joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6108c7e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
imul ecx, ecx, 0x28
add ecx, 0x20
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 8
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 0x18]
push edx
push 0x61082ff0
push 0x80002
mov eax, dword [0x610970ac]
push eax
call sub.rtutils.dll_TracePrintfExW
add esp, 0x18
push 0x61082fd4
mov ecx, dword [ebp - 4]
push ecx
call fcn.6108c430
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 2
mov eax, dword [ebp + 8]
add eax, 8
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4 + 0x18]
push ecx
push 0x61082fa8
push 0x80002
mov edx, dword [0x610970ac]
push edx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x1c
mov eax, dword [ebp + 8]
add eax, 8
push eax
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6108c8d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3e5
je 0x6108c8d2
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
push 0
call fcn.6108dd40
mov esp, ebp
pop ebp
ret 4

Function at 0x6108c8e0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
imul ecx, ecx, 0x28
add ecx, 0x20
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 8
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, 1
sub eax, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 0x18]
push edx
push 0x61083098
push 0x80002
mov eax, dword [0x610970ac]
push eax
call sub.rtutils.dll_TracePrintfExW
add esp, 0x18
push 0x61083080
mov ecx, dword [ebp - 4]
push ecx
call fcn.6108c430
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 3
mov eax, dword [ebp + 8]
add eax, 8
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, 1
sub eax, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x6108c9be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
je 0x6108c9be
mov eax, dword [ebp - 0xc]
push eax
push 0x61083054
push 0x10002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x10
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
add eax, 8
push eax
push 0
call fcn.6108db20
mov esp, ebp
pop ebp
ret 8
Function at 0x6108d790
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
sub eax, 0x6c
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0x2c
push 0x2c
push 0
mov edx, dword [ebp - 0xc]
add edx, 0x14
push edx
call sub.MSWSOCK.dll_GetAcceptExSockaddrs
push 0
push 0x6108dee0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
test eax, eax
jne 0x6108d81e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
push ecx
push 0x610833e0
push 0x80002
mov edx, dword [0x610970ac]
push edx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x14
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.6108d930
jmp 0x6108d918
push 4
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
push 0x700b
push 0xffff
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6108d885
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
push 0x61083368
push 0x80002
mov eax, dword [0x610970ac]
push eax
call sub.rtutils.dll_TracePrintfExW
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.6108d930
jmp 0x6108d918
mov ecx, dword [ebp - 0xc]
movsx edx, word [ecx + 0x110]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.6108c300
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x6108d8f9
mov edx, dword [ebp - 0xc]
add edx, 0x194
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0xc]
push eax
call fcn.6108c580
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1ac
push ecx
call fcn.6108d0e0
mov edx, dword [ebp - 0xc]
add edx, 0x194
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.6108c5a0
jmp 0x6108d906
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.6108c480
lea edx, [ebp - 0xc]
push edx
call fcn.6108ce10
mov esp, ebp
pop ebp
ret 8
Function at 0x6108d990
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
sub eax, 8
mov dword [ebp - 0xc], eax
xor ecx, ecx
add ecx, 0x20
mov edx, dword [ebp - 0xc]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x61083540
push 0x80002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x18
push 0
push 0
push 0x7010
push 0xffff
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6108da36
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
push 0x610834c8
push 0x80002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x14
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.6108da70
jmp 0x6108da5c
mov edx, dword [ebp - 4]
add edx, 0x20
push edx
call fcn.6108c7e0
mov eax, dword [ebp - 4]
add eax, 0x48
push eax
call fcn.6108c7e0
push 0x610834a8
lea ecx, [ebp - 4]
push ecx
call fcn.6108cd90
mov esp, ebp
pop ebp
ret 8
Function at 0x6108db20
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
sub eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
imul edx, edx, 0x28
add edx, 0x20
mov eax, dword [ebp - 4]
sub eax, edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x61083770
push 0x100002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x18
cmp dword [ebp + 0x10], 0x40
jne 0x6108dbe0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x24], 0
jne 0x6108db82
mov dword [ebp - 0x10], 0x61083764
jmp 0x6108db89
mov dword [ebp - 0x10], 0x61083758
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x61083720
push 0x100002
mov edx, dword [0x610970ac]
push edx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x80
push 0xffff
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
jmp 0x6108dbfd
mov eax, dword [ebp + 0x10]
push eax
push 0x610836ec
push 0x10002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x10
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
jne 0x6108dc8d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x18]
push eax
push 0x610836a8
push 0x80002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x10
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_shutdown]
cmp eax, 0xffffffff
jne 0x6108dc81
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x61083658
push 0x80002
mov edx, dword [0x610970ac]
push edx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x14
lea eax, [ebp - 8]
push eax
call fcn.6108cc90
jmp 0x6108dc8b
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 1
jmp 0x6108dc96
lea edx, [ebp - 8]
push edx
call fcn.6108cc90
push 0x61083634
lea eax, [ebp - 8]
push eax
call fcn.6108cd90
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6108dd40
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
sub eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
imul edx, edx, 0x28
add edx, 0x20
mov eax, dword [ebp - 4]
sub eax, edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x61083880
push 0x10002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x18
cmp dword [ebp + 0x10], 0x40
jne 0x6108de05
mov edx, dword [ebp - 4]
cmp dword [edx + 0x24], 0
jne 0x6108dda2
mov dword [ebp - 0x10], 0x61083764
jmp 0x6108dda9
mov dword [ebp - 0x10], 0x61083758
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x61083720
push 0x100002
mov edx, dword [0x610970ac]
push edx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x80
push 0xffff
mov edx, dword [ebp - 4]
mov eax, 1
sub eax, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
jmp 0x6108de22
mov eax, dword [ebp + 0x10]
push eax
push 0x61083840
push 0x10002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x10
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
jne 0x6108debc
mov eax, dword [ebp - 4]
mov ecx, 1
sub ecx, dword [eax + 0x24]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x18]
push eax
push 0x610836a8
push 0x80002
mov ecx, dword [0x610970ac]
push ecx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x10
push 1
mov edx, dword [ebp - 4]
mov eax, 1
sub eax, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_shutdown]
cmp eax, 0xffffffff
jne 0x6108deb0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x61083658
push 0x80002
mov edx, dword [0x610970ac]
push edx
call sub.rtutils.dll_TracePrintfExW
add esp, 0x14
lea eax, [ebp - 8]
push eax
call fcn.6108cc90
jmp 0x6108deba
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 1
jmp 0x6108dec5
lea edx, [ebp - 8]
push edx
call fcn.6108cc90
push 0x61083818
lea eax, [ebp - 8]
push eax
call fcn.6108cd90
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6108e220
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x100
jae 0x6108e322
cmp dword [ebp + 0xc], 0
jne 0x6108e26f
mov edx, dword [ebp + 8]
push edx
call fcn.6108e100
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x6108e265
mov eax, dword [ebp - 4]
jmp 0x6108e338
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x14], 4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x28
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x18
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x34
push ecx
lea edx, [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp + 0xc]
add eax, 0x2c
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x6108e2b6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6108e2d6
cmp dword [ebp - 0x14], 0x3e5
je 0x6108e308
cmp dword [ebp - 0x14], 0x2746
je 0x6108e31d
jmp 0x6108e322
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp edx, 5
jbe 0x6108e2fc
mov eax, dword [ebp - 4]
jmp 0x6108e338
mov dword [ebp + 0xc], 0
jmp 0x6108e238
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x6108e338
jmp 0x6108e238
cmp dword [ebp + 0xc], 0
je 0x6108e335
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.6108e1d0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x6108e3a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x18
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x34]
push ecx
lea edx, [ebp - 8]
push edx
push 1
mov eax, dword [ebp + 0xc]
add eax, 0x2c
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x6108e3f1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x6108e3f6
mov eax, dword [ebp + 0xc]
jmp 0x6108e448
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x18
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x34]
push edx
lea eax, [ebp - 8]
push eax
push 1
mov ecx, dword [ebp + 0xc]
add ecx, 0x2c
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
push eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x6108e441
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x6108e445
xor eax, eax
jmp 0x6108e448
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x6108e4d0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push 1
push 0
push 0
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x44], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x44], 0xffffffff
jne 0x6108e504
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6108e60a
push 0x10
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x6108e524
jmp 0x6108e5f5
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x268]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
test eax, eax
jne 0x6108e546
jmp 0x6108e5f5
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
jne 0x6108e568
jmp 0x6108e5f5
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x6108e585
jmp 0x6108e5f5
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0x6108e350
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x6108e5ac
jmp 0x6108e5f5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
mov ecx, dword [ebp + 8]
add ecx, 0x34
push ecx
push 9
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 4]
push ecx
push 0xb
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
jmp 0x6108e60a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.6108e460
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x6108e620
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0
jne 0x6108e64e
mov eax, dword [ebp + 8]
push eax
call fcn.6108e100
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x6108e644
xor eax, eax
jmp 0x6108e6af
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x14], 9
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x28
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x18
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x34
push edx
lea eax, [ebp - 8]
push eax
push 1
mov ecx, dword [ebp + 0xc]
add ecx, 0x2c
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x48]
push eax
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x6108e699
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x6108e6a0
mov eax, 1
jmp 0x6108e6af
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.6108e1d0
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x6108e6c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x18
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x34]
push ecx
lea edx, [ebp - 8]
push edx
push 1
mov eax, dword [ebp + 0xc]
add eax, 0x2c
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x48]
push edx
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x6108e711
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x6108e716
mov eax, dword [ebp + 0xc]
jmp 0x6108e768
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x18
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x34]
push edx
lea eax, [ebp - 8]
push eax
push 1
mov ecx, dword [ebp + 0xc]
add ecx, 0x2c
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x48]
push eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x6108e761
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x6108e765
xor eax, eax
jmp 0x6108e768
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x6108e7b0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x61097948]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0
je 0x6108e7f3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x40]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov ecx, dword [edx + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp - 8], ecx
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
jmp 0x6108e810
mov edx, dword [ebp + 8]
add edx, 0x20
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov ecx, dword [edx + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp - 8], ecx
push 1
push 0
push 0
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edx, dword [ebp + 8]
mov dword [edx + 0x48], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x48], 0xffffffff
jne 0x6108e83c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6108e952
mov dword [ebp - 0x20], 1
push 4
lea ecx, [ebp - 0x20]
push ecx
push 4
push 0xffff
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x48]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6108e867
jmp 0x6108e93d
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x48]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x6108e884
jmp 0x6108e93d
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x268]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
test eax, eax
jne 0x6108e8a6
jmp 0x6108e93d
mov edx, dword [ebp + 8]
cmp dword [edx + 0x40], 0
je 0x6108e900
mov dword [ebp - 0x1c], 0
push 4
lea eax, [ebp - 0x1c]
push eax
push 0xb
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x48]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x34]
mov dword [ebp - 0x28], ecx
push 8
lea edx, [ebp - 0x2c]
push edx
push 0xc
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x48]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6108e900
jmp 0x6108e93d
mov dword [ebp - 0x18], 0
jmp 0x6108e912
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 5
jae 0x6108e92b
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.6108e620
test eax, eax
jne 0x6108e929
jmp 0x6108e92b
jmp 0x6108e909
cmp dword [ebp - 0x18], 0
je 0x6108e935
xor eax, eax
jmp 0x6108e952
push 0x1e
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.6108e780
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
call fcn.61095de2
mov esp, ebp
pop ebp
ret 4