joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b02a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x10121b54]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100b041f
cmp dword [ebp + 0xc], 0x20
jb 0x100b041f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.100b28f0
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x100fc1b0
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x100b041f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100b0330
sub ecx, edx
cmp ecx, 0x40
jne 0x100b041f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x100b036c
mov al, byte [esi + ecx]
test al, al
je 0x100b036c
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x100b0356
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x100b03a9
mov al, byte [esi + ecx]
test al, al
je 0x100b03a9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x100b0390
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.100b28f0
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.100b0430
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x100b041f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.100b1150
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10097f4e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.10097f4e
mov esp, ebp
pop ebp
ret
Function at 0x100b0cf0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.10097f60
mov eax, dword [0x10121b54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x100b0e5d
cmp dword [ebp + 0xc], 0
je 0x100b0e5d
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.10087310
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100b0e40
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.100b28f0
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100b0e35
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.100b28f0
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.100b16c0
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.100b1150
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x100b0e4a
inc esi
cmp esi, 0x10
jl 0x100b0d30
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10097f4e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10097f4e
mov esp, ebp
pop ebp
ret
Function at 0x100b0e70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10121b54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x100b0f58
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100b28f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x100b0f58
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b0ec7
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x100b0f58
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100b0ef0
mov eax, dword [0x100f89e0]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x100b0f05
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100b0f20
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10097f4e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10097f4e
mov esp, ebp
pop ebp
ret
Function at 0x100b0f70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x10121b54]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.100b28f0
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.100b0430
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x100b0fda
mov al, byte [edi + ecx]
test al, al
je 0x100b0fda
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x100b0fc1
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x100b0ffb
inc eax
sub ecx, 1
jne 0x100b0ff0
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x100b1050
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x100b1045
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x100b1044
mov bl, byte [edi + ecx]
test bl, bl
je 0x100b1044
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x100b1030
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.100b28f0
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x100fc1b0
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x100b110a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x100b10d4
test cl, cl
je 0x100b10d0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x100b10d4
add eax, 2
add esi, 2
test cl, cl
jne 0x100b10b4
xor eax, eax
jmp 0x100b10d9
sbb eax, eax
or eax, 1
test eax, eax
je 0x100b110a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100b10e6
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100b1113
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x100fc1b0
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10097f4e
mov esp, ebp
pop ebp
ret

Function at 0x100d1464
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100d1124
Function at 0x100d86f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.100d8820
add esp, 8
test al, al
je 0x100d8715
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100d8715
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x100d8820
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x100d8ba0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100d8bcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100d8bcb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x1d04d50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 4
push eax
push 1
push 6
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 4
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop edi
cmp eax, 0xffffffff
jne 0x1d04dc4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Socket_accept_ioctl_FIONBIO__failed___i__n
call fcn.01d14d50
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x1d04f00
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x1e94008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
call fcn.01d050d0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1d04f63
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.01d056e0
push eax
push str.Unable_to_create_socket___s__n
call fcn.01d14d50
add esp, 8
or eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1d04fbd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.01d056e0
push eax
push str.Socket_ioctl_FIONBIO__failed___s__n
call fcn.01d14d50
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8
push 4
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 1
push eax
push 1
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.01d19ea0
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1d0504e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1d04fa0
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x428], 0
push eax
push 0
lea eax, [ebp - 0x420]
mov dword [ebp - 0x42c], 1
push eax
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
push eax
mov dword [ebp - 0x420], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jl 0x1d04fa0
push dword [ebx + 0x4c]
lea ecx, [ebx + 0x3c]
call fcn.01d05c90
mov ecx, dword [ebx + 0x40]
mov dword [ebp - 0x428], eax
lea edx, [eax + eax*4]
lea ecx, [ecx + edx*4]
mov dword [ecx], esi
movq xmm0, qword [edi]
movq qword [ecx + 4], xmm0
mov eax, dword [edi + 8]
mov dword [ecx + 0xc], eax
xor eax, eax
mov dword [ebp - 0x438], ecx
mov ecx, dword [ebx + 0x38]
mov dword [ebp - 0x424], eax
test ecx, ecx
je 0x1d050a1
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
push edi
push esi
call dword [eax]
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x438]
pop edi
pop esi
pop ebx
mov dword [ecx + 0x10], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x428]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8
Function at 0x1d09910
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1e94008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea ebx, [ecx + 0x44]
xorps xmm0, xmm0
push esi
movups xmmword [ebx], xmm0
push edi
mov dword [ebx + 0x10], 0
mov esi, 0x1e70c8e
mov edi, dword [0x1e98164]
and edi, 0x10000
je 0x1d09950
mov ecx, str.FCVAR_NEVER_AS_STRING
jmp 0x1d0995f
mov eax, dword [0x1e98174]
mov ecx, esi
mov eax, dword [eax + 0x2c]
test eax, eax
cmovne ecx, eax
mov eax, 0x1e3d0f8
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1d09984
test dl, dl
je 0x1d09980
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1d09984
add ecx, 2
add eax, 2
test dl, dl
jne 0x1d09964
xor eax, eax
jmp 0x1d09989
sbb eax, eax
or eax, 1
test eax, eax
je 0x1d099bc
test edi, edi
je 0x1d09998
mov esi, str.FCVAR_NEVER_AS_STRING
jmp 0x1d099a5
mov eax, dword [0x1e98174]
mov eax, dword [eax + 0x2c]
test eax, eax
cmovne esi, eax
push 0x1ff
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.01e0d270
add esp, 0xc
jmp 0x1d099ce
push 0x200
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
mov edx, ebx
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x208]
call fcn.01d0ea20
pop edi
pop esi
pop ebx
test al, al
jne 0x1d099fa
lea eax, [ebp - 0x208]
push eax
push str.Could_not_get_TCP_IP_address__Invalid_hostname__s_n
call fcn.01d14d50
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret
Function at 0x1d09ac0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1e94008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x11
push 2
push 2
mov dword [ebp - 0x18], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1d09b2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x273f
je 0x1d09b19
mov ecx, eax
call fcn.01d0a290
push eax
push dword [ebp + 0xc]
push 0x1e3d184
push str._s:__port:__d_socket:__s_n
call fcn.01d14d50
add esp, 0x10
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1d09b7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.01d0a290
push eax
push dword [ebp + 0xc]
push 0x1e3d1bc
push str._s:__port:__d__ioctl_FIONBIO:__s_n
call fcn.01d14d50
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 1
push eax
push 0x20
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1d09bd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.01d0a290
push eax
push dword [ebp + 0xc]
push 0x1e3d1fc
push str._s:__port__d__setsockopt_SO_BROADCAST:__s_n
call fcn.01d14d50
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8
test edi, edi
je 0x1d09bfa
cmp byte [edi], 0
je 0x1d09bfa
push 0x1e3d244
push edi
call fcn.01e06197
add esp, 8
test eax, eax
je 0x1d09bfa
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.01d0a1c0
jmp 0x1d09c05
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
cmp edi, 0xffffffff
jne 0x1d09c11
xor eax, eax
jmp 0x1d09c18
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, 2
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1d09c74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.01d0a290
push eax
push edi
push str.CUDPSocket::CreateSocket
push str._s:__port__d__bind___s_n
call fcn.01d14d50
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8
Function at 0x1d09c90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1e94008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
cmp dword [edi], 3
jne 0x1d09d41
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 0x14], ax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], eax
mov ax, word [edi + 0x12]
push 0x10
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
push edx
push dword [ecx + 0x2c]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1d09d41
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x2733
je 0x1d09d40
cmp esi, 0x274d
je 0x1d09d40
cmp esi, 0x2746
je 0x1d09d40
cmp esi, 0x2741
jne 0x1d09d52
mov eax, dword [edi]
cmp eax, 2
je 0x1d09d40
cmp eax, 5
je 0x1d09d40
push ecx
mov ecx, edi
call fcn.01d09360
push eax
mov ecx, esi
call fcn.01d0a290
push eax
push 0x1e3d284
push str._s:__s_:__s_n
call fcn.01d14d50
add esp, 0x10
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x2747
je 0x1d09d1d
mov ecx, esi
call fcn.01d0a290
push eax
push str.CUDPSocket::SendPacket
push 0x1e3d2c4
call dword [sym.imp.tier0_d.dll_Error]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
pop edi
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1d09d90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1e94008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0x10
push eax
push 0
push 0xfaa
lea eax, [ecx + 0x58]
push eax
push dword [ecx + 0x2c]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1d09e73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x2733
je 0x1d09e5f
cmp edi, 0x2746
je 0x1d09e5f
cmp edi, 0x274d
je 0x1d09e5f
cmp edi, 0x2744
je 0x1d09e5f
cmp edi, 0x2738
jne 0x1d09e29
push 0x1e3d2cc
push str.1.__s:_Ignoring_oversized_network_message_n
call fcn.01d14d50
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 4
call fcn.01e0d62c
mov ecx, edi
mov edx, eax
call fcn.01d0a290
push dword [edx]
mov esi, eax
push edi
push esi
push 0x1e3d31c
push str.2.__s:__s__d__i_n
call fcn.01d14d50
push esi
push 0x1e3d354
push str.3.__s:__s_n
call fcn.01d14d50
add esp, 0x20
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 4
test esi, esi
je 0x1d09e5f
lea eax, [esi - 1]
cmp eax, 2
ja 0x1d09ea5
push 0x1e3d384
push str.4.__s:_Ignoring_undersized_network_message_n
call fcn.01d14d50
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 4
cmp esi, 0xfaa
jl 0x1d09edc
push ecx
mov ecx, edi
call fcn.01d09360
push eax
push str.CUDPSocket::ReceivePacketInternal
push str.5.__s:_Oversize_packet_from__s_n
call fcn.01d14d50
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.01d1a440
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 4
Function at 0x1d0a1c0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1e94008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 0xc]
push 0x7f
push eax
lea eax, [ebp - 0x84]
movups xmmword [esi], xmm0
push eax
mov dword [esi], 2
call fcn.01e0d270
add esp, 0xc
mov byte [ebp - 5], 0
cmp byte [ebp - 0x84], 0
lea eax, [ebp - 0x84]
je 0x1d0a235
nop dword [eax + eax]
cmp byte [eax], 0x3a
je 0x1d0a21d
inc eax
cmp byte [eax], 0
jne 0x1d0a210
jmp 0x1d0a235
mov byte [eax], 0
inc eax
push eax
call fcn.01e0d24c
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x1d0a269
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1d0a27c
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x1d0a27c
mov eax, dword [eax]
mov dword [esi + 4], eax
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.01e029b1
mov esp, ebp
pop ebp
ret 8

Function at 0x1d0c160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and edx, 0xfffffffc
mov dword [ebp - 8], ecx
mov eax, edx
cdq
and edx, 3
add edx, eax
sar edx, 2
mov dword [ebp - 0xc], edx
push ebx
mov ebx, ecx
test edx, edx
jle 0x1d0c1dc
mov ecx, dword [ebp + 8]
push esi
push edi
not ecx
lea edi, [ebp - 4]
mov dword [ebp - 0x10], ecx
neg edi
mov eax, dword [ebx]
mov ebx, dword [ebp + 0xc]
xor eax, ecx
bswap eax
mov dword [ebp - 4], eax
xor ecx, ecx
nop
lea esi, [ebp - 4]
mov dl, cl
add esi, ecx
shl dl, cl
lea eax, [edi + esi]
and eax, 0xf
or dl, byte [eax + ebx]
or dl, cl
inc ecx
or dl, 0xa5
xor byte [esi], dl
cmp ecx, 4
jl 0x1d0c1a0
mov ebx, dword [ebp - 8]
inc edi
mov eax, dword [ebp - 4]
xor eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [ebx], eax
add ebx, 4
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], ebx
jne 0x1d0c190
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1d0c1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and edx, 0xfffffffc
mov dword [ebp - 8], ecx
mov eax, edx
cdq
and edx, 3
add edx, eax
sar edx, 2
mov dword [ebp - 0xc], edx
push ebx
mov ebx, ecx
test edx, edx
jle 0x1d0c270
mov ecx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
not eax
lea edi, [ebp - 4]
mov dword [ebp - 0x10], eax
neg edi
mov eax, dword [ebx]
mov ebx, dword [ebp + 0xc]
xor eax, ecx
mov dword [ebp - 4], eax
xor ecx, ecx
nop
lea esi, [ebp - 4]
mov dl, cl
add esi, ecx
shl dl, cl
lea eax, [edi + esi]
and eax, 0xf
or dl, byte [eax + ebx]
or dl, cl
inc ecx
or dl, 0xa5
xor byte [esi], dl
cmp ecx, 4
jl 0x1d0c230
mov ebx, dword [ebp - 8]
inc edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
bswap ecx
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebx], eax
add ebx, 4
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], ebx
jne 0x1d0c222
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret