joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438520
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4697e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.00462862
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00437ec0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00462790
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0045f054
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0045f054
push 1
push 0
push 0
mov ecx, esi
call fcn.0045effc
push 1
push 0
push 1
mov ecx, esi
call fcn.0045effc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004628d4
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4386a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x469808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00462862
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00437ec0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00462790
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x438764
cmp dword [esp + 0x40], 1
jne 0x438762
cmp ecx, eax
jge 0x438764
mov eax, ecx
cmp eax, 0xc8
jge 0x438770
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00438520
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004628d4
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x438ef0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x469873
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045d474
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00462b0a
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00464069
test eax, eax
je 0x43900c
mov ecx, dword [esp + 0x3c]
call fcn.00462b37
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x438fd0
push edi
mov ecx, esi
call fcn.0046019f
mov ecx, esi
call fcn.00439170
cmp dword [esp + 0x38], 1
jne 0x439005
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004602da
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43ba30
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43ba63
push esi
call fcn.0043eb20
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43ba5c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43bae9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43bad2
mov eax, dword [esi + 8]
test eax, eax
je 0x43ba87
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43bace
cmp eax, 2
je 0x43bad2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43ba7a
cmp eax, 3
je 0x43baad
cmp eax, 1
jne 0x43ba7a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43ba7a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43ba7a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043bb10
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43baf8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043bb10
add esp, 4
pop esi
ret

Function at 0x448590
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x448633
test eax, eax
jbe 0x448633
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x448633
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4485de
xor esi, esi
jmp 0x4485e4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44860f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004029e0
add esi, eax
push esi
mov ebx, esi
call fcn.004029e0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4485f0
pop ebp
test edi, edi
pop edi
jne 0x448633
test ebx, ebx
je 0x448633
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0044cee0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x448775
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44888d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44888d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0045d8c6
mov esi, eax
test esi, esi
je 0x44888d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44888d
mov ecx, esi
call fcn.004486e0
cmp edi, eax
jge 0x44888d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x448813
mov dword [esp + 0x34], 1
jmp 0x44886e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44888d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00446f80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x45e26a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45e2a2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045c31e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045c2f6
jmp 0x45e2ae
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45f95c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45f99e
call fcn.00465454
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45f99e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45f995
xor eax, eax
jmp 0x45f9a6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045f9ac
pop edi
pop esi
pop ebx
ret 4
Function at 0x465984
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4659b2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4659d0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004658ea
jmp 0x4659d0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4659d0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004658ea
test edi, edi
mov eax, edi
jne 0x4659ba
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x78bb1eb3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x78bbe5b0]
jne 0x78bb1ebd
repz ret
jmp fcn.78bb557c

Function at 0x78bb3c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x78bb3c2f
pop dword [ebp - 0x48]
mov eax, 0x6c27a2a1
add eax, 0xc93998e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xc01106e8
sub dword [ebp - 0x58], 0x71bec19d
mov dword [ebp - 0x54], 0xd89d3b2e
add dword [ebp - 0x54], 0x59961117
mov dword [ebp - 0x50], 0x43e53cc2
add dword [ebp - 0x50], 0x867076c
mov dword [ebp - 0x4c], 0xfb6d611c
sub dword [ebp - 0x4c], 0xfb6d611c
lea eax, [ebp - 0x58]
push eax
mov eax, 0x5267c6f0
sub eax, 0xd9adb668
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xcd2ed82
sub dword [ebp - 0x58], 0x9860842c
mov dword [ebp - 0x54], 0xc98355e2
add dword [ebp - 0x54], 0x77e90b93
mov dword [ebp - 0x50], 0x45995b29
add dword [ebp - 0x50], 0x1dd61143
mov dword [ebp - 0x4c], 0x16b6a756
sub dword [ebp - 0x4c], 0x16b6a756
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x5e6c8066
add eax, 0x1a4d9002
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x40226
push 0
call eax
mov ecx, 0x56b4
mov esi, eax
mov edi, 0x253c36cb
add edi, 0x537fff35
add edi, dword [ebp - 0x48]
mov edx, 0x95d84555
add edx, 0x2c93da7c
mov ebx, dword [edi]
sub dword [ebp - 0x14], edi
sub ebx, edx
xor dword [ebp - 0x18], ebx
mov dword [esi], ebx
add dword [ebp - 0x44], 0x28e25e24
add esi, 0x529f67f8
add esi, 0xad60980c
add edi, 0xf69186d3
sub edi, 0xf69186cf
loop 0x78bb3d4b
add eax, 0x14da3
xor ebx, ebx
add ebx, eax
add eax, 0x5a9e9475
sub eax, 0x5a9e9470
mov ecx, 0x78ba0000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x406c81
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x406cbf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406c95
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x406c90
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406cec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ccd
not eax
pop ebp
ret 0xc

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4086d9
pop dword [ebp - 0x4c]
mov eax, 0x4086d9
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xb65843f0
add dword [ebp - 0x5c], 0x97fa015b
mov dword [ebp - 0x58], 0xde875556
sub dword [ebp - 0x58], 0xac540911
mov dword [ebp - 0x54], 0x5bf9a5d1
add dword [ebp - 0x54], 0xf0529e5d
mov dword [ebp - 0x50], 0x3c8dfb07
sub dword [ebp - 0x50], 0x3c8dfb07
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x9c851a10
add eax, 0x63bbb644
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9155bd0
add dword [ebp - 0x5c], 0x6b5d0d86
mov dword [ebp - 0x58], 0x76bd688b
add dword [ebp - 0x58], 0xcaaef8ea
mov dword [ebp - 0x54], 0xda2aa84
sub dword [ebp - 0x54], 0xaa333e18
mov dword [ebp - 0x50], 0xc285af19
sub dword [ebp - 0x50], 0xc285af19
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xa9e3ee26
sub eax, 0xa9a31dda
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x36be5
push 0
call eax
mov ecx, 0x11c3e603
add ecx, 0xee3c56e2
mov edi, eax
mov esi, 0x16a04498
add esi, 0xe9a16b68
add esi, dword [ebp - 0x4c]
mov ebx, 0xa73819de
add ebx, 0xdbd87677
mov dword [ebp - 0x30], 0x3a7fb90
mov edx, dword [esi]
sub dword [ebp - 0x30], ecx
add edx, ebx
mov dword [ebp - 0xc], 0x1a061126
mov dword [edi], edx
xor dword [ebp - 0x48], esi
add edi, 0xc946943a
add edi, 0x36b96bca
add esi, 0x5ee84669
add esi, 0xa117b99b
loop 0x4087f6
add eax, 0xe667
mov ebx, eax
add eax, 0x210986e4
add eax, 0xdef67921
mov ecx, 0x8d6cbfb3
add ecx, 0x72d3404d
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x6d775180
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x6d7815b4]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x6d7751b6
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d7752b0
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x6d7751ea
push str.create
push esi
call fcn.6d773a00
pop ecx
pop ecx
jmp 0x6d7752af
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x6d78117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x6d77529c
push dword [0x6d7815a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x6d775245
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d775262
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6d775280
push str.create
push esi
call fcn.6d773a00
pop ecx
pop ecx
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x6d78117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call fcn.6d77b24a
jmp 0x6d7752ae
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x6d78117c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x6d7752ae
push 0
push dword [0x6d7815a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x6d7762df
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x28], eax
call fcn.6d774fdf
push edi
mov ebx, eax
call fcn.6d77500b
pop ecx
pop ecx
test ebx, ebx
jns 0x6d77633c
test eax, eax
jns 0x6d77633a
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d77b1da
leave
ret 0x10
mov ebx, eax
cmp dword [ebp + 0x10], 0xf
jne 0x6d7763d1
mov dword [ebp - 0x30], 0x1c
cmp ebx, 0xffffffff
jne 0x6d77635b
push edi
call fcn.6d77500b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x6d776383
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.6d77b24a
add esp, 0xc
jmp 0x6d776326
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.6d77b24a
mov edi, eax
test edi, edi
je 0x6d776326
push dword [ebp - 0x28]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d776326
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x28]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x6d776329
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x6d7763ef
push str.Invalid_option
jmp 0x6d77631b
mov edi, 0x80
mov dword [ebp - 0x2c], 4
cmp dword [ebp + 0x10], edi
je 0x6d776404
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call fcn.6d77b24a
test eax, eax
jns 0x6d77642e
push str.getsockopt
push esi
call fcn.6d773a00
pop ecx
pop ecx
jmp 0x6d776326
mov eax, dword [ebp + 0x10]
cmp eax, 8
jg 0x6d77644c
je 0x6d776465
dec eax
je 0x6d776465
dec eax
dec eax
je 0x6d776476
dec eax
je 0x6d776465
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x6d77631b
cmp eax, edi
je 0x6d77647e
cmp eax, 0x1000
jle 0x6d776442
cmp eax, 0x1002
jle 0x6d776476
cmp eax, 0x1003
jne 0x6d776442
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x6d776329
mov eax, dword [ebp - 0x24]
jmp 0x6d776329
cmp word [ebp - 0x24], 0
je 0x6d776326
movzx eax, word [ebp - 0x22]
jmp 0x6d776329
Function at 0x6d7764df
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push dword [0x6d7815b4]
mov esi, dword [esp + 0xc]
push dword [esp + 0x10]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
test eax, eax
jne 0x6d776507
push str.Socket_closed
push str.java_net_SocketException
jmp 0x6d77654c
push dword [0x6d78117c]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x190]
cmp eax, 0xffffffff
je 0x6d7764fb
push 1
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x6d776540
push str.send
push esi
call fcn.6d773a00
pop ecx
pop ecx
jmp 0x6d776552
cmp eax, 0xfffffffe
jne 0x6d776552
push 0
push str.java_io_InterruptedIOException
push esi
call sub.java.dll__JNU_ThrowByName_12
pop esi
ret 0xc

Function at 0x6d77659a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
xor eax, eax
cmp byte [ebp + 0x10], al
push esi
sete al
push 0
inc eax
push eax
push 0x17
call fcn.6d77465c
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x6d7765d8
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call fcn.6d77b24a
or eax, esi
jmp 0x6d77660f
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6d776602
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call fcn.6d77b24a
push 0
push 1
push esi
call dword [sym.imp.kernel32.dll_SetHandleInformation]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x6d77667f
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push 1
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call fcn.6d77b24a
test eax, eax
jne 0x6d776701
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d776704
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x6d7766dc
push 0xfffffffffffffffe
pop eax
jmp 0x6d776704
cmp eax, 0x2741
jne 0x6d7766f5
push str.connect:_Address_is_invalid_on_local_machine__or_port_is_not_valid_on_remote_machine
push str.java_net_ConnectException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d776701
push str.connect
push eax
push esi
call fcn.6d77b24a
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d77b1da
leave
ret 0x14