joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021c00
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push esi
push 0
push 0xa
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10021c65
lea eax, [esp + 8]
push edi
push eax
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10021c52
mov edi, dword [esp + 0x138]
cmp dword [esp + 0x14], edi
je 0x10021c50
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10021c52
jmp 0x10021c39
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x128
ret
mov al, bl
pop esi
pop ebx
add esp, 0x128
ret

Function at 0x10021c70
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc0
push ebx
push esi
lea eax, [esp + 0xa4]
push edi
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push ecx
call esi
test eax, eax
jne 0x10021cca
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push edx
call esi
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xc0
ret
cmp dword [esp + 0x10], 6
jne 0x10021cdc
mov eax, dword [esp + 0x14]
cmp eax, 2
mov al, 1
je 0x10021cde
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0xc0
ret
Function at 0x10021cf0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x530
push ebp
mov ebp, dword [esp + 0x538]
test ebp, ebp
mov byte [esp + 7], 0
jne 0x10021d11
xor al, al
pop ebp
add esp, 0x530
ret
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x144]
rep stosd dword es:[edi], eax
mov esi, 1
mov dword [esp + 0x140], ebp
call fcn.10021c70
push 0
push 0xa
mov bl, al
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x10021ded
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10021de6
test bl, bl
je 0x10021d7e
lea ecx, [esp + 0x3c]
push ecx
push str.explorer.exe
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10021dd2
mov edx, dword [esp + 0x30]
cmp edx, ebp
jne 0x10021da1
mov eax, dword [esp + 0x20]
mov byte [esp + 0x13], 1
mov dword [esp + esi*4 + 0x140], eax
inc esi
cmp esi, 0x100
jb 0x10021dd2
jmp 0x10021dd0
xor eax, eax
test esi, esi
jbe 0x10021dd2
lea ecx, [esp + 0x140]
cmp edx, dword [ecx]
je 0x10021dbc
inc eax
add ecx, 4
cmp eax, esi
jb 0x10021dae
jmp 0x10021dd2
mov ecx, dword [esp + 0x20]
mov dword [esp + esi*4 + 0x140], ecx
inc esi
cmp esi, 0x100
jb 0x10021dd2
xor esi, esi
lea edx, [esp + 0x18]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
setne al
test al, al
jne 0x10021d66
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jbe 0x10021e40
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esp + 0x14], esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ebp, [esp + 0x140]
mov eax, dword [ebp]
test eax, eax
je 0x10021e32
push eax
push 0
push 0x1f0fff
call esi
mov edi, eax
test edi, edi
je 0x10021e32
push 1
push edi
call ebx
test eax, eax
push edi
setne byte [esp + 0x17]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x10021e08
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x530
ret
Function at 0x10024bb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
lea edx, [esp + 0x10]
push eax
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10024be8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
add esp, 8
ret 8

Function at 0x10024bf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2808
call fcn.1002ece0
push ebp
push esi
mov edx, ecx
push edi
mov ecx, 0x9ff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [edx]
lea ecx, [esp + 0x14]
stosb byte es:[edi], al
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x2800
push eax
lea eax, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x2828]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
test ebp, ebp
jne 0x10024c80
mov esi, dword [esp + 0x281c]
mov ecx, dword [esp + 0xc]
mov eax, dword [esi]
test eax, eax
jbe 0x10024c59
cmp eax, ecx
jbe 0x10024c5b
mov dword [esi], ecx
mov eax, dword [esi]
test eax, eax
jbe 0x10024c80
mov edi, dword [esp + 0x2818]
dec eax
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.MSVCRT.dll_strncpy]
mov ecx, dword [esi]
add esp, 0xc
mov byte [ecx + edi - 1], 0
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x2808
ret 0xc

Function at 0x10024cb0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [ecx]
lea edx, [esp + 8]
push 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10024ce0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [edx]
push esi
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8
Function at 0x100285a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret
Function at 0x10028bd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
call dword [eax + 0x1c]
test eax, eax
jne 0x10028ca7
cmp dword [esi + 0x10], 0xffffffff
je 0x10028ca7
mov ecx, dword [esi + 8]
push ebx
mov dword [esi + 0x54], edi
call fcn.1002c8e0
mov ecx, dword [esi + 8]
mov ebx, eax
call fcn.1002c530
mov ecx, dword [esi + 8]
add ebx, eax
mov dword [esp + 0x18], ebx
call fcn.1002c530
mov ecx, dword [esi + 8]
mov ebx, eax
call fcn.1002c430
sub eax, ebx
lea ecx, [esi + 0x14]
mov dword [esp + 0x14], eax
push edi
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x14]
push edx
mov edx, dword [esi + 0x10]
push eax
lea ecx, [esp + 0x24]
push 1
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSARecv]
xor ecx, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, edi
mov dword [esi + 0x50], eax
je 0x10028c76
mov edx, dword [esp + 0xc]
mov ecx, dword [esi + 8]
push edx
call fcn.1002c5b0
mov eax, dword [esi + 0x24]
push eax
call ebx
cmp dword [esi + 0x50], edi
jne 0x10028c9c
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x3e5
je 0x10028c9c
mov dword [esi + 0xc], 1
call edi
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x54], eax
push ecx
call ebx
mov eax, dword [esp + 0xc]
pop ebx
pop edi
pop esi
add esp, 0x10
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
Function at 0x10028e00
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [esp + 8], 0
mov eax, dword [esi]
call dword [eax + 0x1c]
test eax, eax
jne 0x10028f15
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x10028f15
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
lea edi, [esi + 0x14]
mov dword [esp + 0x10], edx
push 0
lea ecx, [esp + 0x10]
push edi
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x20]
push 1
push ecx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
je 0x10028e79
mov edx, dword [esi + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x10028ea4
mov edx, dword [esi + 0x24]
mov dword [esp + 8], 0xfffffffe
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10028edc
cmp eax, 0x102
jne 0x10028eff
mov edx, dword [esi + 0x24]
mov dword [esp + 8], 0xfffffffc
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret 0xc
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ecx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x10028eff
mov dword [esp + 8], 0xfffffffd
mov edx, dword [esi + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret 0xc
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x10
ret 0xc
Function at 0x10028f20
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], 0
test eax, eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x10029033
test ecx, ecx
jbe 0x10029033
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x10029033
test eax, eax
je 0x10029033
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x10028f7f
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 0x10
ret 0xc
lea edi, [esi + 0x28]
push 0
push edi
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x20]
push 1
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x10029004
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x10028fbd
mov dword [esi + 0xc], 1
mov dword [esp + 8], 0xfffffffe
jmp 0x10029004
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x38]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10028fe1
cmp eax, 0x102
jne 0x10029004
mov dword [esp + 8], 0xfffffffc
jmp 0x10029004
mov edx, dword [esi + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x10029004
mov dword [esp + 8], 0xfffffffd
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 8]
test ecx, ecx
jle 0x10029029
mov edi, dword [esi + 0x48]
mov eax, ecx
cdq
add edi, eax
mov dword [esi + 0x48], edi
mov eax, dword [esi + 0x4c]
adc eax, edx
mov dword [esi + 0x4c], eax
pop edi
mov eax, ecx
pop esi
add esp, 0x10
ret 0xc
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x10
ret 0xc

Function at 0x10029a40
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi], 0x1002f684
call fcn.10029bd0
lea ecx, [esi + 0x94]
call fcn.1002da60
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov dword [esi], 0x1002f458
cmp eax, ebx
mov byte [esi + 0xc], bl
je 0x10029ad4
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10029ad4
mov ecx, dword [esi + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov byte [esi + 0xc], bl
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0x103
jne 0x10029ad4
mov edx, dword [esi + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 8]
push eax
call edi
mov al, byte [esi + 0xd]
mov dword [esi + 4], ebx
cmp al, bl
je 0x10029ad4
cmp esi, ebx
je 0x10029ad4
mov ecx, esi
call fcn.1000c5f0
push esi
call fcn.1002eb22
add esp, 4
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x90]
cmp eax, ebx
je 0x10029ae7
push eax
call edi
mov dword [esi + 0x90], ebx
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10029b00
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
push edi
push 0x1003704c
lea edi, [esi + 0x94]
push eax
mov ecx, edi
call fcn.1002d170
lea ebx, [esi + 0xe]
mov ecx, edi
push ebx
mov dword [esi + 0x520], eax
call fcn.1002d040
mov al, byte [esi + 0xc]
test al, al
jne 0x10029b9d
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push ecx
push 0
push esi
push 0x10001360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [esp + 0x14]
mov dword [esi + 8], eax
test eax, eax
mov dword [esi + 4], edx
jne 0x10029bae
push eax
call fcn.10013550
add esp, 4
lea ecx, [esp + 0xc]
push eax
push ebx
push str._comm__create_thread__s__failed:__s
push 0x100330e0
call fcn.100132b0
push eax
call fcn.100132c0
mov ecx, dword [esi + 0x520]
add esp, 0x10
xor eax, eax
test ecx, ecx
pop edi
pop esi
setg al
pop ebx
pop ecx
ret 4
mov eax, dword [esi + 0x90]
test eax, eax
je 0x10029bae
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x520]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setg al
pop ebx
pop ecx
ret 4

Function at 0x1002a0d0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc0
lea eax, [esp + 0x9c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0xb4], 1
je 0x1002a16a
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
mov dword [esp + 8], 0x9c
push ecx
call esi
test eax, eax
pop edi
jne 0x1002a133
lea edx, [esp + 4]
mov dword [esp + 4], 0x94
push edx
call esi
mov eax, 1
pop esi
add esp, 0xc0
ret
mov eax, dword [esp + 0x14]
mov ecx, 2
cmp eax, ecx
jne 0x1002a16a
mov eax, dword [esp + 8]
cmp eax, 5
jb 0x1002a16a
jne 0x1002a16a
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x1002a16a
cmp word [esp + 0x98], cx
jae 0x1002a16a
mov eax, 1
pop esi
add esp, 0xc0
ret
xor eax, eax
pop esi
add esp, 0xc0
ret

Function at 0x1002d110
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1002d16a
xor ecx, ecx
lea edx, [esp + 4]
mov dword [esp + 0xa], ecx
push edx
mov dword [esp + 0x12], ecx
mov word [esp + 0xc], 0
mov dword [esp + 0x16], ecx
mov dword [esp + 8], 0x10
mov word [esp + 0x1a], cx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1002d16a
mov edx, dword [esp + 0xa]
push edx
call dword [sym.imp.WS2_32.dll_htons]
and eax, 0xffff
mov dword [esi + 0x88], eax
pop esi
add esp, 0x14
ret
Function at 0x1002d314
Capabilities:
Connect socket

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi], 0xffffffff
jne 0x1002d32c
call fcn.1002d070
cmp eax, 0xffffffff
je 0x1002d3d2
push 0
mov ecx, esi
call fcn.1002d0e0
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.1001f900
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x12], edx
add esp, 8
mov dword [esp + 0xe], edx
mov word [esp + 8], 0
mov dword [esp + 0x12], edx
test eax, eax
mov word [esp + 0x16], dx
jne 0x1002d36e
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 8]
push ecx
push eax
push edx
call fcn.1002cf90
mov ecx, dword [esi]
add esp, 0xc
lea eax, [esp + 8]
push 0x10
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x1002d3a0
mov ecx, esi
call fcn.1002d110
mov bl, 1
jmp 0x1002d3a6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x1002d3d2
mov al, byte [ecx - 1]
test al, al
je 0x1002d3c8
cmp al, 0xff
je 0x1002d3c8
dec al
pop esi
mov byte [ecx - 1], al
mov al, bl
pop ebx
add esp, 0x20
ret 8
dec ecx
push ecx
call fcn.1002eb22
add esp, 4
mov al, bl
pop esi
pop ebx
add esp, 0x20
ret 8

Function at 0x1002d3e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, ecx
cmp dword [ebp], 0xffffffff
jne 0x1002d404
mov eax, dword [ebp + 0x88]
add ebp, 5
push eax
push ebp
push str._comm__Socket__s:_d_::send_error:_Invalid_Socket.
push 0x10037e00
lea ecx, [esp + 0x18]
jmp 0x1002d425
mov eax, dword [esp + 8]
test eax, eax
jne 0x1002d43a
mov ecx, dword [ebp + 0x88]
add ebp, 5
push ecx
push ebp
push str._comm__Socket__s:_d_::send_error:_NULL_buffer.
push 0x10037e3c
lea ecx, [esp + 0x18]
call fcn.100132b0
push eax
call fcn.100132c0
add esp, 0x10
or eax, 0xffffffff
pop ebp
ret 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
xor esi, esi
test edi, edi
jbe 0x1002d4af
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp]
push 0
push edi
lea eax, [ebx + edx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002d476
test esi, esi
je 0x1002d471
sub edi, esi
add ebx, esi
test edi, edi
ja 0x1002d449
cmp esi, 0xffffffff
jne 0x1002d4ad
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.10013550
mov edx, dword [ebp + 0x88]
add esp, 4
add ebp, 5
lea ecx, [esp + 0x14]
push eax
push edx
push ebp
push str._comm__Socket__s:_d_::send_error:__s.
push 0x10037e74
call fcn.100132b0
push eax
call fcn.100132c0
add esp, 0x14
test edi, edi
mov eax, ebx
je 0x1002d4b5
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1002d770
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x1002d795
mov eax, dword [edi + 0x88]
add edi, 5
push eax
push edi
push str._comm__Socket__s:_d_::recv_error:_Invalid_Socket.
push 0x10037f4c
lea ecx, [esp + 0x1c]
jmp 0x1002d7b6
mov edx, dword [esp + 8]
test edx, edx
jne 0x1002d7cb
mov ecx, dword [edi + 0x88]
add edi, 5
push ecx
push edi
push str._comm__Socket__s:_d_::recv_error:_NULL_buffer.
push 0x10037f88
lea ecx, [esp + 0x1c]
call fcn.100132b0
push eax
call fcn.100132c0
add esp, 0x10
or eax, 0xffffffff
pop edi
ret 0xc
mov cl, byte [edi + 4]
push ebx
test cl, cl
push esi
je 0x1002d7f0
mov ebx, dword [esp + 0x14]
test ebx, ebx
mov ecx, ebx
jg 0x1002d7e3
mov ecx, 1
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x1002d81c
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 0x10
test ebx, ebx
mov ecx, ebx
jg 0x1002d807
mov ecx, 1
lea esi, [esp + 0x10]
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1002d862
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.10013550
mov edx, dword [edi + 0x88]
add esp, 4
add edi, 5
lea ecx, [esp + 0x14]
push eax
push edx
push edi
push str._comm__Socket__s:_d_::recv_error:__s.
push 0x10037fc0
call fcn.100132b0
push eax
call fcn.100132c0
add esp, 0x14
mov eax, esi
pop esi
pop ebx
pop edi
ret 0xc
test esi, esi
jne 0x1002d891
test ebx, ebx
jle 0x1002d891
mov eax, dword [edi + 0x88]
add edi, 5
push eax
push edi
push str._comm__Socket__s:_d_::recv_info:_The_connection_has_been_gracefully_closed.
push 0x10037ff0
lea ecx, [esp + 0x24]
call fcn.100132b0
push eax
call fcn.100132c0
add esp, 0x10
mov eax, esi
pop esi
pop ebx
pop edi
ret 0xc
Function at 0x1002d8a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx], 0xffffffff
jne 0x1002d8c4
mov eax, dword [ebx + 0x88]
add ebx, 5
push eax
push ebx
push str._comm__Socket__s:_d_::recv_all_error:_Invalid_Socket.
push 0x10038044
lea ecx, [esp + 0x1c]
jmp 0x1002d8e5
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x1002d8fb
mov ecx, dword [ebx + 0x88]
add ebx, 5
push ecx
push ebx
push str._comm__Socket__s:_d_::recv_all_error:_NULL_buffer.
push 0x10038084
lea ecx, [esp + 0x1c]
call fcn.100132b0
push eax
call fcn.100132c0
add esp, 0x10
or eax, 0xffffffff
pop ebx
pop ecx
ret 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
xor edi, edi
xor esi, esi
test ebp, ebp
mov dword [esp + 0x10], 0x10
jle 0x1002d9a2
jmp 0x1002d91c
mov eax, dword [esp + 0x18]
mov cl, byte [ebx + 4]
test cl, cl
je 0x1002d938
mov ecx, dword [ebx]
mov edx, ebp
sub edx, esi
push 0
add eax, esi
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x1002d955
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
mov edx, ebp
push ecx
mov ecx, dword [ebx]
sub edx, esi
push 0
add eax, esi
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test edi, edi
je 0x1002d966
cmp edi, 0xffffffff
je 0x1002d96b
add esi, edi
cmp esi, ebp
jl 0x1002d918
cmp edi, 0xffffffff
jne 0x1002d9a2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.10013550
mov edx, dword [ebx + 0x88]
add esp, 4
add ebx, 5
lea ecx, [esp + 0x18]
push eax
push edx
push ebx
push str._comm__Socket__s:_d_::recv_all_error:__s.
push 0x100380c0
call fcn.100132b0
push eax
call fcn.100132c0
add esp, 0x14
cmp esi, ebp
mov eax, esi
je 0x1002d9aa
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x401040
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
cmp ebx, eax
jbe 0x40113e
mov ecx, dword [ebp + 8]
push edi
mov edx, 1
sub edx, ecx
mov edi, 2
sub edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edi
jmp 0x401077
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov edi, dword [ebp - 4]
add edi, ecx
movzx ecx, byte [edi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
mov cl, byte [edi]
and cl, 3
add edx, edi
shl cl, 4
cmp edx, ebx
jae 0x401112
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov bl, byte [edx + ebx + 1]
shr bl, 4
add bl, cl
movzx ecx, bl
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp - 0xc]
mov byte [eax + esi + 1], cl
mov ecx, dword [ebp + 8]
mov cl, byte [edx + ecx + 1]
and cl, 0xf
add cl, cl
add ebx, edi
add cl, cl
cmp ebx, dword [ebp + 0xc]
jae 0x4010fe
mov edi, dword [ebp + 8]
mov dl, byte [edx + edi + 2]
mov bl, dl
shr dl, 6
and bl, 0x3f
add dl, cl
movzx edx, dl
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx edx, bl
mov byte [eax + esi + 2], cl
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 3], cl
jmp 0x401126
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 2], cl
mov byte [eax + esi + 3], 0x3d
jmp 0x401129
movzx edx, cl
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
add edx, 3
add eax, 4
mov dword [ebp - 4], edx
cmp edx, ebx
jb 0x401071
pop edi
pop ebx
mov esp, ebp
pop ebp
ret