joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63e0cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63e225
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x63e20a
mov eax, ebx
test eax, eax
je 0x63e105
sub eax, 4
mov eax, dword [eax]
jmp 0x63e107
xor eax, eax
mov edi, eax
test ebx, ebx
je 0x63e117
mov eax, ebx
sub eax, 0xa
movzx eax, word [eax]
jmp 0x63e11b
mov ax, 2
cmp ax, 1
jne 0x63e19c
test ebx, ebx
je 0x63e12f
mov eax, ebx
sub eax, 0xc
movzx eax, word [eax]
jmp 0x63e137
mov eax, dword [0x826bf8]
movzx eax, word [eax]
push edi
push 0
push 0
movzx eax, ax
mov ecx, ebx
xor edx, edx
call fcn.0040e2e4
mov edi, eax
cmp edi, 0x100
jle 0x63e15f
mov eax, edi
add eax, eax
call fcn.00406c64
mov esi, eax
jmp 0x63e165
lea esi, [ebp - 0x200]
test ebx, ebx
je 0x63e173
mov eax, ebx
sub eax, 0xc
movzx edx, word [eax]
jmp 0x63e17c
mov edx, dword [0x826bf8]
movzx edx, word [edx]
mov eax, ebx
test eax, eax
je 0x63e189
sub eax, 4
mov eax, dword [eax]
jmp 0x63e18b
xor eax, eax
push eax
push esi
push edi
movzx eax, dx
mov ecx, ebx
xor edx, edx
call fcn.0040e2e4
jmp 0x63e1d5
cmp edi, 0x100
jle 0x63e1b1
mov eax, edi
add eax, eax
call fcn.00406c64
mov esi, eax
jmp 0x63e1b7
lea esi, [ebp - 0x200]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0042396c
mov eax, dword [ebp - 0x204]
mov ecx, edi
add ecx, ecx
mov edx, esi
call fcn.00406eec
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x63e1f7
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x63e1e1
lea eax, [ebp - 0x200]
cmp esi, eax
je 0x63e20c
mov eax, esi
call fcn.00406c80
jmp 0x63e20c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63e22c
lea eax, [ebp - 0x204]
call fcn.00409c0c
ret

Function at 0x64d1c0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x64d1da
add esp, 0xfffffff0
call fcn.00408440
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x64d25b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, esi
xor edx, edx
mov eax, edi
call fcn.004b0664
xor edx, edx
mov eax, edi
call fcn.0064d590
xor edx, edx
mov eax, edi
call fcn.0064d650
xor eax, eax
mov dword [edi + 0x3c], eax
xor eax, eax
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [edi + 0x2c], eax
lea eax, [ebp - 0x10]
call fcn.00434f10
lea eax, [edi + 0x18]
lea edx, [ebp - 0x10]
call fcn.004358b8
mov byte [edi + 0x39], 0
mov byte [edi + 0x30], 1
lea eax, [edi + 0x10]
call fcn.00409c0c
mov eax, dword [0x63172c]
mov dword [edi + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64d262
lea eax, [ebp - 0x10]
call fcn.00434f24
ret
Function at 0x66cac4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
add esp, 0xffffffdc
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
xor edi, edi
xor esi, esi
cmp edi, dword [esp + 8]
jge 0x66cb88
mov eax, dword [esp]
movzx edx, byte [eax + esi]
inc esi
mov eax, dword [esp]
movzx eax, byte [eax + esi]
mov word [esp + 0xc], ax
inc esi
mov eax, 0x66cb90
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, edx
cmp cx, 0xff
ja 0x66cb13
movzx ecx, cx
bt dword [eax], ecx
setb al
test al, al
jne 0x66cb1e
mov al, 1
jmp 0x66cb42
mov eax, 0x66cb90
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
movzx ecx, word [esp + 0xc]
cmp cx, 0xff
ja 0x66cb3d
movzx ecx, cx
bt dword [eax], ecx
setb al
xor al, 1
test al, al
jne 0x66cb88
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
movzx eax, dx
movzx eax, byte [eax + 0x81eab4]
shl eax, 4
movzx edx, word [esp + 0xc]
add al, byte [edx + 0x81eab4]
mov byte [esp + 0x20], al
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x1c]
movzx edx, byte [esp + 0x20]
mov byte [eax], dl
inc edi
cmp edi, dword [esp + 8]
jl 0x66cae2
mov eax, edi
add esp, 0x24
pop edi
pop esi
ret

Function at 0x66cbb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
add esp, 0xffffffdc
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
xor edi, edi
xor esi, esi
cmp edi, dword [esp + 8]
jge 0x66cc74
mov eax, dword [esp]
movzx edx, word [eax + esi*2]
inc esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov word [esp + 0xc], ax
inc esi
mov eax, 0x66cc7c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, edx
cmp cx, 0xff
ja 0x66cbff
movzx ecx, cx
bt dword [eax], ecx
setb al
test al, al
jne 0x66cc0a
mov al, 1
jmp 0x66cc2e
mov eax, 0x66cc7c
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
movzx ecx, word [esp + 0xc]
cmp cx, 0xff
ja 0x66cc29
movzx ecx, cx
bt dword [eax], ecx
setb al
xor al, 1
test al, al
jne 0x66cc74
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
movzx eax, dx
movzx eax, byte [eax + 0x81eaeb]
shl eax, 4
movzx edx, word [esp + 0xc]
add al, byte [edx + 0x81eaeb]
mov byte [esp + 0x20], al
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x1c]
movzx edx, byte [esp + 0x20]
mov byte [eax], dl
inc edi
cmp edi, dword [esp + 8]
jl 0x66cbce
mov eax, edi
add esp, 0x24
pop edi
pop esi
ret

Function at 0x6cd524
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x6cd542
and ecx, ecx
jle 0x6cd542
push ebx
xor al, byte [edx]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x6cd52d
pop ebx
ret
Function at 0x6d0a3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x3c]
mov ebx, eax
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x24]
mov esi, dword [edx + 0x40]
shr esi, 1
push ebx
push esi
push esi
mov edx, eax
xor ecx, ecx
mov eax, dword [0x665080]
call fcn.006676f8
test esi, esi
jns 0x6d0a70
add esi, 3
sar esi, 2
add esi, 4
mov eax, esi
add eax, eax
add eax, eax
add ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov esi, dword [eax + 0x50]
add esi, esi
add esi, esi
sub esi, 5
test esi, esi
jl 0x6d0afe
inc esi
mov edi, dword [ebx]
mov eax, edi
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x821f3c]
mov edx, 8
call fcn.006cd4c0
and edi, 0xff
xor eax, dword [edi*4 + 0x821f3c]
push eax
mov eax, dword [ebx]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x821f3c]
mov edx, 0x10
call fcn.006cd4c0
pop edx
xor edx, eax
push edx
mov eax, dword [ebx]
shr eax, 0x18
mov eax, dword [eax*4 + 0x821f3c]
mov edx, 0x18
call fcn.006cd4c0
pop edx
xor edx, eax
mov dword [ebx], edx
add ebx, 4
dec esi
jne 0x6d0a93
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6d0f84
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov dword [ebp - 4], edx
lea eax, [ebp - 0x100]
xor ecx, ecx
mov edx, 0x80
call fcn.004077ac
mov dword [ebp - 8], 0x38
mov eax, str.80_
lea edx, [ebp - 0x48]
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
mov esi, 0x80
shr esi, cl
movzx ecx, bl
shr ecx, 3
add ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x6d0fdb
mov byte [edx], 1
jmp 0x6d0fde
mov byte [edx], 0
inc edx
inc eax
dec dword [ebp - 8]
jne 0x6d0fb3
xor eax, eax
mov dword [ebp - 8], eax
mov esi, 0x824bc2
cmp byte [ebp + 8], 0
je 0x6d1004
mov eax, 0xf
sub eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
jmp 0x6d100c
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
lea edx, [ebp - 0x80]
movzx ecx, byte [esi]
add ecx, eax
cmp ecx, 0x1c
jae 0x6d102b
movzx ecx, byte [ebp + ecx - 0x48]
mov byte [edx], cl
jmp 0x6d1032
movzx ecx, byte [ebp + ecx - 0x64]
mov byte [edx], cl
inc eax
inc edx
cmp eax, 0x1c
jne 0x6d1018
mov eax, 0x1c
lea edx, [ebp - 0x64]
movzx ecx, byte [esi]
add ecx, eax
cmp ecx, 0x38
jae 0x6d1054
movzx ecx, byte [ebp + ecx - 0x48]
mov byte [edx], cl
jmp 0x6d105b
movzx ecx, byte [ebp + ecx - 0x64]
mov byte [edx], cl
inc eax
inc edx
cmp eax, 0x38
jne 0x6d1041
mov ecx, 0x1000000
mov eax, 0x18
mov edx, 0x822374
shr ecx, 1
movzx ebx, byte [edx]
cmp byte [ebp + ebx - 0x80], 0
je 0x6d1087
mov ebx, dword [ebp - 0xc]
or dword [ebp + ebx*4 - 0x100], ecx
movzx ebx, byte [edx + 0x18]
cmp byte [ebp + ebx - 0x80], 0
je 0x6d109c
mov ebx, dword [ebp - 0x10]
or dword [ebp + ebx*4 - 0x100], ecx
inc edx
dec eax
jne 0x6d1071
inc dword [ebp - 8]
inc esi
cmp dword [ebp - 8], 0x10
jne 0x6d0fef
mov eax, dword [ebp + 0xc]
add eax, eax
add eax, eax
add dword [ebp + 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov ecx, eax
and ecx, 0xfc0000
shl ecx, 6
and eax, 0xfc0
shl eax, 0xa
or ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, edx
and eax, 0xfc0000
shr eax, 0xa
or ecx, eax
and edx, 0xfc0
shr edx, 6
or ecx, edx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
add dword [ebp + 0x10], 4
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov ecx, eax
and ecx, 0x3f000
shl ecx, 0xc
and eax, 0x3f
shl eax, 0x10
or ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, edx
and eax, 0x3f000
shr eax, 4
or ecx, eax
and edx, 0x3f
or ecx, edx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
add dword [ebp + 0x10], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jne 0x6d10bd
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6da9fc
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x6daa49
test esi, esi
jle 0x6daa49
push 0
push 0x3e8
mov eax, esi
cdq
call fcn.0040ba3c
mov dword [esp], eax
mov dword [esp + 4], edx
push 8
lea eax, [esp + 4]
push eax
push 0x1005
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
test eax, eax
sete al
neg al
sbb eax, eax
call fcn.0042ca08
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x6daa50
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x6daa99
push 0
push 0x3e8
mov eax, esi
cdq
call fcn.0040ba3c
mov dword [esp], eax
mov dword [esp + 4], edx
push 8
lea eax, [esp + 4]
push eax
push 0x1006
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
test eax, eax
sete al
neg al
sbb eax, eax
call fcn.0042ca08
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x6dab2c
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef4
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [esp + 8]
call fcn.006da354
lea edx, [esp + 8]
mov eax, ebx
call fcn.006da344
test esi, esi
jge 0x6dab57
xor esi, esi
jmp 0x6dab7a
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [esp], eax
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
mov esi, esp
push esi
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [ebx + 1]
push eax
call sub.wsock32.dll_select
test eax, eax
jge 0x6dab9c
call fcn.006da9f4
mov dword [edi], eax
xor eax, eax
jmp 0x6dabab
xor eax, eax
mov dword [edi], eax
lea edx, [esp + 8]
mov eax, ebx
call fcn.006da32c
add esp, 0x10c
pop edi
pop esi
pop ebx
ret

Function at 0x6db814
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, edx
lea edi, [esp]
push ecx
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop ecx
mov ebx, ecx
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x6db84b
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x6db84b
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
cmp esi, 0xffffffff
jne 0x6db85d
call sub.wsock32.dll_WSAGetLastError
mov edi, eax
xor eax, eax
mov dword [ebx], eax
jmp 0x6db8c9
xor edi, edi
mov edx, 0x20
mov eax, dword [0x662bcc]
call fcn.00665c00
mov dword [ebx], eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, 0x20
call fcn.004077ac
mov eax, dword [ebx]
mov edx, dword [esp + 8]
mov dword [eax + 8], edx
mov eax, dword [ebx]
mov edx, dword [esp + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebx]
mov edx, dword [esp + 4]
mov dword [eax + 4], edx
mov eax, dword [ebx]
mov ebp, 0x10
mov dword [eax + 0x10], ebp
mov edx, ebp
mov eax, dword [0x662bcc]
call fcn.00665c00
mov edx, dword [ebx]
mov dword [edx + 0x18], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
movzx edx, word [esp + 4]
mov word [eax], dx
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [eax + 4], esi
mov eax, edi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6dc90c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x20], edx
xor eax, eax
push ebp
push 0x6dc9dd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6dc9bf
call fcn.006dbaa8
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [eax + 8], ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
mov eax, ebx
xor edx, edx
call fcn.00429514
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 8]
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x10], 0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x6dc9f8
call fcn.00425870
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 4
call fcn.00409fec
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6dc9e4
lea eax, [ebp - 0x20]
call fcn.00409c0c
lea eax, [ebp - 4]
call fcn.00409c0c
ret
Function at 0x6dfe80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x6ddaa0]
call fcn.006de7d8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6dff8e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x1c]
push eax
call sub.kernel32.dll_InterlockedIncrement
mov dword [ebx], eax
call fcn.006dfb10
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebx + 0x28]
call fcn.0040a060
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
add eax, 0x34
mov edx, dword [ebx + 0xc]
call fcn.0040a060
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
mov edx, dword [ebx + 0x14]
call fcn.0040a060
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
add eax, 0x44
mov edx, dword [ebx + 0x1c]
call fcn.0040a060
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 4]
add eax, 0x4c
mov edx, dword [ebx + 0x24]
call fcn.0040a060
mov eax, dword [ebp - 4]
add eax, 0x50
mov edx, dword [ebx + 0x2c]
call fcn.0040a060
mov eax, dword [ebp - 4]
add eax, 0x54
mov edx, dword [ebx + 0x30]
mov ecx, dword [0x6dd690]
call fcn.0040c448
mov eax, dword [ebp - 4]
add eax, 0x58
mov edx, dword [ebx + 0x40]
mov ecx, dword [0x40fa58]
call fcn.0040c448
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.006e0080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6dffa5
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6f1a5c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x6f1c15
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00409c0c
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, 0x6f1c34
call fcn.0040adbc
sete byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
je 0x6f1ac4
lea eax, [ebp - 4]
call fcn.00409c0c
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ebx, eax
cmp ebx, 0xffffff99
je 0x6f1ad7
cmp ebx, 0xffffff97
je 0x6f1ad7
cmp ebx, 0x64
jl 0x6f1bcc
cmp byte [ebp - 0xd], 0
je 0x6f1aef
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x6f1c34
call fcn.0040ac84
jmp 0x6f1afa
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040a034
mov eax, dword [ebp - 8]
test eax, eax
je 0x6f1b06
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp ax, word [ebp + 0x10]
jne 0x6f1b38
mov eax, dword [ebp - 8]
movzx eax, word [eax + ebx*2 - 2]
cmp ax, word [ebp + 0xc]
jne 0x6f1b38
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0040adf4
cmp dword [ebp + 0x14], 0
je 0x6f1bb2
cmp byte [edi + 0x41], 0
je 0x6f1b59
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x74]
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.006fa238
jmp 0x6f1b82
mov edx, dword [edi + 0x2c]
mov eax, edx
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx + 8]
mov eax, dword [eax + 8]
cmp ecx, dword [eax + 8]
jle 0x6f1b80
mov eax, edx
mov eax, dword [eax + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 0x14]
call fcn.006fa764
mov ebx, eax
jmp 0x6f1b82
xor ebx, ebx
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 0x14], eax
mov dx, 0x3f
mov eax, esi
call fcn.0066720c
push ebx
mov ecx, dword [esi + 8]
inc ecx
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.006f1818
push ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 4]
jmp 0x6f1bf2
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
call fcn.0040ac84
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.0066711c
jmp 0x6f1bf2
mov dx, 0x3a
mov eax, esi
call fcn.0066720c
cmp byte [ebp - 0xd], 0
je 0x6f1be8
mov dx, 0x40
mov eax, esi
call fcn.0066720c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0066711c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f1c1c
lea eax, [ebp - 0x18]
call fcn.00409c0c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409c6c
ret
Function at 0x750a74
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x750bec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00409c0c
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, 0x750c04
call fcn.0040adbc
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x750ad1
lea eax, [ebp - 4]
call fcn.00409c0c
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ebx, eax
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x750b9f
cmp ebx, 0xffffff99
je 0x750af1
cmp ebx, 0xffffff97
je 0x750af1
cmp ebx, 0x64
jl 0x750b9f
cmp byte [ebp - 9], 0
je 0x750b09
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x750c04
call fcn.0040ac84
jmp 0x750b14
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040a034
mov eax, dword [ebp - 8]
test eax, eax
je 0x750b20
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
mov edx, dword [ebp + 8]
cmp ax, word [edx - 0xa]
jne 0x750b58
mov eax, dword [ebp - 8]
movzx eax, word [eax + ebx*2 - 2]
mov edx, dword [ebp + 8]
cmp ax, word [edx - 0xc]
jne 0x750b58
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0040adf4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
jge 0x750b8e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004b0950
add eax, 0x34
mov edx, dword [ebp - 8]
call fcn.00409fec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov dx, 0x3f
call fcn.0066720c
jmp 0x750bd1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov dx, 0x3a
call fcn.0066720c
cmp byte [ebp - 9], 0
je 0x750bc3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov dx, 0x40
call fcn.0066720c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov edx, dword [ebp - 4]
call fcn.0066711c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x750bf3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409c6c
ret
Function at 0x759460
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, edx
lea edi, [esp]
push ecx
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop ecx
mov ebx, ecx
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x759497
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x759497
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
cmp esi, 0xffffffff
jne 0x7594a9
call sub.wsock32.dll_WSAGetLastError
mov edi, eax
xor eax, eax
mov dword [ebx], eax
jmp 0x759515
xor edi, edi
mov edx, 0x20
mov eax, dword [0x662bcc]
call fcn.00665c00
mov dword [ebx], eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, 0x20
call fcn.004077ac
mov eax, dword [ebx]
mov edx, dword [esp + 8]
mov dword [eax + 8], edx
mov eax, dword [ebx]
mov edx, dword [esp + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebx]
mov edx, dword [esp + 4]
mov dword [eax + 4], edx
mov eax, dword [ebx]
mov ebp, 0x10
mov dword [eax + 0x10], ebp
mov edx, ebp
mov eax, dword [0x662bcc]
call fcn.00665c00
mov edx, dword [ebx]
mov dword [edx + 0x18], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
movzx edx, word [esp + 4]
mov word [eax], dx
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [eax + 4], esi
mov eax, edi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x759820
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef4
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [esp + 8]
call fcn.006da354
lea edx, [esp + 8]
mov eax, ebx
call fcn.006da344
test esi, esi
jge 0x75984b
xor esi, esi
jmp 0x75986e
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [esp], eax
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
mov esi, esp
push esi
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [ebx + 1]
push eax
call sub.wsock32.dll_select
test eax, eax
jge 0x759890
call fcn.007596f4
mov dword [edi], eax
xor eax, eax
jmp 0x75989f
xor eax, eax
mov dword [edi], eax
lea edx, [esp + 8]
mov eax, ebx
call fcn.006da32c
add esp, 0x10c
pop edi
pop esi
pop ebx
ret