joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x1000913c
jl 0x10009130
test esi, esi
jne 0x1000913c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10009155
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov edx, dword [eax]
test edx, edx
je 0x1000918d
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1000918d
cmp eax, dword [ebp + 0xc]
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
mov edx, edi
je 0x10009210
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100091b6
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, edi
mov ecx, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x100091fc
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10009223
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100091d0
test edx, edx
je 0x10009210
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, edi
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100b0270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100095c0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100908b3
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100095f0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100095f0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100908b3
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100096c6
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10009619
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10009625
movsx eax, bl
jmp 0x1000965d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10009687
sub eax, 1
je 0x10009687
sub eax, 2
jne 0x100096c6
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100908b3
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100096a5
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100096c6
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100096c6
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100908b3
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100908b3
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a1a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100b0270]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1000a25c
cmp byte [esi + 0x3d], 0
je 0x1000a25c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000a24a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000a211
sub eax, 1
je 0x1000a215
sub eax, 2
jne 0x1000a24a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100908b3
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000a233
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000a24a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100908b3
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100908b3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100908b3
mov esp, ebp
pop ebp
ret
Function at 0x100128b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100128fc
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100128df
cmp edi, 2
jb 0x100128df
cmp byte [esi], cl
jne 0x100128df
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100a53a0]
test edi, edi
jne 0x100128c5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1001292b
cmp cl, 0x23
jne 0x10012912
cmp byte [esi], cl
jne 0x10012912
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100a53a0]
test cl, cl
jne 0x10012903
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10012a40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10012a54
mov dword [edi], 0
mov edx, 0x100a9ea8
call fcn.10012940
mov esi, eax
test esi, esi
je 0x10012b50
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10012b46
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10012b46
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10012b46
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10012b46
mov eax, dword [0x100b0e48]
test eax, eax
je 0x10012ad0
inc dword [eax + 0x36c]
push dword [0x100b0e44]
push ebx
call fcn.10012320
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10012b46
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x10012b2b
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x100b0e48]
add esp, 4
test eax, eax
je 0x10012b13
dec dword [eax + 0x36c]
push dword [0x100b0e44]
push ebx
call fcn.10012340
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10012b3d
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014210
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b0270]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc4]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xcc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100a53a0]
sub esi, 1
jne 0x10014243
mov eax, dword [0x100b0e48]
not ebx
cmp dword [eax + 0x1be0], ebx
jne 0x10014272
mov dword [eax + 0x1be4], ebx
cmp dword [eax + 0x1c1c], ebx
jne 0x10014281
mov byte [eax + 0x1c20], 1
cmp dword [eax + 0x1bc8], ebx
jne 0x1001429a
push ecx
push edi
mov edx, 4
mov ecx, ebx
call fcn.100235e0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100908b3
mov esp, ebp
pop ebp
ret 4
Function at 0x10018260
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x1001829d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x10018283
cmp byte [esi], bl
jne 0x10018283
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x100a53a0]
test bl, bl
jne 0x10018274
pop edi
pop esi
not ecx
pop ebx
jmp fcn.100181f0

Function at 0x100225a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2fa8], 0
lea esi, [edi + 0x2fac]
je 0x10022622
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x100225dc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.10024350
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.10012ce0
mov edx, dword [esi]
mov ecx, 0x100b0e39
push dword [edi + 0x2fa8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2fb4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.10012ce0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002be20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002be5c
mov eax, dword [0x100b0e48]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1002be46
dec dword [eax + 0x36c]
push dword [0x100b0e44]
push ecx
call fcn.10012340
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1002be96
mov eax, dword [0x100b0e48]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1002be80
dec dword [eax + 0x36c]
push dword [0x100b0e44]
push ecx
call fcn.10012340
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1002bed0
mov eax, dword [0x100b0e48]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1002beba
dec dword [eax + 0x36c]
push dword [0x100b0e44]
push ecx
call fcn.10012340
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1002bf26
mov eax, dword [0x100b0e48]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1002bf10
dec dword [eax + 0x36c]
push dword [0x100b0e44]
push ecx
call fcn.10012340
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1002bf60
mov eax, dword [0x100b0e48]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1002bf4a
dec dword [eax + 0x36c]
push dword [0x100b0e44]
push ecx
call fcn.10012340
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1002bf9a
mov eax, dword [0x100b0e48]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1002bf84
dec dword [eax + 0x36c]
push dword [0x100b0e44]
push ecx
call fcn.10012340
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1002e710
Function at 0x100371a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x1003720b
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100aa2c8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100aa2c8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100aa2c8]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100aa2c8]
sub edi, 1
jne 0x100371b4
pop edi
test esi, esi
je 0x1003722a
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100aa2c8]
sub esi, 1
jne 0x10037210
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x1003a6a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0x18]
push 1
push dword [ebp + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x10045730
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100457bc
push esi
call fcn.1005b790
add esp, 4
test al, al
jne 0x100457bc
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10045753
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.100645c0
add esp, 0xc
test eax, eax
je 0x10045787
sub eax, esi
push eax
push 0x2e
push esi
call fcn.100645c0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10045789
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x100457b5
mov al, byte [esi]
push eax
call fcn.10056e40
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x10045797
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10050b20
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x712], 0
je 0x10050bb7
cmp dword [edi + 0x1b0], 0
je 0x10050b71
push esi
push 1
push edi
call fcn.10040530
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.10040530
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov edx, dword [esp + 0xc]
mov ecx, edx
sub ecx, 0
je 0x10050b86
sub ecx, 1
je 0x10050b86
sub ecx, 1
jne 0x10050bb7
push dword [edi + 0x148]
lea eax, [edx*2 + 0x1009778c]
push 1
add eax, edx
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x10051130
Capabilities:
Query environment variable

