joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4082b2
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]

Function at 0x408570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00408272
fsubr qword [edx - 0x7f]
mov al, byte [0x50c0458d]
call fcn.00408282
push eax
push esi
push dword [ebp + 8]
call fcn.00408237
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00408272
jno 0x408604
cld
sub al, 0x8d
inc ebp
call 0x5128e368
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
invalid
inc ebp

Function at 0x408698
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00408282
push eax
push esi
push dword [ebp + 8]
call fcn.00408237
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00408272
xchg esi, eax
and ah, dl
xchg ebx, eax
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00408272
or eax, 0x8d5c71d9
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x10002970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1000b060
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x30], 0
cmp esi, 0x201
jae 0x10002a00
jmp 0x100029ee
jbe 0x10002a94
cmp esi, 0x201
jae 0x10002a00
mov dword [ebp - 0x28], 0x200
lea ebx, [ebp - 0x448]
mov edi, esi
jmp 0x10002a3b
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x10002a2c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, edi
push esi
call fcn.101f12c0
add esp, 4
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x10002a5f
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x10002af7
cmp esi, edi
jne 0x100029e0
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10002b16
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x100029ee
jmp 0x10002a00
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x10002b33
lea eax, [ebp - 0x48]
push esi
push ebx
push eax
call fcn.10003dc0
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x10002ae1
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.10001010
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], getpeername
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x10002ad1
jmp 0x10002ae1
mov dword [ebp - 0x10], 0
push 0x1029b6f4
push 0x28
push 0x1029a804
call fcn.101f16d0
add esp, 0xc
jmp 0x10002b42
push 0x1029b6e4
push eax
push esi
call fcn.101f1a50
add esp, 0xc
ud2
Function at 0x10008590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x100085d4
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x100085da
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x10008616
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x1000863b
test eax, eax
js 0x10008625
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x10008631
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1029b2ec
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.10003b00
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.100018a0
mov ecx, 7
int 0x29
ud2
Function at 0x10009cb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1000b270
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x102ac3b4]
test al, al
je 0x10009e81
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10009cfc
cmp eax, 3
jne 0x10009e7a
mov ebx, dword [0x102ac3b8]
test ebx, ebx
je 0x10009e7a
mov dword [ebp - 0x20], 0
jmp 0x10009d27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10009d58
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10009ecb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10009d20
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10009d20
test byte [ebp - 0x20], 1
je 0x10009e7a
mov ebx, dword [0x102ac3b8]
test ebx, ebx
je 0x10009e7a
mov dword [ebp - 0x20], 0
jmp 0x10009d87
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10009db8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10009ecb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10009d80
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10009d80
test byte [ebp - 0x20], 1
je 0x10009e7a
mov ebx, dword [0x102ac3b8]
test ebx, ebx
je 0x10009e7a
mov dword [ebp - 0x20], 0
jmp 0x10009de7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10009e18
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10009ecb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10009de0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10009de0
test byte [ebp - 0x20], 1
je 0x10009e7a
mov ebx, dword [0x102ac3b8]
test ebx, ebx
je 0x10009e7a
mov dword [ebp - 0x20], 0
jmp 0x10009e47
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10009e74
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10009ecb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10009e40
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10009e40
test byte [ebp - 0x20], 1
jne 0x10009e94
movzx eax, byte [0x102a2080]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x102ac3b8]
jmp 0x10009e9f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10009e7a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10009ecb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10009e9c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x10009e9c
mov dword [ebp - 0x10], 0
push 0x1029b6b0
push 0x2b
push 0x1029a590
call fcn.101f16d0
add esp, 0xc
ud2
Function at 0x1000ac60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x102ab214]
mov esi, ecx
test eax, eax
je 0x1000ac86
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x1000ac9f
cmp dword [eax + 4], 0
je 0x1000ac9f
add eax, 8
pop esi
pop edi
ret
push 0x102ab214
call fcn.101f1490
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x1000ac7a
mov eax, dword [0x102ab214]
test eax, eax
je 0x1000ad36
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1000ad53
mov edi, eax
test eax, eax
jne 0x1000acff
movzx eax, byte [0x102ab3c1]
push 4
push 0x10
call section..text
add esp, 8
test eax, eax
je 0x1000ad67
mov dword [eax], 0x102ab214
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x102ab214]
test eax, eax
je 0x1000ad58
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x1000ad1f
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x1000ad23
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x1000ad23
xor ecx, ecx
xor edx, edx
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x102ab214
call fcn.101f1490
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1000acbd
xor eax, eax
pop esi
pop edi
ret
push 0x102ab214
call fcn.101f1490
add esp, 4
jmp 0x1000acf7
push 0x10
push 4
call fcn.101f15e0
Function at 0x1000ad70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x102ab224]
mov esi, ecx
test eax, eax
je 0x1000ae4a
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x1000ad9d
cmp dword [eax + 4], 0
mov edi, eax
jne 0x1000ae45
mov eax, dword [0x102ab224]
test eax, eax
je 0x1000ae6c
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1000ae89
mov edi, eax
test eax, eax
jne 0x1000ae01
movzx eax, byte [0x102ab3c1]
push 4
push 0xc
call section..text
add esp, 8
test eax, eax
je 0x1000aea5
mov dword [eax], 0x102ab224
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x102ab224]
test eax, eax
je 0x1000ae93
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x1000ae16
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x1000ae18
mov eax, dword [esi + 4]
jmp 0x1000ae18
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x1000ae45
test ecx, ecx
je 0x1000ae45
lock dec dword [ecx]
jne 0x1000ae45
lea ecx, [esp + 4]
call fcn.10002350
add edi, 8
jmp 0x1000ae8b
push 0x102ab224
call fcn.101f1490
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x1000ad91
jmp 0x1000ad9d
push 0x102ab224
call fcn.101f1490
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1000adbb
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x102ab224
call fcn.101f1490
add esp, 4
jmp 0x1000adf9
push 0xc
push 4
call fcn.101f15e0
int3
Function at 0x1000aeb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x102ab234]
mov esi, ecx
test eax, eax
je 0x1000af8a
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x1000aedd
cmp dword [eax + 4], 0
mov edi, eax
jne 0x1000af85
mov eax, dword [0x102ab234]
test eax, eax
je 0x1000afac
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1000afc9
mov edi, eax
test eax, eax
jne 0x1000af41
movzx eax, byte [0x102ab3c1]
push 4
push 0xc
call section..text
add esp, 8
test eax, eax
je 0x1000afe5
mov dword [eax], 0x102ab234
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x102ab234]
test eax, eax
je 0x1000afd3
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x1000af56
