joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009c280
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1013b588]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
je 0x1009c2c0
push 0x118
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.10101bf0
add esp, 0xc
mov byte [ebp - 0x24], 0
jmp 0x1009c34d
mov eax, dword [0x1013b584]
test eax, eax
jne 0x1009c2f2
lea ecx, [ebp - 0x4bc]
push ecx
mov dword [ebp - 0x4bc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x4ac], 2
sete al
inc eax
mov dword [0x1013b584], eax
cmp eax, 2
jne 0x1009c33b
lea edx, [ebp - 0x3a8]
push edx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [ebp - 0x3a8]
call fcn.1009c120
mov esi, eax
test esi, esi
je 0x1009c34d
push 0x118
lea eax, [ebp - 0x13c]
push esi
push eax
call fcn.10101bf0
push esi
mov byte [ebp - 0x24], 0
call fcn.10082dd0
add esp, 0x10
jmp 0x1009c34d
lea ecx, [ebp - 0x13c]
push ecx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c356
sub eax, edx
test eax, eax
jle 0x1009c37c
lea ecx, [ebp - 0x13c]
lea esp, [esp]
cmp byte [ecx + eax - 1], 0x5c
jne 0x1009c37c
dec eax
test eax, eax
jg 0x1009c370
mov byte [ebp + eax - 0x13c], 0
lea edx, [ebp - 0x13c]
push edx
push str._s_sqlite_
push edi
call fcn.1006657b
mov esi, edi
add esp, 0xc
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x1009c3a0
sub esi, ecx
lea eax, [edi + esi]
push eax
push 0xf
call fcn.100a2d80
add esp, 8
mov ecx, 3
lea esp, [esp]
movzx eax, byte [edi + esi]
xor edx, edx
mov ebx, 0x3e
div ebx
movzx eax, byte [edi + esi + 1]
add esi, 5
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 5], dl
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 4], al
movzx eax, byte [edi + esi - 3]
xor edx, edx
div ebx
movzx eax, byte [edi + esi - 2]
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 3], dl
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 2], al
movzx eax, byte [edi + esi - 1]
xor edx, edx
div ebx
dec ecx
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 1], dl
jne 0x1009c3c0
mov ebx, edi
mov byte [edi + esi], cl
call fcn.1009c050
mov esi, eax
test esi, esi
je 0x1009c458
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
push esi
setne bl
call fcn.10082dd0
add esp, 4
jmp 0x1009c467
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
test ebx, ebx
jne 0x1009c384
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1009c7f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x1009c81c
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1013b584]
test eax, eax
jne 0x1009c84e
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x108], 2
sete al
inc eax
mov dword [0x1013b584], eax
cmp eax, 2
je 0x1009c868
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c858
sub eax, edx
cmp eax, 0x104
ja 0x1009c80b
push esi
call fcn.1009c050
mov esi, eax
test esi, esi
je 0x1009c888
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call fcn.10082dd0
add esp, 4
jmp 0x1009c891
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
pop esi
cmp ebx, 0xffffffff
je 0x1009c80b
mov ecx, dword [ebp - 4]
and bl, 0x10
xor eax, eax
cmp bl, 0x10
sete al
xor ecx, ebp
pop ebx
call fcn.1006656c
mov esp, ebp
pop ebp
ret

Function at 0x1009cca0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1013b590], 0
push esi
jne 0x1009ccdb
mov esi, 1
add dword [0x1013b58c], esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
sub dword [0x1013b58c], esi
mov dword [0x1013b57c], eax
cmp eax, 0xffffffff
jne 0x1009ccd3
xor eax, eax
pop esi
pop ebp
ret
mov dword [0x1013b590], esi
jmp 0x1009cce0
mov eax, dword [0x1013b57c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x1009cd2f
test esi, esi
jne 0x1009cd73
push 0x14
call fcn.10066a7d
mov esi, eax
add esp, 4
test esi, esi
je 0x1009cd73
mov eax, dword [0x10114d84]
mov dword [esi], eax
mov ecx, dword [0x10114d88]
mov eax, dword [0x1013b57c]
mov dword [esi + 4], ecx
mov edx, dword [0x10114d8c]
push esi
push eax
mov dword [esi + 8], edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
pop ebp
ret
test esi, esi
je 0x1009cd73
test eax, eax
jns 0x1009cd73
mov eax, 0x10114d84
mov edx, esi
mov ecx, 0xc
sub edx, eax
push edi
mov edi, dword [edx + eax]
cmp edi, dword [eax]
jne 0x1009cd72
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x1009cd46
push esi
call fcn.10066b11
mov ecx, dword [0x1013b57c]
add esp, 4
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x100a2ec0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x100a8730
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x100a8740
xor eax, eax
pop edi
pop ebp
ret
push esi
push 1
push 0x44
call fcn.100891a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x100a8757
pop esi
pop edi
pop ebp
ret
mov al, byte [edi + 5]
mov byte [esi + 5], al
mov ecx, dword [edi]
push ecx
call fcn.100a7fb0
mov dword [esi], eax
mov edx, dword [edi + 0xc]
push edx
call fcn.100a8620
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
push eax
call fcn.100a8f40
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
push ecx
call fcn.100a7fb0
mov dword [esi + 0x14], eax
mov edx, dword [edi + 0x18]
push edx
call fcn.100a8f40
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
push eax
call fcn.100a7fb0
mov dword [esi + 0x1c], eax
movzx ecx, byte [edi + 4]
mov byte [esi + 4], cl
mov edx, dword [edi + 0x20]
push edx
call fcn.100a8730
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x28]
push eax
call fcn.100a8f40
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
push ecx
call fcn.100a8f40
mov dword [esi + 0x2c], eax
add esp, 0x24
or eax, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dl, byte [edi + 6]
mov byte [esi + 6], dl
movzx ecx, byte [edi + 7]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov byte [esi + 7], cl
mov word [esi + 8], 0
mov dword [esi + 0x24], 0
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x100b88a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100b88f0
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x100b88ea
shr eax, 8
cmp al, 2
jne 0x100b88ea
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 2
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x100c44e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x100c4513
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret

Function at 0x100c4660
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x100c467b
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
js 0x100c46af
cmp eax, 2
jg 0x100c46af
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x1011a330]
push 2
push edx
call fcn.10067b53
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.10067b53
add esp, 0x20
xor eax, eax
ret

Function at 0x100c4c60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [eax + ecx*4 + 0x190]
mov edx, ecx
add edx, edx
push esi
lea esi, [eax + edx*8 + 0x1b8]
mov edx, dword [eax + 0x300]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x3c], 3
je 0x100c4d00
cmp dword [eax + ecx*4 + 0x1a8], 0x100c49a0
jne 0x100c4d00
cmp dword [esi], 0
je 0x100c4c9d
test edi, edi
je 0x100c4d00
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.100b8dd0
add esp, 0x14
cmp eax, 0xffffffff
je 0x100c4d00
test al, 1
je 0x100c4d00
cmp dword [esi], 0
jne 0x100c4ce2
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x10138f10]
mov edi, dword [esi + 4]
xor ecx, ecx
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
cmp eax, ecx
je 0x100c4cfd
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x100c4d00
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebx
ret

Function at 0x100c4d10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + ecx*4 + 0x190]
mov eax, esi
call fcn.100c4c60
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push 0
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x100c4d93
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x2733
jne 0x100c4d68
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push eax
push esi
call fcn.100c9ed0
mov edx, dword [esi]
push eax
push str.Send_failure:__s
push edx
call fcn.100c4820
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x4708], ecx
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100c6610
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [esi + 0x520], eax
push 4
lea ecx, [ebp - 0x14]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x100c6663
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.100c47a0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x524]
push edx
mov dword [ebp - 0x10], 1
call fcn.100ddaa0
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x528]
push eax
call fcn.100ddaa0
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0xc
lea edx, [ebp - 0x10]
push edx
push 0x98000004
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x100c66d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.100c47a0
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x100c6d70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x8c], 2
mov ebx, dword [esi]
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x110], ebx
je 0x100c6f59
cmp dword [esi + 0x260], 0
push edi
jne 0x100c6f4f
cmp dword [esi + 0x2d0], 0
jne 0x100c6f4f
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push edi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x100c6e14
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.100c9ed0
push eax
push edi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.100c4820
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
push 0x80
lea edx, [ebp - 0x84]
push 0
push edx
mov dword [ebp - 0x10c], 0x80
call fcn.10066620
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x84]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100c6e7d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.100c9ed0
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.100c4820
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0x102]
lea ebx, [esi + 0x130]
lea esi, [ebp - 0x104]
mov dword [ebp - 0x114], edi
call fcn.100c6d30
test eax, eax
jne 0x100c6eda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x108]
mov esi, eax
push esi
push edx
call fcn.100c9ed0
push eax
mov eax, dword [ebp - 0x110]
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push eax
call fcn.100c4820
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x108]
mov esi, dword [ebp - 0x114]
lea edi, [eax + 0x58]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [eax + 0x164]
lea edi, [eax + 0x134]
lea esi, [ebp - 0x84]
call fcn.100c6d30
test eax, eax
jne 0x100c6f49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x108]
mov esi, eax
push esi
push ecx
call fcn.100c9ed0
mov edx, dword [ebp - 0x110]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.100c4820
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x108]
push esi
call fcn.100c6cb0
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x100c6f70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
push 4
lea eax, [ebp + 8]
push eax
push 1
push 6
push ecx
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x100c6fb9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.100c9ed0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.100c47a0
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.100c47a0
add esp, 8
pop edi
pop esi
pop ebp
ret

