joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f440
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1001f450
push dword [ebp + 8]
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebp - 0x14], xmm0
sub esi, ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 4]
push eax
push 0x1007355c
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jge 0x1001f495
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x31]
push eax
push 1
call dword [0x1006c328]
mov esi, eax
add esp, 8
test esi, esi
je 0x1001f48d
movdqu xmm0, xmmword [ebp - 0x14]
lea eax, [esi + 0x20]
mov dword [esi], 0
mov dword [esi + 0x18], eax
mov edx, edi
mov dword [esi + 4], 2
mov dword [esi + 8], 1
mov dword [esi + 0xc], 6
mov dword [esi + 0x10], 0x10
movdqu xmmword [eax], xmm0
mov ecx, dword [esi + 0x18]
add ecx, 0x10
mov dword [esi + 0x14], ecx
lea esp, [esp]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x1001f4f0
push edi
push dword [ebp + 8]
call fcn.1001f520
add esp, 8
test eax, eax
jne 0x1001f516
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov dword [eax + 0x1c], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001f520
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1006d860]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001f540
sub ecx, edx
lea eax, [ecx + 0x3d]
push eax
push 1
call dword [0x1006c328]
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001f570
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052617
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov eax, 0x17
mov word [ebp - 0x30], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x14]
push eax
push 0x10073558
push 0x17
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jl 0x1001f55e
movdqu xmm0, xmmword [ebp - 0x14]
push 0x1c
lea ecx, [ebp - 0x30]
mov dword [edi], 0
lea eax, [edi + 0x20]
mov dword [edi + 4], 0x17
push ecx
push eax
movdqu xmmword [ebp - 0x28], xmm0
mov dword [edi + 8], 1
mov dword [edi + 0xc], 6
mov dword [edi + 0x10], 0x1c
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
call fcn.10053530
mov ecx, dword [edi + 0x18]
add esp, 0xc
add ecx, 0x1c
mov dword [edi + 0x14], ecx
jmp 0x1001f600
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x1001f600
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10052617
mov esp, ebp
pop ebp
ret
Function at 0x1001f680
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1006d860]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0x48], eax
cmp byte [eax + 0x68a], 0
mov dword [ebp - 0x4c], esi
je 0x1001f84d
cmp byte [esi + 0x18], 0
push ebx
lea ebx, [esi + 0x18]
je 0x1001f84c
lea eax, [ebp - 0x70]
push eax
push ebx
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1001f84c
lea eax, [ebp - 0x44]
push eax
push ebx
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1001f84c
mov ecx, dword [ebp - 0x4c]
mov eax, 0x100736cc
cmp byte [ebx], 0
mov esi, dword [esi]
cmovne eax, ebx
mov ebx, dword [ebp - 0x48]
push dword [ecx + 0x14]
push eax
push 0x100736d4
push ebx
call fcn.10010810
lea eax, [ebp - 0x6c]
push 0x400
push eax
call fcn.10012dc0
lea eax, [ebp - 0x5c]
push 0x400
push eax
call fcn.10012dc0
add esp, 0x20
test esi, esi
je 0x1001f7c4
mov edi, edi
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x1001f73d
cmp ecx, 2
jne 0x1001f7b6
xor eax, eax
mov byte [ebp - 0x34], 0
cmp ecx, 2
lea ebx, [ebp - 0x6c]
setne al
shl eax, 4
add ebx, eax
sub ecx, 2
je 0x1001f76c
sub ecx, 0x15
jne 0x1001f780
push 0x2e
lea eax, [ebp - 0x34]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x1001f77b
push 0x2e
lea eax, [ebp - 0x34]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call sub.WS2_32.dll_inet_ntop
push ebx
call fcn.10012df0
add esp, 4
test eax, eax
je 0x1001f79f
push 2
push 0x10070710
push ebx
call fcn.10012d80
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x1001f7e2
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.10012d20
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001f7e2
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x1001f730
mov ebx, dword [ebp - 0x48]
lea eax, [ebp - 0x5c]
push eax
call fcn.10012df0
add esp, 4
test eax, eax
je 0x1001f7f4
lea eax, [ebp - 0x5c]
push eax
call fcn.10012e00
add esp, 4
jmp 0x1001f7f9
push 0x100736f0
push dword [ebp - 0x48]
call fcn.10010810
add esp, 8
jmp 0x1001f837
mov eax, 0x100736cc
push eax
push 0x10073708
push ebx
call fcn.10010810
lea eax, [ebp - 0x6c]
push eax
call fcn.10012df0
add esp, 0x10
test eax, eax
je 0x1001f823
lea eax, [ebp - 0x6c]
push eax
call fcn.10012e00
add esp, 4
jmp 0x1001f828
mov eax, 0x100736cc
push eax
push 0x10073714
push ebx
call fcn.10010810
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
call fcn.10012d90
lea eax, [ebp - 0x5c]
push eax
call fcn.10012d90
add esp, 8
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10052617
mov esp, ebp
pop ebp
ret
Function at 0x1002a9d0
Capabilities:
Create new key via cryptacquirecontext
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1002aa21
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1002aa2a
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
call fcn.1004fa50
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.1002aa60
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10034520
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp ebx, 0x20
jbe 0x10034544
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
call esi
cmp eax, 1
jne 0x1003456b
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push 2
call esi
cmp eax, 1
je 0x10034573
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x100345a9
cmp ebx, 0x20
je 0x100345a9
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push edi
push dword [ebp - 4]
call esi
push dword [ebp - 8]
mov edi, eax
call esi
mov ecx, 0x20
or edx, 0xffffffff
sub ecx, ebx
xor eax, edi
shl edx, cl
pop edi
test edx, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
cmp ecx, dword [ebp - 8]
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100345c0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006d860]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
mov dword [ebp - 0x28], ecx
mov ecx, 0x80
push edi
cmove ebx, ecx
lea ecx, [ebp - 0x24]
push ecx
push eax
mov edi, ebx
and ebx, 7
push 0x17
shr edi, 3
call esi
cmp eax, 1
jne 0x10034620
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x28]
push 0x17
call esi
cmp eax, 1
jne 0x10034620
cmp edi, 0x10
jg 0x10034620
jne 0x10034633
test ebx, ebx
je 0x10034637
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052617
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x10034687
mov esi, edi
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x14]
sub esi, 4
jb 0x10034655
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1003465a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10034644
cmp esi, 0xfffffffc
je 0x10034687
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10034620
cmp esi, 0xfffffffd
je 0x10034687
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10034620
cmp esi, 0xfffffffe
je 0x10034687
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10034620
cmp esi, 0xffffffff
je 0x10034687
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x10034620
test ebx, ebx
je 0x100346ad
movzx eax, byte [ebp + edi - 0x24]
mov ecx, 8
movzx edx, byte [ebp + edi - 0x14]
sub ecx, ebx
xor edx, eax
mov eax, 0xff
shl eax, cl
test eax, edx
je 0x10034620
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052617
mov esp, ebp
pop ebp
ret
Function at 0x10037b50
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, 0x2b
test edi, edi
je 0x10037bde
mov ebx, dword [ebp + 0xc]
mov edx, dword [0x1007fdbc]
jmp 0x10037b70
mov esi, 4
cmp edi, esi
cmovb esi, edi
cmp byte [0x1007fdb8], 0
jne 0x10037baf
push 2
push 4
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 2
jne 0x10037bde
mov eax, dword [ebp + 0x10]
mov edx, dword [0x1007fdbc]
jmp 0x10037bc8
imul edx, edx, 0x41c64e6d
add edx, 0x3039
mov eax, edx
mov dword [0x1007fdbc], edx
rol eax, 0x10
xor ecx, ecx
test esi, esi
je 0x10037bda
lea esp, [esp]
mov byte [ebx], al
dec edi
inc ebx
shr eax, 8
dec esi
jne 0x10037bd0
test edi, edi
jne 0x10037b70
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x10037bf0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
dec edi
je 0x10037c6a
mov ecx, dword [0x1007fdbc]
mov ebx, 0x3e
lea ebx, [ebx]
cmp byte [0x1007fdb8], 0
jne 0x10037c3e
push 2
push 4
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x10037c74
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1007fdbc]
jmp 0x10037c55
imul ecx, ecx, 0x41c64e6d
add ecx, 0x3039
mov eax, ecx
mov dword [0x1007fdbc], ecx
rol eax, 0x10
cmp eax, 0xfffffffc
jae 0x10037c10
xor edx, edx
div ebx
mov al, byte [edx + 0x10076720]
mov byte [esi], al
inc esi
dec edi
jne 0x10037c10
pop edi
mov byte [esi], 0
xor eax, eax
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret

Function at 0x10037d10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.10047980
push dword [ebp + 8]
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebp - 0x10], xmm0
call fcn.10069569
push dword [ebp + 0xc]
mov edi, eax
call fcn.10069569
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x10037d9d
lea eax, [ebp - 0x20]
push eax
call fcn.10047980
movdqu xmm0, xmmword [ebp - 0x10]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movdqu xmmword [ecx], xmm0
mov ecx, esp
movdqu xmm0, xmmword [eax]
movdqu xmmword [ecx], xmm0
call fcn.10047a20
add esp, 0x20
test edx, edx
ja 0x10037dc0
jb 0x10037d8b
cmp eax, 0x3e8
ja 0x10037dc0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x10037d52
test edi, edi
je 0x10037daa
push edi
call fcn.10054b00
add esp, 4
test esi, esi
je 0x10037db7
push esi
call fcn.10054b00
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x10037dcd
push edi
call fcn.10054b00
add esp, 4
test esi, esi
je 0x10037dda
push esi
call fcn.10054b00
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039e10
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10039e2b
cmp dword [edi], 0
jne 0x10039e3d
test esi, esi
je 0x10039e34
cmp dword [esi], 0
jne 0x10039e3d
test ebx, ebx
je 0x10039e86
cmp dword [ebx], 0
je 0x10039e86
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push eax
call fcn.100478b0
add esp, 0xc
test ebx, ebx
je 0x10039e58
cmp dword [ebx], 0
jne 0x10039e5a
xor ebx, ebx
test esi, esi
je 0x10039e63
cmp dword [esi], 0
jne 0x10039e65
xor esi, esi
test edi, edi
je 0x10039e6e
cmp dword [edi], 0
jne 0x10039e70
xor edi, edi
push eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x18]
mov eax, ecx
mov edx, dword [ebp + 0x1c]
or eax, edx
mov dword [ebp - 4], edx
je 0x10039ed2
test edx, edx
jg 0x10039ebf
jl 0x10039e9f
test ecx, ecx
jae 0x10039eb4
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jl 0x10039ecb
jg 0x10039ebf
cmp ecx, 0xffffffff
jb 0x10039ecb
mov ecx, 0xfffffffe
mov dword [ebp - 4], 0
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e580
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1003e5a8
mov eax, 0x1b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1003e5d5
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
call fcn.1004fa50
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
call fcn.1003e4c0
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100441a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0x10079740
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100441c0
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x1007974c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x1007975c
push esi
mov dword [ebp - 8], ebx
call fcn.10056fbe
add esp, 8
test eax, eax
je 0x1004420c
test ebx, ebx
je 0x100441fc
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10044235
push 0x10079760
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10044235
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x100442e0
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10044251
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x1006c318]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100442d6
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100442d6
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10044282
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100442a0
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100442b0
mov eax, dword [ebp - 8]
test eax, eax
je 0x100442cd
push 8
push 0
push ebx
call eax
jmp 0x100442d4
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x1006c31c]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10044350
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1006d860]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ebp + 8], 2
je 0x100443a9
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10044396
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x10044390
shr eax, 8
cmp al, 2
je 0x100443a9
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052617
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x100796e4
call fcn.100441a0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov dword [0x1007fdd0], eax
test eax, eax
je 0x100443e0
push 0x100796f4
push eax
call edi
mov ecx, dword [0x1007fdc0]
test eax, eax
cmovne ecx, eax
mov dword [0x1007fdc0], ecx
push 0x10079704
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x10044418
push 0x1007970c
push esi
call edi
push 0x1007971c
push esi
mov dword [0x1007fdc4], eax
call edi
push 0x10079730
push esi
mov dword [0x1007fdc8], eax
call edi
mov dword [0x1007fdcc], eax
push 3
push 2
push 0
push 0
push 6
call fcn.1004f790
push 3
push 2
push 0
test al, al
push 2
push 6
setne byte [0x10080d91]
call fcn.1004f790
add esp, 0x28
test al, al
setne byte [0x10080d90]
push 0x10080d98
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10052617
mov esp, ebp
pop ebp
ret

Function at 0x10045570
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
mov byte [ebp + 0xa], cl
lea ecx, [ebp + 8]
push 3
mov eax, dword [esi + 0x18]
push ecx
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
push dword [eax + 0x1a0]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x100455b8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x10079b08
push esi
call fcn.10010750
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push 0x10079b24
push esi
call fcn.10044e80
add esp, 0x10
pop esi
pop ebx
pop ebp
ret
Function at 0x10045710
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1f
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jne 0x1004586c
push edi
lea ecx, [eax + 0x1cc4]
lea edi, [eax + 0x1ec4]
mov dword [edi], ecx
cmp ecx, edi
jae 0x1004574b
mov byte [ecx], 0xff
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x10045756
mov byte [ecx], 0xfa
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x10045761
mov byte [ecx], 0x1f
inc dword [edi]
movzx eax, word [eax + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x1caa]
push eax
call esi
mov ecx, dword [ebp + 8]
movzx edx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x10045795
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004579f
mov byte [eax], ch
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100457a9
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100457b3
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100457be
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100457c9
mov byte [eax], 0xf0
inc dword [edi]
mov esi, dword [ebp - 4]
mov eax, dword [edi]
mov dword [esi + 0x1ec8], eax
lea ecx, [esi + 0x1cc4]
sub eax, ecx
mov dword [edi], ecx
sub eax, 2
push eax
lea eax, [esi + 0x1cc6]
push eax
push 0x3e
push ebx
call fcn.10044f80
add esp, 0x10
lea eax, [esi + 0x1cc4]
push 0
push 3
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x1a0]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x10045829
call edi
push eax
push 0x10079b08
push ebx
call fcn.10010750
add esp, 0xc
push 4
lea eax, [esi + 0x1cc7]
push eax
push ebx
call fcn.100455d0
add esp, 0xc
lea eax, [esi + 0x1ccb]
push 0
push 2
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x1a0]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x1004586b
call edi
push eax
push 0x10079b08
push ebx
call fcn.10010750
add esp, 0xc
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046800
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1006d860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x90], esi
mov eax, dword [esi + 0x18]
mov edi, dword [eax + 0x2d0]
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [edi + 0x13c]
push ebx
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [edi + 0x134], eax
cmp dword [edi + 0x130], ebx
jne 0x10046892
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.10053530
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [edi + 0x130], eax
cmp dword [edi + 0x134], 4
jge 0x100468c3
push 0x1007a150
push esi
call fcn.10010750
add esp, 8
mov dword [edi + 0xc], 7
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052617
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x148]
movzx eax, byte [ecx]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 1]
or edx, eax
mov dword [edi + 0xc], edx
add edx, 0xfffffffd
cmp edx, 3
ja case.default.0x100468e8
jmp dword [edx*4 + 0x10046a2c]
cmp dword [edi + 0x134], 4
jle case.0x100468e8.4
movzx eax, byte [ecx + 2]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 3]
or edx, eax
movzx eax, word [edi + 0x144]
inc eax
and eax, 0xffff
cmp eax, edx
jne case.0x100468e8.4
mov eax, dword [edi + 0x134]
add eax, 0xfffffffc
push eax
lea eax, [ecx + 4]
push eax
push 1
push esi
call fcn.1003acb0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je case.0x100468e8.4
push 5
push edi
call fcn.10047290
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052617
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0x134]
lea eax, [ecx + 4]
mov edx, ecx
mov dword [ebp - 0x8c], eax
add esi, 0xfffffffc
push esi
push dword [ebp - 0x8c]
movzx eax, byte [edx + 2]
shl ax, 8
movzx ecx, ax
movzx eax, byte [edx + 3]
or ecx, eax
mov dword [edi + 8], ecx
call fcn.100473d0
add esp, 8
cmp eax, esi
mov esi, dword [ebp - 0x90]
jae case.0x100468e8.4
push dword [ebp - 0x8c]
push 0x1007a16c
push esi
call fcn.10010810
jmp 0x100469f5
mov eax, dword [edi + 0x134]
add eax, 0xfffffffe
push eax
lea eax, [ecx + 2]
push eax
push edi
call fcn.100465b0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je case.0x100468e8.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052617
mov esp, ebp
pop ebp
ret
push 0x1007a17c
push 0x1006fbec
push esi
call fcn.10010750
add esp, 0xc
push esi
call fcn.10036df0
add esp, 4
test eax, eax
je 0x100468b0
push 5
push edi
call fcn.10047290
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.10052617
mov esp, ebp
pop ebp
ret