joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101ef930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x101ef9c6
push ebx
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
push edi
cmp esi, edx
jle 0x101ef97e
mov edi, dword [ecx]
movzx edi, byte [edi + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + 0x102a4e90]
inc edx
cmp edx, esi
jl 0x101ef960
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x101ef9a2
mov edi, dword [ecx + 8]
movzx edi, byte [edi + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + 0x102a4e90]
inc edx
cmp edx, esi
jl 0x101ef985
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop edi
shr eax, 0x18
pop esi
mov byte [ecx + 0x19], al
pop ebx
pop ebp
ret

Function at 0x101f0600
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x101f063c
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x101f0636
shr eax, 8
cmp al, 2
jne 0x101f0636
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov esp, ebp
pop ebp
ret
Function at 0x101fa420
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x101fa453
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret

Function at 0x101fa590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x2d8], 0
push edi
je case.default.0x101fa5d5
mov eax, dword [ebp + 0x18]
test eax, eax
je case.default.0x101fa5d5
mov edx, dword [eax + 0x9c]
test edx, edx
je case.default.0x101fa5d5
lea ecx, [ebx - 1]
mov eax, str.Data
cmp ecx, 3
ja case.default.0x101fa5d5
jmp dword [ecx*4 + 0x101fa6e8]
mov eax, str.Header
mov ecx, str.from
jmp 0x101fa5f2
mov eax, str.Header
mov ecx, 0x102a5c54
push edx
push ecx
push eax
push str.__s__s__s_
lea eax, [ebp - 0xa0]
push 0xa0
push eax
call fcn.10206140
lea eax, [ebp - 0xa0]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101fa617
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x101fa672
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [ebp - 0xa0]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x101fa6de
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x101fa6a2
mov ecx, dword [esi + 0x134]
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
push ecx
push ebx
push esi
call eax
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x102a5c30
call fcn.10233b39
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [ebp - 0xa0]
push edi
push edx
call fcn.10233b39
add esp, 0x20
jmp case.default.0x101fa5d5
test ebx, ebx
js 0x101fa6dc
cmp ebx, 2
jg 0x101fa6dc
mov edx, dword [esi + 0x130]
push edx
push 1
lea eax, [ebx + ebx*2 + 0x102a5c30]
push 2
push eax
call fcn.10233b39
mov ecx, dword [esi + 0x130]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ecx
push 1
push edx
push eax
call fcn.10233b39
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101fa700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x101fa7a9
cmp dword [esi + 0x324], 0
je 0x101fa7a9
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push ecx
lea edx, [ebp - 0x804]
push 0x801
push edx
call fcn.102060e0
lea eax, [ebp - 0x804]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101fa747
sub eax, edx
push edi
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x101fa77a
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [ebp - 0x804]
push edx
push 0
push esi
call eax
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x102a5c30
call fcn.10233b39
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [ebp - 0x804]
push edi
push edx
call fcn.10233b39
add esp, 0x20
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x101fa7b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push ecx
lea ebx, [esi + 0x5ac]
push 0x4000
push ebx
call fcn.102060e0
mov eax, dword [esi + 0x138]
add esp, 0x10
test eax, eax
je 0x101fa805
cmp dword [esi + 0x85d8], 0
jne 0x101fa805
push ebx
push 0x102591fc
push 0x100
push eax
call fcn.10206140
add esp, 0x10
mov dword [esi + 0x85d8], 1
cmp dword [esi + 0x324], 0
je 0x101fa880
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101fa813
sub eax, edx
push edi
mov edi, eax
cmp edi, 0x3fff
jae 0x101fa837
mov byte [edi + esi + 0x5ac], 0xa
inc edi
mov byte [edi + esi + 0x5ac], cl
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x101fa857
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push 0
push esi
call eax
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x102a5c30
call fcn.10233b39
mov ecx, dword [esi + 0x130]
push ecx
push 1
push edi
push ebx
call fcn.10233b39
add esp, 0x20
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x101fa890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov ecx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi]
lea eax, [ebp + 0x14]
push eax
push ecx
call fcn.10206b10
mov ecx, eax
add esp, 8
mov dword [ebp - 0x14], ecx
test ecx, ecx
jne 0x101fa8c2
pop edi
lea eax, [ecx + 0x1b]
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x101fa8c6
sub eax, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, dword [edi + 0x154]
mov edx, dword [ebp - 0xc]
sete al
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 8]
push edx
push ecx
mov dword [ebp - 0x10], 0
mov edx, dword [edi + eax*4 + 0x170]
push eax
push edi
call edx
mov ebx, eax
xor ecx, ecx
add esp, 0x14
cmp ebx, ecx
jge 0x101fa922
mov eax, dword [ebp - 0x10]
cmp eax, ecx
je 0x101faa0b
cmp eax, 0x51
jne 0x101faa06
xor ebx, ebx
mov dword [ebp - 4], ecx
cmp dword [esi + 0x324], ecx
je 0x101fa9f6
cmp dword [esi + 0x2d8], ecx
je 0x101fa9a3
mov eax, dword [edi + 0x9c]
cmp eax, ecx
je 0x101fa9a3
push eax
push 0x102a5c54
push str.Data
push str.__s__s__s_
lea eax, [ebp - 0xb4]
push 0xa0
push eax
call fcn.10206140
lea eax, [ebp - 0xb4]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101fa970
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x101fa9c3
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [ebp - 0xb4]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x101fa9f3
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x101fa9f6
mov ecx, dword [esi + 0x134]
mov edx, dword [ebp - 8]
push ecx
push ebx
push edx
push 4
push esi
call eax
add esp, 0x14
jmp 0x101fa9f6
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x102a5c30
call fcn.10233b39
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [ebp - 0xb4]
push edi
push edx
call fcn.10233b39
add esp, 0x20
jmp 0x101fa9a0
mov edi, dword [ebp + 0xc]
cmp ebx, dword [ebp - 0xc]
je 0x101faa12
sub dword [ebp - 0xc], ebx
add dword [ebp - 8], ebx
jmp 0x101fa8d5
mov dword [ebp - 4], eax
jmp 0x101faa12
mov dword [ebp - 4], 0x37
mov eax, dword [ebp - 0x14]
push eax
call dword [0x102d99b8]
mov eax, dword [ebp - 4]
add esp, 4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101faa30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax*4 + 0x150]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x101faaac
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x2733
jne 0x101faa81
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push eax
push esi
call fcn.102075f0
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.101fa7b0
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x85dc], edx
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x101fcb10
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x454], eax
push 4
lea ecx, [ebp - 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x101fcb4f
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.101fa700
add esp, 0xc
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x458]
push edx
mov dword [ebp - 0x14], 1
call fcn.10200810
imul eax, eax, 0x3e8
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x45c]
push eax
call fcn.10200810
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0xc
lea edx, [ebp - 0x14]
push edx
push 0x98000004
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x101fcbc1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.101fa700
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x101fd170
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x8c], 2
mov ebx, dword [esi]
mov dword [ebp - 8], ebx
je 0x101fd2d7
cmp dword [esi + 0x1e4], 0
push edi
jne 0x101fd2cd
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x8c]
push ecx
push edi
mov dword [ebp - 4], 0x80
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x101fd1e4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.102075f0
push eax
push edi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.101fa7b0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x10c]
push eax
push edi
mov dword [ebp - 4], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x101fd227
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.102075f0
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.101fa7b0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0xb6]
lea ebx, [esi + 0xe4]
lea esi, [ebp - 0x8c]
mov dword [ebp - 0xc], edi
call fcn.101fd130
test eax, eax
jne 0x101fd271
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov esi, eax
push esi
push ecx
call fcn.102075f0
mov edx, dword [ebp - 8]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.101fa7b0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
lea edi, [eax + 0x58]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [eax + 0x118]
lea edi, [eax + 0xe8]
lea esi, [ebp - 0x10c]
call fcn.101fd130
test eax, eax
jne 0x101fd2ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp + 8]
push esi
push eax
call fcn.102075f0
mov ecx, dword [ebp - 8]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.101fa7b0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push esi
call fcn.101fd0d0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101fd2e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x354]
push 4
lea ecx, [ebp - 4]
push ecx
push 1
push 6
push edx
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x101fd326
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.102075f0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.101fa700
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.101fa700
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101fd340
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x102de5b4]
mov dword [ebp - 4], 0x4020
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x101fd3cd
push 0x9c
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.10230cc0
add esp, 0xc
push 3
push 2
push 0
push 0
mov dword [ebp - 0xa8], 0x9c
mov dword [ebp - 0xa4], 6
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x101fd3c1
mov dword [0x102de5b4], 2
mov esp, ebp
pop ebp
ret
mov dword [0x102de5b4], 1
jmp 0x101fd3d2
cmp eax, 2
je 0x101fd413
push esi
mov esi, dword [ebp + 8]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x101fd3fb
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 4]
jg 0x101fd412
push 4
lea edx, [ebp - 4]
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x101fd440
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x5a0]
test esi, esi
je 0x101fd48b
mov eax, dword [edi + 0x44]
test eax, eax
je 0x101fd48b
push 0x101fd420
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], 0
mov edx, dword [eax + 0x30]
push ecx
push edx
call fcn.101fe840
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x101fd494
mov dword [edi + 0x5a0], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x101fd49d
mov dword [eax], esi
cmp dword [esi + 0x178], 0
mov edi, dword [esi + 0x150]
je 0x101fd4c2
push esi
call fcn.101f3a30
add esp, 4
test eax, eax
jne 0x101fd4d5
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x101fd48b
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x102055c0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edx
push eax
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x10205756
push edi
mov edi, dword [ebp - 0x10]
cmp edi, ebx
je 0x10205738
push esi
cmp dword [edi + 4], 2
jne 0x102056bc
cmp dword [edi + 0x18], ebx
je 0x102056bc
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x102056bc
cmp eax, 0x10
jb 0x102056bc
push 0x20
call dword [0x102d99b4]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x102056c9
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [0x102d99b4]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x102056d2
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x102056a7
push eax
call dword [0x102d99c0]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x102056e5
cmp dword [ebp - 4], ebx
jne 0x102056af
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x102056b9
mov dword [eax + 0x1c], esi
mov dword [ebp - 0xc], esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x10205602
jmp 0x10205700
mov dword [ebp - 8], 8
jmp 0x10205700
push esi
mov dword [ebp - 8], 8
call dword [0x102d99b8]
add esp, 4
jmp 0x10205700
mov edx, dword [esi + 0x18]
push edx
mov dword [ebp - 8], 8
call dword [0x102d99b8]
push esi
call dword [0x102d99b8]
add esp, 8
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, ebx
je 0x1020570f
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], ebx
je 0x10205733
mov eax, dword [ebp - 4]
push eax
call fcn.10205570
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
add esp, 4
mov ecx, ebx
pop edi
mov dword [ebp - 4], ebx
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], ebx
jne 0x1020574a
push 0x2af9
mov dword [ebp - 8], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [edx], ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10206bb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.102349f4
add esp, 0x18
test eax, eax
je 0x10206bd4
cmp eax, 0xffffffff
jne 0x10206bd6
xor eax, eax
pop ebp
ret
Function at 0x102077c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x102077d1
jmp dword [ecx*4 + 0x10207840]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret

Function at 0x102078b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dl, byte [edi]
test dl, dl
je 0x10207961
mov cl, byte [esi]
test cl, cl
je 0x10207961
movsx eax, dl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x102078da
jmp dword [eax*4 + 0x10207988]
mov dl, 0x41
jmp case.default.0x102078da
mov dl, 0x42
jmp case.default.0x102078da
mov dl, 0x43
jmp case.default.0x102078da
mov dl, 0x44
jmp case.default.0x102078da
mov dl, 0x45
jmp case.default.0x102078da
mov dl, 0x46
jmp case.default.0x102078da
mov dl, 0x47
jmp case.default.0x102078da
mov dl, 0x48
jmp case.default.0x102078da
mov dl, 0x49
jmp case.default.0x102078da
mov dl, 0x4a
jmp case.default.0x102078da
mov dl, 0x4b
jmp case.default.0x102078da
mov dl, 0x4c
jmp case.default.0x102078da
mov dl, 0x4d
jmp case.default.0x102078da
mov dl, 0x4e
jmp case.default.0x102078da
mov dl, 0x4f
jmp case.default.0x102078da
mov dl, 0x50
jmp case.default.0x102078da
mov dl, 0x51
jmp case.default.0x102078da
mov dl, 0x52
jmp case.default.0x102078da
mov dl, 0x53
jmp case.default.0x102078da
mov dl, 0x54
jmp case.default.0x102078da
mov dl, 0x55
jmp case.default.0x102078da
mov dl, 0x56
jmp case.default.0x102078da
mov dl, 0x57
jmp case.default.0x102078da
mov dl, 0x58
jmp case.default.0x102078da
mov dl, 0x59
jmp case.default.0x102078da
mov dl, 0x5a
push ecx
call fcn.102077c0
add esp, 4
cmp dl, al
jne 0x10207961
mov dl, byte [edi + 1]
inc edi
inc esi
test dl, dl
jne 0x102078c5
movzx eax, byte [edi]
push eax
call fcn.102077c0
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.102077c0
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
mov eax, ecx
pop ebp
ret
Function at 0x102079f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov dl, byte [ebx]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test dl, dl
je 0x10207ab5
lea esp, [esp]
mov cl, byte [esi]
test cl, cl
je 0x10207ab5
test edi, edi
je 0x10207ab9
movsx eax, dl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x10207a2d
jmp dword [eax*4 + 0x10207ae8]
mov dl, 0x41
jmp case.default.0x10207a2d
mov dl, 0x42
jmp case.default.0x10207a2d
mov dl, 0x43
jmp case.default.0x10207a2d
mov dl, 0x44
jmp case.default.0x10207a2d
mov dl, 0x45
jmp case.default.0x10207a2d
mov dl, 0x46
jmp case.default.0x10207a2d
mov dl, 0x47
jmp case.default.0x10207a2d
mov dl, 0x48
jmp case.default.0x10207a2d
mov dl, 0x49
jmp case.default.0x10207a2d
mov dl, 0x4a
jmp case.default.0x10207a2d
mov dl, 0x4b
jmp case.default.0x10207a2d
mov dl, 0x4c
jmp case.default.0x10207a2d
mov dl, 0x4d
jmp case.default.0x10207a2d
mov dl, 0x4e
jmp case.default.0x10207a2d
mov dl, 0x4f
jmp case.default.0x10207a2d
mov dl, 0x50
jmp case.default.0x10207a2d
mov dl, 0x51
jmp case.default.0x10207a2d
mov dl, 0x52
jmp case.default.0x10207a2d
mov dl, 0x53
jmp case.default.0x10207a2d
mov dl, 0x54
jmp case.default.0x10207a2d
mov dl, 0x55
jmp case.default.0x10207a2d
mov dl, 0x56
jmp case.default.0x10207a2d
mov dl, 0x57
jmp case.default.0x10207a2d
mov dl, 0x58
jmp case.default.0x10207a2d
mov dl, 0x59
jmp case.default.0x10207a2d
mov dl, 0x5a
push ecx
call fcn.102077c0
add esp, 4
cmp dl, al
jne 0x10207ab5
mov dl, byte [ebx + 1]
inc ebx
dec edi
inc esi
test dl, dl
jne 0x10207a10
test edi, edi
jne 0x10207ac3
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
movzx eax, byte [ebx]
push eax
call fcn.102077c0
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.102077c0
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
pop ebp
ret