joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453d48
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453ef3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x453ed4
mov dl, 1
mov eax, dword [0x4156c4]
call fcn.0040332c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004040ac
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x453ec3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00441aec
test al, al
je 0x453eb6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x453f04
lea eax, [ebp - 0x254]
call fcn.004090e4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x453eb6
xor eax, eax
push ebp
push 0x453eaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x453f3c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x453e98
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040431c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x453e98
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040431c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453eb6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x453db9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00419200
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453efa
lea eax, [ebp - 0x260]
call fcn.004040ac
ret

Function at 0x454828
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x472bb4]
cmp byte [eax + 0xa5], 0
jne 0x454899
cmp dword [0x472bcc], 0
jne 0x45485a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4547e4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x472bcc], eax
cmp dword [0x472bc8], 0
jne 0x454875
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x472bc8], eax
cmp dword [0x472bd0], 0
jne 0x454899
push esp
push 0
push 0
push 0x454788
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x472bd0], eax
pop edx
ret
Function at 0x454990
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4549a7
add esp, 0xfffffff0
call fcn.00403680
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d010
mov eax, dword [0x4710c4]
cmp word [eax + 2], 0
jne 0x4549cf
mov eax, dword [0x4710c4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00456110
mov eax, dword [0x471184]
cmp word [eax + 2], 0
jne 0x4549e9
mov eax, dword [0x471184]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00456308
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4152a8]
call fcn.0040332c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4152a8]
call fcn.0040332c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f5e4]
call fcn.00426f30
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x454b70
mov eax, dword [0x470fd0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00427300
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4568b8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x470fd0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c834
test eax, eax
je 0x454ade
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408ad8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c85c
test eax, eax
je 0x454af2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040431c
mov eax, dword [0x470e90]
cmp byte [eax], 0
jne 0x454b26
mov eax, ebx
call fcn.00454c98
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00456a94
mov eax, ebx
call fcn.00457458
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x454b66
call fcn.004036d8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454f18
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x472bb4]
cmp dword [eax + 0x30], 0
je 0x454fc2
cmp dword [ebx + 0x94], 0
jne 0x454fbc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x454ea8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x454fbc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x454f82
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x454fbc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417634
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x454f91
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x455b24
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x455b59
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040419c
jmp 0x455b66
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404100
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x456c70
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x456cb1
mov eax, esi
call fcn.0043d1ac
test al, al
je 0x456cb1
mov eax, dword [ebx + 0x84]
call fcn.0043cea8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456cb1
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043cea8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x462164
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040455c
xor eax, eax
push ebp
push 0x4621fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004040ac
mov eax, dword [ebp - 4]
call fcn.0040436c
test eax, eax
jle 0x4621dd
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dl, byte [edx + ecx - 1]
xor dl, 0x10
and edx, 0xff
sub edx, 0xf
call fcn.00404294
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00404374
mov eax, dword [ebp - 8]
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4621a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462202
lea eax, [ebp - 0x14]
call fcn.004040ac
lea eax, [ebp - 4]
call fcn.004040ac
ret
Function at 0x469b94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x469c6c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
dec eax
test eax, eax
jb 0x469c6c
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add eax, dword [edx + 0x20]
mov edx, dword [ebp - 0x20]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x469c64
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add eax, dword [edx + 0x24]
mov edx, dword [ebp - 0x20]
add edx, edx
add eax, edx
mov ax, word [eax]
mov word [ebp - 0x2e], ax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
movzx edx, word [ebp - 0x2e]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
jmp 0x469c6c
inc dword [ebp - 0x20]
dec dword [ebp - 0x38]
jne 0x469bfb
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x46ad34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
test dl, dl
je 0x46ad46
add esp, 0xfffffff0
call fcn.00403680
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push 0x46ae38
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x46ae16
mov dword [ebp - 0x1c], 0x105
mov eax, dword [ebp - 0x1c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00406d54
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x46ae74
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x46ae0d
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x46ae04
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x415870]
call fcn.004196a0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0046ae90
mov eax, dword [ebp - 0x10]
call fcn.0040335c
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x46ae2e
call fcn.004036d8
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100015be
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xb8]
sub esp, 0x134
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp + 0xb4], eax
push esi
mov esi, dword [sym.imp.ws2_32.dll_select]
xor ecx, ecx
lea edx, [ebp - 0x7c]
push edx
push ecx
push ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
lea ecx, [ebp - 0x6c]
lea eax, [edi + 1]
push ecx
push eax
mov byte [ebp - 0x6d], 0
mov dword [ebp - 0x74], 0x1c
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], 1
call esi
test eax, eax
jle 0x10001671
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_recvfrom]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x98]
push eax
push 2
push 1
lea eax, [ebp - 0x6e]
push eax
push edi
call ebx
cmp eax, 0xffffffff
jne 0x10001670
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x10001670
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x98]
push eax
push 0
push 1
lea eax, [ebp - 0x6e]
push eax
push edi
call ebx
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [edi + 1]
push eax
mov byte [ebp - 0x6d], 1
call esi
test eax, eax
jg 0x10001618
pop ebx
mov ecx, dword [ebp + 0xb4]
mov al, byte [ebp - 0x6d]
xor ecx, ebp
pop esi
call fcn.1000c212
add ebp, 0xb8
leave
ret

Function at 0x100016d6
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
push edi
push 2
push 0x17
mov dword [ebp - 8], edi
mov dword [ebp - 4], 1
call dword [sym.imp.ws2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001715
push str.Socket_creation_failed
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call fcn.10002e31
or eax, 0xffffffff
jmp 0x10001788
push 4
lea eax, [ebp - 8]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10001748
push str.Socket_creation_failed
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call fcn.10002e31
push esi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x10001710
push edi
push 1
push esi
call dword [sym.imp.kernel32.dll_SetHandleInformation]
push 4
lea eax, [ebp - 4]
push eax
push 0x20
push 0xffff
push esi
call fcn.10002e31
push edi
push edi
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x9800000c
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.ws2_32.dll_WSAIoctl]
mov eax, esi
pop edi
pop esi
leave
ret 0xc
Function at 0x10001814
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
inc ecx
push ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call fcn.10002e31
test eax, eax
jne 0x1000189a
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10001878
push str.connect
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call fcn.10002e31
jmp 0x1000189a
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x28]
push eax
push 0x9800000c
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_WSAIoctl]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000c212
leave
ret 0x14

Function at 0x100018a9
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
push 0x1c
lea eax, [ebp - 0x20]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
push 0
push 0
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push 0x9800000c
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_WSAIoctl]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c212
leave
ret 0xc

Function at 0x1000190c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x10001954
push str.JVM_GetSockName
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call fcn.10002e31
or eax, 0xffffffff
jmp 0x10001962
movzx eax, word [ebp - 0x1e]
push eax
call dword [sym.imp.ws2_32.dll_ntohs]
movzx eax, ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000c212
leave
ret 0xc

Function at 0x10001971
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x100019b8
push str.Error_getting_socket_name
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call fcn.10002e31
xor eax, eax
jmp 0x100019c6
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.10002e31
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000c212
leave
ret 0xc
Function at 0x10001ced
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x7ac]
sub esp, 0x82c
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp + 0x7a8], eax
cmp byte [ebp + 0x7d4], 0
mov eax, dword [ebp + 0x7c0]
push esi
mov esi, dword [ebp + 0x7b4]
lea ecx, [ebp - 0x74]
push edi
mov edi, dword [ebp + 0x7c8]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7cc]
mov dword [ebp - 0x78], 0x1c
mov dword [ebp - 0x7c], ecx
je 0x10001d45
and dword [ebp - 0x7c], 0
and dword [ebp - 0x78], 0
jmp 0x10001d64
push 1
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp + 0x7d0]
push eax
push esi
call fcn.10002e31
test eax, eax
jne 0x10001de8
push ebx
cmp edi, 0x800
jle 0x10001d93
mov eax, 0x10000
cmp edi, eax
jle 0x10001d78
mov edi, eax
push edi
call dword [sym.imp.msvcr100.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x10001d96
push str.Native_heap_allocation_failed
push esi
call sub.java.dll__JNU_ThrowOutOfMemoryError_8
jmp 0x10001de7
lea ebx, [ebp - 0x58]
mov eax, dword [esi]
push ebx
push edi
push dword [ebp + 0x7c4]
push dword [ebp - 0x80]
push esi
call dword [eax + 0x320]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push 0
push edi
push ebx
push dword [ebp + 0x7bc]
call dword [sym.imp.ws2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x10001dd7
push str.Datagram_send_failed
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call fcn.10002e31
cmp edi, 0x800
jle 0x10001de7
push ebx
call dword [sym.imp.msvcr100.dll_free]
pop ecx
pop ebx
mov ecx, dword [ebp + 0x7a8]
pop edi
xor ecx, ebp
pop esi
call fcn.1000c212
add ebp, 0x7ac
leave
ret 0x24

Function at 0x10001f9e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
xor eax, eax
cmp byte [ebp + 0x10], al
push esi
sete al
push 0
inc eax
push eax
push 0x17
call fcn.1000b86d
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x10001fdc
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call fcn.10002e31
or eax, esi
jmp 0x10002013
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10002006
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call fcn.10002e31
push 0
push 1
push esi
call dword [sym.imp.kernel32.dll_SetHandleInformation]
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x10002086
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push 1
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call fcn.10002e31
test eax, eax
jne 0x10002108
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1000210b
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x100020e3
push 0xfffffffffffffffe
pop eax
jmp 0x1000210b
cmp eax, 0x2741
jne 0x100020fc
push str.connect:_Address_is_invalid_on_local_machine__or_port_is_not_valid_on_remote_machine
push str.java_net_ConnectException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x10002108
push str.connect
push eax
push esi
call fcn.10002e31
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000c212
leave
ret 0x14

Function at 0x1000211a
Capabilities:
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp + 0x198], eax
xor eax, eax
inc eax
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0x1b0]
cdq
mov ecx, 0x3e8
idiv ecx
push ebx
push esi
mov esi, dword [ebp + 0x1ac]
push edi
mov edi, dword [ebp + 0x1a4]
xor ebx, ebx
mov dword [ebp - 0x78], 4
mov dword [ebp - 0x6c], esi
mov dword [ebp + 0x98], esi
mov dword [ebp - 0x80], eax
imul edx, edx, 0x3e8
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x94]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x7c], edx
call dword [sym.imp.ws2_32.dll_select]
mov dword [ebp - 0x74], eax
cmp eax, ebx
jne 0x100021b8
push str.connect_timed_out
push str.java_net_SocketTimeoutException
push edi
call sub.java.dll__JNU_ThrowByName_12
push 2
push esi
call dword [sym.imp.ws2_32.dll_shutdown]
jmp 0x1000221b
lea eax, [ebp + 0x94]
push eax
push esi
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x1000221b
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x1007
push 0xffff
push esi
call fcn.10002e31
cmp dword [ebp - 0x74], 0
jne 0x1000220d
push 0
call dword [sym.imp.kernel32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x100021c9
cmp dword [ebp - 0x74], 0
jne 0x1000220d
push str.Unable_to_establish_connection
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x1000221b
push str.connect
push dword [ebp - 0x74]
push edi
call fcn.10002e31
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
add ebp, 0x19c
leave
ret 0x10