js 0x401878
push ecx
push 0x10
push esi
push ebx
call sub.WS2_32.DLL_bind
pop edx
test eax, eax
js 0x401868
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x10
push ecx
push eax
push esi
push ebx
call sub.WS2_32.DLL_getsockname
pop edx
test eax, eax
jns 0x40188c
test ebx, ebx
je 0x401878
sub esp, 0xc
push ebx
call sub.WS2_32.DLL_closesocket
add esp, 0xc
push eax
push eax
push str.bind_udp_socket___failed_n
push 0
or edi, 0xffffffff
call fcn.00401410
add esp, 0x10
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4018a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ebx, ebx
jne 0x4018cc
jmp 0x4018e7
push 0
push ebx
push esi
push edi
call sub.WS2_32.DLL_recv
test eax, eax
jle 0x4018dc
sub ebx, eax
je 0x4018e7
add esi, eax
sub esp, 0xc
push edi
call fcn.00401640
add esp, 0x10
test eax, eax
jns 0x4018b8
lea esp, [ebp - 0xc]
or eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401900
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test eax, eax
jle 0x40194e
xor ebx, ebx
jmp 0x40193e
lea eax, [esi + ebx]
push 0
push 1
push eax
push edi
call sub.WS2_32.DLL_recv
test eax, eax
jle 0x40194e
cmp byte [esi + ebx], 0
je 0x401951
inc ebx
cmp dword [ebp + 0x10], ebx
jle 0x40194e
sub esp, 0xc
push edi
call fcn.00401640
add esp, 0x10
test eax, eax
jns 0x401920
or ebx, 0xffffffff
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401960
Capabilities:
Create tcp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [ebp - 0x14], 1
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov ax, word [esi + 2]
test ax, ax
jne 0x401a32
mov word [esi + 2], 0
mov word [esi], 2
push eax
push 6
push 1
push 2
call sub.WS2_32.DLL_socket
mov ebx, eax
mov edi, eax
test ebx, ebx
pop eax
js 0x401a14
cmp word [esi + 2], 0
je 0x4019ca
sub esp, 0xc
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0xffff
push ebx
call sub.WS2_32.DLL_setsockopt
add esp, 0xc
test eax, eax
js 0x401a04
push ecx
push 0x10
push esi
push ebx
call sub.WS2_32.DLL_bind
pop edx
test eax, eax
js 0x401a04
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x10
push ecx
push eax
push esi
push ebx
call sub.WS2_32.DLL_getsockname
pop edx
test eax, eax
js 0x401a04
push esi
push esi
push 0x7fffffff
push ebx
call sub.WS2_32.DLL_listen
pop edx
test eax, eax
pop ecx
jns 0x401a28
test ebx, ebx
je 0x401a14
sub esp, 0xc
push ebx
call sub.WS2_32.DLL_closesocket
add esp, 0xc
push eax
push eax
push str.bind_tcp_socket___failed_n
push 0
or edi, 0xffffffff
call fcn.00401410
add esp, 0x10
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
and eax, 0xffff
push eax
call sub.WS2_32.DLL_ntohs
mov ecx, dword [esi + 4]
mov ebx, eax
push ecx
call sub.WS2_32.DLL_inet_ntoa
push edx
push edx
mov edx, ebx
and edx, 0xffff
push edx
push eax
push str.__bind__s:_hu_n
call sub.msvcrt.dll_printf
add esp, 0x20
jmp 0x40198c