joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ddf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
movzx eax, ax
push esi
mov esi, ecx
cmp eax, 0x401
jg 0x42dea4
je 0x42de93
sub eax, 2
je 0x42de32
sub eax, 0x3fa
jne 0x42deab
call fcn.0042d200
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x42df22
push 0x1f86
push ecx
mov ecx, dword [esi + 4]
mov edx, 0x4e20
push 2
push 3
call fcn.00421fa0
add esp, 0x10
cmp eax, 6
jne 0x42df22
mov ecx, dword [0x465c80]
push 0x642
call fcn.0040d690
push 0x40b
mov ecx, esi
call fcn.00421d80
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.0042d300
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x40b
je 0x42dec8
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x42debf
cmp dword [ebp + 0xc], eax
jne 0x42debf
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
cmp byte [esi + 0x74], 0
jne 0x42df0c
mov ecx, dword [0x465c80]
call fcn.0040a2c0
test al, al
jne 0x42df0c
push 0x1f86
push ecx
mov ecx, dword [esi + 4]
mov edx, 0x4e20
push 2
push 3
call fcn.00421fa0
add esp, 0x10
cmp eax, 6
jne 0x42df22
mov ecx, dword [0x465c80]
push 0x642
call fcn.0040d690
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0x40b
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42fb20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [ebp - 0x11c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov edx, 2
lea esi, [eax + 1]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00430224
add esp, 4
mov edi, eax
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0
push 0
push 0x31
push ebx
mov esi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
xor ecx, ecx
mov eax, 0x10
cmp byte [ebp + 0x10], cl
cmovne ecx, eax
lea eax, [ebp - 0x11c]
or ecx, 0x400
push ecx
push eax
push 0xffffffffffffffff
push edi
push esi
call dword [sym.imp.USER32.dll_DrawTextW]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push edi
call fcn.00430edc
add esp, 4
lea eax, [ebp - 0x10c]
push 0x80
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, str.Button
lea ecx, [ebp - 0x10c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x42fc1c
test dx, dx
je 0x42fc18
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x42fc1c
add ecx, 4
add eax, 4
test dx, dx
jne 0x42fbf6
xor eax, eax
jmp 0x42fc21
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42fc4a
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 0xb
jle 0x42fc4a
push 0x47
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x114]
add ecx, eax
mov dword [ebp - 0x114], ecx
jmp 0x42fc50
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0x118]
sub ecx, dword [ebp - 0x11c]
inc eax
push 6
push eax
inc ecx
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d5f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x443cf7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0043596b
mov dword [ebp - 0x14], eax
cmp dword [0x465c4c], esi
jne 0x443dea
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x443d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x443eca
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x443eca
push 0x452904
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x443eca
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x465c4c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x465c50], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x465c54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465c5c], eax
test eax, eax
je 0x443de7
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465c58], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x443e0f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x443e02
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x443e24
push 4
pop eax
jmp 0x443ecc
cmp dword [ebp - 0x14], esi
je 0x443e24
push dword [0x465c4c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x443e09
mov eax, dword [0x465c58]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x443e82
cmp dword [0x465c5c], edi
je 0x443e82
push eax
call ebx
push dword [0x465c5c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x443e82
test eax, eax
je 0x443e82
call ecx
test eax, eax
je 0x443e77
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x443e77
test byte [ebp - 8], 1
jne 0x443e82
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x443eb2
mov eax, dword [0x465c50]
cmp eax, edi
je 0x443eaf
push eax
call ebx
test eax, eax
je 0x443eaf
call eax
mov esi, eax
test esi, esi
je 0x443eaf
mov eax, dword [0x465c54]
cmp eax, edi
je 0x443eaf
push eax
call ebx
test eax, eax
je 0x443eaf
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x465c4c]
call ebx
test eax, eax
je 0x443eca
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x443ecc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
Function at 0x4014cb
Capabilities:
Add user account to group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
push 4
call fcn.00401657
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
push dword [ebp + 8]
call fcn.0040138d
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401512
push ebx
call fcn.00401651
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
push dword [ebp + 0xc]
call fcn.0040138d
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x40153d
push ebx
call fcn.00401651
add esp, 4
pop eax
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov dword [ebp - 0xc], esp
push 1
mov eax, dword [ebp - 8]
push eax
push 4
call fcn.00401657
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
test eax, eax
je 0x401572
add eax, 8
mov dword [edi], eax
add edi, 4
push 3
mov eax, dword [ebp - 4]
test eax, eax
je 0x401586
add eax, 8
push eax
push 0
call dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4015a8
push 6
call fcn.0040165d
add esp, 4
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
call fcn.00401651
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4015d0
mov eax, 1
jmp 0x4015da
mov eax, 0
jmp 0x4015da
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4015eb
push ebx
call fcn.00401651
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x4015ff
push ebx
call fcn.00401651
add esp, 4
pop ebx
call fcn.00401651
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40709f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push dword [ebp + 8]
mov esi, ecx
push edx
push eax
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.0040705a
pop esi
pop ebp
ret 4

Function at 0x40830c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], eax
dec dword [ebp + 0x5d88d445]
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00407f05
push eax
push esi
push dword [ebp + 8]
call fcn.00407eba
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00407ef5
neg byte [edi - 0x6277ff1a]
jl 0x40837a
invalid
invalid

Function at 0x408bdb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aam 1
add byte [eax], al
cmp dword [ebp + 0xc], 1
je 0x408db3
cmp dword [ebp + 0xc], 8
jne 0x408d7b
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
stc
invalid
inc dword [ecx]
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
invalid
test dword [esi - 7], ebx
invalid
invalid
Function at 0x41bd00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x424c80], ecx
inc edx
cmp edx, 0x100
jb 0x41bd02
cmp edx, 0x800
jae 0x41bdd9
lea esp, [esp]
mov eax, dword [edx*4 + 0x424880]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x424c80]
inc edx
mov dword [edx*4 + 0x424c7c], eax
cmp edx, 0x800
jb 0x41bdb0
mov eax, 0x41c5e0
mov dword [0x424c7c], eax
mov dword [0x426c80], eax
mov dword [0x424c78], 0x41c500
call fcn.0041c010
test eax, eax
jne 0x41be05
mov dword [0x426c80], 0x41c500
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push 0x28400
push 0
call sub.user32.dll_GetClipboardViewer
call sub.kernel32.dll_VirtualAlloc
call fcn.0049f67f
ret
Function at 0x10001a80
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0xf0000000
xor esi, esi
lea eax, [ebp - 8]
push 0x18
push esi
push esi
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10001b53
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10001b48
mov edx, dword [ebp + 8]
mov ecx, edx
push edi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001ad2
push 0
sub ecx, edi
push ecx
push edx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
pop edi
test eax, eax
je 0x10001b3f
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 4]
push 0x6610
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x10001b3f
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push 0
push 1
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x10001b31
mov ecx, dword [ebp + 0x14]
mov esi, 1
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x10001b36
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001b60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10063128]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.1003d4b0
add esp, 8
mov byte [eax], 0
mov eax, str.donottrace.txt
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001ba4
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10001bb4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 3
push 0
mov ecx, eax
lea eax, [ebp - 0x108]
push 0
and ecx, 3
push connect
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push eax
mov dword [0x10064548], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x3000
push eax
push 0
mov dword [0x10064550], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0x10064554
push dword [0x10064550]
mov dword [0x1006454c], eax
push eax
push dword [0x10064548]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x10064548]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10c]
push eax
push dword [0x10064550]
push dword [0x1006454c]
push str.VP6xD1l641p5CrMKbgvnQoD20qUxdortl591yX0dNNGQeTiWITjLGfOgtBE1yS14WodB90cSQObezPtfScLWAIjNbqj31IFVZMdwWY12DfrWFyuZnqBPWXOc8gTndiPN
call fcn.10001a80
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
call fcn.1003ce33
mov esp, ebp
pop ebp
ret

Function at 0x100022d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax + 0x1d4], 0
je 0x100022f0
push eax
call fcn.1003c540
add esp, 4
test eax, eax
jne 0x10002312
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x190]
cmp eax, 0xffffffff
je 0x100022ec
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x10002312
xor al, al
pop ebp
ret
mov al, 1
pop ebp
ret

Function at 0x100029e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10064568]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x10002a31
push 3
push 2
push eax
push 6
call fcn.1002a6a0
add esp, 0x10
test al, al
je 0x10002a25
mov dword [0x10064568], 2
mov esp, ebp
pop ebp
ret
mov dword [0x10064568], 1
jmp 0x10002a36
cmp eax, 2
je 0x10002a76
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10002a5d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x10002a76
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x10002b40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10002b88
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.10029be0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.10024160
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.10024160
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x10002c80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10063128]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x10002e5e
cmp byte [edi + 0x366], 0
push esi
jne 0x10002e54
cmp byte [edi + 0x382], 0
jne 0x10002e54
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x10002d18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.10029be0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.100240b0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ce33
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push 0
push eax
call fcn.1003d0c0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10002d81
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.10029be0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.100240b0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ce33
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x130]
push eax
lea esi, [edi + 0x102]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.10003360
add esp, 0xc
test al, al
jne 0x10002dd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.10029be0
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.100240b0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ce33
mov esp, ebp
pop ebp
ret
movdqu xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movdqu xmmword [edi + 0x58], xmm0
movdqu xmm0, xmmword [esi + 0x10]
movdqu xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x164]
push eax
lea eax, [edi + 0x134]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.10003360
add esp, 0xc
test al, al
jne 0x10002e54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.10029be0
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.100240b0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ce33
mov esp, ebp
pop ebp
ret
push edi
call fcn.10002900
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1003ce33
mov esp, ebp
pop ebp
ret
Function at 0x100036f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10063128]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x49c], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1000374d
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.10024160
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ce33
mov esp, ebp
pop ebp
ret
push dword [esi + 0x4a0]
mov dword [ebp - 0x10], 1
call fcn.10036d40
push dword [esi + 0x4a4]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.10036d40
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x100037bd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.10024160
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003ce33
mov esp, ebp
pop ebp
ret
Function at 0x10005120
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1000529d
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x10005289
push esi
lea esp, [esp]
cmp dword [edi + 4], 2
jne 0x1000521a
cmp dword [edi + 0x18], 0
je 0x1000521a
mov eax, dword [edi + 0x10]
test eax, eax
je 0x1000521a
cmp eax, 0x10
jb 0x1000521a
push 0x20
call dword [0x100630c8]
mov esi, eax
add esp, 4
test esi, esi
je 0x1000527e
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x100630c8]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x1000526d
mov ecx, dword [edi + 0x18]
movdqu xmm0, xmmword [ecx]
movdqu xmmword [eax], xmm0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x10005208
push eax
call dword [0x100630d4]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x10005253
mov eax, dword [ebp - 4]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x10005217
mov dword [eax + 0x1c], esi
mov dword [ebp - 4], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x10005160
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x10005237
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x10005285
push ebx
call fcn.100050e0
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x100630cc]
push esi
call dword [0x100630cc]
add esp, 8
jmp 0x10005228
push esi
mov edi, 8
call dword [0x100630cc]
add esp, 4
jmp 0x10005228
mov edi, 8
jmp 0x10005228
test ebx, ebx
jne 0x10005295
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005f80
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x10005fb3
push 0x2e
push edi
call fcn.1003ea20
add esp, 8
test eax, eax
je 0x10005fb1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret