joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cd4d
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x9463691e
push ss
add dword [0xa42cfb0c], edx
stc
or eax, 0x911675f0
adc edx, dword [ebp + 0x13]
mov byte [0xd070a6ac], al
std
and dword [edi + ebp*2], esp
xchg ebp, eax
mov dh, 0x1b
mov dword [0x673db0c3], eax
add ah, byte es:[ebx - 0x353a9b48]
arpl word [ebx - 0x76], sp
lodsd eax, dword [esi]
xchg edi, eax
sub dword [ebx], esp
xor al, byte [eax]
dec edx
jl 0x46cda2
insb byte es:[edi], dx
or bl, cl
mov ebx, 0x19681450
sbb dword [ebp - 0x17a70a64], esp
sti
lcall 0x149b, 0xe6f2e70d
cmp eax, 0x83ffa19
lea ebp, [ebp - 0x7d0a6b65]
wait
add esi, 0x3f
fidiv dword [eax + 0x7c]
adc al, 0x9b
wait
movsd dword es:[edi], dword [esi]
or esp, ebp
movsd dword es:[edi], dword [esi]
jno 0x46cd16
leave
lahf
push ebp
xor eax, 0x27e36173
cmp edi, dword [ebx - 0x1e]
test dword [eax - 0x6b15a8fe], ebx
sbb bl, cl
inc edi
cwde
mov ah, 0xe5
das
jle 0x46cde2
pop ecx
xchg ebp, eax
jmp 0x13227bf7
out dx, eax
adc esp, dword [ecx + 0x63]
or dword [edx], ebx
cmp byte [ebp - 0x397ab97e], ah
in eax, 0x36
xchg esi, eax
clc
pop edi
nop
jmp 0x46cd79
out 0xbe, al
adc eax, 0x3342297b
adc eax, 0x3342297b
cmp dword [edx - 0x89b9edb], ebp
push eax
dec ecx
mov byte [esi + 0x1d], dl
cmp esi, esp
add byte [edx + 0x7fa5aa7d], bh
mov edx, 0x336810dc
mov eax, 0x5350447c
jbe 0x46ce2e
pop edx
hlt
jbe 0x46ce55
out dx, eax
push ds
rol bl, 1
out 0x9d, al
sub dl, byte [edx + edi - 0x9755726]
arpl word [ebx + 0x2082f395], dx
mov ecx, edx
and bl, 0x19
scasd eax, dword es:[edi]
mov byte [0x437f9826], al
cwde
jg 0x46ce74
mov ebp, 0x89d51a25
push edx
sbb esp, edi
push cs
adc eax, ebx
salc
ficomp word [esi - 0x6a]
mov bl, 0xdb
pop es
sbb dword [eax], edx
loopne 0x46ce57
mov dh, 0x95
xchg esp, eax
xor dh, ch
inc ebx
sbb ebx, eax
sahf
jbe 0x46cde7
leave
inc esi
and ebp, esi
aam 0xe5
ja 0x46ce11
cld
add byte [ebx + 0x71], 0xa8
loopne 0x46ceda
inc ebp
push edx
pop eax
push esp
cmpsd dword [esi], dword es:[edi]
mov esi, 0xed7640da
lds edx, [edi + 0x6d090fcc]
invalid
and al, 0x3f
add al, 0xa2
add cl, dh
push 0x4e304c2
test eax, 0x54f7f923
push ebx
jle 0x46cf36
xor byte [edi - 0x38], al
mov bh, 0x48
push eax
sti
retf 0x5710
sahf
add al, 0x24
pop ds
jne 0x46cf95
add dword [ecx + 0x29], esp
mov dword [edi + edx*2], eax
push ecx
xchg edx, eax
adc ecx, ebx
pop ebp
cmc
cwde
invalid
cli
ficom dword [edi + 0x160ff8e6]
cld
rcr ebp, 0xfe
dec ebx
xchg esi, eax
and byte [ebx - 0x16], bl
clc
dec eax
push ebp
jecxz 0x46cff4
in al, 0x4c
out 0x33, eax
pop ebx
inc esp
or eax, 0xb770810e
mov dl, 0xb5
xchg esp, eax
cmp esp, esi
mov bh, 0xaf
sub bh, dh
mov dh, byte [ebx + edx + 0x6b]
mov eax, dword [0x33c56a97]
mov cl, 0xa6
int 0xa7
mov dl, 0x9a
sbb al, 0x1a
stc
push edi
shl byte [ebx], 1
test al, 0x4a
mov eax, dword [0x7b4824ab]
mov edi, 0x9263cb59
inc ebx
loop 0x46d060
xchg ebp, eax
invalid
popfd
jmp [ecx - 0x74]
mov edi, 0x9a3ad36a
lodsb al, byte [esi]
cwde
pop ebp
jle 0x46d065
sbb esi, dword [edx]
outsd dx, dword [esi]
in al, dx
mov esi, 0x4edc3965
cmp esp, ebx
dec esi
insd dword es:[edi], dx
salc
insd dword es:[edi], dx
mov esp, 0x50c16c7d
xor ebx, dword [ebp + 0x62]
jl 0x46d050
invalid
Function at 0x473e09
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5866d9
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473ed1
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x5866d9
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5803b4
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473f77
cmp edi, dword [esi + 0x7c]
jge 0x473f77
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0048881b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0048881b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5866d9
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5866d9
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473ec9
jmp 0x473e99
call fcn.0048ca42
int3
Function at 0x48b1c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059da99
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48b291
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059da99
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00597774
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48b337
cmp edi, dword [esi + 0x7c]
jge 0x48b337
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049fbdb
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049fbdb
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059da99
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059da99
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48b289
jmp 0x48b259
call fcn.004a3e02
int3
Function at 0x4b8f30
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf3e0
push 0x4b8e1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4c5d74], edx
mov ecx, eax
and ecx, 0xff
add byte [eax], al
mov dword [0x4c5d70], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c5d6c], ecx
shr eax, 0x10
mov dword [0x4c5d68], eax
push 1
call fcn.004ba00b
pop ecx
test eax, eax
jne 0x4b8f5f
push 0x1c
call fcn.004b9021
pop ecx
call fcn.004b9dc8
test eax, eax
jne 0x4b8f70
push 0x10
call fcn.004b9021
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004b9c0c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c6434], eax
call fcn.004b9ada
mov dword [0x4c5d58], eax
call fcn.004b988d
call fcn.004b97d4
call fcn.004b94e4
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b977c
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b8fbf
movzx eax, word [ebp - 0x2c]
jmp 0x4b8fc2
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b9511
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b9604
pop ecx
pop ecx
ret
Function at 0x4d0870
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x95000]
push edi
jmp 0x4d088a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d0891
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d0880
mov eax, 1
add ebx, ebx
jne 0x4d08a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d08b4
jne 0x4d08d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d08d3
dec eax
add ebx, ebx
jne 0x4d08c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d0898
add ebx, ebx
jne 0x4d08cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4d0925
xor ecx, ecx
sub eax, 3
jb 0x4d08eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d095a
sar eax, 1
mov ebp, eax
jmp 0x4d08f6
add ebx, ebx
jne 0x4d08f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d08c4
inc ecx
add ebx, ebx
jne 0x4d0904
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d08c4
add ebx, ebx
jne 0x4d0911
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d0906
jne 0x4d0922
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d0906
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d0944
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d0936
jmp 0x4d0886
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d0944
add edi, ecx
jmp 0x4d0886
pop esi
mov edi, esi
mov ecx, 0x3ba9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d0962
cmp byte [edi], 0x17
jne 0x4d0962
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4d0967
lea edi, [esi + 0xcd000]
mov eax, dword [edi]
or eax, eax
je 0x4d09df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe1bec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe1cc8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d0994
mov ecx, edi
jns 0x4d09c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe1ccc]
or eax, eax
je 0x4d09d9
mov dword [ebx], eax
add ebx, 4
jmp 0x4d09b1
call dword [esi + 0xe1cdc]
mov ebp, dword [esi + 0xe1cd0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4d0a13
sub esp, 0xffffff80
jmp 0x44a604
Function at 0x10002aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [eax + 0x70], 0
mov dword [eax + 0x4c], ecx
jne 0x10002ab3
mov dword [eax + 0x70], 1
mov dword [eax + 0x54], ecx
mov edx, ecx
sub edx, dword [eax + 0x54]
cmp edx, 0x2710
jge 0x10002ac8
cmp edx, 0xffffd8f0
jge 0x10002acd
mov dword [eax + 0x54], ecx
jmp 0x10002ad1
test edx, edx
js 0x10002aec
mov edx, dword [eax + 0x50]
add dword [eax + 0x54], edx
push esi
push edi
mov edi, ecx
sub edi, dword [eax + 0x54]
pop edi
pop esi
js 0x10002ae7
add edx, ecx
mov dword [eax + 0x54], edx
jmp fcn.100024b0
ret

Function at 0x10002c50
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x1001a1b0]
xor eax, esp
mov dword [esp + 0x198], eax
push edi
xor edi, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi], vtable.CTcpSocket.0
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, vtable.CBuffer.0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], eax
lea eax, [esp + 8]
push eax
push 0x202
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
lea ecx, [esi + 0x18]
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x19c]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x14], edi
pop edi
xor ecx, esp
mov dword [esi + 0x64], 0xffffffff
mov eax, esi
call fcn.10008295
mov esp, ebp
pop ebp
ret
Function at 0x10003230
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, eax
mov dword [ebp - 4], 0
cmp ebx, 0x40000
jl 0x1000328d
jmp 0x10003250
xor edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x64]
push 0
push 0x40000
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10003271
inc edi
cmp edi, 0xf
jl 0x10003252
cmp edi, 0xf
je 0x100032be
add dword [ebp - 4], eax
sub ebx, 0x40000
add esi, 0x40000
cmp ebx, 0x40000
jge 0x10003250
test ebx, ebx
jle 0x100032b6
xor edi, edi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x64]
push 0
push ebx
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x100032ae
inc edi
cmp edi, 0xf
jl 0x10003293
cmp edi, 0xf
je 0x100032be
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x100032c1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100034e0
Capabilities:
Create thread
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x198]
xor ebx, ebx
cmp eax, ebx
jne 0x10003502
mov dword [esi + 0x1b8], 0x598
jmp 0x10003519
cmp eax, 0x598
jbe 0x10003513
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x1b8], eax
push edi
mov dword [esi + 0x64], ebx
call fcn.10003640
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, 1
push 0x1001e990
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 5
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], eax
mov dword [ebp - 8], ebx
call edi
mov dword [esi + 0x48], eax
cmp eax, ebx
jne 0x10003558
push 0x1001e990
call edi
mov dword [esi + 0x48], eax
mov ecx, dword [esi + 0x40]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
mov ebx, 0x40000
push ecx
mov dword [ebp - 4], ebx
call edi
mov eax, dword [esi + 0x40]
push 4
lea edx, [ebp - 4]
push edx
push 0x1002
push 0xffff
push eax
mov dword [ebp - 4], ebx
call edi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.100036d0
test eax, eax
je 0x100035ed
lea eax, [esi + 0x58]
push eax
push 0
push esi
push 0x10003850
push 0
push 0
call fcn.10008c9b
add esp, 0x18
mov dword [esi + 0x54], eax
test eax, eax
je 0x100035df
mov ecx, dword [esi + 0x2c]
push ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x5c], 8
push 0x65f
jmp 0x100035fb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x5c], 0xb
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 5
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.10003f50
push edi
call ebx
mov edi, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100036d0
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001a1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x11
push 2
xor edi, edi
push 2
mov dword [ebp - 0x18], edi
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
jne 0x10003712
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008295
mov esp, ebp
pop ebp
ret 8
push edi
push edi
lea ecx, [ebp - 0x24]
push ecx
push edi
push edi
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x9800000c
push eax
mov dword [ebp - 0x1c], edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov ecx, dword [esi + 0x40]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 0x1c]
push eax
push 0xfffffffffffffffb
push 0xffff
push ecx
call edi
mov eax, dword [esi + 0x40]
push 4
lea edx, [ebp - 0x1c]
push edx
push 4
push 0xffff
push eax
call edi
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
push 0
push 0
push 0
push 0
push ebx
mov dword [esi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x20], eax
inc eax
push eax
call fcn.1000827f
mov ecx, dword [ebp - 0x20]
add esp, 4
push 0
push 0
push ecx
mov edi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x20]
push edi
mov byte [edi + edx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
push edi
mov ebx, eax
call fcn.1000828a
add esp, 4
test ebx, ebx
je 0x100036fe
mov ecx, dword [ebp + 0xc]
mov eax, 2
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x40]
push 0x30
push edx
push eax
mov dword [ebp - 0x10], ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x10003837
mov edx, dword [esi + 0x40]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x10003830
cmp eax, 0xffffffff
jne 0x10003827
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10003830
mov dword [ebp - 0x18], 0
jmp 0x10003837
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop edi
xor ecx, ebp
pop ebx
call fcn.10008295
mov esp, ebp
pop ebp
ret 8
Function at 0x10003bd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [eax + 0x14]
push ebx
test eax, eax
jne 0x10003bf3
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x40]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10003c0c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 2
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
xor eax, eax
pop ebx
ret
push edi
lea eax, [esi + 0x19c]
push eax
lea ecx, [esi + 0x1d8]
mov ebx, 1
push ecx
mov dword [esi + 0x60], ebx
mov ecx, esi
mov eax, esi
mov dword [esi + 0x64], ebx
call fcn.10004ae0
mov edx, dword [esi + 0x40]
xor edi, edi
push edi
push edi
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10003c55
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10003c55
xor edi, edi
mov eax, dword [esi + 0x48]
push eax
call fcn.10007ee0
add esp, 4
test edi, edi
pop edi
je 0x10003c70
mov eax, 0x80004005
call fcn.10001280
mov eax, ebx
pop ebx
ret

Function at 0x10003c80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esp, [esp]
mov eax, dword [ebx + 0x70]
mov ecx, dword [ebx + 0x40]
push 0
push 0x598
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x10003d52
cmp edi, 0x10
jne 0x10003cd8
mov edx, dword [ebx + 0x70]
mov ecx, eax
mov eax, 0x10018420
sub edx, eax
cmp ecx, 4
jb 0x10003d8a
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x10003cd8
sub ecx, 4
add eax, 4
jmp 0x10003cc0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebx + 0x1c0]
mov edx, dword [ebx + 0x1c8]
mov eax, dword [ebx + 0x70]
lea esi, [ebx + 0x1d8]
cmp edi, 0x18
jl 0x10003d06
push ecx
push edi
push eax
mov edi, edx
call fcn.10005060
jmp 0x10003d10
cmp edi, 0xc
jne 0x10003d80
call fcn.10004f10
cmp eax, 2
jne 0x10003c90
mov edx, dword [ebx + 0x48]
push edx
call fcn.10007ee0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10003d34
mov eax, 0x4c7
mov ecx, 1
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x34], 4
pop edi
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x38], eax
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
cmp edi, 0xffffffff
jne 0x10003c90
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10003da7
cmp eax, 0x2744
je 0x10003c90
cmp eax, 0x2746
je 0x10003c90
jmp 0x10003d34
push 0xd
call dword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x10003d19
xor eax, eax
pop edi
mov dword [ebx + 0x30], 1
mov dword [ebx + 0x34], 5
mov dword [ebx + 0x3c], eax
pop esi
mov dword [ebx + 0x38], eax
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4