joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10150230
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1021a55d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10282800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [esi]
xor ebx, ebx
cmp dword [esi + 4], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x10282038
je 0x1015036c
xor edx, edx
add ecx, 0x1c
xor eax, eax
lock cmpxchg dword [ecx], edx
mov dword [ebp - 0x10], eax
test eax, eax
je 0x101502cb
mov esi, dword [esi + 4]
lea edi, [eax + 0x18]
push edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x28], 1
mov dword [ebp - 4], ebx
call fcn.100e0d20
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push esi
mov dword [ebp - 0x24], 0x3e3
call fcn.1010dcc0
push edi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + 4]
cmp edi, 0xffffffff
je 0x10150378
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x10150378
call fcn.100e0d20
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
call fcn.100e0d20
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 4]
cmp ecx, dword [eax + 4]
jne 0x10150317
cmp ebx, 0x2733
je 0x1015032f
call fcn.100e0d20
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 4]
cmp ecx, dword [eax + 4]
jne 0x10150378
cmp ebx, 0x4d5
jne 0x10150378
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [esi + 8], 0xfc
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x10150373
call fcn.100e0d20
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x18], esi
mov ebx, eax
mov esi, dword [ebp - 0x14]
jmp 0x10150375
mov dword [ebp - 0x18], 0x10282038
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, dword [esi + 0x10]
mov dword [esi + 4], 0xffffffff
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
test edi, edi
je 0x101503b9
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x101503b9
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x101503b9
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
test ebx, ebx
jne 0x101503cf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.close
lea eax, [ebp - 0x1c]
push eax
call fcn.100dfa60
int3
Function at 0x10150590
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x34]
mov esi, dword [edi]
cmp esi, 0x40
jne 0x101505af
mov esi, 0x2745
call fcn.100e0d20
mov dword [edi], esi
mov dword [edi + 4], eax
test esi, esi
jne 0x10150692
cmp dword [esp + 0x28], esi
je 0x10150637
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x10150637
push ebp
lea eax, [esp + 0x38]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x44], 0
push eax
mov eax, dword [esp + 0x38]
push eax
push eax
push 0
push dword [esp + 0x40]
call sub.WSOCK32.dll_GetAcceptExSockaddrs
mov ebp, dword [esp + 0x38]
cmp ebp, dword [esi]
jbe 0x10150623
call fcn.100e0d20
mov dword [edi], 0x2726
mov dword [edi + 4], eax
jmp 0x10150636
push ebp
push dword [esp + 0x10]
push dword [esp + 0x34]
call fcn.101e55c0
add esp, 0xc
mov dword [esi], ebp
pop ebp
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
cmp eax, 0xffffffff
jne 0x1015065c
call fcn.100e0d20
mov dword [edi], 0x2719
mov dword [edi + 4], eax
pop edi
pop esi
add esp, 0x10
ret
push 4
lea ecx, [esp + 0x18]
push ecx
push 0x700b
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10150680
mov dword [edi], eax
pop edi
pop esi
add esp, 0x10
ret
call fcn.100e0d20
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
pop edi
pop esi
add esp, 0x10
ret
Function at 0x1015c0d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov eax, ecx
push ebp
mov ebp, dword [esp + 0x18]
push esi
cmp byte [eax + 0xd], 0
lea ebx, [eax + 0x48]
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
jge 0x1015c122
mov eax, dword [ebx]
xor ecx, ecx
mov edx, dword [eax + 8]
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x1015c113
nop dword [eax]
mov eax, ecx
and eax, 3
mov al, byte [esp + eax + 0x1c]
xor byte [edi + ecx], al
inc ecx
cmp ecx, ebp
jb 0x1015c100
mov eax, dword [ebx]
mov ecx, ebp
and ecx, 3
je 0x1015c11f
shl cl, 3
ror edx, cl
mov dword [eax + 8], edx
mov eax, dword [ebx]
push ebp
push edi
mov esi, dword [eax]
add esi, 0x38
mov ecx, esi
lea eax, [esi + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [eax]
mov dword [esp + 0x18], eax
call fcn.100de800
mov ebx, dword [ebx]
mov eax, dword [ebx]
cmp dword [eax + 0x50], 1
jne 0x1015c1b9
cmp dword [esi + 0x14], 0xf
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
jbe 0x1015c15d
mov eax, dword [esi]
mov esi, eax
add edx, eax
jmp 0x1015c15f
add edx, esi
mov eax, dword [esp + 0x10]
add eax, esi
cmp eax, edx
je 0x1015c1b9
nop dword [eax]
cmp dword [ebx + 0xc], 0
movzx edi, byte [eax]
movzx ebp, byte [edi + 0x10228cd0]
je 0x1015c18d
mov esi, dword [ebx + 0x10]
and edi, 0x3f
shl esi, 6
or esi, edi
jmp 0x1015c198
mov esi, 0xff
mov ecx, ebp
sar esi, cl
and esi, edi
mov dword [ebx + 0x10], esi
mov ecx, dword [ebx + 0xc]
add ecx, ecx
movzx ecx, byte [ebp + ecx*8 + 0x10228dd0]
mov dword [ebx + 0xc], ecx
cmp ecx, 1
je 0x1015c1cc
inc eax
cmp eax, edx
jne 0x1015c170
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
pop edi
pop esi
sub dword [eax + 0x18], ebp
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 0xc
call fcn.10118d90
mov ecx, eax
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0x10
mov dword [eax + 4], ecx
xor eax, eax
pop ebx
add esp, 8
ret 0xc

Function at 0x1015ccd0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x1015cd01
mov ecx, dword [eax + 0x54]
lea esi, [eax + 0x30]
test ecx, ecx
je 0x1015ccfa
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1015cd40
push dword [0x1028dd78]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1015cd30
mov edx, dword [eax + 4]
test edx, edx
je 0x1015cd30
xor eax, eax
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x1015cd43
inc eax
cmp eax, 2
jl 0x1015cd21
push esi
call fcn.101eb4d1
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x70]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x1015cd60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x1015cd91
mov ecx, dword [eax + 0x44]
lea esi, [eax + 0x20]
test ecx, ecx
je 0x1015cd8a
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1015cdd3
push dword [0x1028dd78]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1015cdc3
mov edx, dword [eax + 4]
test edx, edx
je 0x1015cdc3
mov eax, 4
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x1015cdd6
inc eax
cmp eax, 6
jl 0x1015cdb4
push esi
call fcn.101eb4d1
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x60]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x1015cdf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1021aaf0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10282800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x1015ce98
lea ecx, [esi + 0x1b0]
cmp dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
je 0x1015ce3f
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
mov ecx, dword [esi + 0x1a4]
lea ebx, [esi + 0x180]
test ecx, ecx
je 0x1015ce64
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
je 0x1015ce91
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push ecx
push 1
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x14], 0x10282038
push ecx
push eax
mov byte [ebp - 0xd], 0
call fcn.1010f060
add esp, 0x10
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1015cedf
push dword [0x1028dd78]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1015cecf
mov edx, dword [eax + 4]
test edx, edx
je 0x1015cecf
xor eax, eax
nop dword [eax + eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x1015cef1
inc eax
cmp eax, 2
jl 0x1015cec0
push esi
call fcn.101eb4d1
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x1d0]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x1015ced8
Function at 0x1015cf10
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov ebx, ecx
push edi
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1015cf54
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 1
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0x10282038
push ecx
push eax
mov byte [esp + 0x38], 0
call fcn.1010f060
add esp, 0x10
mov dword [esi], 0xffffffff
mov eax, dword [ebx + 4]
add eax, 0x18
lock inc dword [eax]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
test ebp, ebp
je 0x1015cf85
xor eax, eax
lock xadd dword [ebp], eax
cmp eax, 1
jne 0x1015cf85
mov ecx, dword [ebx + 4]
push 0
push 0x3e3
push edi
call fcn.10126a50
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push dword [esp + 0x38]
mov dword [esp + 0x1c], 0x10282038
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.10133830
mov dword [esp + 0x44], eax
add esp, 0x10
mov eax, dword [esi]
mov dword [esp + 0x44], eax
cmp eax, 0xffffffff
je 0x1015d04a
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x1015d04a
call fcn.100e0d20
mov dword [esp + 0x28], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x40], eax
call fcn.100e0d20
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 4]
cmp ecx, dword [eax + 4]
jne 0x1015cffa
cmp dword [esp + 0x40], 0x2733
je 0x1015d015
call fcn.100e0d20
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 4]
cmp ecx, dword [eax + 4]
jne 0x1015d04a
cmp dword [esp + 0x40], 0x4d5
jne 0x1015d04a
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
push 0x8004667e
push dword [esp + 0x4c]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push dword [esp + 0x44]
call dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x1015d04a
call fcn.100e0d20
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov eax, dword [esp + 0x34]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x1015d06f
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x10]
push 0
push eax
push edi
call fcn.101592c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x24
push edi
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push eax
mov eax, dword [esp + 0x44]
push eax
push eax
mov eax, dword [esp + 0x44]
push 0
push dword [esp + 0x4c]
push eax
push dword [esp + 0x40]
call sub.WSOCK32.dll_AcceptEx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
jne 0x1015d0bf
cmp eax, 0x3e5
je 0x1015d0bf
mov ecx, dword [ebx + 4]
push esi
push eax
push edi
call fcn.10126a50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x24
test ebp, ebp
je 0x1015d0da
xor eax, eax
lock xadd dword [ebp], eax
cmp eax, 1
jne 0x1015d0da
push edi
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CancelIoEx]
mov ecx, dword [ebx + 4]
push edi
call fcn.10126ad0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x24
Function at 0x1015fc70
Capabilities:
Create thread

Disassembly:
sub esp, 8
push 4
call fcn.101e3738
add esp, 4
test eax, eax
je 0x1015fc89
mov dword [eax], 0x1014e1f0
jmp 0x1015fc8b
xor eax, eax
lea ecx, [esp + 4]
push ecx
push 0
push eax
push 0x100ce910
push 0
push 0
call fcn.101ead27
add esp, 0x18
mov dword [esp], eax
test eax, eax
je 0x1015fcca
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x1015fcd9
push ecx
push eax
call fcn.101e0ba7
add esp, 8
test eax, eax
jne 0x1015fcd9
mov eax, 1
add esp, 8
ret
push 6
mov dword [esp + 8], 0
call fcn.101e0e6c
push 1
call fcn.101e0e6c
int3
Function at 0x10162bc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1021b280
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x10282800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push 0x104
push eax
push str.SteamPath
mov dword [ebp - 0x130], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0
push eax
lea ecx, [ebp - 0x12c]
movups xmmword [ebp - 0x12c], xmm0
call fcn.100ce110
mov ecx, dword [ebp - 0x11c]
mov byte [ebp - 0x130], 0
mov dword [ebp - 4], 0
push dword [ebp - 0x130]
test ecx, ecx
jne 0x10162cbd
push 0x1c
push str.C:_Program_Files__x86__Steam
push esi
call fcn.100ce1a0
mov ecx, dword [ebp - 0x118]
add esp, 0x10
cmp ecx, 0xf
jbe 0x10162ca1
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10162c97
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10162d08
push ecx
push edx
call fcn.101e3768
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e3b75
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x12c]
push ecx
cmova eax, dword [ebp - 0x12c]
push eax
push esi
call fcn.100ce1a0
mov ecx, dword [ebp - 0x118]
add esp, 0x10
cmp ecx, 0xf
jbe 0x10162ca1
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10162c97
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10162c97
call fcn.101e90af
int3
Function at 0x10176f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
mov cl, byte [esp + 0x20]
mov eax, 0x21c
push ebx
push ebp
test cl, cl
mov edx, 0x1dc
push esi
cmove eax, edx
push edi
mov edi, dword [esp + 0x2c]
add eax, edi
mov dword [esp + 0x20], eax
test cl, cl
je 0x10176fb0
mov eax, dword [edi + 0xac]
jmp 0x10176fb3
mov eax, dword [edi + 0x64]
mov ebp, dword [esp + 0x40]
test ebp, ebp
je 0x10176fbf
mov byte [ebp], 0
mov ebx, dword [esp + 0x28]
mov esi, dword [ebx + 0x900]
test esi, esi
je 0x1017717a
mov ecx, dword [esi + 0x14]
push eax
mov dword [esp + 0x44], ecx
call dword [0x102823c0]
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x10177015
cmp byte [edi + 0x269], 0
je 0x10177022
push dword [edi + 0x7c]
call dword [0x102823c0]
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
jne 0x1017702a
mov ebx, dword [esp + 0x14]
push ebx
call dword [0x102823b8]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0x14
ret
mov dword [esp + 0x28], 0
cmp byte [edi + 0x26a], 0
je 0x1017703f
mov ecx, dword [edi + 0xcc]
mov dword [esp + 0x18], ecx
jmp 0x10177047
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x1017705d
test byte [eax + 4], 0x10
je 0x1017705d
lea ecx, [eax + 0x74]
mov dword [esp + 0x10], ecx
jmp 0x10177067
lea eax, [ebx + 0x904]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x4c0]
mov edx, 1
cmp eax, edx
jbe 0x101770b3
mov ecx, dword [ebx + 0x900]
add ecx, 0x74
nop
cmp dword [ecx - 8], 0
mov dword [esp + 0x1c], esi
je 0x101770b3
mov eax, dword [ecx]
lea esi, [ecx - 0x14]
cmp eax, dword [esp + 0x40]
cmovge esi, dword [esp + 0x1c]
inc edx
add ecx, 0x60
cmp eax, dword [esp + 0x40]
cmovge eax, dword [esp + 0x40]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 0x4c0]
cmp edx, eax
jb 0x10177080
cmp edx, eax
jne 0x101770c2
push esi
call fcn.10177bc0
add esp, 4
jmp 0x101770ce
lea esi, [edx + edx*2]
shl esi, 5
add esi, dword [ebx + 0x900]
mov eax, dword [esp + 0x34]
push dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
call dword [0x102823b8]
push dword [esi + 4]
call dword [0x102823b8]
mov eax, dword [esp + 0x30]
add esp, 8
cmp byte [esp + 0x30], 0
mov ebx, dword [esp + 0x14]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esi], ebx
mov dword [esi + 0x1c], eax
je 0x1017711c
mov eax, dword [edi + 0xc4]
jmp 0x10177122
mov eax, dword [edi + 0xc8]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2a8]
lea edi, [esi + 0x20]
push edi
push dword [esp + 0x24]
mov eax, dword [eax]
mov dword [esi + 8], eax
call fcn.101767e0
add esp, 8
test al, al
jne 0x10177172
push edi
call fcn.10176a40
push ebx
mov dword [esi + 0xc], 0
call dword [0x102823b8]
push dword [esp + 0x30]
call dword [0x102823b8]
add esp, 0xc
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
test ebp, ebp
je 0x1017717a
mov byte [ebp], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x1017b3b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1017b43c
push esi
call fcn.10191650
add esp, 4
test al, al
jne 0x1017b43c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1017b3d3
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.10192660
add esp, 0xc
test eax, eax
je 0x1017b407
sub eax, esi
push eax
push 0x2e
push esi
call fcn.10192660
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1017b409
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x1017b435
mov al, byte [esi]
push eax
call fcn.10179440
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x1017b417
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x101887b0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10282800]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 4], eax
xor eax, eax
mov ecx, dword [ebx + 0xc]
push ebp
push esi
mov esi, 0x178
mov edx, dword [ecx + 0x154]
cmp dword [esp + 0x120], edx
push edi
sete al
lea eax, [eax*4 + 0x150]
mov ebp, dword [eax + ecx]
mov eax, 0x188
cmove esi, eax
mov eax, dword [ecx + 0x2a8]
add esi, ecx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x101888b3
xor eax, eax
cmp dword [esp + 0x124], edx
sete al
lea eax, [eax*4 + 0x168]
cmp dword [eax + ecx], 0x10188470
jne 0x101888b3
cmp dword [esi], 0
je 0x1018884e
test edi, edi
je 0x101888b3
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.101ae2a0
add esp, 0x14
cmp eax, 0xffffffff
je 0x101888b3
test al, 1
je 0x101888b3
mov ecx, dword [esi]
test ecx, ecx
jne 0x1018889c
mov eax, dword [ebx + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x102823b4]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x101888e7
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x101888b3
add dword [esi + 8], eax
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
jne 0x10188922
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x101888f8
xor edi, edi
lea eax, [edi + 0x51]
jmp 0x10188922
mov ecx, dword [esp + 0x10]
mov eax, 0x1b
mov dword [ecx], 0xffffffff
jmp 0x10188928
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.10190aa0
push eax
push str.Send_failure:__s
push ebx
call fcn.10188210
add esp, 0x18
mov dword [ebx + 0x948], esi
mov eax, 0x37
mov ecx, dword [esp + 0x10]
mov dword [ecx], edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101e3b75
add esp, 0x10c
ret

Function at 0x10188d80
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1a4], 0
je 0x10188d9d
push eax
call fcn.10177210
add esp, 4
test eax, eax
je 0x10188dbe
mov al, 1
ret
mov eax, dword [eax + 0x150]
cmp eax, 0xffffffff
je 0x10188dbe
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
ret
xor al, al
ret
Function at 0x10189020
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x10282800]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call fcn.101e5b40
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x101890a7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.10190aa0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x101890e7
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.10188c00
add esp, 0x10
test al, al
jne 0x101890f0
call fcn.101eb45e
mov esi, dword [eax]
call fcn.101eb45e
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.10190aa0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10188210
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101e3b75
add esp, 0x188
ret

Function at 0x101898f0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x1028e4d4]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x10189941
push 3
push 2
push eax
push eax
push 6
call fcn.101b2320
add esp, 0x14
test al, al
je 0x10189935
mov dword [0x1028e4d4], 2
add esp, 0xc
ret
mov dword [0x1028e4d4], 1
jmp 0x10189946
cmp eax, 2
je 0x1018998c
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10189971
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x1018998c
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret