joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037920
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x38], 0
push esi
push edi
jne 0x10037975
mov esi, dword [ebp + 0xc]
lea edi, [ebx + 0x58]
mov dword [ebp - 4], edi
call fcn.1002d5c0
mov word [edi], ax
test ax, ax
je 0x10037953
push esi
mov esi, edi
mov edi, dword [ebp + 0x10]
call fcn.1002d700
jmp 0x10037963
mov eax, dword [ebp + 0x10]
push eax
mov ebx, edi
mov ecx, esi
call fcn.1002d810
mov ebx, dword [ebp + 8]
add esp, 4
test eax, eax
jne 0x10037998
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0x10]
lea eax, [ebx + 0x58]
mov ecx, 2
push edx
mov dword [ebp - 4], eax
mov word [eax], cx
mov dword [ebx + 0x5c], 0xffffffff
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx + 0x5a], ax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x100379f9
cmp byte [eax], 0
je 0x100379f9
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
call fcn.1002df60
test eax, eax
je 0x1003796a
mov eax, dword [ebp + 8]
cmp dword [eax + 0x38], 1
jne 0x100379d8
cmp word [edi], 0x17
jne 0x100379d8
push 0x273b
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 4]
mov dx, word [ecx]
cmp dx, word [edi]
je 0x10037a15
push 0x273f
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov cx, word [eax]
mov esi, dword [ebp + 0x18]
push edx
mov word [esi], cx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
jmp 0x10037a17
mov ebx, eax
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
push 0x11
push 2
push ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 0x14], eax
cmp eax, 0xffffffff
je 0x1003796a
push 0
push 0
lea edx, [ebp + 0x18]
push edx
push 0
push 0
push 4
lea ecx, [ebp + 8]
push ecx
push 0x9800000c
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x10037a64
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x20]
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0xffff
push ecx
mov dword [ebp + 8], edx
call dword [sym.imp.WS2_32.dll_setsockopt]
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov esi, dword [ebp + 0xc]
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x9c]
test esi, esi
jne 0x10037a9b
xor ecx, ecx
jmp 0x10037aa9
mov ecx, esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10037aa0
sub ecx, edi
push esi
mov edi, ecx
call fcn.100174f0
mov dx, word [ebp + 0x10]
pop edi
pop esi
mov word [ebx + 0xa0], dx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10037ad0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
xor eax, eax
cmp word [esi], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
mov eax, dword [edi + 0x14]
push esi
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10037aff
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x14]
xor eax, eax
cmp word [esi], 2
lea ecx, [ebp - 4]
setne al
push ecx
push esi
push edx
dec eax
and eax, 0xfffffff4
add eax, 0x1c
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x101a4d98
call esi
test eax, eax
jne 0x10037b39
push 0x101a4d98
call esi
mov dword [edi + 0x1c], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10037b50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x38], 0
push ebx
jne 0x10037b6d
mov ebx, eax
mov ecx, esi
call fcn.10037c00
test eax, eax
jne 0x10037b8b
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x14]
push 4
lea eax, [ebp - 4]
push eax
push 0x20
push 0xffff
push ecx
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
push 0x23
push edx
push eax
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x10037bea
mov dword [esi + 0x48], 1
push ebx
mov dword [esi + 0x4c], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esi]
mov eax, dword [edx + 0x88]
mov ecx, esi
call eax
cmp eax, 2
jne 0x10037be5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10037bd7
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037c00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1019f010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, ecx
cmp word [esi + 0x58], 2
push 4
jne 0x10037c80
mov ecx, dword [esi + 0x14]
lea eax, [esi + 0x30]
push eax
push 0xa
push 0
push ecx
call edi
mov eax, dword [esi + 0x14]
push 4
lea edx, [esi + 0x34]
push edx
push 0xb
push 0
push eax
call edi
mov ecx, dword [esi + 0x5c]
mov esi, dword [esi + 0x14]
mov edx, dword [ebx + 4]
xor eax, eax
push 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0xc
push 0
push esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
call edi
cmp eax, 0xffffffff
jne 0x10037cf4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010ee1f
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x14]
lea ecx, [esi + 0x30]
push ecx
push 0xa
push 0x29
push edx
call edi
mov ecx, dword [esi + 0x14]
push 4
lea eax, [esi + 0x34]
push eax
push 0xb
push 0x29
push ecx
call edi
mov ecx, dword [esi + 0x68]
mov edx, dword [esi + 0x60]
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x14
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x64]
push 0xc
mov dword [ebp - 0x18], edx
mov edx, dword [esi + 0x6c]
mov esi, dword [esi + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
push 0x29
push esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
call edi
cmp eax, 0xffffffff
jne 0x10037cf4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010ee1f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.1010ee1f
mov esp, ebp
pop ebp
ret

Function at 0x10037f80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea ebx, [esi + 0x74]
lea esp, [esp]
mov edx, dword [esi + 0x24]
xor eax, eax
cmp word [ebx], 2
lea ecx, [ebp - 4]
setne al
push ecx
push ebx
push 0
push edx
dec eax
and eax, 0xfffffff4
add eax, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x90]
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test edi, edi
js 0x1003801a
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x90]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x98]
mov ecx, esi
call eax
cmp eax, 2
jne 0x10037f90
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.10103120
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10038001
mov eax, 0x4c7
mov dword [esi + 0x10], eax
pop edi
mov dword [esi + 0xc], 4
xor eax, eax
mov dword [esi + 8], 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
jne 0x10037f90
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10038001
lea eax, [edi + 2]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov edx, dword [eax + 0x8c]
call edx
test eax, eax
je 0x1003887e
lea ebx, [edi + 0x144]
call fcn.100053f0
mov eax, dword [edi + 0x44]
cmp eax, 3
jne 0x10038862
xor ebx, ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x144], ebx
mov edx, dword [edi]
mov eax, dword [edx + 0x90]
mov ecx, edi
call eax
xor ecx, ecx
mov word [ebp - 0x3c], cx
mov ecx, dword [ebp + 0x14]
xor edx, edx
lea eax, [ebp - 0x20]
push eax
push ecx
mov ecx, dword [ebp + 8]
mov word [ebp - 0x20], dx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x3c]
push eax
push ecx
push edi
mov dword [edi + 8], 1
mov dword [edi + 0xc], 5
mov dword [edi + 0x10], ebx
mov dword [ebp - 4], ebx
call fcn.10038950
test eax, eax
je 0x100388cd
lea ecx, [ebp - 0x20]
call fcn.10038a30
test eax, eax
je 0x100388be
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call esi
mov edx, dword [edi]
mov eax, dword [edi + 0x14]
mov edx, dword [edx + 0x70]
push eax
mov ecx, edi
call edx
cmp eax, 2
je 0x100388a6
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x3c]
mov ecx, edi
call fcn.10038a80
test eax, eax
je 0x10038897
lea ecx, [edi + 0x38]
push ecx
push ebx
push edi
push 0x10038b80
push ebx
push ebx
call fcn.101124d4
add esp, 0x18
mov dword [edi + 0x34], eax
cmp eax, ebx
je 0x10038889
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x10dd
mov dword [edi + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [edi + 0x144], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [edi + 0x3c], 8
push 0x65f
jmp 0x100388e1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x3c], 0xb
jmp 0x100388e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x100388b5
mov eax, 0x4c7
mov dword [edi + 0x3c], 5
jmp 0x100388e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x3c], 4
jmp 0x100388da
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x3c], 3
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
call esi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], 5
mov dword [edi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov ebx, eax
mov eax, dword [edx + 4]
mov ecx, edi
call eax
push ebx
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10038950
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ebx
call fcn.1002d5c0
mov esi, dword [ebp + 0x10]
mov word [esi], ax
test ax, ax
je 0x10038976
mov edi, dword [ebp + 0x14]
push ebx
call fcn.1002d700
jmp 0x10038987
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
push eax
mov ebx, esi
call fcn.1002d810
mov ebx, dword [ebp + 0xc]
add esp, 4
test eax, eax
je 0x100389be
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x100389cc
cmp byte [eax], 0
je 0x100389cc
mov edi, dword [ebp + 0x1c]
xor ebx, ebx
call fcn.1002df60
test eax, eax
je 0x100389be
mov ecx, dword [ebp + 0x10]
mov dx, word [ecx]
cmp dx, word [edi]
je 0x100389c7
push 0x273f
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18
mov ebx, dword [ebp + 0xc]
mov esi, ecx
movzx eax, word [esi]
push 0x11
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], eax
cmp eax, 0xffffffff
je 0x100389be
mov edx, eax
call fcn.1002e320
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x5c]
test ebx, ebx
jne 0x10038a00
xor ecx, ecx
jmp 0x10038a0e
mov ecx, ebx
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10038a05
sub ecx, edi
push ebx
mov edi, ecx
call fcn.100174f0
mov cx, word [ebp + 0x14]
pop edi
mov word [esi + 0x60], cx
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x18

Function at 0x10038a80
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
mov edi, ecx
cmp dword [ebp + 8], ebx
je 0x10038af1
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x10038b5e
mov edx, dword [edi + 0x14]
xor eax, eax
cmp word [esi], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
push esi
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x10038ae5
cmp eax, 0xffffffff
jne 0x10038adc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10038ae5
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
xor eax, eax
cmp word [esi], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
mov eax, dword [edi + 0x14]
push esi
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10038b5e
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x10038b5e
mov esi, 1
mov dword [edi + 0x40], esi
push 0
mov dword [edi + 0x44], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi]
mov edx, dword [eax + 0x74]
mov ecx, edi
call edx
cmp eax, 2
jne 0x10038b67
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10038b57
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
call fcn.10038d70
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10038cf0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x180]
mov ecx, dword [esi + 0x2c]
inc dword [esi + 0x180]
cmp eax, ecx
jb 0x10038d1b
mov dword [esi + 8], 1
mov dword [esi + 0xc], 5
mov dword [esi + 0x10], 0x2746
xor eax, eax
ret
mov edx, dword [esi + 0x14]
push edi
xor edi, edi
push edi
push edi
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10038d42
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10038d42
xor edi, edi
mov eax, dword [esi + 0x1c]
push eax
call fcn.10103120
add esp, 4
test edi, edi
je 0x10038d67
mov dword [esi + 0x10], edi
mov dword [esi + 8], 1
mov dword [esi + 0xc], 5
xor eax, eax
pop edi
ret
mov eax, 1
pop edi
ret

Function at 0x10038d70
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [edi + 0x14]
push esi
xor esi, esi
push esi
push esi
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10038d97
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x10038d97
xor esi, esi
mov ecx, dword [edi + 0x1c]
push ecx
call fcn.10103120
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x10038f50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
jmp 0x10038f60
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x14]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x10038fc5
push 0
call ebx
mov eax, dword [esi + 0x50]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x84]
mov ecx, esi
call eax
cmp eax, 2
jne 0x10038f60
mov edx, dword [esi + 0x1c]
push edx
call fcn.10103120
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10038faf
mov eax, 0x4c7
mov dword [esi + 0x10], eax
pop edi
mov dword [esi + 0xc], 4
xor eax, eax
mov dword [esi + 8], 1
pop ebx
ret
cmp edi, 0xffffffff
je 0x10038fe5
test edi, edi
jne 0x10038f60
mov ecx, dword [esi + 0x1c]
push ecx
mov dword [esi + 0x180], edi
call fcn.10103120
add esp, 4
jmp 0x10038f60
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10038faf
pop edi
mov eax, 1
pop ebx
ret
Function at 0x10039070
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10128378
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x1019f010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [esi + 0x64]
mov dword [ebp - 0x14], eax
xor edi, edi
xor ebx, ebx
cmp dword [esi + 0x160], edi
jle 0x10039107
lea eax, [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x160], edi
jle 0x100390fa
mov ebx, dword [esi + 0x164]
cmp ebx, dword [esi + 0x168]
je 0x100390da
mov eax, dword [ebx + 4]
mov dword [esi + 0x164], eax
mov dword [eax + 8], edi
jmp 0x100390ea
cmp ebx, edi
je 0x100390fa
mov dword [esi + 0x164], edi
mov dword [esi + 0x168], edi
cmp ebx, edi
je 0x100390fa
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
dec dword [esi + 0x160]
lea eax, [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x100391fc
lea eax, [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x18]
sub eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x14]
push edi
push eax
push ecx
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x10039144
sub dword [esi + 0x178], edi
lea eax, [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jle 0x1003917e
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebx + 0x14]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x7c]
mov ecx, esi
call eax
cmp eax, 2
jne 0x10039183
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.10103120
add esp, 4
jmp 0x10039183
cmp edi, 0xffffffff
je 0x100391a9
mov edi, dword [ebp - 0x14]
push ebx
add edi, 0x1c
call fcn.1002bed0
test eax, eax
jne 0x1003909d
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003909d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10039212
lea edi, [esi + 0x148]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x164]
