joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bc40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a360
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10099790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x100832f8
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
call fcn.1000866c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
call fcn.1001bd90
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.10008bde
test eax, eax
je 0x1001bd57
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
call fcn.100016ac
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebx, eax
test ebx, ebx
je 0x1001bd57
push ebx
call fcn.100579e5
add esp, 4
mov esi, eax
push esi
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x28]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x1001bd4e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x100832f4
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x1001bd4e
cmp dword [ebp - 0x14], 0
je 0x1001bd4e
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x1001bd4e
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x20]
push 0x100871b4
push eax
call fcn.1000c729
add esp, 0x18
push esi
call fcn.10059a38
add esp, 4
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.1000865a
lea ecx, [ebp - 0x24]
call fcn.100086b0
lea ecx, [ebp - 0x20]
call fcn.100086b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005801c
mov esp, ebp
pop ebp
ret
Function at 0x1001c2e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10099790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x114]
push eax
push 0xf003f
push 0
push edi
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x114], 0
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001c35b
push 0
lea eax, [ebp - 0x114]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.1005b850
mov edi, dword [ebp - 0x118]
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push edi
push dword [ebp - 0x114]
mov dword [ebp - 0x110], 0x104
mov dword [ebp - 0x10c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, ebx
test eax, eax
je 0x1001c3e4
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001c3c0
sub ecx, edx
push ecx
push ebx
push 1
push 0
push edi
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1001c443
xor esi, esi
jmp 0x1001c443
lea eax, [ebp - 0x108]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001c410
test dl, dl
je 0x1001c40c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001c410
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001c3f0
xor eax, eax
jmp 0x1001c415
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001c443
mov ecx, ebx
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001c420
sub ecx, edx
push ecx
push ebx
push 1
push 0
push edi
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005801c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001c470
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007a3ec
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x10099790]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x10099790]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
lea eax, [esp + 0x164]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [esp + 0x164]
push eax
mov ecx, esi
call fcn.100086c7
lea eax, [esi + 0x1c]
push eax
push dword [esi]
lea ebx, [esi + 4]
push str._s_sProfiles
push ebx
call fcn.1000c729
add esp, 0x10
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
call fcn.10008646
mov dword [esp + 0x280], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.10008646
mov ecx, ebx
mov byte [esp + 0x280], 1
call fcn.100016ac
push eax
call dword [0x1009c694]
test eax, eax
je 0x1001c67d
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.1000865a
push str..
lea ecx, [esp + 0x18]
mov byte [esp + 0x284], 2
call fcn.10008b6e
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
call fcn.100016ac
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001c674
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x1001c590
mov eax, dword [esp + 0x24]
shr eax, 4
and al, 1
cmp byte [esp + 0x50], 0x2e
je 0x1001c627
test al, al
je 0x1001c627
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
call fcn.10008646
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x284], 3
push dword [ebx]
lea eax, [esp + 0x18]
push 0x10087028
push eax
call fcn.1000c729
add esp, 0xc
lea ecx, [esp + 0x14]
push str..default
call fcn.1000892b
test eax, eax
js 0x1001c616
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push str._sprefs.js
push eax
call fcn.1000c729
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.100016ac
push eax
call dword [0x1009c694]
test eax, eax
jne 0x1001c639
lea ecx, [esp + 0x10]
mov byte [esp + 0x280], 2
call fcn.100086b0
lea eax, [esp + 0x24]
push eax
push esi
call edi
test eax, eax
jne 0x1001c590
jmp 0x1001c66d
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x50]
push eax
lea ecx, [edi + 0x10]
call fcn.100086c7
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 8]
call fcn.100086b5
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0xc]
call fcn.100086b5
lea ecx, [esp + 0x10]
call fcn.100086b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
call fcn.100086b0
lea ecx, [esp + 0x18]
call fcn.100086b0
lea ecx, [esp + 0x1c]
call fcn.100086b0
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.1005801c
mov esp, ebp
pop ebp
ret
Function at 0x1001c710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10099790]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0xd], 0x642e6c6c
mov word [ebp - 0xf], 0x6474
mov word [ebp - 8], 0x6c
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 9], 0x6c
mov dword [ebp - 0x24], 0x6554744e
mov dword [ebp - 0x1b], 0x72506574
mov dword [ebp - 0x15], 0x737365
mov dword [ebp - 0x20], 0x6e696d72
mov byte [ebp - 0x1c], 0x61
mov word [ebp - 0x17], 0x636f
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1001c797
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1009c7dc], eax
test eax, eax
je 0x1001c797
push esi
push edi
call eax
mov ecx, 1
test eax, eax
cmove esi, ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1005801c
mov esp, ebp
pop ebp
ret
Function at 0x1001cbe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a478
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x10099790]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x1b], 0x6c6c64
mov dword [ebp - 0x1f], 0x2e32336c
mov dword [ebp - 0x23], 0x656e7265
mov byte [ebp - 0x24], 0x4b
mov dword [ebp - 0x2a], 0x747865
mov word [ebp - 0x2d], 0x3233
mov dword [ebp - 0x32], 0x7365636f
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2b], 0x4e
mov word [ebp - 0x34], 0x7250
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001cc78
lea eax, [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x1001cc87
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 8]
call fcn.100086b0
xor eax, eax
jmp 0x1001cd31
push 0
push 2
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x164], eax
cmp esi, 0xffffffff
je 0x1001cd1c
lea eax, [ebp - 0x15c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x1001cd15
jmp 0x1001ccd0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x154], eax
je 0x1001ccfa
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp + 8]
call fcn.100016ac
push eax
call fcn.100580ec
add esp, 8
test eax, eax
je 0x1001cd0b
lea eax, [ebp - 0x15c]
push eax
push esi
call ebx
cmp eax, 1
je 0x1001ccd0
jmp 0x1001cd15
mov dword [ebp - 0x160], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 8]
call fcn.100086b0
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005801c
mov esp, ebp
pop ebp
ret
Function at 0x1001cd50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a4c8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x10099790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
call fcn.10008646
mov byte [ebp - 4], 3
push dword [ebp + 0xc]
lea eax, [ebp - 0x6c]
push dword [ebp + 8]
push str.__s___s
push eax
call fcn.1000c729
push 0x40
lea eax, [ebp - 0x54]
push 0
push eax
mov dword [ebp - 0x58], 0x44
call fcn.1005b850
add esp, 0x1c
mov eax, 1
push 0x100831f5
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], ax
mov dword [ebp - 0x74], 0
call fcn.1000866c
mov byte [ebp - 4], 4
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.10008bde
push eax
lea ecx, [ebp - 0x6c]
call fcn.10008bd9
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1001ce56
push 0x3e8
call edi
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, dword [ebp - 0x78]
push dword [ebp - 0x64]
mov dword [ecx], eax
call esi
push dword [ebp - 0x68]
call esi
jmp 0x1001ce61
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx], eax
xor esi, esi
push ecx
lea eax, [ebp + 0x10]
mov ecx, esp
push eax
call fcn.1000865a
call fcn.1001cbe0
add esp, 4
test eax, eax
jne 0x1001ce88
push 0xc8
call edi
inc esi
cmp esi, 0xa
jl 0x1001ce63
push ecx
lea eax, [ebp + 0x10]
mov ecx, esp
push eax
call fcn.1000865a
call fcn.1001cbe0
add esp, 4
test eax, eax
jne 0x1001ceb2
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, 5
jl 0x1001ce03
jmp 0x1001ceb9
mov dword [ebp - 0x70], 1
lea ecx, [ebp - 0x74]
call fcn.100086b0
lea ecx, [ebp - 0x6c]
call fcn.100086b0
lea ecx, [ebp + 8]
call fcn.100086b0
lea ecx, [ebp + 0xc]
call fcn.100086b0
lea ecx, [ebp + 0x10]
call fcn.100086b0
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005801c
mov esp, ebp
pop ebp
ret
Function at 0x10021930
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1002197e
push esi
call fcn.10021bec
pop ecx
test eax, eax
jne 0x1002197e
push ebx
push edi
lea eax, [ebp + 8]
push eax
push esi
call fcn.10021b8d
mov edi, dword [ebp + 8]
mov esi, eax
pop ecx
add edi, esi
mov ebx, 0x1505
jmp 0x10021972
mov al, byte [esi]
push eax
call fcn.1002043b
imul ebx, ebx, 0x21
movsx eax, al
xor ebx, eax
inc esi
pop ecx
cmp esi, edi
jb 0x10021961
pop edi
movzx eax, bl
pop ebx
jmp 0x10021980
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10029368
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x608], edi
je 0x100293a7
push 1
push esi
call fcn.1002a2f1
push dword [esi + 0x59c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [esi + 0x608]
push 0
push esi
mov edi, eax
call fcn.1002a2f1
add esp, 0x24
jmp 0x100293dd
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x100293dd
push dword [esi + 0x598]
imul eax, eax, 3
push 1
add eax, 0x1007b818
push 2
push eax
call fcn.1005b137
push dword [esi + 0x598]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.1005b137
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x100297a9
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x80
push ebx
push esi
push edi
mov edi, dword [esp + 0x90]
push eax
mov esi, dword [edi + eax*4 + 0x1a8]
push edi
call fcn.10029bbb
pop ecx
pop ecx
push 0
push dword [esp + 0xa0]
push dword [esp + 0xa0]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0xa0]
mov esi, eax
and dword [ebx], 0
cmp esi, 0xffffffff
jne 0x1002983f
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x10029810
xor esi, esi
mov dword [ebx], 0x51
jmp 0x1002983e
push 0x80
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.1004de15
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.100293e3
mov eax, dword [edi]
add esp, 0x18
mov dword [eax + 0xcac], ebp
mov dword [ebx], 0x37
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x80
ret

Function at 0x10029bbb
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebp
mov eax, dword [ebx + 0x2b8]
mov ebp, dword [ebx + ecx*4 + 0x1a8]
push esi
lea esi, [ecx + 0x1d]
shl esi, 4
add esi, ebx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x10029c5e
cmp dword [ebx + ecx*4 + 0x1c0], 0x1002969d
jne 0x10029c5e
xor eax, eax
cmp dword [esi], eax
je 0x10029bff
test edi, edi
je 0x10029c5e
push eax
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.1002d3f1
add esp, 0x14
cmp eax, 0xffffffff
je 0x10029c5e
test al, 1
je 0x10029c5e
xor ecx, ecx
cmp dword [esi], ecx
jne 0x10029c48
mov eax, dword [ebx]
mov eax, dword [eax + 0x8e4]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x1008d098]
mov edi, dword [esi + 4]
pop ecx
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
test eax, eax
jne 0x10029c48
mov dword [esi + 4], ecx
jmp 0x10029c5e
mov eax, dword [esi]
add eax, dword [esi + 8]
push ecx
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10029c5e
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1002c523
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1002c542
cmp dword [esi + 0x8c], 0
je 0x1002c542
push 2
push 3
push esi
call fcn.10028200
add esp, 0xc
push dword [esp + 0xc]
call fcn.1004a639
pop ecx
test esi, esi
je 0x1002c563
cmp dword [esi + 0x8c], 0
je 0x1002c563
push 3
push esi
call fcn.1002823a
pop ecx
pop ecx
pop esi
ret
Function at 0x1002d81e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test byte [eax + 0x1fc], 1
je 0x1002d83c
push eax
call fcn.100289d6
pop ecx
test eax, eax
jne 0x1002d858
xor eax, eax
pop ebp
ret
mov eax, dword [eax + 0x1a8]
cmp eax, 0xffffffff
je 0x1002d838
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x1002d834
xor eax, eax
inc eax
pop ebp
ret

Function at 0x1002de37
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1009ab18]
and dword [ebp - 4], 0
push esi
push 2
mov dword [ebp - 8], 0x4020
mov dword [ebp - 0xc], 4
pop esi
test eax, eax
jne 0x1002de7e
push 3
push esi
push eax
push 6
call fcn.1002ede5
add esp, 0x10
test eax, eax
je 0x1002de76
mov dword [0x1009ab18], esi
jmp 0x1002debe
xor eax, eax
inc eax
mov dword [0x1009ab18], eax
cmp eax, esi
je 0x1002debe
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
mov esi, 0x1001
push esi
mov ebx, 0xffff
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1002deac
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x1002debd
push 4
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
pop ebx
pop esi
leave
ret
Function at 0x1002e05d
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x184
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
cmp dword [ebx + 0x90], 2
mov ebp, dword [ebx]
je 0x1002e1e4
mov eax, dword [ebx + 0x294]
push esi
push edi
test al, 2
jne 0x1002e1db
test eax, 0x8000000
jne 0x1002e1db
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x118]
push eax
push dword [esp + 0x1a4]
mov edi, 0x80
mov dword [esp + 0x1c], edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x1002e0dd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push edi
lea eax, [esp + 0x18]
push eax
push esi
call fcn.1004de15
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
jmp 0x1002e1d0
push edi
lea eax, [esp + 0x98]
push 0
push eax
mov dword [esp + 0x1c], edi
call fcn.1005b850
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x98]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1002e132
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push edi
lea eax, [esp + 0x18]
push eax
push esi
call fcn.1004de15
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x1002e1d0
lea eax, [ebx + 0x138]
push eax
lea esi, [ebx + 0x10a]
lea eax, [esp + 0x118]
push esi
push eax
call fcn.1002e5c8
add esp, 0xc
test eax, eax
jne 0x1002e17d
call fcn.1005c3ef
mov esi, eax
call fcn.1005c3ef
mov edi, eax
push 0x80
lea eax, [esp + 0x18]
push eax
push dword [esi]
call fcn.1004de15
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
jmp 0x1002e1d0
push 0xb
pop ecx
lea edi, [ebx + 0x5c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebx + 0x13c]
push eax
lea eax, [esp + 0x9c]
push eax
movsw word es:[edi], word [esi]
call fcn.1002e5c8
add esp, 0xc
test eax, eax
jne 0x1002e1db
call fcn.1005c3ef
mov esi, eax
call fcn.1005c3ef
mov edi, eax
push 0x80
lea eax, [esp + 0x18]
push eax
push dword [esi]
call fcn.1004de15
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.100293e3
add esp, 0x1c
jmp 0x1002e1e2
push ebx
call fcn.1002ddc7
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x184
ret
Function at 0x1002e8e6
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push 4
mov eax, dword [esi + 0xa90]
shr eax, 0xd
and eax, 1
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 8
push 0xffff
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1002e92c
push dword [ebp + 0xc]
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.10029490
add esp, 0xc
jmp 0x1002e99d
push dword [esi + 0xa50]
mov dword [ebp - 0x10], 1
call fcn.10029326
imul eax, eax, 0x3e8
push dword [esi + 0xa54]
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], eax
call fcn.10029326
imul eax, eax, 0x3e8
pop ecx
pop ecx
xor ecx, ecx
push ecx
push ecx
mov dword [ebp + 8], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1002e99d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 0xc]
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.10029490
add esp, 0x10
pop esi
leave
ret

Function at 0x1002e9a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
push 4
xor ecx, ecx
lea eax, [ebp + 8]
push eax
inc ecx
push ecx
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1002e9f1
push 0x80
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.1004de15
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.10029490
add esp, 0x18
jmp 0x1002e9fe
push str.TCP_NODELAY_set_n
push esi
call fcn.10029490
pop ecx
pop ecx
pop esi
leave
ret