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x1000af58
mov eax, dword [esi + 4]
jmp 0x1000af58
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x1000af85
test ecx, ecx
je 0x1000af85
lock dec dword [ecx]
jne 0x1000af85
lea ecx, [esp + 4]
call fcn.100022f0
add edi, 8
jmp 0x1000afcb
push 0x102ab234
call fcn.101f1490
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x1000aed1
jmp 0x1000aedd
push 0x102ab234
call fcn.101f1490
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1000aefb
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x102ab234
call fcn.101f1490
add esp, 4
jmp 0x1000af39
push 0xc
push 4
call fcn.101f15e0
int3
Function at 0x10014dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10014e28
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x10014e20
cmp ebx, ebp
ja 0x10014e9d
cmp ebp, dword [esp + 0x1c]
ja 0x10014ea9
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x10014e22
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x10014e10
jmp 0x10014e7f
ja 0x10014e28
cmp edx, edi
mov ebx, ebp
jne 0x10014de5
mov edx, dword [esp + 0x24]
test edx, edx
je 0x10014e83
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x10014e60
mov esi, edi
sub ecx, ebx
jns 0x10014e77
jmp 0x10014e85
cmp edi, edx
je 0x10014e8c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x10014e85
xor al, 1
cmp esi, edx
jne 0x10014e40
jmp 0x10014e85
xor eax, eax
jmp 0x10014e85
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1029ca08
push 0x2b
push 0x1029c31b
call fcn.101f16d0
push 0x1029ca18
push ebp
push ebx
call fcn.101f1ac0
push 0x1029ca18
push dword [esp + 0x20]
push ebp
call fcn.101f1a50
int3

Function at 0x1002ab80
Capabilities:
Initialize winsock library

Disassembly:
cmp dword [0x102ab488], 0
jne 0x1002ac19
push 0x190
push 0
push 0x102ab490
mov dword [0x102ab488], 1
call fcn.101eec70
add esp, 0xc
push 0x102ab490
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1002ac19
call fcn.10027460
push str.BIO_sock_init
push 0x99
push str.crypto_bio_bio_sock.c
call fcn.10027560
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10027670
call fcn.10027460
push str.BIO_sock_init
push 0x9b
push str.crypto_bio_bio_sock.c
call fcn.10027560
push 0
push 0x7a
push 0x20
call fcn.10027670
add esp, 0x24
or eax, 0xffffffff
ret
mov eax, 1
ret

Function at 0x1002ac20
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x1002ac75
call fcn.10027460
push str.BIO_socket_ioctl
push 0xf7
push str.crypto_bio_bio_sock.c
call fcn.10027560
add esp, 0xc
push str.calling_ioctlsocket__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10027670
add esp, 0xc
xor eax, eax
test esi, esi
pop esi
sete al
ret
Function at 0x1002ac80
Capabilities:
Get socket status

Disassembly:
mov eax, 0x110
call fcn.101ebae0
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
mov ebp, dword [esp + 0x11c]
push edi
mov edi, dword [esp + 0x11c]
cmp edi, 0x3f
ja 0x1002ad6d
push esi
mov esi, dword [esp + 0x128]
mov eax, esi
or eax, dword [esp + 0x12c]
jne 0x1002ace1
pop esi
pop edi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x110
ret
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
cmp dword [esp + 0x12c], edx
jg 0x1002ad14
jl 0x1002acfa
cmp esi, eax
jae 0x1002ad14
pop esi
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x110
ret
sub esi, eax
mov dword [esp + 0x18], edi
xor ecx, ecx
mov dword [esp + 0x14], 1
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
test ebp, ebp
mov dword [esp + 0x10], esi
push 0
lea eax, [esp + 0x1c]
cmovne eax, ecx
test ebp, ebp
push eax
lea eax, [esp + 0x20]
cmove eax, ecx
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x110
ret
mov ecx, dword [esp + 0x114]
or eax, 0xffffffff
pop edi
pop ebp
xor ecx, esp
call fcn.101ebfaa
add esp, 0x110
ret
Function at 0x1002bc70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x168
call fcn.101ebae0
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x170]
push ebp
mov ebp, dword [esp + 0x17c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0x10], eax
push edi
mov edi, dword [esp + 0x174]
test ebp, ebp
je 0x1002be89
push ebx
mov ebx, edi
mov eax, edi
push esi
shr ebx, 0x17
mov esi, 2
test edi, edi
push 0x1002b560
cmovs ebx, esi
shr eax, 0x17
push 0x102ab62c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], eax
call fcn.10027300
add esp, 8
neg eax
sbb eax, eax
test dword [0x102ab638], eax
je 0x1002bd46
mov eax, dword [esp + 0x10]
test edi, edi
push dword [0x102ab630]
cmovs eax, esi
movzx eax, al
shl eax, 0x17
mov dword [esp + 0x30], eax
call fcn.100272f0
add esp, 4
test eax, eax
je 0x1002bd46
lea eax, [esp + 0x2c]
push eax
push dword [0x102ab634]
call fcn.1003c670
push dword [0x102ab630]
mov esi, eax
call fcn.10027370
add esp, 0xc
test esi, esi
je 0x1002bd46
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x1002bd63
push ebx
push str.lib__lu_
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.10037fb0
lea eax, [esp + 0x44]
add esp, 0x10
mov dword [esp + 0x14], eax
mov esi, edi
test edi, edi
jns 0x1002bd91
push pe_nt_image_headers32
lea eax, [esp + 0x78]
and esi, 0x7fffffff
push eax
push esi
call fcn.1002da30
add esp, 0xc
lea ecx, [esp + 0x74]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x1002be15
push 0x1002b560
push 0x102ab62c
and esi, 0x7fffff
call fcn.10027300
add esp, 8
neg eax
sbb eax, eax
test dword [0x102ab638], eax
je 0x1002be19
mov eax, dword [esp + 0x10]
push dword [0x102ab630]
movzx eax, al
shl eax, 0x17
or eax, esi
mov dword [esp + 0x28], eax
call fcn.100272f0
add esp, 4
test eax, eax
je 0x1002bdfb
lea eax, [esp + 0x24]
push eax
push dword [0x102ab634]
call fcn.1003c670
push dword [0x102ab630]
mov ebx, eax
call fcn.10027370
add esp, 0xc
test ebx, ebx
jne 0x1002be12
lea eax, [esp + 0x24]
mov dword [esp + 0x24], esi
push eax
call fcn.1002bb00
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1002be19
mov eax, dword [ebx + 4]
test eax, eax
jne 0x1002be3c
mov eax, esi
and eax, 0xff83ffff
push eax
push str.reason__lu_
lea eax, [esp + 0x7c]
push pe_nt_image_headers32
push eax
call fcn.10037fb0
add esp, 0x10
lea eax, [esp + 0x74]
mov ebx, dword [esp + 0x1c]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
push str.error:_08lX:_s:_s:_s
push ebp
push ebx
call fcn.10037fb0
mov ecx, ebx
add esp, 0x1c
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002be60
sub ecx, edx
lea eax, [ebp - 1]
cmp ecx, eax
jne 0x1002be87
push esi
push 0
push dword [esp + 0x28]
push edi
push str.err:_lx:_lx:_lx:_lx
push ebp
push ebx
call fcn.10037fb0
add esp, 0x1c
pop esi
pop ebx
mov ecx, dword [esp + 0x16c]
pop edi
pop ebp
xor ecx, esp
call fcn.101ebfaa
add esp, 0x168
ret
Function at 0x1002cbf0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x230
call fcn.101ebae0
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x102ab748], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x1002c5f0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x1002c9a0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x1002c5a0
jne 0x1002cd56
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1002cd4c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
push str.ws2_32
lea eax, [esp + 0x38]
push 0x10c
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
mov esi, dword [sym.imp.kernel32.dll_LoadLibraryA]
lea eax, [esp + 0x40]
add esp, 0x18
push eax
call esi
mov ebp, dword [sym.imp.kernel32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.kernel32.dll_GetProcAddress]
test edi, edi
je 0x1002ccbf
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x1002cd06
push edi
call ebp
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
push str.wship6
lea eax, [esp + 0x38]
push 0x10c
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call esi
mov edi, eax
test edi, edi
je 0x1002cd48
push str.getaddrinfo
push edi
call ebx
test eax, eax
je 0x1002cd45
xor esi, esi
lea eax, [esp + 0x10]
nop dword [eax]
push dword [eax + esi*8]
push edi
call ebx
mov dword [esp + esi*8 + 0x14], eax
test eax, eax
je 0x1002cd45
inc esi
lea eax, [esp + 0x10]
cmp esi, 3
jl 0x1002cd10
mov eax, dword [esp + 0x14]
mov dword [0x102a7eb8], eax
mov eax, dword [esp + 0x1c]
mov dword [0x102a7ec0], eax
mov eax, dword [esp + 0x24]
mov dword [0x102a7ec8], eax
jmp 0x1002cd48
push edi
call ebp
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x102ab748], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
mov eax, dword [eax*8 + 0x102a7eb8]
call fcn.101ebfaa
add esp, 0x230
ret 4