joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3f748d07
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_FindResourceW]
push 0xa
push 0x3e7
mov esi, ecx
push dword [0x3f7ea024]
call edi
mov ebx, dword [sym.imp.kernel32.dll_LoadResource]
push eax
push dword [0x3f7ea024]
call ebx
mov ebp, dword [sym.imp.kernel32.dll_LockResource]
push eax
call ebp
push 0xa
push 0x3e6
mov dword [esi + 0x950], eax
push dword [0x3f7ea024]
call edi
push eax
push dword [0x3f7ea024]
call ebx
push eax
call ebp
push 0xa
push 0x3e5
mov dword [esi + 0x94c], eax
push dword [0x3f7ea024]
call edi
push eax
push dword [0x3f7ea024]
call ebx
push eax
call ebp
movzx eax, word [eax]
lea edi, [esi + 0x95c]
push 4
mov dword [edi], eax
shl eax, 2
push eax
call fcn.3f7448c0
mov dword [esi + 0x954], eax
mov eax, dword [edi]
shl eax, 1
push eax
call fcn.3f6e901c
add esp, 0xc
mov dword [esi + 0x958], eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x3f7ae8b6
Capabilities:
Accept command line arguments

Disassembly:
cmp dword [esp + 8], 1
jne 0x3f7ae93b
call dword [sym.imp.kernel32.dll_GetVersion]
push 0
mov dword [0x3f7ead10], eax
call fcn.3f7aebe8
test eax, eax
pop ecx
je 0x3f7e29c5
mov eax, dword [0x3f7ead10]
xor ecx, ecx
mov cl, byte [0x3f7ead11]
and eax, 0xff
shr dword [0x3f7ead10], 0x10
mov dword [0x3f7ead18], eax
mov dword [0x3f7ead1c], ecx
shl eax, 8
add eax, ecx
mov dword [0x3f7ead14], eax
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x3f7eae40], eax
call fcn.3f7aec83
mov dword [0x3f7ead08], eax
call fcn.3f7aed2c
call fcn.3f7c0e62
call fcn.3f7af5fc
call fcn.3f7af6b6
inc dword [0x3f7ead04]
push 1
pop eax
ret 0xc
xor eax, eax
cmp dword [esp + 8], eax
jne 0x3f7ae935
cmp dword [0x3f7ead04], eax
jle 0x3f7e29c5
dec dword [0x3f7ead04]
cmp dword [0x3f7ead20], eax
jne 0x3f7ae962
call fcn.3f7ae9a8
call fcn.3f7aeb4e
call fcn.3f7aeb73
jmp 0x3f7ae935
xor eax, eax
jmp 0x3f7ae938

Function at 0x3f7ae9b7
Capabilities:
Terminate process

Disassembly:
push edi
push 1
pop edi
cmp dword [0x3f7eae64], edi
je 0x3f7e3905
cmp dword [esp + 0xc], 0
push ebx
mov ebx, dword [esp + 0x14]
mov dword [0x3f7ead20], edi
mov byte [0x3f7eae60], bl
jne 0x3f7ae9fd
mov eax, dword [0x3f7eae68]
test eax, eax
jne 0x3f7e391b
push 0x3f7eae50
push 0x3f7eae48
call fcn.3f7ae96e
pop ecx
pop ecx
push 0x3f7eae5c
push 0x3f7eae54
call fcn.3f7ae96e
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x3f7e3942
pop edi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
jmp 0x3f7ae9c7
mov ecx, dword [0x3f7f9da0]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x3f7e393c
mov eax, dword [esi]
test eax, eax
je 0x3f7e3931
call eax
sub esi, 4
cmp esi, dword [0x3f7eae68]
jae 0x3f7e3929
pop esi
jmp 0x3f7ae9ec
push dword [esp + 8]
mov dword [0x3f7eae64], edi
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x3f7aec83
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x3f7eb338]
push ebx
push ebp
mov ebp, dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x3f7e551f
call ebp
mov esi, eax
cmp esi, ebx
je 0x3f7e5503
mov dword [0x3f7eb338], 1
cmp esi, ebx
je 0x3f7e5529
cmp word [esi], bx
mov eax, esi
je 0x3f7aecd5
inc eax
inc eax
cmp word [eax], bx
jne 0x3f7aecc7
inc eax
inc eax
cmp word [eax], bx
jne 0x3f7aecc7
sub eax, esi
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sar eax, 1
push ebx
push ebx
inc eax
push ebx
push ebx
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x3f7aed1c
push ebp
call fcn.3f6e901c
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x3f7aed1c
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x3f7e5536
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x3f7e559d
mov dword [0x3f7eb338], 2
jmp 0x3f7e554e
cmp eax, 1
jne 0x3f7e5549
jmp 0x3f7aecb8
call ebp
mov esi, eax
cmp esi, ebx
je 0x3f7e559d
jmp 0x3f7aecc0
push dword [esp + 0x10]
call fcn.3f6e9364
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x3f7aed18
cmp eax, 2
jne 0x3f7e559d
cmp edi, ebx
jne 0x3f7e555e
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x3f7e559d
cmp byte [edi], bl
mov eax, edi
je 0x3f7e556e
inc eax
cmp byte [eax], bl
jne 0x3f7e5564
inc eax
cmp byte [eax], bl
jne 0x3f7e5564
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.3f6e901c
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x3f7e5584
xor esi, esi
jmp 0x3f7e558f
push ebp
push edi
push esi
call fcn.3f7c0e62
add esp, 0xc
push edi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
mov eax, esi
jmp 0x3f7aed25
xor eax, eax
jmp 0x3f7aed25
Function at 0x3f7c0e62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x3f7c0e71
pop dword [ebp - 0x20]
mov eax, 0xf2bb7a66
sub eax, 0xb33f6bf5
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x4d298
push 0
mov eax, 0x10531c87
add eax, 0x2f19f419
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x17a4199e
sub ecx, 0x17a3cf2a
mov ebx, eax
mov esi, 0xd163ce14
sub esi, 0x91e0ce14
add esi, dword [ebp - 0x20]
mov edx, 0x7c70fa8a
sub edx, 0x96f08079
mov edi, dword [esi]
sub dword [ebp - 0x10], 0x244a3f4
xor edi, edx
add dword [ebp - 0x18], eax
mov dword [ebx], edi
add ebx, 0x4a565dcc
add ebx, 0xb5a9a238
add esi, 0xe894e039
sub esi, 0xe894e035
loop 0x3f7c0ed0
add eax, 0x52bb6568
add eax, 0xad45b73b
xor ebx, ebx
add ebx, eax
add eax, 0x3ab790a8
sub eax, 0x3ab790a3
mov ecx, 0xe5efe966
add ecx, 0x597d169a
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10025582
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10025591
pop dword [ebp - 0xc]
mov eax, 0xb5f241d9
add eax, 0x5a1013b8
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x93d87d2c
sub dword [ebp - 0x1c], 0x458637e1
mov dword [ebp - 0x18], 0xf6fdca6
sub dword [ebp - 0x18], 0xdd3c9061
mov dword [ebp - 0x14], 0xbd812c43
sub dword [ebp - 0x14], 0x7134e815
mov dword [ebp - 0x10], 0xfc2e92c8
add dword [ebp - 0x10], 0x3d16d38
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xb5230c91
add eax, 0x5ae2f37f
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x3ce33eb7
add dword [ebp - 0x1c], 0x378f2a9f
mov dword [ebp - 0x18], 0xaeb4e119
add dword [ebp - 0x18], 0x92b7805c
mov dword [ebp - 0x14], 0x66ad61d7
sub dword [ebp - 0x14], 0x33df56b
mov dword [ebp - 0x10], 0x65618aa4
sub dword [ebp - 0x10], 0x65618aa4
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xea1573eb
sub eax, 0xda0f73d7
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x547fb
push 0
call eax
mov ecx, 0x4277
mov esi, eax
mov edx, 0x1008bc00
add edx, dword [ebp - 0xc]
mov ebx, 0xd97f640c
sub ebx, 0xb1c998d3
mov dword [ebp - 8], 0xca6d8f76
mov edi, dword [edx]
xor dword [ebp - 8], esi
sub edi, ebx
add dword [ebp - 8], edi
mov dword [esi], edi
add dword [ebp - 8], eax
add esi, 4
add edx, 4
loop 0x100256a7
add eax, 0xb57bc99f
sub eax, 0xb57accf0
mov ebx, eax
add eax, 0xe16b8630
add eax, 0x1e9479d5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x6d665180
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x6d6715b4]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x6d6651b6
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d6652b0
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x6d6651ea
push str.create
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d6652af
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x6d67117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x6d66529c
push dword [0x6d6715a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x6d665245
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d665262
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6d665280
push str.create
push esi
call fcn.6d663a00
pop ecx
pop ecx
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x6d67117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call fcn.6d66b24a
jmp 0x6d6652ae
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x6d67117c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x6d6652ae
push 0
push dword [0x6d6715a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x6d6662df
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x28], eax
call fcn.6d664fdf
push edi
mov ebx, eax
call fcn.6d66500b
pop ecx
pop ecx
test ebx, ebx
jns 0x6d66633c
test eax, eax
jns 0x6d66633a
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
leave
ret 0x10
mov ebx, eax
cmp dword [ebp + 0x10], 0xf
jne 0x6d6663d1
mov dword [ebp - 0x30], 0x1c
cmp ebx, 0xffffffff
jne 0x6d66635b
push edi
call fcn.6d66500b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x6d666383
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.6d66b24a
add esp, 0xc
jmp 0x6d666326
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.6d66b24a
mov edi, eax
test edi, edi
je 0x6d666326
push dword [ebp - 0x28]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d666326
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x28]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x6d666329
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x6d6663ef
push str.Invalid_option
jmp 0x6d66631b
mov edi, 0x80
mov dword [ebp - 0x2c], 4
cmp dword [ebp + 0x10], edi
je 0x6d666404
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call fcn.6d66b24a
test eax, eax
jns 0x6d66642e
push str.getsockopt
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d666326
mov eax, dword [ebp + 0x10]
cmp eax, 8
jg 0x6d66644c
je 0x6d666465
dec eax
je 0x6d666465
dec eax
dec eax
je 0x6d666476
dec eax
je 0x6d666465
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x6d66631b
cmp eax, edi
je 0x6d66647e
cmp eax, 0x1000
jle 0x6d666442
cmp eax, 0x1002
jle 0x6d666476
cmp eax, 0x1003
jne 0x6d666442
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x6d666329
mov eax, dword [ebp - 0x24]
jmp 0x6d666329
cmp word [ebp - 0x24], 0
je 0x6d666326
movzx eax, word [ebp - 0x22]
jmp 0x6d666329
Function at 0x6d6664df
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push dword [0x6d6715b4]
mov esi, dword [esp + 0xc]
push dword [esp + 0x10]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
test eax, eax
jne 0x6d666507
push str.Socket_closed
push str.java_net_SocketException
jmp 0x6d66654c
push dword [0x6d67117c]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x190]
cmp eax, 0xffffffff
je 0x6d6664fb
push 1
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x6d666540
push str.send
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d666552
cmp eax, 0xfffffffe
jne 0x6d666552
push 0
push str.java_io_InterruptedIOException
push esi
call sub.java.dll__JNU_ThrowByName_12
pop esi
ret 0xc

Function at 0x6d66659a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
xor eax, eax
cmp byte [ebp + 0x10], al
push esi
sete al
push 0
inc eax
push eax
push 0x17
call fcn.6d66465c
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x6d6665d8
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call fcn.6d66b24a
or eax, esi
jmp 0x6d66660f
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6d666602
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call fcn.6d66b24a
push 0
push 1
push esi
call dword [sym.imp.kernel32.dll_SetHandleInformation]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x6d66667f
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push 1
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call fcn.6d66b24a
test eax, eax
jne 0x6d666701
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d666704
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x6d6666dc
push 0xfffffffffffffffe
pop eax
jmp 0x6d666704
cmp eax, 0x2741
jne 0x6d6666f5
push str.connect:_Address_is_invalid_on_local_machine__or_port_is_not_valid_on_remote_machine
push str.java_net_ConnectException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d666701
push str.connect
push eax
push esi
call fcn.6d66b24a
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d66b1da
leave
ret 0x14
Function at 0x6d666713
Capabilities:
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0x198], eax
xor eax, eax
inc eax
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0x1b0]
cdq
mov ecx, 0x3e8
idiv ecx
push ebx
push esi
mov esi, dword [ebp + 0x1ac]
push edi
mov edi, dword [ebp + 0x1a4]
xor ebx, ebx
mov dword [ebp - 0x78], 4
mov dword [ebp - 0x6c], esi
mov dword [ebp + 0x98], esi
mov dword [ebp - 0x80], eax
imul edx, edx, 0x3e8
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x94]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x7c], edx
call dword [sym.imp.ws2_32.dll_select]
mov dword [ebp - 0x74], eax
cmp eax, ebx
jne 0x6d6667b1
push str.connect_timed_out
push str.java_net_SocketTimeoutException
push edi
call sub.java.dll__JNU_ThrowByName_12
push 2
push esi
call dword [sym.imp.ws2_32.dll_shutdown]
jmp 0x6d666814
lea eax, [ebp + 0x94]
push eax
push esi
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x6d666814
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x1007
push 0xffff
push esi
call fcn.6d66b24a
cmp dword [ebp - 0x74], 0
jne 0x6d666806
push 0
call dword [sym.imp.kernel32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x6d6667c2
cmp dword [ebp - 0x74], 0
jne 0x6d666806
push str.Unable_to_establish_connection
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d666814
push str.connect
push dword [ebp - 0x74]
push edi
call fcn.6d66b24a
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
add ebp, 0x19c
leave
ret 0x10

Function at 0x6d66682e
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d666895
push esi
mov esi, dword [sym.imp.ws2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2736
jne 0x6d666881
push str.Socket_closed
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d66688f
push str.getsockname_failed
call esi
push eax
push edi
call fcn.6d66b24a
or eax, 0xffffffff
pop esi
jmp 0x6d6668a3
movzx eax, word [ebp - 0x1e]
push eax
call dword [sym.imp.ws2_32.dll_ntohs]
movzx eax, ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.6d66b1da
leave
ret 0xc
Function at 0x6d6668b2
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d6668fb
push str.Error_getting_socket_name
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call fcn.6d66b24a
jmp 0x6d66693c
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.6d66b24a
mov ebx, eax
test ebx, ebx
je 0x6d66693b
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d66693b
mov ecx, dword [esi]
push ebx
push eax
push edi
push esi
call dword [ecx + 0x1a0]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.6d66b1da
leave
ret 0x10

Function at 0x6d666bf1
Capabilities:
Send data
Send data on socket

Disassembly:
push 1
push 1
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x6d666c20
push str.send
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [esp + 0xc]
call fcn.6d66b24a
jmp 0x6d666c35
cmp eax, 0xfffffffe
jne 0x6d666c35
push 0
push str.java_io_InterruptedIOException
push dword [esp + 0xc]
call sub.java.dll__JNU_ThrowByName_12
ret 0x10
Function at 0x6d666da4
Capabilities:
Check os version
Get hostname
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0x124]
sub esp, 0x1a4
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0x120], eax
cmp byte [0x6d67119b], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x12c]
mov dword [ebp - 0x7c], edi
jne 0x6d666f03
mov esi, 0x6d6711d4
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp byte [0x6d67119b], 0
jne 0x6d666efc
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x74], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x64], 1
mov byte [0x6d67119a], 0
jne 0x6d666e28
cmp dword [ebp - 0x70], 4
jne 0x6d666e28
cmp dword [ebp - 0x6c], 0
je 0x6d666e21
cmp dword [ebp - 0x6c], 0xa
jne 0x6d666e28
mov byte [0x6d67119a], 1
lea eax, [ebp - 0x80]
push eax
push 0x6d6711d0
push 0x2003
push 0xffff
push dword [ebp + 0x130]
mov dword [ebp - 0x80], 4
call fcn.6d66b24a
test eax, eax
jns 0x6d666e5b
mov dword [0x6d6711d0], 0xfff7
cmp byte [0x6d67119a], 0
je 0x6d666ef5
push 0xff
lea eax, [ebp + 0x20]
push eax
call dword [sym.imp.ws2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x6d666e9a
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push str.Unable_to_obtain_hostname
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
mov al, 1
jmp 0x6d666f88
lea eax, [ebp + 0x20]
push eax
call dword [sym.imp.ws2_32.dll_gethostbyname]
test eax, eax
je 0x6d666ef5
mov eax, dword [eax + 0xc]
mov edi, dword [eax]
mov dword [ebp - 0x78], eax
test edi, edi
je 0x6d666ef5
mov esi, dword [0x6d6711f0]
push 8
call dword [sym.imp.msvcr100.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x6d666f3f
push dword [edi]
call dword [sym.imp.ws2_32.dll_htonl]
add dword [ebp - 0x78], 4
mov dword [ebx], eax
mov eax, dword [0x6d6711f0]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x78]
mov edi, dword [eax]
mov esi, ebx
mov dword [0x6d6711f0], esi
test edi, edi
jne 0x6d666eba
mov esi, 0x6d6711d4
mov byte [0x6d67119b], 1
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0x138]
cmp eax, dword [0x6d6711d0]
jg 0x6d666e93
cmp byte [0x6d67119a], 0
je 0x6d666f86
cmp eax, 0x2ff8
jle 0x6d666f86
mov ecx, dword [ebp + 0x134]
mov eax, 0x7f000000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x6d666e93
mov eax, dword [0x6d6711f0]
jmp 0x6d666f82
test esi, esi
je 0x6d666f5a
mov edi, dword [esi + 4]
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
mov esi, edi
test edi, edi
jne 0x6d666f43
mov dword [0x6d6711f0], esi
push 0x6d6711d4
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push str.heap_allocation_failed
push dword [ebp - 0x7c]
call sub.java.dll__JNU_ThrowOutOfMemoryError_8
jmp 0x6d666e93
cmp dword [eax], ecx
je 0x6d666e93
mov eax, dword [eax + 4]
test eax, eax
jne 0x6d666f77
xor al, al
mov ecx, dword [ebp + 0x120]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
add ebp, 0x124
leave
ret
Function at 0x6d66700d
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x128
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push esi
xor esi, esi
mov byte [ebp - 0x6d], 0
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], 0x10
call fcn.6d66b24a
test al, al
je 0x6d6670d0
lea ecx, [ebp - 0x7c]
push ecx
push esi
push esi
mov esi, dword [sym.imp.ws2_32.dll_select]
lea ecx, [ebp - 0x6c]
lea eax, [ebx + 1]
push ecx
push eax
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], 1
call esi
test eax, eax
jle 0x6d6670cd
push edi
mov edi, dword [sym.imp.ws2_32.dll_recvfrom]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x98]
push eax
push 2
push 1
lea eax, [ebp - 0x6e]
push eax
push ebx
call edi
cmp eax, 0xffffffff
jne 0x6d6670cc
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x6d6670cc
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x98]
push eax
push 0
push 1
lea eax, [ebp - 0x6e]
push eax
push ebx
call edi
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebx + 1]
push eax
mov byte [ebp - 0x6d], 1
call esi
test eax, eax
jg 0x6d667074
pop edi
mov al, byte [ebp - 0x6d]
mov ecx, dword [ebp + 0xa8]
xor ecx, ebp
pop esi
call fcn.6d66b1da
add ebp, 0xac
leave
ret