joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa9d8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0xa9d921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0xa9d946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0xa9d96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0xa9d993
push ecx
push esi
call fcn.00a9d4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0xaa4e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0xaba8f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0xaa4ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.00aa17a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0xaa4e61
mov edx, dword [eax]
jmp 0xaa4e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00aa3050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0xaa4ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xaa4ebf
cmp esi, edi
je 0xaa4ebf
mov ecx, esi
call fcn.00a9ca00
push esi
call fcn.00aaa1c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00aa1990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0xaa4ef5
mov eax, dword [eax]
jmp 0xaa4ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00aa0640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0xaa4f25
mov eax, dword [eax]
jmp 0xaa4f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0xaa4f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xaa4f76
cmp esi, edi
je 0xaa4f76
mov eax, dword [esi]
cmp eax, edi
je 0xaa4f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0xaa4f6d
push eax
call fcn.00aaa1c8
add esp, 4
push esi
call fcn.00aaa1c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xaa5f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xaba9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xaa6002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00aa9dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xaa6002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00aa16e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00aaa20b
push 0x10
call fcn.00aaa1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xaa5fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00a961c0
jmp 0xaa5fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00aa5b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xaa5ff0
mov ecx, edi
call fcn.00a962c0
push edi
call fcn.00aaa1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xaa6021
inc ebx
cmp ebx, 0x20
jb 0xaa5f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xaa8000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xaa8131
push esi
call fcn.00aab145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00a9a080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xaa8131
push 0
push ebp
call fcn.00a9a3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00a9a260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xaa808b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00a9a2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xaa8121
push 0xac0918
push edi
call fcn.00aa93f0
push eax
push ebx
push esi
call fcn.00aa7f60
push 0xac08f8
push edi
call fcn.00aa93f0
push eax
push ebx
push esi
call fcn.00aa7f60
push 0xac08d8
push edi
call fcn.00aa93f0
push eax
push ebx
push esi
call fcn.00aa7f60
push 0xac08c0
push edi
call fcn.00aa93f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00aa7f60
push 0xac08a0
push edi
call fcn.00aa93f0
push eax
push ebx
push esi
call fcn.00aa7f60
push 0xac0888
push edi
call fcn.00aa93f0
push eax
push ebx
push esi
call fcn.00aa7f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10003a40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10003a72
jl 0x10003a65
test ecx, ecx
jne 0x10003a72
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10003b32
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10008cc0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10003ade
jg 0x10003a9d
test esi, esi
je 0x10003ade
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10003ab5
mov eax, dword [esp + 0x10]
jl 0x10003aaf
cmp eax, esi
jae 0x10003ab5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1003a5b0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10003aff
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x10003b1b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10003a84
jl 0x10003b1b
test ecx, ecx
jne 0x10003a84
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10003b70
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10003b70
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.1003a5b0
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x10003bd9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10003b96
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x10003bc4
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1003f0de
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10003bd9
cmp edi, eax
ja 0x10003ba2
test edi, edi
je 0x10003bd9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1003f0de
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10005f70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f1a0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100760c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.10038afa
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10037eb1
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10005f10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009cd0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f732
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x258
mov eax, dword [0x100760c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x234], edi
xorps xmm0, xmm0
mov dword [ebp - 0x230], 0
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x228]
push 0x104
push eax
mov dword [ebp - 0x230], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10009f09
mov edx, dword [edi + 0x14]
cmp eax, edx
ja 0x10009db8
mov dword [ebp - 0x22c], edi
mov ecx, edi
cmp edx, 7
jbe 0x10009d93
mov ecx, dword [edi]
mov dword [ebp - 0x22c], ecx
lea esi, [eax + eax]
mov dword [edi + 0x10], eax
push esi
lea eax, [ebp - 0x228]
push eax
push ecx
call fcn.1003a5b0
mov eax, dword [ebp - 0x22c]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
jmp 0x10009dcd
lea ecx, [ebp - 0x228]
push ecx
push dword [ebp - 0x234]
mov ecx, edi
push eax
call fcn.1000a500
push str.nto0101l.exe
lea ecx, [ebp - 0x264]
call fcn.10004420
push 4
sub esp, 0xc
mov dword [ebp - 4], 1
mov ecx, eax
call fcn.1000a360
push eax
mov edx, edi
lea ecx, [ebp - 0x24c]
call fcn.1000a890
mov esi, eax
add esp, 4
cmp edi, esi
je 0x10009e70
mov ecx, dword [edi + 0x14]
cmp ecx, 7
jbe 0x10009e40
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x10009e36
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009f29
mov eax, edx
push ecx
push eax
call fcn.10038e67
add esp, 8
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 7
mov word [edi], ax
movups xmm0, xmmword [esi]
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ecx, dword [ebp - 0x238]
cmp ecx, 7
jbe 0x10009eb0
mov edx, dword [ebp - 0x24c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10009ea6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009f29
push ecx
push edx
call fcn.10038e67
add esp, 8
mov ecx, dword [ebp - 0x250]
xor eax, eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
cmp ecx, 7
jbe 0x10009f09
mov edx, dword [ebp - 0x264]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10009eff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009f29
push ecx
push edx
call fcn.10038e67
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10038aec
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1003e0cf
int3
Function at 0x1001a8a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x104
mov eax, dword [0x100760c0]
xor eax, esp
mov dword [esp + 0x100], eax
mov ecx, dword [esp + 0x10c]
push ebx
push ebp
mov ebp, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x124]
push edi
mov eax, dword [ebp + 0xc]
mov edi, dword [esp + 0x120]
push ecx
push eax
mov ebx, dword [eax + ecx*4 + 0x148]
push ebp
call fcn.1001ad10
add esp, 0xc
test eax, eax
je 0x1001a8f8
mov dword [esi], 0x1b
or eax, 0xffffffff
jmp 0x1001a95d
push 0
push dword [esp + 0x128]
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x1001a95b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x1001a930
xor edi, edi
mov dword [esi], 0x51
jmp 0x1001a95b
push 0x100
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.100305e0
push eax
push str.Send_failure:__s
push ebp
call fcn.1001a560
mov dword [ebp + 0x954], ebx
add esp, 0x18
mov dword [esi], 0x37
mov eax, edi
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10038aec
add esp, 0x104
ret

Function at 0x1001ad10
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
push esi
lea esi, [edx + 0x17]
mov eax, dword [ecx + 0x298]
mov ebx, dword [ecx + edx*4 + 0x148]
shl esi, 4
add esi, ecx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x1001adc5
cmp dword [ecx + edx*4 + 0x160], 0x1001a7c0
jne 0x1001adc5
cmp dword [esi], 0
je 0x1001ad56
test edi, edi
je 0x1001adc5
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.10026ad0
add esp, 0x14
cmp eax, 0xffffffff
je 0x1001adc5
test al, 1
je 0x1001adc5
cmp dword [esi], 0
jne 0x1001adae
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x4e8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x1001ad9d
pop edi
pop esi
mov eax, 0x1b
pop ebx
ret
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1001adc5
add dword [esi + 8], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1001b170
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x100760c0]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call fcn.1003a450
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1001b1f7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.100305e0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x1001b238
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.1001add0
add esp, 0x10
test al, al
jne 0x1001b241
call fcn.10041dac
mov esi, eax
call fcn.10041dac
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push dword [esi]
call fcn.100305e0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.1001a560
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10038aec
add esp, 0x188
ret

Function at 0x1001b970
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x1007740c]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x1001b9c1
push 3
push 2
push eax
push eax
push 6
call fcn.100313e0
add esp, 0x14
test al, al
je 0x1001b9b5
mov dword [0x1007740c], 2
add esp, 0xc
ret
mov dword [0x1007740c], 1
jmp 0x1001b9c6
cmp eax, 2
je 0x1001ba0c
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1001b9f1
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x1001ba0c
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x1001c660
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x100760c0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
xor eax, eax
push edi
mov edi, dword [esp + 0x28]
push 4
cmp byte [esi + 0x71b], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1001c6c0
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d
push esi
call fcn.1001a630
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10038aec
add esp, 0x18
ret
push dword [esi + 0x6b8]
mov dword [esp + 0x14], 1
call fcn.1001c8e0
push dword [esi + 0x6bc]
imul eax, eax, 0x3e8
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
call fcn.1001c8e0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1001c737
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
push esi
call fcn.1001a630
add esp, 0x10
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.10038aec
add esp, 0x18
ret

Function at 0x1001c750
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x108
mov eax, dword [0x100760c0]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
lea eax, [esp + 4]
push 4
push eax
push 1
push 6
push dword [esp + 0x124]
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1001c7b5
push 0x100
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.100305e0
push eax
push str.Could_not_set_TCP_NODELAY:__s
push esi
call fcn.1001a630
add esp, 0x18
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.10038aec
add esp, 0x108
ret
Function at 0x1001c920
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x10062850
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x1001c93a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x1006286c
push esi
call fcn.10043590
add esp, 8
test eax, eax
je 0x1001c982
test ebp, ebp
je 0x1001c973
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x1001c9a8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c9a8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x1001ca5f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001c9c5
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1001ca55
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1001ca55
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001c9f7
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ca10
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x1001ca20
test ebp, ebp
je 0x1001ca4c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x10076004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x10076004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x100212a0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100212bc
cmp dword [esi + 0x78], 0
je 0x100212bc
push 2
push 3
push esi
call fcn.1001dab0
add esp, 0xc
push dword [esp + 0xc]
call fcn.10020db0
add esp, 4
test esi, esi
je 0x100212dd
cmp dword [esi + 0x78], 0
je 0x100212dd
push 3
push esi
call fcn.1001daf0
add esp, 8
pop esi
ret