joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006e00
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069e5e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10086040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], 0x1007a6f0
mov dword [esi + 0x14], 0
lea ebx, [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [ebx], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.10007b40
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.10006710
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10006f43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [0x1008816c]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x10088e60]
cmp ecx, dword [edx + 4]
jle 0x10006f35
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10006f35
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x10086bf8
test edi, edi
jne 0x10006fbc
cmp byte [ebp + 0x10], 0
je 0x10006fa6
lock inc dword [ebx]
push 0xc
call fcn.100463c4
mov edi, eax
add esp, 4
mov dword [ebp + 0x10], edi
mov byte [ebp - 4], 7
push 0x10
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.100463c4
push eax
mov ecx, edi
mov dword [ebp + 8], eax
mov dword [eax], 0x1007a6cc
mov dword [eax + 0xc], esi
call fcn.10006a90
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x10006fa3
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push ebx
call fcn.10046823
add esp, 8
mov dword [esi + 0x60], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, str.iocp
lea ecx, [ebp - 0x1c]
call fcn.100042f0
int3
Function at 0x10007320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069ee5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10086040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edx, edx
lea eax, [esi + 0x18]
lock xadd dword [eax], edx
test edx, edx
jne 0x10007382
call fcn.100074b0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0x10086be8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0
push eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call fcn.100480e4
add esp, 4
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov ecx, esi
mov dword [ebp - 4], 0
push dword [0x100894c8]
neg ecx
lea eax, [esi + 0x14]
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x100894c8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x34]
push ebx
push eax
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
xor edi, edi
call fcn.10007620
test eax, eax
je 0x1000742c
nop dword [eax]
cmp edi, 0xffffffff
lea eax, [edi + 1]
push ebx
cmove eax, edi
mov edi, eax
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, esi
call fcn.10007620
test eax, eax
jne 0x10007410
push dword [ebp - 0x14]
push dword [0x100894c8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
nop dword [eax]
mov eax, dword [ebp + esi*4 - 0x34]
test eax, eax
je 0x10007451
push eax
call fcn.10046862
add esp, 4
inc esi
cmp esi, 3
jl 0x10007440
lea eax, [ebp - 0x24]
push eax
call fcn.100481cf
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10007e80
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebx, ecx
mov ebp, edx
push esi
push edi
cmp ebx, 0xffffffff
je 0x10007ffd
cmp byte [esp + 0x28], 0
je 0x10007edf
mov al, byte [ebp]
test al, 8
je 0x10007edf
or al, 8
mov dword [esp + 0x1c], 0x10086be8
push 4
mov byte [ebp], al
xor ecx, ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
push eax
push 0x80
push 0xffff
push ebx
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [esp + 0x18]
setne dl
call fcn.10007d80
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, dword [esp + 0x2c]
mov esi, eax
test esi, esi
mov ecx, edi
setne dl
call fcn.10007d80
test esi, esi
je 0x10007ff3
mov ecx, dword [0x1008816c]
mov eax, dword fs:[0x2c]
mov edx, dword [eax + ecx*4]
mov ecx, dword [0x10088e60]
mov dword [esp + 0x14], edx
cmp ecx, dword [edx + 4]
jle 0x10007f5d
push 0x10088e60
call fcn.10046360
mov ecx, dword [0x10088e60]
add esp, 4
cmp ecx, 0xffffffff
jne 0x10007f59
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
mov ecx, dword [0x10088e60]
add esp, 4
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [0x10086bfc]
jne 0x10007f73
cmp dword [edi], 0x2733
je 0x10007fc1
cmp ecx, dword [edx + 4]
jle 0x10007fab
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10007fab
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [0x10086bfc]
jne 0x10007ff3
cmp dword [edi], 0x4d5
jne 0x10007ff3
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [ebp], 0xfc
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, edi
test esi, esi
setne dl
call fcn.10007d80
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret

Function at 0x10008010
Capabilities:
Connect socket

Disassembly:
push esi
cmp ecx, 0xffffffff
jne 0x10008078
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008816c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10088e60]
cmp eax, dword [ecx + 4]
jle 0x10008062
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10008062
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, dword [esp + 0xc]
mov dword [eax], 0x2719
mov dword [eax + 4], 0x10086bf8
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
setne dl
call fcn.10007d80
mov eax, esi
pop esi
ret
Function at 0x100080a0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
mov ebx, dword fs:[0x2c]
push ebp
push esi
mov esi, edx
mov ebp, ecx
push edi
mov edi, dword [0x1008816c]
mov eax, dword [esi]
cmp eax, 0x4cf
jg 0x100081b4
je 0x1000816d
cmp eax, 0x79
je 0x10008123
cmp eax, 0x4c9
jne 0x1000820d
mov ecx, dword [ebx + edi*4]
mov eax, dword [0x10088e60]
cmp eax, dword [ecx + 4]
jle 0x10008119
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10008119
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, 0x274d
jmp 0x10008204
mov ecx, dword [ebx + edi*4]
mov eax, dword [0x10088e60]
cmp eax, dword [ecx + 4]
jle 0x10008163
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10008163
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, 0x274c
jmp 0x10008204
mov ecx, dword [ebx + edi*4]
mov eax, dword [0x10088e60]
cmp eax, dword [ecx + 4]
jle 0x100081ad
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x100081ad
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, 0x2743
jmp 0x10008204
cmp eax, 0x4d0
jne 0x10008289
mov ecx, dword [ebx + edi*4]
mov eax, dword [0x10088e60]
cmp eax, dword [ecx + 4]
jle 0x100081ff
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x100081ff
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, 0x2751
mov dword [esi + 4], 0x10086bf8
mov dword [esi], eax
test eax, eax
jne 0x10008289
cmp ebp, 0xffffffff
jne 0x10008268
mov ecx, dword [ebx + edi*4]
mov eax, dword [0x10088e60]
cmp eax, dword [ecx + 4]
jle 0x10008255
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], ebp
jne 0x10008255
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov dword [esi], 0x2719
mov dword [esi + 4], 0x10086bf8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0x7010
push 0xffff
push ebp
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov ecx, esi
setne dl
call fcn.10007d80
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10008460
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x24]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
mov ecx, dword fs:[0x2c]
mov ebx, eax
mov edx, dword [0x1008816c]
mov edi, dword [ecx + edx*4]
mov ecx, dword [0x10088e60]
cmp ecx, dword [edi + 4]
jle 0x100084d3
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x100084d3
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
mov dword [esi + 4], 0x10086bf8
cmp eax, 0x40
jne 0x10008530
mov eax, dword [0x10088e60]
cmp eax, dword [edi + 4]
jle 0x10008528
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10008528
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov dword [esi], 0x2746
jmp 0x1000857a
cmp eax, 0x4d2
jne 0x10008581
mov eax, dword [0x10088e60]
cmp eax, dword [edi + 4]
jle 0x10008574
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10008574
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov dword [esi], 0x274d
mov dword [esi + 4], 0x10086bf8
test ebx, ebx
je 0x1000858d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
pop edi
mov dword [esi], 0
pop esi
pop ebx
pop ecx
ret

Function at 0x100086e0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push esi
mov esi, edx
push edi
cmp ecx, 0xffffffff
jne 0x10008750
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008816c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10088e60]
cmp eax, dword [ecx + 4]
jle 0x10008737
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10008737
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x2719
mov dword [eax + 4], 0x10086bf8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x18]
push ebx
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov edx, edi
shr edx, 0x1f
call fcn.10007d80
test edi, edi
js 0x1000878b
cmp dword [ebx], 0
mov al, byte [esi]
je 0x10008787
or al, 1
mov byte [esi], al
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
and al, 0xfc
mov byte [esi], al
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10008e40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x10086040]
xor eax, esp
mov dword [esp + 0x420], eax
mov edx, dword [0x1008816c]
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword fs:[0x2c]
push ebx
lea eax, [eax + edx*4]
mov dword [esp + 0x14], ecx
push esi
mov esi, dword [eax]
push edi
mov dword [esp + 0x20], 0x400
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
nop word [eax + eax]
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push 1
lea eax, [esp + 0x34]
push eax
push dword [ecx]
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ecx, dword [0x10088e60]
mov ebx, eax
cmp ecx, dword [esi + 4]
jle 0x10008efd
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10008efd
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov edi, 0x10086bf8
cmp esi, 0x40
jne 0x10008f5e
mov ecx, dword [esp + 0x10]
mov eax, dword [0x10088e60]
cmp eax, dword [ecx + 4]
jle 0x10008f50
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10008f50
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov edi, 0x10086bf8
mov esi, 0x2746
mov eax, edi
jmp 0x10008fd4
cmp esi, 0x4d2
jne 0x10008fb7
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [0x10088e60]
cmp eax, dword [ecx + 4]
jle 0x10008fa9
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10008fa9
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov edi, 0x10086bf8
mov esi, 0x274d
mov eax, edi
jmp 0x10008fd4
cmp esi, 0x2738
je 0x100090ae
mov eax, 0x10086bf8
cmp esi, 0xea
je 0x100090ae
test ebx, ebx
je 0x100090b3
or eax, 0xffffffff
test eax, eax
jg 0x100090d3
je 0x10009097
mov eax, dword [esp + 0x14]
mov ebx, dword [eax]
mov eax, dword [0x10088e60]
cmp eax, dword [ebx + 4]
jle 0x10009030
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10009030
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, dword [edi + 4]
cmp eax, dword [0x10086bfc]
jne 0x10009047
cmp esi, 0x2733
je 0x100090d3
mov eax, dword [0x10088e60]
cmp eax, dword [ebx + 4]
jle 0x10009084
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x10009084
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, dword [edi + 4]
cmp eax, dword [0x10086bfc]
jne 0x10009097
cmp esi, 0x4d5
je 0x100090d3
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.100462d6
mov esp, ebp
pop ebp
ret
mov eax, 0x10086bf8
mov edi, eax
xor esi, esi
mov eax, dword [esp + 0xc]
cmp eax, 0x400
jne 0x10008fdf
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
jmp 0x10008e90
mov ecx, dword [esp + 0x42c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100462d6
mov esp, ebp
pop ebp
ret
Function at 0x1000a010
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a0ed
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10086040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0xc]
cmp dword [edi], 0xffffffff
je 0x1000a0c5
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008816c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10088e6c]
cmp eax, dword [ecx + 4]
jle 0x1000a091
push 0x10088e6c
call fcn.10046360
add esp, 4
cmp dword [0x10088e6c], 0xffffffff
jne 0x1000a091
push 0x1006fa50
call fcn.1004680e
add esp, 4
push 0x10088e6c
call fcn.1004630f
add esp, 4
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov dword [eax + 4], 0x10086bf0
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov dword [eax + 4], 0x10086bf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 1
push 0
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ebx, dword [ebp + 0x1c]
mov esi, eax
cmp esi, 0xffffffff
mov ecx, ebx
sete dl
call fcn.10007d80
cmp esi, 0xffffffff
jne 0x1000a0f5
or esi, esi
jmp 0x1000a113
cmp dword [ebp + 0x10], 0x17
jne 0x1000a113
push 4
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x1c], 0
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp + 0x1c], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
jne 0x1000a134
mov esi, dword [ebp + 8]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esi], ecx
mov dword [esi + 4], edx
jmp 0x1000a20e
mov eax, dword [ebp - 0x10]
push 0
push 0
mov eax, dword [eax + 4]
push dword [eax + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
jne 0x1000a1ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edx, dword [0x1008816c]
mov dword [ebp + 0x10], eax
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x10088e60]
cmp ecx, dword [edx + 4]
jle 0x1000a1a6
push 0x10088e60
call fcn.10046360
add esp, 4
cmp dword [0x10088e60], 0xffffffff
jne 0x1000a1a3
push 0x1006fa40
call fcn.1004680e
add esp, 4
push 0x10088e60
call fcn.1004630f
add esp, 4
mov eax, dword [ebp + 0x10]
mov ecx, 0x10086bf8
jmp 0x1000a1b4
xor eax, eax
mov ecx, 0x10086be8
mov dword [ebx + 4], ecx
mov dword [ebx], eax
test eax, eax
je 0x1000a1c5
mov esi, dword [ebp + 8]
mov dword [esi + 4], ecx
jmp 0x1000a20c
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x1c], 0xffffffff
mov dword [edi], esi
sub eax, 1
je 0x1000a1e7
sub eax, 1
je 0x1000a1e1
mov byte [edi + 4], 0
jmp 0x1000a1eb
mov byte [edi + 4], 0x20
jmp 0x1000a1eb
mov byte [edi + 4], 0x10
push dword [ebp + 8]
push ecx
lea ecx, [edi + 8]
call fcn.1000e7e0
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], 0x10086be8
mov dword [esi + 4], 0x10086be8
mov dword [esi], eax
lea ecx, [ebp + 0x1c]
call fcn.100087a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000a230
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov eax, dword [ebx + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [esp + 0x28], 0
push 0
je 0x1000a25f
mov ecx, dword [ebx + 4]
push 0
push dword [esp + 0x34]
call fcn.10007560
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x1000a283
mov ecx, dword [ebx + 4]
push 0x2719
push dword [esp + 0x34]
call fcn.10007560
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0x2c]
push edi
push dword [esp + 0x2c]
mov dword [esp + 0x34], 0
push ecx
push dword [esp + 0x30]
push dword [esp + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x1000a2de
cmp eax, 0x3e5
je 0x1000a2de
push dword [esp + 0x28]
mov ecx, dword [ebx + 4]
push eax
push edi
call fcn.10007560
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
mov esi, dword [ebx + 4]
lea ecx, [edi + 0x1c]
mov ebx, 1
xor eax, eax
mov edx, ebx
lock cmpxchg dword [ecx], edx
cmp eax, ebx
jne 0x1000a336
push edi
push 2
push 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1000a336
lea ebp, [esi + 0x38]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi + 0x14], 0
mov eax, dword [esi + 0x58]
test eax, eax
je 0x1000a324
mov dword [eax + 0x14], edi
jmp 0x1000a327
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
lea eax, [esi + 0x34]
xchg dword [eax], ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
Function at 0x1000a340
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [esp + 0x28], 0
push 0
je 0x1000a36f
mov ecx, dword [edi + 4]
push 0
push dword [esp + 0x34]
call fcn.10007560
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x1000a393
mov ecx, dword [edi + 4]
push 0x2719
push dword [esp + 0x34]
call fcn.10007560
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
push esi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x1000a3d5
mov eax, 0x2746
jmp 0x1000a3e2
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x1000a403
cmp eax, 0x3e5
je 0x1000a403
push dword [esp + 0x28]
mov ecx, dword [edi + 4]
push eax
push esi
call fcn.10007560
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
mov edi, dword [edi + 4]
lea ecx, [esi + 0x1c]
mov ebx, 1
xor eax, eax
mov edx, ebx
lock cmpxchg dword [ecx], edx
cmp eax, ebx
jne 0x1000a45b
push esi
push 2
push 0
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1000a45b
lea ebp, [edi + 0x38]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x1000a449
mov dword [eax + 0x14], esi
jmp 0x1000a44c
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
xchg dword [eax], ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18