Function at 0x100c6fd0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1013b7a0]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x100c7021
push 3
push 2
push eax
push 6
call fcn.100e4c00
add esp, 0x10
test eax, eax
je 0x100c7015
mov dword [0x1013b7a0], 2
mov esp, ebp
pop ebp
ret
mov dword [0x1013b7a0], 1
jmp 0x100c7026
cmp eax, 2
je 0x100c7067
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x100c704f
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jg 0x100c7066
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100c7070
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1d8], 0
je 0x100c7083
xor eax, eax
pop ebp
ret
mov eax, dword [eax + 0x190]
cmp eax, 0xffffffff
je 0x100c707f
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
neg eax
sbb eax, eax
neg eax
pop ebp
ret
Function at 0x100c7bd0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edx
push eax
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x100c7d66
push edi
mov edi, dword [ebp - 0x10]
cmp edi, ebx
je 0x100c7d48
push esi
cmp dword [edi + 4], 2
jne 0x100c7ccc
cmp dword [edi + 0x18], ebx
je 0x100c7ccc
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x100c7ccc
cmp eax, 0x10
jb 0x100c7ccc
push 0x20
call dword [0x10138f10]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x100c7cd9
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [0x10138f10]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x100c7ce2
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x100c7cb7
push eax
call dword [0x10138f1c]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x100c7cf5
cmp dword [ebp - 4], ebx
jne 0x100c7cbf
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x100c7cc9
mov dword [eax + 0x1c], esi
mov dword [ebp - 0xc], esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x100c7c12
jmp 0x100c7d10
mov dword [ebp - 8], 8
jmp 0x100c7d10
push esi
mov dword [ebp - 8], 8
call dword [0x10138f14]
add esp, 4
jmp 0x100c7d10
mov edx, dword [esi + 0x18]
push edx
mov dword [ebp - 8], 8
call dword [0x10138f14]
push esi
call dword [0x10138f14]
add esp, 8
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, ebx
je 0x100c7d1f
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], ebx
je 0x100c7d43
mov eax, dword [ebp - 4]
push eax
call fcn.100c7b90
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
add esp, 4
mov ecx, ebx
pop edi
mov dword [ebp - 4], ebx
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], ebx
jne 0x100c7d5a
push 0x2af9
mov dword [ebp - 8], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [edx], ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100c9470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.101023d0
add esp, 0x18
test eax, eax
je 0x100c9494
cmp eax, 0xffffffff
jne 0x100c9496
xor eax, eax
pop ebp
ret
Function at 0x100d1920
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x1011a528
push ecx
call fcn.100c47a0
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.100d0a40
test eax, eax
jne 0x100d1954
mov eax, esi
pop ebp
jmp fcn.100d0ed0
pop ebp
ret
Function at 0x100d1d50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
push esi
mov esi, dword [eax + 0x4b8]
push edi
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [ebp - 0x84]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x100d1de4
mov edx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.10065960
mov edx, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x100d1e17
push str.Received_too_short_packet
push ebx
call fcn.100c4820
add esp, 8
mov dword [esi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x15c]
call fcn.100d0bf0
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x100d1e34
jmp dword [eax*4 + 0x100d1f64]
cmp edx, 4
jle case.0x100d1e34.4
lea eax, [esi + 0x15c]
call fcn.100d0c00
movzx ecx, word [esi + 0x40]
inc ecx
cmp cx, ax
jne case.0x100d1e34.4
mov eax, dword [ebp - 0x8c]
add edx, 0xfffffffc
push edx
mov edx, dword [esi + 0x15c]
add edx, 4
push edx
push 1
push eax
call fcn.100c4c20
mov edi, eax
add esp, 0x10
test edi, edi
je 0x100d1ea1
mov ecx, 5
mov eax, esi
call fcn.100d1cd0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x70], eax
adc dword [ebx + 0x74], edx
mov ecx, dword [ebx + 0x74]
mov edx, dword [ebx + 0x70]
push ecx
push edx
push ebx
call fcn.100e0d90
jmp 0x100d1f25
lea eax, [esi + 0x15c]
call fcn.100d0c00
mov ecx, dword [esi + 0x15c]
add ecx, 4
push ecx
movzx eax, ax
push 0x1011a528
push ebx
mov dword [esi + 8], eax
call fcn.100c47a0
jmp 0x100d1f25
add edx, 0xfffffffe
push edx
mov edx, dword [esi + 0x15c]
add edx, 2
push edx
push esi
call fcn.100d0c90
add esp, 0xc
test eax, eax
je case.0x100d1e34.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x101230e0
push ebx
call fcn.100c4820
add esp, 0xc
mov eax, dword [ebp - 0x8c]
push eax
call fcn.100e0f70
add esp, 4
test eax, eax
je 0x100d1e04
mov ecx, 5
mov eax, esi
call fcn.100d1cd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x2a
pop ebx
call fcn.1006656c
mov esp, ebp
pop ebp
ret