joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100244ee
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.10001522
mov dword [ebp - 4], eax
push 4
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 8], eax
call fcn.10001fd7
mov dword [ebp - 0xc], eax
push 8
push dword [ebp - 4]
call fcn.100016e8
mov dword [ebp - 0x28], eax
cmp word [ebp - 0x28], 2
mov eax, 0
sete al
test eax, eax
je 0x10024581
mov eax, 0x10
jmp 0x10024586
mov eax, 0x1c
mov dword [ebp - 0x10], eax
push 0x3c
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xc], 0
je 0x10024678
fild dword [ebp - 0xc]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fadd qword [0x10043394]
fstp qword [ebp - 0x30]
mov dword [ebp - 0x34], esp
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 0
push dword [0x10043ded]
fld qword [ebp - 0x30]
call fcn.100010b7
push eax
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_recvfrom]
nop
nop
cmp dword [ebp - 0x34], esp
je 0x100245fc
push 0x220
push 0x40238a8
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 0x18], eax
push 0x28
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jne 0x1002461e
jmp 0x10024678
cmp dword [ebp - 0x18], 0
jle 0x10024673
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
call fcn.100143f4
lea eax, [ebp - 0x1c]
push eax
call fcn.1001b907
mov dword [ebp - 0x24], eax
fild dword [ebp - 0xc]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fadd qword [0x10043394]
fstp qword [ebp - 0x34]
push dword [ebp - 0x18]
fld qword [ebp - 0x34]
call fcn.100010b7
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.100246e6
jmp 0x10024599
push dword [ebp - 0xc]
call fcn.1000237e
fild dword [ebp - 4]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fadd qword [0x1003f293]
fstp qword [ebp - 0x30]
mov dword [ebp - 0x34], esp
fld qword [ebp - 0x30]
call fcn.100010b7
push eax
xor eax, eax
call dword [0x10043f79]
nop
nop
cmp dword [ebp - 0x34], esp
je 0x100246c4
push 0x40b
push 0x40238a8
push 6
call fcn.10038d0c
add esp, 0xc
mov eax, 0
jmp 0x100246ce
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x100246df
push ebx
call fcn.10038d1e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1002471f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.10001522
mov dword [ebp - 4], eax
push 0xa0
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 8], eax
call fcn.10001fd7
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x1c
push 0x3c
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xc], 0
je 0x10024879
fild dword [ebp - 0xc]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fadd qword [0x10043394]
fstp qword [ebp - 0x30]
mov dword [ebp - 0x34], esp
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 0
push dword [0x10043ded]
fld qword [ebp - 0x30]
call fcn.100010b7
push eax
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_recvfrom]
nop
nop
cmp dword [ebp - 0x34], esp
je 0x100247fd
push 0x1cd
push 0x40238a7
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 0x18], eax
push 0x28
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jne 0x1002481f
jmp 0x10024879
cmp dword [ebp - 0x18], 0
jle 0x10024874
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
call fcn.100143f4
lea eax, [ebp - 0x1c]
push eax
call fcn.1001b907
mov dword [ebp - 0x24], eax
fild dword [ebp - 0xc]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fadd qword [0x10043394]
fstp qword [ebp - 0x34]
push dword [ebp - 0x18]
fld qword [ebp - 0x34]
call fcn.100010b7
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.100246e6
jmp 0x1002479a
push dword [ebp - 0xc]
call fcn.1000237e
fild dword [ebp - 4]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fadd qword [0x1003f293]
fstp qword [ebp - 0x30]
mov dword [ebp - 0x34], esp
fld qword [ebp - 0x30]
call fcn.100010b7
push eax
xor eax, eax
call dword [0x10043f79]
nop
nop
cmp dword [ebp - 0x34], esp
je 0x100248c5
push 0x3a5
push 0x40238a7
push 6
call fcn.10038d0c
add esp, 0xc
mov eax, 0
jmp 0x100248cf
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x100248e0
push ebx
call fcn.10038d1e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1002661f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.1000313c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10026665
mov eax, 0
jmp 0x100267ba
push 0x1f4
push 0x18
call fcn.1001b9b1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10026693
push dword [ebp - 4]
call fcn.10007d66
mov eax, 0
jmp 0x100267ba
push 0x1f4
call fcn.10010650
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100266c4
push dword [ebp - 8]
call fcn.1001a4d2
push dword [ebp - 4]
call fcn.10007d66
mov eax, 0
jmp 0x100267ba
push dword [ebp - 8]
push 0
push dword [ebp - 4]
call fcn.1000328c
push dword [ebp - 0xc]
push 4
push dword [ebp - 4]
call fcn.1000328c
push dword [ebp + 8]
push 8
push dword [ebp - 4]
call fcn.1000328c
push 0
push 0xc
push dword [ebp - 4]
call fcn.1000328c
mov dword [ebp - 0x14], esp
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 4]
push 0x10028d85
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10026752
push 0x2b8
push 0x4016051
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0xf
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10026786
push 0x2fc
push 0x4016051
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
xor eax, eax
call dword [0x10043f35]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x100267b2
push 0x31f
push 0x4016051
push 6
call fcn.10038d0c
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x100267ba
mov esp, ebp
pop ebp
ret 4
Function at 0x1002994d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push dword [ebp + 8]
call fcn.10001522
mov dword [ebp - 4], eax
push 4
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 8], eax
push 0x38
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 0x2c], eax
push 0x1c
push dword [ebp - 0x2c]
call fcn.10001a45
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call fcn.10001903
mov dword [ebp - 0x10], eax
push 8
push dword [ebp - 4]
call fcn.100016e8
mov dword [ebp - 0x30], eax
cmp word [ebp - 0x30], 2
mov eax, 0
sete al
test eax, eax
je 0x10029a11
mov eax, 0x10
jmp 0x10029a16
mov eax, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x10029c0d
fild dword [ebp - 0x10]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fadd qword [0x1003f24b]
fstp qword [ebp - 0x38]
fild dword [ebp - 0x10]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fadd qword [0x1003f211]
fstp qword [ebp - 0x48]
mov dword [ebp - 0x4c], esp
lea eax, [ebp - 0x14]
push eax
fld qword [ebp - 0x48]
call fcn.100010b7
push eax
push 0
push dword [0x10043ded]
fld qword [ebp - 0x38]
call fcn.100010b7
push eax
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_recvfrom]
nop
nop
cmp dword [ebp - 0x4c], esp
je 0x10029a94
push 0x272
push 0x401f695
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 0x18], eax
push 0x28
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jne 0x10029ab6
jmp 0x10029c0d
cmp dword [ebp - 0x18], 0xffffffff
jne 0x10029bb2
jmp 0x10029a19
cmp dword [ebp - 0x18], 0xa
jl 0x10029c08
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.100018c8
push dword [ebp - 0x18]
push 0x20
push dword [ebp - 0x10]
call fcn.1000328c
fild dword [ebp - 0x10]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fadd qword [0x1003f24b]
fstp qword [ebp - 0x38]
push dword [ebp - 4]
fld qword [ebp - 0x38]
call fcn.100010b7
push eax
push dword [ebp - 0x10]
call fcn.10029c7e
push dword [ebp - 0xc]
call fcn.10001903
mov dword [ebp - 0x10], eax
jmp 0x10029a19
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.10002395
fild dword [ebp - 4]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fadd qword [0x1003f293]
fstp qword [ebp - 0x38]
mov dword [ebp - 0x3c], esp
fld qword [ebp - 0x38]
call fcn.100010b7
push eax
xor eax, eax
call dword [0x10043f79]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x10029c5c
push 0x82c
push 0x401f695
push 6
call fcn.10038d0c
add esp, 0xc
mov eax, 0
jmp 0x10029c66
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10029c77
push ebx
call fcn.10038d1e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a50e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push dword [ebp + 8]
call fcn.10001522
mov dword [ebp - 4], eax
push 0xa0
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 8], eax
push 0x38
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 0x2c], eax
push 0x1c
push dword [ebp - 0x2c]
call fcn.10001a45
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call fcn.10001903
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x1c
cmp dword [ebp - 0x10], 0
je 0x1002a7a0
fild dword [ebp - 0x10]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fadd qword [0x1003f24b]
fstp qword [ebp - 0x38]
fild dword [ebp - 0x10]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fadd qword [0x1003f211]
fstp qword [ebp - 0x48]
mov dword [ebp - 0x4c], esp
lea eax, [ebp - 0x14]
push eax
fld qword [ebp - 0x48]
call fcn.100010b7
push eax
push 0
push dword [0x10043ded]
fld qword [ebp - 0x38]
call fcn.100010b7
push eax
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_recvfrom]
nop
nop
cmp dword [ebp - 0x4c], esp
je 0x1002a625
push 0x21f
push 0x4021e32
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 0x18], eax
push 0x28
push dword [ebp - 4]
call fcn.10001a45
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jne 0x1002a647
jmp 0x1002a7a0
cmp dword [ebp - 0x18], 0xffffffff
jne 0x1002a745
jmp 0x1002a5aa
cmp dword [ebp - 0x18], 0xa
jl 0x1002a79b
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.100018c8
push dword [ebp - 0x18]
push 0x20
push dword [ebp - 0x10]
call fcn.1000328c
fild dword [ebp - 0x10]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fadd qword [0x1003f24b]
fstp qword [ebp - 0x38]
push dword [ebp - 4]
fld qword [ebp - 0x38]
call fcn.100010b7
push eax
push dword [ebp - 0x10]
call fcn.10029c7e
push dword [ebp - 0xc]
call fcn.10001903
mov dword [ebp - 0x10], eax
jmp 0x1002a5aa
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.10002395
fild dword [ebp - 4]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fadd qword [0x1003f293]
fstp qword [ebp - 0x38]
mov dword [ebp - 0x3c], esp
fld qword [ebp - 0x38]
call fcn.100010b7
push eax
xor eax, eax
call dword [0x10043f79]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x1002a7ef
push 0x76f
push 0x4021e32
push 6
call fcn.10038d0c
add esp, 0xc
mov eax, 0
jmp 0x1002a7f9
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x1002a80a
push ebx
call fcn.10038d1e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1002e3ab
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x1002e3ca
jmp 0x1002e583
cmp dword [ebp + 8], 6
mov eax, 0
setl al
test eax, eax
je 0x1002e3e8
mov eax, 6
jmp 0x1002e3eb
mov eax, dword [ebp + 8]
mov dword [0x10043d69], eax
cmp dword [0x10043d69], 0x100
mov eax, 0
setg al
test eax, eax
je 0x1002e414
mov eax, 0x100
jmp 0x1002e419
mov eax, dword [0x10043d69]
mov dword [0x10043d69], eax
cmp dword [0x10043d79], 0
jne 0x1002e583
mov dword [ebp - 8], esp
push 0
push 0
push 0
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002e468
push 0x15b
push 0x40232bb
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [0x10043d79], eax
xor ecx, ecx
inc ecx
push ecx
cmp ecx, 6
jg 0x1002e567
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x10043d79]
push 0x10018ea7
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002e4c9
push 0x1c5
push 0x40232bb
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002e561
mov dword [ebp - 8], esp
push 0x10043d65
xor eax, eax
call dword [0x10043f31]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002e504
push 0x23f
push 0x40232bb
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 8], esp
push 0xf
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002e535
push 0x259
push 0x40232bb
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [0x10043f35]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002e561
push 0x27c
push 0x40232bb
push 6
call fcn.10038d0c
add esp, 0xc
pop ecx
jmp 0x1002e46f
add esp, 4
push 0
push 0x1f4
push 0x1002e803
call fcn.100109ce
mov dword [0x10043e51], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1002e589
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov eax, dword [0x10043d69]
mov dword [ebp - 4], eax
cmp dword [0x10043d65], 6
jge 0x1002e5fb
fild dword [0x10043d65]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fild dword [0x10043d71]
fstp qword [ebp - 0x20]
fadd qword [ebp - 0x20]
fstp qword [ebp - 0x28]
fild dword [ebp - 4]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x28]
fsub qword [ebp - 0x30]
fcomp qword [0x1004333c]
fnstsw ax
test ah, 1
je 0x1002e5fb
mov eax, 1
jmp 0x1002e600
mov eax, 0
test eax, eax
je 0x1002e72e
fld qword [0x100433e6]
fild dword [0x10043d65]
fstp qword [ebp - 0x14]
fsub qword [ebp - 0x14]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
call fcn.100010b7
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
inc ecx
push ecx
push eax
cmp ecx, eax
jg 0x1002e726
mov dword [ebp - 0x10], esp
mov eax, 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [0x10043d79]
push 0x10018ea7
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1002e687
push 0x16d
push 0x40232be
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1002e71f
mov dword [ebp - 0x10], esp
push 0x10043d65
xor eax, eax
call dword [0x10043f31]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1002e6c2
push 0x1e7
push 0x40232be
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 0x10], esp
push 0xf
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1002e6f3
push 0x201
push 0x40232be
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [0x10043f35]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1002e71f
push 0x224
push 0x40232be
push 6
call fcn.10038d0c
add esp, 0xc
pop eax
pop ecx
jmp 0x1002e62d
add esp, 8
jmp 0x1002e7f3
fild dword [0x10043d65]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fsub qword [0x100433e6]
fstp qword [ebp - 0x1c]
fild dword [ebp - 4]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fmul qword [0x10043733]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x1c]
fsub qword [ebp - 0x2c]
fcomp qword [0x1003f221]
fnstsw ax
test ah, 0x41
jne 0x1002e7f3
fild dword [0x10043d65]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fsub qword [0x100433e6]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
call fcn.100010b7
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
inc ecx
push ecx
push eax
cmp ecx, eax
jg 0x1002e7f0
cmp dword [0x10043d65], 6
jg 0x1002e7ae
jmp 0x1002e7f0
mov dword [ebp - 0x10], esp
push 0
push 0
push 0
push dword [0x10043d79]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_PostQueuedCompletionStatus]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1002e7ec
push 0x377
push 0x40232be
push 6
call fcn.10038d0c
add esp, 0xc
pop eax
pop ecx
jmp 0x1002e791
add esp, 8
mov eax, 0
jmp 0x1002e7fd
mov esp, ebp
pop ebp
ret 8
Function at 0x1002e822
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 1
push 0
push 1
push 0
push 1
push 1
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push 1
push 0xb
push 1
push 4
push 0x10043e0d
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1002e893
mov eax, 0
jmp 0x1002e9d6
push 0x3e8
push 0x10
call fcn.1001b9b1
mov dword [0x10043df5], eax
cmp dword [0x10043df5], 0
jne 0x1002e8cd
push 0x10043e0d
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, 0
jmp 0x1002e9d6
push 0x3e8
call fcn.10010650
mov dword [0x10043e4d], eax
cmp dword [0x10043e4d], 0
jne 0x1002e90d
push 0x10043e0d
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
push dword [0x10043df5]
call fcn.1001a4d2
mov eax, 0
jmp 0x1002e9d6
call fcn.1002e9da
mov dword [0x10043e01], eax
mov dword [0x10043e05], edx
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x10043e4d]
push 0x1002eaf0
push 0x1f4
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002e96c
push 0x20f
push 0x40211b5
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xf
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002e9a0
push 0x253
push 0x40211b5
push 6
call fcn.10038d0c
add esp, 0xc
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [0x10043f35]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002e9cc
push 0x276
push 0x40211b5
push 6
call fcn.10038d0c
add esp, 0xc
mov eax, 1
jmp 0x1002e9d6
mov esp, ebp
pop ebp
ret
Function at 0x1002f213
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x20
call fcn.10038d18
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
mov dword [ebx], eax
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx], 1
mov ebx, dword [ebp - 4]
add ebx, 0xc
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx], 6
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx], 1
mov dword [ebp - 0x14], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1002f2cc
push 0xae
push 0x4023258
push 6
call fcn.10038d0c
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x1002f355
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x14]
call fcn.10007403
mov dword [ebp - 0x18], eax
push 0x20
push dword [ebp - 8]
push dword [ebp - 0x18]
call fcn.10001688
mov ebx, dword [ebp - 4]
add ebx, 0x18
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0x14]
push dword [ebx]
call fcn.100183df
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1002f325
push ebx
call fcn.10038d1e
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1002f355
push 0x19f
push 0x4023258
push 6
call fcn.10038d0c
add esp, 0xc
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x1002f371
push eax
mov ebx, eax
call fcn.10002543
inc eax
push eax
call fcn.10038d18
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1002f376
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.10038d1e
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1002f393
push ebx
call fcn.10038d1e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8