joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404052
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00402f7f
xor ebx, ebx
cmp dword [0x40ea1c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x404127
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x404092
xor eax, eax
jmp 0x4041eb
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40408b
push eax
call fcn.00402f1c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40ea1c], eax
call esi
push eax
call fcn.00402f1c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40ea20], eax
call esi
push eax
call fcn.00402f1c
mov dword [0x40ea24], eax
lea eax, [ebp - 8]
push eax
call fcn.00402345
test eax, eax
pop ecx
pop ecx
je 0x4040f5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040393b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x404127
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00402f1c
cmp eax, ebx
pop ecx
mov dword [0x40ea2c], eax
je 0x404127
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402f1c
pop ecx
mov dword [0x40ea28], eax
mov eax, dword [0x40ea28]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4041a0
cmp dword [0x40ea2c], esi
je 0x4041a0
push eax
call fcn.00402f88
pop ecx
call eax
cmp eax, ebx
je 0x40416d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x40ea2c]
call fcn.00402f88
pop ecx
call eax
test eax, eax
je 0x40416d
test byte [ebp - 0x18], 1
jne 0x4041a0
lea eax, [ebp - 0xc]
push eax
call fcn.0040237c
test eax, eax
pop ecx
je 0x404188
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040393b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x404197
or dword [ebp + 0x10], 0x200000
jmp 0x4041d1
or dword [ebp + 0x10], 0x40000
jmp 0x4041d1
mov eax, dword [0x40ea20]
cmp eax, esi
je 0x4041d1
push eax
call fcn.00402f88
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4041d1
mov eax, dword [0x40ea24]
cmp eax, esi
je 0x4041d1
push dword [ebp - 4]
push eax
call fcn.00402f88
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x40ea1c]
call fcn.00402f88
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405ebb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e098]
jne 0x405ec5
repz ret
jmp fcn.004074f5

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10012050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
push 5
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.10009770
mov esi, dword [ebx]
mov edi, 1
mov dword [esi + 8], 0
lea eax, [esi + 0x28]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebx + 4], eax
nop
movd xmm0, edi
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100416d8]
divsd xmm0, qword [0x10041720]
movsd qword [esp + 0x10], xmm0
call fcn.10034c50
xorps xmm0, xmmword [0x100418c0]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x10]
movss dword [esi], xmm1
call fcn.10033720
cvtsd2ss xmm0, xmm0
add edi, 2
lea esi, [esi + 8]
movss dword [esi - 4], xmm0
cmp edi, 0xb
jl 0x100120c0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027965
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003c2b0
push 0x1003c2a8
push str.FlsAlloc
push 0x1e
call fcn.1002782f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10027999
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003817c]
call esi
jmp 0x1002799f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100279e3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003c2c0
push 0x1003c2b8
push str.FlsGetValue
push 0x20
call fcn.1002782f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10027a1a
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003817c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10029260
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100292fd
push ebx
push esi
call fcn.10029229
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10029172
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100292aa
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100292fc
push edi
push eax
call fcn.1002546e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100292ca
call fcn.10025434
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100292fb
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10029172
add esp, 0x20
test eax, eax
jne 0x100292e9
push edi
call fcn.10025434
jmp 0x100292f1
push ebx
call fcn.10025434
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10033110
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003313d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003313d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000a5c0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10093160
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100b2040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx + 4]
mov dword [ecx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
lea ebx, [ecx + 0x24]
mov dword [ebp - 0x14], eax
lea edi, [ecx + 0x28]
mov dword [eax], 0
push 8
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
call fcn.1006cbbf
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1006bf1b
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edx, [eax + 8]
lea ecx, [eax + 0x14]
mov dword [eax + 0x34], esi
lea esi, [eax + 4]
mov dword [eax + 0xc], esi
mov esi, eax
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x10], edx
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov esi, dword [ebp - 0x14]
mov dword [edx], 0
mov dword [eax], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov esi, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
not ecx
and ecx, 1
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
shl ecx, 2
mov edx, ecx
mov dword [esi + 0x38], 0
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
test bl, 4
cmove eax, ecx
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000fab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009387c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100b2040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1000fb64
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0xc]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.1000bab0
mov byte [ebp - 4], 6
xor esi, esi
mov ecx, dword [edi + 0x1c]
mov edx, dword [edi + 0x10]
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], edx
test ecx, ecx
jns 0x1000fbaf
mov eax, ecx
neg eax
cmp esi, eax
jae 0x1000fbaf
add ecx, esi
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x1000fbb9
add ecx, esi
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
and ecx, 0x1f
lea eax, [ebp - 0xd]
push ecx
push edx
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x10]
call fcn.10012250
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1000fbe7
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30

Function at 0x1001a9a0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x100b2040]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edx
mov edx, ecx
mov dword [esp + 0x34], 0
lea ecx, [esp + 0xc]
movlpd qword [esp + 0xc], xmm0
mov dword [esp + 0x14], 0x6a09e667
mov dword [esp + 0x18], 0xbb67ae85
mov dword [esp + 0x1c], 0x3c6ef372
mov dword [esp + 0x20], 0xa54ff53a
mov dword [esp + 0x24], 0x510e527f
mov dword [esp + 0x28], 0x9b05688c
mov dword [esp + 0x2c], 0x1f83d9ab
mov dword [esp + 0x30], 0x5be0cd19
call fcn.1001ac50
lea edx, [esp + 0x80]
lea ecx, [esp + 0xc]
call fcn.1001ad00
mov eax, dword [ebp + 0xc]
mov ecx, 0x20
cmp eax, ecx
cmova eax, ecx
push eax
lea eax, [esp + 0x84]
push eax
push esi
call fcn.1006e7e0
mov ecx, dword [esp + 0xac]
add esp, 0x10
pop esi
xor ecx, esp
call fcn.1006cacc
mov esp, ebp
pop ebp
ret
Function at 0x1001ad00
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
mov ecx, dword [esi + 0x28]
cmp ecx, 0x40
jae 0x1001ae94
lea eax, [ecx*8]
add dword [esi], eax
push ebx
adc dword [esi + 4], 0
mov byte [ecx + esi + 0x2c], 0x80
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp eax, 0x38
jbe 0x1001ad5e
cmp eax, 0x40
jae 0x1001ad47
mov byte [eax + esi + 0x2c], 0
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp eax, 0x40
jb 0x1001ad36
lea ebx, [esi + 0x2c]
mov ecx, esi
mov edx, ebx
call fcn.1001aa60
mov dword [esi + 0x28], 0
xor eax, eax
jmp 0x1001ad63
lea ebx, [esi + 0x2c]
jae 0x1001ad74
mov byte [eax + esi + 0x2c], 0
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp eax, 0x38
jb 0x1001ad63
movzx eax, byte [esi + 7]
mov edx, ebx
mov byte [esi + 0x64], al
mov ecx, esi
movzx eax, byte [esi + 6]
mov byte [esi + 0x65], al
movzx eax, byte [esi + 5]
mov byte [esi + 0x66], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x68], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x69], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x6a], al
movzx eax, byte [esi]
mov byte [esi + 0x6b], al
call fcn.1001aa60
movzx eax, byte [esi + 0xb]
mov byte [edi], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 1], al
movzx eax, byte [esi + 9]
mov byte [edi + 2], al
movzx eax, byte [esi + 8]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 4], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 5], al
movzx eax, byte [esi + 0xd]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 8], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 9], al
movzx eax, byte [esi + 0x11]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x17]
mov byte [edi + 0xc], al
movzx eax, byte [esi + 0x16]
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x15]
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xf], al
movzx eax, byte [esi + 0x1b]
mov byte [edi + 0x10], al
movzx eax, byte [esi + 0x1a]
mov byte [edi + 0x11], al
movzx eax, byte [esi + 0x19]
mov byte [edi + 0x12], al
movzx eax, byte [esi + 0x18]
mov byte [edi + 0x13], al
movzx eax, byte [esi + 0x1f]
mov byte [edi + 0x14], al
movzx eax, byte [esi + 0x1e]
mov byte [edi + 0x15], al
movzx eax, byte [esi + 0x1d]
mov byte [edi + 0x16], al
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x17], al
movzx eax, byte [esi + 0x23]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 0x22]
mov byte [edi + 0x19], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x1a], al
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x1b], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x1c], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x1d], al
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x1e], al
movzx eax, byte [esi + 0x24]
mov byte [edi + 0x1f], al
pop ebx
pop edi
pop esi
ret
Function at 0x10024f30
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10024fbc
push esi
call fcn.100398a0
add esp, 4
test al, al
jne 0x10024fbc
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10024f53
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.10042d70
add esp, 0xc
test eax, eax
je 0x10024f87
sub eax, esi
push eax
push 0x2e
push esi
call fcn.10042d70
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10024f89
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x10024fb5
mov al, byte [esi]
push eax
call fcn.10035580
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x10024f97
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1002f7b0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x6de], 0
je 0x1002f84d
cmp dword [esi + 0x1a8], 0
je 0x1002f807
push esi
call fcn.1001fc30
push 1
push esi
mov byte [esp + 0x14], al
call fcn.1001ff00
push dword [esi + 0x14c]
mov eax, dword [esi + 0x1a8]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call eax
push dword [esp + 0x28]
push esi
call fcn.1001ff00
add esp, 0x28
pop esi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x1002f81c
sub eax, 1
je 0x1002f81c
sub eax, 1
jne 0x1002f84d
push dword [esi + 0x148]
lea eax, [ecx*2 + 0x100985f0]
push 1
add eax, ecx
push 2
push eax
call fcn.1007903f
push dword [esi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.1007903f
add esp, 0x20
pop esi
ret

Function at 0x1002fdf0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x100b2040]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 4], eax
xor eax, eax
mov ecx, dword [ebx + 0xc]
push ebp
push esi
mov esi, 0x158
mov edx, dword [ecx + 0x134]
cmp dword [esp + 0x120], edx
push edi
sete al
lea eax, [eax*4 + 0x130]
mov ebp, dword [eax + ecx]
mov eax, 0x168
cmove esi, eax
mov eax, dword [ecx + 0x280]
add esi, ecx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x1002fef3
xor eax, eax
cmp dword [esp + 0x124], edx
sete al
lea eax, [eax*4 + 0x148]
cmp dword [eax + ecx], 0x1002fab0
jne 0x1002fef3
cmp dword [esi], 0
je 0x1002fe8e
test edi, edi
je 0x1002fef3
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.10041500
add esp, 0x14
cmp eax, 0xffffffff
je 0x1002fef3
test al, 1
je 0x1002fef3
mov ecx, dword [esi]
test ecx, ecx
jne 0x1002fedc
mov eax, dword [ebx + 0x4bc]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x1002ff27
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1002fef3
add dword [esi + 8], eax
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
jne 0x1002ff62
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x1002ff38
xor edi, edi
lea eax, [edi + 0x51]
jmp 0x1002ff62
mov ecx, dword [esp + 0x10]
mov eax, 0x1b
mov dword [ecx], 0xffffffff
jmp 0x1002ff68
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.1001b880
push eax
push str.Send_failure:__s
push ebx
call fcn.1002f850
add esp, 0x18
mov dword [ebx + 0x930], esi
mov eax, 0x37
mov ecx, dword [esp + 0x10]
mov dword [ecx], edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1006cacc
add esp, 0x10c
ret
Function at 0x100303f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x184], 0
je 0x1003040d
push eax
call fcn.10029520
add esp, 4
test eax, eax
je 0x1003042e
mov al, 1
ret
mov eax, dword [eax + 0x130]
cmp eax, 0xffffffff
je 0x1003042e
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
ret
xor al, al
ret

Function at 0x10030680
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x100b2040]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call fcn.1006e410
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10030707
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.1001b880
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x10030747
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.10030270
add esp, 0x10
test al, al
jne 0x10030750
call fcn.100782b6
mov esi, dword [eax]
call fcn.100782b6
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.1001b880
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.1002f850
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1006cacc
add esp, 0x188
ret

Function at 0x10030f50
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x100b3484]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x10030fa1
push 3
push 2
push eax
push eax
push 6
call fcn.1005d9f0
add esp, 0x14
test al, al
je 0x10030f95
mov dword [0x100b3484], 2
add esp, 0xc
ret
mov dword [0x100b3484], 1
jmp 0x10030fa6
cmp eax, 2
je 0x10030fec
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10030fd1
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x10030fec
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x100324b0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x10098a6c
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100324ca
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x10098a88
push esi
call fcn.1007be60
add esp, 8
test eax, eax
je 0x10032512
test ebp, ebp
je 0x10032503
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x10032538
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10032538
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x100325ef
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10032555
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100325e5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100325e5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10032587
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100325a0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100325b0
test ebp, ebp
je 0x100325dc
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x100b2004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x100b2004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x10039a00
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10039a3e
mov eax, dword [esi + 0x70]
cmp byte [eax + 0xe0], 0
jne 0x10039a2f
push 0
call fcn.10039a00
add esp, 4
test al, al
mov eax, dword [esi + 0x70]
setne cl
inc cl
mov byte [eax + 0xe0], cl
mov eax, dword [esi + 0x70]
pop esi
cmp byte [eax + 0xe0], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x10039a53
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret