joyce8/EMBER2024-capa huggingface dataset:
Function at 0x327a090
Capabilities:
Connect socket

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x1c]
cmp dword [esi], ebp
jge 0x327a0d0
movzx eax, word [edi]
push ebp
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
test eax, eax
js 0x327a16c
push eax
mov ebp, 1
call fcn.03278b10
add esp, 4
test eax, eax
js 0x327a15e
push dword [esp + 0x20]
push edi
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x327a17d
mov ebx, dword [esi]
mov dword [esp + 0x18], 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x327a12a
test ebx, ebx
js 0x327a12a
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push 0x1007
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x327a175
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x327a12c
mov eax, edi
cmp eax, 0x2733
je 0x327a175
cmp eax, 0x2714
je 0x327a175
cmp eax, 0x2734
je 0x327a175
cmp eax, 0x2726
je 0x327a175
cmp eax, 0x274d
jne 0x327a15a
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
pop ecx
ret
test ebp, ebp
je 0x327a16c
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x327ae10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x3415a34]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
lea eax, [esp + 4]
push esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
test edx, edx
je 0x327aebf
mov ecx, ebx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x327ae48
sub ecx, esi
lea eax, [edx + 2]
add eax, ecx
cmp eax, 0x104
jae 0x327aebf
push edi
lea edi, [esp + 0xc]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x327ae63
mov ax, word [0x33bdf9c]
mov esi, ebx
mov word [edi], ax
mov al, byte [ebx]
inc ebx
test al, al
jne 0x327ae78
lea edi, [esp + 0xc]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x327ae86
mov ecx, ebx
lea eax, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0338ca36
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.0338ca36
add esp, 0x108
ret

Function at 0x327af70
Capabilities:
Set socket configuration

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
push edi
push 0
push 1
push 2
call fcn.0327a200
add esp, 0x10
test eax, eax
jne 0x327aff1
push esi
mov esi, dword [edi]
lea eax, [esp + 8]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x327afdc
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.0328a550
add esp, 0xc
push dword [edi]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi + 4]
call esi
pop esi
mov dword [edi + 4], 0xffffffff
or eax, 0xffffffff
mov dword [edi], 0xffffffff
pop edi
pop ecx
ret
push dword [edi + 4]
call fcn.0327b110
add esp, 4
test eax, eax
js 0x327afb9
pop esi
xor eax, eax
pop edi
pop ecx
ret
mov dword [edi + 4], 0xffffffff
or eax, 0xffffffff
mov dword [edi], 0xffffffff
pop edi
pop ecx
ret

Function at 0x327b110
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x327b149
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.0328a550
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x327b810
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x2c
push esi
mov esi, dword [sym.imp.WS2_32.dll_getaddrinfo]
lea eax, [esp + 0xc]
push edi
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
xorps xmm0, xmm0
mov dword [esp + 0x14], 0
push 0x33bdcf4
push str.1.2.3.4
mov dword [esp + 0x18], 0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0xc
call esi
mov edi, eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.1.2.3.4
call esi
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], 1
push eax
lea eax, [esp + 0x18]
push eax
push 0x33bdcf4
push str.1.2.3.4
call esi
test eax, eax
jne 0x327b8b9
mov eax, dword [0x3417568]
test edi, edi
mov ecx, 1
cmovne eax, ecx
mov dword [0x3417568], eax
mov edx, dword [esp + 0xc]
mov eax, edx
mov ecx, dword [esp + 8]
test eax, eax
je 0x327b8ed
cmp dword [eax + 0xc], 0
jne 0x327b8d6
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x327b8c7
jmp 0x327b8ed
mov eax, ecx
test eax, eax
je 0x327b8ed
nop dword [eax]
cmp dword [eax + 0xc], 0
jne 0x327b8f7
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x327b8e0
mov dword [0x341756c], 1
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.WS2_32.dll_freeaddrinfo]
test eax, eax
je 0x327b910
push eax
call esi
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
test edx, edx
je 0x327b91b
push edx
call esi
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x327b922
push ecx
call esi
pop edi
mov dword [0x3417570], 1
pop esi
add esp, 0x2c
ret
Function at 0x327bb40
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [0x3412b00]
mov ecx, dword [esi + 0x10]
lea eax, [edi - 1]
cmp ecx, eax
je 0x327bd1f
mov ebx, dword [esp + 0x24]
cmp dword [esi + 0xc], ebx
ja 0x327bd1f
mov esi, ecx
push ebp
nop
mov ebp, dword [esi*4 + 0x3412a9c]
inc esi
mov eax, ebp
mov dword [esp + 0x18], ebp
shr eax, 0x1f
movd xmm0, ebp
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x33b1b90]
mulsd xmm0, qword [0x33bdfa0]
call fcn.0338cb80
mov dword [esp + 0x1c], eax
cmp eax, ebx
ja 0x327bbab
cmp esi, edi
jl 0x327bb70
lea edi, [ebp*4]
mov dword [esp + 0x14], esi
push edi
call fcn.0339076d
mov esi, dword [esp + 0x28]
add esp, 4
mov ebx, eax
push edi
test ebx, ebx
je 0x327bc52
push 0
push ebx
call fcn.0338e220
xor ebp, ebp
add esp, 0xc
mov dword [esp + 0x10], ebp
cmp dword [esi + 4], ebp
jbe 0x327bc3a
mov eax, dword [esi]
mov edi, dword [eax + ebp*4]
test edi, edi
je 0x327bc30
mov ebp, dword [esp + 0x18]
mov ecx, dword [edi + 4]
xor edx, edx
shr ecx, 0x10
xor ecx, dword [edi + 4]
imul ecx, ecx, 0x85ebca6b
mov esi, dword [edi]
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
div ebp
mov eax, dword [ebx + edx*4]
mov dword [edi], eax
mov dword [ebx + edx*4], edi
mov edi, esi
test esi, esi
jne 0x327bbf1
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
inc ebp
mov dword [esp + 0x10], ebp
cmp ebp, dword [esi + 4]
jb 0x327bbe4
mov eax, dword [esi]
test eax, eax
je 0x327bc49
push eax
call fcn.03390752
add esp, 4
mov ebp, dword [esp + 0x18]
jmp 0x327bd02
push dword [esi]
call fcn.0339b06c
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x327bc6d
pop ebp
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
mov ecx, dword [esi + 4]
mov eax, ebp
sub eax, ecx
shl eax, 2
push eax
lea eax, [ebx + ecx*4]
push 0
push eax
call fcn.0338e220
xor eax, eax
add esp, 0xc
mov dword [esp + 0x10], eax
cmp dword [esi + 4], eax
jbe 0x327bd02
mov ecx, ebx
mov dword [esp + 0x18], ebx
mov esi, dword [ecx]
mov edi, ecx
test esi, esi
je 0x327bced
nop
mov ecx, dword [esi + 4]
xor edx, edx
shr ecx, 0x10
xor ecx, dword [esi + 4]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
div ebp
mov eax, dword [esp + 0x10]
cmp edx, eax
jne 0x327bcd3
mov edi, esi
jmp 0x327bce3
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [ebx + edx*4]
mov dword [esi], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + edx*4], esi
mov esi, dword [edi]
test esi, esi
jne 0x327bca0
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
inc eax
add ecx, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
cmp eax, dword [esi + 4]
jb 0x327bc97
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], ebp
pop ebp
pop edi
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x10], ecx
pop esi
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x327e250
Capabilities:
Hash data using murmur3

Disassembly:
push ebx
push esi
push edi
call fcn.03299c00
mov edx, dword [0x3412a88]
xor eax, eax
test edx, edx
je 0x327ad8f
mov ecx, dword [0x3412a84]
mov esi, ecx
cmp dword [esi], 0
jne 0x327ad12
inc eax
add esi, 4
cmp eax, edx
jb 0x327ad00
jmp 0x327ad95
test esi, esi
je 0x327ad95
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esi]
mov ecx, dword [edi + 4]
shr ecx, 0x10
xor ecx, dword [edi + 4]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, dword [edi]
mov dword [esi], eax
dec dword [0x3412a8c]
cmp dword [esi], 0
jne 0x327adf6
mov eax, ecx
xor edx, edx
shr eax, 0x10
xor eax, ecx
mov ecx, dword [0x3412a88]
div ecx
inc edx
cmp edx, ecx
jae 0x327ad81
mov eax, dword [0x3412a84]
lea esi, [eax + edx*4]
nop
cmp dword [esi], 0
jne 0x327adf6
inc edx
add esi, 4
cmp edx, ecx
jb 0x327ad70
push dword [edi + 8]
call ebx
push edi
call fcn.03390752
add esp, 4
mov ecx, dword [0x3412a84]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x327ada5
push ecx
call fcn.03390752
add esp, 4
mov eax, dword [0x341757c]
mov dword [0x3412a88], 0
mov dword [0x3412a84], 0
mov dword [0x3412a8c], 0
mov dword [0x3412a90], 0
mov dword [0x3412a94], 0xffffffff
test eax, eax
je 0x327adf5
push 0
push eax
call fcn.0329a5c0
add esp, 8
mov dword [0x341757c], 0
ret
push dword [edi + 8]
call ebx
push edi
call fcn.03390752
add esp, 4
test esi, esi
jne 0x327ad20
jmp 0x327ad8f
call fcn.0329b5f0
jmp 0x327ace0
Function at 0x3283c90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov eax, dword [esi + 0x74]
cmp dword [eax + 0xf0], ebx
je 0x3283ca9
call fcn.0329a5a0
or dword [esi + 0x6c], 2
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x3283dad
cmp byte [edi + 0x121], bl
jne 0x3283dad
mov eax, dword [esi + 0x74]
cmp dword [eax + 0xf0], ebx
je 0x3283cd4
call fcn.0329a5a0
cmp dword [edi + 0x128], 1
jne 0x3283d01
mov eax, dword [esi + 0x74]
cmp dword [eax + 0xf4], ebx
je 0x3283d01
lea eax, [edi + 0x94]
push 0
push eax
call fcn.0327d640
add esp, 8
test eax, eax
js 0x3283d96
push dword [edi + 0x88]
lea eax, [edi + 8]
push eax
push 0
push dword [esi + 8]
push dword [esi]
push dword [edi]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x3283d91
push dword [edi]
call fcn.03278bc0
add esp, 4
cmp eax, 0x2733
je 0x3283d96
cmp eax, 0x2714
je 0x3283d96
push eax
call fcn.03278c20
push eax
push dword [esi + 0x1c]
call fcn.032858d0
add esp, 0xc
mov ebx, 1
push dword [esi + 0x1c]
push esi
push str.Setting_timeout_for_request__p__sent_to_nameserver__p
push 0
call fcn.03285540
mov eax, dword [esi + 0x74]
add eax, 0x24
push eax
lea eax, [esi + 0x28]
push eax
call fcn.0327d640
add esp, 0x18
test eax, eax
jns 0x3283d84
push esi
push str.Error_from_libevent_when_adding_timer_for_request__p
push 2
call fcn.03285540
add esp, 0xc
inc dword [esi + 0x10]
mov eax, ebx
and dword [esi + 0x6c], 0xfffffffd
pop edi
pop esi
pop ebx
ret
cmp eax, dword [esi + 8]
je 0x3283d4d
mov eax, dword [esi + 0x1c]
push 1
mov byte [eax + 0x121], 1
push dword [esi + 0x1c]
call fcn.03287600
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x3286e10
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x6e4
mov eax, dword [0x3415a34]
xor eax, esp
mov dword [esp + 0x6e0], eax
push ebx
push esi
mov esi, dword [esp + 0x6f0]
push edi
mov eax, dword [esi + 0x124]
cmp dword [eax + 0xf0], 0
je 0x3286e42
call fcn.0329a5a0
mov ebx, dword [sym.imp.WS2_32.dll_recvfrom]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x80
push eax
push 0
push 0x5dc
lea eax, [esp + 0x120]
push eax
push dword [esi]
call ebx
mov edi, eax
test edi, edi
js 0x3286eea
je 0x3286f71
push 0
lea eax, [esi + 8]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.03279830
add esp, 0xc
test eax, eax
jne 0x3286f32
mov eax, dword [esi + 0x124]
cmp dword [eax + 0xfc], 0
jne 0x3286ead
mov dword [esi + 0x90], 0
push edi
lea ecx, [esp + 0x114]
push ecx
push eax
call fcn.03286370
add esp, 0xc
mov dword [esp + 0xc], 0x80
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x5dc
lea eax, [esp + 0x120]
push eax
push dword [esi]
call ebx
mov edi, eax
test edi, edi
jns 0x3286e73
push dword [esi]
call fcn.03278bc0
add esp, 4
cmp eax, 0x2733
je 0x3286ff5
cmp eax, 0x2714
je 0x3286ff5
push eax
call fcn.03278c20
push eax
push esi
call fcn.032858d0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6e0]
xor ecx, esp
call fcn.0338ca36
add esp, 0x6e4
ret
push 0x80
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0327aae0
push eax
push str.Address_mismatch_on_received_DNS_packet.__Apparent_source_was__s
push 2
call fcn.03285540
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6e0]
xor ecx, esp
call fcn.0338ca36
add esp, 0x6e4
ret
cmp dword [esi + 0x128], 0
jne 0x3286ff5
push ebp
lea ebp, [esi + 0x94]
push ebp
call fcn.0327d700
mov eax, dword [esi + 0x124]
push 0
push 0x84000002
mov dword [eax + 0xf4], 1
movzx eax, word [esi + 8]
mov edi, dword [esi + 0x124]
push eax
call fcn.0327aee0
mov ebx, eax
add esp, 0x10
test ebx, ebx
js 0x3286ff4
cmp dword [edi + 0xc8], 0
je 0x328700d
lea eax, [esi + 8]
push eax
call fcn.0327aa80
add esp, 4
test eax, eax
jne 0x328700d
push dword [edi + 0xc8]
lea eax, [edi + 0x48]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x328700d
push str.Couldnt_bind_to_outgoing_address
push 2
call fcn.03285540
add esp, 8
pop ebp
mov ecx, dword [esp + 0x6ec]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0338ca36
add esp, 0x6e4
ret
push ebp
call fcn.0327c240
mov eax, dword [esi]
add esp, 4
test eax, eax
js 0x3287025
push eax
call fcn.03278ba0
add esp, 4
push esi
push 0x3283bb0
push 0x12
push ebx
mov dword [esi], ebx
push dword [edi + 0x10]
push ebp
call fcn.0327d390
add esp, 0x18
jmp 0x3286ff4
Function at 0x32873e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
cmp dword [ebx + 0x5c], 0
mov esi, dword [ebx + 0x54]
je 0x32873f6
call fcn.0329a5a0
test esi, esi
je 0x3287552
nop
push dword [esi + 0x90]
lea eax, [esi + 0x10]
push eax
push 0
push dword [esi + 0xb0]
push dword [esi + 0xac]
push dword [ebx]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x328745e
push dword [ebx]
call fcn.03278bc0
add esp, 4
cmp eax, 0x2733
je 0x328758c
cmp eax, 0x2714
je 0x328758c
push eax
push eax
call fcn.03278c20
add esp, 4
push eax
push str.Error__s___d__while_writing_response_to_port__dropping
push 2
call fcn.03285540
add esp, 0x10
xor edi, edi
mov ebp, 1
mov dword [esp + 0x14], edi
cmp dword [esi + 0xbc], edi
je 0x32874ac
cmp dword [esi + 0xb8], edi
jle 0x328749a
nop dword [eax]
mov eax, dword [esi + 0xbc]
push dword [eax + edi*4]
call fcn.03390752
inc edi
add esp, 4
cmp edi, dword [esi + 0xb8]
jl 0x3287480
push dword [esi + 0xbc]
call fcn.03390752
mov edi, dword [esp + 0x18]
add esp, 4
mov eax, dword [esi + 0xc]
test eax, eax
je 0x32874ee
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x32874c5
push eax
push 0
call fcn.0329a5d0
add esp, 8
mov ecx, dword [esi + 0xc]
mov edi, ebp
cmp dword [ecx + 0x54], esi
jne 0x32874e5
mov eax, dword [esi]
test eax, eax
je 0x32874de
cmp eax, esi
je 0x32874de
mov dword [ecx + 0x54], eax
jmp 0x32874e5
mov dword [ecx + 0x54], 0
mov eax, dword [esi + 0xc]
dec dword [eax + 4]
mov ebp, dword [eax + 4]
mov eax, dword [esi + 0xac]
test eax, eax
je 0x3287501
push eax
call fcn.03390752
add esp, 4
push esi
call fcn.03284920
mov ecx, dword [esi]
add esp, 4
test ecx, ecx
je 0x3287521
cmp ecx, esi
je 0x3287521
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
test ebp, ebp
je 0x3287591
test edi, edi
je 0x328753e
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x328753e
push eax
push 0
call fcn.0329a5e0
add esp, 8
push esi
call fcn.03390752
mov esi, dword [ebx + 0x54]
add esp, 4
test esi, esi
jne 0x3287400
lea esi, [ebx + 0x14]
push esi
call fcn.0327d700
push ebx
push 0x32849e0
push 0x12
push dword [ebx]
push dword [ebx + 0x58]
push esi
call fcn.0327d390
push 0
push esi
call fcn.0327d640
add esp, 0x24
test eax, eax
jns 0x328758c
push str.Error_from_libevent_when_adding_event_for_DNS_server.
push 2
call fcn.03285540
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x32875a6
push eax
push 0
call fcn.0329a5e0
add esp, 8
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx]
test eax, eax
jle 0x32875be
push eax
call fcn.03278ba0
add esp, 4
mov dword [ebx], 0xffffffff
lea edi, [ebx + 0x14]
push edi
call fcn.0327d700
push edi
call fcn.0327c240
mov eax, dword [ebx + 0x5c]
add esp, 8
test eax, eax
je 0x32875e2
push 1
push eax
call fcn.0329a5c0
add esp, 8
push ebx
call fcn.03390752
push esi
call fcn.03390752
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x32892a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
cmp dword [edi + 0xf0], ebx
je 0x32892c9
call fcn.0329a5a0
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x30]
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x3289342
push dword [esp + 0xc]
call fcn.0339076d
mov esi, eax
add esp, 4
test esi, esi
je 0x3289342
lea eax, [esp + 0xc]
push eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x30]
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x3289330
cmp dword [esp + 0xc], 1
jbe 0x3289330
push esi
push edi
call fcn.03288f20
add esp, 8
mov ebx, eax
push esi
call fcn.03390752
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret

Function at 0x328ebd0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x3415a34]
xor eax, esp
mov dword [esp + 0x84], eax
push ebp
mov ebp, dword [esp + 0x90]
push esi
or esi, 0xffffffff
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x328ec05
push eax
push 0
call fcn.0329a5d0
mov eax, dword [ebp + 0x18]
add esp, 8
test byte [ebp + 0x1c], 2
jne 0x328ecb1
push edi
mov edi, dword [esp + 0xa0]
test edi, edi
js 0x328ec20
cmp edi, dword [ebp + 0xc]
jbe 0x328ec23
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x328ecb0
mov esi, dword [ebp]
push ebx
xor ebx, ebx
test eax, eax
je 0x328ec3a
call fcn.0329a5a0
test esi, esi
je 0x328ecad
lea ecx, [esp + 0x14]
cmp ebx, 0x10
jge 0x328ec6e
test edi, edi
je 0x328ec6e
mov eax, dword [esi + 0x18]
inc ebx
add eax, dword [esi + 8]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0xc]
cmp edi, eax
jb 0x328ec6c
mov dword [ecx], eax
add ecx, 8
sub edi, dword [esi + 0xc]
mov esi, dword [esi]
test esi, esi
jne 0x328ec42
jmp 0x328ec6e
mov dword [ecx], edi
test ebx, ebx
je 0x328ecad
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xb8]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x328ec99
or esi, 0xffffffff
jmp 0x328ecaf
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x328ecaf
push esi
push ebp
call fcn.0328e9c0
add esp, 8
jmp 0x328ecaf
xor esi, esi
pop ebx
pop edi
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x328ecc3
push eax
push 0
call fcn.0329a5e0
add esp, 8
mov ecx, dword [esp + 0x8c]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.0338ca36
add esp, 0x88
ret
Function at 0x328ece0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
sub esp, 0x54
mov eax, dword [0x3415a34]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
push edi
mov edi, dword [esp + 0x60]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x328ed06
push eax
push 0
call fcn.0329a5d0
add esp, 8
test byte [edi + 0x1c], 4
je 0x328ed14
or esi, 0xffffffff
jmp 0x328ee75
push ebp
mov ebp, dword [esp + 0x68]
lea eax, [esp + 0xc]
push eax
push 0x4004667f
push ebp
mov dword [esp + 0x18], 0x1000
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x328ed45
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x328ed45
cmp eax, 0x1000
jle 0x328ed4a
mov eax, 0x1000
mov esi, dword [esp + 0x6c]
test esi, esi
js 0x328ed56
cmp esi, eax
jle 0x328ed58
mov esi, eax
push 4
push esi
push edi
call fcn.03290340
add esp, 0xc
cmp eax, 0xffffffff
jne 0x328ed70
or esi, eax
jmp 0x328ee74
push ebx
push 1
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x2c]
push eax
push esi
push edi
call fcn.03290590
mov ebx, eax
add esp, 0x18
xor ecx, ecx
mov dword [esp + 0x1c], ebx
test ebx, ebx
jle 0x328edb5
nop word [eax + eax]
mov eax, dword [esp + ecx*8 + 0x20]
mov dword [esp + ecx*8 + 0x44], eax
mov eax, dword [esp + ecx*8 + 0x24]
mov dword [esp + ecx*8 + 0x40], eax
inc ecx
cmp ecx, ebx
jl 0x328eda0
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x24]
push eax
push ebx
lea eax, [esp + 0x54]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x328edf0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
jne 0x328edf9
xor esi, esi
jmp 0x328ee73
mov esi, dword [esp + 0x18]
cmp esi, 0xffffffff
jne 0x328edfe
or esi, 0xffffffff
jmp 0x328ee73
test esi, esi
je 0x328ee73
mov dword [esp + 0x10], 0
mov ebp, esi
test ebx, ebx
jle 0x328ee64
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx]
test byte [eax + 0x10], 8
lea edx, [eax + 0xc]
je 0x328ee23
xor ecx, ecx
jmp 0x328ee3e
mov ecx, dword [eax + 4]
sub ecx, dword [eax + 8]
mov eax, edx
sub ecx, dword [edx]
mov dword [esp + 0x14], edx
cmp ecx, 0x7fffffff
jbe 0x328ee3e
mov ecx, 0x7fffffff
mov eax, dword [edx]
cmp ecx, ebp
jge 0x328ee5d
add eax, ecx
sub ebp, ecx
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [edx], eax
mov ebx, dword [ebx]
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x1c]
jl 0x328ee14
jmp 0x328ee64
add eax, ebp
mov dword [edx], eax
mov dword [edi + 8], ebx
add dword [edi + 0xc], esi
add dword [edi + 0x10], esi
push edi
call fcn.03290690
add esp, 4
pop ebx
pop ebp
mov eax, dword [edi + 0x18]
test eax, eax
je 0x328ee87
push eax
push 0
call fcn.0329a5e0
add esp, 8
mov ecx, dword [esp + 0x58]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0338ca36
add esp, 0x54
ret