joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4651d8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x10]
push ecx
mov eax, 2
push edx
mov word [ebx], ax
call fcn.0045a519
mov eax, dword [eax]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
lea esi, [ebp - 0x10]
mov edi, eax
call fcn.00401350
cmp edi, 0xffffffff
jne 0x46524a
mov eax, dword [ebp + 0x10]
push 0x48b2e4
push eax
call fcn.0044cdcc
add esp, 8
test al, al
je 0x46524a
push 0
push 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
add eax, ecx
call fcn.00403f30
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 2
jmp 0x46522a
mov eax, dword [ebp + 0x14]
lea ecx, [eax - 1]
mov dword [ebx + 4], edi
cmp ecx, 0xfffe
ja 0x465244
push eax
call dword [sym.imp.WSOCK32.dll_htons]
pop edi
mov word [ebx + 2], ax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x466794
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x38
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00413110
add esp, 0xc
mov eax, 1
lea ecx, [ebp - 0x4c]
push ecx
push 0
push esi
mov dword [ebp - 0x4c], 0x7c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
call fcn.00411391
add esp, 4
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4667f7
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
push 0
mov ecx, edi
call fcn.00403e10
mov eax, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x3c]
push 0
lea ecx, [edi + 0x10]
call fcn.00403e10
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
push 0
lea ecx, [edi + 0x20]
call fcn.00403e10
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
push 0
lea ecx, [edi + 0x30]
call fcn.00403e10
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
lea esi, [edi + 0x40]
push 0
mov ecx, esi
call fcn.00403e10
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
lea ecx, [edi + 0x50]
push 0
call fcn.00403e10
lea eax, [edi + 0x50]
push eax
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0044ce22
push eax
lea esi, [edi + 0x60]
call fcn.0040e410
lea ecx, [ebp - 0x10]
call fcn.00402250
mov ax, word [ebp - 0x34]
mov word [edi + 0x78], ax
mov eax, dword [ebp - 0x40]
mov dword [edi + 0x74], eax
dec eax
je 0x4668af
dec eax
je 0x46689d
mov dword [edi + 0x70], 3
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x70], 2
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x70], 1
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4669fe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0xd0], 0
je 0x466a40
test al, al
je 0x466a40
lea eax, [esi + 0xd4]
push eax
call fcn.00431aad
push esi
push 0
push 0x4669ec
call fcn.004153f4
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
pop esi
pop ecx
pop ebp
ret 8
push eax
push esi
call fcn.004668c1
pop esi
pop ecx
pop ebp
ret 8

Function at 0x46883e
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov al, byte [0x4974e7]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x8000
push edi
mov byte [ebp - 4], al
call fcn.00414319
add esp, 4
push eax
call fcn.0041422e
add esp, 8
mov esi, eax
push ebx
mov dword [ebp - 8], esi
call fcn.00443d6e
test al, al
je 0x46889b
push edi
push ebx
call fcn.00443136
push eax
push 1
push ebx
call fcn.004680a0
push eax
call fcn.00414496
add esp, 0x10
mov ebx, eax
jmp 0x4688e6
push esi
jmp 0x4688f9
lea esi, [ebp - 0x1c]
call fcn.0040d610
push ebx
call fcn.004533e0
push esi
push eax
call fcn.0045f62c
mov edx, dword [ebp - 0x1c]
push edx
push 0x487e30
push edi
call fcn.00414510
add esp, 0xc
cmp byte [ebp - 4], 0
mov dword [ebp - 0xc], eax
je 0x4688d8
push ebx
call fcn.00453401
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea esi, [ebp - 0x1c]
call fcn.00401350
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push edi
call fcn.004147a6
add esp, 4
cmp esi, 0xffffffff
jne 0x468898
push 0x4000
push edi
call fcn.00414319
add esp, 4
push eax
call fcn.0041422e
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468d51
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor edi, edi
mov byte [ebp + 0xb], 1
cmp dword [ebx + 4], esi
je 0x468e6c
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov byte [eax], 0
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
mov ecx, dword [ebp + 0xc]
mov byte [edx], 0
mov byte [eax], 0
mov dword [ecx], esi
lea ebx, [ebx]
push esi
push ebx
call fcn.00436554
movzx eax, word [eax]
cmp eax, 0x2b
je 0x468db4
cmp eax, 0x5e
je 0x468daf
cmp eax, 0x21
je 0x468daf
cmp eax, 0x23
jne 0x468de7
