joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015d60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, 0xffffffff
je 0x10015e95
mov eax, dword [ebp + 0xc]
test byte [eax], 8
je 0x10015dac
xor ecx, ecx
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x14]
call fcn.10001ae0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push 0xffff
lea edi, [ebp - 0x14]
mov ebx, 0x80
mov ecx, esi
call fcn.10016950
add esp, 0xc
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test byte [0x1006dc8c], 1
mov ebx, eax
jne 0x10015de4
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [ebp + 0x10]
mov ecx, 0x1006dd38
mov dword [edi], eax
mov dword [edi + 4], ecx
test ebx, ebx
je 0x10015e98
test byte [0x1006dc8c], 1
jne 0x10015e26
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
cmp dword [edi + 4], 0x1006dd38
jne 0x10015e37
cmp dword [edi], 0x2733
je 0x10015e56
push 0x4d5
lea esi, [ebp - 0xc]
call fcn.1001d4a0
mov ecx, dword [edi + 4]
cmp ecx, dword [ebp - 8]
jne 0x10015e8f
mov edx, dword [edi]
cmp edx, dword [ebp - 0xc]
jne 0x10015e8f
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0x8004667e
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
and byte [eax], 0xfc
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
mov esi, edi
call fcn.1001d4e0
add esp, 4
mov ebx, eax
test ebx, ebx
jne 0x10015ecb
jmp 0x10015e98
mov edi, dword [ebp + 0x10]
xor esi, esi
test byte [0x1006dc8c], 1
jne 0x10015ec1
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [edi], esi
mov dword [edi + 4], eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015ee0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x10015f29
test byte [0x1006dc8c], 1
jne 0x10015f13
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x2719
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [ebp - 4]
push eax
push 0x8004667e
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test byte [0x1006dc8c], 1
mov edi, eax
jne 0x10015f71
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
test edi, edi
js 0x10015f22
xor edi, edi
test byte [0x1006dc8c], 1
jne 0x10015fae
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [esi], edi
mov dword [esi + 4], eax
or byte [ebx], 2
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10015fd0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x10016019
test byte [0x1006dc8c], 1
jne 0x10016003
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x2719
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
or eax, 0xffffffff
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_connect]
test byte [0x1006dc8c], 1
mov edi, eax
jne 0x10016059
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
test edi, edi
jne 0x100160a0
xor ebx, ebx
test byte [0x1006dc8c], 1
jne 0x10016096
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [esi], ebx
mov dword [esi + 4], eax
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x100160b0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x10069700]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov eax, 1
mov dword [esp + 0x120], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov edi, ecx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x128]
xor esi, esi
push edx
push esi
lea eax, [ebx + 1]
push eax
mov dword [esp + 0x138], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x1001612a
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.100282cc
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], esi
push 0x1007
lea esi, [esp + 0x14]
mov eax, ebx
mov dword [esp + 0x14], 4
call fcn.10016a30
add esp, 8
test eax, eax
jne 0x100161ba
cmp dword [esp + 8], eax
je 0x10016187
test byte [0x1006dc8c], 1
jne 0x1001617f
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov edx, dword [esp + 8]
mov dword [edi], edx
jmp 0x100161b2
xor esi, esi
test byte [0x1006dc8c], 1
jne 0x100161b0
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov dword [edi], esi
mov eax, 0x1006dd38
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.100282cc
mov esp, ebp
pop ebp
ret

Function at 0x100162b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edx, dword [ebp + 0x10]
push edi
push edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.WS2_32.dll_WSARecv]
test byte [0x1006dc8c], 1
mov edi, eax
mov ebx, vtable.system_error_category.0
jne 0x1001630d
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], ebx
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp eax, 0x40
jne 0x1001634c
test byte [0x1006dc8c], 1
jne 0x10016345
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], ebx
call fcn.10028d66
add esp, 4
mov eax, 0x2746
jmp 0x1001637b
cmp eax, 0x4d2
jne 0x10016385
test byte [0x1006dc8c], 1
jne 0x10016376
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], ebx
call fcn.10028d66
add esp, 4
mov eax, 0x274d
mov ecx, 0x1006dd38
mov dword [esi + 4], ecx
mov dword [esi], eax
test edi, edi
je 0x10016392
or eax, 0xffffffff
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
test byte [0x1006dc8c], 1
jne 0x100163b7
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], ebx
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016620
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_WSASend]
test byte [0x1006dc8c], 1
mov edi, eax
mov ebx, vtable.system_error_category.0
jne 0x1001667b
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], ebx
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp eax, 0x40
jne 0x100166ba
test byte [0x1006dc8c], 1
jne 0x100166b3
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], ebx
call fcn.10028d66
add esp, 4
mov eax, 0x2746
jmp 0x100166e9
cmp eax, 0x4d2
jne 0x100166f3
test byte [0x1006dc8c], 1
jne 0x100166e4
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], ebx
call fcn.10028d66
add esp, 4
mov eax, 0x274d
mov ecx, 0x1006dd38
mov dword [esi + 4], ecx
mov dword [esi], eax
test edi, edi
je 0x10016700
or eax, 0xffffffff
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
test byte [0x1006dc8c], 1
jne 0x10016725
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], ebx
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016880
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 1
push 0
push 0
push eax
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
test byte [0x1006dc8c], 1
mov esi, eax
jne 0x100168d0
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [edi], eax
mov dword [edi + 4], ecx
cmp esi, 0xffffffff
jne 0x100168ed
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x17
jne 0x1001690a
push 4
lea edx, [ebp - 4]
push edx
push 0x1b
push 0x29
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_setsockopt]
xor ebx, ebx
test byte [0x1006dc8c], 1
jne 0x10016933
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [edi + 4], eax
mov eax, esi
pop esi
mov dword [edi], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016950
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
cmp esi, 0xffffffff
jne 0x1001699f
mov eax, 1
test byte [0x1006dc8c], al
jne 0x10016988
or dword [0x1006dc8c], eax
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x2719
mov ecx, 0x1006dd38
mov dword [edi], eax
mov dword [edi + 4], ecx
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0xffff
jne 0x100169b3
cmp ebx, 0x80
jne 0x100169b3
or byte [eax], 8
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push ebx
push edx
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
mov eax, 1
test byte [0x1006dc8c], al
jne 0x100169fb
or dword [0x1006dc8c], eax
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [edi], eax
mov dword [edi + 4], ecx
test esi, esi
jne 0x10016a21
lea ecx, [ebp - 0xc]
call fcn.10001ae0
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10016c50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, eax
cmp ebx, 0xffffffff
jne 0x10016c9e
test byte [0x1006dc8c], 1
jne 0x10016c86
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x2719
mov ecx, 0x1006dd38
mov dword [edi], eax
mov dword [edi + 4], ecx
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edx, dword [ebp + 8]
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push edx
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test byte [0x1006dc8c], 1
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [esi], eax
jne 0x10016ce8
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [edi], eax
mov dword [edi + 4], ecx
test ebx, ebx
jne 0x10016d2f
xor esi, esi
test byte [0x1006dc8c], 1
jne 0x10016d25
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [edi], esi
mov dword [edi + 4], eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016d40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x10016d8c
test byte [0x1006dc8c], 1
jne 0x10016d75
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x2719
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test byte [0x1006dc8c], 1
mov edi, eax
mov dword [ebp - 4], edi
jne 0x10016dcd
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
test edi, edi
js 0x10016e29
xor edi, edi
test byte [0x1006dc8c], 1
jne 0x10016e0a
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], edi
cmp dword [ebx], edi
je 0x10016e26
or byte [eax], 1
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
and byte [eax], 0xfc
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10016e40
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
mov esi, eax
mov ebx, ecx
mov edi, edx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
test edi, edi
jne 0x10016eb0
cmp dword [ebp + 0xc], edi
jne 0x10016eb0
test ebx, ebx
jne 0x10016eb0
test esi, esi
je 0x10016ece
mov ecx, dword [esi]
mov eax, 0x10624dd3
imul ecx, ecx, 0x3e8
imul dword [esi + 4]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
jne 0x10016e8b
mov eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xc]
call fcn.10001ae0
mov edx, dword [eax]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10016ece
cmp dword [esi], 0
jne 0x10016ece
mov eax, dword [esi + 4]
test eax, eax
jle 0x10016ece
cmp eax, 0x3e8
jge 0x10016ece
mov dword [esi + 4], 0x3e8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push ebx
push ecx
push edi
push edx
call dword [sym.imp.WS2_32.dll_select]
test byte [0x1006dc8c], 1
mov esi, eax
jne 0x10016f08
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, dword [ebp + 0x10]
mov ecx, 0x1006dd38
mov dword [ebx], eax
mov dword [ebx + 4], ecx
test esi, esi
js 0x10016f52
xor edi, edi
test byte [0x1006dc8c], 1
jne 0x10016f48
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [ebx], edi
mov dword [ebx + 4], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016f60
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10069700]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp edi, 0xffffffff
jne 0x10016fc3
test byte [0x1006dc8c], 1
jne 0x10016fa2
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x2719
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100282cc
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
test byte [0x1006dc8c], 1
mov edi, eax
mov dword [ebp - 0x114], edi
jne 0x10017033
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
test edi, edi
je 0x10017049
jle 0x10017082
xor edi, edi
test byte [0x1006dc8c], 1
jne 0x10017072
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [esi], edi
mov edi, dword [ebp - 0x114]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.100282cc
mov esp, ebp
pop ebp
ret

Function at 0x100170a0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10069700]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp edi, 0xffffffff
jne 0x10017103
test byte [0x1006dc8c], 1
jne 0x100170e2
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x2719
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100282cc
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
test byte [0x1006dc8c], 1
mov edi, eax
mov dword [ebp - 0x114], edi
jne 0x10017173
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x1006dd38
mov dword [esi], eax
mov dword [esi + 4], ecx
test edi, edi
je 0x10017189
jle 0x100171c2
xor edi, edi
test byte [0x1006dc8c], 1
jne 0x100171b2
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
mov eax, 0x1006dd38
mov dword [esi], edi
mov edi, dword [ebp - 0x114]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.100282cc
mov esp, ebp
pop ebp
ret
Function at 0x10017dd0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005775c
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10069700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [edi], vtable.boost::asio::detail::select_reactor.0
mov ecx, edi
mov dword [ebp - 4], 4
call fcn.10017e70
push 0x100159d0
push 3
push 0xc
lea eax, [edi + 0xc8]
push eax
mov byte [ebp - 4], 3
call fcn.100299d1
push 0x10017d60
push 4
push 0x24
lea ecx, [edi + 0x38]
push ecx
mov byte [ebp - 4], 2
call fcn.100299d1
lea esi, [edi + 0x30]
call fcn.100179f0
lea edx, [edi + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [edi], vtable.boost::asio::io_service::service.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10018990
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
mov eax, dword [ebx + 4]
push edi
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x14], 0
je 0x100189bc
mov eax, dword [ebx + 4]
push 0
push 0
call fcn.10015780
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
cmp eax, 0xffffffff
jne 0x100189db
mov eax, dword [ebx + 4]
push 0
push 0x2719
call fcn.10015780
pop edi
pop esi
pop ebp
ret 0x10
xor ecx, ecx
push ecx
push esi
mov dword [ebp + 0x14], ecx
mov dword [ebp + 8], ecx
lea edx, [ebp + 8]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x10018a10
mov eax, 0x2746
jmp 0x10018a1c
cmp eax, 0x4d2
jne 0x10018a1c
mov eax, 0x274d
test edi, edi
je 0x10018a3a
cmp eax, 0x3e5
je 0x10018a3a
mov edx, dword [ebp + 0x14]
push edx
push eax
mov eax, dword [ebx + 4]
call fcn.10015780
pop edi
pop esi
pop ebp
ret 0x10
mov eax, dword [ebx + 4]
mov edi, esi
call fcn.10015710
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x100199d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10058048
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x10069700]
xor eax, esp
mov dword [esp + 0x6c], eax
push esi
push edi
mov eax, dword [0x10069700]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
lea eax, [ebx + 0x108]
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.1001d630
add esp, 8
xor esi, esi
push str.smtphm.qiye.163.com
mov dword [esp + 0x8c], esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, eax
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0xf
mov byte [esp + 0x40], 0
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10019a55
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.100076c0
mov byte [esp + 0x88], 1
cmp dword [esp + 0x54], 0x10
mov esi, dword [esp + 0x40]
jae 0x10019a80
lea esi, [esp + 0x40]
test byte [0x1006dc8c], 1
mov dword [esp + 0x14], 0
jne 0x10019aaf
or dword [0x1006dc8c], 1
push 0x10058930
mov dword [0x1006dd38], 0x1005d8e0
call fcn.10028d66
add esp, 4
lea ecx, [esp + 0x24]
push esi
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0x1006dd38
call fcn.100192f0
add esp, 8
cmp dword [esp + 0x14], 0
je 0x10019ada
lea edx, [esp + 0x14]
push edx
call fcn.10002960
lea edi, [esp + 0x24]
lea esi, [esp + 0x5c]
call fcn.100193c0
sub esp, 8
mov eax, esp
mov dword [esp + 0x1c], esp
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
push eax
lea eax, [esp + 0x18]
call fcn.1001dd30
mov eax, dword [0x1006ca34]
movzx ecx, byte [eax]
push ecx
push ebx
lea edx, [esp + 0x24]
push 0x10019c40
push edx
call fcn.1001d6d0
add esp, 0x18
push eax
mov eax, esi
mov byte [esp + 0x8c], 2
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.1001d7e0
mov byte [esp + 0x88], 1
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x10019b6e
mov esi, eax
add eax, 4
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x10019b6e
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10019b6e
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
cmp dword [esp + 0x54], 0x10
jb 0x10019b82
mov ecx, dword [esp + 0x40]
push ecx
call fcn.10028db2
add esp, 4
mov dword [esp + 0x88], 0xffffffff
mov esi, dword [esp + 0x10]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], edi
mov byte [esp + 0x40], 0
cmp esi, edi
je 0x10019bcf
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x10019bcf
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10019bcf
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
mov al, 1
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.100282cc
mov esp, ebp
pop ebp
ret