joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2001dc2a
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x2009c7db
call fcn.2007d394
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
xor edi, edi
push dword [ebx]
mov esi, ecx
push str.Block_GetFirstHeaderTime__u___p__r_n
mov dword [ebp - 0x10], edi
call fcn.2002eb98
push eax
call fcn.2002ebe0
add esp, 0x10
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.200011c0
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x80dc]
mov ecx, dword [eax]
cmp ecx, eax
mov edx, dword [esi + 0x80e0]
mov dword [ebp + 0xc], ecx
je 0x2001dccd
dec edx
mov dword [ebp + 8], edx
cmp edi, dword [ebp + 8]
jge 0x2001dccd
cmp dword [ecx + 0x10], 2
jb 0x2001dcb7
cmp dword [esi + 0x80e0], 5
jbe 0x2001dcb7
mov dword [ebp - 0x14], ecx
lea ecx, [ebp + 0xc]
call fcn.2001ade7
push dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0x80d8]
call fcn.2001d467
jmp 0x2001dcbf
lea ecx, [ebp + 0xc]
call fcn.2001ade7
mov eax, dword [esi + 0x80dc]
mov ecx, dword [ebp + 0xc]
inc edi
cmp ecx, eax
jne 0x2001dc84
and dword [ebx], 0
mov eax, dword [esi + 0x80dc]
mov edi, dword [eax]
cmp edi, eax
mov dword [ebp + 0xc], edi
je 0x2001dd2f
cmp dword [edi + 0x10], 2
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x10], eax
jb 0x2001dd00
lea ecx, [ebp + 0xc]
call fcn.2001ade7
mov edi, dword [ebp + 0xc]
cmp edi, dword [esi + 0x80dc]
jne 0x2001dcdf
jmp 0x2001dd2f
cmp dword [esi + 0x80e0], 5
jbe 0x2001dd1e
push dword [esi + 0x80e8]
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0x80e4]
call fcn.2001b61a
inc dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x14], eax
mov eax, dword [edi + 0x10]
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x2001dd65
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0x80d8]
call fcn.20063726
mov esi, dword [esi + 0x80dc]
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x2001dd65
xor esi, esi
inc esi
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x14], eax
mov dword [ebx], esi
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x2001dd7a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [esi + 0x18]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x2001e6f5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ax, word [esi + 0xc]
movzx ecx, ax
cmp dword [esi + 0x18], ecx
push edi
jae 0x2001e741
xor ebx, ebx
test ax, ax
jbe 0x2001e741
mov edi, dword [esi + 0x14]
lea eax, [esi + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx eax, bx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.2001b667
cmp dword [eax], edi
je 0x2001e7e0
inc ebx
cmp bx, word [esi + 0xc]
jb 0x2001e71c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esi + 0x14]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], eax
mov eax, dword [edi]
xor ebx, ebx
cmp eax, edi
mov dword [ebp - 8], eax
je 0x2001e82d
mov ecx, dword [eax + 0x10]
cmp ecx, 0xffffffff
je 0x2001e782
mov edx, dword [ebp - 0xc]
sub edx, ecx
cmp edx, dword [ebp + 0x10]
jbe 0x2001e782
test ebx, ebx
je 0x2001e77a
cmp ecx, ebx
jae 0x2001e782
mov eax, dword [eax + 0xc]
mov ebx, ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
call fcn.200255a0
mov eax, dword [ebp - 8]
cmp eax, edi
jne 0x2001e760
test ebx, ebx
je 0x2001e82d
movzx eax, word [esi + 8]
imul eax, dword [ebp - 4]
add eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
movzx ecx, word [esi + 8]
imul ecx, dword [ebp - 4]
movzx eax, word [esi + 0xa]
sub eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
movzx edx, word [esi + 8]
cmp eax, edx
jbe 0x2001e7ca
movzx eax, word [esi + 8]
mov dword [ecx], eax
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 0x10]
call fcn.2001e158
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x2001e82f
movzx eax, word [esi + 8]
mov edx, dword [ebp + 8]
movzx ecx, bx
imul eax, ecx
add eax, dword [esi + 4]
mov dword [edx], eax
movzx edx, word [esi + 8]
movzx eax, word [esi + 0xa]
imul edx, ecx
sub eax, edx
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
movzx edi, word [esi + 8]
cmp eax, edi
jbe 0x2001e812
movzx eax, word [esi + 8]
mov dword [edx], eax
lea eax, [ebp + 8]
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 4]
push eax
call fcn.2001e158
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi], eax
jmp 0x2001e7db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x20023c6e
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x2009ce89
call fcn.2007d394
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
push esi
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
je 0x20023ce3
cmp dword [ebp + 0xc], esi
je 0x20023ce3
lea eax, [edi + 0x70]
push eax
lea ecx, [ebp + 0x10]
call fcn.200011c0
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov ecx, edi
call fcn.20022b6a
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x198]
call fcn.2001b667
mov eax, dword [eax]
cmp eax, dword [edi + 0x19c]
jne 0x20023cf6
or dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x20023ce3
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [edi + 0x18]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
mov esi, dword [eax + 0x10]
lea eax, [ebx + 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x20023d96
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
push eax
call fcn.2007ca70
add esp, 0xc
lea ebx, [esi + 0x20]
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x18]
push ecx
push eax
mov ecx, ebx
call fcn.2002367f
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
je 0x20023de5
cmp dword [esi + 0xc], ecx
jne 0x20023de5
mov eax, dword [esi + 0x24]
mov eax, dword [eax]
mov edx, dword [eax + 8]
push ecx
push ecx
mov dword [ebp - 0x18], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
push ecx
lea eax, [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
push dword [esi]
mov dword [ebp + 0xc], ecx
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x20023dc3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x20023db4
cmp eax, 0x2747
je 0x20023db4
mov ecx, dword [edi + 0x210]
push dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x18]
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x20023ce3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [esi + 0x18]
jmp 0x20023ce3
mov eax, dword [ebp - 0x18]
add dword [edi + 0x1b0], eax
and dword [esi + 0x1c], 0
jmp 0x20023de5
mov eax, dword [ebp + 0xc]
add dword [edi + 0x1b0], eax
mov eax, dword [ebx + 4]
push dword [eax]
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.2000a107
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x20023dfa
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [esi + 0x18]
xor eax, eax
inc eax
jmp 0x20023ce5
Function at 0x20023e50
Capabilities:
Set socket configuration

Disassembly:
mov eax, 0x2009ce9b
call fcn.2007d394
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
lea eax, [edi + 0x70]
push eax
lea ecx, [ebp - 0x34]
call fcn.200011c0
mov dword [ebp - 4], ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [edi + 0x198]
call fcn.2001b667
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
cmp eax, dword [edi + 0x19c]
je 0x20023f93
mov dword [ebp - 0x28], 1
mov esi, dword [eax + 0x10]
mov dword [ebp - 0x2c], esi
lea eax, [esi + 4]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
lea ebx, [edi + 0x1a4]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.2001b667
mov eax, dword [edi + 0x1a8]
cmp dword [ebp - 0x18], eax
je 0x20023ef8
mov byte [ebp - 4], 1
push dword [ebp - 0x18]
lea eax, [ebp - 0x3c]
push eax
mov ecx, ebx
call fcn.20023370
jmp 0x20023ef8
and dword [ebp - 4], 0
push 0
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov eax, dword [esi]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x20023f25
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x20023f33
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi + 0x24]
mov ebx, dword [eax]
cmp ebx, eax
je 0x20023f4c
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [ebx]
cmp ebx, dword [esi + 0x24]
jne 0x20023f3c
mov ebx, dword [ebp - 0x30]
mov ecx, dword [ebx + 0x10]
add ecx, 0x20
call fcn.200023da
mov ecx, esi
call fcn.20022b44
push esi
call fcn.2008f9fe
pop ecx
mov byte [ebp - 4], 3
mov dword [edi + 0x90], 1
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [edi + 0x198]
call fcn.20023370
jmp 0x20023f91
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x34]
cmp esi, ebx
je 0x20023fa8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [esi + 0x18]
cmp dword [ebp - 0x14], ebx
je 0x20023fbb
mov ecx, dword [edi + 0x210]
mov eax, dword [ecx]
push dword [ebp - 0x14]
call dword [eax + 0x10]
cmp dword [ebp + 0xc], ebx
je 0x20023ff8
mov esi, dword [ebp - 0x20]
cmp esi, ebx
je 0x20023ff8
mov word [ebp - 0x24], 1
mov word [ebp - 0x22], bx
push 4
lea eax, [ebp - 0x24]
push eax
push 0x80
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [ebp - 0x28], ebx
je 0x20024004
mov ecx, edi
call fcn.20023a23
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x200250b2
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x200cc84c]
push ebx
push edi
xor edi, edi
push edi
push 1
xor eax, ebp
push 2
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x200250e2
xor eax, eax
jmp 0x2002519f
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x14], 2
call esi
push 4
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x1c]
push eax
push 0xffffff7f
push 0xffff
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edi, dword [sym.imp.WS2_32.dll_bind]
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call edi
cmp eax, 0xffffffff
jne 0x20025150
cmp dword [ebp + 0xc], 0
je 0x20025150
push 0
call esi
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call edi
cmp eax, 0xffffffff
jne 0x20025150
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x2002519e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x20025145
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
push 5
push ebx
mov esi, eax
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
push ebx
je 0x20025146
mov ecx, dword [ebp - 0x18]
push ebx
call fcn.20024830
test eax, eax
push ebx
je 0x20025146
mov ecx, dword [ebp - 0x18]
call fcn.20022b9a
movzx eax, si
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret 8

Function at 0x200251af
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x200cc84c]
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
mov edi, ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], eax
call fcn.200013ff
push 0
push esi
lea ecx, [ebp - 0x1c]
call fcn.20034471
lea ecx, [ebp - 0x1c]
call fcn.200342ea
test eax, eax
je 0x20025274
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x20025201
push 1
push esi
push esi
push esi
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov esi, eax
cmp esi, 0xffffffff
je 0x20025274
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x18]
mov word [ebp - 0x14], 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [edi + 0x210]
push esi
push esi
mov word [ebp - 0x12], ax
call fcn.20024830
test eax, eax
je 0x2002526d
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x2002525d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x2002525d
mov ecx, dword [edi + 0x210]
mov eax, dword [ecx]
push esi
call dword [eax + 0x18]
jmp 0x20025274
mov ecx, dword [edi + 0x210]
push esi
call fcn.20022b9a
mov eax, esi
jmp 0x20025276
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.2007c9ae
leave
ret 8
Function at 0x20025fbd
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x2002600a
and word [ebp - 4], 0
and word [ebp - 2], 0
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push 2
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [esi + 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x2002600c
xor eax, eax
pop esi
leave
ret
Function at 0x20026055
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
mov eax, 0x2009d0fb
call fcn.2007d394
sub esp, 0x2c
mov eax, dword [0x200cc84c]
push ebx
push esi
mov esi, ecx
xor eax, ebp
cmp dword [esi + 4], 0xffffffff
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], esi
jne 0x200261e5
xor ebx, ebx
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x2002609d
xor eax, eax
jmp 0x200261ea
push 4
lea ecx, [ebp - 0x38]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [ebp - 0x38], 0x1388
call dword [sym.imp.WS2_32.dll_setsockopt]
push edi
lea ecx, [ebp - 0x24]
call fcn.20004f37
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x28]
call fcn.200026bf
mov byte [ebp - 4], 1
mov edi, dword [ebp + 0xc]
cmp di, bx
jne 0x2002614f
push ebx
push 0x3a
lea ecx, [ebp - 0x24]
call fcn.20025dea
mov esi, eax
cmp esi, ebx
jle 0x20026141
push esi
push ebx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x24]
call fcn.20025e4c
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x28]
call fcn.20015e97
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.200026ee
inc esi
push esi
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x24]
call fcn.20025f32
mov byte [ebp - 4], 3
push dword [ebp - 0x30]
call fcn.2007db04
pop ecx
mov edi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.200026ee
mov esi, dword [ebp - 0x2c]
jmp 0x2002615b
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
call fcn.20015e97
jmp 0x2002613c
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
call fcn.20015e97
cmp di, bx
jne 0x20026163
push 0x50
pop edi
push edi
mov word [ebp - 0x20], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x28]
cmp dword [eax - 0xc], ebx
jge 0x20026186
push 0x80070057
call fcn.200010ce
movsx ecx, byte [eax]
cmp ecx, 0x2f
jle 0x2002619f
cmp ecx, 0x3a
jge 0x2002619f
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1c], eax
jmp 0x200261b6
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x200261b3
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x2002619a
mov dword [ebp - 0x1c], ebx
push 0x10
lea eax, [ebp - 0x20]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.200026ee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.200026ee
jmp 0x200261e8
xor esi, esi
inc esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret 8
Function at 0x20026613
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov eax, 0x2009d145
call fcn.2007d394
sub esp, 0x820
mov eax, dword [0x200cc84c]
and dword [ebp - 0x820], 0
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, ebp
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x818], ecx
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x814]
mov dword [ebp - 0x824], eax
call fcn.200026bf
and dword [ebp - 4], 0
lea ecx, [ebp - 0x81c]
call fcn.200026bf
mov byte [ebp - 4], 1
test esi, esi
mov dword [ebp - 0x828], 0x50
je 0x200266a2
mov ecx, dword [ebp - 0x818]
push 0
push esi
call fcn.20026055
test eax, eax
jne 0x20026694
xor esi, esi
jmp 0x200267a0
push edi
lea ecx, [ebp - 0x814]
call fcn.20003052
jmp 0x200266ec
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x82c]
push eax
push edi
call fcn.20097ef9
test eax, eax
je 0x200266ec
cmp dword [ebp - 0x82c], 3
jne 0x2002668d
push dword [ebp - 0x828]
mov ecx, dword [ebp - 0x818]
push dword [ebp - 0x81c]
call fcn.20026055
test eax, eax
je 0x2002668d
test ebx, ebx
push dword [ebp - 0x824]
lea eax, [ebp - 0x810]
je 0x20026713
push ebx
push dword [ebp - 0x814]
push str.POST__s_HTTP_1.1_r_n_s_r_n_s
push eax
call fcn.2007d900
add esp, 0x14
jmp 0x20026727
push dword [ebp - 0x814]
push 0x200a7018
push eax
call fcn.2007d900
add esp, 0x10
lea eax, [ebp - 0x810]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
test edi, edi
jle 0x20026771
mov ebx, 0x1000
cmp edi, ebx
mov eax, ebx
jg 0x20026749
mov eax, edi
push 0
push eax
lea eax, [ebp + esi - 0x810]
push eax
mov eax, dword [ebp - 0x818]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jl 0x2002676f
sub edi, eax
add esi, eax
test edi, edi
jg 0x20026741
test edi, edi
jne 0x2002679a
mov ecx, dword [ebp - 0x818]
call fcn.20026205
cmp eax, 0x64
mov dword [ebp - 0x820], eax
jne 0x2002679a
mov ecx, dword [ebp - 0x818]
call fcn.20026205
mov dword [ebp - 0x820], eax
mov esi, dword [ebp - 0x820]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x81c]
call fcn.200026ee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.200026ee
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret 0x14
Function at 0x200267db
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov eax, 0x2009d145
call fcn.2007d394
sub esp, 0x81c
mov eax, dword [0x200cc84c]
and dword [ebp - 0x820], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
xor eax, ebp
mov dword [ebp - 0x818], ecx
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x814]
mov dword [ebp - 0x10], eax
call fcn.200026bf
and dword [ebp - 4], 0
lea ecx, [ebp - 0x81c]
call fcn.200026bf
mov byte [ebp - 4], 1
test esi, esi
mov dword [ebp - 0x824], 0x50
je 0x20026861
mov ecx, dword [ebp - 0x818]
push 0
push esi
call fcn.20026055
test eax, eax
jne 0x20026853
xor esi, esi
jmp 0x20026959
push edi
lea ecx, [ebp - 0x814]
call fcn.20003052
jmp 0x200268ab
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x828]
push eax
push edi
call fcn.20097ef9
test eax, eax
je 0x200268ab
cmp dword [ebp - 0x828], 3
jne 0x2002684c
push dword [ebp - 0x824]
mov ecx, dword [ebp - 0x818]
push dword [ebp - 0x81c]
call fcn.20026055
test eax, eax
je 0x2002684c
test ebx, ebx
lea eax, [ebp - 0x810]
je 0x200268cc
push ebx
push dword [ebp - 0x814]
push str.GET__s_HTTP_1.1_r_n_s_r_n
push eax
call fcn.2007d900
add esp, 0x10
jmp 0x200268e0
push dword [ebp - 0x814]
push str.GET__s_HTTP_1.1_r_n_r_n
push eax
call fcn.2007d900
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
test edi, edi
jle 0x2002692a
mov ebx, 0x1000
cmp edi, ebx
mov eax, ebx
jg 0x20026902
mov eax, edi
push 0
push eax
lea eax, [ebp + esi - 0x810]
push eax
mov eax, dword [ebp - 0x818]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jl 0x20026928
sub edi, eax
add esi, eax
test edi, edi
jg 0x200268fa
test edi, edi
jne 0x20026953
mov ecx, dword [ebp - 0x818]
call fcn.20026205
cmp eax, 0x64
mov dword [ebp - 0x820], eax
jne 0x20026953
mov ecx, dword [ebp - 0x818]
call fcn.20026205
mov dword [ebp - 0x820], eax
mov esi, dword [ebp - 0x820]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x81c]
call fcn.200026ee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.200026ee
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret 0xc
Function at 0x20029527
Capabilities:
Get memory capacity

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xb8
mov eax, dword [0x200cc84c]
push esi
xor eax, ebp
push edi
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
xor edi, edi
push 0x5c
mov dword [ebp + 0x4c], eax
lea eax, [ebp - 0x28]
push edi
push eax
mov esi, ecx
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], edi
mov dword [ebp - 0x48], 0x20
call fcn.2007e690
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.20028be0
cmp dword [ebp + 0x7c], edi
jbe 0x2002966e
lea eax, [ebp - 0x28]
push eax
push 0x14
lea eax, [ebp + 0x58]
push eax
mov ecx, esi
call fcn.20028d19
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x54], eax
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp + 0x54]
push eax
mov ecx, esi
call fcn.20028d19
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp + 0x54], eax
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp + 0x54]
push eax
mov ecx, esi
call fcn.20028d19
lea eax, [ebp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x28]
push eax
push 8
lea eax, [ebp + 0x44]
push eax
mov ecx, esi
call fcn.20028d19
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x50], eax
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp + 0x50]
push eax
mov ecx, esi
call fcn.20028d19
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x28]
push eax
push 0x20
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.20028d19
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x58]
push eax
mov ecx, esi
call fcn.20028c12
mov eax, dword [ebp + 0x7c]
sub eax, edi
cmp eax, 0x14
jae 0x2002964c
push eax
lea eax, [ebp + 0x58]
push eax
mov eax, dword [ebp + 0x4c]
add eax, edi
push eax
call fcn.2007ca70
mov edi, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x20029663
push 0x14
lea eax, [ebp + 0x58]
push eax
mov eax, dword [ebp + 0x4c]
add eax, edi
push eax
call fcn.2007ca70
add esp, 0xc
add edi, 0x14
mov eax, dword [ebp + 0x7c]
sub eax, edi
jne 0x20029578
mov ecx, dword [ebp + 0x6c]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.2007c9ae
add ebp, 0x70
leave
ret 8