joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d39b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051ec
mov eax, dword [ebp - 8]
call fcn.004051ec
xor eax, eax
push ebp
push 0x4d3b0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, 0x4d3b24
call fcn.00404db8
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403614
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x40
mov eax, dword [0x4df0b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
call fcn.004051fc
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
call fcn.004051fc
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x14]
call fcn.004051fc
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x3c], 1
lea eax, [ebp - 0x58]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
jne 0x4d3a84
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
call fcn.0040f6b0
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0xc]
call fcn.00404d74
mov byte [ebp - 0xd], 0
jmp 0x4d3ad8
cmp dword [ebp + 8], 0
jle 0x4d3acc
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_WaitForInputIdle
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4d3aae
mov eax, dword [ebp - 0xc]
call fcn.00404d20
mov byte [ebp - 0xd], 1
jmp 0x4d3ad8
lea edx, [ebp - 0x60]
mov eax, 0x4d3b30
call fcn.0047b8ac
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0xc]
call fcn.00404fc4
mov byte [ebp - 0xd], 0
jmp 0x4d3ad8
mov eax, dword [ebp - 0xc]
call fcn.00404d20
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3b12
lea eax, [ebp - 0x60]
call fcn.00405484
lea eax, [ebp - 0x5c]
call fcn.00404d20
lea eax, [ebp - 0x14]
call fcn.00404d20
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d44
ret

Function at 0x4d42d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d4337
xor eax, eax
push ebp
push 0x4d4330
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4337
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4d4340
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0xd], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d442a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
call fcn.004051fc
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
call fcn.004051fc
push eax
call sub.user32.dll_FindWindowA
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x4d43b2
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jbe 0x4d4379
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x4d4407
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x4d443c
call fcn.0047b8ac
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00404fc4
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040d0c4
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x40a87c]
call fcn.0040fef8
call fcn.004045ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4431
lea eax, [ebp - 0x1c]
call fcn.00405484
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404d44
ret
Function at 0x40f22e
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f2cb
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f2cb
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f2cb
push 4
push 0xffffffffffffffff
push esi
push 0x40f9e5
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f2cb
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f296
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f2cb
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f2d1
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f2cd

Function at 0x413ca1
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413cb1
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x413cb7
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x413cdf
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x413cc6
mov esi, ecx
jmp 0x413ce2
movzx esi, si
pop edi
cmp cx, si
je 0x413cff
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x413ce3
mov eax, 0x437338
jmp 0x413d07
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x42914f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x42915e
pop dword [ebp - 0x28]
mov eax, 0x42915e
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x47916
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x1268c98b
add ecx, 0xed978e22
mov ebx, eax
mov esi, 0x448800
add esi, dword [ebp - 0x28]
mov edx, 0x5ffadf4a
xor dword [ebp - 0x10], ebx
mov edi, dword [esi]
xor dword [ebp - 0xc], 0x44a9f66d
xor edi, edx
add dword [ebp - 0x20], 0x70ebdd5c
mov dword [ebx], edi
sub dword [ebp - 4], edi
add ebx, 4
add esi, 0x3c5659c6
sub esi, 0x3c5659c2
loop 0x4291a7
add eax, 0x15187
mov ebx, eax
add eax, 0x11664efe
add eax, 0xee99b107
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10015420
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1001545e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10015456
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10015460
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10015446
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10015530
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10015561
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10015561
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x10015561
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x6d66355a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x6d663569
pop dword [ebp - 0x44]
mov eax, 0x6d663569
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xad5cb316
add dword [ebp - 0x54], 0xa0f59235
mov dword [ebp - 0x50], 0xb23b9b98
add dword [ebp - 0x50], 0x7ff7b0ad
mov dword [ebp - 0x4c], 0x767d2c7d
sub dword [ebp - 0x4c], 0x2a30e84f
mov dword [ebp - 0x48], 0xc32c896b
sub dword [ebp - 0x48], 0xc32c896b
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xf03e851d
sub dword [ebp - 0x54], 0x7bcc1bc7
mov dword [ebp - 0x50], 0x781a369
sub dword [ebp - 0x50], 0xc61541f4
mov dword [ebp - 0x4c], 0x9f595431
add dword [ebp - 0x4c], 0xc416183b
mov dword [ebp - 0x48], 0xe2c05e71
add dword [ebp - 0x48], 0x1d3fa18f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x919e0ea7
sub eax, 0x24374e5b
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x370d0
push 0
call eax
mov ecx, 0x4754
mov edx, eax
mov edi, 0x6d674000
add edi, dword [ebp - 0x44]
mov esi, 0xeab61f7
sub esi, 0x8c418e3d
xor dword [ebp - 0x24], 0x572a2790
mov ebx, dword [edi]
sub dword [ebp - 0x28], esi
xor ebx, esi
add dword [ebp - 0x34], ebx
mov dword [edx], ebx
mov dword [ebp - 0x28], 0xb15e96a9
add edx, 4
add edi, 4
loop 0x6d663675
add eax, 0x6ae98e5a
sub eax, 0x6ae87e37
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe583fe71
add ecx, 0x87e2018f
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x6d663af6
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa8
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0x74], eax
mov eax, dword [0x6d671004]
test eax, eax
jns 0x6d663bae
and dword [0x6d671004], 0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x6d663b4e
cmp dword [ebp - 0x1c], 5
jae 0x6d663ba9
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesTcpParameters
jmp 0x6d663b5e
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesVxDMSTCPParameters
push reloc.ws2_32.dll_bind
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d663ba9
push edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push str.DefaultTOS
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 0x24]
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x6d663ba9
mov eax, dword [ebp - 0x28]
mov dword [0x6d671004], eax
mov eax, dword [0x6d671004]
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.6d66b1da
add ebp, 0x78
leave
ret
Function at 0x6d663d3b
Capabilities:
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0x9c]
cdq
mov ecx, 0x3e8
idiv ecx
lea ecx, [ebp - 0x80]
push ecx
push 0
push 0
lea ecx, [ebp - 0x78]
push ecx
mov dword [ebp - 0x78], 1
imul edx, edx, 0x3e8
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x98]
mov dword [ebp - 0x74], eax
inc eax
push eax
mov dword [ebp - 0x7c], edx
call dword [sym.imp.ws2_32.dll_select]
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.6d66b1da
add ebp, 0x90
leave
ret 8

Function at 0x6d663dab
Capabilities:
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xa4]
lea ecx, [ebp - 0x80]
cmp eax, 0xffffffff
jne 0x6d663de1
xor ecx, ecx
jmp 0x6d663df5
cdq
mov esi, 0x3e8
idiv esi
imul edx, edx, 0x3e8
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edx
mov esi, dword [ebp + 0x98]
mov ebx, dword [ebp + 0x9c]
xor edx, edx
inc edx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], edx
xor eax, eax
cmp dword [ebp + eax*4 - 0x74], ebx
je 0x6d663e17
inc eax
cmp eax, edx
jb 0x6d663e0c
cmp eax, edx
jne 0x6d663e25
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x78], 2
push ecx
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.ws2_32.dll_select]
sub eax, 0
je 0x6d663e65
dec eax
je 0x6d663e4c
dec eax
je 0x6d663e45
or eax, 0xffffffff
jmp 0x6d663e67
push 2
mov dword [edi], esi
pop eax
jmp 0x6d663e67
lea eax, [ebp - 0x78]
push eax
push esi
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x6d663e5e
mov dword [edi], esi
jmp 0x6d663e60
mov dword [edi], ebx
xor eax, eax
inc eax
jmp 0x6d663e67
xor eax, eax
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
add ebp, 0x90
leave
ret 0x10
Function at 0x6d665180
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x6d6715b4]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x6d6651b6
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d6652b0
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x6d6651ea
push str.create
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d6652af
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x6d67117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x6d66529c
push dword [0x6d6715a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x6d665245
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d665262
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6d665280
push str.create
push esi
call fcn.6d663a00
pop ecx
pop ecx
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x6d67117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call sym.net.dll__NET_SockaddrToInetAddress_12
jmp 0x6d6652ae
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x6d67117c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x6d6652ae
push 0
push dword [0x6d6715a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x6d6662df
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x28], eax
call fcn.6d664fdf
push edi
mov ebx, eax
call fcn.6d66500b
pop ecx
pop ecx
test ebx, ebx
jns 0x6d66633c
test eax, eax
jns 0x6d66633a
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
leave
ret 0x10
mov ebx, eax
cmp dword [ebp + 0x10], 0xf
jne 0x6d6663d1
mov dword [ebp - 0x30], 0x1c
cmp ebx, 0xffffffff
jne 0x6d66635b
push edi
call fcn.6d66500b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x6d666383
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
add esp, 0xc
jmp 0x6d666326
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
mov edi, eax
test edi, edi
je 0x6d666326
push dword [ebp - 0x28]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d666326
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x28]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x6d666329
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x6d6663ef
push str.Invalid_option
jmp 0x6d66631b
mov edi, 0x80
mov dword [ebp - 0x2c], 4
cmp dword [ebp + 0x10], edi
je 0x6d666404
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call sym.net.dll__NET_SockaddrToInetAddress_12
test eax, eax
jns 0x6d66642e
push str.getsockopt
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d666326
mov eax, dword [ebp + 0x10]
cmp eax, 8
jg 0x6d66644c
je 0x6d666465
dec eax
je 0x6d666465
dec eax
dec eax
je 0x6d666476
dec eax
je 0x6d666465
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x6d66631b
cmp eax, edi
je 0x6d66647e
cmp eax, 0x1000
jle 0x6d666442
cmp eax, 0x1002
jle 0x6d666476
cmp eax, 0x1003
jne 0x6d666442
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x6d666329
mov eax, dword [ebp - 0x24]
jmp 0x6d666329
cmp word [ebp - 0x24], 0
je 0x6d666326
movzx eax, word [ebp - 0x22]
jmp 0x6d666329
Function at 0x6d6664df
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push dword [0x6d6715b4]
mov esi, dword [esp + 0xc]
push dword [esp + 0x10]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
test eax, eax
jne 0x6d666507
push str.Socket_closed
push str.java_net_SocketException
jmp 0x6d66654c
push dword [0x6d67117c]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x190]
cmp eax, 0xffffffff
je 0x6d6664fb
push 1
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x6d666540
push str.send
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d666552
cmp eax, 0xfffffffe
jne 0x6d666552
push 0
push str.java_io_InterruptedIOException
push esi
call sub.java.dll__JNU_ThrowByName_12
pop esi
ret 0xc

Function at 0x6d66659a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
xor eax, eax
cmp byte [ebp + 0x10], al
push esi
sete al
push 0
inc eax
push eax
push 0x17
call fcn.6d66465c
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x6d6665d8
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call sym.net.dll__NET_SockaddrToInetAddress_12
or eax, esi
jmp 0x6d66660f
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6d666602
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call sym.net.dll__NET_SockaddrToInetAddress_12
push 0
push 1
push esi
call dword [sym.imp.kernel32.dll_SetHandleInformation]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x6d66667f
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push 1
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
test eax, eax
jne 0x6d666701
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d666704
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x6d6666dc
push 0xfffffffffffffffe
pop eax
jmp 0x6d666704
cmp eax, 0x2741
jne 0x6d6666f5
push str.connect:_Address_is_invalid_on_local_machine__or_port_is_not_valid_on_remote_machine
push str.java_net_ConnectException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d666701
push str.connect
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d66b1da
leave
ret 0x14
Function at 0x6d666713
Capabilities:
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0x198], eax
xor eax, eax
inc eax
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0x1b0]
cdq
mov ecx, 0x3e8
idiv ecx
push ebx
push esi
mov esi, dword [ebp + 0x1ac]
push edi
mov edi, dword [ebp + 0x1a4]
xor ebx, ebx
mov dword [ebp - 0x78], 4
mov dword [ebp - 0x6c], esi
mov dword [ebp + 0x98], esi
mov dword [ebp - 0x80], eax
imul edx, edx, 0x3e8
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x94]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x7c], edx
call dword [sym.imp.ws2_32.dll_select]
mov dword [ebp - 0x74], eax
cmp eax, ebx
jne 0x6d6667b1
push str.connect_timed_out
push str.java_net_SocketTimeoutException
push edi
call sub.java.dll__JNU_ThrowByName_12
push 2
push esi
call dword [sym.imp.ws2_32.dll_shutdown]
jmp 0x6d666814
lea eax, [ebp + 0x94]
push eax
push esi
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x6d666814
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x1007
push 0xffff
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
cmp dword [ebp - 0x74], 0
jne 0x6d666806
push 0
call dword [sym.imp.kernel32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x6d6667c2
cmp dword [ebp - 0x74], 0
jne 0x6d666806
push str.Unable_to_establish_connection
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d666814
push str.connect
push dword [ebp - 0x74]
push edi
call sym.net.dll__NET_SockaddrToInetAddress_12
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
add ebp, 0x19c
leave
ret 0x10

Function at 0x6d66682e
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d666895
push esi
mov esi, dword [sym.imp.ws2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2736
jne 0x6d666881
push str.Socket_closed
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d66688f
push str.getsockname_failed
call esi
push eax
push edi
call sym.net.dll__NET_SockaddrToInetAddress_12
or eax, 0xffffffff
pop esi
jmp 0x6d6668a3
movzx eax, word [ebp - 0x1e]
push eax
call dword [sym.imp.ws2_32.dll_ntohs]
movzx eax, ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.6d66b1da
leave
ret 0xc