joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4040a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4040d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040653e
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40410c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40410c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040653e
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4041e3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x404134
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x404140
movsx eax, bl
jmp 0x404178
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4041a2
sub eax, 1
je 0x4041a2
sub eax, 2
jne 0x4041e3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040653e
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4041c0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4041e3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040653e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040653e
mov esp, ebp
pop ebp
ret 4
Function at 0x405070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40512c
cmp byte [esi + 0x3d], 0
je 0x40512c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40511a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4050e1
sub eax, 1
je 0x4050e5
sub eax, 2
jne 0x40511a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040653e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405103
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40511a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040653e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040653e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040653e
mov esp, ebp
pop ebp
ret
Function at 0x406f3a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406f79
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406f79
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406f79
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406f79
cmp dword [ecx + 0x74], 0xe
jbe 0x406f79
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x7d5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d506a
add dl, dl
jne 0x7d5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d50dc
xor eax, eax
add dl, dl
jne 0x7d5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d517d
add dl, dl
jne 0x7d50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d5075
mov eax, 1
add dl, dl
jne 0x7d50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d50e1
sub eax, ebx
mov ebx, 1
jne 0x7d5128
mov ecx, 1
add dl, dl
jne 0x7d510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d5136
cmp eax, 0x7d00
jae 0x7d516d
cmp eax, 0x500
jb 0x7d5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d5075
cmp eax, 0x7f
ja 0x7d5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x45033cb
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xa347023
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1000377e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [eax + 0x70], 0
mov dword [eax + 0x4c], ecx
jne 0x10003791
mov dword [eax + 0x70], 1
mov dword [eax + 0x54], ecx
mov edx, ecx
sub edx, dword [eax + 0x54]
cmp edx, 0x2710
jge 0x100037a6
cmp edx, 0xffffd8f0
jge 0x100037ab
mov dword [eax + 0x54], ecx
xor edx, edx
test edx, edx
js 0x100037ca
mov edx, dword [eax + 0x50]
add dword [eax + 0x54], edx
push esi
push edi
mov edi, ecx
sub edi, dword [eax + 0x54]
pop edi
pop esi
js 0x100037c5
add edx, ecx
mov dword [eax + 0x54], edx
jmp fcn.1000335d
ret

Function at 0x10004462
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edi, edi
push edi
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 2
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
cmp eax, edi
jne 0x1000449b
call fcn.100043e1
jmp 0x100044d8
mov ecx, dword [ebp - 0xc]
push 4
pop edx
push edi
push ecx
push edi
push edi
push edx
push eax
mov dword [esi + 4], ecx
mov dword [esi + 0x18], edx
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi], eax
cmp eax, edi
jne 0x100044d6
call fcn.100043e1
push dword [esi + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
mov eax, ebx
jmp 0x100044d8
xor eax, eax
pop edi
pop ebx
leave
ret 4

Function at 0x100045e4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x10045390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 6
and dword [ebp - 0x8c], 0
pop ecx
xor eax, eax
lea edi, [esi + 2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0xa8]
rep stosd dword es:[edi], eax
movzx eax, word [esi]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x84]
push 3
mov dword [ebp - 0x88], eax
push edx
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0xac], 0xc00
call fcn.10004ac9
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xac]
push eax
push 0
push dword [ebp - 0x88]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
lea eax, [ebp - 0x84]
cmp dword [ebp - 0x88], eax
je 0x1000467f
push dword [ebp - 0x88]
call fcn.1001ccb3
pop ecx
test edi, edi
je 0x1000468e
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
jmp 0x100046ec
mov eax, dword [ebp - 0x8c]
xor edi, edi
jmp 0x100046a8
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x100046ae
cmp ecx, 0x17
je 0x100046ae
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x10004698
jmp 0x100046c0
push dword [eax + 0x10]
push dword [eax + 0x18]
push esi
call fcn.1001ff30
xor edi, edi
add esp, 0xc
inc edi
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x100046df
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
jmp 0x100046ea
push 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001c645
leave
ret
Function at 0x10004771
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1000479d
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push dword [ebp + 0xc]
lea esi, [ebp - 0x24]
push eax
call fcn.100046fa
add esp, 0xc
pop esi
leave
ret

Function at 0x100047b6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
test edi, edi
je 0x100047d1
push dword [ebp + 8]
call fcn.100043f6
jmp 0x100047ec
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x100047f8
call fcn.100043e1
jmp 0x100047fc
mov dword [esi], eax
xor eax, eax
test eax, eax
js 0x10004858
lea eax, [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x1000481d
call fcn.100043e1
test eax, eax
js 0x1000481f
xor eax, eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
test eax, eax
js 0x10004858
test edx, edx
jne 0x10004831
test ecx, ecx
je 0x1000484a
xor eax, eax
cmp edx, eax
ja 0x1000484a
jb 0x1000483e
cmp ecx, dword [ebp + 0x10]
ja 0x1000484a
push dword [esi]
mov esi, dword [ebp + 0xc]
call fcn.10004462
jmp 0x10004858
or ecx, edx
mov eax, 0x800703ee
je 0x10004858
mov eax, 0x800700df
pop edi
pop esi
leave
ret

Function at 0x1000485c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
xor eax, eax
inc eax
cmp dword [ebp + 0xc], 0
push esi
push edi
mov dword [ebp - 8], eax
jne 0x10004894
lea eax, [ebp - 8]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
push eax
push 0xfffffffffffffffb
mov esi, 0xffff
push esi
push dword [ebp + 8]
call edi
mov ebx, eax
lea eax, [ebp - 4]
jmp 0x100048c2
cmp dword [ebp + 0xc], eax
jne 0x1000489e
lea eax, [ebp - 4]
jmp 0x10004877
cmp dword [ebp + 0xc], 2
jne 0x100048d1
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 4]
push eax
push 0xfffffffffffffffb
mov esi, 0xffff
push esi
push dword [ebp + 8]
call edi
mov ebx, eax
lea eax, [ebp - 8]
push 4
push eax
push 4
push esi
push dword [ebp + 8]
call edi
or ebx, eax
jmp 0x100048dc
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
or ebx, 0xffffffff
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10004d2e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0xcc]
test eax, eax
je 0x10004e9e
mov eax, edi
call fcn.10004f1f
test eax, eax
je 0x10004e9e
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0xd0]
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov word [ebp - 0x20], ax
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
inc ebx
xor esi, esi
push edi
lea edx, [ebp - 0x20]
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], 5
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], ebx
mov dword [ebp - 4], esi
call fcn.10004f75
test eax, eax
je 0x10004e5a
push dword [ebp + 0x18]
lea eax, [ebp - 0x20]
push eax
push edi
lea eax, [ebp - 0x3c]
call fcn.10006d58
test eax, eax
je 0x10004e49
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [edi + 0x1c]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x94]
cmp eax, 2
je 0x10004e2f
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
call fcn.100050e1
test eax, eax
je 0x10004e1e
lea eax, [edi + 0x4c]
push eax
push esi
push edi
push 0x10005211
push esi
push esi
call fcn.1001dafd
add esp, 0x18
mov dword [edi + 0x48], eax
cmp eax, esi
je 0x10004e0f
push dword [edi + 4]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x10004e97
push 0x65f
push str.CTcpClient::Start
push edi
push 8
jmp 0x10004e69
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CTcpClient::Start
push edi
push 0xb
jmp 0x10004e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x10004e3e
mov eax, 0x4c7
push eax
push str.CTcpClient::Start
push edi
push 5
jmp 0x10004e69
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CTcpClient::Start
push edi
push 4
jmp 0x10004e69
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CTcpClient::Start
push edi
push 3
pop esi
call fcn.10005b3f
and dword [edi + 0xc], 0
and dword [edi + 0x14], 0
mov dword [edi + 0x10], 5
mov dword [edi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop esi
pop ebx
jmp 0x10004ea0
xor eax, eax
pop edi
leave
ret 0x14
Function at 0x100050e1
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, eax
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x1000514f
push 0x30
push dword [edi + 0x20]
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x10005208
xor eax, eax
cmp word [esi], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
push esi
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebx
je 0x10005143
cmp eax, 0xffffffff
jne 0x100051fc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x100051fc
mov dword [ebp - 4], 1
jmp 0x10005208
mov eax, dword [edi + 0x1c]
lea ecx, [ebp + 8]
push ecx
xor ebx, ebx
push 0x8004667e
inc ebx
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x10005176
push 0x80004005
call fcn.10001257
xor eax, eax
cmp word [esi], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
push esi
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
test esi, esi
je 0x100051a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
jne 0x10005208
cmp esi, 0xffffffff
jne 0x100051b7
push dword [edi + 0x2c]
mov esi, dword [edi + 0x1c]
call fcn.10004905
pop ecx
mov esi, eax
test esi, esi
jne 0x10005201
push 0x23
push dword [edi + 0x20]
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x10005208
mov dword [edi + 0x54], ebx
push esi
mov dword [edi + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x98]
cmp eax, 2
jne 0x100051fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100051f9
mov eax, 0x4c7
push eax
jmp 0x10005202
mov dword [ebp - 4], ebx
jmp 0x10005208
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4

Function at 0x100054b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
jmp 0x10005514
mov eax, dword [esi + 0x64]
push 0
push dword [esi + 0x30]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x1000550b
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x64]
mov edx, dword [esi]
push edi
push eax
mov ecx, esi
call dword [edx + 0xa8]
cmp eax, 2
jne 0x10005514
push dword [esi + 0x24]
call fcn.10004be3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100054ff
mov eax, 0x4c7
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], eax
jmp 0x1000553d
cmp edi, 0xffffffff
je 0x10005520
test edi, edi
je 0x10005532
mov eax, dword [esi + 0x194]
test eax, eax
je 0x100054b3
jmp 0x1000552d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x100054ff
xor eax, eax
inc eax
pop edi
ret
and dword [esi + 0x14], 0
mov dword [esi + 0x10], 5
xor ecx, ecx
inc ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0xc], ecx
xor eax, eax
pop edi
ret
Function at 0x10005662
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
jmp 0x100056ee
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov edx, dword [esi + 0x30]
sub eax, ecx
cmp eax, edx
jl 0x1000567c
mov eax, edx
push 0
push eax
push ecx
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test ebx, ebx
jle 0x100056e9
lea eax, [esi + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x190], ebx
lea eax, [esi + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi + 0x14]
mov edx, dword [esi]
push ebx
push eax
mov ecx, esi
call dword [edx + 0xa0]
cmp eax, 2
jne 0x100056d4
push dword [esi + 0x24]
call fcn.10004be3
pop ecx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
sub eax, ecx
cmp eax, ebx
jl 0x100056e2
mov eax, ebx
add ecx, eax
mov dword [edi + 0x14], ecx
jmp 0x100056ee
cmp ebx, 0xffffffff
je 0x10005702
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
jne 0x1000566b
xor eax, eax
inc eax
pop ebx
pop ebp
ret 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1000571a
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x100056fa
xor ecx, ecx
inc ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], ecx
xor eax, eax
jmp 0x100056fd