joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cb70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
test eax, eax
jne 0x1000cbc2
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 8]
push eax
push 0xfffffffffffffffb
push 0xffff
push edi
call ebx
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0xffff
push edi
mov esi, eax
call ebx
pop edi
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x1000cbfb
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [ebp - 4]
push edx
push 0xfffffffffffffffb
push 0xffff
push edi
call ebx
push 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push edi
call ebx
pop edi
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x1000cc34
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [ebp - 4]
push ecx
push 0xfffffffffffffffb
push 0xffff
push edi
call ebx
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0xffff
push edi
mov esi, eax
call ebx
pop edi
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000cf80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp edx, ecx
ja 0x1000cfb8
jb 0x1000cfae
cmp eax, ebx
jae 0x1000cfb8
mov eax, ebx
mov edx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x18]
push 0
push eax
push edx
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
jne 0x1000cfde
call fcn.1000a7e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0x10]
test ebx, ebx
jne 0x1000cfef
mov ecx, dword [ebp - 8]
sub ecx, edx
mov dword [esi + 4], ecx
jmp 0x1000cff2
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x10], edx
mov edx, dword [ebp + 0x14]
push 0
mov dword [esi + 0x14], edx
mov edx, dword [esi + 4]
push edx
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push ecx
push eax
mov dword [esi + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi], eax
test eax, eax
jne 0x1000d040
call fcn.1000a7e0
mov edi, eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000d1e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x24]
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
push edx
push eax
mov dword [ebp - 8], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1000d20f
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.1000d0c0
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1000d230
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
test ecx, ecx
je 0x1000d25e
mov eax, dword [ebp + 8]
push eax
call fcn.1000ce60
jmp 0x1000d268
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x1000d2cd
call fcn.1000a7e0
test eax, eax
js 0x1000d2e0
mov eax, dword [edi]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1000d297
call fcn.1000a7e0
test eax, eax
js 0x1000d2e0
mov eax, dword [ebp - 8]
push esi
mov esi, dword [ebp - 4]
test esi, esi
jne 0x1000d2a3
test eax, eax
je 0x1000d2d1
mov edx, dword [ebp + 0x14]
xor ecx, ecx
cmp esi, ecx
ja 0x1000d2d1
jb 0x1000d2b2
cmp eax, edx
ja 0x1000d2d1
mov eax, dword [edi]
mov ecx, dword [ebp + 0x10]
push 4
push 2
push 0
push 0
push 0
push eax
call fcn.1000cf80
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [edi], eax
jmp 0x1000d276
or eax, esi
mov eax, 0x800703ee
je 0x1000d2df
mov eax, 0x800700df
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000d450
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x1002e1f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [esi + 2], eax
mov dword [esi + 6], eax
mov dword [esi + 0xa], eax
mov dword [esi + 0xe], eax
mov dword [esi + 0x12], eax
push edi
mov dword [esi + 0x16], eax
mov dword [ebp - 0xa8], eax
mov word [esi + 0x1a], ax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
movzx eax, word [esi]
push 3
lea edx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xac], 0xc00
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x88], edx
call fcn.1000d380
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xac]
push ecx
push 0
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x84]
cmp eax, ecx
je 0x1000d518
push eax
call fcn.1001401e
add esp, 4
test edi, edi
je 0x1000d535
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001306f
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x8c]
xor edi, edi
mov eax, ebx
test ebx, ebx
je 0x1000d570
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x1000d55a
cmp ecx, 0x17
je 0x1000d55a
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x1000d544
jmp 0x1000d570
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
push edx
push eax
push esi
call fcn.10013af0
add esp, 0xc
mov edi, 1
push ebx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop ebx
test edi, edi
je 0x1000d59c
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001306f
mov esp, ebp
pop ebp
ret
push 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1001306f
mov esp, ebp
pop ebp
ret
Function at 0x1000f440
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], ebx
je 0x1000f4af
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x1000f525
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x1000f4a4
cmp eax, 0xffffffff
jne 0x1000f49c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1000f4a4
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1000f525
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x1000f525
mov dword [esi + 0x50], 1
push 0
mov dword [esi + 0x54], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x90]
mov ecx, esi
call edx
cmp eax, 2
jne 0x1000f4a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000f51e
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x1000f810
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x190]
push edi
test eax, eax
jne 0x1000f8cc
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
lea esp, [esp]
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x1c]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x1000f89f
push 0
call ebx
mov eax, dword [esi + 0x60]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xa0]
mov ecx, esi
call eax
cmp eax, 2
jne 0x1000f8a8
mov edx, dword [esi + 0x24]
push edx
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.1000f010
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000f884
mov eax, 0x4c7
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0xffffffff
je 0x1000f8bf
test edi, edi
je 0x1000f8d5
mov ecx, dword [esi + 0x190]
test ecx, ecx
je 0x1000f830
pop edi
pop esi
mov eax, 1
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1000f884
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], 0
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1000f900
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
push esi
mov esi, ecx
mov ecx, dword [ebx + 0x14]
sub eax, ecx
push edi
je 0x1000f9a6
lea esp, [esp]
mov edx, dword [esi + 0x2c]
cmp eax, edx
jl 0x1000f929
mov eax, edx
push 0
push eax
mov eax, dword [esi + 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x1000f993
lea ebx, [esi + 0x158]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x18c], edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x98]
mov ecx, esi
call eax
cmp eax, 2
jne 0x1000f989
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.1000f010
add esp, 8
push edi
mov ecx, ebx
call fcn.1000ef20
jmp 0x1000f998
cmp edi, 0xffffffff
je 0x1000f9b2
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x18]
sub eax, ecx
jne 0x1000f920
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1000f9d4
mov edx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [edx], 1
mov eax, 1
pop ebx
pop ebp
ret 8
mov ecx, 1
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], ecx
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x100108b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x48]
push eax
push 0
push esi
push 0x100106c0
push 0
push 0
call fcn.100137c9
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x44], eax
pop esi
mov eax, ecx
ret
Function at 0x10010a70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push esi
push edi
mov esi, ecx
test eax, eax
jne 0x10010a9c
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10010ab9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, 1
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 2
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], eax
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
mov edi, 1
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
mov ecx, esi
call edx
cmp eax, 2
je 0x10010b15
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10010b0d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10010b0d
test eax, eax
je 0x10010b0d
push 0x80004005
call fcn.1000a7c0
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10010b24
mov eax, 0x4c7
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 5
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], eax
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x10010ba0
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 0xc], edi
je 0x10010c0e
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x10010cde
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x10010cd9
cmp eax, 0xffffffff
jne 0x10010c04
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10010cd9
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10010cde
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x10010cde
mov dword [esi + 0x4c], 1
push 0
mov dword [esi + 0x50], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
mov ecx, esi
call edx
cmp eax, 2
jne 0x10010c94
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10010c85
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0x1c]
xor edi, edi
push edi
push edi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10010cba
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10010cba
xor edi, edi
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.1000f010
add esp, 8
test edi, edi
je 0x10010cd9
push 0x80004005
call fcn.1000a7c0
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x10010cf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x190]
mov ecx, dword [esi + 0x38]
mov ebx, 1
add dword [esi + 0x190], ebx
cmp eax, ecx
jb 0x10010d21
xor eax, eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
pop esi
pop ebx
ret
mov edx, dword [esi + 0x1c]
push edi
xor edi, edi
push edi
push edi
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10010d48
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10010d48
xor edi, edi
mov eax, dword [esi + 0x24]
push eax
push str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.1000f010
add esp, 8
test edi, edi
je 0x10010d73
mov dword [esi + 0x14], edi
pop edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], 5
