joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024190
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.software
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002426a
mov edx, dword [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push str.ShiQiang
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1002426a
mov eax, dword [edi]
mov ecx, dword [esp]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
push eax
push 1
push 0
push str.OnlyIdentifier1
push ecx
call esi
mov edx, dword [edi]
mov eax, dword [esp + 4]
push 0x104
add edx, 0x208
push edx
push 1
push 0
push str.OnlyIdentifier2
push eax
call esi
mov ecx, dword [edi]
mov edx, dword [esp + 4]
push 0x104
add ecx, 0x410
push ecx
push 1
push 0
push str.OnlyIdentifier3
push edx
call esi
mov eax, dword [edi]
mov ecx, dword [esp + 4]
push 0x104
add eax, 0x618
push eax
push 1
push 0
push str.OnlyIdentifier4
push ecx
call esi
mov edx, dword [esp + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
pop esi
add esp, 8
ret

Function at 0x10027310
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x10027339
jmp 0x10027320
movsx ecx, cl
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x10027320
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
Function at 0x1002c960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100d78d1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x1013d900]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x14], 0
call fcn.1002c6c0
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x28], 1
call fcn.1002c9f0
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 1
test eax, eax
je 0x1002c9d3
push eax
call fcn.1002c3c0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 0xc
Function at 0x10030fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100d62d1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1013d900]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
lea edi, [ebp + 8]
mov dword [ebp], vtable.CHttpPageRequest.0
xor ebx, ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
lea esi, [ebp + 0x24]
push esi
mov dword [esp + 0x30], ebx
call fcn.1000e0c0
mov dword [ebp + 0x54], 0xf
mov dword [ebp + 0x50], ebx
mov byte [ebp + 0x40], bl
mov eax, 2
mov byte [esp + 0x2c], al
mov dword [ebp + 4], eax
call fcn.1000df50
mov edi, dword [esi + 0x10]
cmp dword [esi + 0xc], edi
jbe 0x1003101c
call fcn.100596cf
mov ebx, dword [esi + 0xc]
mov eax, dword [esi]
mov dword [esp + 0x18], eax
cmp ebx, dword [esi + 0x10]
jbe 0x1003102f
call fcn.100596cf
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
push edi
push ecx
push ebx
push eax
lea ebx, [esp + 0x28]
call fcn.100321c0
lea edi, [ebp + 0x3c]
call fcn.1000df50
mov dword [ebp + 0x58], 0
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x10031120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100d6286
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1013d900]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
lea esi, [ebp + 0xc]
push esi
mov dword [ebp], vtable.CHttpPageResponse.0
call fcn.1000e0c0
xor eax, eax
lea edi, [ebp + 0x28]
mov dword [esp + 0x28], eax
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], eax
mov byte [edi + 4], al
mov ecx, dword [esp + 0x34]
mov byte [esp + 0x28], 1
mov dword [ebp + 4], ecx
mov byte [ebp + 8], al
mov ebx, dword [esi + 0x10]
cmp dword [esi + 0xc], ebx
jbe 0x1003118d
call fcn.100596cf
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x18], edx
mov dword [esp + 0x34], ecx
cmp ecx, dword [esi + 0x10]
jbe 0x100311a8
call fcn.100596cf
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
push ebx
push edx
push ecx
push eax
lea ebx, [esp + 0x28]
call fcn.100321c0
call fcn.1000df50
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x10031490
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x100d788b
mov eax, dword fs:[0]
push eax
push ebp
push edi
mov eax, dword [0x1013d900]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1c]
push 0x5c
call fcn.10032528
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x100314d8
push eax
call fcn.10030fa0
jmp 0x100314da
xor eax, eax
mov ecx, ebp
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x80], eax
lea edi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100314f0
sub ecx, edi
push ecx
push ebp
lea ecx, [eax + 8]
call fcn.100058b0
mov eax, dword [esi + 0x80]
mov dword [eax + 4], 0
mov ecx, dword [esi + 0x80]
push 9
push str.GET_test1
add ecx, 0x3c
call fcn.100058b0
lea ecx, [esi + 0x54]
push ecx
push 0
push esi
push 0x10031670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x58], eax
test eax, eax
je 0x10031550
cmp eax, 0xffffffff
je 0x10031550
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0xc
ret 4

Function at 0x10031570
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x100d785b
mov eax, dword fs:[0]
push eax
sub esp, 8
push edi
mov eax, dword [0x1013d900]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, edx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100315a0
sub eax, edi
push eax
push edx
lea ecx, [esi + 0x64]
call fcn.100058b0
push 0x5c
call fcn.10032528
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0
test eax, eax
je 0x100315d5
push eax
call fcn.10030fa0
jmp 0x100315d7
xor eax, eax
mov ecx, ebx
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 0x80], eax
lea edi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100315f0
sub ecx, edi
push ecx
push ebx
lea ecx, [eax + 8]
call fcn.100058b0
mov eax, dword [esi + 0x80]
mov dword [eax + 4], 1
mov ecx, dword [esi + 0x80]
push 0xa
push str.POST_test1
add ecx, 0x3c
call fcn.100058b0
lea ecx, [esi + 0x54]
push ecx
push 0
push esi
push 0x10031690
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x58], eax
test eax, eax
je 0x10031650
cmp eax, 0xffffffff
je 0x10031650
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x14
ret
Function at 0x10032da6
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x100d45aa
call fcn.1005dae4
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x10032dcb
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10032e11
lea ecx, [ebp - 0x10]
call fcn.10019ab0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100485f5
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10019c70
mov eax, esi
call fcn.1005dbbc
ret 8

Function at 0x1003b104
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x1003b14b
call fcn.1003dd19
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1003b14b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1003b167
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1003ac7c
mov esi, eax
test edi, edi
je 0x1003b165
test ebx, ebx
je 0x1003b165
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1003bd72
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x1003bdba
call fcn.1003dd19
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1003bdba
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x1003bdfd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x1003bde6
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x1003bde6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x1003bdfa
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1004d08b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.1003dd19
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1004d0c4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.1004ccd7
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x10056c06
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1013d900]
jne 0x10056c10
repz ret
jmp fcn.10060bbf

Function at 0x1006c346
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100619fb
and dword [ebp - 4], 0
cmp dword [0x1014e164], 0
mov ebx, eax
jne 0x1006c3f7
push 0x100dfe60
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1006c4a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100dfe54
push edi
call esi
test eax, eax
je 0x1006c4a8
push eax
call fcn.10061989
mov dword [esp], 0x100dfe44
push edi
mov dword [0x1014e164], eax
call esi
push eax
call fcn.10061989
mov dword [esp], 0x100dfe30
push edi
mov dword [0x1014e168], eax
call esi
push eax
call fcn.10061989
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x1014e16c], eax
call esi
push eax
call fcn.10061989
pop ecx
mov dword [0x1014e174], eax
test eax, eax
je 0x1006c3f7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10061989
pop ecx
mov dword [0x1014e170], eax
mov eax, dword [0x1014e170]
cmp eax, ebx
je 0x1006c44f
cmp dword [0x1014e174], ebx
je 0x1006c44f
push eax
call fcn.10061a04
push dword [0x1014e174]
mov esi, eax
call fcn.10061a04
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1006c44f
test edi, edi
je 0x1006c44f
call esi
test eax, eax
je 0x1006c446
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1006c446
test byte [ebp - 0xc], 1
jne 0x1006c44f
or dword [ebp + 0x10], 0x200000
jmp 0x1006c488
mov eax, dword [0x1014e168]
cmp eax, ebx
je 0x1006c488
push eax
call fcn.10061a04
pop ecx
test eax, eax
je 0x1006c488
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1006c488
mov eax, dword [0x1014e16c]
cmp eax, ebx
je 0x1006c488
push eax
call fcn.10061a04
pop ecx
test eax, eax
je 0x1006c488
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1014e164]
call fcn.10061a04
pop ecx
test eax, eax
je 0x1006c4a8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1006c4aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10071de2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100619fb
and dword [ebp - 4], 0
cmp dword [0x1014e2ec], 0
mov ebx, eax
jne 0x10071e93
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10071f44
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10071f44
push eax
call fcn.10061989
mov dword [esp], 0x100dfe44
push edi
mov dword [0x1014e2ec], eax
call esi
push eax
call fcn.10061989
mov dword [esp], 0x100dfe30
push edi
mov dword [0x1014e2f0], eax
call esi
push eax
call fcn.10061989
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1014e2f4], eax
call esi
push eax
call fcn.10061989
pop ecx
mov dword [0x1014e2fc], eax
test eax, eax
je 0x10071e93
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10061989
pop ecx
mov dword [0x1014e2f8], eax
mov eax, dword [0x1014e2f8]
cmp eax, ebx
je 0x10071eeb
cmp dword [0x1014e2fc], ebx
je 0x10071eeb
push eax
call fcn.10061a04
push dword [0x1014e2fc]
mov esi, eax
call fcn.10061a04
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10071eeb
test edi, edi
je 0x10071eeb
call esi
test eax, eax
je 0x10071ee2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10071ee2
test byte [ebp - 0xc], 1
jne 0x10071eeb
or dword [ebp + 0x10], 0x200000
jmp 0x10071f24
mov eax, dword [0x1014e2f0]
cmp eax, ebx
je 0x10071f24
push eax
call fcn.10061a04
pop ecx
test eax, eax
je 0x10071f24
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10071f24
mov eax, dword [0x1014e2f4]
cmp eax, ebx
je 0x10071f24
push eax
call fcn.10061a04
pop ecx
test eax, eax
je 0x10071f24
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1014e2ec]
call fcn.10061a04
pop ecx
test eax, eax
je 0x10071f44
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10071f46
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10077d70
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1013d900]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10077dc2
mov eax, dword [esp]
cmp al, 2
jne 0x10077dbc
shr eax, 8
cmp al, 2
jne 0x10077dbc
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10056c06
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.10056c06
add esp, 0x194
ret
Function at 0x10078f60
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x10078f82
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x10078f76
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x10078fb2
cmp dword [esi + 8], 0
jne 0x10078fa5
mov ecx, dword [eax + 8]
push 0x1012c5f8
push ecx
call fcn.1005a56d
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x10078fa5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.1005cfd0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10078fd4
mov eax, dword [esi + 8]
test eax, eax
je 0x10078fce
push eax
call fcn.1005a125
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x10084170
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x100841a2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x10084300
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x1008431b
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x1008434f
cmp eax, 2
jg 0x1008434f
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x100e2158]
push 2
push edx
call fcn.10059b86
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.10059b86
add esp, 0x20
xor eax, eax
ret

Function at 0x10084920
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edx, dword [eax + 0x29c]
push ebx
mov ebx, dword [eax + ecx*4 + 0x168]
push esi
lea esi, [ecx + 0x19]
shl esi, 4
add esi, eax
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x3c], 3
je 0x100849c9
cmp dword [eax + ecx*4 + 0x180], 0x10084660
jne 0x100849c9
cmp dword [esi], 0
je 0x1008495e
test edi, edi
je 0x100849c9
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.100796e0
add esp, 0x10
cmp eax, 0xffffffff
je 0x100849c9
test al, 1
je 0x100849c9
cmp dword [esi], 0
jne 0x100849a7
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x1013ed24]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100849c2
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x100849c9
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
ret

Function at 0x100849d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esi + ecx*4 + 0x168]
mov eax, esi
call fcn.10084920
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x10084a54
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x10084a2b
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.10089eb0
mov edx, dword [esi]
push eax
push str.Send_failure:__s
push edx
call fcn.100844e0
mov eax, dword [esi]
mov dword [eax + 0x8628], ebp
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100865a0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x474], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x100865de
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.10084450
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x478]
push edx
mov dword [esp + 0xc], 1
call fcn.1009d770
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x47c]
push eax
call fcn.1009d770
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x10086657
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.10084450
add esp, 0x10
add esp, 0x14
ret
Function at 0x10086c50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1013d900]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
cmp dword [ebp + 0x8c], 2
push edi
mov edi, dword [ebp]
mov dword [esp + 0xc], edi
je 0x10086dd2
cmp dword [ebp + 0x218], 0
push ebx
push esi
jne 0x10086dc7
cmp dword [ebp + 0x280], 0
jne 0x10086dc7
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x10086ce9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.10089eb0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.100844e0
add esp, 0x18
jmp 0x10086dd0
push ebx
lea edx, [esp + 0x1c]
push 0
push edx
mov dword [esp + 0x1c], ebx
call fcn.1005e2a0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10086d36
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.10089eb0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.100844e0
add esp, 0x18
jmp 0x10086dd0
lea edi, [ebp + 0xcc]
lea ebx, [ebp + 0xfc]
lea esi, [esp + 0x98]
call fcn.10086c10
test eax, eax
jne 0x10086d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.10089eb0
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.100844e0
add esp, 0x18
jmp 0x10086dd0
lea edi, [ebp + 0x58]
mov ecx, 0xb
lea esi, [ebp + 0xcc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [ebp + 0x130]
lea edi, [ebp + 0x100]
lea esi, [esp + 0x18]
call fcn.10086c10
test eax, eax
jne 0x10086dc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.10089eb0
push eax
mov eax, dword [esp + 0x20]
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push eax
call fcn.100844e0
add esp, 0x18
jmp 0x10086dd0
push ebp
call fcn.10086bb0
add esp, 4
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
xor ecx, esp
call fcn.10056c06
add esp, 0x10c
ret

Function at 0x10086df0
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x10086e39
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.10089eb0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.10084450
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.10084450
add esp, 8
pop edi
pop esi
ret