joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043590
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ebx
call fcn.10033c60
mov esi, dword [ebp + 0x10]
mov word [esi], ax
test ax, ax
je 0x100435b6
mov edi, dword [ebp + 0x14]
push ebx
call fcn.10033da0
jmp 0x100435c1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, ebx
call fcn.10033eb0
add esp, 4
test eax, eax
je 0x100435f8
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10043606
cmp word [eax], 0
je 0x10043606
mov edi, dword [ebp + 0x1c]
xor ebx, ebx
call fcn.100344b0
test eax, eax
je 0x100435f8
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [edi]
je 0x10043601
push 0x273f
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18
mov ebx, dword [ebp + 0xc]
mov esi, ecx
movzx eax, word [esi]
push 0x11
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], eax
cmp eax, 0xffffffff
je 0x100435f8
push 0
push 0
lea ecx, [ebp + 0xc]
push ecx
push 0
push 0
push 4
lea edx, [ebp + 0x10]
push edx
push 0x9800000c
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x10043664
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10043664
test eax, eax
je 0x10043664
push 0x80004005
call fcn.10002670
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x5c]
call fcn.1003afe0
mov ax, word [ebp + 0x14]
pop edi
mov word [esi + 0x60], ax
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x18
Function at 0x10043690
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
mov edi, eax
cmp dword [ebp + 8], ebx
je 0x100436fb
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x100437bd
mov edx, dword [esi + 0x14]
xor eax, eax
cmp word [edi], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
push edi
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x100437b8
cmp eax, 0xffffffff
jne 0x100436f1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x100437b8
xor ebx, ebx
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 4
xor eax, eax
cmp word [edi], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
mov eax, dword [esi + 0x14]
push edi
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100437bd
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x100437bd
mov eax, 1
mov dword [esi + 0x40], eax
push 0
mov dword [esi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x78]
mov ecx, esi
call edx
cmp eax, 2
jne 0x10043778
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10043769
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 4
mov eax, dword [esi + 0x14]
xor edi, edi
push edi
push edi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1004379e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x1004379e
xor edi, edi
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.10033ad0
add esp, 4
test edi, edi
je 0x100437b8
push 0x80004005
call fcn.10002670
mov ebx, 1
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x10043b00
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x184]
mov ecx, dword [esi + 0x2c]
inc dword [esi + 0x184]
cmp eax, ecx
jb 0x10043b2b
mov dword [esi + 8], 1
mov dword [esi + 0xc], 5
mov dword [esi + 0x10], 0x2746
xor eax, eax
ret
mov edx, dword [esi + 0x14]
push edi
xor edi, edi
push edi
push edi
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10043b52
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10043b52
xor edi, edi
mov eax, dword [esi + 0x1c]
push eax
call fcn.10033ad0
add esp, 4
test edi, edi
je 0x10043b77
mov dword [esi + 0x10], edi
mov dword [esi + 8], 1
mov dword [esi + 0xc], 5
xor eax, eax
pop edi
ret
mov eax, 1
pop edi
ret
Function at 0x10043d10
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x10043d32
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10043d46
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 8], 1
mov dword [esi + 0xc], 2
mov dword [esi + 0x10], eax
xor eax, eax
ret
mov eax, 1
mov dword [esi + 0x40], eax
push 0
mov dword [esi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x78]
mov ecx, esi
call edx
cmp eax, 2
je 0x10043daf
mov eax, dword [esi + 0x14]
push edi
xor edi, edi
push edi
push edi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10043d8e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10043d8e
xor edi, edi
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.10033ad0
add esp, 4
test edi, edi
pop edi
je 0x10043da9
push 0x80004005
call fcn.10002670
mov eax, 1
ret
mov dword [esi + 8], 0
mov dword [esi + 0xc], 5
mov dword [esi + 0x10], 0
xor eax, eax
ret

Function at 0x10043dd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esi + 0x180]
push ebx
push edi
test eax, eax
jne 0x10043e8d
xor ebx, ebx
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x14]
push ebx
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, ebx
jle 0x10043e4f
push ebx
mov dword [esi + 0x184], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x50]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x88]
mov ecx, esi
call eax
cmp eax, 2
jne 0x10043e6a
mov eax, dword [esi + 0x1c]
push eax
call fcn.10033ad0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x10043e39
mov eax, 0x4c7
mov dword [esi + 0x10], eax
pop edi
mov dword [esi + 0xc], 4
xor eax, eax
mov dword [esi + 8], 1
pop ebx
ret
cmp edi, 0xffffffff
je 0x10043e80
cmp edi, ebx
jne 0x10043e6a
mov ecx, dword [esi + 0x1c]
push ecx
mov dword [esi + 0x184], ebx
call fcn.10033ad0
add esp, 4
mov edx, dword [esi + 0x180]
test edx, edx
je 0x10043de2
pop edi
mov eax, 1
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10043e39
pop edi
mov eax, 1
pop ebx
ret
Function at 0x10043ea0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10136968
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x101b2070]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esi + 0x64]
mov dword [esp + 0xc], eax
xor edi, edi
xor ebx, ebx
cmp dword [esi + 0x160], edi
jle 0x10043f3c
lea eax, [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x160], edi
jle 0x10043f2f
mov ebx, dword [esi + 0x164]
cmp ebx, dword [esi + 0x168]
je 0x10043f0f
mov eax, dword [ebx + 4]
mov dword [esi + 0x164], eax
mov dword [eax + 8], edi
jmp 0x10043f1f
cmp ebx, edi
je 0x10043f2f
mov dword [esi + 0x164], edi
mov dword [esi + 0x168], edi
cmp ebx, edi
je 0x10043f2f
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
dec dword [esi + 0x160]
lea eax, [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], edi
cmp ebx, edi
je 0x10044037
lea eax, [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x18]
sub eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x14]
push edi
push eax
push ecx
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x10043f7b
sub dword [esi + 0x17c], edi
lea eax, [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jle 0x10043fb8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebx + 0x14]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x80]
mov ecx, esi
call eax
cmp eax, 2
jne 0x10043fbd
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.10033ad0
add esp, 4
jmp 0x10043fbd
cmp edi, 0xffffffff
je 0x10043fe4
mov edi, dword [esp + 0xc]
push ebx
add edi, 0x1c
call fcn.10041140
test eax, eax
jne 0x10043ed2
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10043ed2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1004404e
lea edi, [esi + 0x148]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x164]
xor ecx, ecx
cmp eax, ecx
je 0x10044018
mov dword [eax + 8], ebx
mov ecx, dword [esi + 0x164]
mov dword [ebx + 4], ecx
jmp 0x10044024
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [esi + 0x168], ebx
inc dword [esi + 0x160]
push edi
mov dword [esi + 0x164], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0xc]
push ebx
add edi, 0x1c
mov dword [esi + 8], 1
mov dword [esi + 0xc], 3
mov dword [esi + 0x10], eax
call fcn.10041140
test eax, eax
jne 0x1004407d
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100443e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10136a08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x101b2070]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1004453e
cmp dword [ebp + 0xc], esi
jle 0x1004453e
mov eax, dword [ebx]
mov edx, dword [eax + 0x44]
call edx
test eax, eax
jne 0x1004444b
mov eax, 0x139f
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x18], eax
add ebx, 0x64
mov eax, ebx
mov dword [esp + 0x14], esi
call fcn.10001850
mov edi, eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
cmp dword [ebp + 0xc], 0
mov dword [esp + 0x38], esi
jle 0x10044537
mov eax, dword [ebp + 8]
mov ecx, dword [eax + esi*8]
test ecx, ecx
jle 0x100444c3
mov edx, dword [eax + esi*8 + 4]
mov eax, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x18]
jg 0x100444cd
mov eax, dword [edi + 0x10]
add eax, dword [edi + 0xc]
mov edx, dword [edi + 0x18]
sub eax, edx
mov ebx, eax
cmp eax, ecx
jl 0x100444ad
mov ebx, ecx
test ebx, ebx
jle 0x100444c3
mov eax, dword [esp + 0x1c]
push ebx
push eax
push edx
call fcn.1011fc70
add esp, 0xc
add dword [edi + 0x18], ebx
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x10044478
mov eax, dword [esp + 0x14]
test eax, eax
jle 0x10044537
cmp eax, dword [esp + 0x18]
jg 0x10044537
mov esi, dword [esp + 0x20]
lea edi, [esp + 0x24]
call fcn.10044560
mov esi, eax
test esi, esi
je 0x100444f1
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [esp + 0x28]
xor ecx, ecx
test esi, esi
sete cl
mov esi, ecx
test ebx, ebx
je 0x10044520
mov edi, dword [esp + 0x24]
push ebx
add edi, 0x1c
call fcn.10041140
test eax, eax
jne 0x10044520
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, 0x5b6
jmp 0x100444ea
mov eax, 0x57
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10044db0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
test eax, eax
je 0x10044dc7
cmp word [eax], 0
jne 0x10044dcc
mov eax, str.0.0.0.0
push edi
xor ecx, ecx
lea edi, [ebp - 0x28]
mov word [ebp - 0x28], cx
call fcn.100344b0
test eax, eax
je 0x10044eea
mov ax, word [ebp - 0x28]
push 0x11
movzx edx, ax
push 2
push edx
mov word [esi + 0x11c], ax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x124], eax
cmp eax, 0xffffffff
je 0x10044eea
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 4
lea edx, [ebp - 8]
push edx
push 0x9800000c
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x10044e52
call edi
cmp eax, 0x2733
je 0x10044e52
test eax, eax
je 0x10044e52
push 0x80004005
call fcn.10002670
mov ecx, dword [esi + 0x124]
xor eax, eax
cmp word [ebp - 0x28], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
lea eax, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x10044ecf
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
mov edx, dword [esi]
mov eax, dword [esi + 0x124]
mov edx, dword [edx + 0xd8]
push eax
mov ecx, esi
call edx
cmp eax, 2
je 0x10044eab
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10044eba
mov eax, 0x4c7
push eax
mov dword [esi + 0x130], 5
call edi
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
call edi
push eax
mov dword [esi + 0x130], 4
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov dword [esi + 0x130], 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10044f50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jbe 0x100450a2
push esi
push edi
push 0
push 0
push ebx
push 0x10046490
push 0
push 0
call fcn.1011d9a7
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x10045082
mov eax, dword [ebx + 0x138]
lea esi, [ebx + 0x134]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x1004500c
mov edx, dword [esi]
cmp edx, ecx
ja 0x1004500c
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x10044ffc
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x10045078
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x10044ffc
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x10044feb
xor ecx, ecx
jmp 0x10044fed
add ecx, edx
cmp ecx, eax
jae 0x10044ff3
mov ecx, eax
push ecx
call fcn.100373b0
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x10045058
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x10045058
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x1004504f
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x10045078
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x1004504f
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x1004503e
xor ecx, ecx
jmp 0x10045040
add ecx, edx
cmp ecx, eax
jae 0x10045046
mov ecx, eax
push ecx
call fcn.100373b0
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x10045058
mov dword [eax], edi
mov eax, dword [ebp - 8]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebx + 0x10]
jb 0x10044f74
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.vector_T__too_long
call fcn.1011ba3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebx + 0x130], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [ebp - 0xc], 0
pop esi
mov eax, dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10045ae0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ecx + 0x124]
xor eax, eax
lea edx, [ebp - 4]
mov word [ebp - 0x20], ax
push edx
lea eax, [ebp - 0x20]
push eax
push ecx
mov dword [ebp - 4], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10045b14
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push ecx
push edx
lea ecx, [ebp + 0x10]
lea eax, [ebp - 0x20]
call fcn.100343d0
add esp, 8
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10045b40
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [ecx + 0x178]
test edi, edi
je 0x10045bd6
mov eax, dword [ebp + 8]
dec eax
xor edx, edx
div dword [ecx + 0x174]
push esi
mov esi, dword [ecx + 0x1b8]
movzx esi, byte [esi + edx]
cmp eax, esi
pop esi
jne 0x10045bd6
mov edx, dword [edi + edx*4]
mov eax, 0xf
cmp eax, edx
sbb eax, eax
neg eax
cmp eax, 1
jne 0x10045bd6
test edx, edx
je 0x10045bd6
cmp dword [edx + 0x30], 0
je 0x10045bd6
mov ecx, dword [ecx + 0x124]
xor edx, edx
lea eax, [ebp - 4]
mov word [ebp - 0x20], dx
push eax
lea edx, [ebp - 0x20]
push edx
push ecx
mov dword [ebp - 4], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x10045bd6
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push eax
push ecx
lea ecx, [ebp + 8]
lea eax, [ebp - 0x20]
call fcn.100343d0
add esp, 8
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10047220
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
sub esp, 8
xor eax, eax
cmp dword [ebx + 0x90], ecx
jle 0x10047353
push esi
push edi
jmp 0x10047242
xor ecx, ecx
mov esi, dword [ebx + 0x94]
cmp esi, dword [ebx + 0x98]
je 0x1004725e
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x94], eax
mov dword [eax + 0x30], ecx
jmp 0x1004726e
cmp esi, ecx
je 0x1004727e
mov dword [ebx + 0x94], ecx
mov dword [ebx + 0x98], ecx
cmp esi, ecx
je 0x1004727e
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
dec dword [ebx + 0x90]
mov eax, dword [esi + 0x1c]
sub dword [ebx + 0x40], eax
lea edi, [esi + 0x1c]
push eax
lea eax, [ebx + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov ecx, dword [ebx + 8]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0xc]
mov dword [esi + 0x38], edx
mov ecx, dword [ebx + 0x10]
lea eax, [esi + 0x34]
mov dword [eax + 8], ecx
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov ecx, dword [ecx + 0x124]
xor edx, edx
cmp word [eax], 2
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
setne dl
push 0
push esi
mov dword [esi + 0x18], 3
dec edx
and edx, 0xfffffff4
add edx, 0x1c
mov dword [esi + 0x50], edx
mov edx, dword [esi + 0x50]
push edx
push eax
push 0
lea eax, [ebp - 8]
push eax
push 1
push edi
push ecx
mov dword [esi + 0x28], 2
call dword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x10047303
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
je 0x1004731f
mov eax, dword [ebp - 4]
test eax, eax
je 0x10047344
cmp eax, 0x3e5
je 0x10047340
mov edi, dword [ebp + 8]
push esi
add edi, 0x58
call fcn.10041140
test eax, eax
jne 0x1004733d
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10047351
cmp dword [ebx + 0x90], 0
jg 0x10047240
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10047360
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push edi
mov ecx, esi
mov edi, 1
call edx
test eax, eax
jne 0x1004737f
xor edi, edi
mov eax, edi
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
add eax, 8
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x124]
push 0
push 0
push 0
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x100473d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x100473d5
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov ecx, esi
xor edi, edi
call eax
test eax, eax
je 0x10047378
push 0x80004005
call fcn.10002670
mov ecx, dword [ebp + 8]
push ecx
call fcn.10033ad0
add esp, 4
mov eax, edi
pop edi
pop ebp
ret 8
Function at 0x1006af90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.1011fc40
mov edx, dword [esp + 8]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0x64]
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
inc edi
test byte [ecx + 0x34], 1
je 0x1006afdb
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 8]
lea ebx, [edi + ecx]
cmp ebx, eax
jbe 0x1006afcb
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
add dword [esi + 0x14], ecx
add dword [esi + 0x18], ecx
sub eax, ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], eax
jmp 0x1006afe6
mov eax, dword [esp + 0x18]
cmp edi, dword [eax + 8]
ja 0x1006afc4
mov esi, eax
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
movzx ebx, byte [ecx + eax - 1]
mov ecx, dword [edx + 0xb0]
push ecx
call fcn.100e0fd0
push eax
call fcn.1007b790
add esp, 8
test eax, 0x200000
je 0x1006b01f
or edx, 0xffffffff
sub edx, ebx
add dword [esi + 8], edx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esi + 8]
lea eax, [ebx + edi]
mov esi, ebp
sub esi, eax
xor esi, eax
mov ecx, ebp
xor ecx, eax
or esi, ecx
xor esi, ebp
shr esi, 0x1f
mov eax, 0x100
dec esi
mov dword [esp + 0x18], eax
cmp ebp, eax
jae 0x1006b04b
mov eax, ebp
mov dword [esp + 0x18], ebp
xor edi, edi
test eax, eax
je 0x1006b0a7
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x14]
mov ecx, ebx
shr ecx, 0x1f
lea edx, [eax + ebp - 1]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], edx
lea esp, [esp]
mov edx, ebx
sub edx, edi
shr edx, 0x1f
mov eax, edi
shr eax, 0x1f
xor dl, al
xor cl, al
or dl, cl
mov ecx, dword [esp + 0x10]
xor dl, cl
dec dl
movzx eax, dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx]
dec dword [esp + 0x24]
xor edx, ebx
and eax, edx
not eax
inc edi
and esi, eax
cmp edi, dword [esp + 0x18]
jb 0x1006b070
mov eax, dword [esp + 0x1c]
not esi
and esi, 0xff
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
and ecx, esi
neg ecx
inc ebx
and ebx, ecx
sub ebp, ebx
mov dword [eax + 8], ebp
pop ebp
mov eax, ecx
pop edi
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
pop ecx
ret