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
mov dword [esp + 0xc], 0
push str.CURL_SMALLSENDS
mov edi, dword [esi + 0xc]
cmp eax, dword [edi + 0x14c]
sete bl
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x1005117f
push 0xa
push 0
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
test eax, eax
je 0x1005117f
cmp dword [esp + 0x20], eax
cmovb eax, dword [esp + 0x20]
jmp 0x10051183
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
push eax
push dword [esp + 0x24]
mov eax, dword [edi + ebx*4 + 0x168]
push ebx
push esi
call eax
mov ecx, dword [esp + 0x38]
add esp, 0x14
mov dword [ecx], eax
pop edi
pop esi
pop ebx
test eax, eax
jns 0x100511ba
mov eax, dword [esp]
test eax, eax
je 0x100511be
cmp eax, 0x51
jne 0x100511c3
mov dword [ecx], 0
xor eax, eax
pop ecx
ret
mov eax, 0x37
pop ecx
ret
Function at 0x10051870
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x100b0270]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100518f7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.1003bb10
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x10051937
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.10051460
add esp, 0x10
test al, al
jne 0x10051940
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.1003bb10
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10050bc0
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100908b3
add esp, 0x188
ret
Function at 0x10055620
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp byte [0x100b0a4d], 0
push esi
push edi
mov edi, dword [esp + 0x20]
je 0x10055695
test edi, edi
je 0x10055695
mov eax, dword [0x100b0a50]
test eax, eax
jne 0x1005568f
mov esi, dword [esp + 0x1c]
push str.recv
push esi
push edi
push str.LIMIT__s:_d__s_reached_memlimit_n
call fcn.10055420
add esp, 0x10
push str.recv
push esi
push edi
push str.LIMIT__s:_d__s_reached_memlimit_n
push 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
add esp, 4
push eax
call fcn.10055a90
push dword [0x100b0a48]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 0x18
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
pop edi
pop esi
mov dword [eax], 0xc
or eax, 0xffffffff
ret
dec eax
mov dword [0x100b0a50], eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test edi, edi
je 0x100556c8
push esi
push dword [esp + 0x18]
push dword [esp + 0x24]
push edi
push str.RECV__s:_d_recv__lu____ld_n
call fcn.10055420
add esp, 0x14
pop edi
mov eax, esi
pop esi
ret

Function at 0x10055700
Capabilities:
Send data
Send data on socket

Disassembly:
cmp byte [0x100b0a4d], 0
push esi
push edi
mov edi, dword [esp + 0x20]
je 0x10055775
test edi, edi
je 0x10055775
mov eax, dword [0x100b0a50]
test eax, eax
jne 0x1005576f
mov esi, dword [esp + 0x1c]
push str.send
push esi
push edi
push str.LIMIT__s:_d__s_reached_memlimit_n
call fcn.10055420
add esp, 0x10
push str.send
push esi
push edi
push str.LIMIT__s:_d__s_reached_memlimit_n
push 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
add esp, 4
push eax
call fcn.10055a90
push dword [0x100b0a48]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 0x18
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
pop edi
pop esi
mov dword [eax], 0xc
or eax, 0xffffffff
ret
dec eax
mov dword [0x100b0a50], eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test edi, edi
je 0x100557a8
push esi
push dword [esp + 0x18]
push dword [esp + 0x24]
push edi
push str.SEND__s:_d_send__lu____ld_n
call fcn.10055420
add esp, 0x14
pop edi
mov eax, esi
pop esi
ret
Function at 0x1005b790
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x100b0270]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1005b7d9
lea eax, [esp + 8]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1005b7d9
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100908b3
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov al, 1
pop esi
xor ecx, esp
call fcn.100908b3
add esp, 0x18
ret
Function at 0x10065030
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.10045b40
push dword [esp + 0x38]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
push dword [esp + 0x40]
mov edi, eax
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x100650c5
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.10045b40
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.10045bf0
add esp, 0x20
test edx, edx
ja 0x100650e9
jb 0x100650b7
cmp eax, 0x3e8
ja 0x100650e9
push 1
call ebp
push 1
push esi
push edi
call ebx
test eax, eax
je 0x10065080
test edi, edi
je 0x100650d2
push edi
call fcn.10091de1
add esp, 4
test esi, esi
je 0x100650df
push esi
call fcn.10091de1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edi, edi
je 0x100650f6
push edi
call fcn.10091de1
add esp, 4
test esi, esi
je 0x10065103
push esi
call fcn.10091de1
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret