joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10065b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push eax
call fcn.1005bae0
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x10065ba3
mov edx, dword [ebp - 8]
push edx
call sym.ruby.dll_rb_io_close
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call sym.ruby.dll_rb_io_fptr_finalize
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 8], 0
mov dword [ebp - 4], 0
push 0x7c
call sym.ruby.dll_ruby_xmalloc
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], 0
xor edx, edx
jne 0x10065bfc
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], 0
xor ecx, ecx
jne 0x10065c28
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x60], 0
xor eax, eax
jne 0x10065c54
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x50], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x64], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x68], 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x6c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x70], 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x74], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x44], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x48], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x78], 0
xor ecx, ecx
jne 0x10065baa
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [edx + 8], eax
xor ecx, ecx
jne 0x10065b75
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
push eax
call fcn.10062980
add esp, 4
cmp dword [ebp + 0x14], 0
je 0x10065d4f
mov ecx, dword [ebp + 0x14]
push ecx
call sym.ruby.dll_rb_str_new_cstr
add esp, 4
push eax
call sym.ruby.dll_rb_obj_freeze
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
push eax
call sym.ruby.dll_rb_update_max_fd
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x100abda0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.100ad640
cmp dword [eax + 0xb0], 0
je 0x100abe00
mov eax, dword [ebp + 8]
push eax
call fcn.100abd40
add esp, 4
mov ecx, 4
imul edx, ecx, 0
mov dword [ebp + edx - 8], eax
push 0x10242884
call sym.ruby.dll_rb_str_new_cstr
add esp, 4
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], eax
mov edx, dword [sym.ruby.dll_rb_eSystemExit]
push edx
lea eax, [ebp - 8]
push eax
push 2
call sym.ruby.dll_rb_class_new_instance
add esp, 0xc
push eax
call sym.ruby.dll_rb_exc_raise
call sym.ruby.dll_ruby_finalize
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esp, ebp
pop ebp
ret

Function at 0x100b3670
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + ecx], eax
mov dword [ebp - 4], 1
jmp 0x100b3698
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x270
jge 0x100b36de
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4 - 4]
shr ecx, 0x1e
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
xor ecx, dword [eax + edx*4 - 4]
imul ecx, ecx, 0x6c078965
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax*4]
mov dword [edx + ecx*4], eax
jmp 0x100b368f
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x9c4], 1
mov edx, dword [ebp + 8]
add edx, 0x9c0
mov eax, dword [ebp + 8]
mov dword [eax + 0x9c0], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b38c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x9c4], 0x270
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [eax + 0x9c0], edx
mov dword [ebp - 8], 0xe4
jmp 0x100b38f8
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
je 0x100b396c
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax]
and edx, 1
je 0x100b391f
mov dword [ebp - 0xc], 0x9908b0df
jmp 0x100b3926
mov dword [ebp - 0xc], 0
mov eax, 4
imul ecx, eax, 0x18d
mov edx, 4
imul eax, edx, 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax]
and eax, 0x80000000
mov edx, 4
shl edx, 0
mov esi, dword [ebp - 4]
mov edx, dword [esi + edx]
and edx, 0x7fffffff
or eax, edx
shr eax, 1
xor eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x100b38ef
mov dword [ebp - 8], 0x18d
jmp 0x100b397e
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
je 0x100b39f2
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx]
and eax, 1
je 0x100b39a5
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x100b39ac
mov dword [ebp - 0x10], 0
mov ecx, 4
imul edx, ecx, 0xffffff1d
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ecx]
and ecx, 0x80000000
mov eax, 4
shl eax, 0
mov esi, dword [ebp - 4]
mov eax, dword [esi + eax]
and eax, 0x7fffffff
or ecx, eax
shr ecx, 1
xor ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
xor ecx, dword [eax + edx]
mov edx, dword [ebp - 4]
mov dword [edx], ecx
jmp 0x100b3975
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx]
and eax, 1
je 0x100b3a0e
mov dword [ebp - 0x14], 0x9908b0df
jmp 0x100b3a15
mov dword [ebp - 0x14], 0
mov ecx, 4
imul edx, ecx, 0xffffff1d
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ecx]
and ecx, 0x80000000
mov eax, 4
imul eax, eax, 0
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax]
and eax, 0x7fffffff
or ecx, eax
shr ecx, 1
xor ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
xor ecx, dword [eax + edx]
mov edx, dword [ebp - 4]
mov dword [edx], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b3a60
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9c4]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + 0x9c4], eax
cmp dword [ebp - 8], 0
jg 0x100b3a93
mov ecx, dword [ebp + 8]
push ecx
call fcn.100b38c0
add esp, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c0]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c0]
add eax, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x9c0], eax
mov edx, dword [ebp - 4]
shr edx, 0xb
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100b4060
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x10
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0xf0000000
push 1
push 0
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100b40ac
mov edx, dword [ebp + 8]
push edx
push 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.1017f3c0
add esp, 8
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx]
xor eax, dword [ebp - 8]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx]
xor ecx, dword [ebp - 0xc]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
mov ecx, 4
imul esi, ecx, 0
mov eax, dword [ebp - 0xc]
cdq
mov cl, 0x20
call fcn.10194a90
mov edx, dword [ebp + 8]
xor eax, dword [edx + esi]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov esi, 4
shl esi, 1
call sym.ruby.dll_rb_w32_getpid
mov edx, dword [0x102587e4]
shl edx, 0x10
xor eax, edx
mov ecx, dword [ebp + 8]
xor eax, dword [ecx + esi]
mov edx, 4
shl edx, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, dword [0x102587e4]
add edx, 1
mov dword [0x102587e4], edx
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx]
lea ecx, [ebp + 8]
xor eax, ecx
mov edx, 4
imul ecx, edx, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10137620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push sym.ruby.dll_ruby_copyright
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop ebp
ret

Function at 0x101501a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x190
call sym.ruby.dll_ruby_mimmalloc
add esp, 4
mov dword [ebp - 8], eax
push 0x190
call sym.ruby.dll_ruby_mimmalloc
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x101501d2
cmp dword [ebp - 4], 0
jne 0x101501f3
push str._FATAL__failed_to_allocate_memory_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10052750
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x190
push 0
mov eax, dword [ebp - 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [sym.ruby.dll_ruby_current_thread], ecx
mov edx, dword [ebp - 8]
push edx
call fcn.101650b0
add esp, 4
mov eax, dword [ebp - 8]
mov dword [sym.ruby.dll_ruby_current_vm], eax
call fcn.1016d380
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.10165200
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call sym.ruby.dll_ruby_thread_init_stack
add esp, 4
push str.vm.c_Init_BareVM
mov edx, dword [ebp - 4]
push edx
call fcn.1004df90
add esp, 8
call sym.ruby.dll_rb_hash_new
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x164], eax
mov esp, ebp
pop ebp
ret

Function at 0x1016d380
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.1016d730
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10250b00], eax
mov eax, dword [ebp - 4]
push eax
call fcn.1016f440
add esp, 4
push 2
push 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x48
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
xor eax, eax
je 0x1016d404
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x58]
push edx
call fcn.1016d730
mov eax, dword [eax + 0x48]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.initial_thread__th:__p__thid:__p__event:__p__n
call fcn.100abba0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1016df70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.1016f420
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1016dfa5
push str._BUG__rb_thread_call_with_gvl___is_called_by_non_ruby_thread_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10052750
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xa0]
mov ecx, dword [edx + 0xa4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 8], 0
jne 0x1016dfd3
push str.rb_thread_call_with_gvl:_called_by_a_thread_which_has_GVL.
call sym.ruby.dll_rb_bug
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.1016e7a0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0xc], eax
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1016e700
add esp, 0x14
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1016f570
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1016f58f
push str.w32_resume_thread
call fcn.1016f190
add esp, 4
pop ebp
ret

Function at 0x1016f5a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 4
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
pop ebp
ret

Function at 0x10175f50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call fcn.101743a0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x24]
mov dword [0x102697d4], ecx
mov edx, dword [ebp - 4]
add edx, 0xd8
push edx
call sym.ruby.dll_rb_gc_set_stack_end
add esp, 4
mov eax, dword [sym.ruby.dll_rb_cObject]
push eax
push str.Fiber
call sym.ruby.dll_rb_define_class
add esp, 8
mov dword [0x102697dc], eax
push fcn.10175730
mov ecx, dword [0x102697dc]
push ecx
call sym.ruby.dll_rb_define_alloc_func
add esp, 8
mov edx, dword [sym.ruby.dll_rb_eStandardError]
push edx
push str.FiberError
call sym.ruby.dll_rb_define_class
add esp, 8
mov dword [0x102697e0], eax
push 0xffffffffffffffff
push 0x10175f20
push str.yield
mov eax, dword [0x102697dc]
push eax
call sym.ruby.dll_rb_define_singleton_method
add esp, 0x10
push 0
push 0x10175980
push 0x10251f88
mov ecx, dword [0x102697dc]
push ecx
call sym.ruby.dll_rb_define_method
add esp, 0x10
push 0xffffffffffffffff
push 0x10175ea0
push str.resume
mov edx, dword [0x102697dc]
push edx
call sym.ruby.dll_rb_define_method
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1017dab0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
cmp dword [0x1026ce54], 0
jne 0x1017dac5
call fcn.10184350
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1017db20
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2733
je 0x1017db14
mov eax, dword [ebp - 4]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
jmp 0x1017db20
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x70
xor ecx, ecx
jne 0x1017dac5
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1017dd10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
cmp dword [0x1026ce54], 0
jne 0x1017dd25
call fcn.10184350
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1017ddbe
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2726
jne 0x1017dda8
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.10184410
add esp, 8
test eax, eax
je 0x1017dda8
mov eax, dword [ebp - 0x14]
sar eax, 4
and eax, 0xffff
mov dword [ebp - 8], eax
je 0x1017dda8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp - 8]
mov word [ecx], dx
xor eax, eax
jmp 0x1017ddc9
mov eax, dword [ebp - 0xc]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
xor ecx, ecx
jne 0x1017dd25
mov eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1017de40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
cmp dword [0x1026ce54], 0
jne 0x1017de53
call fcn.10184350
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1017de91
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
xor eax, eax
jne 0x1017de53
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1017e3d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
cmp dword [0x1026ce54], 0
jne 0x1017e3e3
call fcn.10184350
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1017e429
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
xor edx, edx
jne 0x1017e3e3
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1017e5c0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
cmp dword [0x1026ce54], 0
jne 0x1017e5d3
call fcn.10184350
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1017e5ff
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
xor ecx, ecx
jne 0x1017e5d3
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1017e610
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
cmp dword [0x1026ce54], 0
jne 0x1017e623
call fcn.10184350
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1017e653
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
xor edx, edx
jne 0x1017e623
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1017ede0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1017ee20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
xor eax, eax
jmp 0x1017eeca
cmp dword [ebp - 4], 0
je 0x1017ee43
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
jge 0x1017ee41
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x22
xor eax, eax
jmp 0x1017eeca
jmp 0x1017ee6f
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp + 0xc], eax
cmp dword [ebp - 4], 0
jne 0x1017ee6f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0xc
xor eax, eax
jmp 0x1017eeca
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x1017eeb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
cmp dword [ebp + 8], 0
jne 0x1017eead
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
jmp 0x1017eeca
call fcn.10184f00
push eax
push 0x2f
push 0x5c
mov ecx, dword [ebp - 4]
push ecx
call fcn.10183940
add esp, 0x10
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1017f050
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x1017f082
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*2 + 2]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
test edx, edx
je 0x1017f0a2
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x3d
je 0x1017f0a0
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x1017f06e
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4 + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jmp 0x1017f0db
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*2 + 2]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
test edx, edx
je 0x1017f11f
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x3d
je 0x1017f11d
push 0
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
push edx
push 0xfde9
call fcn.10184fb0
add esp, 0x10
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
cmp dword [edx], 0
jne 0x1017f114
jmp 0x1017f11f
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
jmp 0x1017f0c7
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret