joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2722f3d5
Capabilities:
Reference http user-agent string

Disassembly:
push dword [esp + 0x18]
push eax
mov ax, 0xc916
cmovno eax, eax
push dword [esp + 0x20]
lahf
lea eax, [esp + 0x228]
jmp 0x27203437
test eax, eax
jmp 0x271f0a3d
je 0x2730a13a
movzx edi, word [ebx + 0x1a]
mov eax, ebx
mov dword [esp + 0x10], edi
jmp 0x272ff88c
je 0x271eb2c7
mov ecx, edi
movzx eax, bp
mov eax, ebx
jmp 0x272789f8
movzx eax, word [ebp + 0x10]
jmp 0x2733eaa8
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
cmc
pop ebx
cmp ecx, edx
xor ecx, esp
jmp 0x27201128
mov cl, byte [eax]
jmp 0x27275810
mov edi, dword [ebx + 0xc]
jmp 0x27240af6
je 0x271a0ad7
test byte [ebx + 0x5c], 6
jmp 0x271a0ad1
call fcn.271f85bd
mov esi, eax
stc
test eax, esi
test esi, esi
jmp 0x271b83ba
jne 0x2732ce7e
mov eax, 0x101
jmp 0x272a893b
call fcn.27088f70
mov esp, ebp
pop ebp
jmp 0x272a6137
push str.CONNECT__s:_hu_HTTP_1.1_r_nHost:__s:_hu_r_nProxy_Connection:_Keep_Alive_r_n
push 0x400
jmp 0x2702e703
push ebp
xchg bp, bp
xor bp, 0xe51d
mov ebp, esp
add ax, 0x9ab5
and esp, 0xfffffff8
sub esp, 0x814
shld ax, bp, 0x1e
mov eax, dword [0x270b313c]
cmp ch, 0xd
xor eax, esp
clc
stc
mov dword [esp + 0x810], eax
bts eax, ecx
mov eax, dword [ebp + 0xc]
cmp si, 0xad8c
push ebx
mov ebx, dword [ebp + 8]
clc
push esi
stc
cmp ax, sp
cmc
push edi
mov dword [esp + 0x14], eax
cmp ebp, edi
test eax, esi
test ebx, ebx
jmp 0x271fa4f6
test edi, edi
jmp 0x272f38ad
jne 0x271f0a43
test byte [ebx + 0x5c], 2
jmp 0x2730a134
jne 0x271d06b0
sub eax, edx
or dh, 9
bt dx, sp
mov edx, 0x96
stc
cmp eax, edx
jmp 0x272ea334
inc eax
clc
test cl, cl
jmp 0x272648a2
call fcn.272b947a
mov eax, esi
jmp 0x272a6746
ret
jmp 0x271cb534
jmp 0x271cb534
push 0x3a
not ah
movsx ecx, ax
pop eax
cmovne ecx, esp
xchg ecx, ecx
bswap cx
mov word [esp + 0x18], ax
seta ch
xchg ecx, ecx
cbw
lea eax, [esp + 0x618]
mov ecx, esi
lea ecx, [esp + 0x18]
jmp 0x27007a8b
inc ecx
cmp dx, dx
cmp word [ebx + 0x16], cx
jne 0x271fa4fc
mov eax, dword [ebx + 0xc]
test eax, eax
jmp 0x2724ffde
jae 0x272bfbd5
lea esi, [esp + 0x18]
adc ax, 0xb22d
sbb ah, 0xad
mov eax, edi
shl cl, cl
test ch, 0x11
sub esi, edi
xchg cl, cl
mov cl, 0x1a
mov cl, bl
mov cl, byte [eax]
mov byte [esi + eax], cl
jmp 0x2734e2f2
je 0x271bac7d
test byte [ebx + 0x5c], 4
je 0x271bac7d
mov eax, edi
setae cl
not cl
lea edx, [eax + 1]
jmp 0x271d06b0
jmp 0x271cb534
call fcn.272b947a
mov esi, ebx
jmp 0x271f13bc
jne 0x2717c466
mov eax, 0x100
jmp 0x272f3931
test eax, eax
je 0x271fa4fc
sub ecx, ecx
jmp 0x272c9a40
push eax
jmp 0x271798bf
inc eax
cmc
test di, 0xd42b
test cl, cl
jmp 0x2701e628
Function at 0x27231c7d
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, dword [edi + 0x2bc]
mov dword [ebp - 0x118], ecx
not cl
movzx cx, dl
bswap cx
mov ecx, dword [edi + 0x2c0]
jmp 0x272775ec
je 0x272d5756
call dword [sym.imp.msvcrt.dll_rand]
sub edx, edx
and cx, di
rol ch, 0x9d
test sp, bp
mov ecx, 0xf5
btr esi, 0x87
sbb esi, 0xe7300f9e
mov si, bx
div ecx
bts esi, esp
mov dword [ebp - 0x79c], 0
test ebx, esi
add esi, 0x5e2490aa
shrd esi, eax, 0xad
mov esi, edx
cmc
add esi, 8
jmp 0x2700e3b7
push 0x270c49a0
jmp 0x272219e8
call fcn.2708a171
ret
je 0x271878aa
mov eax, 0x103
jmp 0x27307283
mov cx, word [edi + 0x8c]
jmp 0x272ed13e
call fcn.27001186
mov eax, esi
sub eax, ebx
cmp esp, eax
neg eax
jmp 0x27260c2f
push 0x7a4
bswap eax
movsx eax, cx
mov eax, 0x2708dfc9
call fcn.2708a127
mov ebx, dword [ebp + 0xc]
sar ax, cl
rol al, cl
movsx eax, bp
mov eax, dword [ebp + 8]
test esi, eax
sub ecx, ecx
mov dword [ebp - 0x7a0], eax
stc
cmp ebp, ecx
mov dword [ebp - 0x7a4], ecx
clc
mov dword [ebp - 0x7a8], ecx
test eax, edx
stc
cmp dword [edi + 0x7c], ecx
je 0x272d5756
cmp dword [edi + 0x80], ecx
jmp 0x272ae481
sbb eax, eax
clc
and eax, 0x103
jmp 0x27272542
lea esp, [ebp - 0x7c0]
jmp 0x271c2ec8
mov dword [ebp - 0x114], ecx
mov cx, bx
jmp 0x2720c085
jne 0x272c829d
cmp dword [edi + 0x84], ecx
jmp 0x271e019e
cmp word [edi + 0x1c], 1
jmp 0x27194ccd
push 0
xchg si, si
movsx esi, dx
push ebx
mov esi, 0x19346480
push dword [ebp - 0x7a0]
mov esi, edi
jmp 0x27346dc5
push ebx
jmp 0x2702f459
jmp 0x27272542
call fcn.2719452f
cmp dword [ebp - 0x7a4], 0
mov esi, eax
je 0x272219ed
cmp dword [ebp - 0x7a8], 0x2800
jbe 0x272219ed
push dword [ebp - 0x7a4]
jmp 0x271bf7e5

Function at 0x272329c1
Capabilities:
Terminate thread

Disassembly:
call sub.KERNEL32.dll_EnterCriticalSection
push dword [0x27167c20]
xor eax, eax
cmovge di, cx
mov edi, 0x27167bf0
jmp 0x273496af
push esi
jmp 0x272ecc61
je 0x27364fe2
mov esi, 0x27167c04
push esi
mov dword [ebp - 0xc], esi
jmp 0x2717d8bb
push ebp
btc bp, 0x35
bt ebp, edi
mov ebp, esp
sub esp, 0xc
jmp 0x27261e35
cmp dword [0x27167c30], 0
push ebx
jmp 0x271aba2a
pop esi
movsx ebx, si
pop ebx
leave
ret
push edi
jmp 0x271fec93
call fcn.271b516e
mov edi, dword [0x27167bfc]
jmp loc.2700e459
pop edi
jmp 0x272cd74f
Function at 0x2725bd86
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
jmp loc.2701065f

Function at 0x2725c7de
Capabilities:
Initialize winsock library
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
clc
test ecx, 0x4e9fbf21
and esp, 0xfffffff8
rol ah, 0x3b
sub esp, 0x208
inc ax
mov eax, dword [0x270b313c]
xor eax, esp
mov dword [esp + 0x204], eax
btc eax, esi
bts eax, ecx
sar eax, cl
mov eax, dword [ebp + 8]
test esi, 0xd8022607
cmc
push ebx
push edi
cmp edi, 0xb29620b3
clc
mov dword [esp + 8], eax
test dx, 0xef16
xor eax, 0x3bb21a2c
lea eax, [esp + 0x30]
test edi, 0x4b3e5495
stc
cmc
push eax
test bp, cx
sub ebx, ebx
push 2
jmp loc.2700c482

Function at 0x27270ace
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x330
mov al, bl
mov eax, 0x2708d563
jmp 0x272fe051
call fcn.2708a127
mov eax, dword [ebp + 8]
cmp ch, 0x3e
cmovg di, bp
cmp dword [eax], 0
not di
mov edi, ecx
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x330], edi
jmp loc.2701a612

Function at 0x27272c97
Capabilities:
Terminate process

Disassembly:
xor eax, eax
jmp 0x271bfd71
jne 0x271ad62d
mov dword [ebp - 0x24], str.ipv4
jmp 0x2719acf7
jne 0x2702075a
mov dword [ebp - 0x24], str.ipv6
movzx esi, bp
cmc
cmp dword [ebp + 0xc], 0x17
jmp 0x2719ace5
mov dword [ebp - 0x1c], edi
jmp 0x2719677b
push 0x20
movsx ax, cl
setns ah
cmovs ax, bx
mov eax, 0x2708d724
jmp 0x2735e1e6
call fcn.2708a0be
sub edi, edi
cmp dword [ebp + 0xc], 2
jmp 0x272523c2
Function at 0x27279fe1
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [eax]
jmp 0x272574fb
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x273602ab
push eax
lea eax, [esp + 0x34]
jmp 0x2727ccaf
call sub.WS2_32.dll_WSAGetLastError
test edi, edi
jmp 0x2722a3eb
call sub.WS2_32.dll_htons
mov word [esp + 0x22], ax
cmp dx, bx
cmc
test esi, esi
jmp 0x272cacc0
je 0x2726ae6e
lea eax, [esp + 0xc]
jmp 0x2719688c
mov dword [esp + 0x28], eax
jmp 0x271d96c1
call sub.WS2_32.dll_gethostbyname
mov edi, eax
jmp 0x271b5557
jne 0x27325820
mov eax, 0x103
jmp 0x27308622
push ebp
sal al, 0x9c
sbb bp, 0x3fb5
mov ebp, esp
adc eax, esi
and esp, 0xfffffff8
dec ax
sub esp, 0x430
and al, 0x30
sar ah, 0xa
bts ax, di
mov eax, dword [0x270b313c]
xor eax, esp
cmp esp, 0x2d31630a
clc
test edx, esp
mov dword [esp + 0x42c], eax
btc eax, 0x3b
mov eax, dword [ebp + 8]
cmc
push esi
push edi
sbb esi, 0x92afc813
clc
mov esi, ecx
test esi, 0x8f29ae23
test eax, eax
jne 0x27331873
mov eax, 0x101
jmp loc.2701a13f
push eax
movzx ax, ah
lea eax, [esp + 0x18]
jmp 0x272f48d4
push dword [ebp + 0xc]
mov word [esp + 0x24], ax
movsx ax, dl
cbw
mov eax, dword [ecx + 0xc]
jmp 0x272a0a5c
jmp 0x27338315
mov eax, dword [eax]
jmp 0x2717f871
add esp, 0xc
jmp 0x27318ec4
jne 0x27316778
mov edi, 0x101
jmp 0x27297d76
push eax
call fcn.27286dad
mov ecx, dword [esp + 0x18]
jmp 0x272a9dea
jmp fcn.27338322
lea eax, [esi + 0x20]
cdq
not dl
push eax
cmovne edx, ebp
mov edx, 0xf9bf6f0e
lea edx, [esp + 0x24]
mov ecx, esi
jmp 0x273382e8
test ecx, ecx
jmp 0x2726ae68
xor eax, eax
cmovp edi, esi
lea edi, [esp + 0x20]
jmp 0x271898e6
push eax
jmp 0x2725d00b
call fcn.27007dbb
mov edi, eax
pop ecx
test ebp, 0x6ba29434
test edi, edi
jne 0x27338315
add esi, 0x3c
push esi
cbw
mov ax, 0xb93c
lea eax, [esp + 0x24]
call fcn.272c07f0
pop ecx
rcl esi, 0xa7
mov eax, edi
adc di, 0x309
cmp esp, 0x92168b7
stosd dword es:[edi], eax
cmovno ax, sp
push 2
pop eax
jmp 0x272954fb
Function at 0x2728763e
Capabilities:
Get system information on windows

Disassembly:
call sub.KERNEL32.dll_GetTickCount
push 0x3e8
jmp loc.271da0b0
jmp fcn.27210753
push 0x47c
movsx eax, si
cmovbe eax, ebx
bswap eax
mov eax, 0x2708f03b
jmp 0x272d061f
jne 0x2700f8cf
push str.BindIoCompletionCallback_failed__r_n
call fcn.2702778a
pop ecx
jmp 0x2725a672
call fcn.2708a127
mov ebx, dword [ebp + 8]
stc
mov dword [ebp - 0x454], ebx
clc
jmp 0x27349665
sub esi, esi
push esi
push 0x2701b833
push ebx
jmp 0x2736a0ba
mov dword [ebp - 4], esi
call sub.KERNEL32.dll_BindIoCompletionCallback
test eax, eax
jmp 0x27291dbc
Function at 0x2729ae14
Capabilities:
Execute anti-debugging instructions
Set socket configuration

Disassembly:
call fcn.272744de
pop ecx
cmp bp, cx
shr ebx, 0x2a
bsf ebx, ebx
mov ebx, eax
cmp dh, 0xc
test ebx, ebx
jmp 0x272ef882
push eax
cbw
lea eax, [ebp - 0x48]
jmp 0x272e1ab5
jne 0x271a8743
push 0
jmp 0x27214a54
call fcn.272936b9
jmp 0x27179c57
mov dword [ebp - 0x50], 0x40
push ebx
call sub.WS2_32.dll_WSAAddressToStringA
push dword [ebp + 0xc]
mov ecx, 0x3da7841b
cmovs cx, bx
mov ecx, dword [edi]
mov edx, ebx
jmp 0x27179c48
jne 0x271c121f
mov eax, 0x101
jmp loc.2700fd79
cmp dword [ebp - 0x50], 0
je 0x272945f4
lea eax, [ebp - 0x50]
jmp 0x27187ef0
push eax
push eax
cwde
push 0xc
movsx eax, di
cwde
lea eax, [ebp - 0x60]
push eax
push 0x98000004
jmp 0x273214fe
call sub.WS2_32.dll_WSAIoctl
mov eax, ebx
mov dword [ebp - 0x5c], 0x7530
mov dword [ebp - 0x58], 0x1388
jmp 0x271fdeeb
push 0
jmp 0x272c8376
push dword [ebp - 0x4c]
call fcn.271cd259
pop ecx
movsx cx, ch
and cx, bx
pop ecx
test sp, di
stc
test eax, eax
je 0x271a8743
mov ecx, dword [edi]
mov edx, esi
mov si, 0x80a0
bswap si
mov esi, eax
jmp 0x2719c306
cmp eax, 2
jmp 0x272876d7
call fcn.272ed847
pop ecx
btc cx, dx
sal ch, 1
pop ecx
test ebx, esi
cmp dh, 0xbe
test eax, eax
jmp 0x271b9a52
call sub.WS2_32.dll_inet_ntoa
push dword [ebp - 0x54]
jmp 0x27278c88
call sub.WS2_32.dll_ntohs
movzx esi, ax
mov eax, dword [sym.SocksCapExDLL32.dll_Ordinal_199]
jmp 0x27227d3a
je 0x2718f03b
cmp eax, 1
jmp 0x2718f035
push dword [ebp - 0x4c]
jmp 0x27252449
jne 0x271fdef0
push eax
push eax
movzx ecx, dx
movsx ecx, bx
mov ch, dl
lea ecx, [ebp - 0x4c]
jmp 0x2733a99d
push 0xffff
inc edi
push esi
mov dword [ebp - 0x4c], edi
call sub.WS2_32.dll_setsockopt
test eax, eax
jmp 0x27297efa
push ebp
mov ebp, esp
lea esp, [esp - 0x64]
mov dh, 0xa0
shl ah, cl
shr edx, cl
mov eax, dword [0x270b313c]
ror dh, cl
xor eax, ebp
bswap edx
jmp 0x2731027b
push dword [ebp + 0xc]
jmp 0x271a8736
push eax
jmp 0x27213d4d
jne 0x271fdef0
mov eax, dword [edi]
mov esi, dword [eax]
sal eax, 0xa3
mov ax, si
push 4
or eax, edi
adc ax, di
lea eax, [ebp - 0x4c]
cmp esi, 0xca240c30
test esp, esp
push eax
test ecx, 0x32114731
push 8
sub edi, edi
jmp 0x27299cfa
mov edi, ecx
jmp 0x2723435f
mov dword [ebp - 4], eax
movsx ax, bl
cdq
cbw
push ebx
cbw
mov ebx, dword [ebp + 8]
cmovl eax, esp
push esi
rdtsc
push edi
lea eax, [ebp - 0x50]
push eax
rdtsc
push dword [ebp + 0xc]
bswap edi
jmp 0x27339cc4
push esi
mov dword [ebp - 0x60], edi
jmp 0x2720db17
lea eax, [ebp - 0x54]
movsx edi, si
lea esi, [ebp - 0x4c]
movzx edx, cx
mov edx, ebx
movzx edi, cx
mov di, si
jmp 0x272f2052
push ecx
jmp 0x271e7885
Function at 0x2729d248
Capabilities:
Set thread local storage value

Disassembly:
mov ebx, dword [ebp + 0x1a8]
push esi
mov si, 0xc23b
push edi
push 0x270c4ae4
bswap edi
mov dword [ebp - 0x78], eax
mov esi, ecx
cmovp di, ax
mov edi, edx
mov edi, edx
jmp 0x272b99ed
push dword [ebp - 0x7c]
jmp 0x2732d6fb
push ebx
jmp 0x2725da60
jne 0x271dc0be
lea eax, [ebp - 0x70]
jmp 0x272de5da
call sub.KERNEL32.dll_TlsSetValue
mov dword [ebp - 0x74], 1
push 0x270c4ae8
jmp 0x272bc887
call dword [0x270bb4a4]
mov dword [ebp - 0x70], eax
cmc
test eax, eax
je 0x2725da71
sub ecx, ecx
mov di, cx
bswap di
xchg di, di
mov word [ebp - 0x6c], cx
lea ecx, [ebp - 0x6c]
mov edi, eax
jmp 0x272c918a
push ebx
jmp 0x271f2f75
je 0x2729aeb9
mov esi, dword [esi + 4]
jmp 0x27250e15
push dword [0x270c4ae4]
jmp 0x271dc0b2
jmp 0x272ea4b9
jne 0x27315933
lea eax, [ebp - 0x80]
jmp 0x2733e9bd
push str.GetAddrInfoW__s__s_ai_family_d_...__failed_dwErrorCode_d__s__r_n
call fcn.2702778a
lea esp, [esp + 0x18]
bswap bx
cmp dword [ebp - 0x74], 0
mov edi, esp
pop edi
mov bx, 0x6a3e
mov bh, dh
bswap ebx
pop esi
not bh
pop ebx
jmp 0x27018825
call fcn.271f1ab9
pop ecx
jmp 0x2719132f
xor esi, esi
movsx ax, ah
jmp 0x272ea4b9
push ebp
neg bp
lea ebp, [esp - 0x1a0]
sbb ah, cl
adc eax, 0xba03ad19
sub esp, 0x220
cmc
clc
and ah, 0xb5
mov eax, dword [0x270b313c]
cmp dx, 0xb107
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1ac]
test sp, bx
and dword [ebp - 0x74], 0
push ebx
jmp 0x27182dc5
push esi
jmp 0x27323df7
call fcn.2700fd2a
test eax, eax
jmp 0x271b9ce5
call fcn.2700fd2a
test eax, eax
jmp 0x27258d52
call fcn.27028284
test esi, esi
jmp 0x271fb0d5
push eax
jmp 0x2720070f
lea eax, [ebp - 0x6c]
push eax
push edi
jmp 0x2732374c
call sub.KERNEL32.dll_TlsSetValue
push edi
jmp 0x272a9b16
push esi
push dword [ebp - 0x78]
jmp 0x271a2bf9
push dword [ebp - 0x78]
jmp 0x271faaa6
push dword [0x270c4ae8]
jmp 0x2731592e
push eax
lea eax, [ebp - 0x7c]
jmp 0x27286bab
Function at 0x272a72c7
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push eax
sar al, 0x3f
sar ah, cl
lea eax, [ebp - 0x234]
stc
jmp 0x273096fb
call fcn.27088f70
leave
ret
jne 0x272b27b4
cmp word [ebp - 0x234], 2
jmp 0x2722f712
jne 0x2721faa2
movzx edi, word [ebp - 0x232]
jmp 0x2721faa2
mov ecx, dword [ebp - 8]
rol esi, 0x23
mov ax, di
and esi, ecx
pop edi
xor ecx, ebp
movsx esi, di
cmovo esi, edi
xchg esi, esi
pop esi
jmp 0x271f7f69
je 0x2720b68f
cmp word [ebp - 0x234], 0x17
jmp 0x2720b689
rep stosd dword es:[edi], eax
bt ax, si
lea eax, [ebp - 0x218]
jmp 0x271f4f60
push ebp
add ecx, ecx
or ebp, edi
and cl, 0xb1
mov ebp, esp
add eax, 0x10050d29
xchg ecx, eax
sub esp, 0x234
mov eax, dword [0x270b313c]
neg cl
sar cx, 0x9a
rcr ch, cl
xor eax, ebp
mov dword [ebp - 8], eax
and cx, si
adc cx, bx
or cl, 0xaa
push esi
sar cl, 0xbd
ror cl, cl
push edi
xor edi, 0x628d9ba8
bsf ecx, esi
clc
push 7
sar di, 0x8f
pop ecx
sub eax, eax
mov edi, 0xe2b2e2ae
movsx edi, cx
lea edi, [ebp - 0x234]
jmp 0x2727a7b7
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
cmc
cmp esi, 0x2726
jmp 0x2702ef7e
push eax
test si, 0x5d98
push dword [ebp + 8]
mov dword [ebp - 0x218], 0x1c
clc
sub edi, edi
call sub.WS2_32.dll_getsockname
test eax, eax
jmp 0x27201abe

Function at 0x272b318f
Capabilities:
Send data
Send data on socket
Terminate process

Disassembly:
je 0x272b4463
cmp dword [ebp + 0x10], 0x2000
ja 0x272b4463
mov eax, dword [ebp + 8]
cmp eax, 0x1824901d
cmp eax, esi
jmp 0x272fefc7
mov ebp, esp
sub esp, 0x14
stc
push ebx
cmc
test edx, esi
push esi
test bx, di
clc
sub esi, esi
cmc
push edi
cmp dword [ebp + 0x10], esi
jmp 0x27277924
push ebp
bts bp, sp
cmp sp, cx
jmp 0x272aeaea
sub eax, eax
jmp fcn.271ad3ea
je 0x272b4463
mov eax, dword [eax + 0x28]
cmp edi, 0x2315909a
clc
add eax, 0x58
jmp loc.2708f496
Function at 0x272b726c
Capabilities:
Send data
Send data on socket
Set thread local storage value
Terminate process

Disassembly:
je 0x272ec161
cmp dword [ebp + 0x14], 0x10000
jmp 0x272a2817
jne 0x27298211
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jmp 0x271fea04
push dword [ebp + 0xc]
jmp 0x271b83df
call sub.WS2_32.dll_WSASend
mov edi, eax
jmp 0x272a1289
push ecx
jmp 0x273495f6
push 1
jmp 0x27294542
call fcn.2729eab9
mov eax, dword [esi + 0x2014c]
jmp 0x271dfec9
mov ebp, esp
clc
test esp, esp
lea esp, [esp - 0x14]
cmc
push ebx
test si, bx
push esi
test cx, 0x7a7
xor esi, esi
cmp si, bx
jmp 0x272559d1
push edi
jmp 0x2724e7bf
je 0x271edd2c
push 8
mov di, 0xe8c
pop ecx
jmp 0x272e869b
jne 0x272eb876
push str.ErrMsg
jmp 0x27278d15
push ebx
clc
add eax, 0x3c
jmp 0x272c91e5
push ecx
jmp 0x2734dc4a
je 0x27298211
mov esi, dword [ebp + 8]
seto al
xchg cx, cx
push dword [ebp + 0x1c]
cbw
lea eax, [esi + 0x20188]
movsx cx, bh
push eax
movzx cx, al
movzx ecx, ax
setg cl
mov ecx, esi
jmp 0x271bf925
rep movsd dword es:[edi], dword [esi]
push dword [sym.SocksCapExDLL32.dll_Ordinal_198]
jmp 0x2702bf2e
lea ecx, [ebp - 4]
jmp 0x271ba2ff
push dword [ebp + 0x10]
jmp 0x2733dd85
push edi
cmp dword [ebp + 0x14], esi
jmp 0x2718b4f6
jmp 0x272ec16a
leave
jmp 0x2702cdfb
push ecx
movsx ecx, bx
jmp 0x2724e55a
push 0x10
push str.Out_of_memory_
call fcn.27027248
add esp, 0xc
jmp 0x271ba918
call dword [sym.imp.msvcrt.dll_exit]
jmp 0x272eb876
sub eax, eax
inc eax
jmp 0x2725a060
cmp edi, 0xffffffff
jmp 0x271913d3
ja 0x272ec161
mov eax, dword [ebp + 8]
cmp bx, di
test ebp, ecx
cmp eax, esi
je 0x272ec161
mov eax, dword [eax + 0x2014c]
stc
add eax, 0x3c
jmp 0x272f4933
push ebp
jmp 0x271cb498
push eax
jmp 0x272ec15c
lea edi, [ebx + 0x10044]
push 1
jmp 0x2722e5c5
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], esi
xchg edi, eax
movzx edi, di
mov dword [ebp - 0x10], esi
bswap eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
xchg esi, eax
mov dword [ebp - 0x14], 0x2701cfb5
lea edi, [ebx + 0x20]
movsx esi, cx
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
nop
mov ah, 0xb3
movsd dword es:[edi], dword [esi]
setns al
movzx eax, bx
movsd dword es:[edi], dword [esi]
bswap esi
lahf
mov esi, dword [ebp + 8]
cbw
not eax
mov eax, esi
lea eax, [ebx + 0x30]
jmp 0x27304e77
call fcn.27001186
sub eax, eax
movzx esi, dx
cmovg si, bx
pop edi
pop esi
movzx ebx, sp
setns bl
not ebx
pop ebx
jmp 0x2726af6e
push eax
jmp 0x271b5665
push eax
call fcn.2700bae4
mov ebx, eax
test esp, 0x5631ab86
cmp ebx, esi
jmp 0x271de1e2
call fcn.27187909
mov edi, dword [ebp + 0x14]
jmp 0x271dccd5
push dword [ebx + 0x40]
call sub.msvcrt.dll_memcpy
mov esi, dword [ebp + 0x18]
xor ecx, ecx
lea eax, [ebx + 0x3c]
add esp, 0xc
cmp eax, eax
stc
mov dword [eax], edi
mov dword [ebp - 4], ecx
stc
cmp esi, ecx
jmp 0x271dde96
push 1
jmp 0x272f3dbd
push ebx
jmp 0x27272ae8
Function at 0x272b93e8
Capabilities:
Receive data
Receive data on socket

Disassembly:
ret 0xc
push ebx
jmp 0x272622af
push dword [edi]
jmp 0x2729adec
call fcn.2727eab5
mov ebx, eax
jmp 0x272642d5
jle 0x2734e2eb
push esi
jmp 0x2701c725
jle 0x272f4fcf
cmp word [edi + 0x16], 0x55
je 0x272eb403
cmp dword [edi + 0x7c], eax
jmp 0x272eb3f1
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0
push dword [ebp + 8]
jmp 0x272d5660
push 0x270c49a0
jmp 0x272df409
push esi
xchg esi, esi
not esi
push dword [ebp + 0x10]
jmp 0x2731dee1
lea esp, [esp + 0x14]
cmp ebx, 0xffffffff
je 0x272be497
cmp dword [ebp + 0xc], 0x2800
jmp 0x272720fb
jle 0x272df40e
push esi
jmp 0x27232f6e
call sub.WS2_32.dll_recv
mov ebx, eax
xor eax, eax
cmp ebx, eax
jmp 0x272bb598
call fcn.27001186
or eax, 0xffffffff
jmp 0x27359613
push ebp
and ax, 0x583d
mov ebp, esp
push ecx
bsf eax, eax
sub ax, sp
bsr eax, eax
mov eax, dword [0x270b313c]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x271c8ebc
call fcn.2708a280
mov esi, esp
jmp 0x27345eaf
jle 0x272f4fcf
cmp dword [ebp + 8], eax
je 0x272f4fcf
cmp esi, eax
jmp 0x27212e74
cmp dword [ebp + 0xc], 0x2800
jmp 0x272d6fbe
push ebx
jmp 0x272f5e0e
jle 0x272a2877
push esi
push 0x270c49a0
jmp 0x272a2872
call fcn.27001186
test ebx, ebx
jmp 0x272f4fc9
je 0x272f4fcf
cmp dword [edi + 0x80], eax
je 0x272f4fcf
cmp esi, 0x2800
jmp 0x27208629
je 0x272622b4
mov eax, ebx
shl ebx, cl
cmovs ebx, ebx
bts bx, ax
lea esp, [ebp - 0xc]
movsx ecx, bx
pop esi
inc bx
xor bx, sp
pop ebx
setns cl
rol ch, cl
mov cx, bx
mov ecx, dword [ebp - 4]
cmc
cmp si, 0x6139
xor ecx, ebp
jmp 0x27366023
push esi
jmp 0x2736a8cc
mov esi, dword [ebp + 0xc]
jmp 0x2735d8f9
push ebx
push dword [ebp + 8]
jmp 0x2721aa9b
mov eax, esi
jmp 0x272bafd3
push dword [ebp + 8]
jmp 0x271cb797
jmp 0x272f4fda
push esi
jmp 0x2735683e
call fcn.27088f70
leave
jmp 0x27188691
push edi
jmp 0x271d1b42

Function at 0x272c835c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push dword [ebp + 8]
jmp 0x2733d6f8
jmp 0x27358510
jne 0x272e837a
sub eax, eax
jmp 0x271d13a6
mov dword [ebp - 8], edi
jmp 0x27326b11
leave
ret
call sub.KERNEL32.dll_GetTickCount
mov ebx, dword [esi - 0x14]
jmp 0x2733469b
jmp 0x2735861c
push ebp
or ebp, ecx
mov ebp, esp
push ecx
cmp ah, dl
push ecx
stc
cmp ch, dl
push ebx
sub ebx, ebx
test ax, cx
cmp dword [ebp + 8], ebx
jmp 0x271de898
jne 0x271cd35f
jmp 0x2733469e
push esi
jmp 0x272e991e
push edi
movsx edi, bx
mov edi, 0x270c4aac
jmp 0x2722d26b
call fcn.27007877
mov esi, dword [0x270bb548]
not di
cmova di, si
mov dword [ebp - 4], 1
mov di, 0x7488
mov edi, 0x270bb548
jmp 0x272a8485
mov dword [esi - 4], eax
lea esi, [ebp - 8]
jmp loc.27006f43
push dword [esi - 0xc]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
bsf cx, ax
pop ecx
test edx, 0xdc33e603
clc
test eax, eax
jmp 0x27358613
pop ebx
jmp 0x27246522
je 0x2727174c
mov esi, dword [esi]
cmc
cmp esi, edi
jmp 0x272db3bc
Function at 0x272cb956
Capabilities:
Set thread local storage value

Disassembly:
jne fcn.2735948f
lea eax, [ebp - 0x78]
jmp 0x272a61f3
push dword [0x270c4ae4]
jmp loc.27009705
push eax
jmp 0x2727babc
push ebp
movsx ebp, dx
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x270b313c]
test ax, 0x55bb
clc
cmc
xor eax, ebp
clc
mov dword [ebp + 0x90], eax
cmc
push ebx
jmp 0x2734d1cd
call fcn.2700fd2a
test eax, eax
jmp 0x271d2783
push 0x270c4ae4
sub ebx, ebx
jmp 0x272ef675
Function at 0x272ce295
Capabilities:
Set socket configuration

Disassembly:
push eax
jmp 0x272706ed
je 0x272b72d1
mov edi, dword [sym.imp.msvcrt.dll_strncpy]
mov dword [esp + 0x14], 0x35
mov ebx, 0x100
clc
test di, sp
test esi, esi
je 0x2724d1b5
push ebx
lea eax, [esp + 0x38c]
jmp loc.2701b82c
push ebx
lahf
cbw
setge al
push dword [esp + 0x20]
lahf
lea eax, [esp + 0x490]
jmp 0x271806de
push ebx
test dx, si
mov dword [esp + 0x10], eax
bts ax, sp
sub ah, 0x3f
cmc
mov eax, dword [ebp + 0x1c]
cmc
cmp esi, 0x8f15ff17
push esi
mov esi, dword [ebp + 0xc]
stc
push edi
mov dword [esp + 0x24], eax
stc
cmp sp, cx
mov dword [esp + 0x20], ecx
test eax, eax
jmp 0x272dc8b4
call edi
mov ebx, 0xf0
push ebx
test ecx, ecx
sub edi, edi
nop
movsx eax, dx
movsx ax, dh
lea eax, [esp + 0x68]
jmp 0x272af28b
push edi
jmp loc.27018bf1
push edi
jmp 0x273607e0
push ebp
shr al, 0x23
mov ebp, esp
adc ax, di
and esp, 0xfffffff8
lahf
mov eax, 0x10584
jmp 0x273072b8
je 0x272b72d1
test ecx, ecx
jmp 0x271e2f92
call fcn.27088fa0
mov eax, dword [0x270b313c]
ror cx, 0xb6
btc cx, 0xa5
xor eax, esp
cmp bp, si
shl ch, 0x2f
or ecx, ebx
mov dword [esp + 0x10580], eax
shl cx, 0x93
mov eax, dword [ebp + 8]
sub cx, di
shl cx, 0x3b
mov ecx, dword [ebp + 0x20]
cmp ebp, 0x7cb2c50a
cmc
test dx, 0x8ca2
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
jmp 0x27257d8c
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [esp + 0x254]
jmp 0x272a042e

Function at 0x272d05f7
Capabilities:
Get system information on windows

Disassembly:
push dword [esp]
popfd
mov dword [esp], eax
jmp fcn.27205365
push ebp
pushfd
mov ebp, 0x9339ec28
shl ebp, 0xdd
or ebp, 0x28bd0523
xor ebp, 0x523aea5
mov ebp, dword [esp + 4]
mov dword [esp + 4], 0x8434295f
jae 0x272c3bbe