joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ecef0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72fc55
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd4
mov dword [ebp - 0xd8], ecx
mov eax, dword [ebp - 0xd8]
movzx ecx, byte [eax + 0x21]
test ecx, ecx
je 0x5ecf86
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0xd4], eax
mov ecx, dword [edx + 0x14]
mov dword [ebp - 0xd0], ecx
mov edx, dword [ebp - 0xd4]
or edx, dword [ebp - 0xd0]
je 0x5ecf86
push 1
mov eax, dword [ebp - 0xd8]
add eax, 0x10
push eax
mov ecx, dword [ebp - 0xd8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xd8]
mov eax, dword [edx + 0x50]
call eax
movzx ecx, al
test ecx, ecx
jne 0x5ecf86
push 0
lea ecx, [ebp - 0x68]
call fcn.005937d0
push 0x7daafc
lea edx, [ebp - 0x68]
push edx
call fcn.00563aac
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x1c
mov ecx, dword [ebp - 0xd8]
cmp dword [ecx + 8], 0xffffffff
jne 0x5ecfbd
push 0
lea ecx, [ebp - 0x98]
call fcn.005d0d40
push 0x7df6b8
lea edx, [ebp - 0x98]
push edx
call fcn.00563aac
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xd8]
movzx edx, byte [ecx + 0x20]
test edx, edx
je 0x5ed005
cmp dword [ebp - 0x10], 0
jge 0x5ed005
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x5ecf93
cmp dword [ebp - 0x10], 0
jl 0x5ed05a
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.005c66c0
mov dword [ebp - 0xdc], eax
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xe0], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xe0]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.005c6990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.005c6800
jmp 0x5ed0bc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x2733
jne 0x5ed07c
mov ecx, dword [ebp - 0xd8]
movzx edx, byte [ecx + 0x20]
test edx, edx
jne 0x5ed07c
jmp 0x5ed0bc
cmp dword [ebp - 0x38], 0x2733
je 0x5ed08e
cmp dword [ebp - 0x38], 0x274c
jne 0x5ed0b0
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0xcc]
call fcn.005937d0
push 0x7daafc
lea ecx, [ebp - 0xcc]
push ecx
call fcn.00563aac
jmp 0x5ed0bc
mov edx, dword [ebp - 0x38]
push edx
call fcn.005ee220
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5ed0d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
cmp dword [eax + 8], 0xffffffff
jne 0x5ed0fa
push 0
lea ecx, [ebp - 0x34]
call fcn.005d0d40
push 0x7df6b8
lea ecx, [ebp - 0x34]
push ecx
call fcn.00563aac
push 1
push 1
lea edx, [ebp + 8]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x5ed11d
call fcn.005ee190
mov esp, ebp
pop ebp
ret 4
Function at 0x5ed860
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x60]
cmp dword [eax + 8], 0xffffffff
jne 0x5ed891
push 0
lea ecx, [ebp - 0x58]
call fcn.005d0d40
push 0x7df6b8
lea ecx, [ebp - 0x58]
push ecx
call fcn.00563aac
lea edx, [ebp - 0x28]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0x1c
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x60]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5ed8dc
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
call fcn.005c66c0
mov eax, dword [ebp - 0x5c]
or eax, 1
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 8]
jmp 0x5ed8f5
call fcn.005ee190
mov ecx, dword [ebp + 8]
call fcn.005c61a0
mov ecx, dword [ebp - 0x5c]
or ecx, 1
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x5edae0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
cmp dword [eax + 8], 0xffffffff
jne 0x5edb0a
push 0
lea ecx, [ebp - 0x34]
call fcn.005d0d40
push 0x7df6b8
lea ecx, [ebp - 0x34]
push ecx
call fcn.00563aac
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5edb35
call fcn.005ee190
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5ee0f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5ee11c
call fcn.005ee190
mov esp, ebp
pop ebp
ret 8
Function at 0x5f13f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72ff77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov dword [ebp - 0x54], 0
mov eax, dword [ebp + 0xc]
xor ecx, ecx
cmp dword [eax + 0x14], 0
sete cl
movzx edx, cl
test edx, edx
je 0x5f143e
mov ecx, dword [ebp + 8]
call fcn.005f06a0
mov eax, dword [ebp - 0x54]
or eax, 1
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
jmp 0x5f1505
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x34], 4
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x18], 0x10
jb 0x5f1473
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x58], ecx
jmp 0x5f147c
mov edx, dword [ebp + 0xc]
add edx, 4
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
push ecx
push 0
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5f14f1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
add ecx, 8
push ecx
lea ecx, [ebp - 0x50]
call fcn.005f0730
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp + 8]
call fcn.005f0780
mov ecx, dword [ebp - 0x54]
or ecx, 1
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.005efbd0
mov eax, dword [ebp + 8]
jmp 0x5f1505
mov ecx, dword [ebp + 8]
call fcn.005f06a0
mov edx, dword [ebp - 0x54]
or edx, 1