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x10010e70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18c]
push edi
test eax, eax
jne 0x10010f5c
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x5c]
mov edx, dword [esi + 0x1c]
push ebx
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, ebx
jle 0x10010f11
mov eax, dword [esi + 0x5c]
push edi
push eax
mov dword [esi + 0x190], ebx
call fcn.1000ccc0
add esp, 8
test eax, eax
jne 0x10010f65
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x5c]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x94]
mov ecx, esi
call eax
cmp eax, 2
jne 0x10010f4e
mov eax, dword [esi + 0x24]
push eax
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.1000f010
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x10010ef6
mov eax, 0x4c7
mov ecx, 1
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 4
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0xffffffff
jne 0x10010f33
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10010f5c
cmp eax, 0x2744
je 0x10010f4e
cmp eax, 0x2746
jne 0x10010ef6
jmp 0x10010f4e
cmp edi, ebx
jne 0x10010f4e
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__recv_0_bytes__detect_package__n
mov dword [esi + 0x190], ebx
call fcn.1000f010
add esp, 8
mov edx, dword [esi + 0x18c]
test edx, edx
je 0x10010e85
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 5
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10011490
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022928
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1002e1f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x70]
mov dword [ebp - 0x14], eax
mov ecx, dword [esi + 0x188]
xor edi, edi
test ecx, ecx
jle 0x10011524
lea ebx, [esi + 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 0x170]
cmp edi, dword [esi + 0x174]
je 0x100114f9
mov eax, dword [edi + 4]
mov dword [esi + 0x170], eax
mov dword [eax + 8], 0
jmp 0x1001150b
test edi, edi
je 0x1001150b
xor eax, eax
mov dword [esi + 0x170], eax
mov dword [esi + 0x174], eax
xor eax, eax
cmp edi, eax
je 0x1001151d
mov dword [edi + 4], eax
mov dword [edi + 8], eax
dec dword [esi + 0x16c]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x10011625
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x14]
mov edx, dword [esi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test ebx, ebx
jle 0x100115a4
lea eax, [esi + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x188], ebx
lea eax, [esi + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi + 0x14]
mov edx, dword [esi]
push ebx
push eax
mov eax, dword [edx + 0x8c]
mov ecx, esi
call eax
cmp eax, 2
jne 0x100115a9
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.1000f010
add esp, 8
jmp 0x100115a9
cmp ebx, 0xffffffff
je 0x100115d2
mov ecx, dword [ebp - 0x14]
push edi
add ecx, 0x1c
mov dword [ebp - 4], 0xffffffff
call fcn.1000c0b0
test eax, eax
jne 0x100114c0
push edi
call fcn.1000eff0
add esp, 4
jmp 0x100114c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1001163c
lea ebx, [esi + 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x170]
xor ecx, ecx
cmp eax, ecx
je 0x10011606
mov dword [eax + 8], edi
mov edx, dword [esi + 0x170]
mov dword [edi + 4], edx
jmp 0x10011612
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
mov dword [esi + 0x174], edi
inc dword [esi + 0x16c]
push ebx
mov dword [esi + 0x170], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 1
mov dword [esi + 0xc], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp - 0x14]
push edi
add ecx, 0x1c
mov dword [esi + 0x10], 3
mov dword [esi + 0x14], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1000c0b0
test eax, eax
jne 0x10011671
push edi
call fcn.1000eff0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100118d0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov esi, ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.1000d5c0
add esp, 0xc
test eax, eax
jne 0x100118f5
pop edi
pop esi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
push ebx
test eax, eax
je 0x10011932
cmp word [eax], 0
je 0x10011932
mov ebx, dword [ebp + 0x18]
push ebx
push 0
push eax
call fcn.1000d1b0
add esp, 0xc
test eax, eax
je 0x10011929
mov dx, word [edi]
cmp dx, word [ebx]
je 0x10011932
push 0x273f
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x14
movzx eax, word [edi]
push 0x11
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x1c], eax
cmp eax, 0xffffffff
je 0x10011929
push 0
push eax
call fcn.1000cc50
add esp, 8
test eax, eax
je 0x10011961
push 0x80004005
call fcn.1000a7c0
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x1c]
push ecx
push edx
call fcn.1000cb70
add esp, 8
test eax, eax
je 0x1001197f
push 0x80004005
call fcn.1000a7c0
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [esi + 0x68]
call fcn.100103f0
mov cx, word [ebp + 0x10]
pop ebx
pop edi
mov word [esi + 0x6c], cx
mov eax, 1
pop esi
pop ebp
ret 0x14

Function at 0x10011eb0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x44]
push eax
push 0
push esi
push 0x10011ae0
push 0
push 0
call fcn.100137c9
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x40], eax
pop esi
mov eax, ecx
ret

Function at 0x1001306f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002e1f0]
jne 0x10013079
repz ret
jmp fcn.10014d0b