joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4614b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, ecx
mov dword [esp + 4], 0xffffffff
push ebx
push esi
xor ecx, ecx
mov dword [esp + 0x10], eax
test byte [edx + 0x1c], 0x80
mov ebx, dword [eax + 8]
push edi
mov dword [esp + 0x18], ebx
jne 0x4614dd
xor edi, edi
jmp 0x4614f4
mov edi, dword [edx + 8]
test edi, edi
je 0x4614f4
mov eax, dword [edi + 0x38]
and al, 3
cmp al, 2
je 0x4614f4
mov edi, dword [edi + 0x14]
test edi, edi
jne 0x4614e4
mov esi, dword [edx + 8]
test esi, esi
je 0x461628
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], edx
nop dword [eax]
cmp dword [ebp + 0x10], 0
je 0x46151f
cmp dword [edx], 0
je 0x461612
cmp esi, edi
je 0x461612
cmp eax, dword [ebp + 0x14]
je 0x461612
push dword [esp + 0x10]
lea eax, [esp + 0x28]
mov edx, esi
push ecx
mov ecx, dword [esp + 0x1c]
push eax
push 1
push 0
push dword [ebp + 8]
call fcn.00461630
add esp, 0x18
mov edx, eax
test byte [esi + 0x38], 8
mov dword [esp + 0x10], edx
je 0x461561
movzx ecx, word [esi + 0x32]
jmp 0x461565
movzx ecx, word [esi + 0x34]
movzx eax, cx
mov ecx, dword [ebx + 0x74]
mov dword [esp + 0x20], eax
cmp dword [ebx + 0x78], ecx
jg 0x46158a
push eax
push edx
push dword [ebp + 0xc]
mov edx, 0x8a
mov ecx, ebx
call fcn.0042a9a0
add esp, 0xc
jmp 0x4615bc
mov edx, dword [ebp + 0xc]
lea eax, [ecx + 1]
mov dword [ebx + 0x74], eax
lea ecx, [ecx + ecx*4]
mov eax, dword [ebx + 0x70]
mov dword [eax + ecx*4 + 4], edx
mov edx, dword [esp + 0x10]
mov dword [eax + ecx*4 + 8], edx
mov edx, dword [esp + 0x20]
mov dword [eax + ecx*4], 0x8a
mov dword [eax + ecx*4 + 0xc], edx
mov dword [eax + ecx*4 + 0x10], 0
mov eax, dword [ebx + 0x74]
test eax, eax
jle 0x4615d3
lea ecx, [eax + eax*4]
mov edx, 1
mov eax, dword [ebx + 0x70]
mov word [eax + ecx*4 - 0x12], dx
mov edx, dword [esp + 0x24]
test edx, edx
je 0x461609
mov eax, dword [esp + 0x14]
not edx
mov ebx, dword [eax + 8]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 0x3c]
add eax, dword [ecx + 0x38]
jns 0x4615fc
push edx
mov edx, ebx
call fcn.0042b160
add esp, 4
jmp 0x461605
mov ecx, dword [ecx + 0x40]
mov eax, dword [ebx + 0x74]
mov dword [ecx + edx*4], eax
mov ebx, dword [esp + 0x18]
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov edx, dword [esp + 0x1c]
mov esi, dword [esi + 0x14]
add edx, 4
inc eax
mov dword [esp + 0x1c], edx
mov dword [ebp + 0xc], eax
test esi, esi
jne 0x461510
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bba70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4d4d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov ecx, dword [ebx + 4]
xor eax, eax
mov dword [ebp - 0x20], eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x1c], eax
test ecx, ecx
je 0x4bbacd
lea eax, [ebp - 0x1c]
push eax
push dword [ecx + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageGraphicsContext]
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jmp 0x4bbad0
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.gdiplus.dll_GdipGraphicsClear]
test eax, eax
cmovne esi, eax
lea eax, [edi - 1]
xor ecx, ecx
mov dword [ebp - 0x14], esi
cmp eax, 3
ja case.default.0x4bbaf5
jmp dword [eax*4 + 0x4bbc3c]
lea ecx, [ebx + 0x19c]
jmp case.default.0x4bbaf5
lea ecx, [ebx + 0x32c]
jmp case.default.0x4bbaf5
lea ecx, [ebx + 0x4bc]
jmp case.default.0x4bbaf5
lea ecx, [ebx + 0x64c]
lea eax, [ebx + 0xc]
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
push edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x4bbb93
mov dword [esi + 8], 0
lea eax, [esi + 4]
mov dword [esi + 0xc], 0
mov edi, dword [ebp - 0x1c]
push eax
push edi
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov dword [esi + 8], eax
jmp 0x4bbb98
mov edi, dword [ebp - 0x1c]
xor esi, esi
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov edi, dword [ebx + 4]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0
push dword [edi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageHeight]
test eax, eax
je 0x4bbbbc
mov dword [edi + 8], eax
mov edi, dword [ebx + 4]
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0
push dword [edi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageWidth]
test eax, eax
je 0x4bbbda
mov dword [edi + 8], eax
mov edi, dword [ebp - 0x20]
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push 0
push 0
test esi, esi
je 0x4bbbff
push dword [esi + 4]
push edi
call dword [sym.imp.gdiplus.dll_GdipDrawImageRectI]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
jmp 0x4bbc08
push 0
push edi
call dword [sym.imp.gdiplus.dll_GdipDrawImageRectI]
push 0x101
push 0
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_RedrawWindow]
push edi
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf1a3
mov esp, ebp
pop ebp
ret
Function at 0x4bc290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4d4d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov ecx, dword [ebx + 4]
xor eax, eax
mov dword [ebp - 0x20], eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x1c], eax
test ecx, ecx
je 0x4bc2ed
lea eax, [ebp - 0x1c]
push eax
push dword [ecx + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageGraphicsContext]
mov edi, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jmp 0x4bc2f0
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.gdiplus.dll_GdipGraphicsClear]
test eax, eax
cmovne edi, eax
xor ecx, ecx
mov dword [ebp - 0x14], edi
sub esi, 1
je 0x4bc32c
sub esi, 1
je 0x4bc324
sub esi, 1
jne 0x4bc332
lea ecx, [ebx + 0x4bc]
jmp 0x4bc332
lea ecx, [ebx + 0x32c]
jmp 0x4bc332
lea ecx, [ebx + 0x19c]
lea eax, [ebx + 0xc]
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
push edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x4bc3ab
mov dword [esi + 8], 0
lea eax, [esi + 4]
mov dword [esi + 0xc], 0
mov edi, dword [ebp - 0x1c]
push eax
push edi
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov dword [esi + 8], eax
jmp 0x4bc3b0
mov edi, dword [ebp - 0x1c]
xor esi, esi
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov edi, dword [ebx + 4]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0
push dword [edi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageHeight]
test eax, eax
je 0x4bc3d4
mov dword [edi + 8], eax
mov edi, dword [ebx + 4]
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0
push dword [edi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageWidth]
test eax, eax
je 0x4bc3f2
mov dword [edi + 8], eax
mov edi, dword [ebp - 0x20]
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push 0
push 0
test esi, esi
je 0x4bc417
push dword [esi + 4]
push edi
call dword [sym.imp.gdiplus.dll_GdipDrawImageRectI]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
jmp 0x4bc420
push 0
push edi
call dword [sym.imp.gdiplus.dll_GdipDrawImageRectI]
push 0x101
push 0
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_RedrawWindow]
push edi
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf1a3
mov esp, ebp
pop ebp
ret
Function at 0x4bfc2b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4bfc6a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4bfc6a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4bfc6a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4bfc6a
cmp dword [ecx + 0x74], 0xe
jbe 0x4bfc6a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4cb960
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4cb9ab
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004cbaf9
test al, al
jne 0x4cb9a5
sub edx, 2
cmp edx, edi
jne 0x4cb98b
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4cb9cd
lea eax, [edi + 2]
cmp edx, eax
je 0x4cb9cd
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004cb8ac
add esp, 0x10
jmp 0x4cbac5
push esi
lea ecx, [ebp - 0x255]
call fcn.004cbaf9
sub edx, edi
xor ecx, ecx
sar edx, 1
inc edx
test al, al
lea eax, [ebp - 0x254]
cmovne ecx, edx
xor ebx, ebx
push ebx
push ebx
push ebx
push eax
push ebx
push edi
mov dword [ebp - 0x260], ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4cba0e
push dword [ebp - 0x25c]
jmp 0x4cb9bd
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4cba4b
cmp word [ebp - 0x226], 0
je 0x4cba6c
cmp word [ebp - 0x226], ax
jne 0x4cba4b
cmp word [ebp - 0x224], 0
je 0x4cba6c
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004cb8ac
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4cbab8
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4cba25
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4cbaa0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4cbac5
push 0x4cb6dc
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004d0120
add esp, 0x10
jmp 0x4cba95
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bf1a3
leave
ret

Function at 0x4cc618
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4cc629
pop esi
ret
push ebx
push edi
push esi
call fcn.004cc5e1
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004c9df0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4cc651
push ebx
push esi
push edi
call fcn.004c2130
add esp, 0xc
push 0
call fcn.004c84b0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4cca20
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cc666
Function at 0x4d4360
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4d438d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4d438d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002600
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebx + 0x10]
test dword [edi + 0xdc], 0x2000
jne 0x10002631
push str.Cannot_resume_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
push 0xb13
push 0x1013f628
push dword [0x10149f20]
call dword [0x10149f24]
add esp, 0x10
push esi
lea esi, [edi + 0x98]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebx + 0xf0], 1
push esi
mov byte [edi + 0xc3], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0xb8], 0xffffffff
pop esi
je 0x10002692
push 0
push 1
push 0x1013f054
push dword [edi + 0xbc]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10002692
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10002692
push str.Failed_to_signal_resume_via_inter_thread_communication_channel.
push edi
call fcn.100085c0
add esp, 8
pop edi
pop ebx
ret
Function at 0x100028d0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x30
mov eax, dword [0x1013dd8c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0x1c
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
push edi
movups xmmword [esp + 0x18], xmm0
mov eax, dword [esi + 0xb0]
movq qword [esp + 0x28], xmm0
cmp eax, 0xffffffff
je 0x10002a96
cmp byte [esi + 0xc1], 0
jne 0x10002a96
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov byte [esp + 0x10], 0
cmp ebx, 0xffffffff
je 0x100029d8
cmp dword [esp + 0xc], 0
jle 0x100029d8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x10002984
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.10007c10
push eax
push str.Failed_to_set_nonblocking_mode_on_incoming_connection_socket:__s_n
push esi
call fcn.100085c0
add esp, 0xc
jmp 0x10002989
mov byte [esp + 0x10], 1
push 0
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x100029a6
push str.Failed_to_set_noninheritable_mode_on_incoming_connection_socket._n
push esi
call fcn.100085c0
add esp, 8
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
mov edx, ebx
push 0
push dword [esp + 0x14]
mov ecx, esi
push eax
call fcn.10001f60
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.10065961
add esp, 0x30
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2726
je 0x10002a96
cmp edi, 0x2746
je 0x10002a96
cmp edi, 0x2733
je 0x10002a16
mov ecx, edi
call fcn.10007c10
push eax
push str.Error_accepting_connection:__s_n
push esi
call fcn.100085c0
add esp, 0xc
cmp ebx, 0xffffffff
je 0x10002a44
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x10002a44
push 0x1013f900
push 0xc19
push 0x1013f918
push dword [0x10149f20]
call dword [0x10149f24]
add esp, 0x10
cmp edi, 0x2728
je 0x10002a54
cmp edi, 0x2747
jne 0x10002a96
mov eax, dword [esi + 0xc8]
test eax, eax
jne 0x10002a80
push str.Hit_process_or_system_resource_limit_at_FIRST_connection._This_is_really_bad_as_there_is_no_sane_way_to_proceed._Will_try_busy_waiting_for_system_resources_to_become_magically_available._n
push esi
call fcn.100085c0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.10065961
add esp, 0x30
ret
push eax
push str.Hit_process_or_system_resource_limit_at__u_connections__temporarily_suspending_accept__._Consider_setting_a_lower_MHD_OPTION_CONNECTION_LIMIT._n
push esi
mov byte [esi + 0xc2], 1
call fcn.100085c0
add esp, 0xc
mov ecx, dword [esp + 0x34]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10065961
add esp, 0x30
ret
Function at 0x10002df0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0xc
mov eax, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edi
mov byte [edi + 0xc4], 0
mov ecx, dword [edi + 0xb8]
cmp ecx, 0xffffffff
je 0x10002e44
push edx
push ecx
call eax
test eax, eax
je 0x10002e3b
mov esi, dword [sym.imp.WS2_32.dll_recv]
push 0
push 4
lea eax, [esp + 0x20]
push eax
push dword [edi + 0xb8]
call esi
test eax, eax
jg 0x10002e26
mov edx, dword [esp + 0x10]
mov eax, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov ecx, dword [edi + 0xb0]
cmp ecx, 0xffffffff
je 0x10002e67
cmp byte [edi + 0xc1], 0
jne 0x10002e67
push edx
push ecx
call eax
test eax, eax
je 0x10002e67
mov ecx, edi
call fcn.100028d0
test dword [edi + 0xdc], 4
jne 0x10002ed7
mov esi, dword [edi + 0xc]
test esi, esi
je 0x10002ed7
mov edi, dword [esp + 0x10]
nop
mov ebp, dword [esi + 0xa0]
mov ebx, dword [esi + 4]
cmp ebp, 0xffffffff
je 0x10002ecd
push dword [esp + 0x24]
push ebp
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
setne al
movzx eax, al
push eax
push dword [esp + 0x24]
push ebp
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
setne al
movzx eax, al
push eax
push edi
push ebp
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
mov ecx, esi
setne dl
call fcn.100017f0
add esp, 8
mov esi, ebx
test ebx, ebx
jne 0x10002e80
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.10002ab0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x10004800
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x1013dd8c]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
mov dword [0x10149f24], 0x10001440
push eax
push 0x202
mov dword [0x10149f20], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1000485f
push str.Failed_to_initialize_winsock_n
push 0x1a69
push 0x10141ab8
push dword [0x10149f20]
call dword [0x10149f24]
add esp, 0x10
mov eax, dword [esp]
mov dword [0x10147cd4], 1
cmp al, 2
je 0x10004895
shr eax, 8
cmp al, 2
je 0x10004895
push str.Winsock_version_2.2_is_not_available_n
push 0x1a6c
push str.T:Bin_prepmhd_srclibmicrohttpd_0.9.55W32VS2015...._srcmicrohttpddaemon.c
push dword [0x10149f20]
call dword [0x10149f24]
add esp, 0x10
call fcn.10008380
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.10065961
mov esp, ebp
pop ebp
ret
Function at 0x10006a10
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
push edi
cmp byte [esi + 0xa8], 0
mov edi, dword [esi + 0x10]
jne 0x10006bb7
mov eax, dword [esi + 0x1c]
mov byte [esi + 0xa8], 1
test eax, eax
je 0x10006a42
push eax
call fcn.10007930
add esp, 4
mov dword [esi + 0x1c], 0
push ebx
lea ebx, [edi + 0x98]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi + 0xe8], 0
je 0x10006a8f
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
jne 0x10006a67
mov dword [edi + 0x10], eax
jmp 0x10006a69
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
test ecx, ecx
jne 0x10006a80
mov dword [edi + 0x14], eax
mov byte [esi + 0xe8], cl
jmp 0x10006b2b
mov dword [ecx + 4], eax
mov byte [esi + 0xe8], 0
jmp 0x10006b2b
test dword [edi + 0xdc], 4
jne 0x10006b0a
mov eax, dword [esi + 0x90]
cmp eax, dword [edi + 0xd0]
jne 0x10006ad8
mov eax, dword [esi + 0x94]
cmp eax, dword [edi + 0xd4]
jne 0x10006ad8
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
test ecx, ecx
jne 0x10006ac6
mov dword [edi + 0x20], eax
jmp 0x10006ac9
mov dword [ecx + 8], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
test ecx, ecx
jne 0x10006af9
mov dword [edi + 0x24], eax
jmp 0x10006afc
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
test ecx, ecx
jne 0x10006ae7
mov dword [edi + 0x28], eax
jmp 0x10006aea
mov dword [ecx + 8], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
test ecx, ecx
jne 0x10006af9
mov dword [edi + 0x2c], eax
jmp 0x10006afc
mov dword [ecx + 0xc], eax
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
jne 0x10006b18
mov dword [edi + 8], eax
jmp 0x10006b1a
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
test ecx, ecx
jne 0x10006b28
mov dword [edi + 0xc], eax
jmp 0x10006b2b
mov dword [ecx + 4], eax
mov dword [esi + 4], 0
mov dword [esi], 0
mov eax, dword [edi + 0x18]
mov dword [esi], eax
mov dword [esi + 4], 0
cmp dword [edi + 0x1c], 0
jne 0x10006b4f
mov dword [edi + 0x1c], esi
jmp 0x10006b55
mov eax, dword [edi + 0x18]
mov dword [eax + 4], esi
mov dword [edi + 0x18], esi
push ebx
mov byte [esi + 0xf0], 0
mov byte [esi + 0xa7], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test dword [edi + 0xdc], 4
pop ebx
je 0x10006bb7
cmp dword [edi + 0xb8], 0xffffffff
je 0x10006bb7
push 0
push 1
push 0x10142b6c
push dword [edi + 0xbc]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10006bb7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10006bb7
push str.Failed_to_signal_end_of_connection_via_inter_thread_communication_channel
push edi
call fcn.100085c0
add esp, 8
pop edi
pop esi
ret
Function at 0x100080a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x4c
mov eax, dword [0x1013dd8c]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x100080c6
push 0x271e
jmp 0x1000825d
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov edi, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 0
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x10008247
push 0x7f000001
mov dword [esp + 0x28], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x10008233
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x10008233
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x10008233
push 6
push 1
push 2
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x10008233
lea eax, [esp + 0x18]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x10008278
push 0x10
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x100081a9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10008278
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x100081d5
push esi
call ebx
push edi
call ebx
mov ebp, dword [esp + 0x14]
jmp 0x10008236
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x48]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x10008229
mov ax, word [esp + 0x34]
cmp ax, word [esp + 0x44]
jne 0x10008229
mov ax, word [esp + 0x36]
cmp ax, word [esp + 0x46]
jne 0x10008229
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x48]
jne 0x10008229
lea eax, [esp + 0x18]
push eax
push 0x8004667e
push ebp
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x1000827e
push ebp
call ebx
push edi
call ebx
mov ebp, dword [esp + 0x14]
push esi
call ebx
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, 0x320
jl 0x100080d2
mov eax, dword [esp + 0x1c]
push 0x274d
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.10065961
add esp, 0x4c
ret
push esi
call ebx
push edi
jmp 0x10008234
push esi
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x54]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ebp
mov eax, 1
pop ebp
pop ebx
xor ecx, esp
call fcn.10065961
add esp, 0x4c
ret