mov dword [ebp - 0x54], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5f1f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
movzx eax, word [ebp + 8]
test eax, eax
je 0x5f1fdf
movzx ecx, word [ebp + 8]
movzx edx, word [ebp + 8]
sub edx, 1
xor ecx, edx
sar ecx, 1
mov word [ebp + 8], cx
mov dword [ebp - 4], 0
jmp 0x5f1fc8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
movzx ecx, word [ebp + 8]
test ecx, ecx
je 0x5f1fdd
mov dx, word [ebp + 8]
shr dx, 1
mov word [ebp + 8], dx
jmp 0x5f1fbf
jmp 0x5f1fe5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x639ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x734870
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.0065a630
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
add ecx, 0x28
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx], vtable.Poco::XML::LexicalHandler.0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x38]
mov dword [eax], vtable.Poco::XML::WhitespaceFilter.5.0
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 4], vtable.Poco::XML::WhitespaceFilter.4.0
mov edx, dword [ebp - 0x38]
mov dword [edx + 8], vtable.Poco::XML::WhitespaceFilter.3.0
mov eax, dword [ebp - 0x38]
mov dword [eax + 0xc], vtable.Poco::XML::WhitespaceFilter.2.0
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x10], vtable.Poco::XML::WhitespaceFilter.1.0
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x28], vtable.Poco::XML::WhitespaceFilter.0
mov eax, dword [ebp - 0x38]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x38]
add ecx, 0x30
mov dword [ebp - 0x34], ecx
lea edx, [ebp - 0x19]
mov dword [ebp - 0x18], edx
push 0
push 0
mov ecx, dword [ebp - 0x34]
call fcn.0040b0a0
mov eax, dword [ebp - 0x38]
mov byte [eax + 0x4c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x639bb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73488d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [eax], vtable.Poco::XML::WhitespaceFilter.5.0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], vtable.Poco::XML::WhitespaceFilter.4.0
mov edx, dword [ebp - 0x24]
mov dword [edx + 8], vtable.Poco::XML::WhitespaceFilter.3.0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xc], vtable.Poco::XML::WhitespaceFilter.2.0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x10], vtable.Poco::XML::WhitespaceFilter.1.0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x28], vtable.Poco::XML::WhitespaceFilter.0
mov dword [ebp - 4], 1
push 0
push 1
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.0040b0a0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
call fcn.0065a540
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
call fcn.0065a700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x657410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73642e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
mov dword [ebp - 0xa0], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
call edx
push eax
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
call eax
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
mov edx, dword [ebp - 0xb0]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x60]
push ecx
call fcn.00657c50
add esp, 0x18
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 2
push 0
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0xa0]
call fcn.00656e10
mov byte [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x60]
call fcn.0040b0a0
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.0040b0a0
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040b0a0
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], vtable.Poco::XML::SAXParseException.0
mov edx, dword [ebp - 0xa0]
add edx, 0x30
push edx
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
call eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xa0]
add ecx, 0x4c
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 4], 8
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0xa0]
mov dword [ecx + 0x68], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
call edx
mov ecx, dword [ebp - 0xa0]
mov dword [ecx + 0x6c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x6575b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x736477
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
mov dword [ebp - 0xa0], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
call edx
push eax
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
call eax
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
mov edx, dword [ebp - 0xb0]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x60]
push ecx
call fcn.00657c50
add esp, 0x18
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 2
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xb8]
push ecx
mov ecx, dword [ebp - 0xa0]
call fcn.00656e70
mov byte [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x60]
call fcn.0040b0a0
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.0040b0a0
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040b0a0
mov edx, dword [ebp - 0xa0]
mov dword [edx], vtable.Poco::XML::SAXParseException.0
mov eax, dword [ebp - 0xa0]
add eax, 0x30
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
call eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xa0]
add ecx, 0x4c
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 4], 8
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0xa0]
mov dword [ecx + 0x68], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
call edx
mov ecx, dword [ebp - 0xa0]
mov dword [ecx + 0x6c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x65f700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x736b1a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x7c]
call fcn.0065e3f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x7c]
mov dword [eax], vtable.Poco::XML::Event.0
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x7c]
add eax, 0xc
mov dword [ebp - 0x78], eax
push 0
push 0
mov ecx, dword [ebp - 0x78]
call fcn.0040b0a0
mov ecx, dword [0x7c2410]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x78]
call fcn.0040aed0
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x28], ecx
mov edx, dword [ebp - 0x7c]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x7c]
mov dword [eax + 0x30], 1
mov ecx, dword [ebp - 0x7c]
mov dl, byte [ebp + 0x14]
mov byte [ecx + 0x34], dl
mov eax, dword [ebp - 0x7c]
mov cl, byte [ebp + 0x18]
mov byte [eax + 0x35], cl
mov edx, dword [ebp - 0x7c]
mov byte [edx + 0x36], 0
mov eax, dword [ebp - 0x7c]
mov byte [eax + 0x37], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x699c90
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.0049f540
add esp, 8
test esi, esi
jg 0x699cee
je 0x699ccc
cmp esi, 0xffffffff
jne 0x699cee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x699ce3
cmp eax, 0xb
je 0x699ce3
cmp eax, 0x2733
jne 0x699cee
push 0xa
push edi
call fcn.0049f560
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x69a640
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [ebx + 0x20]
cmp dword [esi], 6
je 0x69a657
call fcn.0069a000
test eax, eax
jle 0x69a6a0
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push ebx
mov esi, eax
call fcn.0049f540
add esp, 8
test esi, esi
jg 0x69a69e
push esi
call fcn.00699bf0
add esp, 4
test eax, eax
je 0x69a69e
push 0xa
push ebx
call fcn.0049f560
add esp, 8
mov eax, esi
pop esi
pop ebx
ret

Function at 0x69c840
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jge 0x69c881
push 0x233
push 0x7a8ca8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.0049ca60
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret

Function at 0x69c890
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
mov ecx, ebp
mov ebx, 1
call fcn.0069c780
mov edi, eax
add esp, 4
test edi, edi
jge 0x69c8cc
push 0x7b
push 0x7a8ca8
push 0x6c
push 0x6a
push 0x20
call fcn.0049ca60
add esp, 0x14
jmp 0x69c98a
call fcn.0069c700
cmp eax, 1
jne 0x69c99a
test edi, edi
jle 0x69c8e5
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
push 0x8e
push 0x7a8ca8
push 0x16
push 9
call fcn.004b1d70
add esp, 0x10
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x69c920
push 0x92
push 0x7a8ca8
push 0x66
push 0x6a
push 0x20
call fcn.0049ca60
add esp, 0x14
jmp 0x69c970
cmp word [eax + 8], 2
je 0x69c941
push 0x99
push 0x7a8ca8
push 0x6b
push 0x6a
push 0x20
call fcn.0049ca60
add esp, 0x14
jmp 0x69c970
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx]
mov byte [esi], cl
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dl, byte [ecx + 1]
mov byte [esi + 1], dl
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx + 2]
mov byte [esi + 2], cl
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
movzx ecx, byte [eax + 3]
mov byte [esi + 3], cl
xor ebx, ebx
push 0xa2
push 0x7a8ca8
push 0x16
push 0xa
call fcn.004b1d70
add esp, 0x10
test ebx, ebx
je 0x69c9a1
push ebp
push 0x79f8cc
push 2
call fcn.0049cd60
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x6b9080
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x738c9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
mov ecx, dword [ebp + 8]
call fcn.006b80a0
test eax, eax
je 0x6b917c
push 0
mov ecx, dword [ebp + 8]
call fcn.006b80a0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x6b9174
mov ecx, dword [ebp + 8]
call fcn.006b8050
lea eax, [ebp - 0x61]
mov dword [ebp - 0x60], eax
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.0040b0a0
mov dword [ebp - 0xb8], str.cannot_kill_process
mov ecx, dword [ebp - 0xb8]
add ecx, 1
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp - 0xb8]
mov al, byte [edx]
mov byte [ebp - 0xbd], al
add dword [ebp - 0xb8], 1
cmp byte [ebp - 0xbd], 0
jne 0x6b90fa
mov ecx, dword [ebp - 0xb8]
sub ecx, dword [ebp - 0xbc]
mov dword [ebp - 0xc4], ecx
mov edx, dword [ebp - 0xc4]
push edx
push str.cannot_kill_process
lea ecx, [ebp - 0x58]
call fcn.0040a9d0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00593a10
push 0x7dab3c
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00563aac
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.0040b0a0
mov ecx, dword [ebp + 8]
call fcn.006b8050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret