joyce8/EMBER2024-capa huggingface dataset:
Function at 0x530bf7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x530c34
cmp dword [ebp + 0x14], edi
je 0x530c34
cmp ecx, edi
jne 0x530c3b
call fcn.005368bb
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00537a2f
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x530c4f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x530c70
cmp ebx, 0xffffffff
je 0x530c5f
push ebx
push edi
push ecx
call fcn.005306b0
add esp, 0xc
cmp esi, edi
je 0x530c1c
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x530c1c
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x530c8c
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x530c93
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x530d84
test word [esi + 0xc], 0x10c
je 0x530ce7
mov eax, dword [esi + 4]
test eax, eax
je 0x530ce7
jl 0x530de5
cmp ebx, eax
mov edi, ebx
jb 0x530cb8
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x530d8c
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0053938d
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x530d7c
cmp ebx, dword [ebp - 0xc]
jb 0x530d54
cmp dword [ebp - 0xc], 0
je 0x530d11
mov ecx, closesocket
xor edx, edx
cmp ebx, ecx
jbe 0x530d06
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x530d0d
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x530d1c
mov eax, closesocket
cmp ebx, eax
ja 0x530d1c
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x530db8
push eax
push dword [ebp - 8]
push esi
call fcn.00539360
pop ecx
push eax
call fcn.00539263
add esp, 0xc
test eax, eax
je 0x530df7
cmp eax, 0xffffffff
je 0x530de5
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x530d7c
push esi
call fcn.00538b82
cmp eax, 0xffffffff
pop ecx
je 0x530de9
cmp dword [ebp - 4], 0
je 0x530db8
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x530c9b
mov eax, dword [ebp + 0x14]
jmp 0x530c36
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x530da3
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.005306b0
add esp, 0xc
call fcn.005368bb
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x530c2c
cmp dword [ebp + 0xc], 0xffffffff
je 0x530dce
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.005306b0
add esp, 0xc
call fcn.005368bb
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x530c2c
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x530c36
or dword [esi + 0xc], 0x10
jmp 0x530de9
Function at 0x5317e7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5f2e68]
jne 0x5317f1
repz ret
jmp fcn.0053b250

Function at 0x53a8ef
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5f2d00]
je 0x53a90a
inc edi
cmp edi, 0x17
jb 0x53a8fb
cmp edi, 0x17
jae 0x53aa8a
push ebp
push 3
call fcn.00543b73
cmp eax, 1
pop ecx
je 0x53aa56
push 3
call fcn.00543b73
test eax, eax
pop ecx
jne 0x53a93e
cmp dword [0x5f22f0], 1
je 0x53aa56
cmp ebx, 0xfc
je 0x53aa89
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x602fa8
push ebp
call fcn.005418e9
add esp, 0xc
test eax, eax
je 0x53a974
push esi
push esi
push esi
push esi
push esi
call fcn.00537933
add esp, 0x14
push 0x104
mov esi, 0x602fc1
push esi
push 0
mov byte [0x6030c5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x53a9b8
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.005418e9
add esp, 0xc
test eax, eax
je 0x53a9b8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00537933
add esp, 0x14
push esi
call fcn.00530f70
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x53a9fd
push esi
call fcn.00530f70
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6032bc
push 0x58efe0
sub ecx, eax
push ecx
push eax
call fcn.00541836
add esp, 0x14
test eax, eax
je 0x53a9fd
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00537933
add esp, 0x14
jmp 0x53a9ff
xor esi, esi
push 0x56adb4
push ebx
push ebp
call fcn.00541773
add esp, 0xc
test eax, eax
je 0x53aa1f
push esi
push esi
push esi
push esi
push esi
call fcn.00537933
add esp, 0x14
push dword [edi*8 + 0x5f2d04]
push ebx
push ebp
call fcn.00541773
add esp, 0xc
test eax, eax
je 0x53aa41
push esi
push esi
push esi
push esi
push esi
call fcn.00537933
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.005439b6
add esp, 0xc
jmp 0x53aa89
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x53aa89
cmp ebp, 0xffffffff
je 0x53aa89
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5f2d04]
push dword [esi]
call fcn.00530f70
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x53cf90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x53cfbd
call fcn.005368ce
mov dword [eax], esi
call fcn.005368bb
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00537a2f
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x53cf99
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x53cfec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005368e1
pop ecx
call fcn.005368bb
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x53d013
test al, 1
je 0x53d013
test byte [esp + 0xc], 2
je 0x53d013
call fcn.005368ce
mov dword [eax], 5
call fcn.005368bb
mov dword [eax], 0xd
jmp 0x53cfe3
xor eax, eax
pop esi
ret
Function at 0x5439b6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.005384f0
xor ebx, ebx
cmp dword [0x603734], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x543a8c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x543b6c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x54f1d8
push edi
call esi
cmp eax, ebx
je 0x543b6c
push eax
call fcn.00538482
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x603734], eax
call esi
push eax
call fcn.00538482
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x603738], eax
call esi
push eax
call fcn.00538482
mov dword [0x60373c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00531522
test eax, eax
pop ecx
pop ecx
je 0x543a5a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00537933
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x543a8c
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00538482
cmp eax, ebx
pop ecx
mov dword [0x603744], eax
je 0x543a8c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00538482
pop ecx
mov dword [0x603740], eax
mov eax, dword [0x603740]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x543b11
cmp dword [0x603744], ecx
je 0x543b11
push eax
call fcn.005384f9
push dword [0x603744]
mov esi, eax
call fcn.005384f9
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x543b11
cmp edi, ebx
je 0x543b11
call esi
cmp eax, ebx
je 0x543ade
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x543ade
test byte [ebp - 0x18], 1
jne 0x543b11
lea eax, [ebp - 0x10]
push eax
call fcn.00531595
test eax, eax
pop ecx
je 0x543af9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00537933
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x543b08
or dword [ebp + 0x10], 0x200000
jmp 0x543b4c
or dword [ebp + 0x10], 0x40000
jmp 0x543b4c
mov eax, dword [0x603738]
cmp eax, dword [ebp - 8]
je 0x543b4c
push eax
call fcn.005384f9
cmp eax, ebx
pop ecx
je 0x543b4c
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x543b4c
mov eax, dword [0x60373c]
cmp eax, dword [ebp - 8]
je 0x543b4c
push eax
call fcn.005384f9
cmp eax, ebx
pop ecx
je 0x543b4c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x603734]
call fcn.005384f9
cmp eax, ebx
pop ecx
je 0x543b6c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x543b6e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009c30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x1003c2e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x19c], ecx
mov ecx, dword [ebp - 0x19c]
call fcn.10009bf0
mov eax, dword [ebp - 0x19c]
mov dword [eax], vtable.CTcpSocket.0
mov ecx, dword [ebp - 0x19c]
add ecx, 0x2c
call fcn.10001030
mov ecx, dword [ebp - 0x19c]
add ecx, 0x3c
call fcn.10001030
mov ecx, dword [ebp - 0x19c]
add ecx, 0x4c
call fcn.10001030
push str.CTcpSocket::CTcpSocket
push 0x10037cc0
call fcn.10009c20
add esp, 8
lea ecx, [ebp - 0x198]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 0x19c]
mov dword [edx + 4], eax
push 0
mov eax, dword [ebp - 0x19c]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [ebp - 0x19c]
mov dword [ecx + 0x64], 0xffffffff
mov edx, dword [ebp - 0x19c]
mov dword [edx + 0x5c], 0
mov eax, dword [ebp - 0x19c]
mov dword [eax + 0x60], 0
mov ecx, dword [ebp - 0x19c]
mov dword [ecx + 0x14], 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000fb07
mov esp, ebp
pop ebp
ret

Function at 0x10009dd0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push str.CTcpSocket::Disconnect
push 0x10037cdc
call fcn.10009c20
add esp, 8
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x10009df6
jmp 0x10009e62
mov ecx, 1
mov word [ebp - 4], cx
xor edx, edx
mov word [ebp - 2], dx
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x64]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0
mov edx, dword [ebp - 8]
add edx, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x64]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x64], 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x1000a4a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xf
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
jmp 0x1000a4dc
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x10]
jl 0x1000a54d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 0
jmp 0x1000a4fd
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x10]
jge 0x1000a529
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x64]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x1000a527
jmp 0x1000a529
jmp 0x1000a4f4
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x10]
jne 0x1000a539
or eax, 0xffffffff
jmp 0x1000a5b9
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
jmp 0x1000a4d3
cmp dword [ebp - 0x14], 0
jle 0x1000a5a7
mov dword [ebp - 0x1c], 0
jmp 0x1000a565
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x10]
jge 0x1000a591
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x64]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x1000a58f
jmp 0x1000a591
jmp 0x1000a55c
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x10]
jne 0x1000a59e
or eax, 0xffffffff
jmp 0x1000a5b9
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jne 0x1000a5b6
mov eax, dword [ebp - 4]
jmp 0x1000a5b9
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000a8f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003c2e0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a922
mov eax, 0x190
call fcn.10028bb0
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
movzx eax, byte [ebp + 0x10]
and eax, 0xff
movzx ecx, al
movzx edx, byte [ebp + 0xc]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 0x10]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000fb07
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000ac50
Capabilities:
Create thread
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 0x598
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x198], 0
jne 0x1000ac7a
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x28]
mov dword [ecx + 0x1b8], edx
jmp 0x1000aca1
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x198]
cmp ecx, dword [ebp - 0x28]
jbe 0x1000ac8f
xor eax, eax
jmp 0x1000ae09
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x198]
mov dword [edx + 0x1b8], ecx
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x64], 0
mov ecx, dword [ebp - 0x30]
call fcn.1000ae10
push 1
push 0
push 5
push 1
mov ecx, dword [ebp - 0x30]
add ecx, 0x30
call fcn.1000aa10
mov dword [ebp - 0x24], 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.1000a9e0
push 0x10040b80
call fcn.100016b0
add esp, 4
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x48], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x48], 0
jne 0x1000ad08
push 0x10040b80
call fcn.100016b0
add esp, 4
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x48], eax
mov dword [ebp - 0x20], 0x40000
push 4
lea edx, [ebp - 0x20]
push edx
push 0x1001
push 0xffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x20], 0x40000
push 4
lea edx, [ebp - 0x20]
push edx
push 0x1002
push 0xffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
movzx edx, word [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.1000aef0
test eax, eax
je 0x1000adbc
mov ecx, dword [ebp - 0x30]
add ecx, 0x58
push ecx
push 0
mov edx, dword [ebp - 0x30]
push edx
push 0x1000b0d0
push 0
push 0
call fcn.10010aaf
add esp, 0x18
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x54], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x54], 0
je 0x1000ada6
mov dword [ebp - 0x24], 1
mov ecx, dword [ebp - 0x30]
add ecx, 0x2c
call fcn.1000ab60
jmp 0x1000adba
push 0x65f
push 0x100378a4
push 8
mov ecx, dword [ebp - 0x30]
call fcn.1000bd60
jmp 0x1000add2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CUdpSocket::Start
push 0xb
mov ecx, dword [ebp - 0x30]
call fcn.1000bd60
cmp dword [ebp - 0x24], 0
jne 0x1000ae06
push 1
push 0
push 5
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 0x30
call fcn.1000aa10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
call fcn.1000ba50
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000b380
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1000b3c1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2733
jne 0x1000b3c1
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x48]
push eax
push str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.10009be0
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1000b760
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov dword [ebp - 0xc], ecx
mov eax, 1
test eax, eax
je 0x1000b89c
push 0
push 0x598
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x70]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x1000b849
cmp dword [ebp - 4], 0x10
jne 0x1000b7d6
mov ecx, 4
mov edi, 0x10037894
mov edx, dword [ebp - 0xc]
mov esi, dword [edx + 0x70]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1000b7d6
push 0
push 0
push 5
push 1
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.1000aa10
xor eax, eax
jmp 0x1000b8a1
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c0]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1c8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x70]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x1d8
call fcn.1000ca30
cmp eax, 2
jne 0x1000b847
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x48]
push eax
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.10009be0
add esp, 8
push 1
push 0x4c7
call fcn.1000a8d0
add esp, 4
push eax
push 4
push 1
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.1000aa10
xor eax, eax
jmp 0x1000b8a1
jmp 0x1000b897
cmp dword [ebp - 4], 0xffffffff
jne 0x1000b897
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2733
jne 0x1000b865
jmp 0x1000b89c
cmp dword [ebp - 8], 0x2744
je 0x1000b877
cmp dword [ebp - 8], 0x2746
jne 0x1000b87e
jmp 0x1000b76b
push 1
mov ecx, dword [ebp - 8]
push ecx
push 4
push 1
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.1000aa10
xor eax, eax
jmp 0x1000b8a1
jmp 0x1000b76b
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b8b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, 1
test eax, eax
je 0x1000b9f0
mov ecx, dword [ebp - 0x20]
call fcn.1000ba00
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x7c
push ecx
lea ecx, [ebp - 8]
call fcn.1000cb00
lea ecx, [ebp - 8]
call fcn.1000cac0
movzx edx, al
test edx, edx
je 0x1000b9d9
push 0
lea ecx, [ebp - 8]
call fcn.1000cae0
mov ecx, eax
call fcn.100019c0
push eax
lea ecx, [ebp - 8]
call fcn.1000cae0
mov ecx, eax
call fcn.1000a8b0
push eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x1000b95a
mov edx, dword [ebp - 0x20]
add edx, 0x160
push edx
lea ecx, [ebp - 0x10]
call fcn.10002df0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x194]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x194], ecx
lea ecx, [ebp - 0x10]
call fcn.10002e20
jmp 0x1000b9d7
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1000b9d7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2733
jne 0x1000b9ae
mov eax, dword [ebp - 0x20]
add eax, 0x160
push eax
lea ecx, [ebp - 0x18]
call fcn.10002df0
lea ecx, [ebp - 8]
call fcn.1000ca90
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x178
call fcn.1000c6f0
lea ecx, [ebp - 0x18]
call fcn.10002e20
lea ecx, [ebp - 8]
call fcn.1000cb30
jmp 0x1000b9f0
push 1
mov ecx, dword [ebp - 0x14]
push ecx
push 3
push 1
mov ecx, dword [ebp - 0x20]
add ecx, 0x30
call fcn.1000aa10
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.1000cb30
mov eax, dword [ebp - 0x1c]
jmp 0x1000b9f5
jmp 0x1000b9e3
lea ecx, [ebp - 8]
call fcn.1000cb30
jmp 0x1000b9f0
lea ecx, [ebp - 8]
call fcn.1000cb30
jmp 0x1000b8b9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000bfd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
push str.CUdpSocket::Connect
push 0x10037a48
call fcn.10009c20
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], eax
push 0
mov edx, dword [ebp - 0x10]
add edx, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov word [ecx + 8], ax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x20], ecx
mov eax, dword [eax + 0x18]
mov dword [edx + 0x24], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x28], 0xca
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x29], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x64], 3
je 0x1000c065
mov ecx, dword [ebp - 0x10]
call fcn.1000ba50
push 0
push 0
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.1000ac50
mov dword [ebp - 8], eax
push 0x1770
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x1000c0b2
cmp dword [ebp - 0x14], 0x102
je 0x1000c0f9
cmp dword [ebp - 0x14], 0xffffffff
je 0x1000c10f
jmp 0x1000c125
push 1
mov eax, dword [ebp - 0x10]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x1000c140
push 0
push 0
call fcn.10010aaf
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x268], eax
mov al, 1
jmp 0x1000c12b
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor al, al
jmp 0x1000c12b
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor al, al
jmp 0x1000c12b
xor al, al
jmp 0x1000c12b
mov esp, ebp
pop ebp
ret 8

Function at 0x1000d810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x1000d640
push 0
push 0
call fcn.10010aaf
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
call fcn.10008c60
mov esp, ebp
pop ebp
ret