cmp eax, 0x2b
jne 0x468dbd
mov edx, dword [ebp + 0x10]
mov byte [edx], 1
inc esi
jmp 0x468d91
cmp eax, 0x5e
jne 0x468dcb
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
inc esi
jmp 0x468d91
cmp eax, 0x21
jne 0x468dd9
mov ecx, dword [ebp + 0x18]
mov byte [ecx], 1
inc esi
jmp 0x468d91
cmp eax, 0x23
jne 0x468de4
mov edx, dword [ebp + 0x1c]
mov byte [edx], 1
inc esi
jmp 0x468d91
push esi
inc esi
push ebx
mov dword [ebp + 0x1c], esi
call fcn.00436554
movzx eax, word [eax]
cmp eax, 0x7b
jne 0x468ed5
mov eax, 0x40
lea ecx, [ebp - 0x10]
call fcn.004013c0
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0x7d
call fcn.0045ff79
test al, al
je 0x468eb1
mov edx, dword [ebp - 0x10]
mov eax, dword [edi*4 + 0x492968]
push edx
push eax
call fcn.0041167b
add esp, 8
test eax, eax
je 0x468e41
inc edi
cmp edi, 0x62
jl 0x468e23
cmp edi, 0x62
jne 0x468ea8
xor edi, edi
lea esi, [ebp - 0x10]
call fcn.00402140
movzx ecx, word [eax]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov edx, dword [ebp + 0xc]
cwde
mov dword [edx], eax
cmp eax, 0xffffffff
jne 0x468e77
mov ecx, esi
call fcn.00402250
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
test eax, 0x200
je 0x468e84
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
test eax, 0x400
je 0x468e91
mov edx, dword [ebp + 0x18]
mov byte [edx], 1
test eax, 0x100
je 0x468ecb
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
mov byte [eax], 1
call fcn.00402250
jmp 0x468f0e
cmp byte [edi + 0x492af0], 0
je 0x468ebf
lea ecx, [ebp - 0x10]
mov byte [ebp + 0xb], 0
call fcn.00402250
jmp 0x468f0e
movzx ecx, byte [edi + str._f_b_b..__reepqrstuvwxyz________t___]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
lea ecx, [ebp - 0x10]
call fcn.00402250
jmp 0x468f0e
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov ecx, dword [ebp + 0xc]
cwde
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x468e6c
test eax, 0x200
je 0x468ef4
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
test eax, 0x400
je 0x468f01
mov ecx, dword [ebp + 0x18]
mov byte [ecx], 1
test eax, 0x100
je 0x468f0e
mov edx, dword [ebp + 0x10]
mov byte [edx], 1
mov eax, dword [ebp + 0xc]
and dword [eax], 0xff
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x61085680
Capabilities:
Create raw socket
Create tcp socket
Create udp socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [0x61098f40], 1
mov dword [0x61098f44], 1
mov dword [0x61098f48], 1
mov dword [0x61098f58], 0x15180
mov dword [0x61098f4c], 2
mov dword [0x61098f50], 3
mov dword [0x61098f54], 3
mov dword [0x61099760], 2
push 0x610813c4
push 0x61098f5c
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 8
mov dword [0x61097024], 3
mov dword [0x61097028], 3
mov dword [0x6109702c], 3
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x61097038], eax
cmp dword [0x61097038], 0xffffffff
jne 0x61085741
push 0x610813a4
push 0x10002
mov eax, dword [0x610970ac]
push eax
call sub.rtutils.dll_TracePrintfExW
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x61085751
push 0x610979e8
call fcn.61085200
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x61087760
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push 0x61081ec0
push 0x20002
mov eax, dword [0x610970ac]
push eax
call sub.rtutils.dll_TracePrintfExW
add esp, 0xc
cmp dword [0x610979f4], 0
jne 0x610877e3
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x610979f4], eax
cmp dword [0x610979f4], 0
jne 0x610877a7
jmp 0x6108781e
push 0x61081e98
call fcn.61086060
push 0
push 0xffffffffffffffff
push 0
push fcn.61087d80
mov ecx, dword [0x610979f4]
push ecx
push 0x610979f8
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x610877e3
push 0x61081e98
call fcn.610860a0
jmp 0x6108781e
push 0x14
push 0
push 0x61098f00
call sub.msvcrt.dll_memset
add esp, 0xc
mov edx, dword [0x610979f4]
mov dword [0x61098f10], edx
push 0x61098f00
lea eax, [ebp - 4]
push eax
call sub.iphlpapi.dll_NotifyAddrChange
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3e5
je 0x6108781c
jmp 0x6108781e
jmp 0x6108783c
call fcn.610876e0
push 0x61081e48
push 0x20002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x61088530
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0xffffffff
jne 0x61088543
mov eax, dword [ebp + 0x10]
jmp 0x6108858d
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x61088574
mov eax, dword [ebp + 0x10]
jmp 0x6108858d
cmp dword [ebp - 4], 4
je 0x6108857f
mov eax, dword [ebp + 0x10]
jmp 0x6108858d
cmp dword [ebp - 0x10], 0
jne 0x6108858a
mov eax, dword [ebp + 0x10]
jmp 0x6108858d
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x610885a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0xffffffff
jne 0x610885c8
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x61088659
mov eax, dword [ebp + 0x14]
sub eax, 2
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6108860d
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x61088659
cmp dword [ebp - 4], 1
je 0x6108862a
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x61088659
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax]
test ecx, ecx
jne 0x6108864b
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x61088659
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0x10]
mov word [eax + edx*2], 0
mov esp, ebp
pop ebp
ret 0x14

Function at 0x61088a70
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x61097948]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0xc]
push ecx
push 8
push 0
push 0x61082200
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x61088b7a
mov dword [ebp - 8], 0
jmp 0x61088ac5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0x80
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x61088af8
jmp 0x61088b70
mov ecx, dword [0x610979ec]
push ecx
lea edx, [ebp - 0x118]
push edx
call fcn.610873f0
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x61088b6b
lea eax, [ebp - 0x11c]
push eax
push 1
push 0
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 1
push 0x610821e0
mov eax, dword [ebp - 0x11c]
push eax
call fcn.61088530
mov ecx, dword [ebp - 0x120]
mov dword [ecx + 0x100], eax
cmp dword [ebp - 0x11c], 0xffffffff
je 0x61088b6b
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x61088abc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
call fcn.61095de2
mov esp, ebp
pop ebp
ret
Function at 0x61088e70
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x61097948]
mov dword [ebp - 4], eax
push 0
push 2
call fcn.61094e80
push 0x6108251c
call fcn.61086060
mov dword [0x61097020], 2
lea eax, [ebp - 0x198]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x61088ed7
push 0x610824f4
push 0x10002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x61089073
call fcn.6108ae40
test eax, eax
jne 0x61088f16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x19c], eax
mov edx, dword [ebp - 0x19c]
push edx
push 0x610824a8
push 0x10002
mov eax, dword [0x610970ac]
push eax
call sub.rtutils.dll_TracePrintfExW
add esp, 0x10
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
call fcn.61086150
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x61088f35
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
call fcn.61085680
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x61088f54
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
call fcn.61087a70
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x61088f73
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
call fcn.61086020
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x61088f92
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
call fcn.6108d740
push 0
push 2
call fcn.61094e80
call fcn.6108c010
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x61088fbf
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
push 0
push 2
call fcn.61094e80
call fcn.610943d0
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x61088fe7
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
push 0
push 2
call fcn.61094e80
call fcn.61088c80
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x6108900c
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
push 0
push 2
call fcn.61094e80
call fcn.61087550
push 0
push 2
call fcn.61094e80
push 0
push 0
call fcn.61087d80
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x61089043
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
push 0
push 2
call fcn.61094e80
call fcn.61089a60
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x61089068
mov eax, dword [ebp - 0x19c]
jmp 0x61089073
push 0
push 4
call fcn.61094e80
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.61095de2
mov esp, ebp
pop ebp
ret
Function at 0x6108a150
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x61097948]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x401
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x810]
push ecx
push 7
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x6108a186
