joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ec80
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x128
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x124], eax
push 0x103
lea eax, [esp + 0x25]
push 0
push eax
mov byte [esp + 0x2c], 0
call fcn.1001f410
add esp, 0xc
test edi, edi
je 0x1000ed64
push esi
push 1
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.LCDEBUG
lea ecx, [esp + 0x28]
lea eax, [esp + 0x14]
push str.GlobalProcLock__s_Mutex
push ecx
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], eax
call fcn.100182ad
add esp, 0xc
lea edx, [esp + 0x24]
push edx
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x1000ed4c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000ed45
mov dword [edi], esi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1001829e
add esp, 0x128
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1001829e
add esp, 0x128
ret
mov ecx, dword [esp + 0x124]
xor ecx, esp
xor eax, eax
call fcn.1001829e
add esp, 0x128
ret
Function at 0x1000eef0
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x13c
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push ebp
xor ecx, ecx
cmp ecx, 0x1002bdd0
push esi
mov eax, 1
push edi
mov dword [esp + 0x10], eax
je 0x1000f052
push 0x128
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.1001f410
add esp, 0xc
push 0
push 2
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
mov dword [esp + 0x1c], esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1000f047
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0x3c]
push ecx
push 0x1002bdd0
call fcn.10019974
add esp, 8
test eax, eax
jne 0x1000f030
mov esi, dword [esp + 0x20]
push str.SeDebugPrivilege
xor edi, edi
call ebp
mov ecx, eax
lea eax, [edi + 1]
call fcn.1000cb10
add esp, 4
push esi
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000efbe
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SeDebugPrivilege
call ebp
mov ecx, eax
xor eax, eax
call fcn.1000cb10
add esp, 4
test edi, edi
je 0x1000efdc
and dword [esp + 0x10], 1
jmp 0x1000f030
call ebx
mov edx, dword [esp + 0x20]
push eax
push edx
push 0x1002f514
push 0x763
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_kill_by_name
call fcn.1000be40
add esp, 0x18
call ebx
push eax
mov eax, dword [esp + 0x24]
push eax
push 0x1002f514
push 0x763
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_kill_by_name
call fcn.1000bb50
add esp, 0x18
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000ef68
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001829e
add esp, 0x13c
ret

Function at 0x1000f070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor ecx, ecx
xor esi, esi
test ebp, ebp
jbe 0x1000f0ac
mov edi, edi
mov al, byte [esi + str.infogo]
xor al, byte [ecx + edi]
add ecx, 1
mov dl, al
shl dl, 4
shr al, 4
add dl, al
mov byte [ecx + edi - 1], dl
lea eax, [esi + 1]
xor edx, edx
mov esi, 6
div esi
cmp ecx, ebp
mov esi, edx
jb 0x1000f080
pop esi
mov eax, edi
pop ebp
ret

Function at 0x1000f0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor ecx, ecx
xor esi, esi
test ebp, ebp
jbe 0x1000f101
push ebx
nop
mov bl, byte [ecx + edi]
mov al, bl
shl al, 4
shr bl, 4
add al, bl
mov byte [ecx + edi], al
mov dl, byte [esi + str.infogo]
xor dl, al
mov byte [ecx + edi], dl
lea eax, [esi + 1]
xor edx, edx
mov esi, 6
div esi
add ecx, 1
cmp ecx, ebp
mov esi, edx
jb 0x1000f0d0
pop ebx
pop esi
mov eax, edi
pop ebp
ret
Function at 0x1000f110
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, eax
je 0x1000f20c
test ebp, ebp
je 0x1000f20c
test edi, edi
je 0x1000f20c
cmp edx, 0xffffffff
jne 0x1000f151
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000f140
sub eax, edx
mov dword [esp + 0xc], eax
mov edx, eax
push ebx
push esi
xor ebx, ebx
xor esi, esi
test edx, edx
jle 0x1000f201
add edi, 0xfffffffc
cmp esi, edi
jge 0x1000f201
mov ecx, dword [esp + 0x1c]
mov al, byte [ebx + ecx]
cmp al, 0x30
jb 0x1000f179
cmp al, 0x39
jbe 0x1000f1f0
cmp al, 0x41
jb 0x1000f181
cmp al, 0x5a
jbe 0x1000f1f0
cmp al, 0x61
jb 0x1000f189
cmp al, 0x7a
jbe 0x1000f1f0
cmp al, 0x5f
je 0x1000f1f0
cmp al, 0x2e
je 0x1000f1f0
cmp al, 0x21
je 0x1000f1f0
cmp al, 0x7e
je 0x1000f1f0
cmp al, 0x2a
je 0x1000f1f0
cmp al, 0x27
je 0x1000f1f0
cmp al, 0x28
je 0x1000f1f0
cmp al, 0x29
je 0x1000f1f0
cmp al, 0x3b
je 0x1000f1f0
cmp al, 0x2f
je 0x1000f1f0
cmp al, 0x3f
je 0x1000f1f0
cmp al, 0x3a
je 0x1000f1f0
cmp al, 0x40
je 0x1000f1f0
cmp al, 0x26
je 0x1000f1f0
cmp al, 0x3d
je 0x1000f1f0
cmp al, 0x2b
je 0x1000f1f0
cmp al, 0x24
je 0x1000f1f0
cmp al, 0x2c
je 0x1000f1f0
cmp al, 0x2d
je 0x1000f1f0
mov byte [esi + ebp], 0x25
mov dl, byte [ebx + ecx]
add esi, 1
lea eax, [esi + ebp]
call fcn.1000fb50
mov edx, dword [esp + 0x14]
add esi, 2
jmp 0x1000f1f6
mov byte [esi + ebp], al
add esi, 1
add ebx, 1
cmp ebx, edx
jl 0x1000f162
mov byte [esi + ebp], 0
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
pop edi
xor eax, eax
pop ebp
ret
Function at 0x100112a0
Capabilities:
Create directory

Disassembly:
sub esp, 0x114
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x19]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x20], 0
call fcn.1001f410
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100112d8
sub eax, edx
mov ebp, eax
cmp ebp, 0x104
jle 0x10011328
push str.lpPath_is_too_long
push 0x100
push str..Cutil_File.c
push 1
mov ecx, str.cutil_file_make_sure_dirA
call fcn.1000be40
push str.lpPath_is_too_long
push 0x100
push str..Cutil_File.c
push 1
mov ecx, str.cutil_file_make_sure_dirA
call fcn.1000bb50
add esp, 0x20
jmp 0x10011377
lea edx, [esp + 0x14]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x10011330
xor esi, esi
test ebp, ebp
jle 0x10011377
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x10011350
mov bl, byte [esp + esi + 0x14]
cmp bl, 0x5c
je 0x1001135e
cmp bl, 0x2f
jne 0x10011370
push 0
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + esi + 0x1c], 0
call edi
mov byte [esp + esi + 0x14], bl
add esi, 1
cmp esi, ebp
jl 0x10011350
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001829e
add esp, 0x114
ret

Function at 0x10011390
Capabilities:
Copy file
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x114
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
mov ecx, esi
call fcn.100112a0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 7
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
je 0x100113c6
push 0x80
push esi
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push esi
push edi
call ebx
test eax, eax
jne 0x10011466
push 0x103
push eax
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
push eax
call fcn.1001f410
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x10011415
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.1001829e
add esp, 0x114
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
push eax
push esi
lea ecx, [esp + 0x14]
push str._s._d
push ecx
call fcn.100182ad
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x100113fc
push 4
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 6
lea ecx, [esp + 0x10]
push ecx
call ebp
push 0
push esi
push edi
call ebx
test eax, eax
je 0x100113fc
mov ecx, dword [esp + 0x118]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1001829e
add esp, 0x114
ret
Function at 0x10011490
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x108], eax
test esi, esi
je 0x10011598
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100114b1
sub eax, edx
je 0x10011598
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and eax, 0xfffffffe
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1001157d
push 0x103
push eax
mov byte [esp + 0x10], al
lea eax, [esp + 0x11]
push eax
call fcn.1001f410
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10011537
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
push eax
push esi
lea ecx, [esp + 0x10]
push str._s._d
push ecx
call fcn.100182ad
add esp, 0x10
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1001154f
xor eax, eax
pop edi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.1001829e
add esp, 0x10c
ret
push 6
lea eax, [esp + 0xc]
push eax
call edi
push 4
push 0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop edi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.1001829e
add esp, 0x10c
ret
mov eax, 1
pop edi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.1001829e
add esp, 0x10c
ret
mov ecx, dword [esp + 0x108]
xor ecx, esp
xor eax, eax
call fcn.1001829e
add esp, 0x10c
ret
Function at 0x100115b0
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x148
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x100116df
cmp edi, ebx
je 0x100116df
call fcn.10011220
test eax, eax
je 0x100116df
mov ecx, edi
call fcn.100112a0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 7
je 0x10011606
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 3
push edi
push esi
call ebp
test eax, eax
jne 0x100116c2
push 0x103
lea eax, [esp + 0x49]
push ebx
push eax
mov byte [esp + 0x50], bl
call fcn.1001f410
add esp, 0xc
push 0x31
lea ecx, [esp + 0x15]
push ebx
push ecx
mov byte [esp + 0x1c], bl
call fcn.1001f410
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
push eax
lea edx, [esp + 0x14]
push 0x1002ea70
push edx
call fcn.100182ad
add esp, 0xc
mov eax, edi
mov ecx, 0x104
lea ebx, [esp + 0x44]
call fcn.1000f9f0
push 0x104
mov eax, 0x1002f564
call fcn.1000fa40
add esp, 4
push 0x104
lea eax, [esp + 0x14]
call fcn.1000fa40
add esp, 4
mov eax, ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x100116df
push 4
push 0
mov ecx, ebx
push ecx
call ebp
push 6
mov edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 3
push edi
push esi
call ebp
test eax, eax
je 0x100116df
mov eax, 1
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.1001829e
add esp, 0x148
ret
mov ecx, dword [esp + 0x150]
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1001829e
add esp, 0x148
ret
Function at 0x100118f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x28]
xor eax, eax
push esi
push edi
push eax
push 1
push 1
push eax
or ebx, 0xffffffff
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x28], eax
lea esp, [esp]
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10011997
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100119c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, dword [esp + 0x28]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100119ab
push 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esi, eax
add ebx, esi
test edi, edi
je 0x100119c0
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x34]
je 0x100119d5
sub dword [esp + 0x34], eax
add dword [esp + 0x14], eax
jmp 0x10011930
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x100119f0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
neg eax
sbb eax, eax
xor ecx, esp
add eax, 1
call fcn.1001829e
add esp, 0x19c
ret
Function at 0x10011a30
Capabilities:
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1b4
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x28]
push eax
push 0x202
mov ebx, ecx
mov dword [esp + 0x18], 0x8000
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x10011a8d
call fcn.10011f00
test eax, eax
je 0x10011aa8
push ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x10011ab4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.1001829e
add esp, 0x1b4
ret
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c4]
push ecx
mov word [esp + 0x1c], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0xffff
push esi
mov word [esp + 0x2e], ax
mov dword [esp + 0x28], 1
call edi
push 0x10
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x10011a8d
push 8
push esi
call dword [sym.imp.WS2_32.dll_listen]
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x1002
push 0xffff
push esi
call edi
push 4
lea edx, [esp + 0x14]
push edx
push 0x1001
push 0xffff
push esi
call edi
mov ecx, dword [esp + 0x1bc]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1001829e
add esp, 0x1b4
ret
Function at 0x10011b50
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x138
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
mov ebx, ecx
or eax, 0xffffffff
cmp ebx, 0xffff
mov edi, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], edi
ja 0x10011d09
call fcn.100119f0
push 6
push edi
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x10011cec
push ebx
mov word [esp + 0x130], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12e], ax
call fcn.10011fb0
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x130], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0x10
lea ecx, [esp + 0x130]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_connect]
xor ebx, ebx
cmp eax, 0xffffffff
jne 0x10011ccd
lea edx, [esp + 0x18]
push edx
push ebx
lea eax, [esp + 0x28]
push eax
push ebx
lea ecx, [esi + 1]
push ecx
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], edi
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x10011c85
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x1007
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp dword [esp + 0x10], ebx
je 0x10011ccd
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.getsockopt_error:_d__n
push 0xea
push str..Cutil_Socket.c
push edi
mov ecx, str.cutil_socket_connect_timeoutEx
call fcn.1000be40
add esp, 0x14
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.getsockopt_error:_d__n
push 0xea
jmp 0x10011cb8
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.socket_select_error:_d__n
push 0xf0
push str..Cutil_Socket.c
push edi
mov ecx, str.cutil_socket_connect_timeoutEx
call fcn.1000be40
add esp, 0x14
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.socket_select_error:_d__n
push 0xf0
push str..Cutil_Socket.c
push edi
mov ecx, str.cutil_socket_connect_timeoutEx
call fcn.1000bb50
add esp, 0x14
xor edi, edi
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push esi
mov dword [esp + 0x18], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp edi, ebx
jne 0x10011d07
push esi
call sub.WS2_32.dll_closesocket
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.1001829e
add esp, 0x138
ret
mov eax, esi
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001829e
add esp, 0x138
ret
Function at 0x10011d30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
cmp ebp, 0xffffffff
push esi
push edi
mov edi, eax
jne 0x10011d4f
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10011d42
sub eax, edx
mov ebp, eax
test ebp, ebp
mov esi, ebp
jle 0x10011d77
mov ebx, dword [sym.imp.WS2_32.dll_send]
jmp 0x10011d60
mov eax, dword [esp + 0x14]
push 0
push esi
push edi
push eax
call ebx
test eax, eax
jle 0x10011d80
sub esi, eax
add edi, eax
test esi, esi
jg 0x10011d60
mov eax, ebp
pop edi
sub eax, esi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x10011fb0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x1a4], eax
push 0x1006bf10
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
jne 0x10012045
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x1006bf10
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1001202e
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.10022400
mov edx, dword [esp + 0x10]
add esp, 0xc
push edx
call sub.WS2_32.dll_ntohl
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.1001829e
add esp, 0x1ac
ret
xor eax, eax
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.1001829e
add esp, 0x1ac
ret
call fcn.10011d90
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.1001829e
add esp, 0x1ac
ret

Function at 0x10012140
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x14], eax
xor eax, eax
mov word [esp + 4], ax
mov dword [esp + 6], eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov word [esp + 0x12], ax
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0xc], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x10012194
xor eax, eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1001829e
add esp, 0x1c
ret
mov eax, dword [esp + 8]
push eax
call sub.WS2_32.dll_ntohl
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1001829e
add esp, 0x1c
ret

Function at 0x100121b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x14], eax
xor eax, eax
mov word [esp + 4], ax
mov dword [esp + 6], eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov word [esp + 0x12], ax
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0xc], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x10012205
xor ax, ax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1001829e
add esp, 0x1c
ret
mov eax, dword [esp + 6]
push eax
call sub.WS2_32.dll_ntohs
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1001829e
add esp, 0x1c
ret
Function at 0x10012220
Capabilities:
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1c0
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x1bc], eax
push esi
push edi
lea eax, [esp + 0x30]
push eax
push 0x202
mov edi, ecx
mov dword [esp + 0x14], 0x8000
mov dword [esp + 0x10], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10012285
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x1bc]
xor ecx, esp
call fcn.1001829e
add esp, 0x1c0
ret
test edi, edi
je 0x100122a8
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0x17
push edi
mov dword [esp + 0x1c], 0x1c
call dword [sym.imp.WS2_32.dll_WSAStringToAddressA]
jmp 0x100122ce
mov eax, dword [0x1002baa4]
mov ecx, dword [0x1002baa8]
mov edx, dword [0x1002baac]
mov dword [esp + 0x1c], eax
mov eax, dword [0x1002bab0]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x1cc]
push ecx
mov word [esp + 0x18], 0x17
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0xffff
push esi
mov word [esp + 0x2a], ax
mov dword [esp + 0x24], 1
call edi
push 0x1c
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1001226b
push 8
push esi
call dword [sym.imp.WS2_32.dll_listen]
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1002
push 0xffff
push esi
call edi
push 4
lea edx, [esp + 0x10]
push edx
push 0x1001
push 0xffff
push esi
call edi
mov ecx, dword [esp + 0x1c4]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.1001829e
add esp, 0x1c0
ret
Function at 0x10014080
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x10014087
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.10014090