joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452c45
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0043b9b0
mov eax, dword [0x4b12c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0044ccee
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x452c87
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x452de3
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00459150
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4b2a58]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00453c43
mov ecx, dword [esi*4 + 0x4b2a58]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x452ddc
cmp eax, dword [ecx + edi + 0x24]
jne 0x452ddc
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x452ddc
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00453c43
add esp, 0x14
test edx, edx
jl 0x452ddc
jg 0x452d52
test eax, eax
jb 0x452ddc
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x452ddc
jl 0x452d6c
cmp dword [ebp - 0x1008], eax
ja 0x452ddc
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x452d8a
test ebx, ebx
je 0x452dc3
cmp ecx, edi
jae 0x452dc3
mov al, byte [ecx]
cmp al, 0xd
jne 0x452da4
lea eax, [edi - 1]
cmp ecx, eax
jae 0x452db0
cmp byte [ecx + 1], 0xa
jne 0x452db0
inc ecx
jmp 0x452db0
movzx eax, al
movsx eax, byte [eax + 0x4b1ab8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x452d8a
cmp edx, ebx
jne 0x452d8a
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x452de1
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043b9a0
leave
ret
Function at 0x4530db
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4b2a58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45311b
cmp byte [ebx], 0xa
jne 0x45311b
or byte [edi + eax + 0x28], 4
jmp 0x453120
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x45321f
mov dl, byte [eax]
cmp dl, 0x1a
je 0x453202
inc eax
cmp dl, 0xd
je 0x45314c
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x453172
cmp eax, ecx
jae 0x453180
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x453134
jmp 0x45321f
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4531fd
cmp dword [ebp - 0x10], 0
je 0x4531fd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4b2a58]
test byte [eax + edi + 0x28], 0x48
je 0x4531d7
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4531c2
mov byte [esi], dl
jmp 0x4531d3
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4b2a58]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x45321f
cmp byte [ebp - 1], 0xa
jne 0x4531e6
cmp esi, ebx
jne 0x4531e6
mov byte [esi], 0xa
jmp 0x45321e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00453c61
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x45321f
mov byte [esi], 0xd
jmp 0x45321e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4b2a58]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x45321c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x45321f
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x453228
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4b2a58]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45326e
cmp word [ebx], dx
jne 0x45326e
or byte [eax + edi + 0x28], 4
jmp 0x453273
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4533d6
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4533b6
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4532b4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4532ea
cmp eax, edx
jae 0x4532f8
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x45328f
jmp 0x4533d6
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4533b1
cmp dword [ebp - 0x18], 0
je 0x4533b1
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4b2a58]
test byte [eax + edi + 0x28], 0x48
je 0x453387
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x45334b
mov word [esi], cx
jmp 0x453382
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4b2a58]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4b2a58]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4b2a58]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4533d6
pop eax
cmp word [ebp - 4], ax
jne 0x453397
cmp esi, ebx
jne 0x453397
mov word [esi], ax
jmp 0x4533d3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00453c61
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4533d6
push 0xd
pop eax
jmp 0x453392
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4b2a58]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4533d0
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4533d6
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x459110
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45913d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45913d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x6d77259d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x6d7725ac
pop dword [ebp - 0x30]
mov eax, 0x6d7725ac
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xa88be80e
add dword [ebp - 0x40], 0xa5c65d3d
mov dword [ebp - 0x3c], 0x317473ed
sub dword [ebp - 0x3c], 0xff4127a8
mov dword [ebp - 0x38], 0x16104a68
sub dword [ebp - 0x38], 0xc9c4063a
mov dword [ebp - 0x34], 0x24ee52cb
add dword [ebp - 0x34], 0xdb11ad35
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x4ddee5b7
sub dword [ebp - 0x40], 0xd96c7c61
mov dword [ebp - 0x3c], 0x9f0506c8
add dword [ebp - 0x3c], 0xa2675aad
mov dword [ebp - 0x38], 0xa76986fb
sub dword [ebp - 0x38], 0x43fa1a8f
mov dword [ebp - 0x34], 0x193fed47
sub dword [ebp - 0x34], 0x193fed47
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x3f45430e
add eax, 0x2e327d3e
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x36852
push 0
call eax
mov ecx, 0x617b2772
add ecx, 0x9e851dad
mov ebx, eax
mov esi, 0x6d784000
add esi, dword [ebp - 0x30]
mov edi, 0x1e9078d7
add edi, 0xdef9dc58
xor dword [ebp - 0x24], eax
mov edx, dword [esi]
add dword [ebp - 0x10], 0x8145b7eb
sub edx, edi
xor dword [ebp - 0x28], ecx
mov dword [ebx], edx
xor dword [ebp - 0x24], eax
add ebx, 0x74b2e2c8
add ebx, 0x8b4d1d3c
add esi, 4
loop 0x6d7726be
add eax, 0x272ecb15
sub eax, 0x272dc3c6
xor ebx, ebx
add ebx, eax
add eax, 0x3a81874d
add eax, 0xc57e78b8
mov ecx, 0x6d770000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x6d775180
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x6d7815b4]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x6d7751b6
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d7752b0
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x6d7751ea
push str.create
push esi
call fcn.6d773a00
pop ecx
pop ecx
jmp 0x6d7752af
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x6d78117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x6d77529c
push dword [0x6d7815a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x6d775245
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d775262
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6d775280
push str.create
push esi
call fcn.6d773a00
pop ecx
pop ecx
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x6d78117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
jmp 0x6d7752ae
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x6d78117c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x6d7752ae
push 0
push dword [0x6d7815a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x6d7762df
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x28], eax
call fcn.6d774fdf
push edi
mov ebx, eax
call fcn.6d77500b
pop ecx
pop ecx
test ebx, ebx
jns 0x6d77633c
test eax, eax
jns 0x6d77633a
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d77b1da
leave
ret 0x10
mov ebx, eax
cmp dword [ebp + 0x10], 0xf
jne 0x6d7763d1
mov dword [ebp - 0x30], 0x1c
cmp ebx, 0xffffffff
jne 0x6d77635b
push edi
call fcn.6d77500b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x6d776383
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
add esp, 0xc
jmp 0x6d776326
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
mov edi, eax
test edi, edi
je 0x6d776326
push dword [ebp - 0x28]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d776326
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x28]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x6d776329
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x6d7763ef
push str.Invalid_option
jmp 0x6d77631b
mov edi, 0x80
mov dword [ebp - 0x2c], 4
cmp dword [ebp + 0x10], edi
je 0x6d776404
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
test eax, eax
jns 0x6d77642e
push str.getsockopt
push esi
call fcn.6d773a00
pop ecx
pop ecx
jmp 0x6d776326
mov eax, dword [ebp + 0x10]
cmp eax, 8
jg 0x6d77644c
je 0x6d776465
dec eax
je 0x6d776465
dec eax
dec eax
je 0x6d776476
dec eax
je 0x6d776465
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x6d77631b
cmp eax, edi
je 0x6d77647e
cmp eax, 0x1000
jle 0x6d776442
cmp eax, 0x1002
jle 0x6d776476
cmp eax, 0x1003
jne 0x6d776442
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x6d776329
mov eax, dword [ebp - 0x24]
jmp 0x6d776329
cmp word [ebp - 0x24], 0
je 0x6d776326
movzx eax, word [ebp - 0x22]
jmp 0x6d776329
Function at 0x6d7764df
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push dword [0x6d7815b4]
mov esi, dword [esp + 0xc]
push dword [esp + 0x10]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
test eax, eax
jne 0x6d776507
push str.Socket_closed
push str.java_net_SocketException
jmp 0x6d77654c
push dword [0x6d78117c]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x190]
cmp eax, 0xffffffff
je 0x6d7764fb
push 1
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x6d776540
push str.send
push esi
call fcn.6d773a00
pop ecx
pop ecx
jmp 0x6d776552
cmp eax, 0xfffffffe
jne 0x6d776552
push 0
push str.java_io_InterruptedIOException
push esi
call sub.java.dll__JNU_ThrowByName_12
pop esi
ret 0xc

Function at 0x6d77659a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
xor eax, eax
cmp byte [ebp + 0x10], al
push esi
sete al
push 0
inc eax
push eax
push 0x17
call fcn.6d77465c
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x6d7765d8
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
or eax, esi
jmp 0x6d77660f
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6d776602
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
push 0
push 1
push esi
call dword [sym.imp.kernel32.dll_SetHandleInformation]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x6d77667f
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push 1
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
test eax, eax
jne 0x6d776701
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d776704
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x6d7766dc
push 0xfffffffffffffffe
pop eax
jmp 0x6d776704
cmp eax, 0x2741
jne 0x6d7766f5
push str.connect:_Address_is_invalid_on_local_machine__or_port_is_not_valid_on_remote_machine
push str.java_net_ConnectException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d776701
push str.connect
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d77b1da
leave
ret 0x14
Function at 0x6d776713
Capabilities:
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp + 0x198], eax
xor eax, eax
inc eax
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0x1b0]
cdq
mov ecx, 0x3e8
idiv ecx
push ebx
push esi
mov esi, dword [ebp + 0x1ac]
push edi
mov edi, dword [ebp + 0x1a4]
xor ebx, ebx
mov dword [ebp - 0x78], 4
mov dword [ebp - 0x6c], esi
mov dword [ebp + 0x98], esi
mov dword [ebp - 0x80], eax
imul edx, edx, 0x3e8
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x94]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x7c], edx
call dword [sym.imp.ws2_32.dll_select]
mov dword [ebp - 0x74], eax
cmp eax, ebx
jne 0x6d7767b1
push str.connect_timed_out
push str.java_net_SocketTimeoutException
push edi
call sub.java.dll__JNU_ThrowByName_12
push 2
push esi
call dword [sym.imp.ws2_32.dll_shutdown]
jmp 0x6d776814
lea eax, [ebp + 0x94]
push eax
push esi
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x6d776814
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x1007
push 0xffff
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
cmp dword [ebp - 0x74], 0
jne 0x6d776806
push 0
call dword [sym.imp.kernel32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x6d7767c2
cmp dword [ebp - 0x74], 0
jne 0x6d776806
push str.Unable_to_establish_connection
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d776814
push str.connect
push dword [ebp - 0x74]
push edi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d77b1da
add ebp, 0x19c
leave
ret 0x10

Function at 0x6d77682e
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d776895
push esi
mov esi, dword [sym.imp.ws2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2736
jne 0x6d776881
push str.Socket_closed
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d77688f
push str.getsockname_failed
call esi
push eax
push edi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
or eax, 0xffffffff
pop esi
jmp 0x6d7768a3
movzx eax, word [ebp - 0x1e]
push eax
call dword [sym.imp.ws2_32.dll_ntohs]
movzx eax, ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.6d77b1da
leave
ret 0xc
Function at 0x6d7768b2
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d7768fb
push str.Error_getting_socket_name
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
jmp 0x6d77693c
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
mov ebx, eax
test ebx, ebx
je 0x6d77693b
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d77693b
mov ecx, dword [esi]
push ebx
push eax
push edi
push esi
call dword [ecx + 0x1a0]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.6d77b1da
leave
ret 0x10

Function at 0x6d776bf1
Capabilities:
Send data
Send data on socket

Disassembly:
push 1
push 1
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x6d776c20
push str.send
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [esp + 0xc]
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
jmp 0x6d776c35
cmp eax, 0xfffffffe
jne 0x6d776c35
push 0
push str.java_io_InterruptedIOException
push dword [esp + 0xc]
call sub.java.dll__JNU_ThrowByName_12
ret 0x10
Function at 0x6d776da4
Capabilities:
Check os version
Get hostname
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0x124]
sub esp, 0x1a4
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp + 0x120], eax
cmp byte [0x6d78119b], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x12c]
mov dword [ebp - 0x7c], edi
jne 0x6d776f03
mov esi, 0x6d7811d4
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp byte [0x6d78119b], 0
jne 0x6d776efc
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x74], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x64], 1
mov byte [0x6d78119a], 0
jne 0x6d776e28
cmp dword [ebp - 0x70], 4
jne 0x6d776e28
cmp dword [ebp - 0x6c], 0
je 0x6d776e21
cmp dword [ebp - 0x6c], 0xa
jne 0x6d776e28
mov byte [0x6d78119a], 1
lea eax, [ebp - 0x80]
push eax
push 0x6d7811d0
push 0x2003
push 0xffff
push dword [ebp + 0x130]
mov dword [ebp - 0x80], 4
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
test eax, eax
jns 0x6d776e5b
mov dword [0x6d7811d0], 0xfff7
cmp byte [0x6d78119a], 0
je 0x6d776ef5
push 0xff
lea eax, [ebp + 0x20]
push eax
call dword [sym.imp.ws2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x6d776e9a
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push str.Unable_to_obtain_hostname
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
mov al, 1
jmp 0x6d776f88
lea eax, [ebp + 0x20]
push eax
call dword [sym.imp.ws2_32.dll_gethostbyname]
test eax, eax
je 0x6d776ef5
mov eax, dword [eax + 0xc]
mov edi, dword [eax]
mov dword [ebp - 0x78], eax
test edi, edi
je 0x6d776ef5
mov esi, dword [0x6d7811f0]
push 8
call dword [sym.imp.msvcr100.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x6d776f3f
push dword [edi]
call dword [sym.imp.ws2_32.dll_htonl]
add dword [ebp - 0x78], 4
mov dword [ebx], eax
mov eax, dword [0x6d7811f0]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x78]
mov edi, dword [eax]
mov esi, ebx
mov dword [0x6d7811f0], esi
test edi, edi
jne 0x6d776eba
mov esi, 0x6d7811d4
mov byte [0x6d78119b], 1
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0x138]
cmp eax, dword [0x6d7811d0]
jg 0x6d776e93
cmp byte [0x6d78119a], 0
je 0x6d776f86
cmp eax, 0x2ff8
jle 0x6d776f86
mov ecx, dword [ebp + 0x134]
mov eax, 0x7f000000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x6d776e93
mov eax, dword [0x6d7811f0]
jmp 0x6d776f82
test esi, esi
je 0x6d776f5a
mov edi, dword [esi + 4]
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
mov esi, edi
test edi, edi
jne 0x6d776f43
mov dword [0x6d7811f0], esi
push 0x6d7811d4
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push str.heap_allocation_failed
push dword [ebp - 0x7c]
call sub.java.dll__JNU_ThrowOutOfMemoryError_8
jmp 0x6d776e93
cmp dword [eax], ecx
je 0x6d776e93
mov eax, dword [eax + 4]
test eax, eax
jne 0x6d776f77
xor al, al
mov ecx, dword [ebp + 0x120]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d77b1da
add ebp, 0x124
leave
ret