joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432540
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x248
mov eax, dword [0x612790]
xor eax, esp
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x250]
xorps xmm0, xmm0
push ebx
mov ebx, dword [esp + 0x260]
push ebp
mov ebp, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x270]
push edi
mov edi, dword [esp + 0x25c]
push 0x200
mov dword [esp + 0x14], eax
lea eax, [esp + 0x58]
push 0
push eax
mov dword [esp + 0x28], ebx
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x50], xmm0
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esp + 0x270]
xorps xmm0, xmm0
movzx edx, ax
mov eax, dword [esp + 0x1c]
push edx
movups xmmword [esp + 0x34], xmm0
mov dword [esp + 0x30], edx
lea ecx, [eax + 1]
movzx eax, byte [eax]
push ecx
push eax
push 0x824
push str.__connect
push str.BAGENT
push str.Hosts_URL__.s__default_port_d_
push dword [0x915734]
mov dword [esp + 0x40], ecx
call fcn.004322d0
mov ecx, dword [esp + 0x3c]
xorps xmm0, xmm0
mov dword [esi], 0
movzx eax, byte [ecx]
mov byte [eax + ecx + 1], 0
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [ecx + 1]
push str._256_:_:_6_0_9_
push eax
movups xmmword [ebp], xmm0
call fcn.00436d70
test eax, eax
lea ecx, [esp + 0x90]
mov eax, 2
cmove ecx, dword [esp + 0x50]
mov word [esp + 0x60], ax
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x58], ecx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 0x40
test eax, eax
je 0x43264c
push eax
jmp 0x432653
push dword [esp + 0x264]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x26], ax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x432694
push ebx
lea eax, [esp + 0x28]
push eax
push edi
call fcn.00432730
mov ebx, eax
add esp, 0xc
test bl, 1
je 0x4326dc
movups xmm0, xmmword [esp + 0x24]
movups xmmword [ebp], xmm0
jmp 0x4326dc
push dword [esp + 0x268]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x5c]
push eax
push edi
call fcn.00433960
mov ebx, eax
add esp, 0x10
test bl, 1
je 0x4326d6
push dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push edi
call fcn.00432730
mov ebx, eax
add esp, 0xc
test bl, 1
jne 0x432689
mov dword [esi], 0x20a
jmp 0x4326dc
mov dword [esi], 0x194
push dword [esi]
mov eax, dword [esp + 0x14]
push ebx
push dword [esp + 0x28]
push dword [esp + 0x20]
movzx eax, byte [eax]
push eax
push 0x847
push str.__connect
push str.BAGENT
push str.Hosts_URL__.s__default_port_d___status_x__stv_d
push dword [0x915734]
call fcn.004322d0
mov ecx, dword [esp + 0x27c]
add esp, 0x28
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00498b38
add esp, 0x248
ret
Function at 0x433820
Capabilities:
Create udp socket

Disassembly:
push edi
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
test edi, edi
jns 0x433869
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__close
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push 0x5c3
push str.__ns_init
push str.BAGENT
push str.NS_context_initialization__socket_____d__errno_d
push 2
push str.BAGENT
call fcn.00432050
add esp, 0x20
pop edi
ret
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, 0xba55
lea ebp, [ebx + 0x398]
nop dword [eax + eax]
push esi
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
push ebp
push edi
mov word [ebx + 0x39a], ax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x4338a7
inc esi
cmp esi, 0xffff
jb 0x433880
jmp 0x4338f3
movzx eax, word [ebx + 0x39a]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
lea eax, [ebx + 0x205]
push eax
movzx eax, byte [ebx + 0x204]
push eax
push edi
push 0x5d2
push str.__ns_init
push str.BAGENT
push str.bind__d___.s:_d_
push dword [0x915734]
call fcn.004322d0
add esp, 0x24
cmp esi, 0xffff
jb 0x433923
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
push 0x5d8
push str.__ns_init
push str.BAGENT
push str.Error_bind_NS_UDP_socket__errno_d
push 0
push str.BAGENT
call fcn.00432050
add esp, 0x1c
pop esi
pop ebp
pop ebx
pop edi
ret
push edi
push 0x5de
push str.__ns_init
push str.BAGENT
push str.Created_SD_NS__d
push dword [0x915734]
xor eax, eax
mov word [ebx + 0x39a], ax
call fcn.004322d0
mov eax, dword [esp + 0x30]
add esp, 0x18
pop esi
pop ebp
mov dword [eax], edi
mov eax, 1
pop ebx
pop edi
ret
Function at 0x436330
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
mov eax, 0x55555556
imul ebp
push esi
mov eax, edx
mov ecx, dword [esp + 0x18]
shr eax, 0x1f
mov esi, ebp
add eax, edx
lea eax, [eax + eax*2]
sub esi, eax
mov edx, esi
and esi, 1
sar edx, 1
and edx, 1
lea eax, [edx + esi*2]
lea edx, [eax + ebp]
mov dword [esp + 8], eax
shl edx, 2
mov eax, 0x55555556
imul edx
mov eax, dword [esp + 0x20]
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [eax], esi
cmp esi, dword [esp + 0x1c]
jle 0x436387
pop esi
xor eax, eax
pop ebp
pop ecx
ret
push ebx
lea eax, [ebp - 3]
xor ebx, ebx
push edi
mov edi, dword [0x6125f4]
test eax, eax
js 0x436420
mov esi, dword [esp + 0x18]
mov eax, 0xaaaaaaab
mul ebp
add esi, 2
mov ebp, edx
mov dword [esp + 0x1c], esi
shr ebp, 1
lea eax, [ebp*2]
add eax, ebp
mov dword [esp + 0x20], eax
nop
movzx edx, byte [esi - 2]
mov bl, byte [esi - 1]
mov eax, edx
mov bh, byte [esi]
and edx, 3
shr eax, 2
movzx esi, bl
shl edx, 4
add edx, edi
movzx eax, byte [eax + edi]
mov byte [ecx], al
mov eax, esi
shr eax, 4
and esi, 0xf
movzx eax, byte [eax + edx]
mov byte [ecx + 1], al
movzx edx, bh
mov eax, edx
and edx, 0x3f
shr eax, 6
add eax, edi
movzx eax, byte [eax + esi*4]
mov esi, dword [esp + 0x1c]
mov byte [ecx + 2], al
add esi, 3
movzx eax, byte [edx + edi]
mov byte [ecx + 3], al
add ecx, 4
mov dword [esp + 0x1c], esi
sub ebp, 1
jne 0x4363c0
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x436461
mov edx, dword [esp + 0x18]
movzx eax, byte [ebx + edx]
shr eax, 2
movzx eax, byte [eax + edi]
mov byte [ecx], al
movzx eax, byte [ebx + edx]
and eax, 3
add eax, eax
movzx eax, byte [edi + eax*8]
mov byte [ecx + 1], al
mov eax, 1
pop edi
mov word [ecx + 2], 0x3d3d
add ecx, 4
pop ebx
pop esi
pop ebp
mov byte [ecx], 0
pop ecx
ret
cmp eax, 1
jne 0x4364a8
mov ebp, dword [esp + 0x18]
movzx eax, byte [ebx + ebp]
shr eax, 2
movzx eax, byte [eax + edi]
mov byte [ecx], al
movzx edx, byte [ebx + ebp]
movzx eax, byte [ebx + ebp + 1]
and edx, 3
shr eax, 4
shl edx, 4
add edx, edi
movzx eax, byte [eax + edx]
mov byte [ecx + 1], al
movzx eax, byte [ebx + ebp + 1]
and eax, 0xf
movzx eax, byte [edi + eax*4]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
pop edi
pop ebx
pop esi
mov byte [ecx], 0
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x436510
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2c
mov eax, dword [0x612790]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x10
push ebp
mov ebp, dword [esp + 0x38]
mov dword [esp + 0xc], ebp
push esi
push edi
test ebx, ebx
je 0x436720
lea eax, [esp + 0x28]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__timespec64_get]
mov esi, dword [0x612630]
mov eax, 0x44b82fa1
add esi, dword [esp + 0x38]
add esp, 8
imul esi
sar edx, 0x1c
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
cdq
mov edi, eax
mov eax, edx
add edi, dword [0x612628]
adc eax, dword [0x61262c]
add edi, dword [esp + 0x28]
mov dword [esp + 0x24], edi
adc eax, dword [esp + 0x2c]
imul ecx, ecx, 0x3b9aca00
mov dword [esp + 0x1c], eax
sub esi, ecx
mov dword [esp + 0x20], esi
mov esi, ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea eax, [esp + 0x28]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__timespec64_get]
mov eax, dword [esp + 0x30]
add esp, 8
mov ecx, dword [esp + 0x2c]
mov edx, eax
sub edx, edi
sbb ecx, dword [esp + 0x1c]
or edx, ecx
je 0x4365d0
sub eax, edi
jmp 0x4365d8
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x20]
test eax, eax
jg 0x4366e4
push 0x3e8
push 1
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_WSAPoll]
mov edi, eax
test edi, edi
jns 0x436639
call ebx
cmp eax, 0x2714
jne 0x43666f
call ebx
cmp eax, 0x2714
jne 0x436639
push esi
push dword [esp + 0x4c]
call ebx
push eax
push edi
push ebp
push 0x76c
push str.__xmit_n
push str.BAGENT
push str.__d__poll_____d__errno_d__requested__d_octets__rest__d_octets
push 0
push str.BAGENT
call fcn.00432050
add esp, 0x2c
jmp 0x436662
test byte [esp + 0x1a], 0x10
je 0x436662
push 0
push esi
push dword [esp + 0x18]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp esi, edi
je 0x436720
test edi, edi
jle 0x4366af
sub esi, edi
add dword [esp + 0x10], edi
test esi, esi
je 0x4366e4
mov edi, dword [esp + 0x24]
jmp 0x4365a8
push esi
push dword [esp + 0x4c]
call ebx
push eax
push edi
push ebp
push 0x764
push str.__xmit_n
push str.BAGENT
push str.__d__poll_____d__errno_d__requested__d_octets__rest__d_octets
push 2
push str.BAGENT
call fcn.00432050
add esp, 0x2c
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00498b38
add esp, 0x2c
ret
call ebx
push eax
movsx eax, word [esp + 0x1c]
push eax
movsx eax, word [esp + 0x22]
push eax
push edi
push esi
push ebp
push 0x789
push str.__xmit_n
push str.BAGENT
push str.__d__send__d_octets____d__.revents_08x__08x___errno_d
push 2
push str.BAGENT
call fcn.00432050
add esp, 0x30
push esi
push dword [esp + 0x4c]
push ebp
push 0x792
push str.__xmit_n
push str.BAGENT
push str.__d__Did_not_put_requested__d_octets__rest__d_octets
push 2
push str.BAGENT
call fcn.00432050
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00498b38
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00498b38
add esp, 0x2c
ret
Function at 0x436bf0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x436c1e
push 0xbef
push str.bagent_start
push str.BAGENT
push str.No_context_is_provided
push 2
push str.BAGENT
call fcn.00432050
add esp, 0x18
pop esi
ret
push 0xbf1
push str.bagent_start
push str.BAGENT
push str.Starting_Control_thread_...
push dword [0x915734]
call fcn.004322d0
push esi
push 0
push 0x4348e0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
push eax
push 0xbfc
push str.bagent_start
push str.BAGENT
push str.Control_thread_has_been_started__tid_d.
push dword [0x915734]
mov dword [esi], eax
call fcn.004322d0
mov eax, dword [esi + 0x304]
add esp, 0x38
test eax, eax
je 0x436c91
push 1
push dword [esi + 0x308]
mov dword [esi + 0x314], 1
call eax
add esp, 8
mov eax, 1
pop esi
ret

Function at 0x436ca0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x436cce
push 0xc1c
push str.bagent_stop
push str.BAGENT
push str.No_context_is_provided
push 2
push str.BAGENT
call fcn.00432050
add esp, 0x18
pop esi
ret
push 0xc1e
push str.bagent_stop
push str.BAGENT
push str.Set_exit_flag_
push 3
push str.BAGENT
call fcn.00432050
add esp, 0x18
mov dword [0x915730], eax
cmp dword [esp + 0xc], 0
je 0x436d3e
push 0xc22
push str.bagent_stop
push str.BAGENT
push str.Wait_for_control_thread_termination
push 3
push str.BAGENT
call fcn.00432050
add esp, 0x18
push 0x32c8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x436d3e
push 2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x304]
test eax, eax
je 0x436d5f
push 2
push dword [esi + 0x308]
mov dword [esi + 0x314], 2
call eax
add esp, 8
mov eax, 1
pop esi
ret

Function at 0x43fc00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push edi
xor edi, edi
bts edi, eax
cmp eax, 0x20
cmovae edx, edi
xor edi, edx
cmp eax, 0x40
mov eax, dword [esp + 0xc]
cmovae edx, edi
test eax, eax
js 0x43fc4c
push ebx
push esi
lea ebx, [esp + 0x14]
xor ecx, ecx
lea ebx, [ebx + 4]
bts ecx, eax
xor esi, esi
cmp eax, 0x20
cmovae esi, ecx
xor ecx, esi
cmp eax, 0x40
mov eax, dword [ebx]
cmovae esi, ecx
or edi, ecx
or edx, esi
test eax, eax
jns 0x43fc28
pop esi
pop ebx
mov eax, edi
pop edi
ret
Function at 0x443c50
Capabilities:
Hash data using djb2

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
mov ecx, 0x1505
test edi, edi
jne 0x443c66
pop edi
xor eax, eax
pop esi
ret
push ebx
mov bl, byte [edi]
test bl, bl
je 0x443c90
nop dword [eax]
mov eax, ecx
lea edi, [edi + 1]
mov edx, esi
shld esi, ecx, 5
shl ecx, 5
add ecx, eax
movzx eax, bl
mov bl, byte [edi]
adc esi, edx
cdq
add ecx, eax
adc esi, edx
test bl, bl
jne 0x443c70
pop ebx
pop edi
mov eax, ecx
pop esi
ret

Function at 0x445620
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x24], 0
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
jb 0x4456f5
push ebp
mov ebp, dword [esp + 0x24]
ja 0x445646
test ebp, ebp
je 0x4456f4
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
movzx ecx, word [ebx + 8]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov al, byte [esi + eax]
test edi, edi
je 0x445682
movzx edx, cx
or edx, 2
mov ecx, edx
xor ecx, 1
imul ecx, edx
shr ecx, 8
xor al, cl
mov byte [esi + edi], al
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push 1
push eax
mov eax, dword [ebx]
not eax
push eax
call fcn.00447790
not eax
mov dword [ebx], eax
movzx eax, al
add eax, dword [ebx + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [ebx + 4], eax
shr eax, 0x18
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
mov eax, dword [ebx + 8]
not eax
push eax
call fcn.00447790
mov edx, dword [esp + 0x2c]
add esp, 0x18
add esi, 1
not eax
mov dword [ebx + 8], eax
adc edx, 0
movzx ecx, ax
mov dword [esp + 0x14], edx
cmp edx, dword [esp + 0x34]
jb 0x445661
ja 0x4456f1
cmp esi, ebp
jb 0x445661
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x10
ret
Function at 0x445700
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x24], 0
xorps xmm0, xmm0
push esi
mov esi, dword [esp + 0x18]
movlpd qword [esp + 8], xmm0
jb 0x44586c
push ebp
mov ebp, dword [esp + 0x28]
ja 0x44572b
test ebp, ebp
je 0x44586b
cmp dword [esp + 0x20], 0
push ebx
push edi
je 0x4457f8
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
nop dword [eax + eax]
mov ecx, dword [esp + 0x2c]
push 1
mov bl, byte [eax + ecx]
mov ax, word [esi + 8]
or ax, 2
mov byte [esp + 0x14], bl
movzx edi, ax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.00447790
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.00447790
mov edx, dword [esp + 0x40]
not eax
mov dword [esi + 8], eax
add esp, 0x18
mov eax, edi
mov ecx, edi
xor ecx, 1
imul ecx, eax
mov eax, dword [esp + 0x14]
shr ecx, 8
xor cl, bl
mov byte [eax + edx], cl
add eax, 1
mov ecx, dword [esp + 0x1c]
adc ecx, 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
cmp ecx, dword [esp + 0x34]
jb 0x445750
ja 0x445869
cmp eax, ebp
jb 0x445750
pop edi
pop ebx
pop ebp
pop esi
add esp, 0x10
ret
movlpd qword [esp + 0x14], xmm0
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
push 1
mov al, byte [edi + eax]
mov byte [esp + 0x14], al
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.00447790
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.00447790
add esp, 0x18
not eax
add edi, 1
mov dword [esi + 8], eax
adc ebx, 0
cmp ebx, dword [esp + 0x34]
jb 0x445806
ja 0x445869
cmp edi, ebp
jb 0x445806
pop edi
pop ebx
pop ebp
pop esi
add esp, 0x10
ret

Function at 0x445a40
Capabilities:
Hash data via bcrypt

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x445a6f
cmp dword [esp + 0x10], 0
ja 0x445a6f
mov ecx, dword [esp + 0xc]
jb 0x445a5a
cmp ecx, 0xffffffff
ja 0x445a6f
push 0
push ecx
push dword [esp + 0x10]
push dword [eax + 4]
call sub.bcrypt.dll_BCryptHashData
test eax, eax
setns al
ret
xor al, al
ret

Function at 0x445cd0
Capabilities:
Generate random numbers via winapi

Disassembly:
movzx eax, word [esp + 8]
push 2
push eax
push dword [esp + 0xc]
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setns al
ret
Function at 0x4578c0
Capabilities:
Convert ip address from string
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x457955
lea eax, [esp + 8]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x457955
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4578e8
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.004738e0
add esp, 0xc
test eax, eax
je 0x45791c
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004738e0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x45791e
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x45794e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.004662b0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x457930
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4582a0
Capabilities:
Convert ip address from string

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x4582cc
cmp byte [eax], 0
je 0x4582cc
lea ecx, [esp + 8]
push ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x4582c6
mov eax, 0x2b
ret
mov eax, dword [esp + 8]
jmp 0x4582d2
xor eax, eax
mov dword [esp + 8], eax
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 8]
push dword [eax + 0x9b4]
call fcn.0049ab90
add esp, 8
xor eax, eax
ret
Function at 0x4612a0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x702], 0
je 0x461337
cmp dword [edi + 0x1c0], 0
je 0x4612f1
push esi
push 1
push edi
call fcn.00453130
push dword [edi + 0x154]
mov eax, dword [edi + 0x1c0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00453130
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov edx, dword [esp + 0xc]
mov ecx, edx
sub ecx, 0
je 0x461306
sub ecx, 1
je 0x461306
sub ecx, 1
jne 0x461337
push dword [edi + 0x150]
lea eax, [edx*2 + 0x5f4da8]
push 1
add eax, edx
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
push dword [edi + 0x150]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x461910
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x612790]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 4], eax
xor eax, eax
mov ecx, dword [ebx + 0xc]
push ebp
push esi
mov esi, 0x180
mov edx, dword [ecx + 0x15c]
cmp dword [esp + 0x120], edx
push edi
sete al
lea eax, [eax*4 + 0x158]
mov ebp, dword [eax + ecx]
mov eax, 0x190
cmove esi, eax
mov eax, dword [ecx + 0x298]
add esi, ecx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x461a13
xor eax, eax
cmp dword [esp + 0x124], edx
sete al
lea eax, [eax*4 + 0x170]
cmp dword [eax + ecx], 0x4615d0
jne 0x461a13
cmp dword [esi], 0
je 0x4619ae
test edi, edi
je 0x461a13
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.00472200
add esp, 0x14
cmp eax, 0xffffffff
je 0x461a13
test al, 1
je 0x461a13
mov ecx, dword [esi]
test ecx, ecx
jne 0x4619fc
mov eax, dword [ebx + 0x4d8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x612764]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x461a47
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x461a13
add dword [esi + 8], eax
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
jne 0x461a82
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x461a58
xor edi, edi
lea eax, [edi + 0x51]
jmp 0x461a82
mov ecx, dword [esp + 0x10]
mov eax, 0x1b
mov dword [ecx], 0xffffffff
jmp 0x461a88
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.0044eb70
push eax
push str.Send_failure:__s
push ebx
call fcn.00461340
add esp, 0x18
mov dword [ebx + 0x958], esi
mov eax, 0x37
mov ecx, dword [esp + 0x10]
mov dword [ecx], edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00498b38
add esp, 0x10c
ret
Function at 0x461e30
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1ac], 0
je 0x461e4d
push eax
call fcn.0045bee0
add esp, 4
test eax, eax
jne 0x461e6c
xor al, al
ret
mov eax, dword [eax + 0x158]
cmp eax, 0xffffffff
je 0x461e4a
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x461e4a
mov al, 1
ret

Function at 0x462100
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x612790]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x462187
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.0044eb70
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x4621c7
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.00461d00
add esp, 0x10
test al, al
jne 0x4621d0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.0044eb70
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00461340
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00498b38
add esp, 0x188
ret