joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb6b10
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
mov ebx, 0x104
lea eax, [esi + 0xd]
cmp eax, ebx
cmova ebx, eax
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0xb6ca2
push 1
push ebx
call fcn.001591ee
mov edi, eax
add esp, 8
test edi, edi
je 0xb6ca2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
inc eax
cmp esi, eax
jne 0xb6c85
push str.kernel32.dll
push 0x17bec4
lea eax, [edi - 1]
add eax, esi
push 0xe
push eax
call fcn.000b24b0
add esp, 0x10
cmp eax, 0xd
jne 0xb6c85
push 0
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
je 0xb6c85
push 1
push esi
call fcn.001591ee
mov ebx, eax
add esp, 8
test ebx, ebx
je 0xb6c85
push ebx
push esi
push 0
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0xb6c7c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0xb6c7c
xor esi, esi
test dword [ebp - 8], 0xfffffffc
jbe 0xb6c54
mov eax, dword [ebp - 0x10]
lea ecx, [eax + esi*4]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xProductVersion
push dword [ebp - 0x1c]
push edi
call fcn.000b24b0
add esp, 0x14
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueA]
cmp eax, 1
je 0xb6c54
mov eax, dword [ebp - 8]
inc esi
shr eax, 2
cmp esi, eax
jb 0xb6c14
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0xb6c7c
mov edx, dword [ebp - 0x14]
test edx, edx
je 0xb6c7c
mov eax, dword [ebp - 0xc]
test eax, eax
je 0xb6c7c
push eax
call fcn.000c0f20
add esp, 4
neg eax
sbb eax, eax
and eax, 1
mov dword [ebp - 0x18], eax
push ebx
call fcn.00158d47
add esp, 4
push edi
call fcn.00158d47
mov eax, dword [ebp - 0x18]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xb7320
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], edx
push ebx
push ebx
push 3
push ebx
push 3
mov esi, ecx
mov dword [ebp - 8], ebx
push 0x80000000
xorps xmm0, xmm0
mov dword [ebp - 0xc], ebx
push esi
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0xb7390
push esi
push str.failed_to_open_drive_on__s
push 0x1cb
push str.fr_get_device_number_by_path
push str.fr_vps.c
call fcn.000c08e0
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x2d1080
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0xb73c0
cmp dword [ebp - 8], 0xc
jne 0xb73c0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0xb73df
push esi
push str.failed_to_get_device_number_on__s
push 0x1d0
push str.fr_get_device_number_by_path
push str.fr_vps.c
call fcn.000c08e0
add esp, 0x14
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xb7cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc], eax
cmp dword [eax + 0x4c], 0xffffffff
mov edi, edx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], esi
je 0xb7d2f
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x4c], eax
cmp eax, 0xffffffff
jne 0xb7d82
push dword [edi]
push str.failed_to_open_license_file__s
push 0x2dc
push str.fr_usb_load
push str.fr_vps.c
call fcn.000c08e0
add esp, 0x14
mov esi, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
push 1
push ebx
call fcn.001591ee
push 1
push ebx
mov dword [ebp - 0x14], eax
call fcn.001591ee
mov edi, eax
add esp, 0x10
mov eax, dword [ebp - 0x14]
test eax, eax
je 0xb7e5d
test edi, edi
je 0xb7e5d
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x4c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xb7e39
mov edx, dword [ebp - 8]
cmp ebx, edx
jne 0xb7e39
push ecx
push 1
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
push 0
push eax
push edi
push str.123_94__
push str.1_394i23
call fcn.001496d0
add esp, 0x20
test eax, eax
jne 0xb7e14
mov eax, dword [ebp - 0x10]
push dword [eax]
push ebx
push str.failed_to_decrypt__zu_bytes_from__s
push 0x2ea
push str.fr_usb_load
push str.fr_vps.c
call fcn.000c0810
add esp, 0x18
jmp 0xb7e7e
push dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, edi
call fcn.000b7b70
add esp, 4
test eax, eax
je 0xb7e80
mov eax, dword [ebp - 0x10]
push dword [eax]
push str.failed_to_load_license_from__s
push 0x2ec
jmp 0xb7e6c
mov eax, dword [ebp - 0x10]
push dword [eax]
push ebx
push str.failed_to_read__zu_bytes_from__s
push 0x2e8
push str.fr_usb_load
push str.fr_vps.c
call fcn.000c08e0
add esp, 0x18
jmp 0xb7e7e
push str.failed_to_create_crypto_buffer_objects
push 0x17bec4
push 0x2e3
push str.fr_usb_load
push str.fr_vps.c
call fcn.000c0810
add esp, 0x14
mov esi, eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0xb7e90
push eax
call fcn.00158d47
add esp, 4
test edi, edi
je 0xb7e9d
push edi
call fcn.00158d47
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xb8210
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xorps xmm0, xmm0
push esi
xor esi, esi
movq qword [ebp - 0x10], xmm0
push edi
mov eax, dword [ebx + 0x4c]
mov dword [ebp - 8], esi
cmp eax, 0xffffffff
jne 0xb826c
push str.invalid_file_handle
push 0x17bec4
push 0x5c7
push str.fr_usb_is_attach
push str.fr_vps.c
call fcn.000c0810
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
push 0
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0xb82b3
push str.failed_to_reset_file_handle
push 0x17bec4
push 0x5c9
push str.fr_usb_is_attach
push str.fr_vps.c
call fcn.000c08e0
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
push 1
push dword [ebx + 0x50]
call fcn.001591ee
mov edi, eax
add esp, 8
test edi, edi
je 0xb82e5
push 0
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x50]
push edi
push dword [ebx + 0x4c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xb82e5
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 0x50]
je 0xb831a
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ee
je 0xb831a
push str.failed_to_read_file_handle
push 0x17bec4
push 0x5d1
push str.fr_usb_is_attach
push str.fr_vps.c
call fcn.000c08e0
add esp, 0x14
mov esi, eax
test edi, edi
je 0xb8327
push edi
call fcn.00158d47
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret

Function at 0xb8b30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
mov esi, edx
push edi
test ebx, ebx
je 0xb8bb2
cmp dword [ebx], 0
jne 0xb8bb2
test esi, esi
je 0xb8bb2
push 0x14
push 1
call fcn.001591ee
mov edi, eax
add esp, 8
mov dword [ebp - 4], edi
test edi, edi
je 0xb8bb2
lea ecx, [edi + 0xc]
call fcn.000c1630
test eax, eax
jne 0xb8bb2
lea ecx, [edi + 0x10]
call fcn.000c1510
test eax, eax
jne 0xb8bb2
mov eax, dword [ebp + 8]
push 0
push 0
push edi
mov dword [edi], esi
push 0xb8ac0
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi + 8], eax
mov esi, dword [edi + 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0xb8bb2
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
call fcn.000b8bd0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb96c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0xb971a
push str.failed_to_clear_non_blocking_flag_on_socket
push 0x17bec4
push 0x35f
push str.set_fd_block
push 0x188be0
call fcn.000c0810
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret

Function at 0xb9730
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x60], edx
xor edi, edi
mov ebx, ecx
test edx, edx
je 0xb98b8
mov eax, dword [ebp + 8]
test eax, eax
jle 0xb98b8
mov ecx, dword [ebx + 0x294]
test ecx, ecx
jne 0xb97d9
push ecx
push eax
push edx
push dword [ebx + 0x230]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov eax, dword [ebx]
cmp dword [eax], esi
jne 0xb9810
test edi, edi
jns 0xb98db
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0xb9810
call esi
cmp eax, 0x2745
je 0xb9810
call esi
cmp eax, 0x274c
je 0xb9810
call esi
cmp eax, 0x2746
je 0xb9810
push str.failed_to_read_from_socket
push 0x17bec4
push 0x3cf
push str.pull
push 0x188be0
call fcn.000c08e0
jmp 0xb98d6
push eax
call fcn.000c1f70
mov edi, eax
add esp, 4
mov eax, dword [ebx]
cmp dword [eax], esi
jne 0xb9810
test edi, edi
jg 0xb98db
mov ecx, dword [ebx + 0x294]
mov edx, edi
call fcn.000c2060
cmp eax, 3
jg 0xb983b
cmp eax, 2
jge 0xb981a
cmp eax, 0xfffffe73
jne 0xb9840
mov esi, 1
jmp 0xb98db
push dword [ebp + 8]
mov edx, dword [ebp - 0x60]
mov ecx, ebx
call fcn.000b9730
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
cmp eax, 5
je 0xb986a
push eax
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.000c20a0
push eax
push str.failed_to_read_from_ssl_session_object___s___d_
push 0x3ef
push str.pull
push 0x188be0
call fcn.000c0810
add esp, 0x18
jmp 0xb98d9
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0xb9810
call esi
cmp eax, 0x2745
je 0xb9810
call esi
cmp eax, 0x274c
je 0xb9810
call esi
cmp eax, 0x2746
je 0xb9810
push str.failed_to_read_from_socket
push 0x17bec4
push 0x3dd
push str.pull
push 0x188be0
call fcn.000c08e0
jmp 0xb98d6
push str.invalid_buffer_or_length
push 0x17bec4
push 0x3c8
push str.pull
push 0x188be0
call fcn.000c0810
add esp, 0x14
mov esi, eax
mov ecx, dword [ebp - 8]
or eax, 0xffffffff
test esi, esi
cmovne edi, eax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xb9900
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x1a700c]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0xc], edx
xor edi, edi
mov ebx, ecx
test edx, edx
je 0xb9a83
mov eax, dword [ebp + 8]
test eax, eax
jle 0xb9a83
mov ecx, dword [ebx + 0x294]
test ecx, ecx
jne 0xb99ae
push ecx
push eax
push edx
push dword [ebx + 0x230]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov eax, dword [ebx]
cmp dword [eax], esi
jne 0xb99ef
test edi, edi
jns 0xb9aa6
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0xb99ef
call esi
cmp eax, 0x2745
je 0xb99ef
call esi
cmp eax, 0x274c
je 0xb99ef
call esi
cmp eax, 0x2746
je 0xb99ef
push str.failed_to_read_from_socket
push 0x17bec4
push 0x428
push str.push
push 0x188be0
call fcn.000c08e0
jmp 0xb9aa1
push eax
call 0xd8b70
mov edi, eax
add esp, 4
test edi, edi
mov eax, 0xffffffff
cmovs edi, eax
mov eax, dword [ebx]
cmp dword [eax], esi
jne 0xb99ef
test edi, edi
jg 0xb9aa6
mov ecx, dword [ebx + 0x294]
mov edx, edi
call fcn.000c2060
cmp eax, 3
jg 0xb9a1c
cmp eax, 2
jge 0xb99f9
cmp eax, 0xfffffe73
jne 0xb9a21
mov esi, 1
jmp 0xb9aa6
push dword [ebp + 8]
mov edx, dword [esp + 0x10]
mov ecx, ebx
call fcn.000b9900
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
cmp eax, 5
je 0xb9a39
lea edx, [esp + 0x10]
mov ecx, eax
call fcn.000c20a0
push eax
push str.failed_to_write_to_ssl_session_object___s
push 0x448
jmp 0xb9a92
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0xb99ef
call esi
cmp eax, 0x2745
je 0xb99ef
call esi
cmp eax, 0x274c
je 0xb99ef
call esi
cmp eax, 0x2746
je 0xb99ef
push str.failed_to_read_from_socket
push 0x17bec4
push 0x436
push str.push
push 0x188be0
call fcn.000c08e0
jmp 0xb9aa1
push str.invalid_buffer_or_length
push 0x17bec4
push 0x41d
push str.push
push 0x188be0
call fcn.000c0810
mov esi, eax
add esp, 0x14
mov ecx, dword [esp + 0x64]
test esi, esi
mov eax, 0xffffffff
cmovne edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xb9b20
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
lea eax, [ebp - 8]
push edi
push edi
push edi
push eax
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 8], edi
push edx
push dword [esi + 0x230]
call dword [sym.imp.WS2_32.dll_WSASend]
mov ecx, eax
mov eax, dword [esi]
cmp dword [eax], edi
jne 0xb9bab
test ecx, ecx
jns 0xb9bb0
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0xb9bab
call esi
cmp eax, 0x2745
je 0xb9bab
call esi
cmp eax, 0x274c
je 0xb9bab
call esi
cmp eax, 0x2746
je 0xb9bab
push str.failed_to_read_from_socket
push 0x17bec4
push 0x474
push str.pushv
push 0x188be0
call fcn.000c08e0
add esp, 0x14
mov edi, eax
jmp 0xb9bb0
mov edi, 1
mov eax, dword [ebp - 8]
or ecx, 0xffffffff
test edi, edi
pop edi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xba0f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x1a700c]
xor eax, esp
mov dword [esp + 0x34], eax
mov dword [esp + 4], 0
push esi
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
je 0xba1c0
test edx, edx
je 0xba1c0
lea eax, [esp + 0xc]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x14]
movaps xmmword [esp + 0x14], xmm0
push eax
push edx
push ecx
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 1
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0xba190
mov edx, dword [esp + 0xc]
test edx, edx
je 0xba190
push ecx
mov ecx, edi
call fcn.000b9dd0
add esp, 4
mov ecx, 1
test eax, eax
cmovne esi, ecx
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
push 0
push 0x400
push 0x1ab260
push 0x400
push esi
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x1ab260
push str.failed_to_get_connect_socket_addresses___s
push 0x5a2
jmp 0xba1cf
push str.invalid_host_and_port
push 0x17bec4
push 0x599
push str.connect_socket
push 0x188be0
call fcn.000c0810
mov ecx, dword [esp + 0x50]
add esp, 0x14
pop edi
pop esi
xor ecx, esp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xba500
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
push esi
push 2
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push 0x401
push dword [esi + 0x27c]
lea eax, [esi + 0x254]
push dword [esi + 0x270]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0xba554
push str.failed_to_resolve_client_socket_address_structure
push 0x17bec4
push 0x61a
push str.mg_connection_get_addr
push 0x188be0
call fcn.000c0810
add esp, 0x14
mov ebx, eax
pop esi
pop ebx
pop ecx
ret
push 0xa
push 0x20
push dword [esi + 0x28c]
lea eax, [esi + 0x234]
push 0x401
push dword [esi + 0x284]
push dword [esi + 0x250]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0xba5a7
push str.failed_to_resolve_server_socket_address_structure
push 0x17bec4
push 0x623
push str.mg_connection_get_addr
push 0x188be0
call fcn.000c0810
add esp, 0x14
mov ebx, eax
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [esi + 0x27c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xba5b0
sub ecx, edx
mov dword [esi + 0x280], ecx
mov ecx, dword [esi + 0x284]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xba5c8
sub ecx, edx
mov dword [esi + 0x288], ecx
mov ecx, dword [esi + 0x28c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xba5e0
sub ecx, edx
mov dword [esi + 0x290], ecx
cmp word [esi + 0x234], 0x17
jne 0xba68a
cmp byte [esi + 0x23c], bl
jne 0xba68a
cmp byte [esi + 0x23d], bl
jne 0xba68a
cmp byte [esi + 0x23e], bl
jne 0xba68a
cmp byte [esi + 0x23f], bl
jne 0xba68a
cmp byte [esi + 0x240], bl
jne 0xba68a
cmp byte [esi + 0x241], bl
jne 0xba68a
cmp byte [esi + 0x242], bl
jne 0xba68a
cmp byte [esi + 0x245], bl
jne 0xba68a
cmp byte [esi + 0x244], bl
jne 0xba68a
cmp byte [esi + 0x246], 0xff
jne 0xba68a
cmp byte [esi + 0x247], 0xff
jne 0xba68a
mov ecx, dword [esi + 0x284]
add dword [esi + 0x288], 0xfffffff9
push dword [esi + 0x288]
lea eax, [ecx + 7]
push eax
push ecx
call fcn.00152e40
mov ecx, dword [esi + 0x284]
add esp, 0xc
mov eax, dword [esi + 0x288]
mov byte [ecx + eax], bl
cmp word [esi + 0x254], 0x17
jne 0xba725
cmp byte [esi + 0x25c], bl
jne 0xba725
cmp byte [esi + 0x25d], bl
jne 0xba725
cmp byte [esi + 0x25e], bl
jne 0xba725
cmp byte [esi + 0x25f], bl
jne 0xba725
cmp byte [esi + 0x260], bl
jne 0xba725
cmp byte [esi + 0x261], bl
jne 0xba725
cmp byte [esi + 0x262], bl
jne 0xba725
cmp byte [esi + 0x265], bl
jne 0xba725
cmp byte [esi + 0x264], bl
jne 0xba725
cmp byte [esi + 0x266], 0xff
jne 0xba725
cmp byte [esi + 0x267], 0xff
jne 0xba725
mov ecx, dword [esi + 0x27c]
add dword [esi + 0x280], 0xfffffff9
push dword [esi + 0x280]
lea eax, [ecx + 7]
push eax
push ecx
call fcn.00152e40
mov ecx, dword [esi + 0x280]
add esp, 0xc
mov eax, dword [esi + 0x27c]
mov byte [ecx + eax], bl
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0xba7e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
mov eax, dword [edi]
mov dword [edi + 0x2a4], 1
cmp dword [eax + 8], 2
jne 0xba821
mov dword [eax], 1
mov ecx, dword [edi + 0x230]
lea esi, [edi + 0x230]
cmp ecx, 0xffffffff
je 0xba8cd
call fcn.000b96c0
mov eax, dword [edi]
cmp dword [eax + 8], 1
jne 0xba8a8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1007
push 0xffff
push dword [esi]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0xba8a8
cmp dword [ebp - 0xc], 0x6c
je 0xba8a8
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x80
push 0xffff
push dword [esi]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0xba8a8
push dword [esi]
push str.failed_to_set_SO_LINGER_on_socket__d
push 0x69b
push str.mg_connection_close
push 0x188be0
call fcn.000c08e0
add esp, 0x14
push 2
push dword [esi]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x48
push 0
push esi
call fcn.00153d90
add esp, 0xc
mov dword [esi], 0xffffffff
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xba920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov edx, ecx
push dword [ebx + 0xc]
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push eax
mov dword [ebp - 4], 0
call fcn.000ba200
mov edi, dword [ebp - 4]
add esp, 8
test eax, eax
je 0xba967
push str.failed_to_create_connection_object
push 0x17bec4
push 0x6cf
jmp 0xbaa66
push 0x4c
push 1
call fcn.001591ee
mov esi, eax
add esp, 8
test esi, esi
jne 0xba98d
push str.failed_to_create_context_object
push 0x17bec4
push 0x6d1
jmp 0xbaa66
push dword [ebp - 8]
mov eax, dword [ebx + 0xc]
push dword [ebp - 0xc]
mov dword [esi + 4], eax
push dword [ebp + 8]
mov dword [esi + 8], 2
mov dword [edi], esi
push str.GET__s_HTTP_1.1_r_nHost:__s:_s_r_nUpgrade:_websocket_r_nConnection:_Upgrade_r_nSec_WebSocket_Key:_x3JJHMbDL1EzLkh9GBhXDw_r_nSec_WebSocket_Version:_13_r_n_r_n
push dword [edi + 0x278]
call fcn.000c1200
add esp, 0x14
test eax, eax
jne 0xbaa57
mov eax, dword [edi + 0x278]
mov ecx, edi
push dword [eax]
mov edx, dword [eax + 8]
call fcn.000b9ad0
add esp, 4
test eax, eax
jle 0xbaa57
mov ecx, edi
call fcn.000bc0a0
test eax, eax
jne 0xbaa57
mov eax, dword [edi + 0x10]
mov ecx, 0x18923c
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0xbaa10
test dl, dl
je 0xbaa0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0xbaa10
add eax, 2
add ecx, 2
test dl, dl
jne 0xba9f0
xor eax, eax
jmp 0xbaa15
sbb eax, eax
or eax, 1
test eax, eax
jne 0xbaa57
mov eax, dword [ebx + 0xc]
lea ecx, [esi + 0x38]
mov dword [ebx], edi
mov dword [edi + 8], eax
call fcn.000c1510
test eax, eax
jne 0xbaa46
mov esi, dword [esi + 0x38]
push eax
push eax
push ebx
push 0xba8e0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0xbaa9d
push str.failed_to_start_client_worker_thread
push 0x17bec4
push 0x6f6
jmp 0xbaa66
push str.failed_to_complete_websocket_upgrade_request
push 0x17bec4
push 0x6e8
push str.mg_connect_websocket_client
push 0x188be0
call fcn.000c0810
add esp, 0x14
test eax, eax
je 0xbaa9d
test edi, edi
je 0xbaa9d
mov ecx, edi
call fcn.000ba7e0
lea eax, [ebp - 4]
push eax
call fcn.000ba3e0
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret