joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b9da0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x5b9e0b
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x5b9e45
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.005b9aa0
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x5b9dd5
mov edi, 0x5d3860
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x5b9e45
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.005b9aa0
add edi, 4
add esp, 0xc
cmp edi, 0x5d3874
jb 0x5b9e10
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x5b9e80
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.005c03a2
mov esi, eax
add esp, 8
test esi, esi
je 0x5b9f17
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x5b9f12
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.005bfd7f
add esp, 8
test eax, eax
je 0x5b9ef3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x5b9ef8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.005bfd7f
add esp, 8
test eax, eax
jne 0x5b9ed5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x5b9f12
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x5bad20
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5ce8ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x5bae12
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.005bf42f
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x5bae12
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.005b6380
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.005bf83b
push 0x10
call fcn.005bf803
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x5badd5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.005ac1c0
jmp 0x5badd7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.005ba990
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x5bae00
mov ecx, edi
call fcn.005ac2c0
push edi
call fcn.005bf7f8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x5bae31
inc ebx
cmp ebx, 0x20
jb 0x5bad4e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5bc010
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cf818
push 0x5c04fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x5bc0e9
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x5bc0e9
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005bf803
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x5bc0e9
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x5bc0e9
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x5bc0ec
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.005bc111
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bcb30
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5bcb68
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x5bcb70
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5bcba4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5bcba4
push eax
push esi
call fcn.005bf83b
add esp, 8
pop esi
ret 0x10

Function at 0x5bcbb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5bcc32
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x5bcc25
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x5d42fc
push ecx
mov dword [esp + 0x1c], 4
call fcn.005bf42f
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x5bcbea
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x5bcc40
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5bccd2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x5bccc5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x5d42fc
push ecx
mov dword [esp + 0x1c], 4
call fcn.005bf42f
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x5bccbb
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x5bcc7a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x5bce50
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x5bcf81
push esi
call fcn.005c0465
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.005af150
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x5bcf81
push 0
push ebp
call fcn.005af470
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.005af330
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x5bcedb
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005af3c0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x5bcf71
push 0x5d48f4
push edi
call fcn.005be280
push eax
push ebx
push esi
call fcn.005bcdb0
push 0x5d48d4
push edi
call fcn.005be280
push eax
push ebx
push esi
call fcn.005bcdb0
push 0x5d48b4
push edi
call fcn.005be280
push eax
push ebx
push esi
call fcn.005bcdb0
push 0x5d489c
push edi
call fcn.005be280
add esp, 0x44
push eax
push ebx
push esi
call fcn.005bcdb0
push 0x5d487c
push edi
call fcn.005be280
push eax
push ebx
push esi
call fcn.005bcdb0
push 0x5d4864
push edi
call fcn.005be280
push eax
push ebx
push esi
call fcn.005bcdb0
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5be040
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005bdfd0
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005bdfd0
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005bdfd0
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005bdfd0
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret
Function at 0x5bf230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5bf286
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5cf88c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5bf279
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5bf288
xor eax, eax
pop esi
leave
ret 4

Function at 0x5c63f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x5ef7d0
cmp edx, dword [eax]
je 0x5c6412
add eax, 8
inc ecx
cmp eax, 0x5ef860
jl 0x5c6403
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x5ef7d0]
jne 0x5c6540
mov eax, dword [0x5f4918]
cmp eax, 1
je 0x5c651a
test eax, eax
jne 0x5c6443
cmp dword [0x5ef024], 1
je 0x5c651a
cmp edx, 0xfc
je 0x5c6540
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5c647a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.005c77e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.005c66c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x5c64bd
lea eax, [ebp - 0x1a4]
push eax
call fcn.005c66c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5cfd40
push edi
call fcn.005c7660
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.005c77e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005c77f0
lea eax, [ebp - 0xa0]
push 0x5cfd20
push eax
call fcn.005c77f0
push dword [esi + 0x5ef7d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.005c77f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.005c9a03
add esp, 0x2c
pop edi
jmp 0x5c6540
lea eax, [ebp + 8]
lea esi, [esi + 0x5ef7d4]
push 0
push eax
push dword [esi]
call fcn.005c66c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10001ea0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10062400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
push edi
push 4
mov edi, edx
cmp byte [esi + 0x49c], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10001efb
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.10022fe0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x4a0]
mov dword [ebp - 0x10], 1
call fcn.10035e20
mov ecx, dword [esi + 0x4a4]
imul eax, eax, 0x3e8
mov dword [ebp - 0xc], eax
call fcn.10035e20
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x10001f65
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.10022fe0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
Function at 0x10002710
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10062400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x100028ef
cmp byte [edi + 0x366], 0
jne 0x100028e8
cmp byte [edi + 0x382], 0
jne 0x100028e8
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x80
push eax
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x100027a8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.10029470
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.10023060
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x88]
mov dword [ebp - 0x10c], 0x80
push 0
push eax
call fcn.10044470
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x88]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10002813
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.10029470
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.10023060
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x130]
lea esi, [edi + 0x102]
push eax
mov edx, esi
lea ecx, [ebp - 0x108]
call fcn.100026b0
add esp, 4
test al, al
jne 0x10002866
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.10029470
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10023060
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
movdqu xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
lea edx, [edi + 0x134]
lea ecx, [ebp - 0x88]
movdqu xmmword [edi + 0x58], xmm0
movdqu xmm0, xmmword [esi + 0x10]
movdqu xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x164]
push eax
call fcn.100026b0
add esp, 4
test al, al
jne 0x100028e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.10029470
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10023060
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.100025d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
Function at 0x10002cd0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 1
mov edi, ecx
push 6
push edx
mov esi, dword [edi]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10002d1c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, edi
call fcn.10029470
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.10022fe0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.10022fe0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002d30
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100642f0]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
push esi
mov esi, ecx
test eax, eax
jne 0x10002d86
push 3
push ecx
xor edx, edx
lea ecx, [eax + 6]
call fcn.10029c70
add esp, 8
test al, al
je 0x10002d7a
mov dword [0x100642f0], 2
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x100642f0], 1
jmp 0x10002d8b
cmp eax, 2
je 0x10002dc7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10002db0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x10002dc7
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100032c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0x1d4], 0
je 0x100032dc
call fcn.1003bad0
test eax, eax
jne 0x10003300
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 0x190]
cmp eax, 0xffffffff
je 0x100032d6
push 2
push 1
lea ecx, [ebp - 1]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x10003300
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x10004cd0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x10004e4b
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x10004e37
push esi
jmp 0x10004d10
cmp dword [edi + 4], 2
jne 0x10004dca
cmp dword [edi + 0x18], 0
je 0x10004dca
mov eax, dword [edi + 0x10]
test eax, eax
je 0x10004dca
cmp eax, 0x10
jb 0x10004dca
push 0x20
call dword [0x10063410]
mov esi, eax
add esp, 4
test esi, esi
je 0x10004e2c
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x10063410]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x10004e1b
mov ecx, dword [edi + 0x18]
movdqu xmm0, xmmword [ecx]
movdqu xmmword [eax], xmm0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x10004db8
push eax
call dword [0x10063414]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x10004e01
mov eax, dword [ebp - 4]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x10004dc7
mov dword [eax + 0x1c], esi
mov dword [ebp - 4], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x10004d10
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x10004de7
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x10004e33
mov ecx, ebx
call fcn.10004c90
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x1006341c]
push esi
call dword [0x1006341c]
add esp, 8
jmp 0x10004dd8
push esi
mov edi, 8
call dword [0x1006341c]
add esp, 4
jmp 0x10004dd8
mov edi, 8
jmp 0x10004dd8
test ebx, ebx
jne 0x10004e43
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005bf0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, ecx
push 0x401
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + 0x400], 0
test eax, eax
jne 0x10005c21
push 0x2e
push esi
call fcn.1003d070
add esp, 8
test eax, eax
je 0x10005c1f
mov byte [eax], 0
xor eax, eax
pop esi
ret