joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041c30
Capabilities:
Get hostname

Disassembly:
sub esp, 0x20
mov eax, dword [0x1008d040]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov esi, dword [esp + 0x2c]
xor ebx, ebx
push edi
xor edi, edi
mov dword [esp + 0xc], ebx
test byte [esi + 0x44], 1
jne 0x10041c59
mov dword [esi], 0x100
cmp dword [esi + 0x38], ebx
jne 0x10041c65
mov dword [esi + 0x38], 0x4d0
cmp dword [esi + 4], ebx
jne 0x10041c71
mov dword [esi + 4], 0x7d0
cmp dword [esi + 8], ebx
jne 0x10041c7d
mov dword [esi + 8], 3
push dword [esi + 0x84]
call fcn.10045800
add esp, 4
test eax, eax
jne 0x10041d1a
test dword [esi], 0x200
je 0x10041cb2
pop edi
pop esi
mov eax, 0x1a
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100574bd
add esp, 0x20
ret
push 0x7f000001
mov dword [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_htonl]
push 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10042090
add esp, 0x14
test eax, eax
jne 0x10041e25
push eax
push dword [esp + 0x10]
push esi
call fcn.10042430
push dword [esp + 0x18]
mov ebx, eax
call fcn.10045170
add esp, 0x10
test ebx, ebx
je 0x10041d1a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100574bd
add esp, 0x20
ret
push ebp
cmp dword [esi + 0x28], edi
jne 0x10041de7
mov ebp, 0x40
mov dword [esi + 0x28], edi
push ebp
mov dword [esp + 0x18], ebp
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10041d56
lea eax, [ebp - 0x31]
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100574bd
add esp, 0x20
ret
push ebp
push edi
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x10041d8f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
jne 0x10041d93
mov eax, dword [esp + 0x14]
add ebp, ebp
add eax, eax
push eax
push edi
mov dword [esp + 0x1c], eax
call dword [0x1008d004]
add esp, 8
test eax, eax
je 0x10041db9
mov edi, eax
jmp 0x10041d56
test eax, eax
je 0x10041d96
mov byte [edi], 0
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x10041de7
push 4
call dword [section..data]
add esp, 4
mov dword [esi + 0x24], eax
test eax, eax
jne 0x10041dc0
mov ebx, 0xf
jmp 0x10041e14
lea eax, [ebp + 1]
push eax
call fcn.10045ea0
mov ecx, dword [esi + 0x24]
add esp, 4
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
cmp dword [eax], 0
jne 0x10041de0
mov ebx, 0xf
jmp 0x10041e14
mov dword [esi + 0x28], 1
cmp dword [esi + 0x30], 0
jne 0x10041df4
mov dword [esi + 0x2c], 0
cmp dword [esi + 0x34], 0
jne 0x10041e14
push 0x1005d620
call fcn.10045ea0
add esp, 4
mov dword [esi + 0x34], eax
test eax, eax
mov ecx, 0xf
cmove ebx, ecx
test edi, edi
je 0x10041e22
push edi
call dword [0x1008d008]
add esp, 4
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100574bd
add esp, 0x20
ret
Function at 0x10046260
Capabilities:
Generate random numbers via rtlgenrandom
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [ebx]
xor esi, esi
sub eax, 1
je 0x10046360
sub eax, 1
je 0x1004630c
sub eax, 2
jne 0x10046340
mov ecx, dword [ebx + 0x10c]
mov eax, dword [ebx + 0x108]
mov dword [esp + 0x10], ecx
test edi, edi
je 0x100462fa
inc eax
movzx eax, al
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x18]
mov cl, byte [eax + ebx + 8]
mov eax, dword [esp + 0x10]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [esp + 0x10], eax
movzx eax, byte [eax + ebx + 8]
mov byte [ebx + ebp + 8], al
mov eax, dword [esp + 0x10]
mov byte [eax + ebx + 8], cl
mov eax, ebp
mov ebp, dword [esp + 0x1c]
movzx eax, byte [eax + ebx + 8]
add eax, edx
movzx eax, al
movzx eax, byte [eax + ebx + 8]
mov byte [esi + ebp], al
inc esi
mov eax, dword [esp + 0x18]
cmp esi, edi
jb 0x100462a4
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [ebx + 0x108], eax
mov dword [ebx + 0x10c], ecx
pop ebx
pop ecx
ret
push dword [ebx + 8]
push edi
push 1
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
test eax, eax
je 0x10046340
nop
add esi, eax
cmp esi, edi
je 0x10046367
push dword [ebx + 8]
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebp]
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
test eax, eax
jne 0x10046320
mov eax, dword [ebx]
sub eax, 2
jne 0x10046352
push dword [ebx + 8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
push ebx
call fcn.10045fa0
add esp, 4
jmp 0x10046271
push edi
push ebp
call sub.ADVAPI32.dll_SystemFunction036
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10046b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push dword [esp + 0x20]
mov dword [esp + 0x18], 0
push dword [esp + 0x20]
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10046bc8
cmp eax, 0xea
jne 0x10046c25
mov eax, dword [esp + 4]
test eax, eax
je 0x10046c25
inc eax
push eax
call dword [section..data]
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x10046c25
lea ecx, [esp + 4]
push ecx
push eax
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10046c14
mov ecx, dword [esp + 4]
cmp ecx, 1
je 0x10046c14
mov eax, dword [esi]
pop esi
mov byte [ecx + eax], 0
mov eax, 1
pop ecx
ret
push dword [esi]
call dword [0x1008d008]
add esp, 4
mov dword [esi], 0
xor eax, eax
pop esi
pop ecx
ret
Function at 0x100471f0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push str.LOCALDOMAIN
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x10047239
push eax
call fcn.10045ea0
mov esi, eax
add esp, 4
test esi, esi
jne 0x10047218
pop edi
lea eax, [esi + 0xf]
pop esi
ret
push 1
push esi
push dword [esp + 0x14]
call fcn.10047260
push esi
mov edi, eax
call dword [0x1008d008]
add esp, 0x10
test edi, edi
je 0x10047239
mov eax, edi
pop edi
pop esi
ret
push str.RES_OPTIONS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x1004725a
push eax
push dword [esp + 0x10]
call fcn.10047310
add esp, 8
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x10048020
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
test ebx, ebx
je 0x1004808b
mov edi, dword [esp + 0xc]
test edi, edi
je 0x1004808b
push esi
push 0x14
call fcn.10041a10
mov esi, eax
add esp, 4
test esi, esi
jne 0x1004804a
lea eax, [esi + 0xf]
pop esi
pop edi
pop ebx
ret
mov eax, dword [esp + 0x18]
mov dword [esi + 0xc], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x100480a0
push 0
push 0
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x10048083
push esi
call dword [0x1008d008]
add esp, 4
mov eax, 3
pop esi
pop edi
pop ebx
ret
mov dword [edi], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
pop edi
mov eax, 2
pop ebx
ret
Function at 0x1004a610
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
test eax, eax
je 0x1004a6fd
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x1004a6fd
push esi
push edi
push 0x1005db20
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov edi, eax
add esp, 8
test edi, edi
jne 0x1004a665
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
je 0x1004a65a
sub eax, 1
je 0x1004a65a
mov esi, 0xe
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
push 2
push 0
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
je 0x1004a68a
push edi
mov esi, 0xe
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
mov esi, eax
add esp, 4
test esi, esi
js 0x1004a676
push 0
push 0
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
jne 0x1004a676
test esi, esi
je 0x1004a6d8
push esi
push ebx
call fcn.1004a1b0
add esp, 8
test eax, eax
jne 0x1004a6e9
mov eax, dword [ebx + 8]
add eax, dword [ebx + 4]
je 0x1004a6e9
push edi
push esi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, esi
jne 0x1004a676
add dword [ebx + 4], esi
push edi
xor esi, esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov esi, 0xf
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov eax, 2
pop ebx
ret
Function at 0x1004c980
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x5c
mov eax, dword [0x1008d040]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
push ebp
mov ebp, dword [esp + 0x6c]
push esi
mov esi, dword [esp + 0x6c]
cmp eax, 2
jne 0x1004c9b4
push 4
push ebp
push esi
call fcn.1004c610
add esp, 0xc
mov esi, eax
jmp 0x1004cab1
cmp eax, 0x17
jne 0x1004caee
push esi
call fcn.10045ef0
add esp, 4
cmp eax, 0x46
jb 0x1004c9de
push 0x2738
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
jmp 0x1004cab1
push edi
push 0x46
lea eax, [esp + 0x20]
push esi
push eax
call fcn.10045e40
lea eax, [esp + 0x28]
push 0x2f
push eax
call sub.VCRUNTIME140.dll_strchr
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1004ca05
mov byte [edi], 0
inc edi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.1004cb10
add esp, 8
cmp eax, 1
je 0x1004ca24
or esi, 0xffffffff
jmp 0x1004cab0
push ebx
test edi, edi
jne 0x1004ca45
mov esi, 0x80
lea eax, [esi + 7]
shr eax, 3
push eax
lea eax, [esp + 0x14]
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x1004caaf
mov al, byte [edi]
xor esi, esi
xor ebx, ebx
test al, al
je 0x1004caa4
nop
movsx eax, al
lea edi, [edi + 1]
push eax
push str.0123456789
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
je 0x1004caa4
mov ecx, ebx
inc ebx
test ecx, ecx
je 0x1004ca73
test esi, esi
je 0x1004caa4
lea esi, [esi + esi*4]
add esi, esi
sub esi, str.0123456789
add esi, eax
cmp esi, 0x80
ja 0x1004caa4
mov al, byte [edi]
test al, al
jne 0x1004ca50
test ebx, ebx
je 0x1004caa4
lea eax, [esi + 7]
shr eax, 3
cmp eax, 0x10
jbe 0x1004ca34
push 0x2738
jmp 0x1004caa6
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
pop ebx
pop edi
cmp esi, 0xffffffff
jne 0x1004cad4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1004cad4
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100574bd
add esp, 0x5c
ret
sar esi, 0x1f
and esi, 0xfffffffe
lea eax, [esi + 1]
pop esi
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100574bd
add esp, 0x5c
ret
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x60]
or eax, 0xffffffff
pop esi
pop ebp
xor ecx, esp
call fcn.100574bd
add esp, 0x5c
ret
Function at 0x1004d0d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14c
mov eax, dword [0x1008d040]
xor eax, esp
mov dword [esp + 0x148], eax
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x158]
push ebx
mov ebx, dword [esp + 0x158]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
test eax, eax
je 0x1004d2e9
test ebx, ebx
je 0x1004d2e9
test ecx, ecx
je 0x1004d2e9
mov dword [ecx], ebp
test byte [eax], 0x40
jne 0x1004d2cd
push 0x2e
push ebx
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
jne 0x1004d2cd
push esi
push str.HOSTALIASES
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov esi, eax
add esp, 4
test esi, esi
jne 0x1004d157
lea esi, [ebp + 4]
jmp 0x1004d280
call fcn.1004a130
mov ebp, eax
test ebp, ebp
jne 0x1004d16a
lea esi, [eax + 0xf]
jmp 0x1004d280
push ebp
push esi
call fcn.1004a610
mov esi, eax
add esp, 8
test esi, esi
jne 0x1004d280
lea eax, [esp + 0xc]
push eax
push esi
push 0x30
push 1
push 0x1007fd08
push ebp
call fcn.1004a9f0
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x1004d280
push edi
push dword [esp + 0x10]
call fcn.100454c0
mov edi, eax
add esp, 4
test edi, edi
je 0x1004d27a
push edi
call fcn.100454c0
push 0x3f
mov esi, eax
mov byte [esp + 0x20], 0
lea eax, [esp + 0x21]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0xff
lea eax, [esp + 0x6d]
mov byte [esp + 0x6c], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
call fcn.1004ad60
push esi
call fcn.10049f60
push 0x40
lea eax, [esp + 0x40]
push eax
push esi
call fcn.1004adc0
add esp, 0x30
test eax, eax
jne 0x1004d267
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.10050990
add esp, 8
test eax, eax
jne 0x1004d267
push 1
push esi
call fcn.1004a090
push esi
call fcn.1004ad60
push esi
call fcn.10049f60
push 0x100
lea eax, [esp + 0x6c]
push eax
push esi
call fcn.1004adc0
add esp, 0x1c
test eax, eax
jne 0x1004d267
lea eax, [esp + 0x58]
push eax
call fcn.10045ef0
add esp, 4
test eax, eax
je 0x1004d267
lea eax, [esp + 0x58]
push eax
call fcn.10045d00
add esp, 4
test eax, eax
jne 0x1004d2ac
push edi
call fcn.10045580
mov edi, eax
add esp, 4
test edi, edi
jne 0x1004d1b7
mov esi, 4
pop edi
push ebp
call fcn.1004a190
push dword [esp + 0x10]
call fcn.10045170
add esp, 8
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.100574bd
add esp, 0x14c
ret
lea eax, [esp + 0x58]
push eax
call fcn.10045ea0
mov ecx, dword [esp + 0x18]
xor esi, esi
add esp, 4
test eax, eax
mov dword [ecx], eax
mov ecx, 0xf
cmove esi, ecx
jmp 0x1004d27f
pop ebp
mov eax, 4
pop ebx
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.100574bd
add esp, 0x14c
ret
mov ecx, dword [esp + 0x150]
mov eax, 2
pop ebp
pop ebx
xor ecx, esp
call fcn.100574bd
add esp, 0x14c
ret
Function at 0x1004d6b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push edi
xor edi, edi
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x1004d887
mov eax, dword [eax + 0x1c]
mov ebx, edi
inc edi
mov dword [esp + 0x20], ebx
test eax, eax
jne 0x1004d6c7
test edi, edi
je 0x1004d887
lea eax, [edi + edi*4]
shl eax, 3
push esi
push eax
mov dword [esp + 0x2c], eax
call dword [section..data]
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jne 0x1004d707
lea eax, [esi + 0xf]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ebp, dword [ebp + 0x1c]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebp
test edi, edi
je 0x1004d80c
mov ebx, dword [esp + 0x30]
lea ecx, [esi + 0x24]
mov dword [esp + 0x10], ecx
mov dword [ecx], eax
mov dword [ecx - 0x24], ebp
mov ebp, dword [ebp + 0x18]
movzx ecx, word [ebp]
mov eax, ecx
sub eax, 2
je 0x1004d74d
sub eax, 0x15
je 0x1004d746
xor eax, eax
jmp 0x1004d7da
mov eax, 0x1c
jmp 0x1004d752
mov eax, 0x10
push 0x11
push 2
push ecx
push ebx
mov dword [esp + 0x24], eax
call fcn.10051190
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x1004d780
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 0x273f
jne 0x1004d86d
xor eax, eax
jmp 0x1004d7da
push dword [esp + 0x14]
push ebp
push esi
push ebx
call fcn.10050c70
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1004d7af
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 0x2714
je 0x1004d780
push esi
push ebx
call fcn.10050c30
add esp, 8
xor eax, eax
jmp 0x1004d7da
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
add eax, 0xffffffe4
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
push esi
push ebx
test eax, eax
jne 0x1004d865
call fcn.10050c30
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
mov dword [ecx - 0x20], eax
add ecx, 0x28
mov eax, dword [esp + 0x18]
mov ebp, dword [ebp + 0x1c]
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], ebp
cmp eax, edi
jb 0x1004d727
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
push 0x1004db50
push 0x28
push edi
push esi
call sub.api_ms_win_crt_utility_l1_1_0.dll_qsort
mov ecx, dword [esp + 0x44]
add esp, 0x10
mov eax, dword [esi]
mov dword [ecx + 0x1c], eax
test ebx, ebx
je 0x1004d842
mov ecx, esi
nop dword [eax]
mov eax, dword [ecx + 0x28]
lea edx, [ecx + 0x28]
mov ecx, dword [ecx]
mov dword [ecx + 0x1c], eax
lea ecx, [edx]
sub ebx, 1
jne 0x1004d830
mov eax, dword [esp + 0x28]
push esi
mov eax, dword [eax + esi - 0x28]
mov dword [eax + 0x1c], 0
call dword [0x1008d008]
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret
call fcn.10050c30
add esp, 8
push dword [esp + 0x20]
call dword [0x1008d008]
add esp, 4
mov eax, 4
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x10050c70
Capabilities:
Connect socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x10050c9d
mov eax, dword [eax + 8]
test eax, eax
je 0x10050c9d
push dword [ecx + 0xb8]
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
call eax
add esp, 0x10
ret
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_connect]
ret
Function at 0x100511d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x10051203
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10051203
push dword [ecx + 0xb8]
push 0
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_recv]
ret

Function at 0x10051220
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x10051259
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10051259
push dword [ecx + 0xb8]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recvfrom]
ret

Function at 0x10051280
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x100512c2
mov edx, dword [eax + 0x10]
test edx, edx
je 0x100512c2
push dword [ecx + 0xb8]
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
lea eax, [esp + 4]
push 1
push eax
push dword [esp + 0x1c]
call edx
add esp, 0x10
add esp, 8
ret
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
add esp, 8
ret

Function at 0x10051760
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test esi, esi
je 0x10051785
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10051774
pop edi
mov eax, edx
pop esi
ret

Function at 0x10051790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x1c]
test ebx, ebx
je 0x100517c3
movzx eax, byte [esi + ebp]
push eax
call fcn.10045e00
movzx eax, al
inc esi
xor eax, edi
add esp, 4
imul edi, eax, 0x1000193
cmp esi, ebx
jb 0x100517a6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10055df0
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
sub esp, 0x898
mov eax, dword [0x1008d040]
xor eax, esp
mov dword [esp + 0x894], eax
mov eax, dword [esp + 0x8a4]
mov ecx, dword [esp + 0x8a8]
mov edx, dword [esp + 0x8b8]
push ebx
push ebp
movzx ebp, word [esp + 0x8a8]
push esi
mov esi, dword [esp + 0x8b8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x8bc]
push edi
mov edi, dword [esp + 0x8ac]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x8c4]
push eax
push ebp
push edi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
mov dword [ecx], 0
call fcn.10056880
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x10055f77
test esi, esi
je 0x10055ed4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x10055e9d
push str.getsockname
call sub.api_ms_win_crt_runtime_l1_1_0.dll_perror
add esp, 4
jmp 0x10055ed4
push 0xa
push 0
push 0
push dword [esp + 0x20]
lea eax, [esp + 0x34]
push esi
push dword [esp + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x10055ed4
push eax
push str.getnameinfo___failed_:__d_n
push 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
add esp, 4
push eax
call fcn.10052cb0
add esp, 0xc
push ebp
push edi
push 0x1005e59c
push dword [esp + 0x24]
lea eax, [esp + 0xb4]
push str.GET__s_HTTP__s_r_nHost:__s:_d_r_nConnection:_Close_r_nUser_Agent:_Windows_UPnP_1.1_MiniUPnPc__r_n_r_n
push 0x800
push eax
call fcn.10013030
mov edi, eax
add esp, 0x1c
cmp edi, 0x800
jae 0x10055f70
xor esi, esi
test edi, edi
jle 0x10055f2e
mov ebp, dword [sym.imp.WS2_32.dll_send]
nop
push 0
mov eax, edi
sub eax, esi
push eax
lea eax, [esp + 0xac]
add eax, esi
push eax
push ebx
call ebp
test eax, eax
js 0x10055f63
add esi, eax
cmp esi, edi
jl 0x10055f10
push dword [esp + 0x1c]
push dword [esp + 0x24]
push ebx
call fcn.100557f0
add esp, 0xc
mov esi, eax
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
mov ecx, dword [esp + 0x8a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100574bd
add esp, 0x898
ret
push str.send
call sub.api_ms_win_crt_runtime_l1_1_0.dll_perror
add esp, 4
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10055f4a
Function at 0x100562f0
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
sub esp, 0x214
mov eax, dword [0x1008d040]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x230]
push ebx
mov ebx, dword [esp + 0x224]
push ebp
mov ebp, dword [esp + 0x230]
push esi
mov esi, eax
mov dword [esp + 0xc], ecx
push edi
mov edi, dword [esp + 0x22c]
mov dword [esp + 0x14], eax
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10056338
mov byte [esp + 0x18], al
sub esi, ecx
mov ax, word [esp + 0x234]
cmp ax, 0x50
je 0x1005636b
movzx eax, ax
push eax
push str.:_hu
lea eax, [esp + 0x20]
push 8
push eax
call fcn.10013030
add esp, 0x10
push ebp
push esi
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x20]
lea eax, [esp + 0x34]
push edi
push str.POST__s_HTTP__s_r_nHost:__s_s_r_nUser_Agent:_Windows_UPnP_1.1_MiniUPnPc__r_nContent_Length:__d_r_nContent_Type:_text_xml__charset_utf_8__r_nSOAPAction:___s__r_nConnection:_Close_r_nCache_Control:_no_cache_r_nPragma:_no_cache_r_n_r_n
push 0x200
push eax
call fcn.10013030
mov ebx, eax
add esp, 0x24
cmp ebx, 0x200
jb 0x1005639e
or eax, 0xffffffff
jmp 0x10056418
lea ebp, [ebx + esi]
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov edi, eax
add esp, 4
test edi, edi
jne 0x100563b5
or esi, 0xffffffff
jmp 0x10056416
push ebx
lea eax, [esp + 0x24]
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
push esi
push dword [esp + 0x24]
lea eax, [edi + ebx]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
push 0
push ebp
push edi
push dword [esp + 0x234]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jns 0x1005640d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.send
push str.Socket_error:__s___d_n
push 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
add esp, 4
push eax
call fcn.10052cb0
add esp, 0x10
push edi
call fcn.10058873
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100574bd
add esp, 0x214
ret