joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e9c20
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
push ebx
push ebp
push esi
xor ebp, ebp
mov esi, ecx
xor ebx, ebx
and esi, 0x80
mov dword [esp + 0x10], ebp
cmp dword [0x101f4f2c], ebp
jne 0x100e9c59
push str.smbp_sock_receive:_smbp_not_initialized__n
call fcn.10117cb0
add esp, 4
pop esi
lea eax, [ebp + 0x13]
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x100e9c63
mov dword [eax], ebp
cmp dword [esp + 0x18], ebp
jne 0x100e9c75
pop esi
pop ebp
mov eax, 0x16
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x20]
cmp edi, ebp
je 0x100e9daa
cmp dword [edi + 0xc], 1
jl 0x100e9daa
mov eax, dword [edi + 8]
cmp dword [eax + 4], ebp
je 0x100e9daa
cmp dword [eax], ebp
je 0x100e9daa
and ecx, 0xc0
cmp cl, 0xc0
je 0x100e9daa
push 0x101f4f28
call fcn.100ea210
mov eax, dword [esp + 0x20]
add esp, 4
cmp dword [eax + 0x18], ebx
jne 0x100e9cdf
push 0x101f4f28
call fcn.100ea230
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x39
pop ebx
add esp, 8
ret
push esi
mov esi, eax
call fcn.100e9050
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x100e9daf
cmp dword [edi + 0xc], ebx
jle 0x100e9d89
mov esi, dword [sym.imp.WS2_32.dll_recv]
mov eax, dword [edi + 8]
cmp ebp, dword [eax + ebx*8 + 4]
jb 0x100e9d13
xor ebp, ebp
inc ebx
jmp 0x100e9d67
push 0x101f7ba0
call fcn.100ea230
mov ecx, dword [edi + 8]
mov edx, dword [ecx + ebx*8 + 4]
lea eax, [ecx + ebx*8]
mov eax, dword [eax]
mov ecx, dword [esp + 0x20]
add esp, 4
push 0
sub edx, ebp
push edx
mov edx, dword [ecx + 8]
add eax, ebp
push eax
push edx
call esi
push 0x101f7ba0
mov edi, eax
call fcn.100ea210
add esp, 4
cmp edi, 0xffffffff
je 0x100e9d6e
test edi, edi
je 0x100e9d89
add dword [esp + 0x14], edi
add ebp, edi
test byte [esp + 0x24], 0x40
je 0x100e9d89
mov edi, dword [esp + 0x20]
cmp ebx, dword [edi + 0xc]
jl 0x100e9d05
jmp 0x100e9d89
call fcn.100f7470
cmp eax, 0x23
je 0x100e9d81
mov dword [esp + 0x10], eax
cmp eax, 0x3c
jne 0x100e9d89
mov dword [esp + 0x10], 0x23
mov eax, dword [esp + 0x28]
test eax, eax
je 0x100e9d9e
cmp dword [esp + 0x10], 0
jne 0x100e9d9e
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, 0x16
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100e9dc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0xc
push ebp
xor ebp, ebp
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 4], ebp
cmp dword [0x101f4f2c], ebp
jne 0x100e9def
push str.smbp_sock_receivembuf:_smbp_not_initialized__n
call fcn.10117cb0
add esp, 4
lea eax, [ebp + 0x13]
pop ebp
add esp, 0xc
ret
push esi
mov esi, dword [esp + 0x18]
cmp esi, ebp
jne 0x100e9e03
pop esi
mov eax, 0x16
pop ebp
add esp, 0xc
ret
push edi
cmp dword [esp + 0x24], ebp
je 0x100e9fda
mov edi, dword [esp + 0x2c]
cmp edi, ebp
je 0x100e9fda
cmp dword [edi], ebp
jbe 0x100e9fda
cmp dword [esp + 0x20], ebp
jne 0x100e9fda
push ebx
mov ebx, dword [esp + 0x2c]
mov eax, ebx
and eax, 0xc0
cmp al, 0xc0
jne 0x100e9e49
mov eax, 0x16
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret
push 0x101f4f28
call fcn.100ea210
add esp, 4
cmp dword [esi + 0x18], ebp
jne 0x100e9e75
push 0x101f4f28
call fcn.100ea230
add esp, 4
pop ebx
pop edi
pop esi
mov eax, 0x39
pop ebp
add esp, 0xc
ret
and ebx, 0x80
push ebx
call fcn.100e9050
add esp, 4
test eax, eax
jne 0x100e9e41
cmp dword [edi], ebp
jbe 0x100e9fba
mov ebx, dword [sym.imp.WS2_32.dll_recv]
test ebp, ebp
jne 0x100e9ea9
lea ecx, [esp + 0x10]
push ecx
push 1
push ebp
call fcn.100f8270
jmp 0x100e9eb7
lea edx, [esp + 0x10]
push edx
push 1
push 0
call fcn.100f82e0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100e9f87
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], edi
jne 0x100e9ed4
mov dword [esp + 0x14], eax
jmp 0x100e9ee6
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.100f7bb0
mov eax, dword [esp + 0x18]
add esp, 8
mov edx, dword [esp + 0x30]
mov edi, dword [edx]
push eax
mov dword [esp + 0x1c], eax
sub edi, ebp
call fcn.100f8400
add esp, 4
cmp eax, edi
jae 0x100e9f0e
mov eax, dword [esp + 0x10]
push eax
call fcn.100f8400
add esp, 4
mov edi, eax
push 0x101f7ba0
call fcn.100ea230
mov ecx, dword [esp + 0x14]
add esp, 4
push 0
push edi
push ecx
call fcn.100f7bf0
mov edx, dword [esi + 8]
add esp, 4
push eax
push edx
call ebx
push 0x101f7ba0
mov edi, eax
call fcn.100ea210
add esp, 4
cmp edi, 0xffffffff
je 0x100e9f71
test edi, edi
je 0x100e9fb6
mov eax, dword [esp + 0x10]
push edi
push eax
call fcn.100f7b70
add esp, 8
add ebp, edi
test byte [esp + 0x2c], 0x40
je 0x100e9fb6
mov ecx, dword [esp + 0x30]
cmp ebp, dword [ecx]
jb 0x100e9e96
mov edi, ecx
jmp 0x100e9fba
call fcn.100f7470
cmp eax, 0x23
je 0x100e9f82
mov edi, eax
cmp eax, 0x3c
jne 0x100e9f87
mov edi, 0x23
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100e9f98
push eax
call fcn.100f7ae0
add esp, 4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
pop ebx
mov dword [edx], 0
mov dword [eax], 0
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x14]
push ebp
push esi
call fcn.100f7b90
mov ecx, dword [esp + 0x30]
add esp, 8
pop ebx
mov dword [ecx], esi
mov dword [edi], ebp
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
pop edi
pop esi
mov eax, 0x16
pop ebp
add esp, 0xc
ret
Function at 0x100ea090
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x190]
neg eax
sbb eax, eax
xor ecx, esp
and eax, 0xc
call fcn.1013d581
add esp, 0x194
ret

Function at 0x100f7480
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x28
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
mov ebp, dword [esp + 0x30]
test ebp, ebp
jne 0x100f74aa
lea eax, [ebp + 0x16]
pop ebp
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1013d581
add esp, 0x28
ret
push ebx
xor eax, eax
push esi
mov dword [esp + 0x10], eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, 2
push 0x7f000001
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov edi, dword [sym.imp.WS2_32.dll_socket]
push 0x11
push 2
push 2
mov dword [esp + 0x24], eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x100f750e
call fcn.100f7470
pop edi
pop esi
mov ebx, eax
pop ebx
mov dword [ebp], 0
pop ebp
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1013d581
add esp, 0x28
ret
push 0x11
push 2
push 2
call edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x100f7526
call fcn.100f7470
mov ebx, eax
jmp 0x100f758e
push 0x10
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x100f7542
call fcn.100f7470
mov ebx, eax
jmp 0x100f7587
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x28]
push eax
push esi
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x100f7539
push 0x10
lea ecx, [esp + 0x28]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100f7539
push 8
call fcn.1013fbbd
add esp, 4
mov dword [ebp], eax
test eax, eax
jne 0x100f75b1
lea ebx, [eax + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword [ebp], 0
pop ebp
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1013d581
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [eax], esi
mov edx, dword [ebp]
mov dword [edx + 4], edi
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
xor eax, eax
call fcn.1013d581
add esp, 0x28
ret
Function at 0x100f7640
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
push esi
mov esi, dword [esp + 0x118]
test esi, esi
jne 0x100f765d
lea eax, [esi + 0x16]
pop esi
add esp, 0x110
ret
mov eax, dword [esi]
lea ecx, [esp + 8]
push ecx
push 0
push 0
lea edx, [esp + 0x1c]
mov dword [esp + 0x20], eax
push edx
inc eax
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x100f76a3
call fcn.100f7470
pop esi
add esp, 0x110
ret
test eax, eax
jle 0x100f76cc
mov ecx, dword [esi]
push 0
push 1
lea eax, [esp + 0xf]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x100f7696
test eax, eax
je 0x100f7696
xor eax, eax
pop esi
add esp, 0x110
ret
mov eax, 0x23
pop esi
add esp, 0x110
ret

Function at 0x100f77e0
Capabilities:
Create thread

Disassembly:
cmp dword [0x101f4f2c], 0
jne 0x100f77fc
push str.smbp_kernel_thread_start:_smbp_not_initialized__n
call fcn.10117cb0
add esp, 4
mov eax, 5
ret
push ebx
mov ebx, dword [esp + 8]
push edi
test ebx, ebx
je 0x100f7862
mov edi, dword [esp + 0x14]
test edi, edi
je 0x100f7862
push esi
push 8
call fcn.1013fbbd
mov esi, eax
add esp, 4
test esi, esi
je 0x100f784b
mov eax, dword [esp + 0x14]
push 0
push 0
push esi
push 0x100f7780
push 0
push 0
mov dword [esi], ebx
mov dword [esi + 4], eax
call fcn.10141985
add esp, 0x18
test eax, eax
jne 0x100f785a
push esi
call fcn.1013db65
add esp, 4
pop esi
mov dword [edi], 0
pop edi
mov eax, 6
pop ebx
ret
pop esi
mov dword [edi], eax
pop edi
xor eax, eax
pop ebx
ret
pop edi
mov eax, 4
pop ebx
ret
Function at 0x100ff130
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0xc]
movzx ecx, word [eax + 0xe]
mov ax, word [eax + 6]
movzx ebx, word [esi + 0x20]
mov dword [esp + 0x14], ecx
mov edx, 0xf00
and ax, dx
xor edx, edx
mov ecx, 0x400
cmp ax, cx
sete dl
mov ecx, 0x300
push edi
mov edi, dword [esi + 8]
push esi
push str.__OUTER__
push edi
mov ebp, edx
xor edx, edx
cmp ax, cx
mov eax, dword [edi + 0x18]
mov ecx, dword [eax + 0x18]
sete dl
and ebx, 0xff
mov dword [esp + 0x1c], edx
call ecx
push esi
call fcn.100fe020
add esp, 0x10
test eax, eax
je 0x100ff1cb
mov edx, dword [edi + 0xc]
mov dword [esi + 0x14], edx
test ebp, ebp
je 0x100ff1d3
mov eax, dword [esi + 8]
mov ecx, 0xffffffee
mov word [eax + 0x20], cx
mov edx, dword [esi + 8]
mov eax, 0x268
mov word [edx + 0x22], ax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x1c]
push esi
push eax
call edx
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, ebx
sub eax, 0
je 0x100ff244
sub eax, 1
je 0x100ff1eb
sub eax, 0x3f
je 0x100ff1eb
mov eax, 0xffffffef
jmp 0x100ff1f7
cmp dword [esp + 0x18], 0
je 0x100ff222
mov eax, 0xfffffff1
mov ecx, dword [esi + 8]
mov word [ecx + 0x20], ax
mov edx, dword [esi + 8]
mov eax, 0x28c
mov word [edx + 0x22], ax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x1c]
push esi
push eax
call edx
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
cmp ebx, 1
jne 0x100ff236
call fcn.100fe910
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.100fe7d0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [esp + 0x10], 0
push esi
je 0x100ff25a
call fcn.100fec90
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [esp + 0x1c], 0
je 0x100ff26f
call fcn.100feac0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.100fe6a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10100510
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xdc
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebp
mov ebp, dword [esp + 0xe4]
push esi
mov esi, ecx
cmp esi, 0x40
jbe 0x10100539
mov esi, 0x40
push 0x40
lea eax, [esp + 0xa4]
push 0
push eax
call fcn.1013f910
push 0x40
lea ecx, [esp + 0x70]
push 0
push ecx
call fcn.1013f910
push esi
lea edx, [esp + 0xbc]
push edi
push edx
call fcn.1013e9e0
push esi
lea eax, [esp + 0x88]
push edi
push eax
call fcn.1013e9e0
add esp, 0x30
xor eax, eax
jmp 0x10100580
xor byte [esp + eax + 0xa0], 0x36
xor byte [esp + eax + 0x60], 0x5c
inc eax
cmp eax, 0x40
jl 0x10100580
lea ecx, [esp + 8]
push ecx
call fcn.10135ef0
push 0x40
lea edx, [esp + 0xa8]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.10109300
mov ecx, dword [esp + 0xfc]
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.10109300
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.101093c0
lea ecx, [esp + 0x2c]
push ecx
call fcn.10135ef0
push 0x40
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.10109300
push 0x10
lea ecx, [esp + 0x40]
push ebx
push ecx
call fcn.10109300
add esp, 0x40
lea edx, [esp + 8]
push edx
push ebx
call fcn.101093c0
mov ecx, dword [esp + 0xe8]
add esp, 8
pop esi
pop ebp
xor ecx, esp
call fcn.1013d581
add esp, 0xdc
ret
Function at 0x10109450
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
jne 0x1010949b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x1010949b
push 8
push 1
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
call esi
test eax, eax
jne 0x1010949b
push str.smbp_read_random:_cant_acquire_crypto_provider_n
call fcn.10117cb0
add esp, 4
pop esi
pop ecx
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x101094c1
push str.smbp_read_random:_cant_generate_randomness_n
call fcn.10117cb0
add esp, 4
mov edx, dword [esp + 4]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
pop ecx
ret
Function at 0x10117aa0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x90
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x94]
mov cx, word [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xa4]
push ebp
mov ebp, dword [esp + 0xa0]
push esi
mov esi, dword [esp + 0xb4]
push edi
mov edi, dword [esp + 0xac]
push 0x80
lea edx, [esp + 0x20]
push 0
push edx
mov dword [esp + 0x24], eax
mov word [esp + 0x22], cx
mov dword [esp + 0x1c], 0
call fcn.1013f910
add esp, 0xc
cmp dword [esi], 4
jne 0x10117b62
mov cx, word [esp + 0x16]
mov edx, dword [esi + 4]
mov eax, 2
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], cx
mov dword [esp + 0x20], edx
test ebx, ebx
je 0x10117b34
mov eax, dword [ebx + 0x14ac]
jmp 0x10117b3c
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov eax, dword [ecx]
test eax, eax
jl 0x10117b62
push 0x10
lea edx, [esp + 0x20]
push edx
push 0
sub edi, ebp
push edi
push ebp
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov ebp, eax
test ebp, ebp
jle 0x10117b8a
mov dword [esp + 0x10], 0
mov ebp, dword [esp + 0x10]
mov eax, ebp
neg eax
sbb eax, eax
and eax, 0xfffeffff
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1013d581
add esp, 0x90
ret
jge 0x10117b66
mov eax, dword [esi]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
jne 0x10117ba4
mov ecx, dword [esi + 4]
cmp ecx, dword [0x1019b3f8]
je 0x10117c05
cmp eax, 6
jne 0x10117bd5
mov edx, dword [esi + 4]
cmp edx, dword [0x1019b40c]
jne 0x10117bd5
mov eax, dword [esi + 8]
cmp eax, dword [0x1019b410]
jne 0x10117bd5
mov ecx, dword [esi + 0xc]
cmp ecx, dword [0x1019b414]
jne 0x10117bd5
mov edx, dword [esi + 0x10]
cmp edx, dword [0x1019b418]
je 0x10117c05
call edi
cmp eax, 0x2750
je 0x10117c7c
call edi
cmp eax, 0x2742
je 0x10117c7c
call edi
cmp eax, 0x2751
je 0x10117c7c
call edi
cmp eax, 0x2743
je 0x10117c7c
cmp dword [0x101f5134], 0x3e8
jge 0x10117b66
inc dword [0x101f5134]
test ebx, ebx
je 0x10117c58
mov eax, dword [ebx + 0x14a8]
mov ecx, dword [ebx + 0x14a0]
push eax
push ecx
add ebx, 0x142c
push ebx
push esi
call edi
push eax
call fcn.1013ed6d
add esp, 4
push eax
call edi
push eax
push str.mDNSPlatformSendUDP_got_error__d___s__sending_packet_to__a_on_interface__a__s__d
push 0
call fcn.1011dd40
add esp, 0x20
jmp 0x10117b66
push esi
call edi
push eax
call fcn.1013ed6d
add esp, 4
push eax
call edi
push eax
push str.mDNSPlatformSendUDP_got_error__d___s__sending_packet_to__a
push 0
call fcn.1011dd40
add esp, 0x14
jmp 0x10117b66
mov eax, 0xfffeffe6
jmp 0x10117b71
Function at 0x101182a0
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov cx, word [0x1019b354]
push 0x10
lea edx, [esp + 0xc]
mov esi, eax
push edx
mov eax, 2
push esi
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_bind]
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x18]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
xor ecx, esp
call fcn.1013d581
add esp, 0x14
ret

Function at 0x10118310
Capabilities:
Get hostname

Disassembly:
sub esp, 0x14
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
mov ebp, dword [esp + 0x1c]
push esi
call fcn.101182a0
test eax, eax
je 0x10118334
mov dword [ebp + 8], 1
push ebx
push edi
lea esi, [ebp + 0x18d4]
push 0x3f
lea edi, [esi + 1]
push edi
mov byte [esi], 0
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [ecx]
mov al, byte [edi + ebx]
test al, al
je 0x10118361
cmp al, 0x2e
je 0x10118361
inc ebx
cmp ebx, 0x3f
jl 0x10118350
mov byte [esi], bl
test bl, bl
jne 0x10118375
push str.Computer
push esi
call fcn.10118cc0
add esp, 8
lea esi, [ebp + 0x1914]
push 0x3f
lea edi, [esi + 1]
push edi
mov byte [esi], 0
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_gethostname]
lea esp, [esp]
mov al, byte [edi + ebx]
test al, al
je 0x101183a1
cmp al, 0x2e
je 0x101183a1
inc ebx
cmp ebx, 0x3f
jl 0x10118390
mov byte [esi], bl
test bl, bl
jne 0x101183b5
push str.Computer
push esi
call fcn.10118cc0
add esp, 8
push ebp
call fcn.10112060
mov ecx, dword [ebp]
mov eax, 2
mov word [esp + 0x14], ax
mov dword [ecx], 0xffffffff
movzx edx, word [0x1019b374]
mov edi, dword [ebp]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.10117de0
add esp, 0xc
mov esi, eax
pop edi
pop ebx
test esi, esi
jne 0x101183f7
mov eax, ebp
call fcn.101181f0
mov esi, eax
push str.mDNSPlatformInit
push ebp
call fcn.1011b070
push str.mDNSPlatformInit
push ebp
call fcn.1011b2f0
add esp, 0x10
test esi, esi
jne 0x1011841e
push esi
push ebp
call fcn.1010df10
add esp, 8
mov ecx, dword [esp + 0x18]
mov eax, esi
neg eax
pop esi
sbb eax, eax
pop ebp
xor ecx, esp
and eax, 0xfffeffff
call fcn.1013d581
add esp, 0x14
ret
Function at 0x10126200
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x24
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x34]
push 0
push 2
push 2
mov dword [esp + 0x18], 0x1c
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
mov dword [edi], 0
cmp ebx, 0xffffffff
je 0x1012635d
mov eax, dword [esi]
cmp eax, 4
jne 0x10126267
mov ecx, 2
mov word [esp + 0x10], cx
mov ecx, dword [esi + 4]
mov edx, 1
mov eax, 0x10
mov word [esp + 0x12], dx
mov dword [esp + 0x14], ecx
jmp 0x101262b5
cmp eax, 6
jne 0x10126356
mov edx, 0x17
mov ecx, 1
mov word [esp + 0x10], dx
mov edx, dword [esi + 4]
mov word [esp + 0x12], cx
mov ecx, dword [esi + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0x10]
mov eax, 0x1c
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], 0
push eax
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jge 0x101262ed
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
push eax
call fcn.1013ed6d
add esp, 4
push eax
call edi
push eax
push esi
push str.mDNSPlatformSourceAddrForDest:_connect__a_failed_errno__d___s_
push 0
call fcn.1011dd40
add esp, 0x14
jmp 0x10126356
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jge 0x10126328
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
push eax
call fcn.1013ed6d
add esp, 4
push eax
call esi
push eax
push str.mDNSPlatformSourceAddrForDest:_getsockname_failed_errno__d___s_
push 0
call fcn.1011dd40
add esp, 0x10
jmp 0x10126356
mov edx, dword [esi]
mov dword [edi], edx
cmp dword [esi], 4
jne 0x1012633a
mov eax, dword [esp + 0x14]
mov dword [edi + 4], eax
jmp 0x10126356
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1013d581
add esp, 0x24
ret

Function at 0x101263b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10126402
mov eax, dword [esp]
cmp al, 2
jne 0x101263fc
shr eax, 8
cmp al, 2
jne 0x101263fc
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.1013d581
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.1013d581
add esp, 0x194
ret