joyce8/EMBER2024-capa huggingface dataset:
Function at 0x106d9fc
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x111121c]
push esi
mov esi, ecx
cmp dword [esi + 0x34], 5
mov dword [ebp - 4], eax
push edi
jne 0x106db1c
mov eax, dword [esi + 0x444]
dec eax
je 0x106da9a
dec eax
je 0x106da6b
dec eax
jne 0x106db0e
push 4
call fcn.0106d9c5
movzx eax, word [esi + 0x38]
push eax
lea eax, [esi + 0x554]
push eax
push 0x100c4c8
lea eax, [ebp - 0x23c]
push 0x238
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov edi, eax
add esp, 0x14
inc edi
lea eax, [ebp - 0x23c]
jmp 0x106daf9
push 5
mov ecx, esi
call fcn.0106d9c5
mov byte [ebp - 0x350], 5
mov byte [ebp - 0x34f], 2
mov byte [ebp - 0x34e], 0
mov byte [ebp - 0x34d], 2
push 4
lea eax, [ebp - 0x350]
jmp 0x106daf8
push 4
mov ecx, esi
call fcn.0106d9c5
mov eax, dword [esi + 0x440]
cmp eax, 0xffffffff
jne 0x106dadf
movzx eax, word [esi + 0x38]
push eax
lea eax, [esi + 0x554]
push eax
lea ecx, [ebp - 0x34c]
call fcn.0106d8e5
lea eax, [ebp - 0x343]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 0xa
lea eax, [ebp - 0x34c]
jmp 0x106daf9
movzx ecx, word [esi + 0x38]
push ecx
push eax
lea ecx, [ebp - 0x35c]
call fcn.0106d8b4
push 9
lea eax, [ebp - 0x35c]
pop edi
push 0
push edi
push eax
push dword [esi + 0x2c]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x106db0e
cmp edi, eax
je 0x106db30
mov eax, dword [esi]
push 0x8100031a
mov ecx, esi
call dword [eax + 0x14]
jmp 0x106db30
mov ecx, esi
call fcn.0106d89b
test eax, eax
je 0x106db30
push 7
mov ecx, esi
call fcn.0106d9c5
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0105ec09
leave
ret

Function at 0x106dbb7
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xe6c]
push edi
xor edi, edi
cmp ecx, edi
lea edx, [eax + esi + 0x66c]
jne 0x106dbdd
mov ecx, 0x800
sub ecx, eax
push edi
push ecx
push edx
push dword [esi + 0x2c]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x106dbfa
cmp eax, edi
je 0x106dbfa
add dword [esi + 0xe6c], eax
xor edi, edi
inc edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x106dea9
Capabilities:
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
push esi
mov esi, ecx
mov al, byte [esi + 0x664]
cmp al, 0xff
push edi
je 0x106df94
test al, al
je 0x106df84
cmp al, 2
jne 0x106df96
push 2
call fcn.0106dbb7
lea ecx, [esi + 0xe6c]
mov eax, dword [ecx]
cmp eax, 2
jb 0x106dfa0
lea edx, [esi + 0x66c]
cmp byte [edx], 1
jne 0x106df8d
cmp byte [edx + 1], 0
jne 0x106df8d
add eax, 0xfffffffe
push eax
mov dword [ecx], eax
lea eax, [esi + 0x66e]
push eax
push edx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
push 4
mov ecx, esi
call fcn.0106d9c5
mov eax, dword [esi + 0x440]
cmp eax, 0xffffffff
je 0x106df45
movzx ecx, word [esi + 0x38]
push ecx
push eax
lea ecx, [ebp - 0x108]
call fcn.0106d971
jmp 0x106df5c
movzx eax, word [esi + 0x38]
push eax
lea eax, [esi + 0x554]
push eax
lea ecx, [ebp - 0x108]
call fcn.0106d918
lea ecx, [ebp - 0x108]
call fcn.0106d9a6
push 0
mov edi, eax
push edi
lea eax, [ebp - 0x108]
push eax
push dword [esi + 0x2c]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x106df84
cmp edi, eax
je 0x106dfa0
push 0x8100031a
mov ecx, esi
jmp 0x106df9b
push 0x8100031b
jmp 0x106df89
mov ecx, esi
push 0x8100031c
mov eax, dword [esi]
call dword [eax + 0x14]
pop edi
pop esi
leave
ret

Function at 0x106e043
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x111121c]
push esi
mov esi, dword [ebp + 8]
or dword [esi], 0xffffffff
mov dword [ebp - 4], eax
push edi
mov eax, ecx
mov eax, dword [eax + 0x2c]
xor edi, edi
inc edi
cmp eax, 0xffffffff
je 0x106e088
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x18], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
jne 0x106e088
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0105ec09
leave
ret 4

Function at 0x106e53f
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x111121c]
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push accept
mov edi, ecx
lea ecx, [edi + 0xc]
push 0x100c4b0
mov dword [ebp - 4], eax
mov eax, dword [ecx]
push esi
call dword [eax + 0x18]
mov ebx, eax
cmp ebx, esi
jl 0x106e5a8
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x106e5a8
cmp word [ebp - 0x194], 0x101
je 0x106e59f
call sub.WSOCK32.dll_WSACleanup
jmp 0x106e5a8
mov dword [edi + 0x34], 1
xor ebx, ebx
mov ecx, edi
call fcn.0106e117
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0105ec09
leave
ret
Function at 0x106e6ea
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x111121c]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x444]
neg esi
push 0
sbb esi, esi
push 1
and esi, 0x19
push 2
mov dword [ebp - 4], eax
add esi, 0x81000301
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [edi + 0x2c], eax
je 0x106e7c0
push 0x33
push 0x428
push dword [edi + 0x10]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
test eax, eax
jne 0x106e7c0
mov eax, dword [edi + 0x444]
test eax, eax
mov word [ebp - 0x14], 2
je 0x106e777
jle 0x106e7a0
cmp eax, 3
jg 0x106e7a0
xor eax, eax
mov ax, word [edi + 0x448]
push eax
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [edi + 0x44c]
mov dword [ebp - 0x10], eax
push 5
jmp 0x106e799
xor eax, eax
mov ax, word [edi + 0x38]
push eax
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [edi + 0x440]
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.0106e442
push 4
mov ecx, edi
call fcn.0106d9c5
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x2c]
call sub.WSOCK32.dll_connect
test eax, eax
je 0x106e7be
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x106e7c0
xor esi, esi
test esi, esi
jge 0x106e7d3
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x14]
test al, al
je 0x106e7d3
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.0105ec09
leave
ret

Function at 0x106eb57
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x34], 1
push edi
mov edi, 0x80004005
jne 0x106ec14
call fcn.0106e117
lea edi, [esi + 0x450]
push edi
call sub.WSOCK32.dll_inet_addr
push dword [ebp + 8]
mov dword [esi + 0x44c], eax
call sub.WSOCK32.dll_inet_addr
push 0x104
push dword [ebp + 8]
mov dword [esi + 0x440], eax
lea eax, [esi + 0x554]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [esi + 0x444], 0
mov ax, word [ebp + 0xc]
mov word [esi + 0x38], ax
je 0x106ebe8
cmp dword [esi + 0x44c], 0xffffffff
jne 0x106ebe8
push 3
mov ecx, esi
call fcn.0106d9c5
push edi
mov ecx, esi
call fcn.0106e293
mov edi, eax
test edi, edi
jge 0x106ec14
push 0x8100031d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
jmp 0x106ec14
cmp dword [esi + 0x440], 0xffffffff
mov ecx, esi
jne 0x106ec0d
push 2
call fcn.0106d9c5
push dword [ebp + 8]
mov ecx, esi
call fcn.0106e293
mov edi, eax
test edi, edi
jge 0x106ec14
push edi
jmp 0x106ebdf
call fcn.0106e6ea
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x106ec21
Capabilities:
Create tcp socket
Create udp socket
Get hostname
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x111121c]
push esi
push 0
push 1
push 2
mov dword [ebp - 4], eax
mov esi, ecx
mov dword [ebp - 0x11c], 0x81000301
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x2c], eax
je 0x106eda4
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
jne 0x106ec8d
push 0x104
lea eax, [ebp - 0x108]
push eax
call sub.WSOCK32.dll_gethostname
lea eax, [ebp - 0x108]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x106ec8b
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x106ec8d
xor ebx, ebx
push edi
xor eax, eax
lea edi, [ebp - 0x118]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x1aeb
mov word [ebp - 0x118], 2
mov word [esi + 0x38], 0x1aeb
call sub.WSOCK32.dll_htons
push 0x3b
push 0x428
push dword [esi + 0x10]
mov word [ebp - 0x116], ax
push dword [esi + 0x2c]
mov dword [ebp - 0x114], ebx
call sub.WSOCK32.dll_WSAAsyncSelect
test eax, eax
jne 0x106eda2
jmp 0x106ecfa
xor eax, eax
mov ax, word [esi + 0x38]
cmp ax, 0x1af5
ja 0x106ed0f
inc eax
push eax
mov word [esi + 0x38], ax
call sub.WSOCK32.dll_htons
mov word [ebp - 0x116], ax
push 0x10
lea eax, [ebp - 0x118]
push eax
push dword [esi + 0x2c]
call sub.WSOCK32.dll_bind
test eax, eax
jne 0x106ecdc
xor edi, edi
cmp dword [esi + 0x30], edi
je 0x106ed7f
push dword [ebp - 0x116]
call sub.WSOCK32.dll_ntohs
push ebx
mov dword [ebp - 0x124], eax
call sub.WSOCK32.dll_inet_ntoa
push eax
lea ecx, [ebp - 0x120]
call fcn.01038411
push 1
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x116]
call sub.WSOCK32.dll_ntohs
lea ecx, [esi + 0xe70]
push eax
push dword [ebp - 0x120]
call fcn.0106d7bd
push dword [ebp - 0x120]
mov dword [ebp - 0x11c], eax
mov ax, word [ebp - 0x124]
mov word [esi + 0xedc], ax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 5
push dword [esi + 0x2c]
call sub.WSOCK32.dll_listen
test eax, eax
jne 0x106ed9e
push 9
mov ecx, esi
call fcn.0106d9c5
mov dword [ebp - 0x11c], edi
jmp 0x106eda2
mov word [esi + 0x38], di
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
pop esi
call fcn.0105ec09
leave
ret 4
Function at 0x106ee40
Capabilities:
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
xor esi, esi
cmp dword [ebx + 0x2c], 0xffffffff
push edi
mov dword [ebp - 8], esi
je 0x106ef6d
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov edi, ecx
mov dword [ebx + 0x668], esi
je 0x106eecb
mov eax, dword [ebx + 0xee4]
cmp eax, esi
mov dword [ebp - 0xc], eax
jbe 0x106eecb
cmp ecx, esi
jbe 0x106eebc
push eax
add eax, ecx
lea edi, [ebx + 0xee0]
push eax
mov ecx, edi
call fcn.0106edbc
test al, al
jne 0x106eea0
xor eax, eax
jmp 0x106ef6f
mov edi, dword [edi]
mov ecx, dword [ebp + 8]
add edi, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 8]
mov eax, dword [ebx + 0xee0]
mov edi, dword [ebx + 0xee4]
mov dword [ebp - 4], eax
test edi, edi
jbe 0x106ef06
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 4]
add eax, esi
push eax
push dword [ebx + 0x2c]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x106eefb
and dword [ebx + 0x668], 0
add esi, eax
cmp esi, edi
mov dword [ebp - 8], esi
jb 0x106eecf
jmp 0x106ef06
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebx + 0x668], eax
cmp esi, edi
jne 0x106ef1b
push 0xffffffffffffffff
push 0
lea ecx, [ebx + 0xee0]
call fcn.0106edbc
jmp 0x106ef6d
cmp byte [ebp + 0x10], 0
je 0x106ef6d
xor eax, eax
cmp dword [ebx + 0xee4], eax
jbe 0x106ef3e
cmp esi, eax
jbe 0x106ef6d
push esi
push eax
lea ecx, [ebx + 0xee0]
call fcn.0106e8a8
jmp 0x106ef6d
push eax
sub edi, esi
add ebx, 0xee0
push edi
mov ecx, ebx
call fcn.0106edbc
test al, al
je 0x106ef6d
mov eax, dword [ebp - 4]
mov ecx, edi
mov edi, dword [ebx]
add esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x106f543
Capabilities:
Create tcp socket
Create udp socket
Send data
Send data on socket
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x111121c]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x3c]
push eax
mov esi, ecx
mov dword [ebp - 0x28], 1
call fcn.0106f51e
push dword [ebp + 0xc]
mov byte [ebp - 0x3b], 4
call sub.WSOCK32.dll_htonl
push 0
push 2
push 2
mov dword [ebp + 0xc], eax
call sub.WSOCK32.dll_socket
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
je 0x106f603
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push 0xffff
push edi
call sub.WSOCK32.dll_setsockopt
cmp eax, ebx
je 0x106f603
mov eax, dword [esi + 0x160]
push dword [ebp + 8]
mov word [ebp - 0x14], 2
mov dword [ebp - 0x10], eax
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call sub.WSOCK32.dll_bind
cmp eax, ebx
jne 0x106f5d4
call sub.WSOCK32.dll_WSAGetLastError
jmp 0x106f603
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov ax, word [esi + 0x14c]
push 0x10
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push eax
push 0
push 0x14
lea eax, [ebp - 0x3c]
push eax
push edi
mov word [ebp - 0x24], 2
call sub.WSOCK32.dll_sendto
cmp eax, ebx
jne 0x106f607
mov eax, ebx
jmp 0x106f60f
push edi
call sub.WSOCK32.dll_closesocket
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0105ec09
leave
ret 8

Function at 0x106faee
Capabilities:
Get local ipv4 addresses
Get socket information
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xd4]
push eax
call fcn.0106f51e
or ebx, 0xffffffff
xor edi, edi
cmp dword [esi + 0x110], ebx
jne 0x106fb4b
push edi
push 2
push 2
call sub.WSOCK32.dll_socket
cmp eax, ebx
mov dword [esi + 0x110], eax
je 0x106fb8e
lea ecx, [esi + 0x11c]
push 0x10
push ecx
push eax
mov word [ecx], 2
mov word [esi + 0x11e], di
mov dword [esi + 0x120], edi
call sub.WSOCK32.dll_bind
cmp eax, ebx
je 0x106fb8e
push 0x10
lea eax, [esi + 0x12c]
push eax
push edi
push 0x14
lea eax, [esi + 0xd4]
push eax
push dword [esi + 0x110]
call sub.WSOCK32.dll_sendto
cmp eax, ebx
je 0x106fb8e
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x11c]
push eax
push dword [esi + 0x110]
mov dword [ebp - 4], 0x10
call sub.WSOCK32.dll_getsockname
cmp eax, ebx
jne 0x106fbaf
call sub.WSOCK32.dll_WSAGetLastError
test eax, eax
jg 0x106fb9e
call sub.WSOCK32.dll_WSAGetLastError
jmp 0x106fbd3
call sub.WSOCK32.dll_WSAGetLastError
and eax, 0xffff
or eax, 0x80070000
jmp 0x106fbd3
xor edx, edx
lea ecx, [esi + 0x120]
inc edx
cmp dword [ecx], edi
jne 0x106fbce
mov eax, dword [esi + 0x15c]
mov ebx, dword [eax]
mov dword [ecx], ebx
cmp dword [eax + 4], edi
je 0x106fbce
mov dword [esi + 0x38], edx
mov dword [esi + 0x28], edx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x106fbdd
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x111121c]
push esi
mov esi, ecx
push dword [esi + 0x110]
mov dword [ebp - 4], eax
call fcn.0106f225
test eax, eax
jne 0x106fc40
mov eax, dword [esi + 0x2c]
cmp eax, 4
lea ecx, [eax + 1]
mov dword [esi + 0x2c], ecx
jb 0x106fc28
mov dword [esi + 0x30], 1
mov dword [esi + 0x180], 6
mov eax, 0x800705b4
jmp 0x106fd87
cmp ecx, 2
jne 0x106fc39
mov ecx, esi
call fcn.0106faee
jmp 0x106fd87
xor eax, eax
jmp 0x106fd87
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
xor edi, edi
push edi
push 0x14
lea eax, [esi + 0xd4]
push eax
push dword [esi + 0x110]
mov dword [ebp - 0x18], 0x10
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
jne 0x106fc73
or eax, eax
jmp 0x106fd86
cmp dword [esi + 0x38], edi
push ebx
mov dword [esi + 0x28], 2
je 0x106fd3e
mov ecx, dword [esi + 0x15c]
cmp dword [ecx], edi
je 0x106fcad
mov edx, dword [esi + 0xd8]
xor eax, eax
cmp dword [eax + ecx], edx
je 0x106fd50
mov ebx, dword [esi + 0x15c]
add eax, 4
cmp dword [eax + ebx], edi
jne 0x106fc96
mov eax, dword [esi + 0xd8]
mov bx, word [esi + 0xdc]
mov cx, word [esi + 0xde]
mov dword [esi + 0x158], eax
mov ax, word [esi + 0xd6]
mov word [esi + 0x156], ax
mov eax, dword [esi + 0xe0]
xor edi, edi
push 3
mov dword [esi + 0x150], eax
mov dword [esi + 0x140], eax
inc edi
mov word [esi + 0x14c], bx
mov bx, word [esi + 0x11e]
xor eax, eax
cmp dword [esi + 0x16c], eax
pop edx
mov dword [esi + 0x180], edx
mov dword [esi + 0x30], edi
mov word [esi + 0x14e], cx
mov word [esi + 0x154], bx
mov word [esi + 0x13c], 2
mov word [esi + 0x13e], cx
je 0x106fd69
mov dword [esi + 0x180], edx
mov dword [0x1113c3c], eax
mov eax, 0x80004005
jmp 0x106fd85
mov eax, dword [esi + 0x120]
cmp eax, dword [esi + 0xd8]
jne 0x106fcad
mov dword [esi + 0x30], edi
mov dword [esi + 0x17c], 6
mov dword [esi + 0x180], 1
jmp 0x106fd83
cmp dword [esi + 0x168], eax
je 0x106fd83
push 4
pop eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x180], eax
mov dword [0x1113c3c], edi
xor eax, eax
pop ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.0105ec09
leave
ret
Function at 0x106fd97
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x111121c]
push ebx
push esi
mov esi, ecx
push dword [esi + 0x110]
mov dword [ebp - 4], eax
xor ebx, ebx
call fcn.0106f225
test eax, eax
jne 0x106fde8
mov eax, dword [esi + 0x2c]
cmp eax, 4
lea ecx, [eax + 1]
mov dword [esi + 0x2c], ecx
jb 0x106fdd6
mov dword [esi + 0x28], 5
jmp 0x106fe7b
cmp ecx, 2
jne 0x106fe7b
mov ecx, esi
call fcn.0106f27d
jmp 0x106fe20
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x14
lea eax, [esi + 0xd4]
push eax
push dword [esi + 0x110]
mov dword [ebp - 0x18], 0x10
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
jne 0x106fe39
call sub.WSOCK32.dll_WSAGetLastError
test eax, eax
jg 0x106fe24
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
jmp 0x106fe7b
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
jmp 0x106fe7b
mov ecx, esi
call fcn.0106f655
mov ebx, eax
test ebx, ebx
jge 0x106fe52
mov dword [esi + 0x180], 2
jmp 0x106fe7b
push edi
push 4
pop edi
mov dword [esi + 0x180], edi
mov dword [0x1113c3c], 1
mov eax, dword [esi + 0x110]
cmp eax, 0xffffffff
je 0x106fe77
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 0x28], edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
pop ebx
call fcn.0105ec09
leave
ret

Function at 0x106ff0a
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x111121c]
push ebx
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
push dword [esi + 0x110]
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
call fcn.0106f225
test eax, eax
jne 0x106ff6e
mov eax, dword [esi + 0x2c]
cmp eax, 4
lea ecx, [eax + 1]
mov dword [esi + 0x2c], ecx
jb 0x106ff5c
mov dword [esi + 0x180], 5
mov ebx, 0x800705b4
jmp 0x107003e
cmp ecx, 2
jne 0x107003e
mov ecx, esi
call fcn.0106fe8e
jmp 0x106ffa3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x14
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 0x110]
mov dword [ebp - 0x18], 0x10
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
jne 0x106ffbf
call sub.WSOCK32.dll_WSAGetLastError
test eax, eax
jg 0x106ffaa
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
jmp 0x107003e
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
jmp 0x107003e
mov eax, dword [ebp - 0x28]
cmp eax, dword [esi + 0x158]
jne 0x107000d
mov ax, word [ebp - 0x2a]
cmp ax, word [esi + 0x156]
jne 0x107000d
mov ecx, esi
call fcn.0106f655
mov ebx, eax
test ebx, ebx
jge 0x106fff0
mov dword [esi + 0x180], 2
jmp 0x107003e
mov dword [esi + 0x28], 7
mov dword [esi + 0x180], 4
mov dword [0x1113c3c], 1
jmp 0x1070026
mov dword [esi + 0x17c], 7
mov dword [esi + 0x180], 5
mov ebx, 0x800705b4
mov eax, dword [esi + 0x110]
cmp eax, 0xffffffff
je 0x107003e
push eax
call sub.WSOCK32.dll_closesocket
or dword [esi + 0x110], 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0105ec09
leave
ret
Function at 0x10700e2
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
lea esi, [ebx + 0xd4]
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebx + 0x114]
call fcn.0106f225
test eax, eax
je 0x107014e
push 0
push 0x14
push esi
push dword [ebx + 0x114]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x1070172
push dword [ebx + 0xd8]
mov dword [ebp - 4], 1
call sub.WSOCK32.dll_ntohl
mov dword [ebx + 0x4c], eax
xor eax, eax
mov ax, word [ebx + 0xd6]
push eax
call sub.WSOCK32.dll_ntohs
mov word [ebx + 0x50], ax
lea edi, [ebx + 0x118]
push dword [edi]
mov ecx, ebx
call fcn.0106f225
test eax, eax
je 0x10701a2
push 0
push 0x14
push esi
push dword [edi]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x107017a
or eax, 0xffffffff
jmp 0x1070221
push dword [ebx + 0xd8]
mov dword [ebp - 4], 1
call sub.WSOCK32.dll_ntohl
mov dword [ebx + 0x70], eax
xor eax, eax
mov ax, word [ebx + 0xd6]
push eax
call sub.WSOCK32.dll_ntohs
mov word [ebx + 0x74], ax
cmp dword [ebp - 4], 0
jne 0x10701ca
inc dword [ebx + 0x2c]
mov eax, dword [ebx + 0x2c]
cmp eax, 2
jne 0x10701bc
mov ecx, ebx
call fcn.01070052
jmp 0x1070221
push 4
pop ecx
cmp ecx, eax
sbb eax, eax
and eax, 0x80004005
jmp 0x1070221
mov ax, word [ebx + 0x50]
test ax, ax
je 0x107021f
mov cx, word [ebx + 0x74]
test cx, cx
je 0x107021f
movzx eax, ax
push 2
cdq
pop esi
idiv esi
test edx, edx
je 0x1070218
movzx eax, cx
push esi
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x1070218
push 9
pop ecx
lea eax, [ebx + 0x3c]
push 9
mov esi, eax
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebx + 0x60]
pop ecx
mov esi, edx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 9
pop ecx
lea esi, [ebp - 0x28]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x28], 0xb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret