joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10050320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x10050333
mov eax, dword [esi]
jmp 0x10050335
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1005035d
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.10050200
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x10050374
mov dword [edi], 0
call fcn.10127920
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x100503ab
push esi
call fcn.10050000
add esp, 4
test al, al
je 0x100503a0
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x10050730
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x1005073c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1005077a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1005077a
cmp eax, 3
je 0x1005077a
cmp eax, 0x7b
je 0x1005077a
cmp eax, 0xf
je 0x1005077a
cmp eax, 0x15
je 0x1005077a
cmp eax, 0x57
je 0x1005077a
cmp eax, 0xa1
je 0x1005077a
cmp eax, 0x35
je 0x1005077a
xor al, al
ret
mov al, 1
ret

Function at 0x10050780
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x1005078c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100507ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100507ca
cmp eax, 3
je 0x100507ca
cmp eax, 0x7b
je 0x100507ca
cmp eax, 0xf
je 0x100507ca
cmp eax, 0x15
je 0x100507ca
cmp eax, 0x57
je 0x100507ca
cmp eax, 0xa1
je 0x100507ca
cmp eax, 0x35
je 0x100507ca
xor al, al
ret
mov al, 1
ret
Function at 0x100508f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101720b0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x101c6270]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x10050931
mov eax, dword [edi]
jmp 0x10050933
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x10050952
push esi
push edi
push ebx
call fcn.10050200
add esp, 0xc
jmp 0x10050a9c
test eax, 0x400
je 0x10050a5b
cmp dword [edi + 0x14], 8
jb 0x10050967
mov edx, dword [edi]
jmp 0x10050969
mov edx, edi
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10050982
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.10004470
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x100509e1
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10004630
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
cmp esi, 0xffffffff
jne 0x10050a10
push dword [ebp - 0x34]
push edi
push ebx
call fcn.10050200
add esp, 0xc
jmp 0x10050a9c
push edi
call fcn.10050000
add esp, 4
test al, al
jne 0x10050a43
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.10050100
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10050a9c
push esi
mov dword [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10050a6d
mov dword [esi], 0
call fcn.10127920
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x10050a84
mov dword [ebp - 0x30], 2
call fcn.10050100
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010f54f
mov esp, ebp
pop ebp
ret
Function at 0x10050f00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172148
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101c6270]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x41]
mov edi, dword [ebp + 8]
push ecx
push 0
push 0
push eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
lea ecx, [ebp - 0x54]
call fcn.1004e490
mov esi, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
cmp esi, ecx
mov dword [ebp - 4], 0
sete al
test al, al
jne 0x10050fb7
sub ecx, esi
sar ecx, 1
push ecx
push esi
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x10050fb7
mov ecx, esi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10050f94
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10004470
lea ecx, [ebp - 0x28]
mov eax, 1
jmp 0x10050fd3
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov eax, 2
movups xmm0, xmmword [ecx]
mov dword [edi + 0x10], 0
xor edx, edx
mov dword [edi + 0x14], 0
or eax, 4
movups xmmword [edi], xmm0
movq xmm0, qword [ecx + 0x10]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
movq qword [edi + 0x10], xmm0
mov word [ecx], dx
test al, 2
je 0x1005102f
and eax, 0xfffffffd
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
cmp ecx, 8
jb 0x1005102f
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.10004630
mov eax, dword [ebp - 0x48]
test al, 1
je 0x10051060
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x1005104c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10004630
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 3
test esi, esi
je 0x1005107c
mov ecx, dword [ebp - 0x4c]
sub ecx, esi
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x54]
call fcn.10004630
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010f54f
mov esp, ebp
pop ebp
ret

Function at 0x10052ea0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x101c6270]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10052ef5
mov eax, dword [esp]
cmp al, 2
jne 0x10052eef
shr eax, 8
cmp al, 2
jne 0x10052eef
call fcn.100694a0
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.1010f54f
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 2
xor ecx, esp
call fcn.1010f54f
add esp, 0x194
ret
Function at 0x100566d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017265f
mov eax, dword fs:[0]
push eax
sub esp, 0x8bc
mov eax, dword [0x101c6270]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x82c], 0
cmp byte [0x101cdba8], 0
je 0x100568d8
cmp dword [ebp + 0xc], 0
je 0x100568d8
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.1012bf20
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.10001770
push dword [eax + 4]
push dword [eax]
call fcn.10131b58
add esp, 0x1c
mov dword [ebp - 0x8c8], 0x1017f44c
push 0
lea eax, [ebp - 0x8c4]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x878]
mov dword [ebp - 0x82c], 1
mov dword [ebp - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 0x87c], 0x48
call fcn.1000a7c0
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x8cc], eax
lea eax, [ebp - 0x8c4]
mov ecx, eax
mov dword [ebp - 0x830], eax
call fcn.10009ba0
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebp - 0x88c], 0
mov dword [ebp - 0x888], 4
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 4
push eax
push 0x1017f454
push edi
call fcn.10056680
add esp, 4
push eax
lea eax, [ebp - 0x8c8]
push 0x1017f45c
push eax
call fcn.10032870
add esp, 8
push eax
call fcn.10056bd0
add esp, 8
push eax
call fcn.10032870
add esp, 8
push eax
call fcn.10032870
push eax
call fcn.10032b20
add esp, 0xc
lea eax, [ebp - 0x828]
lea ecx, [ebp - 0x8c8]
push eax
call fcn.10057160
cmp dword [eax + 0x14], 8
jb 0x1005686b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x10056890
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.10004630
xor eax, eax
mov dword [ebp - 0x818], 0
lea ecx, [ebp - 0x878]
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
call fcn.10056fd0
lea eax, [ebp - 0x878]
mov dword [ebp - 4], 5
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.101110c6
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010f54f
mov esp, ebp
pop ebp
ret
Function at 0x10056900
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101726ca
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x101c6270]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x42c], 0
cmp byte [0x101cdba8], 0
je 0x10056ad8
cmp dword [ebp + 0xc], 0
je 0x10056ad8
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.1012bf20
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.10001770
push dword [eax + 4]
push dword [eax]
call fcn.10131b10
add esp, 0x1c
mov dword [ebp - 0x4c8], 0x1017ee2c
push 0
lea eax, [ebp - 0x4c4]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x42c], 1
mov dword [ebp - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov dword [ebp - 0x47c], 0x48
call fcn.10029fb0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x4cc], eax
lea eax, [ebp - 0x4c4]
mov ecx, eax
mov dword [ebp - 0x430], eax
call fcn.10029ef0
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 4
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 4
push eax
push 0x1017f49c
push edi
call fcn.10056680
add esp, 4
push eax
lea eax, [ebp - 0x4c8]
push str.Autodesk___AdskProxyManager
push eax
call fcn.100204d0
add esp, 8
push eax
call fcn.100204d0
add esp, 8
push eax
call fcn.100204d0
add esp, 8
push eax
call fcn.100204d0
push eax
call fcn.10020760
add esp, 0xc
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x4c8]
push eax
call fcn.1004d450
cmp dword [eax + 0x14], 0x10
jb 0x10056a9b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x428]
call fcn.1000d980
lea ecx, [ebp - 0x478]
call fcn.1004a2b0
lea eax, [ebp - 0x478]
mov dword [ebp - 4], 5
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.101110c6
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010f54f
mov esp, ebp
pop ebp
ret
Function at 0x1005e000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [eax]
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005e010
sub ecx, edx
mov esi, 0x811c9dc5
mov edx, 0
je 0x1005e036
movzx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x1005e025
push 0x1f31d
and esi, 0x7fffffff
push esi
call fcn.1013f515
imul ecx, eax, 0xb14
add esp, 8
imul edx, edx, 0x41a7
pop edi
pop esi
sub edx, ecx
lea eax, [edx + 0x7fffffff]
js 0x1005e064
mov eax, edx
ret 4

Function at 0x10066d80
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10066d9c
cmp dword [esi + 0x6c], 0
je 0x10066d9c
push 2
push 3
push esi
call fcn.10073d20
add esp, 0xc
push dword [esp + 0xc]
call fcn.100bebf0
add esp, 4
test esi, esi
je 0x10066dbd
cmp dword [esi + 0x6c], 0
je 0x10066dbd
push 3
push esi
call fcn.10073d60
add esp, 8
pop esi
ret

Function at 0x100676b0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2c8], 2
je fcn.10067660
mov al, 1
ret
Function at 0x10070f60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x101c6270]
xor eax, esp
mov dword [esp + 0x104], eax
push edi
mov edi, dword [esp + 0x110]
cmp byte [edi + 0x500], 0
jne 0x10070f92
cmp dword [edi + 0x160], 0
je 0x10071049
push esi
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x11c]
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.100c5970
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10070fc0
sub esi, ecx
mov ecx, dword [edi + 0x160]
test ecx, ecx
je 0x10070ff5
cmp byte [edi + 0x48c0], al
jne 0x10070ff5
lea edx, [esp + 8]
nop
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x10070fe0
mov byte [edi + 0x48c0], 1
cmp byte [edi + 0x500], 0
je 0x10071048
mov byte [esp + esi + 8], 0xa
inc esi
cmp esi, 0x102
jae 0x100710a0
cmp dword [edi + 0x1d0], 0
mov byte [esp + esi + 8], 0
je 0x1007105f
push 1
push edi
call fcn.10061ef0
push dword [edi + 0x15c]
lea eax, [esp + 0x14]
push esi
push eax
mov eax, dword [edi + 0x1d0]
push 0
push edi
call eax
push 0
push edi
call fcn.10061ef0
add esp, 0x24
pop esi
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1010f54f
add esp, 0x108
ret
push dword [edi + 0x158]
push 1
push 2
push 0x10181b60
call fcn.10139c36
push dword [edi + 0x158]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.10139c36
mov ecx, dword [esp + 0x12c]
add esp, 0x20
pop esi
pop edi
xor ecx, esp
call fcn.1010f54f
add esp, 0x108
ret
call fcn.10110134
int3

Function at 0x100710b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x101c6270]
xor eax, esp
mov dword [esp + 0x804], eax
push edi
mov edi, dword [esp + 0x810]
test edi, edi
je 0x1007118e
cmp byte [edi + 0x500], 0
je 0x1007118e
push esi
lea eax, [esp + 0x81c]
push eax
push dword [esp + 0x81c]
lea eax, [esp + 0x10]
push 0x801
push eax
call fcn.100c5970
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10071110
sub esi, ecx
cmp dword [edi + 0x1d0], 0
je 0x10071163
push 1
push edi
call fcn.10061ef0
push dword [edi + 0x15c]
lea eax, [esp + 0x14]
push esi
push eax
mov eax, dword [edi + 0x1d0]
push 0
push edi
call eax
push 0
push edi
call fcn.10061ef0
add esp, 0x24
pop esi
pop edi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.1010f54f
add esp, 0x808
ret
push dword [edi + 0x158]
push 1
push 2
push 0x10181b60
call fcn.10139c36
push dword [edi + 0x158]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.10139c36
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.1010f54f
add esp, 0x808
ret
Function at 0x100713f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x1a8]
call fcn.10071a00
add esp, 8
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [ebp], 0
cmp ebx, 0xffffffff
jne 0x10071476
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x1007144e
pop edi
pop esi
mov dword [ebp], 0x51
xor eax, eax
pop ebp
pop ebx
ret
push esi
push edi
call fcn.100c82c0
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.10070f60
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x48c4], esi
mov eax, ebx
mov dword [ebp], 0x37
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10071a00
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
shl eax, 4
mov ebp, dword [ebx + ecx*4 + 0x1a8]
lea esi, [ebx + 0x1cc]
add esi, eax
mov eax, dword [ebx + 0x2c0]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x10071ab8
cmp dword [ebx + ecx*4 + 0x1bc], 0x10071350
jne 0x10071ab8
cmp dword [esi], 0
je 0x10071a4c
test edi, edi
je 0x10071ab8
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.10070a30
add esp, 0x14
cmp eax, 0xffffffff
je 0x10071ab8
test al, 1
je 0x10071ab8
cmp dword [esi], 0
jne 0x10071aa1
mov eax, dword [ebx]
mov eax, dword [eax + 0x4c0]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x101c6038]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x10071aa1
pop edi
mov dword [esi + 4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10071ab8
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10071ac0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x1d0], 0
je 0x10071b04
push esi
push 1
push edi
call fcn.10061ef0
push dword [edi + 0x15c]
mov eax, dword [edi + 0x1d0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.10061ef0
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x10071b3d
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x10181b60
push 2
push eax
call fcn.10139c36
push dword [edi + 0x158]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.10139c36
add esp, 0x20
xor eax, eax
pop edi
ret
Function at 0x100726a0
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [esp + 0x20]
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x100726e8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.100c82c0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.100710b0
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.100710b0
add esp, 8
pop edi
pop esi
ret

Function at 0x10072820
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x108
mov eax, dword [0x101c6270]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
push ebp
cmp dword [ebx + 0x94], 2
mov ebp, dword [ebx]
je 0x100729d7
cmp byte [ebx + 0x27a], 0
push esi
push edi
jne 0x100729cc
cmp byte [ebx + 0x296], 0
jne 0x100729cc
mov esi, dword [esp + 0x120]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x98]
mov dword [esp + 0x14], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x100728b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.100c82c0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebp
call fcn.10070f60
add esp, 0x18
jmp 0x100729d5
push 0x80
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x80
push 0
push eax
call fcn.1012bf20
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10072908
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.100c82c0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebp
call fcn.10070f60
add esp, 0x18
jmp 0x100729d5
lea eax, [ebx + 0x138]
push eax
lea esi, [ebx + 0x10a]
lea eax, [esp + 0x98]
push esi
push eax
call fcn.10071e70
add esp, 0xc
test al, al
jne 0x10072955
call fcn.1013dae1
mov esi, dword [eax]
call fcn.1013dae1
push esi
push ebx
mov edi, eax
call fcn.100c82c0
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.10070f60
add esp, 0x18
jmp 0x100729d5
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movups xmmword [ebx + 0x60], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebx + 0x70], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [ebx + 0x80], xmm0
mov dword [ebx + 0x88], eax
mov ax, word [esi + 0x2c]
mov word [ebx + 0x8c], ax
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebx + 0x13c]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10071e70
add esp, 0xc
test al, al
jne 0x100729cc
call fcn.1013dae1
mov esi, dword [eax]
call fcn.1013dae1
push esi
push ebx
mov edi, eax
call fcn.100c82c0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.10070f60
add esp, 0x18
jmp 0x100729d5
push ebx
call fcn.10072420
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x10c]
pop ebp
pop ebx
xor ecx, esp
call fcn.1010f54f
add esp, 0x108
ret