joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4194c0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.MSVCR80.dll_malloc]
push esi
push edi
push 0x18
call ebx
mov esi, eax
add esp, 4
test esi, esi
jne 0x4194dc
jmp fcn.00408a80
mov edi, dword [esp + 0x14]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.0041baf0
mov ecx, eax
mov edx, 8
mul edx
cmp ecx, 0xffffffff
mov dword [esi + 0xc], ecx
mov edi, eax
ja 0x419511
test edx, edx
ja 0x419511
cmp edi, 0xffffffff
jbe 0x41952e
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41952e
push str.attemped_allocation_of_excessively_large_array
push 0x10
call fcn.00408640
add esp, 8
push edi
call ebx
add esp, 4
test eax, eax
mov dword [esi + 0x14], eax
jne 0x419540
jmp fcn.00408a80
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret

Function at 0x4195c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push esi
push edi
push 0x18
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4195db
jmp fcn.00408a80
mov eax, dword [esp + 0x1c]
lea edi, [esp + 8]
call fcn.00402e50
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 4], edx
mov edx, dword [eax + 0xc]
mov dword [esi + 8], ecx
pop edi
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], 0
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x419c80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, eax
xor ebx, ebx
xor ebp, ebp
test esi, esi
push edi
mov edi, 0x100
je 0x419d02
push 0x104
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x419caf
jmp fcn.00408a80
mov edx, dword [esi]
lea eax, [ecx + 4]
mov dword [ecx], edx
mov dword [esi], ecx
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x24]
cmp edi, 0xffffffff
mov byte [eax], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
jne 0x419ce4
push str.external_program_did_not_execute___
lea esi, [esp + 0x14]
call fcn.00402ff0
add esp, 4
push edi
push str.returned_error_code__d
lea esi, [esp + 0x18]
call fcn.00402ff0
mov eax, dword [esp + 0x24]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x100
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x419cb8
jmp fcn.00408a80
Function at 0x419dc0
Capabilities:
Execute command

Disassembly:
push esi
push edi
mov esi, eax
mov edi, esi
and edi, 1
je 0x419dd4
mov eax, dword [esp + 0xc]
call fcn.0041a550
cmp dword [0x5426d0], 7
jb 0x419e02
push 0x46000087
call fcn.00408960
add esp, 4
test eax, eax
je 0x419e02
push ebx
push esi
push str.SYSTEM__u___s
push 0x46000087
call fcn.00408640
add esp, 0x10
test edi, edi
je 0x419e0f
mov eax, dword [esp + 0xc]
call fcn.0041a450
push ebx
call dword [sym.imp.MSVCR80.dll_system]
add esp, 4
cmp dword [0x5426d0], 7
mov esi, eax
jb 0x419e48
push 0x46000087
call fcn.00408960
add esp, 4
test eax, eax
je 0x419e48
push esi
push str.SYSTEM_return_u
push 0x46000087
call fcn.00408640
add esp, 0xc
test edi, edi
je 0x419e55
mov eax, dword [esp + 0xc]
call fcn.0041a5d0
pop edi
mov eax, esi
pop esi
ret

Function at 0x419e60
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, eax
xor ebx, ebx
xor ebp, ebp
test esi, esi
push edi
mov edi, 0x100
je 0x419ee3
push 0x104
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x419e8f
jmp fcn.00408a80
mov edx, dword [esi]
lea eax, [ecx + 4]
mov dword [ecx], edx
mov dword [esi], ecx
mov edx, dword [esp + 0x24]
mov ecx, esi
mov byte [eax], bl
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
call fcn.00408fd0
push eax
push 0x5103a4
lea esi, [esp + 0x18]
call fcn.00402ff0
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x419efa
cmp dword [esp + 0x18], ebx
jl 0x419efa
mov ecx, dword [esp + 0x14]
add eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x100
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x419e98
jmp fcn.00408a80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x41a240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [ebp + 8], 0
push ebx
push esi
mov ebx, eax
jne 0x41a277
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41a277
push 0x2ef
push str..misc.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
test edi, edi
jne 0x41a2a2
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41a2a2
push 0x2f0
push str..misc.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
test ebx, ebx
je 0x41a2de
push 0xc
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x41a2ba
jmp fcn.00408a80
mov ecx, dword [ebx]
mov dword [eax], ecx
lea esi, [eax + 4]
mov dword [ebx], eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403400
mov dword [esi], eax
mov eax, dword [edi]
add esp, 4
mov dword [esi + 4], eax
mov dword [edi], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 8
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41a2c3
jmp fcn.00408a80
Function at 0x41a7f0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, eax
cmp esi, edi
mov dword [esp + 0xc], edi
je 0x41a820
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41a810
sub eax, edx
cmp eax, 1
ja 0x41a847
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41a847
push 0x3ef
push str..misc.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
cmp esi, edi
je 0x41a86f
push esi
lea ebx, [esp + 0x10]
call fcn.00403400
add esp, 4
push 0
push 0
push 0x8004
mov ebx, eax
call fcn.00403ae0
add esp, 0xc
mov esi, ebx
jmp 0x41a871
xor esi, esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41a898
push eax
lea ebx, [esp + 0x10]
call fcn.00403400
add esp, 4
push 0
push 0
push 0x80
mov edi, eax
call fcn.00403ae0
add esp, 0xc
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41a8c7
test edi, edi
je 0x41a8bc
lea eax, [esp + 0xc]
push eax
push esi
mov eax, edi
call fcn.00419f10
add esp, 8
mov esi, ebx
call fcn.0041a3c0
jmp 0x41a901
mov eax, esi
mov esi, ebx
call fcn.0041a340
jmp 0x41a901
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x41a901
push 0x140
call fcn.00408960
add esp, 4
test eax, eax
je 0x41a901
test edi, edi
jne 0x41a8ed
mov edi, str.NULL
push edi
push esi
push str.SetEnvironmentVariable_failed__name_s__value_s
push 0x140
call fcn.00408640
add esp, 0x10
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41a91e
mov edi, dword [sym.imp.MSVCR80.dll_free]
nop
mov esi, dword [eax]
push eax
call edi
add esp, 4
test esi, esi
mov eax, esi
jne 0x41a910
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ab20
Capabilities:
Terminate process

Disassembly:
sub esp, 0x2c
mov eax, dword [0x535df0]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
xor ebp, ebp
test edi, edi
push esi
mov dword [esp + 0x20], eax
mov esi, ecx
mov ebx, 0x100
je 0x41abdc
push 0x104
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x41ab63
jmp fcn.00408a80
mov edx, dword [edi]
mov dword [ecx], edx
lea eax, [ecx + 4]
mov dword [edi], ecx
add dword [0x53c204], 1
mov byte [eax], 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
xor ecx, ecx
push eax
mov eax, 0x10
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ecx
call fcn.004078a0
add esp, 4
push edi
push 0
lea ecx, [esp + 0x2c]
push 0
push ecx
mov eax, 0x28
mov ebx, 0x10
call fcn.00403180
push eax
push esi
push str.openvpn__s__s.tmp
lea esi, [esp + 0x2c]
call fcn.00402ff0
mov eax, dword [esp + 0x38]
add esp, 0x1c
test eax, eax
je 0x41abf7
cmp dword [esp + 0x18], ebp
jl 0x41abf7
mov edx, dword [esp + 0x14]
add eax, edx
jmp 0x41abf9
push 0x100
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x41ab6c
jmp fcn.00408a80
xor eax, eax
mov ecx, dword [esp + 0x20]
push edi
push ecx
call fcn.0041ad20
mov ecx, dword [esp + 0x3c]
add esp, 8
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004dcaae
add esp, 0x2c
ret
Function at 0x41b3e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ecx, ecx
push esi
xor ebx, ebx
test eax, eax
push edi
mov dword [esp + 0xc], ecx
je 0x41b40e
mov eax, dword [eax + 4]
test eax, eax
je 0x41b40e
mov eax, dword [eax + 4]
add ecx, 1
test eax, eax
jne 0x41b400
mov dword [esp + 0xc], ecx
add ecx, 1
mov eax, ecx
mov edx, 4
mul edx
cmp ecx, 0xffffffff
mov esi, eax
ja 0x41b42a
test edx, edx
ja 0x41b42a
cmp esi, 0xffffffff
jbe 0x41b447
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41b447
push str.attemped_allocation_of_excessively_large_array
push 0x10
call fcn.00408640
add esp, 8
cmp dword [ebp + 0xc], ebx
je 0x41b4dc
lea eax, [esi + 4]
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x41b466
jmp fcn.00408a80
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
lea edi, [eax + 4]
mov dword [eax], edx
mov dword [ecx], eax
push esi
push 0
push edi
call sub.MSVCR80.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x41b4cc
mov esi, dword [eax + 4]
xor ebx, ebx
test esi, esi
je 0x41b4cc
mov edi, edi
cmp ebx, dword [esp + 0xc]
jl 0x41b4bd
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41b4bd
push 0x660
push str..misc.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
mov eax, dword [esi]
mov dword [edi + ebx*4], eax
mov esi, dword [esi + 4]
add ebx, 1
test esi, esi
jne 0x41b490
mov dword [edi + ebx*4], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x41b472
jmp fcn.00408a80

Function at 0x41b500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0xc], ebx
je 0x41b5ce
push 0x4c
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
cmp eax, ebx
jne 0x41b52e
jmp fcn.00408a80
mov ecx, dword [edi]
mov dword [eax], ecx
lea esi, [eax + 4]
mov dword [edi], eax
push 0x48
push 0
push esi
call sub.MSVCR80.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x41b55d
push eax
mov ebx, edi
call fcn.00403400
add esp, 4
mov dword [esi], eax
mov ebx, 1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41b5e8
push edi
push 0x40
mov edx, 0x11
sub edx, ebx
push 0
push edx
lea ecx, [esi + ebx*4]
push eax
mov edx, str.make_arg_array
call fcn.0042c910
mov edi, eax
add esp, 0x14
test edi, edi
jl 0x41b595
lea eax, [edi + ebx + 1]
cmp eax, 0x12
jle 0x41b5ec
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41b5ec
push 0x67e
push str..misc.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
add edi, ebx
mov dword [esi + edi*4], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x48
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41b537
jmp fcn.00408a80
mov edi, dword [esp + 0xc]
add edi, ebx
mov dword [esi + edi*4], 0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b900
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
test ebp, ebp
push edi
je 0x41b91e
cmp dword [ebp], esi
je 0x41b91e
add esi, 1
cmp dword [ebp + esi*4], 0
jne 0x41b914
lea ecx, [esi + 1]
mov eax, ecx
mov edx, 4
mul edx
cmp ecx, 0xffffffff
mov ebx, eax
ja 0x41b93a
test edx, edx
ja 0x41b93a
cmp ebx, 0xffffffff
jbe 0x41b957
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41b957
push str.attemped_allocation_of_excessively_large_array
push 0x10
call fcn.00408640
add esp, 8
cmp dword [esp + 0x1c], 0
je 0x41b9ac
lea eax, [ebx + 4]
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x41b974
jmp fcn.00408a80
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov dword [eax], edx
lea edi, [eax + 4]
mov dword [ecx], eax
push ebx
push 0
push edi
call sub.MSVCR80.dll_memset
add esp, 0xc
test esi, esi
jle 0x41b9a4
mov ecx, ebp
mov eax, edi
sub ecx, edi
mov edx, dword [ecx + eax]
mov dword [eax], edx
add eax, 4
sub esi, 1
jne 0x41b997
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x41b981
jmp fcn.00408a80

Function at 0x41b9d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
xor eax, eax
test edx, edx
push edi
je 0x41b9ed
cmp dword [edx], eax
je 0x41b9ed
add eax, 1
cmp dword [edx + eax*4], 0
jne 0x41b9e4
mov esi, dword [edx]
mov edi, str.__INLINE__
mov ecx, 0xb
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41ba1a
cmp eax, 2
jne 0x41ba1a
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 4]
push eax
call fcn.0041b600
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x41ba70
mov edi, dword [ebp + 8]
test edi, edi
je 0x41ba5a
push 0x4c
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x41ba39
jmp fcn.00408a80
mov ecx, dword [edi]
mov dword [eax], ecx
lea esi, [eax + 4]
mov dword [edi], eax
push 0x48
push 0
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [esi], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x48
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41ba42
jmp fcn.00408a80
cmp eax, 1
jne 0x41ba8c
mov edx, dword [edx]
mov eax, dword [ebp + 8]
push 0
push edx
call fcn.0041b500
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x41baaa
mov eax, dword [edx + 4]
mov ecx, dword [edx]
push eax
mov eax, dword [ebp + 8]
push ecx
call fcn.0041b500
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
push edx
call fcn.0041b900
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [ebp + 8]
sub esp, 8
cmp ecx, dword [ebx]
push esi
push edi
jbe 0x41bc7b
mov eax, ecx
mov edx, 4
mul edx
cmp ecx, 0xffffffff
mov esi, eax
mov edi, edx
ja 0x41bbd1
test edi, edi
ja 0x41bbd1
cmp eax, 0xffffffff
jbe 0x41bbee
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41bbee
push str.attemped_allocation_of_excessively_large_array
push 0x10
call fcn.00408640
add esp, 8
mov eax, esi
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
mov dword [esp + 0xc], eax
jne 0x41bc07
jmp fcn.00408a80
mov ecx, edi
mov edi, dword [ebp + 8]
cmp edi, 0xffffffff
ja 0x41bc1a
test ecx, ecx
ja 0x41bc1a
cmp esi, 0xffffffff
jbe 0x41bc3b
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41bc37
push str.attemped_allocation_of_excessively_large_array
push 0x10
call fcn.00408640
add esp, 8
mov eax, dword [esp + 0xc]
push esi
push 0
push eax
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0xc
cmp dword [ebx + 4], eax
jbe 0x41bc65
mov edi, edi
mov ecx, dword [ebx + 8]
mov edx, dword [ecx + eax*4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jb 0x41bc50
mov edx, dword [ebx + 8]
push edx
call dword [sym.imp.MSVCR80.dll_free]
mov eax, dword [esp + 0x10]
add esp, 4
mov dword [ebx + 8], eax
mov dword [ebx], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41be10
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
test esi, esi
push edi
je 0x41be8a
mov ebp, dword [sym.imp.MSVCR80.dll_strrchr]
push 0x5c
push esi
call ebp
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41be38
cmp byte [ebx], 0
je 0x41be38
add ebx, 1
jmp 0x41be3a
mov ebx, esi
cmp byte [ebx], 0
je 0x41be8a
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41be44
sub eax, edx
lea edi, [eax + 1]
push edi
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41be67
jmp fcn.00408a80
push edi
push ebx
push esi
call sub.MSVCR80.dll_memcpy
push 0x2e
push esi
call ebp
add esp, 0x14
test eax, eax
je 0x41be7e
mov byte [eax], 0
cmp byte [esi], 0
je 0x41be8a
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x41bea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, eax
xor eax, eax
push esi
push edi
mov edi, 2
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
call fcn.0041baf0
push eax
call fcn.0041bba0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov dword [ecx + eax*4], 0
lea ecx, [eax + 1]
mov eax, dword [ebp + 8]
add esp, 4
test eax, eax
mov dword [esp + 0xc], ecx
mov dword [ebx + 4], ecx
je 0x41c014
xor esi, esi
cmp dword [eax + 4], esi
mov dword [esp + 0x14], esi
jbe 0x41bfc3
jmp 0x41bf05
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [edx + esi*4]
test eax, eax
mov dword [esp + 0x10], eax
je 0x41bf55
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41bf16
sub eax, edx
lea esi, [eax + 1]
push esi
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x41bfef
mov eax, dword [esp + 0x10]
push esi
push eax
push edi
call sub.MSVCR80.dll_memcpy
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
add esp, 0xc
mov dword [esp + 0x10], edi
jmp 0x41bf5d
mov dword [esp + 0x10], 0
lea edi, [ecx + 2]
cmp edi, ecx
ja 0x41bf8b
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41bf8b
push 0x71e
push str..misc.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
call fcn.0041baf0
push eax
call fcn.0041bba0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov edx, dword [esp + 0x14]
mov dword [ecx + eax*4], edx
add eax, 1
mov dword [esp + 0x10], eax
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
add esi, 1
add esp, 4
cmp esi, dword [eax + 4]
mov dword [esp + 0x14], esi
jb 0x41bf01
mov eax, dword [eax + 0xc]
test eax, eax
mov dword [esp + 0x14], eax
je 0x41c00f
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41bfd1
sub eax, edx
lea edi, [eax + 1]
push edi
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41bff4
jmp fcn.00408a80
mov ecx, dword [esp + 0x14]
push edi
push ecx
push esi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov dword [ebx + 0xc], esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov dword [ebx + 0xc], esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c020
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push eax
lea eax, [esp + 0x14]
call fcn.0041bea0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edi], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 4], edx
mov edx, dword [eax + 0xc]
add esp, 4
test ebp, ebp
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
je 0x41c086
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c056
sub eax, edx
lea ebx, [eax + 1]
push ebx
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41c079
jmp fcn.00408a80
push ebx
push ebp
push esi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
jmp 0x41c088
xor esi, esi
test ebp, ebp
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0xc]
mov dword [eax], esi
mov dword [esp + 0x24], ebx
je 0x41c0d4
mov eax, ebp
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c0a0
sub eax, edx
lea ebx, [eax + 1]
push ebx
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41c0c3
jmp fcn.00408a80
push ebx
push ebp
push esi
call sub.MSVCR80.dll_memcpy
mov ebx, dword [esp + 0x30]
add esp, 0xc
jmp 0x41c0d6
xor esi, esi
test ebx, ebx
mov dword [edi + 0xc], esi
je 0x41c0f3
push 0
push ebx
push edi
call fcn.0041bcf0
add esp, 0xc
push ebx
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop ebx
add esp, 0x14
ret

Function at 0x41c100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov al, byte [esi]
push edi
xor ebx, ebx
xor edi, edi
test al, al
je 0x41c1b5
movsx eax, al
test eax, eax
je 0x41c151
push eax
call dword [sym.imp.MSVCR80.dll_isspace]
add esp, 4
test ebx, ebx
je 0x41c13b
test eax, eax
jne 0x41c151
add edi, 1
jmp 0x41c146
test eax, eax
jne 0x41c146
mov ebx, esi
mov edi, 1
movsx eax, byte [esi + 1]
add esi, 1
test eax, eax
jne 0x41c124
test ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
je 0x41c1b5
test edi, edi
ja 0x41c185
push 0x10
call fcn.00408960
add esp, 4
test eax, eax
je 0x41c185
push 0x7ac
push str..misc.c
push str.Assertion_failed_at__s:_d
push 0x10
call fcn.00408640
add esp, 0x10
lea edx, [edi + 1]
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41c19d
jmp fcn.00408a80
push edi
push ebx
push esi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov byte [esi + edi], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41cc60
Capabilities:
Terminate process

Disassembly:
sub esp, 0x44
mov eax, dword [0x535df0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
mov ebx, edx
xor ebp, ebp
test ebx, ebx
push edi
mov esi, ecx
mov edi, 0x40
je 0x41cd1b
push 0x44
call dword [sym.imp.MSVCR80.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x41cc9b
jmp fcn.00408a80
mov edx, dword [ebx]
mov dword [ecx], edx
lea eax, [ecx + 4]
mov dword [ebx], ecx
xor ecx, ecx
test esi, esi
mov byte [eax], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
je 0x41ce30
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x48], eax
mov eax, ecx
shr eax, 0x10
mov dword [esp + 0x3c], edx
mov edx, dword [esi + 0x10]
and eax, 3
sub eax, 1
mov dword [esp + 0x34], ecx
mov dword [esp + 0x44], edx
je 0x41cdca
sub eax, 1
je 0x41cd45
sub eax, 1
lea esi, [esp + 0x10]
je 0x41cd33
push str.UNKNOWN
call fcn.00402ff0
add esp, 4
jmp 0x41cdf4
push 0x40
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x41cca4
jmp fcn.00408a80
push str.IPV6
call fcn.00402ff0
add esp, 4
jmp 0x41cdf4
movzx esi, cl
lea ecx, [esp + 0x38]
push ecx
lea edi, [esp + 0x28]
call fcn.00403e00
add esp, 4
lea edi, [esp + 0x20]
lea eax, [esp + 0x24]
call fcn.0041c9c0
cmp dword [esp + 0x20], ebp
je 0x41cda2
push 1
push eax
mov eax, ebx
call fcn.004420a0
push eax
push 0x5103a4
lea esi, [esp + 0x20]
call fcn.00402ff0
add esp, 0x10
test byte [esp + 0x36], 8
je 0x41cda2
movzx edx, byte [esp + 0x37]
push edx
push 0x5164ac
call fcn.00402ff0
add esp, 8
test byte [esp + 0x36], 4
je 0x41cdf4
lea eax, [esp + 0x24]
call fcn.004241e0
test eax, eax
jl 0x41cdf4
push eax
push 0x5164b0
lea esi, [esp + 0x18]
call fcn.00402ff0
add esp, 8
jmp 0x41cdf4
push ebx
push 0x5164a8
push 1
add esi, 4
push esi
xor eax, eax
mov ebx, 6
call fcn.00403180
push eax
push 0x5103a4
lea esi, [esp + 0x28]
call fcn.00402ff0
add esp, 0x18
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41ce1b
cmp dword [esp + 0x18], ebp
jl 0x41ce1b
mov ecx, dword [esp + 0x14]
add eax, ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.004dcaae
add esp, 0x44
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.004dcaae
add esp, 0x44
ret
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, str._NULL_
call fcn.004dcaae
add esp, 0x44
ret