xor ecx, ecx
cmp eax, ecx
je 0x100391dd
mov dword [eax + 8], ebx
mov ecx, dword [esi + 0x164]
mov dword [ebx + 4], ecx
jmp 0x100391e9
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [esi + 0x168], ebx
inc dword [esi + 0x160]
push edi
mov dword [esi + 0x164], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x14]
push ebx
add edi, 0x1c
mov dword [esi + 8], 1
mov dword [esi + 0xc], 3
mov dword [esi + 0x10], eax
call fcn.1002bed0
test eax, eax
jne 0x10039240
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039680
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ecx + 0x14]
xor eax, eax
lea edx, [ebp - 4]
mov word [ebp - 0x20], ax
push edx
lea eax, [ebp - 0x20]
push eax
push ecx
mov dword [ebp - 4], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100396b1
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ecx
push edx
lea ecx, [ebp + 0x10]
lea eax, [ebp - 0x20]
call fcn.1002de90
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10039b90
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
test eax, eax
je 0x10039b9f
cmp byte [eax], 0
jne 0x10039ba4
mov eax, str.0.0.0.0
push edi
xor ecx, ecx
lea edi, [ebp - 0x24]
mov word [ebp - 0x24], cx
call fcn.1002df60
test eax, eax
je 0x10039c94
mov ax, word [ebp - 0x24]
push 0x11
movzx edx, ax
push 2
push edx
mov word [esi + 0x38], ax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
je 0x10039c94
push 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 4
lea edx, [ebp - 4]
push edx
push 0x9800000c
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x10039c0f
call edi
mov ecx, dword [esi + 0x40]
xor eax, eax
cmp word [ebp - 0x24], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
lea eax, [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x10039c7d
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
mov edx, dword [esi]
mov eax, dword [esi + 0x40]
mov edx, dword [edx + 0xcc]
push eax
mov ecx, esi
call edx
cmp eax, 2
je 0x10039c5d
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10039c6c
mov eax, 0x4c7
push eax
mov dword [esi + 0x4c], 5
call edi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
call edi
push eax
mov dword [esi + 0x4c], 4
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov dword [esi + 0x4c], 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10039cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xc], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jbe 0x10039e39
push esi
push edi
push 0
push 0
push ebx
push 0x1003ae70
push 0
push 0
call fcn.101124d4
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x10039e1c
mov eax, dword [ebx + 0x58]
lea esi, [ebx + 0x54]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x10039da6
mov edx, dword [esi]
cmp edx, ecx
ja 0x10039da6
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x10039d96
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x10039e12
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x10039d96
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x10039d85
xor ecx, ecx
jmp 0x10039d87
add ecx, edx
cmp ecx, eax
jae 0x10039d8d
mov ecx, eax
push ecx
call fcn.10033af0
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x10039df2
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x10039df2
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x10039de9
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x10039e12
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x10039de9
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x10039dd8
xor ecx, ecx
jmp 0x10039dda
add ecx, edx
cmp ecx, eax
jae 0x10039de0
mov ecx, eax
push ecx
call fcn.10033af0
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x10039df2
mov dword [eax], edi
mov eax, dword [ebp - 8]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebx + 0xc]
jb 0x10039d14
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.vector_T__too_long
call fcn.1010eda6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebx + 0x4c], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [ebp - 0xc], 0
pop esi
mov eax, dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10039e50
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x2c], 0
mov eax, 1
jbe 0x10039e83
cmp dword [esi + 0x30], 0
jbe 0x10039e83
push 0
push 0
push esi
push 0x1003bc40
push 0
push 0
call fcn.101124d4
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x50], eax
mov eax, ecx
ret

Function at 0x1003a870
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ecx + 0x40]
xor eax, eax
lea edx, [ebp - 4]
mov word [ebp - 0x20], ax
push edx
lea eax, [ebp - 0x20]
push eax
push ecx
mov dword [ebp - 4], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1003a8a1
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ecx
push edx
lea ecx, [ebp + 0x10]
lea eax, [ebp - 0x20]
call fcn.1002de90
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret 0xc