joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5660f0
Capabilities:
Patch process command line

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x636b5a
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0xa4]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xbc], edi
push str.CProcess::GetProcessCommandLine
mov dword [ebp - 4], 0
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xb4], 0
call fcn.00562ae0
xorps xmm0, xmm0
mov dword [ebp - 4], 1
push 0
movups xmmword [edi], xmm0
push 0x642690
mov ecx, edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.00414450
push str.GetPebAddress
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0xb4], 1
call fcn.00562ae0
push str.NtQueryInformationProcess
push str.ntdll.dll
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0x18
lea ecx, [ebp - 0x28]
push ecx
push 0
push esi
call eax
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.005630c0
push 0
push 4
lea eax, [ebp - 0xb8]
push eax
lea eax, [esi + 0x10]
mov esi, dword [ebp - 0xa8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
test eax, eax
je 0x5662a0
push 8
lea eax, [ebp - 0xb0]
push eax
mov eax, dword [ebp - 0xb8]
add eax, 0x40
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x566218
push eax
push eax
push eax
push str.Could_not_read_CommandLine__n
jmp 0x5662a9
movzx eax, word [ebp - 0xb0]
push eax
call dword [0x63e238]
mov esi, eax
movzx eax, word [ebp - 0xb0]
push eax
push 0
push esi
call fcn.0060ddfb
movzx eax, word [ebp - 0xb0]
add esp, 0x10
push 0
push eax
push esi
push dword [ebp - 0xac]
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x566266
push eax
push eax
push eax
push str.Could_not_read_the_command_line_string__n
jmp 0x5662a9
push esi
mov ecx, edi
call fcn.00419480
push esi
call dword [0x63e240]
add esp, 4
lea ecx, [ebp - 0xa4]
call fcn.005630c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.Could_not_read_the_address_of_ProcessParameters__n
lea ecx, [ebp - 0x34]
call fcn.005652e0
push 0x6b1e48
lea eax, [ebp - 0x34]
push eax
call fcn.0060dddd
int3
Function at 0x5663c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x268]
sub esp, 0x268
push 0xffffffffffffffff
push 0x636bc1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp + 0x264], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x270]
lea ecx, [ebp + 0x22c]
mov eax, dword [ebp + 0x274]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x278]
push str.CProcess::OpenProcessesByName
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
call fcn.00562ae0
mov dword [ebp - 4], 1
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
xor eax, eax
mov dword [ebp - 0x30], 1
xor ebx, ebx
mov dword [ebp - 0x18], eax
xor edi, edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push ebx
push 2
mov byte [ebp - 4], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov dword [ebp - 0x10], eax
lea eax, [ebp + 4]
push ebx
push eax
call fcn.0060ddfb
add esp, 0xc
mov dword [ebp], 0x22c
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5664f9
mov esi, dword [ebp - 0x10]
push dword [ebp - 0x1c]
lea eax, [ebp + 0x24]
push eax
call dword [0x63e3a0]
add esp, 8
test eax, eax
jne 0x5664df
cmp edi, ebx
je 0x5664cc
mov eax, dword [ebp + 8]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x28], edi
jmp 0x5664df
lea eax, [ebp + 8]
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.00565db0
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5664a7
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
mov eax, edi
sub eax, ecx
test eax, 0xfffffffc
je 0x56655e
cmp ecx, edi
je 0x56655e
mov ebx, dword [ebp - 0x14]
mov esi, ecx
nop dword [eax]
push dword [esi]
push 0
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x1c], ecx
cmp eax, dword [ebx + 8]
je 0x566542
mov dword [eax], ecx
add dword [ebx + 4], 4
jmp 0x56654e
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov ecx, ebx
call fcn.00565db0
add esi, 4
cmp esi, edi
jne 0x566520
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x566591
sub ebx, ecx
mov eax, ecx
and ebx, 0xfffffffc
cmp ebx, 0x1000
jb 0x566587
mov ecx, dword [eax - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x566587
call dword [0x63e2e0]
push ebx
push ecx
call fcn.00604b8c
add esp, 8
lea ecx, [ebp + 0x22c]
call fcn.005630c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x264]
xor ecx, ebp
call fcn.00604ed9
lea esp, [ebp + 0x268]
pop ebp
ret
Function at 0x566990
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x636c40
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1ac], esi
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x8c]
mov edi, dword [ebp + 8]
push str.CProcessHolder::StartProcess
mov dword [ebp - 0x1b0], eax
call fcn.00562ae0
push str.CProcessHolder::IsProcessStarted
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0
call fcn.00562ae0
mov esi, dword [esi]
lea ecx, [ebp - 0x48]
call fcn.005630c0
test esi, esi
jne 0x566bac
cmp byte [ebp + 0x14], 0
jne 0x566ae5
push 0x118
lea eax, [ebp - 0x1a4]
push esi
push eax
call fcn.0060ddfb
add esp, 0xc
mov dword [ebp - 0x1a8], 0x114
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [ebp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x44], esi
je 0x566a76
cmp dword [ebp - 0x1a4], 6
mov dword [ebp - 0x40], str.runas
jae 0x566a7d
mov dword [ebp - 0x40], 0
cmp dword [edi + 0x14], 7
jbe 0x566a85
mov edi, dword [edi]
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x3c], edi
cmp dword [eax + 0x14], 7
jbe 0x566a96
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x566add
push str.ShellExecuteEx___failed._Return.
lea ecx, [ebp - 0x8c]
call fcn.00563760
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx], 0
jmp 0x566b82
mov eax, dword [ebp - 0x14]
jmp 0x566b7a
push str.Escape_from_job.
lea ecx, [ebp - 0x8c]
call fcn.00563760
mov eax, dword [ebp - 0x1b0]
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
cmp dword [eax + 0x14], 7
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x54], 0x44
movups xmmword [ebp - 0x1c0], xmm0
jbe 0x566b3c
mov eax, dword [eax]
cmp dword [edi + 0x14], 7
jbe 0x566b44
mov edi, dword [edi]
lea ecx, [ebp - 0x1c0]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0x1000000
push 0
push 0
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x566b74
push str.CreateProcess___failed._Return.
jmp 0x566ac1
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx], eax
lea ecx, [ebp - 0x8c]
call fcn.005630c0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 0
push str.Process_already_started.
lea ecx, [ebp - 0x34]
call fcn.005652e0
push 0x6b1e48
lea eax, [ebp - 0x34]
push eax
call fcn.0060dddd
int3
Function at 0x566cb0
Capabilities:
Create thread

Disassembly:
sub esp, 0x3c
mov eax, dword [0x6ec7c0]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
push 0x6794ac
mov dword [edi], vtable.AsyncWorker.0
call fcn.00562ae0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push 1
push 0
mov byte [edi + 0x28], 0
call esi
push 0
push 1
push 0
mov dword [edi + 0xc], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov dword [edi + 0x14], eax
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0x18], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edi
push 0x5672e0
push 0
push 0
mov dword [edi + 0x1c], eax
call esi
push 0
push 0
push edi
push 0x5670f0
push 0
push 0
mov dword [edi + 0x10], eax
call esi
lea ecx, [esp + 8]
mov dword [edi + 8], eax
call fcn.005630c0
mov ecx, dword [esp + 0x40]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00604ed9
add esp, 0x3c
ret
Function at 0x58c9f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, ecx
push edi
mov edi, dword [esp + 0x20]
test ebx, ebx
je 0x58cbfa
test bl, 7
jne 0x58cbfa
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
push esi
cmp eax, 1
jne 0x58cad6
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x24], eax
cmp ebx, 8
jb 0x58cbee
lea esi, [edi - 7]
shr ebx, 3
nop dword [eax]
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0058bf90
mov eax, dword [esp + 0x30]
add esp, 8
xor dword [esp + 0x10], eax
mov ecx, ebp
mov eax, dword [esp + 0x24]
xor dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
call fcn.0058c620
mov ecx, dword [esp + 0x14]
lea esi, [esi + 8]
mov eax, ecx
mov dword [esp + 0x24], ecx
shr eax, 8
add edi, 8
mov byte [esi + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 4], al
mov eax, ecx
shr eax, 0x18
mov byte [esi + 3], al
mov byte [esi + 6], cl
mov ecx, dword [esp + 0x10]
mov eax, ecx
shr eax, 8
mov byte [esi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [esi], al
mov eax, ecx
shr eax, 0x18
mov dword [esp + 0x28], ecx
mov byte [esi + 2], cl
mov byte [esi - 1], al
sub ebx, 1
jne 0x58ca50
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0xc
cmp eax, 2
jne 0x58cb82
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
cmp ebx, 8
jb 0x58cbee
lea esi, [edi - 7]
shr ebx, 3
nop dword [eax]
lea eax, [esp + 0x18]
mov ecx, ebp
push eax
call fcn.0058c620
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0058bf90
mov ecx, dword [esp + 0x24]
lea esi, [esi + 8]
xor ecx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ecx
xor edx, dword [esp + 0x10]
add edi, 8
shr eax, 8
mov byte [esi + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 4], al
mov eax, edx
shr eax, 8
mov byte [esi + 1], al
mov eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov byte [esi + 6], cl
shr ecx, 0x18
mov byte [esi + 2], dl
shr eax, 0x10
shr edx, 0x18
mov byte [esi + 3], cl
mov byte [esi], al
mov byte [esi - 1], dl
sub ebx, 1
jne 0x58cb00
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0xc
cmp ebx, 8
jb 0x58cbee
lea esi, [edi - 7]
shr ebx, 3
nop dword [eax]
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0058bf90
add esp, 8
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.0058c620
mov ecx, dword [esp + 0x14]