jmp 0x6108a263
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x810], 0x2e
mov ecx, dword [ebp - 4]
mov word [ebp + ecx*2 - 0x80e], 0
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.6108a030
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x38]
and eax, 2
je 0x6108a263
mov dword [ebp - 4], 0x401
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x810]
push edx
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x6108a1f6
jmp 0x6108a263
push 0x61082708
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
push edx
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 8
lea ecx, [ebp - 0x810]
push ecx
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov word [ebp + edx*2 - 0x810], 0x2e
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x80e], 0
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.6108a030
mov ecx, dword [ebp - 8]
call fcn.61095de2
mov esp, ebp
pop ebp
ret 4
Function at 0x6108a9e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x61097948]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6108aa13
jmp 0x6108ab4a
mov ax, word [ebp - 0x12]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x610828d0
push 0x1000002
mov eax, dword [0x610970ac]
push eax
call sub.rtutils.dll_TracePrintfExW
add esp, 0x14
push 4
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0x6108aa5d
jmp 0x6108ab4a
push 0x61097a24
push 0x61082874
push 1
push 0
push 0x61082884
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0x6108aa84
jmp 0x6108ab44
push 0
mov ecx, dword [0x61097a24]
mov edx, dword [ecx]
mov eax, dword [0x61097a24]
push eax
call dword [edx + 0xc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x6108ab44
mov dword [ebp - 0x30], 0
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], 0x14
push 1
lea edx, [ebp - 0x30]
push edx
mov eax, dword [0x61097a24]
mov ecx, dword [eax]
mov edx, dword [0x61097a24]
push edx
call dword [ecx + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x6108ab10
push 0
push 0x61097a1c
push 0xffffffffffffffff
push 1
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x61097a24]
mov edx, dword [ecx]
mov eax, dword [0x61097a24]
push eax
call dword [edx + 0x18]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x6108ab10
call fcn.6108a950
cmp dword [ebp - 0x1c], 0
jge 0x6108ab44
push 0
mov ecx, dword [0x61097a24]
mov edx, dword [ecx]
mov eax, dword [0x61097a24]
push eax
call dword [edx + 0x10]
mov ecx, dword [0x61097a24]
mov edx, dword [ecx]
mov eax, dword [0x61097a24]
push eax
call dword [edx + 8]
mov dword [0x61097a24], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
call fcn.61095de2
mov esp, ebp
pop ebp
ret 4
Function at 0x6108b180
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x61097948]
mov dword [ebp - 8], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
push 0
push 0
push 0x401
lea eax, [ebp - 0x438]
push eax
push 0x1c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_getnameinfo]
lea edx, [ebp - 0x438]
push edx
push 0x61082a98
push 0x100002
mov eax, dword [0x610970ac]
push eax
call sub.rtutils.dll_TracePrintfExW
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x480]
push edx
call fcn.6108b300
push 0x1a
push 0
lea eax, [ebp - 0x466]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44c], ecx
mov byte [ebp - 0x448], 1
mov dword [ebp - 0x444], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
lea edx, [ebp - 0x43c]
push edx
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0x40
lea ecx, [ebp - 0x480]
push ecx
push 0x120000
mov edx, dword [0x61098ed4]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x6108b256
xor eax, eax
jmp 0x6108b2eb
cmp dword [ebp - 0x10], 0x2b05
jne 0x6108b2ac
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.6108b330
push 2
push 0
push 0
push 0x401
lea edx, [ebp - 0x438]
push edx
push 0x1c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
lea ecx, [ebp - 0x438]
push ecx
push 0x61082a5c
push 0x100002
mov edx, dword [0x610970ac]
push edx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x10
jmp 0x6108b2d3
cmp dword [ebp - 0x10], 0
je 0x6108b2d3
mov eax, dword [ebp - 0x10]
push eax
push 0x61082a40
push 0x10002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x10
xor eax, eax
jmp 0x6108b2eb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
jne 0x6108b2e8
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.61095de2
mov esp, ebp
pop ebp
ret 8