joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ac40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
cmp edx, 0xb
ja case.default.0x1003ac51
jmp dword [edx*4 + 0x1019ad7c]
add edx, 0xfffffff8
mov dword [esi + 4], 0
xor eax, eax
mov dword [esi], edx
mov word [esi + 8], 4
pop esi
pop edi
pop ebp
ret
movsx eax, byte [ecx]
mov dword [esi], eax
sar eax, 0x1f
mov dword [esi + 4], eax
xor eax, eax
mov word [esi + 8], 4
inc eax
jmp 0x1003ac6c
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
cmp edx, 6
bswap eax
bswap ecx
mov dword [esi + 4], eax
mov dword [esi], ecx
jne 0x1003ad62
mov word [esi + 8], 4
mov eax, 8
jmp 0x1003ac6c
mov word [esi + 8], 1
xor eax, eax
jmp 0x1003ac6c
movsx eax, byte [ecx]
movzx ecx, byte [ecx + 1]
mov edx, eax
sar eax, 0x1f
shl edx, 8
mov dword [esi + 4], eax
mov eax, 2
or ecx, edx
mov dword [esi], ecx
jmp 0x1003ac66
movsx eax, byte [ecx]
movzx edi, byte [ecx + 1]
movzx ecx, byte [ecx + 2]
mov edx, eax
shl edi, 8
sar eax, 0x1f
shl edx, 0x10
mov dword [esi + 4], eax
mov eax, 3
or edi, edx
or ecx, edi
jmp 0x1003accd
movsx edx, byte [ecx]
mov eax, dword [ecx + 2]
movzx ecx, byte [ecx + 1]
shl edx, 8
bswap eax
or ecx, edx
mov dword [esi], eax
mov eax, 6
mov dword [esi + 4], ecx
jmp 0x1003ac66
mov eax, dword [ecx]
bswap eax
mov dword [esi], eax
sar eax, 0x1f
mov dword [esi + 4], eax
mov word [esi + 8], 4
mov eax, 4
jmp 0x1003ac6c
lea eax, [edx - 0xc]
and edx, 1
mov dword [esi + 0x10], ecx
movzx ecx, word [edx + edx + 0x101950e4]
shr eax, 1
mov dword [esi + 0xc], eax
mov word [esi + 8], cx
jmp 0x1003ac6c
xor eax, eax
mov word [esi + 8], 0x4001
mov dword [esi + 0xc], eax
mov dword [esi], eax
jmp 0x1003ac6c
mov edx, eax
and eax, 0xfffff
xor edi, edi
inc edi
or ecx, eax
mov eax, 8
not edx
cmove edi, eax
test edx, 0x7ff00000
cmovne edi, eax
mov word [esi + 8], di
jmp 0x1003ac6c
Function at 0x1003ae70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov ecx, edx
mov edi, edx
mov ebx, dword [ebp + 8]
call fcn.100428e0
cmp eax, 0x10
je 0x1003af86
mov esi, eax
test eax, eax
jne 0x1003af8d
xor esi, esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x108]
test eax, eax
jne 0x1003af8d
mov eax, dword [edi + 0x74]
cmp byte [eax + 8], 0
je 0x1003af31
movzx ecx, word [eax + 0x18]
add dword [ebp - 0x14], ecx
adc dword [ebp - 0x10], 0
movsx ecx, byte [edi + 0x44]
test ecx, ecx
je 0x1003af97
mov word [edi + 0x32], 0
and byte [edi + 1], 0xf9
movzx edx, word [edi + ecx*2 + 0x46]
dec cl
mov word [edi + 0x46], dx
mov byte [edi + 0x44], cl
movsx ecx, cl
mov ecx, dword [edi + ecx*4 + 0x78]
mov dword [edi + 0x74], ecx
mov ecx, dword [eax + 0x48]
call fcn.10025e10
movzx ecx, word [edi + 0x46]
mov eax, dword [edi + 0x74]
cmp cx, word [eax + 0x18]
jae 0x1003aed3
inc ecx
mov word [edi + 0x46], cx
movzx ecx, word [edi + 0x46]
mov ebx, dword [eax + 0x38]
cmp cx, word [eax + 0x18]
jne 0x1003af44
movzx eax, byte [eax + 9]
add eax, 8
jmp 0x1003af63
cmp byte [eax + 2], 0
jne 0x1003af1b
movzx ecx, word [eax + 0x18]
add dword [ebp - 0x14], ecx
adc dword [ebp - 0x10], 0
jmp 0x1003af1b
movzx edx, word [eax + 0x1a]
mov eax, dword [eax + 0x40]
movzx eax, word [eax + ecx*2]
mov word [ebp - 0x16], dx
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll__byteswap_ushort
add esp, 4
and ax, word [ebp - 0x16]
movzx eax, ax
push dword [ebx + eax]
call sub.api_ms_win_crt_utility_l1_1_0.dll__byteswap_ulong
add esp, 4
mov ecx, edi
mov edx, eax
call fcn.10042b80
mov ebx, dword [ebp - 0x1c]
test eax, eax
je 0x1003aeae
mov esi, eax
jmp 0x1003af8d
xor esi, esi
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 4], ecx
mov dword [ebx], eax
mov ecx, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.100428e0
Function at 0x1003d1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
mov word [ecx + 0x32], 0
and byte [ecx + 1], 0xf9
cmp byte [ecx], 0
jne 0x1003d229
movzx edx, word [ecx + 0x46]
mov eax, dword [ecx + 0x74]
lea esi, [edx + 1]
mov word [ecx + 0x46], si
cmp si, word [eax + 0x18]
jae 0x1003d225
cmp byte [eax + 8], 0
je 0x1003d230
xor eax, eax
pop esi
pop ebp
ret
mov word [ecx + 0x46], dx
pop esi
pop ebp
jmp fcn.10044570
pop esi
pop ebp
jmp fcn.10044740
Function at 0x10042710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edx, edx
je 0x100427da
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx + 0x70]
mov edi, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
lea eax, [eax + eax*4]
test ecx, ecx
lea edx, [eax*8 + 0x38]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
je 0x100427e1
push 0
call fcn.10019ed0
add esp, 4
mov ebx, eax
test eax, eax
je 0x100427ef
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 0x14]
mov ecx, esi
mov dword [ebx + 4], eax
mov dword [ebx], esi
movzx eax, word [esi + 6]
inc eax
mov word [ebx + 8], ax
push ebx
push edi
call fcn.1003d280
add esp, 8
movzx eax, word [ebx + 8]
test ax, ax
je 0x1004279d
cmp ax, word [esi + 8]
jbe 0x100427f6
push 0x101b128f
push 0x1000c
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.nss3.dll_sqlite3_log
add esp, 0x14
mov ecx, dword [ebp - 0x10]
mov esi, 0xb
mov eax, dword [ecx + 0x70]
mov edx, ebx
mov ecx, dword [eax + 0xc]
call fcn.10019c40
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
jmp fcn.1003b8d0
mov ecx, edx
xor edx, edx
call fcn.10002c70
jmp 0x10042764
mov esi, 7
jmp 0x100427d0
mov esi, dword [ebp - 0x10]
mov edx, ebx
mov ecx, esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call fcn.1003b8d0
mov ecx, esi
add esp, 0x10
mov esi, eax
jmp 0x100427c3
Function at 0x10044570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov cl, byte [ecx]
test cl, cl
jne 0x1004462e
movzx ebx, word [esi + 0x46]
mov edi, dword [esi + 0x74]
inc ebx
mov word [esi + 0x46], bx
cmp byte [edi], 0
je 0x100446a0
mov ecx, dword [0x101d2114]
test ecx, ecx
jne 0x10044688
cmp bx, word [edi + 0x18]
mov cl, byte [edi + 8]
jb 0x100446c8
test cl, cl
je 0x1004465a
movsx eax, byte [esi + 0x44]
test eax, eax
je 0x1004461e
mov word [esi + 0x32], 0
and byte [esi + 1], 0xf9
movzx ecx, word [esi + eax*2 + 0x46]
dec al
mov word [esi + 0x46], cx
mov ecx, dword [esi + 0x74]
mov byte [esi + 0x44], al
movsx eax, al
mov eax, dword [esi + eax*4 + 0x78]
mov dword [esi + 0x74], eax
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
jne 0x100446d4
call fcn.10025e90
mov ecx, dword [esi + 0x74]
movzx eax, word [esi + 0x46]
cmp ax, word [ecx + 0x18]
jae 0x100445bd
xor eax, eax
cmp byte [ecx + 2], 0
je 0x10044626
push 0
push esi
call fcn.1003d1f0
add esp, 0x10
jmp 0x10044629
mov byte [esi], 1
mov eax, 0x65
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
cmp cl, 3
jae 0x1004472a
mov eax, 0x65
cmp cl, 1
je 0x10044626
cmp cl, 2
jne 0x10044585
mov byte [esi], 0
xor eax, eax
cmp dword [esi + 4], 0
jg 0x10044626
jmp 0x10044585
mov eax, dword [edi + 0x38]
movzx ecx, byte [edi + 9]
push dword [ecx + eax + 8]
call sub.api_ms_win_crt_utility_l1_1_0.dll__byteswap_ulong
add esp, 4
mov ecx, esi
mov edx, eax
call fcn.10042b80
test eax, eax
jne 0x10044626
mov ecx, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.10044740
call dword [section..00cfg]
push 0x19c
call ecx
add esp, 4
test eax, eax
je 0x100445a8
push 0x101b128f
push 0x11350
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.nss3.dll_sqlite3_log
add esp, 0x14
mov eax, 0xb
jmp 0x10044626
xor eax, eax
test cl, cl
jne 0x10044626
jmp 0x1004467a
mov edi, dword [ecx + 0x14]
dec dword [edi + 0x78]
mov eax, dword [edi + 0x88]
mov dword [ecx + 0x10], eax
mov dword [edi + 0x88], ecx
mov edx, dword [edi + 0x98]
mov eax, dword [ecx + 0x18]
mov edi, dword [edi + 0x3c]
mov ebx, edx
dec eax
sar ebx, 0x1f
imul ebx, eax
mul edx
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov ecx, dword [edi]
add edx, ebx
mov ebx, edx
mov ecx, dword [ecx + 0x48]
mov dword [ebp - 0x10], eax
call dword [section..00cfg]
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0x14]
push edi
call ecx
add esp, 0x10
jmp 0x100445fc
mov ecx, esi
call fcn.10042660
test eax, eax
jne 0x10044626
mov cl, byte [esi]
jmp 0x10044637
Function at 0x10048c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov dword [ecx], 0
mov ecx, 0x14
xor edx, edx
call fcn.10002c70
test eax, eax
je 0x10048cb3
cmp byte [0x101d2024], 0
mov ebx, eax
je 0x10048c7e
mov ecx, dword [0x101d2114]
test ecx, ecx
je 0x10048c4d
call dword [section..00cfg]
push 0xc8
call ecx
add esp, 4
test eax, eax
jne 0x10048c7e
mov eax, dword [ebp + 8]
mov dword [ebx + 8], edi
xor ecx, ecx
mov dword [ebx + 0xc], eax
mov eax, ebx
add eax, 4
push eax
push ecx
push ebx
push 0x10049080
push ecx
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
test eax, eax
mov dword [ebx], eax
je 0x10048c7e
cmp dword [ebx + 8], 0
jne 0x10048caa
jmp 0x10048c8e
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov ecx, edi
mov dword [ebx + 4], eax
call dword [section..00cfg]
push dword [ebp + 8]
call edi
add esp, 4
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [esi], ebx
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 7
jmp 0x10048cae
Function at 0x1004b400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ecx + 0x14]
test eax, eax
mov dword [ebp - 0x20], eax
jle 0x1004b554
mov eax, dword [ecx + 0x10]
xor ecx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], eax
lea eax, [edx + 1]
mov dword [ebp - 0x1c], eax
xor eax, eax
xor edx, edx
cmp ecx, 2
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
setb dl
xor edx, ecx
mov ecx, edx
shl ecx, 4
cmp dword [ebp + 8], 0
mov esi, dword [esi + ecx + 0xc]
mov dword [ebp - 0x24], esi
je 0x1004b48e
mov esi, dword [ebp - 0x18]
mov edi, dword [esi + ecx]
xor esi, esi
mov ecx, dword [ebp + 8]
movzx ebx, byte [edi + esi]
movzx ecx, byte [ecx + esi]
cmp bl, cl
jne 0x1004b46a
test bl, bl
je 0x1004b48e
inc esi
jmp 0x1004b454
mov bl, byte [ebx + 0x10194380]
cmp bl, byte [ecx + 0x10194380]
je 0x1004b467
test edx, edx
je 0x1004b52c
mov ecx, dword [ebp - 0x14]
inc ecx
cmp ecx, dword [ebp - 0x20]
jne 0x1004b42a
jmp 0x1004b556
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebx + 0x24]
test esi, esi
jne 0x1004b4f4
lea edi, [ebx + 0x20]
add ebx, 0x1c
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x10]
mov ecx, 0x101d4a18
test ebx, ebx
je 0x1004b4e4
mov edi, dword [edi]
dec ebx
xor esi, esi
mov ecx, dword [edi + 0xc]
movzx edx, byte [ecx + esi]
movzx eax, byte [eax + esi]
cmp dl, al
jne 0x1004b4ca
test dl, dl
je 0x1004b4f0
mov eax, dword [ebp - 0x10]
inc esi
jmp 0x1004b4b4
mov dl, byte [edx + 0x10194380]
cmp dl, byte [eax + 0x10194380]
je 0x1004b4c4
mov eax, dword [ebp - 0x10]
test ebx, ebx
jne 0x1004b4ac
mov ecx, 0x101d4a18
mov eax, dword [ecx + 8]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1004b483
jmp 0x1004b556
mov ecx, edi
jmp 0x1004b4e4
mov eax, dword [ebp - 0x10]
mov cl, byte [eax]
xor eax, eax
test cl, cl
je 0x1004b51b
mov edx, dword [ebp - 0x1c]
movzx ecx, cl
movzx ecx, byte [ecx + 0x10194380]
add ecx, eax
imul eax, ecx, 0x9e3779b1
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1004b502
xor edx, edx
div dword [ebx + 0x18]
lea edi, [esi + edx*8 + 4]
lea ebx, [esi + edx*8]
jmp 0x1004b49e
xor ecx, ecx
mov esi, dword [ebp + 8]
movzx edx, byte [ecx + str.main]
movzx ebx, byte [esi + ecx]
cmp dl, bl
je 0x1004b55e
mov dl, byte [edx + 0x10194380]
cmp dl, byte [ebx + 0x10194380]
jne 0x1004b480
jmp 0x1004b566
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
test dl, dl
je 0x1004b48e
inc ecx
jmp 0x1004b52e
Function at 0x10072fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
test byte [ecx + 0x24], 0x20
mov eax, edx
jne 0x10072fe3
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ecx + 4]
movzx esi, word [edi + 0x10]
and esi, 0x20
test ax, ax
je 0x1007301b
xor edx, edx
cwde
inc edx
test eax, eax
cmovg edx, eax
add edi, 0x24
xor eax, eax
mov ebx, edx
movzx esi, si
shr esi, 5
xor esi, 1
add eax, esi
movzx esi, word [edi]
add edi, 0x14
and esi, 0x20
dec ebx
jne 0x10073002
jmp 0x1007301f
xor edx, edx
xor eax, eax
test si, si
je 0x10072fde
sub edx, eax
add dx, word [ecx + 0x2c]
mov eax, edx
jmp 0x10072fde
Function at 0x100c9720
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x98
mov eax, dword [0x101d2014]
lea esi, [ebp - 0x98]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x90
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi - 4], 0x94
lea esi, [ebp - 0x9c]
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [esi + 4], 5
je 0x100c9777
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10192ef0
add esp, 0x98
pop esi
pop ebp
ret
cmp dword [ebp - 0x94], 1
jne 0x100c9764
mov byte [0x101d4b60], 1
jmp 0x100c9764

Function at 0x100c97a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edx, dword [0x101d2014]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 1
push ecx
push eax
push edi
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
je 0x100c9806
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
push esi
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x100c9816
cmp edi, 0x17
jne 0x100c97f3
test byte [0x101d4b60], 1
jne 0x100c9834
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret
call sub.wsock32.dll_WSAGetLastError
push eax
call fcn.100d4df0
add esp, 4
jmp 0x100c982f
call sub.wsock32.dll_WSAGetLastError
push eax
push 0xffffe896
call sym.nss3.dll_PR_SetError
add esp, 8
push esi
call sub.wsock32.dll_closesocket
xor esi, esi
dec esi
jmp 0x100c97f3
lea eax, [ebp - 0x18]
lea edi, [ebp - 0x14]
mov dword [eax], 4
push eax
push edi
push 0x1002
push 0xffff
push esi
call sub.wsock32.dll_getsockopt
test eax, eax
jne 0x100c97f3
cmp dword [ebp - 0x14], 0x10000
jl 0x100c97f3
mov eax, 0xffff
mov dword [ebp - 0x14], eax
push dword [ebp - 0x18]
push edi
push 0x1002
push eax
push esi
call sub.wsock32.dll_setsockopt
jmp 0x100c97f3
Function at 0x100c9dd0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov esi, dword [eax + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x100c9e1d
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x100c9e04
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
je 0x100c9e2f
mov ecx, 0xffffe8d2
cmp eax, 0x2733
jne 0x100c9e21
push eax
push ecx
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
pop esi
pop edi
pop ebp
ret
cmp eax, 0x274c
jne 0x100c9e46
mov ecx, 0xffffe89a
jmp 0x100c9e10
mov ecx, esi
mov edx, 3
push dword [ebp + 0x14]
call fcn.100c9980
add esp, 4
sar eax, 0x1f
jmp 0x100c9e1d
cmp eax, 0x2726
jne 0x100c9e54
mov ecx, 0xffffe8d3
jmp 0x100c9e10
push eax
call fcn.100d41f0
add esp, 4
jmp 0x100c9e1a

Function at 0x100c9ee0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0x100c9f27
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x18]
push 0
push ecx
push edx
mov ebx, edi
push edi
mov edi, ecx
call sub.wsock32.dll_send
cmp eax, 0xffffffff
je 0x100c9f2b
add esi, eax
mov eax, dword [ebp + 8]
cmp esi, edi
jge 0x100c9f20
mov eax, dword [eax + 4]
cmp dword [eax + 4], 0
je 0x100c9f71
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x100c9f22
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x100c9f63
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 0
jne 0x100c9f63
mov edi, ebx
mov ecx, ebx
mov edx, 2
push dword [ebp + 0x18]
call fcn.100c9980
add esp, 4
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
test eax, eax
jns 0x100c9efb
jmp 0x100c9f6c
push eax
call fcn.100d6990
add esp, 4
xor eax, eax
dec eax
jmp 0x100c9f22
mov ecx, ebx
mov edx, 2
push dword [ebp + 0x18]
call fcn.100c9980
mov ecx, dword [ebp + 0x10]
mov edi, ebx
add esp, 4
mov edx, dword [ebp + 0xc]
test eax, eax
mov eax, 0xffffffff
jns 0x100c9efb
jmp 0x100c9f22

Function at 0x100c9fa0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0
mov eax, dword [esi + 4]
mov edi, dword [eax + 0x18]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push ebx
push dword [ebp + 0xc]
push edi
call sub.wsock32.dll_sendto
cmp eax, 0xffffffff
jne 0x100c9ffe
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x100ca015
mov ecx, dword [esi + 4]
cmp dword [ecx + 4], 0
jne 0x100ca015
mov ecx, edi
mov edx, 2
push dword [ebp + 0x20]
call fcn.100c9980
add esp, 4
test eax, eax
jns 0x100c9fba
jmp 0x100ca01e
mov ecx, dword [ebp - 0x10]
add ecx, eax
cmp ecx, ebx
jge 0x100ca029
mov eax, dword [esi + 4]
cmp dword [eax + 4], 0
jne 0x100ca029
mov dword [ebp - 0x10], ecx
jmp 0x100c9fe6
push eax
call fcn.100d6990
add esp, 4
xor eax, eax
dec eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, ecx
jmp 0x100ca021
Function at 0x100ca030
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov esi, dword [eax + 0x18]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.wsock32.dll_recvfrom
mov ebx, eax
cmp eax, 0xffffffff
jne 0x100ca08e
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x100ca085
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
jne 0x100ca085
xor edx, edx
mov ecx, esi
inc edx
push dword [ebp + 0x20]
call fcn.100c9980
add esp, 4
test eax, eax
jns 0x100ca03f
jmp 0x100ca08e
push eax
call fcn.100d4df0
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100ca160
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x18]
call sub.wsock32.dll_getsockname
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x100ca181
pop ebp
ret
call sub.wsock32.dll_WSAGetLastError
push eax
call fcn.100d6ab0
add esp, 4
xor eax, eax
dec eax
jmp 0x100ca17f

Function at 0x100ca220
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x18]
call sub.wsock32.dll_setsockopt
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x100ca247
pop ebp
ret
call sub.wsock32.dll_WSAGetLastError
push eax
call fcn.100d4df0
add esp, 4
xor eax, eax
dec eax
jmp 0x100ca245
Function at 0x100cac30
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x101d2014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x101d4d40], 0
je 0x100cacfa
xor eax, eax
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x18]
lea esi, [ebp - 0x14]
mov dword [ecx + 4], eax
mov dword [ecx], 0xc
mov dword [ecx + 8], 1
push eax
push ecx
push edx
push esi
call dword [sym.imp.kernel32.dll_CreatePipe]
test eax, eax
je 0x100cad04
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
call fcn.100ca570
test eax, eax
je 0x100cad1a
mov dword [eax], 0x101d381c
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ecx], 0xaaaaaaaa
mov ecx, dword [eax + 4]
mov dword [ecx + 0x18], ebx
mov dword [esi], eax
mov ebx, dword [ebp - 0x18]
call fcn.100ca570
test eax, eax
je 0x100cad3e
mov dword [eax], 0x101d381c
mov ecx, dword [eax + 4]
mov dword [ecx], 0xaaaaaaaa
mov ecx, dword [eax + 4]
mov dword [ecx + 0x18], ebx
mov dword [edi], eax
xor ecx, ecx
mov eax, dword [esi]
inc ecx
xor esi, esi
mov eax, dword [eax + 4]
mov dword [eax + 8], ecx
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
call sym.nss3.dll_PR_Init
jmp 0x100cac50
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xffffe896
call sym.nss3.dll_PR_SetError
add esp, 8
jmp 0x100cad6c
xor edi, edi
push edi
push 0xffffe890
call sym.nss3.dll_PR_SetError
add esp, 8
mov dword [esi], edi
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
call esi
jmp 0x100cad6c
xor ebx, ebx
push ebx
push 0xffffe890
call sym.nss3.dll_PR_SetError
add esp, 8
mov dword [edi], ebx
mov esi, dword [esi]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor esi, esi
dec esi
jmp 0x100cace6