lea esi, [esi + 8]
mov eax, ecx
mov byte [esi + 6], cl
shr eax, 8
add edi, 8
mov byte [esi + 5], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [esi + 4], al
mov byte [esi + 3], cl
mov ecx, dword [esp + 0x10]
mov eax, ecx
shr eax, 8
mov byte [esi + 1], al
mov eax, ecx
mov byte [esi + 2], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esi], al
mov byte [esi - 1], cl
sub ebx, 1
jne 0x58cb90
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0xc
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0xc
Function at 0x58cc10
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 0x50
mov eax, dword [0x6ec7c0]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x60]
push esi
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x18], ebx
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebx + 0xc], ecx
mov ecx, dword [esp + 0x60]
mov dword [ebx + 8], eax
lea eax, [ecx - 1]
cmp eax, 0x37
ja 0x58cda0
push ebp
push edi
push ecx
lea eax, [esp + 0x28]
push esi
push eax
call fcn.0060ddef
movups xmm0, xmmword [0x67ee90]
lea esi, [ebx + 0x10]
push 0x1000
movups xmmword [esi], xmm0
lea eax, [ebx + 0x58]
mov dword [esp + 0x2c], esi
movups xmm0, xmmword [0x67eea0]
push 0x67eed8
push eax
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [0x67eeb0]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [0x67eec0]
movups xmmword [esi + 0x30], xmm0
movq xmm0, qword [0x67eed0]
movq qword [esi + 0x40], xmm0
call fcn.0060ddef
add esp, 0x18
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x68]
lea ebp, [esp + 0x24]
xor edi, edi
mov dword [esp + 0x10], 0x12
nop dword [eax]
xor edx, edx
lea ebx, [edx + 4]
movzx eax, byte [ebp]
lea ecx, [edi + 1]
shl edx, 8
inc ebp
or edx, eax
cmp ecx, esi
lea eax, [esp + 0x24]
cmovne eax, ebp
xor edi, edi
cmp ecx, esi
mov ebp, eax
cmovne edi, ecx
sub ebx, 1
jne 0x58ccd5
mov eax, dword [esp + 0x14]
xor dword [eax], edx
add eax, 4
sub dword [esp + 0x10], 1
mov dword [esp + 0x14], eax
jne 0x58ccd0
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x20]
nop
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.0058c620
mov eax, dword [esp + 0x14]
lea esi, [esi + 8]
mov dword [esi - 8], eax
add edi, 2
mov eax, dword [esp + 0x18]
mov dword [esi - 4], eax
cmp edi, 0x12
jb 0x58cd20
mov dword [esp + 0x10], 4
lea ebp, [ebx + 0x58]
xor edi, edi
mov esi, ebp
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.0058c620
mov eax, dword [esp + 0x14]
lea esi, [esi + 8]
mov dword [esi - 8], eax
add edi, 2
mov eax, dword [esp + 0x18]
mov dword [esi - 4], eax
cmp edi, 0x100
jl 0x58cd54
add ebp, 0x400
sub dword [esp + 0x10], 1
jne 0x58cd50
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00604ed9
add esp, 0x50
ret 0xc
mov ecx, dword [esp + 0x54]
xor al, al
pop esi
pop ebx
xor ecx, esp
call fcn.00604ed9
add esp, 0x50
ret 0xc
Function at 0x5962a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x59634f
push esi
call fcn.005b0cc0
add esp, 4
test al, al
jne 0x59634f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x5962c7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.005ba6b0
add esp, 0xc
test eax, eax
je 0x5962fb
sub eax, esi
push eax
push 0x2e
push esi
call fcn.005ba6b0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x5962fd
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x59632e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.005ac860
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x596310
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x5aac10
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x198
mov eax, dword [0x6ec7c0]
xor eax, esp
mov dword [esp + 0x194], eax
test byte [esp + 0x19c], 2
je 0x5aac71
lea eax, [esp + 4]
push eax
push 0x202
call dword [0x63e1c4]
test eax, eax
jne 0x5aac57
mov eax, dword [esp + 4]
cmp al, 2
jne 0x5aac51
shr eax, 8
cmp al, 2
je 0x5aac71
call dword [0x63e1c0]
mov eax, 2
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00604ed9
add esp, 0x198
ret
push ebp
push esi
push edi
push str.kernel32
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x5aac98
mov dword [0x700dfc], esi
jmp 0x5aadbb
push ebx
push 0x6831c4
push edi
call ebp
push 0x6831d4
push str.iphlpapi.dll
mov ebx, eax
call dword [0x63e384]
add esp, 8
test eax, eax
je 0x5aace2
test ebx, ebx
je 0x5aacd0
push 8
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x5aad9f
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x5aad9f
test ebx, ebx
je 0x5aad07
push str.AddDllDirectory
push edi
call ebp
test eax, eax
je 0x5aad07
push 0x800
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x5aad9f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x5aad9f
lea ecx, [eax + 0xd]
push ecx
call dword [0x6ec2c8]
mov edi, eax
add esp, 4
test edi, edi
je 0x5aad95
push dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x5aad95
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5aad44
sub ecx, edx
mov eax, 0x5c
mov edx, edi
mov word [ecx + edi], ax
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x5aad60
sub edx, ecx
mov ecx, str.iphlpapi.dll
sub edx, ecx
add edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x5aad72
test ebx, ebx
je 0x5aad8c
push 8
push 0
push edi
call ebx
jmp 0x5aad93
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
call dword [0x6ec2cc]
add esp, 4
mov dword [0x700dfc], esi
pop ebx
test esi, esi
je 0x5aadbb
push str.if_nametoindex
push esi
call ebp
test eax, eax
je 0x5aadbb
mov dword [0x700dec], eax
push str.ws2_32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x5aadf3
push str.FreeAddrInfoExW
push esi
call ebp
push str.GetAddrInfoExCancel
push esi
mov dword [0x700df0], eax
call ebp
push str.GetAddrInfoExW
push esi
mov dword [0x700df4], eax
call ebp
mov dword [0x700df8], eax
push 3
push 2
push 0
push 0
push 6
call fcn.005f3210
push 3
push 2
push 0
test al, al
push 2
push 6
setne byte [0x701235]
call fcn.005f3210
add esp, 0x28
test al, al
setne byte [0x701234]
push 0x701238
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp + 0x1a0]
xor eax, eax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00604ed9
add esp, 0x198
ret
Function at 0x5b1c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x6ec7c0]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x78]
push edi
xor edi, edi
mov dword [esp + 8], eax
cmp byte [eax + 0x6e7], 0
je 0x5b1de9
cmp byte [ebp + 0x18], 0
push ebx
lea ebx, [ebp + 0x18]
je 0x5b1de8
push esi
mov esi, dword [0x63e1d0]
lea eax, [esp + 0x34]
push eax
push ebx
push 2
call esi
test eax, eax
jg 0x5b1de7
lea eax, [esp + 0x38]
push eax
push ebx
push 0x17
call esi
test eax, eax
jg 0x5b1de7
push dword [ebp + 0x14]
cmp byte [ebx], 0
mov eax, str._none_
mov esi, dword [ebp]
mov ebp, dword [esp + 0x14]
cmovne eax, ebx
push eax
push str.Host__s:_d_was_resolved.
push ebp
call fcn.005a7500
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.005968e0
lea eax, [esp + 0x3c]
push 0x400
push eax
call fcn.005968e0
add esp, 0x20
test esi, esi
je 0x5b1d5b
lea edx, [edi + 0x10]
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x5b1cd2
cmp ecx, 2
jne 0x5b1d50
xor eax, eax
mov byte [esp + 0x48], 0
cmp ecx, 2
lea ebx, [esp + 0x14]
cmovne eax, edx
add ebx, eax
sub ecx, 2
je 0x5b1d01
sub ecx, 0x15
jne 0x5b1d16
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x5b1d11
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call fcn.0060c319
push ebx
call fcn.00596900
add esp, 4
test eax, eax
je 0x5b1d35
push 2
push 0x682b50
push ebx
call fcn.005968a0
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x5b1d7b
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.00596840
mov edi, eax
add esp, 8
test edi, edi
jne 0x5b1d7b
lea edx, [eax + 0x10]
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x5b1cc1
lea eax, [esp + 0x24]
push eax
call fcn.00596900
add esp, 4
test eax, eax
je 0x5b1d8b
lea eax, [esp + 0x24]
push eax
call fcn.00596910
add esp, 4
jmp 0x5b1d90
push str.too_many_IP__cant_show
push ebp
call fcn.005a7500
add esp, 8
jmp 0x5b1dd0
mov eax, str._none_
push eax
push str.IPv6:__s
push ebp
call fcn.005a7500
lea eax, [esp + 0x20]
push eax
call fcn.00596900
add esp, 0x10
test eax, eax
je 0x5b1dbc
lea eax, [esp + 0x14]
push eax
call fcn.00596910
add esp, 4
jmp 0x5b1dc1
mov eax, str._none_
push eax
push str.IPv4:__s
push ebp
call fcn.005a7500
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call fcn.005968b0
lea eax, [esp + 0x28]
push eax
call fcn.005968b0
add esp, 8
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
pop edi
pop ebp
xor ecx, esp
call fcn.00604ed9
add esp, 0x6c
ret