joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422004]
jne 0x40100a
repz ret
jmp fcn.004013cb

Function at 0x407013
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004027ae
and dword [ebp - 4], 0
cmp dword [0x428fb4], 0
mov ebx, eax
jne 0x4070c4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407175
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407175
push eax
call fcn.0040273c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428fb4], eax
call esi
push eax
call fcn.0040273c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428fb8], eax
call esi
push eax
call fcn.0040273c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x428fbc], eax
call esi
push eax
call fcn.0040273c
pop ecx
mov dword [0x428fc4], eax
test eax, eax
je 0x4070c4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040273c
pop ecx
mov dword [0x428fc0], eax
mov eax, dword [0x428fc0]
cmp eax, ebx
je 0x40711c
cmp dword [0x428fc4], ebx
je 0x40711c
push eax
call fcn.004027b7
push dword [0x428fc4]
mov esi, eax
call fcn.004027b7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40711c
test edi, edi
je 0x40711c
call esi
test eax, eax
je 0x407113
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407113
test byte [ebp - 0xc], 1
jne 0x40711c
or dword [ebp + 0x10], 0x200000
jmp 0x407155
mov eax, dword [0x428fb8]
cmp eax, ebx
je 0x407155
push eax
call fcn.004027b7
pop ecx
test eax, eax
je 0x407155
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407155
mov eax, dword [0x428fbc]
cmp eax, ebx
je 0x407155
push eax
call fcn.004027b7
pop ecx
test eax, eax
je 0x407155
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428fb4]
call fcn.004027b7
pop ecx
test eax, eax
je 0x407175
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407177
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409a0f
Capabilities:
Accept command line arguments
Read file on windows

Disassembly:
inc dword [0x40aecb0]
cmp dword [0x40b26b4], 0x297
jne 0x409a2e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push esi
mov esi, 0xff
and dword [0x40aecb0], esi
cmp dword [0x40b26b4], 0x13ca
jne 0x409a4d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [0x40aecb0]
lea ecx, [ecx + 0x40aa1e0]
mov dl, byte [ecx]
movzx eax, dl
add eax, dword [0x40aecac]
and eax, esi
mov dword [0x40aecac], eax
lea eax, [eax + 0x40aa1e0]
mov bl, byte [eax]
mov byte [eax], dl
mov byte [ecx], bl
movzx eax, byte [eax]
movzx ecx, bl
add eax, ecx
and eax, esi
mov al, byte [eax + 0x40aa1e0]
pop esi
pop ebx
ret
Function at 0x409b58
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x788]
sub esp, 0x808
mov eax, dword [0x422004]
xor eax, ebp
mov dword [ebp + 0x784], eax
mov eax, dword [0x40b26b4]
push esi
mov esi, dword [0x40aa1d8]
push edi
mov dword [ebp - 0x80], eax
call fcn.004099cf
push eax
call fcn.00409a8a
dec dword [ebp - 0x80]
xor edi, edi
cmp dword [0x40b26b4], 0x638
pop ecx
jne 0x409bd4
push edi
lea eax, [ebp + 0x384]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x409bd4
call fcn.00409a0f
mov ecx, dword [ebp - 0x80]
add ecx, esi
xor byte [ecx], al
mov eax, 1
xor eax, 4
sub dword [ebp - 0x80], 1
cmp dword [ebp - 0x80], edi
jge 0x409bbc
mov ecx, dword [ebp + 0x784]
pop edi
xor ecx, ebp
pop esi
call fcn.00401000
add ebp, 0x788
leave
ret
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.09015fb3
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.09015fb3
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x9015fb3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x9015fc2
pop dword [ebp - 8]
mov eax, 0xebd66189
sub eax, 0xe2d501c7
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x48ce2820
add dword [ebp - 0x18], 0x5841d2b
mov dword [ebp - 0x14], 0xb0b88c76
sub dword [ebp - 0x14], 0x7e854031
mov dword [ebp - 0x10], 0xea84aa28
add dword [ebp - 0x10], 0x61c79a06
mov dword [ebp - 0xc], 0xad465c90
add dword [ebp - 0xc], 0x52b9a370
lea eax, [ebp - 0x18]
push eax
mov eax, 0x34d4ee8f
add eax, 0xd4387235
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x95af4d14
add dword [ebp - 0x18], 0xdec31c42
mov dword [ebp - 0x14], 0xfb06ffd2
sub dword [ebp - 0x14], 0xb99a9e5d
mov dword [ebp - 0x10], 0xd8e3ccec
add dword [ebp - 0x10], 0x8a8b9f80
mov dword [ebp - 0xc], 0x111667df
add dword [ebp - 0xc], 0xeee99821
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x77ffb
push 0
call eax
mov ecx, 0x81fa3412
add ecx, 0x7e061427
mov edi, eax
mov ebx, 0x9125c00
add ebx, dword [ebp - 8]
mov edx, 0x124ffd01
sub edx, 0x33fb8aff
add dword [ebp - 4], edi
mov esi, dword [ebx]
add dword [ebp - 4], 0xcea7ae4f
xor esi, edx
mov dword [edi], esi
add dword [ebp - 4], eax
add edi, 0xf79944cb
add edi, 0x866bb39
add ebx, 0xd1c7fdc8
sub ebx, 0xd1c7fdc4
loop 0x90160d9
add eax, 0xa9a6c709
sub eax, 0xa9a5b352
mov ebx, eax
add eax, 0xbb7a18cc
add eax, 0x4485e739
mov ecx, 0x6fc0a555
add ecx, 0x993f5aab
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x49f217
Capabilities:
Encode data using xor

Disassembly:
invalid
jnp 0x49f192
mov dl, 0xd
inc ebx
adc byte [edi - 0x745dae68], bl
push edi
pop ebx
and al, 0x3d
jo 0x49f222
fnstcw word [ebx + 0x242d98d3]
leave
sal dword [esi], 0x7c
dec ebp
mov edi, esi
in al, dx
invalid
inc ecx
xor dword [ecx], ebx
movsd dword es:[edi], dword [esi]
add ch, byte [edi - 0x7255f458]
invalid
cdq
pop ebp
iretd
lea ebx, [ecx - 0x50330a3]
inc esi
mov cl, 0xa6
dec ebx
jp 0x49f20e
jmp 0x49f292
outsb dx, byte [esi]
jmp 0x49f1bc
outsd dx, dword [esi]
out dx, al
stosd dword es:[edi], eax
xchg ebp, eax
lcall 0xe447, 0xa1dcd016
cmp byte [0xe752eb32], dh
fistp qword [edx]
pop edi
cwde
push ecx
imul edx, esp, 0x63
aaa
retf
jmp 0x49f2c6
ficom dword [0xbec72b]
pushfd
jns 0x49f2c2
sub eax, edi
mov esi, 0x27799c00
shr byte [edi + edx*2 - 0x16], 1
lodsb al, byte [esi]
dec eax
out 0xd3, eax
jbe 0x49f2d6
jmp 0x49f316
adc byte [esi], al
mov ebp, 0x9f986b93
jbe 0x49f2c7
dec ecx
jl 0x49f2ea
lodsd eax, dword [esi]
loopne 0x49f294
sbb eax, dword [eax - 0x38]
mov esp, 0x42ea7d95
xchg ebp, eax
jge 0x49f2af
inc edx
xor edx, dword [ebx + 0x68176af]
xchg ebx, eax
scasd eax, dword es:[edi]
jbe 0x49f24c
push es
mov bh, byte [ecx + 0x7a]
salc
popal
pop ss
jp 0x49f268
sbb byte [edx], dh
stosd dword es:[edi], eax
fldcw word [ecx + esi]
mov bh, 0x61
or ecx, dword [edi]
or ah, byte [edx - 0x67]
xchg byte [ecx], cl
cdq
aas
sub ch, dl
test byte [edi + 0x1d], cl
dec ebp
mov dl, byte [edi + 0xdb0a9d2]
out dx, al
or dl, byte [0xf4383409]
scasb al, byte es:[edi]
xchg edx, eax
test al, 9
sub ebp, esp
push ecx
inc edx
in eax, dx
xor byte [edx + 0x7c], dh
jle 0x49f333
add dh, dh
pop ebx
add dword [edi - 0xbf945], edx
invalid
mov eax, 0xc749a705
jae 0x49f361
inc esi
inc byte [ecx + 0xa]
shr byte [ecx], 1
sbb dword [ebx], ecx
push esp
sub ch, byte [esi]
or esi, esp
mul bh
sub byte [esp + 0x7226d7c4], dl
and bh, byte [ebx - 0x7d080be7]
jo 0x49f32a
push ds
pop ds
les edx, [edi]
iretd
rcr dword [ebx], 1
pop dword [esp + eax - 0xa5bc8c5]
pop edx
mov ebx, 0x5806ce5b
rol dword [esi], cl
cmp dh, byte [edi]
mov cl, 0xc7
sbb al, 0x95
sahf
cmp al, 0x1b
out 0xa3, al
adc esi, dword [edi - 0x77]
add byte [esi + 0x44], ch
mov ebp, 0xc32c5863
sar ah, 0xf7
xor dword [edi], ecx
xchg dword [ecx + 0x6a2dbdfa], edi
sbb al, dh
jbe 0x49f3da
inc ebx
aaa
jmp 0x49f396
test dl, ah
sub byte [edx + 0x331a46fa], ch
clc
xchg edi, eax
pop ebx
xchg esi, eax
ret 0x361e
Function at 0x4ac5c7
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x4ac5c4
adc eax, 0x16ab87f9
int1
loope 0x4ac634
insb byte es:[edi], dx
stosd dword es:[edi], eax
pop eax
push esp
out 0xdd, al
outsb dx, byte [esi]
jecxz 0x4ac5f7
wait
sbb dh, byte [edi - 0x76]
lea ebx, [eax]
sbb byte [ebx], bl
sub ecx, dword [ecx - 0x19555f82]
mov dword [esi - 0x60], edi
stosb byte es:[edi], al
out 0xa7, al
sbb ebp, dword [ebx]
mov dword [esi - 0x60], edi
stosb byte es:[edi], al
out 0xa7, al
mov al, byte [0x17a7e6aa]
pop ss
cmp bl, dl
lds ebx, [edx + 0x56]
xor al, 0xaa
jo 0x4ac5c9
test eax, 0xe8a990da
mov ch, 0x1c
dec ebp
jnp 0x4ac5ab
push edx
xor al, 0x83
mov ch, 0xda
or al, 0x4b
sal esi, cl
adc ebp, dword [esi + 0x64]
jae 0x4ac5b5
aaa
movsb byte es:[edi], byte [esi]
mov dword [0x29100a71], eax
retf
jns 0x4ac628
das
outsb dx, byte [esi]
xchg ebx, eax
int1
invalid
mov ebx, 0x52020719
iretd
imul ecx
cdq
rcr ecx, 0xcf
std
aam 0xe7
push esi
out 0x45, al
sbb byte [edi - 0x6c3e97f5], ah
or dh, byte [esi - 0x74]
popfd
dec esi
sahf
ljmp 0xba29

Function at 0x4eb357
Capabilities:
Encode data using xor

Disassembly:
xor byte [0xac3d256f], 0x25
mov dl, 0xdc
in eax, dx
xchg edx, eax
lodsb al, byte [esi]
and eax, 0x92eddcb2
mov bl, 0xca
sbb dword [ecx], esi
les esp, [ebx - 0x7c8bd2cc]
cmc
add esi, dword [eax + 0x4dc61100]
inc ecx
ja 0x4eb352
hlt
Function at 0x580b77
Capabilities:
Encode data using xor

Disassembly:
sar byte [ebx - 0xee9a129], cl
pop esp
sbb byte [edx + 0x1378929b], dh
xchg edx, eax
js 0x580b97
sub edx, dword [ebx - 0x19]
cdq
push ebx
mov bl, byte [edx + 0x3b5a8919]
mov byte [edi + 0x64cee36c], dh
rcr dword [edx + 0x33], 1
mov dword [ebp - 0x7cf4e1e2], esp
mov esi, 0x6bf36733
sbb ecx, edi
loop 0x580b81
xor ecx, dword [ecx + 0xb1e1ea5]
cmp dword [esi + 0x6bf36733], 0x1b
iretd
loop 0x580c1f
xchg ebp, eax
and al, byte [esi]
mov al, byte [ebx]
enter 0x3f06, 0x79
push 0xffffffffffffffed
pop edi
bound esi, qword [ebx - 0x66]
and eax, 0xa115c809
popfd
sub byte [ecx - 0xf28756], bh
sal esp, 1
mov bl, 0x39
cmp edx, ebx
mov esi, 0xfa3b2b82
inc esp
rcl cl, cl
mov dword [ecx + 0x5b], 0xbb2fa5b
and eax, 0x4822f69b
mov ebx, 0x71b2862f
mov ebp, 0x2a675a0a
invalid
call 0x46790c81
cld
sbb dl, byte [ecx]
clc
jns 0x580c70
jne 0x580c90
cli
xor dword [esi], esi
adc ebp, dword [eax - 0x7c]
cmp byte [edi + 0x781eebc8], bl
jb 0x580c83
sbb bl, byte [edi + 0x1bd88b32]
stc
adc ch, byte [edx + 0x30]
mov eax, 0x206e8ee
push es
adc dl, byte [edx]
pop ebx
sub al, ch
cmp ch, dl
nop
add eax, 0x65444d8f
adc bl, byte [eax + eax*4 + 0x21]
mov ebp, 0xf20292ef
jp 0x580cb2
mov dword [0xcc6395e2], eax
dec edi
add ebp, dword [ecx]
aam 0xaf
invalid
dec ebp
xor bl, byte [ebx - 0x1f6a2724]
inc ebx
lds cx, [ebx]
dec esp
xor dword [edi + 0x5d88af5a], 0xffffffe4
in al, 0x5a
pop edx
pop edx
ret
xchg esp, eax
mov esi, 0xe28b0885
dec ebp
jno 0x580d03
xchg ebx, eax
cmp ebp, dword [esi + 0x34eb4241]
push ss
mov ebp, 0xcacb1f8a
test dword [ecx - 0x664a0869], esi
jne 0x580c82
mov ebx, 0xb96cef19
push ss
push esi
or eax, dword [ebx + 0x1842fb4e]
push esp
out 2, eax
mov ecx, 0x830b5616
dec esi
sti
inc edx
sbb byte [edi + 2], dl
sti
movsb byte es:[edi], byte [esi]
lcall 0x85e2, 0xb54c9c74
cmpsd dword [esi], dword es:[edi]
cwde
stosd dword es:[edi], eax
add dword [edx], edx
test byte [edi + 0x6ab254e2], dh
adc bh, byte [eax]
cmpsb byte [esi], byte es:[edi]
sbb ebx, dword [edx]
and ebp, edx
invalid
test ah, bh
mov eax, dword [0x43ee46d2]
imul ebx, dword [ecx - 0x73], 0xffffffca
push es
mov ebp, 0xd7e76c82
invalid

Function at 0x6025a0
Capabilities:
Encode data using xor

Disassembly:
shr byte [ebx - 0x5d], 0x3d
xchg ebx, eax
dec ebx
mov ch, 0x5b
and byte [0x58e568e3], bl
push eax
mov al, byte cs:[0xade823f8]
xchg esp, eax
in al, dx
xor byte [ebp + edx - 0x675d2b52], ch
push eax
adc al, 0xd
mov dword [ebx - 0x61], esi
rol esp, cl
ja 0x6025a4
pop ds
push edi
arpl word [ebx + 0x78f66045], di
out 0x52, eax
mov edi, 0x7b132bd1
mov cl, 0x69
dec edx
mov byte [0x50baf478], al
or al, 0x7b
dec esp
dec esi
adc eax, 0x40950beb
hlt
Function at 0x65006c
Capabilities:
Encode data using xor

Disassembly:
jno 0x6500e2
sbb dword [edi + 0x73ede06f], ebp
popfd
mov al, 0xb2
mov bl, 0x98
mov dl, 0xb3
cwde
xor byte [esi + eax*8 - 0x56], 0x3c
sub dword [0x170ee4ed], ebp
mov gs, word [edi + 0x7e]
in eax, 0x4e
xchg esi, eax
outsb dx, byte [esi]
xor byte [eax + edi*2], ch
in eax, dx
pop ds
adc ebx, ebp
test esp, ebx
mov dl, 0x6e
and dword [edx - 0x5310e188], 0xfc2ab33e
jle 0x650076
sub bh, byte [edx + 0x1d]
and eax, 0xbf7cd60e
or ebx, ebp
aad 0x6a
scasb al, byte es:[edi]
adc byte [eax - 0x6784b782], 0xb7
cwde
mov bh, 0x51
push ecx
cmp eax, 0xfe3ae8b5
jb 0x6500b5
cmp eax, 0x3673b0e3
or ebp, 0xfffffffb
imul eax, eax, 0xb02a83ec
jne 0x650127
fdivrp st(4)
rol byte [edx - 0x43], cl
insb byte es:[edi], dx
loopne 0x65011f
lcall 0xe1e3, 0x454ae54
adc ecx, dword [ebp + 0x44d378e4]
js 0x6500b7
inc esp
push ebp
or eax, 0xcba06fd2
sub byte [ebp + 0x73132c56], bl
pushal
lodsd eax, dword [esi]
popfd
sub eax, 0x81e075e
aam 0x9a
push 0x50
into
invalid
cld
sub dl, byte [ecx - 0x77692312]
push cs
dec ecx
push ebx
stosb byte es:[edi], al
ret 0xf1ee
loop 0x650177
push es
push eax
push eax
rcl byte [edi]
xchg ebx, eax
push ebp
movsd dword es:[edi], dword [esi]
add cl, dh
push edi
das
invalid
imul edi, esi, 0xffffffb3
arpl word [esi + 0x1e202e0f], bx
pushal
int 4
and eax, 0xdbaae892
sub byte [0x5b40debc], bh
sar byte [edi + 0x68007c26], 0x4a
jnp 0x650118
add al, byte [edi]
add byte [eax + 0x5e3f1092], 0x8c
call word [eax - 0x54]
add ecx, ebp
dec esi
pop eax
jne 0x65018b
xor al, 0x79
invalid
mov esp, 0xbe62818e
wait
adc dword [eax + edx*8 - 0x18], esp
sub al, 5
imul edi, esi, 0x1c
clc
or eax, 0xccf3d33d
cmp byte [ebx + ebp*8], cl
push esp
adc ecx, dword [edx]
xor dword [eax - 0x351f9fb1], edi
out dx, al
outsb dx, byte [esi]
inc byte [ebx]
sub al, 0xbe
lodsb al, byte [esi]
jbe 0x65014e
jo 0x65015f
push esi
invalid
Function at 0x40a290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40a29f
pop dword [ebp - 0x3c]
mov eax, 0xa7105ebb
add eax, 0x593043e4
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xe99b3c10
add dword [ebp - 0x4c], 0x64b7093b
mov dword [ebp - 0x48], 0x2700279e
sub dword [ebp - 0x48], 0xf4ccdb59
mov dword [ebp - 0x44], 0xef141e42
add dword [ebp - 0x44], 0x5d3825ec
mov dword [ebp - 0x40], 0xe1971b89
sub dword [ebp - 0x40], 0xe1971b89
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xe71e0b76
sub eax, 0xe6dccae6
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x5f76c62a
add dword [ebp - 0x4c], 0x14fba32c
mov dword [ebp - 0x48], 0x361eb537
sub dword [ebp - 0x48], 0xf4b253c2
mov dword [ebp - 0x44], 0x40c7fe9f
add dword [ebp - 0x44], 0x22a76dcd
mov dword [ebp - 0x40], 0xba01102e
add dword [ebp - 0x40], 0x45feefd2
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x4db85833
add eax, 0xb288e809
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x380ce
push 0
call eax
mov ecx, 0x3c15
mov edx, eax
mov ebx, 0x821bfba4
add ebx, 0x7e25c45c
add ebx, dword [ebp - 0x3c]
mov esi, 0x64c3cec5
add esi, 0x1a17f7a0
add dword [ebp - 0x10], 0xb154aa55
mov edi, dword [ebx]
sub dword [ebp - 8], 0x79b70eae
xor edi, esi
mov dword [ebp - 0x2c], 0x9f907614
mov dword [edx], edi
add edx, 0x4cd9c3fd
sub edx, 0x4cd9c3f9
add ebx, 0x942354a8
sub ebx, 0x942354a4
loop 0x40a3bb
add eax, 0x14a0a75d
sub eax, 0x149fc436
mov ebx, eax
add eax, 0xb97dabc2
add eax, 0x46825443
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x6d775180
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x6d7815b4]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x6d7751b6
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d7752b0
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x6d7751ea
push str.create
push esi
call fcn.6d773a00
pop ecx
pop ecx
jmp 0x6d7752af
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x6d78117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x6d77529c
push dword [0x6d7815a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x6d775245
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d775262
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6d775280
push str.create
push esi
call fcn.6d773a00
pop ecx
pop ecx
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x6d78117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call fcn.6d771c6b
jmp 0x6d7752ae
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x6d78117c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x6d7752ae
push 0
push dword [0x6d7815a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x6d7762df
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x28], eax
call fcn.6d774fdf
push edi
mov ebx, eax
call fcn.6d77500b
pop ecx
pop ecx
test ebx, ebx
jns 0x6d77633c
test eax, eax
jns 0x6d77633a
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d77b1da
leave
ret 0x10
mov ebx, eax
cmp dword [ebp + 0x10], 0xf
jne 0x6d7763d1
mov dword [ebp - 0x30], 0x1c
cmp ebx, 0xffffffff
jne 0x6d77635b
push edi
call fcn.6d77500b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x6d776383
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.6d771c6b
add esp, 0xc
jmp 0x6d776326
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.6d771c6b
mov edi, eax
test edi, edi
je 0x6d776326
push dword [ebp - 0x28]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d776326
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x28]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x6d776329
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x6d7763ef
push str.Invalid_option
jmp 0x6d77631b
mov edi, 0x80
mov dword [ebp - 0x2c], 4
cmp dword [ebp + 0x10], edi
je 0x6d776404
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call fcn.6d771c6b
test eax, eax
jns 0x6d77642e
push str.getsockopt
push esi
call fcn.6d773a00
pop ecx
pop ecx
jmp 0x6d776326
mov eax, dword [ebp + 0x10]
cmp eax, 8
jg 0x6d77644c
je 0x6d776465
dec eax
je 0x6d776465
dec eax
dec eax
je 0x6d776476
dec eax
je 0x6d776465
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x6d77631b
cmp eax, edi
je 0x6d77647e
cmp eax, 0x1000
jle 0x6d776442
cmp eax, 0x1002
jle 0x6d776476
cmp eax, 0x1003
jne 0x6d776442
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x6d776329
mov eax, dword [ebp - 0x24]
jmp 0x6d776329
cmp word [ebp - 0x24], 0
je 0x6d776326
movzx eax, word [ebp - 0x22]
jmp 0x6d776329