joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56bc7b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056bafa

Function at 0x5719d1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057133f

Function at 0x5719dc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057157a

Function at 0x57813e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x58d470
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x58d4c4
push 0xc
call fcn.00544535
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x58d4b2
mov eax, dword [ebp + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 4], esi
mov dword [ecx + 8], eax
pop esi
pop ebp
jmp 0x58d6b0
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ecx + 4], esi
mov dword [ecx + 8], eax
pop esi
pop ebp
jmp 0x58d6b0
pop esi
pop ebp
ret
push esi
push 0xc
mov esi, ecx
call fcn.00544535
add esp, 4
mov dword [eax], esi
mov edx, dword [esi + 4]
push 0
push 4
push eax
push 0x58d4d0
push 0
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
push 0
mov dword [eax + 8], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
jmp dword [sym.imp.KERNEL32.dll_SwitchToThread]
Function at 0x590070
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x610684]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 8
mov word [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5900ee
call esi
cmp eax, 0x3f0
jne 0x5900cf
lea eax, [ebp - 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x5900ee
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544516
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x5900d8
call esi
cmp eax, 0x7a
jne 0x5900d8
mov esi, dword [ebp - 0x18]
mov eax, esi
call fcn.00545870
mov ebx, esp
test ebx, ebx
je 0x5900d8
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x5900d8
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x222
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x5900d8
xor esi, esi
mov byte [ebp - 0xd], 0
cmp dword [ebx], esi
jbe 0x590180
lea edi, [ebx + 4]
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x59017c
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x590163
jmp 0x590180
mov byte [ebp - 0xd], 1
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0xd]
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544516
mov esp, ebp
pop ebp
ret
Function at 0x595410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9828
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x610684]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x70], eax
call fcn.005952b0
add esp, 4
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push 0
push 0x5d7b58
call fcn.0044f570
push 0x104
mov dword [ebp - 4], 0
call fcn.0054452c
mov edi, eax
mov dword [ebp - 0x6c], 0x104
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.00595610
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
add esp, 0xc
lea edx, [ebp - 0x59]
cmp dword [ebp - 0x14], 0x10
cmovae ecx, dword [ebp - 0x28]
add eax, ecx
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push edx
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x58]
call fcn.00492d90
mov ecx, dword [ebp + 0xc]
lea ebx, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
mov byte [ebp - 4], 1
cmovae ebx, dword [ebp - 0x58]
mov esi, dword [ecx + 0x14]
mov dword [ebp - 0x68], ebx
cmp esi, 0x10
jb 0x5954e2
mov edx, dword [ecx]
jmp 0x5954e4
mov edx, ecx
mov eax, dword [ecx + 0x10]
add eax, edx
cmp esi, 0x10
jb 0x5954f0
mov ecx, dword [ecx]
lea edx, [ebp - 0x59]
push edx
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.00595190
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x60]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x64]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea esi, [ebp - 0x40]
cmovae esi, dword [ebp - 0x40]
mov byte [ebp - 4], 2
call ebx
test eax, eax
je 0x59553f
lea eax, [ebp - 0x60]
push eax
push 0x20219
push 0
push dword [ebp - 0x68]
push dword [ebp - 0x64]
call ebx
test eax, eax
jne 0x595576
lea eax, [ebp - 0x6c]
push eax
push edi
push 0
push 0
push esi
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x595576
cmp byte [edi], al
jne 0x59555e
xor ecx, ecx
jmp 0x59556c
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x595563
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x70]
push edi
call fcn.0044f570
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00544527
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x59559d
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0044f7a0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], 0
cmp eax, 8
jb 0x5955c6
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.0044f7a0
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], 0
cmp eax, 0x10
jb 0x5955ef
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0044c890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544516
mov esp, ebp
pop ebp
ret
Function at 0x415f63
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x433b84
push 0x433b7c
push str.FlsGetValue
push 2
call fcn.00415e68
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x415f94
mov ecx, esi
call fcn.00411065
call esi
jmp 0x415f9a
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x415f9d
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x433b8c
push 0x433b84
push str.FlsSetValue
push 3
call fcn.00415e68
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x415fd1
mov ecx, esi
call fcn.00411065
call esi
jmp 0x415fd7
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x10001000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push edi
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.MSVCR90.dll_sprintf]
push esi
lea ecx, [esp + 0x1c]
push str._c_route_delete__s
push ecx
call edi
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x18
push 0
push 0
lea edx, [esp + 0x14]
push edx
push str.cmd.exe
push 0
push 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call ebp
push str.mask_255.255.255.255_0.0.0.0
push esi
lea eax, [esp + 0x14]
push str._c_route_add__s__s
push eax
call edi
add esp, 0x10
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push str.cmd.exe
push 0
push 0
call ebx
push 0x7d0
call ebp
mov ecx, dword [0x1002a408]
shl ecx, 4
pop edi
lea ecx, [ecx + 0x10024378]
pop ebp
mov eax, esi
sub ecx, esi
pop ebx
jmp 0x100010b0
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
test dl, dl
jne 0x100010b0
mov ecx, dword [esp + 0x104]
inc dword [0x1002a408]
xor ecx, esp
call fcn.10006e9c
add esp, 0x108
ret
Function at 0x10001200
Capabilities:
List tcp connections and listeners

Disassembly:
sub esp, 0x108
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
push 0
push 5
push 2
push 1
lea eax, [esp + 0x20]
push eax
push 0
mov dword [esp + 0x28], 0
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov ebp, eax
push 0
push 5
push 2
push 1
lea edx, [esp + 0x20]
push edx
push ebp
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
xor ebx, ebx
cmp dword [ebp], ebx
jbe 0x1000134e
lea edi, [ebp + 0x18]
cmp dword [edi - 0x14], 5
jne 0x10001341
mov eax, dword [edi]
push eax
call fcn.10001160
add esp, 4
lea edx, [esp + 0x14]
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x10001280
lea eax, [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001291
sub eax, edx
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x100012b9
mov al, byte [esp + ecx + 0x14]
cmp al, 0x41
jl 0x100012b4
cmp al, 0x5f
jg 0x100012b4
add al, 0x20
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, edx
jl 0x100012a2
movzx ecx, word [edi - 4]
push ecx
call sub.WS2_32.dll_ntohs
movzx esi, ax
mov ecx, str.game.exe
lea eax, [esp + 0x14]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100012f0
test dl, dl
je 0x100012ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100012f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100012d0
xor eax, eax
jmp 0x100012f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001301
cmp esi, 0x1964
jmp 0x1000133f
mov ecx, str.poker.exe
lea eax, [esp + 0x14]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001330
test dl, dl
je 0x1000132c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001330
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001310
xor eax, eax
jmp 0x10001335
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001341
cmp esi, 0x3b63
je 0x1000135e
inc ebx
add edi, 0x18
cmp ebx, dword [ebp]
jb 0x10001265
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001244
push ebp
call dword [sym.imp.MSVCR90.dll_free]
mov ecx, dword [esp + 0x118]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10006e9c
add esp, 0x108
ret
Function at 0x10002130
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1002a484]
lea eax, [esp]
push eax
push 0x1002a40c
push 0
push 0
push 0x10009078
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1002a40c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002160
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x1000218d
mov edx, eax
and edx, 0x80000001
jns 0x10002180
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1002a40c], dl
inc eax
cmp eax, ecx
jl 0x10002171
pop ecx
ret

Function at 0x10002190
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1002a484]
lea eax, [esp]
push eax
push 0x1002a41c
push 0
push 0
push 0x10009090
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1002a41c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100021c0
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x100021ed
mov edx, eax
and edx, 0x80000001
jns 0x100021e0
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1002a41c], dl
inc eax
cmp eax, ecx
jl 0x100021d1
pop ecx
ret

Function at 0x100021f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1002a484]
lea eax, [esp]
push eax
push 0x1002a42c
push 0
push 0
push 0x100090a8
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1002a42c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002220
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x1000224d
mov edx, eax
and edx, 0x80000001
jns 0x10002240
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1002a42c], dl
inc eax
cmp eax, ecx
jl 0x10002231
pop ecx
ret

Function at 0x10002250
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1002a484]
lea eax, [esp]
push eax
push 0x1002a43c
push 0
push 0
push 0x100090c0
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1002a43c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002280
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x100022ad
mov edx, eax
and edx, 0x80000001
jns 0x100022a0
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1002a43c], dl
inc eax
cmp eax, ecx
jl 0x10002291
pop ecx
ret
Function at 0x100022b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x10002370
push 0
push 0
mov byte [0x100090c8], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100022e3
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x10002630
push 0
push 0
call esi
test eax, eax
je 0x100022fe
push eax
call edi
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x100045d0
push 0
push 0
call esi
test eax, eax
je 0x10002319
push eax
call edi
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x10005710
push 0
push 0
call esi
test eax, eax
je 0x10002334
push eax
call edi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0x100035e0
push 0
push 0
call esi
test eax, eax
je 0x1000234f
push eax
call edi
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0x10001390
push 0
push 0
call esi
test eax, eax
je 0x1000236a
push eax
call edi
pop edi
pop esi
add esp, 0x18
ret
Function at 0x100031f0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x10024ff8]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x10008220
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003291
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.100066d0
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x100033d5
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x100264cc]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x10008220
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003350
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.100066d0
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x100033d5
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x100033d7
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10006e9c
add esp, 0x278
ret
Function at 0x100041a0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x100264fc]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x10008220
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004241
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.100066d0
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10004385
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x100279d0]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x10008220
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004300
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.100066d0
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10004385
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10004387
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10006e9c
add esp, 0x278
ret
Function at 0x10005190
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x10027a00]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x10008220
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10005231
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.100066d0
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10005375
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x10028ed4]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x10008220
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100052f0
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.100066d0
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10005375
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10005377
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10006e9c
add esp, 0x278
ret