joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100414a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10136160]
movss xmm0, dword [0x1011606c]
push ebx
mov ebx, eax
mov dword [ebp - 4], ebx
comiss xmm0, dword [ebx + 0x1cd8]
ja 0x10041709
cmp dword [ebx + 0x1cd4], 0
push esi
push edi
jne 0x1004151d
or edx, 0xffffffff
mov al, 0x23
mov esi, 0x10115fb1
or edi, 0xffffffff
nop
cmp al, 0x23
jne 0x100414ee
cmp byte [esi], al
jne 0x100414ee
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10115a00]
test al, al
jne 0x100414e0
not edx
push edx
call fcn.1003b2d0
mov dword [ebx + 0x1cd4], eax
add esp, 4
mov eax, dword [0x10136160]
movss xmm2, dword [ebx + 0x10]
movss xmm1, dword [ebx + 0x14]
or dword [eax + 0x1af0], 0x10
mulss xmm2, dword [0x10116074]
mulss xmm1, dword [0x10116074]
movss xmm3, dword [0x101160d4]
movss dword [eax + 0x1b2c], xmm2
movss dword [eax + 0x1b30], xmm1
movss dword [eax + 0x1b34], xmm3
movss dword [eax + 0x1b38], xmm3
mov dword [eax + 0x1b3c], 0
mov dword [eax + 0x1b40], 0
movss xmm2, dword [ebx + 0x10]
movss xmm1, dword [ebx + 0x14]
mov eax, dword [0x10136160]
mulss xmm2, dword [0x100d0714]
mulss xmm1, dword [0x100d0714]
or dword [eax + 0x1af0], 1
movss dword [eax + 0x1b00], xmm2
mov dword [eax + 0x1b08], 0x3f000000
movss dword [eax + 0x1b04], xmm1
mov dword [eax + 0x1b0c], 0x3f000000
mov dword [eax + 0x1af4], 1
lea eax, [ebp - 0xc]
movss xmm0, dword [ebx + 0x151c]
addss xmm0, xmm0
push eax
push 1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [ebx + 0x1520]
addss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.10042f00
push 0xc1347
push 0
push str.NavWindowingList
call fcn.10035f10
mov edi, dword [ebx + 0x1a38]
add esp, 0x14
sub edi, 1
js 0x100416f8
nop
mov eax, dword [ebx + 0x1a40]
mov esi, dword [eax + edi*4]
cmp byte [esi + 0x83], 0
je 0x100416ef
cmp esi, dword [esi + 0x318]
jne 0x100416ef
test dword [esi + 8], 0x80000
jne 0x100416ef
mov ecx, dword [esi]
mov edx, ecx
cmp ecx, 0xffffffff
jae 0x10041675
mov bl, byte [edx]
test bl, bl
je 0x1004166e
cmp bl, 0x23
jne 0x10041668
cmp byte [edx + 1], bl
je 0x1004166e
inc edx
cmp edx, 0xffffffff
jb 0x10041658
mov ebx, dword [ebp - 4]
cmp ecx, edx
jne 0x100416c5
mov eax, dword [esi + 8]
test eax, 0x4000000
je 0x10041686
mov ecx, str._Popup_
jmp 0x100416c5
test eax, 0x400
je 0x100416c0
mov eax, str.MainMenuBar
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100416b2
test dl, dl
je 0x100416ae
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100416b2
add ecx, 2
add eax, 2
test dl, dl
jne 0x10041692
xor eax, eax
jmp 0x100416b7
sbb eax, eax
or eax, 1
mov ecx, str._Main_menu_bar_
test eax, eax
je 0x100416c5
mov ecx, str._Untitled_
cmp dword [ebx + 0x1ccc], esi
lea eax, [ebp - 0xc]
push eax
sete al
mov dword [ebp - 0xc], 0
push 0
movzx eax, al
push eax
push ecx
mov dword [ebp - 8], 0
call fcn.1006d440
add esp, 0x10
sub edi, 1
jns 0x10041620
call fcn.1003a0d0
push 1
call fcn.10042910
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042b40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101354c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10136160]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1a6c]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xc4
mov dword [ebp - 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10115a00]
sub esi, 1
jne 0x10042b80
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x10042bc7
inc ecx
test esi, esi
je 0x10042bb5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10042bba
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10048580
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ca284
mov esp, ebp
pop ebp
ret

Function at 0x10045350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10136160]
push esi
mov esi, dword [ebp + 8]
mov dword [eax + 0x2ebc], 0
test esi, esi
je 0x100453a9
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push edi
push eax
call fcn.100453b0
push 0x10115ff0
push esi
mov edi, eax
call fcn.1003c610
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100453a8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
ret
Function at 0x10046fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x10136160]
cmp byte [edi + 0x2eb9], 0
lea eax, [edi + 0x20]
jne 0x100470f5
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x100470ed
push esi
push 0x1011456c
push ecx
call fcn.1003c610
mov esi, eax
add esp, 8
test esi, esi
je 0x100470e9
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x100470df
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100470df
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
je 0x100470df
push 0
push dword [ebp - 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100470df
mov eax, dword [0x10136160]
test eax, eax
je 0x10047075
inc dword [eax + 0x370]
push dword [0x10136168]
push ebx
call dword [0x101344f0]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x100470df
push esi
push dword [ebp - 4]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp - 4]
je 0x100470cb
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, dword [0x10136160]
test eax, eax
je 0x100470b9
dec dword [eax + 0x370]
push dword [0x10136168]
push ebx
call dword [0x101344f4]
add esp, 8
jmp 0x100470e9
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp - 4]
push ebx
call fcn.1003e1c0
add esp, 0xc
jmp 0x100470aa
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x2eb9], 1
pop ebx
movss xmm0, dword [edi + 0x2ebc]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x10047146
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x2ebc], xmm0
jb 0x10047146
mov eax, dword [eax]
test eax, eax
je 0x10047135
push eax
call fcn.10045350
add esp, 4
mov dword [edi + 0x2ebc], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x358], 1
mov dword [edi + 0x2ebc], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10050420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x10050447
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.1003e6b0
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1005046c
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.1003e6b0
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10050491
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.1003e6b0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x100504d2
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.1003e6b0
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x100504f7
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.1003e6b0
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1005051c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.1003e6b0
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1004b790
Function at 0x10059120
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101354c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.1003bd80
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x2c]
push eax
push dword [0x101361b8]
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
movd xmm0, eax
lea eax, [ebp - 0x14]
cvtdq2ps xmm0, xmm0
push eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss dword [edi + 0xc], xmm0
xorps xmm0, xmm0
movss dword [edi + 8], xmm1
movlpd qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [0x101361c0]
mov edx, dword [ebp - 0x10]
sbb edx, dword [0x101361c4]
call fcn.100cae80
mov edx, dword [0x101361cc]
mov ecx, dword [0x101361c8]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.100cae80
movss xmm1, dword [ebp - 8]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [0x101361c0], eax
mov dword [0x101361c4], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf4], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf5], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xf7], 0
mov byte [edi + 0xf6], al
call fcn.1003bd80
mov esi, eax
cmp byte [esi + 0x34f], 0
je 0x1005925a
cvttss2si ecx, dword [esi + 0xdc]
lea eax, [ebp - 0xc]
push eax
push dword [0x101361b8]
mov dword [ebp - 0xc], ecx
cvttss2si ecx, dword [esi + 0xe0]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1005925a
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xdc], 0xff7fffff
mov dword [esi + 0xe0], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x100592d0
mov ecx, dword [0x101361b8]
cmp eax, ecx
je 0x1005928e
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x100592d0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100592d0
lea eax, [ebp - 0x1c]
push eax
push dword [0x101361b8]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x100592d0
movd xmm0, dword [ebp - 0x1c]
movd xmm1, dword [ebp - 0x18]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xdc], xmm0
movss dword [esi + 0xe0], xmm1
cmp byte [edi + 0xa8], 0
pop edi
pop esi
je 0x100592e0
or eax, 0xffffffff
jmp 0x100592e5
call fcn.1003be60
cmp dword [0x101346b0], eax
je 0x100592f7
mov dword [0x101346b0], eax
call fcn.100595b0
call fcn.10059310
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca284
mov esp, ebp
pop ebp
ret
Function at 0x100748b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cee7d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x101354c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
push ecx
push 0
push 0
push closesocket
push 0
push dword [ebp + 0x10]
push eax
call fcn.10074df0
mov eax, dword [ebp - 0x18]
add esp, 0x1c
mov ebx, dword [ebp - 0x1c]
sub eax, ebx
sar eax, 2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10074990
xor edi, edi
test eax, eax
je 0x10074990
cmp edi, dword [ebp + 0x18]
jge 0x10074990
mov esi, dword [ebx + edi*4]
lea eax, [ebp - 0x20]
push eax
push 0x40
push dword [ebp + 0x14]
push esi
push dword [0x10135a60]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x24]
push esi
push dword [0x10135a60]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x20]
push dword [ebp + 0x14]
push esi
push dword [0x10135a60]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc edi
cmp edi, dword [ebp - 0x28]
jb 0x10074942
test ebx, ebx
je 0x100749c6
mov ecx, dword [ebp - 0x14]
mov eax, ebx
sub ecx, ebx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x100749bc
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100749bc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push ebx
call fcn.100ca494
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ca284
mov esp, ebp
pop ebp
ret

Function at 0x10074cd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x101354c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x130], eax
push esi
push 2
xor ebx, ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x10074d15
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca284
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10074d6d
push dword [ebp - 0x130]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10074d5c
mov eax, dword [ebp - 0x118]
cmp eax, esi
jbe 0x10074d5c
mov ebx, dword [ebp - 0x124]
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10074d30
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ca284
mov esp, ebp
pop ebp
ret
Function at 0x100806b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1008073c
push esi
call fcn.10094490
add esp, 4
test al, al
jne 0x1008073c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x100806d3
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1009d8a0
add esp, 0xc
test eax, eax
je 0x10080707
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1009d8a0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10080709
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x10080735
mov al, byte [esi]
push eax
call fcn.1008f7b0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x10080717
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1008afe0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6f9], 0
je 0x1008b077
cmp dword [edi + 0x1a8], 0
je 0x1008b031
push esi
push 1
push edi
call fcn.1007b760
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1a8]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.1007b760
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov edx, dword [esp + 0xc]
mov ecx, edx
sub ecx, 0
je 0x1008b046
sub ecx, 1
je 0x1008b046
sub ecx, 1
jne 0x1008b077
push dword [edi + 0x148]
lea eax, [edx*2 + 0x1011d738]
push 1
add eax, edx
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x1008b620
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x101354c0]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 4], eax
xor eax, eax
mov ecx, dword [ebx + 0xc]
push ebp
push esi
mov esi, 0x178
mov edx, dword [ecx + 0x154]
cmp dword [esp + 0x120], edx
push edi
sete al
lea eax, [eax*4 + 0x150]
mov ebp, dword [eax + ecx]
mov eax, 0x188
cmove esi, eax
mov eax, dword [ecx + 0x2a8]
add esi, ecx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x1008b723
xor eax, eax
cmp dword [esp + 0x124], edx
sete al
lea eax, [eax*4 + 0x168]
cmp dword [eax + ecx], 0x1008b2e0
jne 0x1008b723
cmp dword [esi], 0
je 0x1008b6be
test edi, edi
je 0x1008b723
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.1009c120
add esp, 0x14
cmp eax, 0xffffffff
je 0x1008b723
test al, 1
je 0x1008b723
mov ecx, dword [esi]
test ecx, ecx
jne 0x1008b70c
mov eax, dword [ebx + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x10135128]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x1008b757
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1008b723
add dword [esi + 8], eax
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
jne 0x1008b792
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x1008b768
xor edi, edi
lea eax, [edi + 0x51]
jmp 0x1008b792
mov ecx, dword [esp + 0x10]
mov eax, 0x1b
mov dword [ecx], 0xffffffff
jmp 0x1008b798
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.10075b10
push eax
push str.Send_failure:__s
push ebx
call fcn.1008b080
add esp, 0x18
mov dword [ebx + 0x948], esi
mov eax, 0x37
mov ecx, dword [esp + 0x10]
mov dword [ecx], edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ca284
add esp, 0x10c
ret
Function at 0x1008bbf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1a4], 0
je 0x1008bc0d
push eax
call fcn.10084bf0
add esp, 4
test eax, eax
je 0x1008bc2e
mov al, 1
ret
mov eax, dword [eax + 0x150]
cmp eax, 0xffffffff
je 0x1008bc2e
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
ret
xor al, al
ret

Function at 0x1008be80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x101354c0]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1008bf07
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.10075b10
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x1008bf47
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.1008ba70
add esp, 0x10
test al, al
jne 0x1008bf50
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.10075b10
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.1008b080
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100ca284
add esp, 0x188
ret

Function at 0x1008c750
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x101363c4]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x1008c7a1
push 3
push 2
push eax
push eax
push 6
call fcn.100b6a10
add esp, 0x14
test al, al
je 0x1008c795
mov dword [0x101363c4], 2
add esp, 0xc
ret
mov dword [0x101363c4], 1
jmp 0x1008c7a6
cmp eax, 2
je 0x1008c7ec
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1008c7d1
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x1008c7ec
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x1008dc20
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x1008dc3a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x1011dbb4
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
add esp, 8
test eax, eax
je 0x1008dc82
test ebp, ebp
je 0x1008dc73
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x1008dca8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008dca8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x1008dd5f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008dcc5
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [0x10135128]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1008dd55
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1008dd55
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008dcf7
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008dd10
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x1008dd20
test ebp, ebp
je 0x1008dd4c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x1013512c]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x1013512c]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x10094490
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x101354c0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x100944d8
lea eax, [esp + 8]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
pop esi
setg al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100ca284
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov al, 1
pop esi
xor ecx, esp
call fcn.100ca284
add esp, 0x18
ret

Function at 0x100945f0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x10094602
mov eax, dword [eax + 0x70]
mov al, byte [eax + 0xe3]
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x10094616
xor al, al
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
ret