joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d73e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.100df46d
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x100d740d
xor eax, eax
jmp 0x100d75b1
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x100aefd0
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.100d4b0e
push esi
push eax
call fcn.100aeff0
add esp, 0x14
test eax, eax
je 0x100d745a
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.100df618
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.100d4af0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.100d620f
add esp, 0x28
test eax, eax
jne 0x100d7491
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x100d74cd
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.100df5e9
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x100d74cd
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x100d62e1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.100d6330
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x100d754d
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.100e6a5e
add esp, 0xc
cmp eax, 0xfffffffa
je 0x100d7536
cmp eax, 0xfffffffc
je 0x100d752f
cmp eax, 0xfffffffe
je 0x100d7528
test eax, eax
je 0x100d7548
push str.Unknown_zlib_error
jmp 0x100d753b
push str.zlib_stream_error
jmp 0x100d753b
push str.zlib_memory_error
jmp 0x100d753b
push str.zlib_version_error
push dword [ebp - 4]
call fcn.100d4b2a
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x100d757d
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.100df53e
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.100df4f6
add esp, 0x14
jmp 0x100d7406
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.100dc3b4
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e5063
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 8], edx
cmp dword [edi + 0x6c], eax
jb 0x100e50ff
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.100ae520
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 4], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x100e50b4
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x100e50db
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x100e5224
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x100e512c
xor eax, eax
jmp 0x100e5178
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x100e5149
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.100e8719
jmp 0x100e5159
cmp eax, 2
jne 0x100e5162
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.100e6c2f
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 0x30], eax
push ecx
push dword [esi]
push dword [ebp - 8]
call fcn.100ae520
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x100e51a0
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x100e51b5
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x100e5071
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x100e5224
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x100e51f4
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.100aeaa0
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x100e5224
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x100e5224
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
add eax, ecx
push esi
push 0
push eax
call fcn.100aeaa0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e6c2f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x100e6c3c
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.100e6c42
Function at 0x100f1470
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x100f14b9
mov al, byte [esi]
push eax
call fcn.100f8800
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x100f1497
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x100f2750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100f2771
cmp dword [esi + 0x8c], 0
je 0x100f2771
push 2
push 3
push esi
call fcn.100f8be0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.100fa700
add esp, 4
test esi, esi
je 0x100f2794
cmp dword [esi + 0x8c], 0
je 0x100f2794
push 3
push esi
call fcn.100f8c20
add esp, 8
pop esi
pop ebp
ret

Function at 0x100f2f10
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2b0], 2
jne 0x100f2f25
pop ebp
jmp fcn.100f2ec0
mov al, 1
pop ebp
ret
Function at 0x100f5e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x608], 0
je 0x100f5e44
push esi
push 1
push edi
call fcn.100ef110
push dword [edi + 0x59c]
mov eax, dword [edi + 0x608]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.100ef110
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x100f5e7a
push dword [edi + 0x598]
lea eax, [eax + eax*2]
push 1
add eax, 0x1020f5c8
push 2
push eax
call fcn.100c26f7
push dword [edi + 0x598]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.100c26f7
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x100f62c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ecx + eax*4 + 0x1a8]
push edi
mov edi, dword [ebp + 0x10]
push eax
push ecx
mov dword [ebp - 0x88], ecx
call fcn.100f6800
add esp, 8
push 0
push dword [ebp + 0x14]
push edi
push esi
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov dword [ebx], 0
cmp esi, 0xffffffff
jne 0x100f637a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x100f633c
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.1011b7b0
push eax
mov eax, dword [ebp - 0x88]
push str.Send_failure:__s
push dword [eax]
call fcn.100f5e80
mov eax, dword [ebp - 0x88]
add esp, 0x18
mov eax, dword [eax]
mov dword [eax + 0xcac], edi
mov eax, esi
mov dword [ebx], 0x37
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004338a
mov esp, ebp
pop ebp
ret
Function at 0x100f6800
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
shl eax, 4
push edi
mov edx, dword [ebx + ecx*4 + 0x1a8]
lea esi, [ebx + 0x1cc]
add esi, eax
mov dword [ebp + 8], edx
mov eax, dword [ebx + 0x2a8]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x100f68bd
cmp dword [ebx + ecx*4 + 0x1bc], 0x100f61d0
jne 0x100f68bd
cmp dword [esi], 0
je 0x100f684f
test edi, edi
je 0x100f68bd
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
call fcn.100f59b0
add esp, 0x14
cmp eax, 0xffffffff
je 0x100f68bd
test al, 1
je 0x100f68bd
cmp dword [esi], 0
jne 0x100f68a4
mov eax, dword [ebx]
mov eax, dword [eax + 0x8e4]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x10272270]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x100f68a4
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x100f68bd
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100f69b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test byte [eax + 0x1f8], 1
je 0x100f69d0
push eax
call fcn.100f38d0
add esp, 4
test eax, eax
jne 0x100f69f2
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x1a8]
cmp eax, 0xffffffff
je 0x100f69cc
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x100f69f2
xor al, al
pop ebp
ret
mov al, 1
pop ebp
ret

Function at 0x100f7160
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x102937b0]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x100f71b1
push 3
push 2
push eax
push 6
call fcn.100f86a0
add esp, 0x10
test al, al
je 0x100f71a5
mov dword [0x102937b0], 2
mov esp, ebp
pop ebp
ret
mov dword [0x102937b0], 1
jmp 0x100f71b6
cmp eax, 2
je 0x100f71f6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x100f71dd
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x100f71f6
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x100f7420
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x90], 2
mov ebx, dword [esi]
je 0x100f762c
test dword [esi + 0x284], 0x8000002
push edi
jne 0x100f7622
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], 0x80
push eax
push edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x100f74b9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.1011b7b0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.100f5e80
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x104]
mov dword [ebp - 0x188], 0x80
push 0
push eax
call fcn.100aeaa0
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100f752d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.1011b7b0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.100f5e80
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x138]
push eax
lea edi, [esi + 0x10a]
lea eax, [ebp - 0x184]
push edi
push eax
call fcn.100f7bd0
add esp, 0xc
test al, al
jne 0x100f7591
call fcn.100b1ad5
mov esi, eax
call fcn.100b1ad5
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push dword [esi]
call fcn.1011b7b0
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.100f5e80
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x28]
movups xmmword [esi + 0x5c], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [esi + 0x6c], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [esi + 0x7c], xmm0
mov dword [esi + 0x84], eax
mov ax, word [edi + 0x2c]
mov word [esi + 0x88], ax
lea eax, [esi + 0x16c]
push eax
lea eax, [esi + 0x13c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.100f7bd0
add esp, 0xc
test al, al
jne 0x100f7622
call fcn.100b1ad5
mov esi, eax
call fcn.100b1ad5
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push dword [esi]
call fcn.1011b7b0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.100f5e80
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret
push esi
call fcn.100f7080
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004338a
mov esp, ebp
pop ebp
ret
Function at 0x100f8000
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 4
mov eax, dword [esi + 0xa90]
shr eax, 0xc
and eax, 1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x100f805e
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.100f5f60
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret
push dword [esi + 0xa50]
mov dword [ebp - 0x10], 1
call fcn.100f8310
push dword [esi + 0xa54]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.100f8310
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x100f80ce
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.100f5f60
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004338a
mov esp, ebp
pop ebp
ret

Function at 0x100f80e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 4
mov dword [ebp - 0x88], 1
mov esi, dword [eax]
lea eax, [ebp - 0x88]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x100f8153
push 0x80
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.1011b7b0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.100f5f60
add esp, 0x18
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.100f5f60
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.1004338a
mov esp, ebp
pop ebp
ret

Function at 0x100f82d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.100f8300
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.100c9f5b
Function at 0x100f8550
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100f8570
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push str.LoadLibraryExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x1020fa10
push esi
mov dword [ebp - 8], ebx
call fcn.101dcb74
add esp, 8
test eax, eax
je 0x100f85bc
test ebx, ebx
je 0x100f85ac
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x100f85e5
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100f85e5
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x100f8690
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f8601
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x10272270]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100f8686
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100f8686
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f8632
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f8650
sub ecx, edx
add ecx, ebx
sub ecx, esi
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100f8660
mov eax, dword [ebp - 8]
test eax, eax
je 0x100f867d
push 8
push 0
push ebx
call eax
jmp 0x100f8684
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x10272274]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10101d70
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10101f04
push edi
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x10101ef0
push esi
nop dword [eax]
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x10101dbf
mov eax, 0x10
jmp 0x10101dcd
cmp eax, 0x17
jne 0x10101e81
mov eax, 0x1c
cmp dword [edi + 0x18], 0
mov dword [ebp - 4], eax
je 0x10101e81
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x10101e81
cmp ecx, eax
jb 0x10101e81
push 0x20
call dword [0x10272270]
mov esi, eax
add esp, 4
test esi, esi
je 0x10101ee5
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x10272270]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x10101ed4
push dword [ebp - 4]
push dword [edi + 0x18]
push eax
call fcn.100ae520
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x10101e6f
push eax
call dword [0x1027227c]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x10101eba
mov eax, dword [ebp - 8]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x10101e7e
mov dword [eax + 0x1c], esi
mov dword [ebp - 8], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x10101db0
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
pop esi
test eax, eax
je 0x10101e9e
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x10101eec
push ebx
call fcn.10101d30
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x10272274]
push esi
call dword [0x10272274]
add esp, 8
jmp 0x10101e8f
push esi
mov edi, 8
call dword [0x10272274]
add esp, 4
jmp 0x10101e8f
mov edi, 8
jmp 0x10101e8f
test ebx, ebx
jne 0x10101efc
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10102230
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.101dcdb0
add esp, 0x18
test eax, eax
je 0x10102252
cmp eax, 0xffffffff
jne 0x10102254
xor eax, eax
pop ebp
ret