joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007a30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x21ac
call fcn.10075f70
mov eax, dword [0x10091628]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x21a4]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0x202
mov dword [ebp - 0x21ac], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10007a88
push str.WSAStartup_failed_n
call fcn.1000b030
add esp, 4
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075d21
mov esp, ebp
pop ebp
ret
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10007ab5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_failed_with_error:__ld_n
call fcn.1000b030
add esp, 8
jmp 0x10007bf2
xorps xmm0, xmm0
mov eax, 2
push ebx
movlpd qword [ebp - 0x200c], xmm0
mov word [ebp - 0x2014], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0xef1b
mov dword [ebp - 0x2010], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2012], ax
lea eax, [ebp - 0x2014]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10007b19
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Connect_failed_with_error:__ld_n
call fcn.1000b030
add esp, 8
jmp 0x10007beb
push 0
push 4
lea eax, [ebp - 0x21a8]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x10007b49
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.recv_failed_with_error:__ld_n
call fcn.1000b030
add esp, 8
jmp 0x10007beb
push dword [ebp - 0x21a8]
push str.recv_file_size:__d_n
call fcn.1000b030
add esp, 8
push 0
push 2
push 0x10079914
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 2
je 0x10007b87
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.send_failed_with_error:__ld_n
call fcn.1000b030
add esp, 8
jmp 0x10007beb
xor ebx, ebx
mov eax, edi
mov dword [edi + 0x10], ebx
cmp dword [edi + 0x14], 0x10
jb 0x10007b96
mov eax, dword [edi]
push 0
mov byte [eax], bl
lea eax, [ebp - 0x2004]
push 0x2000
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x10007beb
mov ecx, dword [ebp - 0x21ac]
lea eax, [ebp - 0x2004]
push edi
push eax
call fcn.10006c60
add ebx, edi
cmp ebx, dword [ebp - 0x21a8]
jae 0x10007beb
push 0
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jg 0x10007bb3
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.10075d21
mov esp, ebp
pop ebp
ret
Function at 0x10011bc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10011bf1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10011be0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10012ab0
Capabilities:
Create thread
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007844b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x35c
mov eax, dword [0x10091628]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 8]
mov ecx, dword [ebx + 0x10]
sub eax, 1
je 0x10012b15
sub eax, 5
jne 0x10012b0e
test ecx, ecx
je 0x10012b0e
mov eax, dword [0x10091b98]
mov dword [ecx], eax
mov eax, 1
jmp 0x10012b7d
lea eax, [ebp - 0x120]
mov dword [0x10091b98], esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x10012b7b
lea eax, [ebp - 0x120]
push eax
push str._sYGXMutexFile.lock
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.100129b0
add esp, 0x10
lea eax, [ebp - 0x228]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x10012b9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10075d21
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x330]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x330]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
mov dword [ebp - 0x350], 0x787d6c5a
mov dword [ebp - 0x34c], 0x818b8c80
mov dword [ebp - 0x348], 0x878e479c
mov word [ebp - 0x344], 0xd98
movq qword [ebp - 0x342], xmm0
mov dword [ebp - 0x33a], 0
mov word [ebp - 0x336], 0
mov byte [ebp - 0x334], 0
mov dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0x1d
jae 0x10012c58
nop dword [eax]
mov eax, dword [ebp - 0x354]
mov eax, dword [ebp - 0x354]
mov eax, dword [ebp - 0x354]
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0x1d
jb 0x10012c30
push esi
call fcn.10013400
push 4
call fcn.10075d2f
add esp, 8
test eax, eax
je 0x10012c74
mov dword [eax], 0x10012a90
jmp 0x10012c76
xor eax, eax
mov dword [ebp - 0x360], eax
lea ecx, [ebp - 0x358]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100129f0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x35c], eax
test eax, eax
je 0x10012ccd
mov ecx, dword [ebp - 0x358]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x10012cde
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x10012ce5
jmp 0x10012b0e
push 6
mov dword [ebp - 0x358], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x10013350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, 0xffffffff
jne 0x1001337e
or eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x10013391
mov ebx, dword [ebx]
test edi, edi
jle 0x100133cb
nop word [eax + eax]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100133df
add esi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp esi, edi
jl 0x100133a0
push dword [ebp - 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10013400
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor bl, bl
push edi
mov byte [ebp - 1], bl
call dword [sym.imp.ntdll.dll_RtlAcquirePebLock]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + 0xc]
mov esi, dword [esi + 0xc]
mov eax, esi
mov edi, dword [esi]
cmp edi, esi
je 0x100134d6
mov ecx, dword [ebp + 8]
mov ebx, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp ecx, dword [esi + 0x18]
jne 0x100134c7
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x3c]
mov byte [ebp - 1], 1
mov dword [ecx], eax
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x40]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x58]
mov eax, dword [esi + 0x54]
mov dword [ecx], eax
mov ecx, dword [esi + 0x54]
mov eax, dword [esi + 0x58]
mov dword [ecx + 4], eax
movzx eax, word [esi + 0x2e]
push eax
push 0
push dword [esi + 0x30]
call sub.VCRUNTIME140.dll_memset
movzx eax, word [esi + 0x26]
push eax
push 0
push dword [esi + 0x28]
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
cmp dword [ebp - 8], esi
mov eax, edi
cmovne eax, dword [ebp - 0xc]
mov edi, dword [ebx]
mov esi, ebx
cmp edi, eax
jne 0x10013432
mov bl, byte [ebp - 1]
call dword [sym.imp.ntdll.dll_RtlReleasePebLock]
xor eax, eax
test bl, bl
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007872b
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x10091628]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
push 0x10079da8
push str..log.txt
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
add esp, 0x10
test eax, eax
jne 0x10016318
push str.Error_opening_log_file
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
call fcn.1000e120
mov esi, eax
mov ecx, esi
call fcn.1000d610
call fcn.10015d70
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x1001634e
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1001633f
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x12c]
push eax
call fcn.10006dc0
cmp dword [ebp - 0x11c], 0
je 0x100163ee
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
lea eax, [ebp - 0x144]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.10014620
lea eax, [ebp - 0x144]
push eax
call fcn.100058c0
lea eax, [ebp - 0x12c]
push eax
call fcn.10007c10
mov edx, dword [ebp - 0x130]
add esp, 0x10
cmp edx, 0x10
jb 0x100163ee
mov ecx, dword [ebp - 0x144]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100163e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100163e4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10075d5f
add esp, 8
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x1001642a
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10016420
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10016420
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10075d5f
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10075d21
mov esp, ebp
pop ebp
ret

Function at 0x10017ab0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], 0x67452301
mov eax, ecx
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ecx + 0x9c], 0
ret
Function at 0x1001a880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10078a86
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10091628]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebx], eax
mov dword [ebx + 4], 1
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
movsd qword [ebx + 0x18], xmm0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0xf
mov byte [ebx + 0x20], 0
mov dword [ebx + 0x38], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0xf
mov byte [ebx + 0x38], 0
lea esi, [ebx + 0x50]
mov byte [ebp - 4], 1
push 0x40
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10075d2f
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
push 0x1000
lea ecx, [ebx + 0x38]
mov byte [ebp - 4], 2
call fcn.1000a3b0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10025010
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x6bb], 0
je 0x100250ad
cmp dword [esi + 0x194], 0
je 0x10025067
push esi
call fcn.100259e0
push 1
push esi
mov byte [esp + 0x14], al
call fcn.10025e80
push dword [esi + 0x144]
mov eax, dword [esi + 0x194]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call eax
push dword [esp + 0x28]
push esi
call fcn.10025e80
add esp, 0x28
pop esi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x1002507c
sub eax, 1
je 0x1002507c
sub eax, 1
jne 0x100250ad
push dword [esi + 0x140]
lea eax, [ecx*2 + 0x1007b2bc]
push 1
add eax, ecx
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
push dword [esi + 0x140]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x20
pop esi
ret

Function at 0x10025470
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, 0x2b
test edi, edi
je 0x1002551b
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
nop dword [eax]
mov ebx, 4
lea eax, [esp + 0x1c]
push 4
push eax
cmp edi, ebx
push ebp
cmovb ebx, edi
call fcn.1002f2f0
add esp, 0xc
cmp eax, 4
jne 0x100254d6
cmp byte [0x10091bf0], 0
jne 0x100254e2
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x1002551d
mov eax, dword [esp + 0x1c]
jmp 0x100254ff
imul eax, dword [0x10091bec], 0x41c64e6d
add eax, 0x3039
mov dword [0x10091bec], eax
rol eax, 0x10
xor ecx, ecx
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x10025513
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x10025503
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x10025490
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10025530
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
sub ebx, 1
je 0x100255d0
mov esi, dword [esp + 0x14]
mov ebp, 0x3e
nop
push 4
lea eax, [esp + 0x20]
push eax
push esi
call fcn.1002f2f0
add esp, 0xc
cmp eax, 4
je 0x1002556b
test eax, eax
jne 0x100255d5
jmp 0x100255b5
cmp byte [0x10091bf0], 0
jne 0x1002559a
push 2
push 4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
je 0x100255b5
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret
imul eax, dword [0x10091bec], 0x41c64e6d
add eax, 0x3039
mov dword [0x10091bec], eax
rol eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0xfffffffc
jae 0x10025550
xor edx, edx
div ebp
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x10025550
mov byte [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100255e0
Capabilities:
Generate random numbers via winapi

Disassembly:
push dword [esp + 8]
push 0
push dword [esp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
ret
Function at 0x1002acd0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1002ad7f
push esi
call fcn.100447c0
add esp, 4
test al, al
jne 0x1002ad7f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1002acf7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1004d6a0
add esp, 0xc
test eax, eax
je 0x1002ad2b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1004d6a0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1002ad2d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x1002ad5e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.100233a0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x1002ad40
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1002f050
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x10091628]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
cmp dword [eax], 0x100912ec
mov ecx, dword [eax + 8]
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0xc]
jne 0x1002f08a
mov esi, dword [ecx + 0x78]
mov ebx, dword [ecx + 0x7c]
mov ebp, dword [ecx + 0x80]
jmp 0x1002f096
mov esi, dword [ecx + 0x30]
mov ebx, dword [ecx + 0x34]
mov ebp, dword [ecx + 0x4c0]
test esi, esi
je 0x1002f17c
mov eax, dword [edi]
test eax, eax
je 0x1002f0d3
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1002f0c6
test dl, dl
je 0x1002f0c2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1002f0c6
add ecx, 2
add eax, 2
test dl, dl
jne 0x1002f0a6
xor eax, eax
jmp 0x1002f0cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x1002f17c
push edi
call fcn.1002f000
push esi
call dword [0x10091264]
mov edx, eax
add esp, 8
mov dword [edi], edx
test edx, edx
je 0x1002f12b
test ebx, ebx
je 0x1002f14c
mov ecx, ebx
mov al, byte [esi]
cmp al, byte [ecx]
jne 0x1002f111
test al, al
je 0x1002f10d
mov al, byte [esi + 1]
cmp al, byte [ecx + 1]
jne 0x1002f111
add esi, 2
add ecx, 2
test al, al
jne 0x1002f0f1
xor eax, eax
jmp 0x1002f116
sbb eax, eax
or eax, 1
test eax, eax
je 0x1002f14c
push ebx
call dword [0x10091264]
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jne 0x1002f14f
push edi
call fcn.1002f000
add esp, 4
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10075d21
add esp, 0x18
ret
mov dword [edi + 4], edx
mov esi, dword [edi]
mov dword [edi + 8], 0
test esi, esi
je 0x1002f1af
cmp byte [esi], 0
je 0x1002f1af
mov ebx, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [esp + 0x14]
push eax
push esi
push 2
call ebx
test eax, eax
je 0x1002f198
mov dword [edi + 0xc], 1
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword [eax + 0x38], ebp
xor eax, eax
pop ebp
pop ebx
xor ecx, esp
call fcn.10075d21
add esp, 0x18
ret
lea eax, [esp + 0x14]
push eax
push esi
push 0x17
call ebx
test eax, eax
je 0x1002f1af
mov dword [edi + 0xc], 2
jmp 0x1002f17c
mov ecx, dword [edi]
mov dword [edi + 0xc], 0
cmp byte [ecx], 0
je 0x1002f17c
mov esi, ecx
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1002f1c2
sub esi, edx
je 0x1002f1d5
cmp byte [ecx + esi - 1], 0x2e
jne 0x1002f1d5
dec esi
cmp esi, 0xffff
jae 0x1002f17c
lea eax, [esi + 1]
push eax
push 1
call dword [0x10091268]
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x1002f12b
push esi
push dword [edi]
push eax
call fcn.10023400
mov eax, dword [edi + 8]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x1002f17c
Function at 0x100376e0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
jne 0x100376fa
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x10079dc8
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcspbrk
add esp, 8
test eax, eax
je 0x10037742
test ebp, ebp
je 0x10037733
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x10037768
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10037768
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x10037842
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10037785
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0x10091258]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10037838
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10037838
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100377c6
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100377e1
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x10037800
test ebp, ebp
je 0x1003782f
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x1009125c]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x1009125c]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x10041a90
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x10091ce0]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x10041ae1
push 3
push 2
push eax
push eax
push 6
call fcn.10067410
add esp, 0x14
test al, al
je 0x10041ad5
mov dword [0x10091ce0], 2
add esp, 0xc
ret
mov dword [0x10091ce0], 1
jmp 0x10041ae6
cmp eax, 2
je 0x10041b2c
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10041b11
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x10041b2c
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret