joyce8/EMBER2024-capa huggingface dataset:
Function at 0x25dcc80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
lea edi, [ebp - 0x11c]
mov ecx, 0x47
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x23f6480]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.025dd4b0
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
call fcn.026b6310
add esp, 4
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
movsx ecx, byte [ebp + eax - 0x10d]
cmp ecx, 0x2f
jne 0x25dcd17
mov edx, dword [ebp - 0x118]
sub edx, 1
mov dword [ebp - 0x11c], edx
cmp dword [ebp - 0x11c], 0x104
jae 0x25dcd03
jmp 0x25dcd09
call fcn.026a5cbe
nop
mov eax, dword [ebp - 0x11c]
mov byte [ebp + eax - 0x10c], 0
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x114], ecx
jmp 0x25dcd34
mov edx, dword [ebp - 0x114]
add edx, 1
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0x114]
movsx ecx, byte [eax]
test ecx, ecx
je 0x25dcd95
mov edx, dword [ebp - 0x114]
movsx eax, byte [edx]
cmp eax, 0x2f
je 0x25dcd5d
mov ecx, dword [ebp - 0x114]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x25dcd93
mov eax, dword [ebp - 0x114]
mov byte [eax], 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
call fcn.026e1efb
add esp, 8
test eax, eax
je 0x25dcd8a
lea edx, [ebp - 0x10c]
push edx
call fcn.026e1e91
add esp, 4
mov eax, dword [ebp - 0x114]
mov byte [eax], 0x5c
jmp 0x25dcd25
push 0
lea ecx, [ebp - 0x10c]
push ecx
call fcn.026e1efb
add esp, 8
test eax, eax
je 0x25dcdb9
lea edx, [ebp - 0x10c]
push edx
call fcn.026e1e91
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x25dcde8]
call fcn.026a5faa
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.026a6086
add esp, 0x11c
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret

Function at 0x25de010
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x25de023
mov eax, 1
jmp 0x25de0af
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + 0x1c], dx
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x67452301
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0xefcdab89
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x98badcfe
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x10325476
mov edx, 4
shl edx, 2
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0xc3d2e1f0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x60], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x64], 0
xor eax, eax
pop ebp
ret
Function at 0x25e46a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov ecx, 0x23e4033
call fcn.026a74de
mov ecx, dword [ebp - 4]
call fcn.025e5050
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.026c51e2
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.026e37c0
add esp, 4
cmp eax, 0xffffffff
jne 0x25e4729
mov edx, dword [ebp + 8]
push edx
call fcn.026e373d
add esp, 4
test eax, eax
je 0x25e4729
push 0
push 0
push 5
mov eax, dword [ebp - 4]
push eax
call fcn.025e55b0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x38]
jmp 0x25e4864
push 2
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.026c51e2
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.026c5a24
add esp, 4
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.026c51e2
add esp, 0xc
mov edx, dword [ebp - 0x14]
and edx, dword [ebp - 0x10]
cmp edx, 0xffffffff
jne 0x25e4784
push 0
push 0
push 5
mov eax, dword [ebp - 4]
push eax
call fcn.025e55b0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x38]
jmp 0x25e4864
xor edx, edx
jne 0x25e4784
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], 0xffffffff
cmp dword [ebp - 8], 0
ja 0x25e47a7
cmp dword [ebp - 0xc], 0xffffffff
jb 0x25e47c4
push 0
push 0
push 5
mov edx, dword [ebp - 4]
push edx
call fcn.025e55b0
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
jmp 0x25e4864
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 8]
jne 0x25e47e6
push 0
push 0
push 0xd
mov edx, dword [ebp - 4]
push edx
call fcn.025e55b0
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
jmp 0x25e4864
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
xor edx, edx
jne 0x25e47ec
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
call fcn.026a7236
add esp, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov dword [ecx + 0x50], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x50]
push eax
call fcn.026c4cc8
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x1c]
je 0x25e4849
push 0
push 0
push 5
mov edx, dword [ebp - 4]
push edx
call fcn.025e55b0
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
jmp 0x25e4864
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x50]
mov eax, dword [ebp - 0x1c]
mov byte [edx + eax], 0
mov ecx, dword [ebp - 4]
call fcn.025e54e0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x38]
add esp, 0x24
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret 4
Function at 0x25f6970
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov ecx, 0x23e4361
call fcn.026a74de
mov dword [ebp - 0x14], 4
mov esi, esp
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x1008
push 0xffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x25f69e8
cmp dword [ebp - 8], 1
jne 0x25f69e8
mov esi, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp esi, esp
call fcn.026a5ffe
nop
push edx
mov ecx, ebp
push eax
lea edx, [0x25f6a08]
call fcn.026a5faa
pop eax
pop edx
pop esi
add esp, 0x18
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x25feef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x23e4833
call fcn.026a74de
mov eax, dword [ebp + 8]
mov byte [eax + 0xa2], 0
mov ecx, dword [ebp + 8]
mov byte [ecx + 0xa8], 0
mov edx, dword [ebp + 8]
mov byte [edx + 0xa4], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0xaa], 0
mov ecx, dword [ebp + 8]
mov byte [ecx + 0xb3], 0
mov edx, dword [ebp + 8]
xor eax, eax
xor ecx, ecx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov edx, dword [ebp + 8]
xor eax, eax
xor ecx, ecx
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp + 8]
mov byte [edx + 0xa1], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x34], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x38], 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.02616800
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x25fefa0
mov eax, dword [ebp - 4]
jmp 0x25ff025
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xb2]
test eax, eax
jne 0x25fefd7
push 1
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x49c]
push edx
mov eax, dword [ebp + 8]
add eax, 0x60
push eax
call fcn.0263e5a0
add esp, 0x10
mov ecx, dword [ebp + 8]
mov byte [ecx + 0xb2], 1
jmp 0x25ff023
mov edx, dword [ebp + 8]
add edx, 0x60
push edx
call fcn.0263e610
add esp, 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x49c]
cmp edx, dword [ecx + 0x78]
je 0x25ff023
mov eax, dword [ebp + 8]
add eax, 0x60
push eax
call fcn.0263e670
add esp, 4
push 1
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x49c]
push edx
mov eax, dword [ebp + 8]
add eax, 0x60
push eax
call fcn.0263e5a0
add esp, 0x10
xor eax, eax
add esp, 4
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x261cc30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
push esi
push edi
lea edi, [ebp - 0x1b0]
mov ecx, 0x6c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x23f6480]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x23e51ea
call fcn.026a74de
mov eax, dword [ebp + 8]
and eax, 2
je 0x261cd0a
mov ecx, 0x202
mov word [ebp - 0xc], cx
mov esi, esp
lea edx, [ebp - 0x1a0]
push edx
movzx eax, word [ebp - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp esi, esp
call fcn.026a5ffe
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
je 0x261ccaa
mov eax, 2
jmp 0x261ce55
movzx ecx, word [ebp - 0x1a0]
and ecx, 0xff
movzx edx, cl
movzx eax, word [ebp - 0xc]
and eax, 0xff
movzx ecx, al
cmp edx, ecx
jne 0x261ccf1
movzx edx, word [ebp - 0x1a0]
shr edx, 8
and edx, 0xff
movzx eax, dl
movzx ecx, word [ebp - 0xc]
shr ecx, 8
and ecx, 0xff
movzx edx, cl
cmp eax, edx
je 0x261cd0a
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp esi, esp
call fcn.026a5ffe
mov eax, 2
jmp 0x261ce55
call fcn.0265c260
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
je 0x261cd29
mov eax, dword [ebp - 0x1ac]
jmp 0x261ce55
push 0x23ec594
call fcn.0261cfe0
add esp, 4
mov dword [0x255e9ac], eax
cmp dword [0x255e9ac], 0
je 0x261cd79
mov esi, esp
push 0x23ec5b0
mov eax, dword [0x255e9ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.026a5ffe
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
je 0x261cd79
mov ecx, dword [ebp - 0x1b0]
mov dword [0x255e99c], ecx
mov esi, esp
push 0x23ec5c0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.026a5ffe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x261cded
mov esi, esp
push 0x23ec5c8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.026a5ffe
mov dword [0x255e9a0], eax
mov esi, esp
push 0x23ec5d8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.026a5ffe
mov dword [0x255e9a4], eax
mov esi, esp
push 0x23ec5ec
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.026a5ffe
mov dword [0x255e9a8], eax
push 3
push 2
push 0
push 0
push 6
call fcn.0265bdb0
add esp, 0x14
movzx edx, al
test edx, edx
je 0x261ce0f
mov byte [0x2560061], 1
jmp 0x261ce16
mov byte [0x2560061], 0
push 3
push 2
push 0
push 2
push 6
call fcn.0265bdb0
add esp, 0x14
movzx eax, al
test eax, eax
je 0x261ce38
mov byte [0x2560060], 1
jmp 0x261ce3f
mov byte [0x2560060], 0
mov esi, esp
push 0x2560068
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
cmp esi, esp
call fcn.026a5ffe
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x261ce84]
call fcn.026a5faa
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.026a6086
add esp, 0x1b0
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x2620890
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov ecx, 0x23e5500
call fcn.026a74de
mov dword [ebp - 8], 0x4020
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 4
cmp dword [0x255e9bc], 0
jne 0x262090e
push 3
push 2
push 0
push 0
push 6
call fcn.0265bdb0
add esp, 0x14
movzx eax, al
test eax, eax
je 0x2620904
mov dword [0x255e9bc], 2
jmp 0x262090e
mov dword [0x255e9bc], 1
cmp dword [0x255e9bc], 2
jne 0x2620919
jmp 0x2620970
mov esi, esp
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x1001
push 0xffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x262094c
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jle 0x262094c
jmp 0x2620970
mov esi, esp
push 4
lea edx, [ebp - 8]
push edx
push 0x1001
push 0xffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.026a5ffe
nop
push edx
mov ecx, ebp
push eax
lea edx, [0x2620990]
call fcn.026a5faa
pop eax
pop edx
pop esi
add esp, 0x24
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret

Function at 0x26212c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
push edi
lea edi, [ebp - 0x11c]
mov ecx, 0x47
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x23f6480]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x23e5500
call fcn.026a74de
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], 6
mov esi, esp
push 4
lea eax, [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jge 0x2621358
push 0x100
lea eax, [ebp - 0x118]
push eax
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.026a5ffe
push eax
call fcn.0263ac70
add esp, 0xc
push eax
push 0x23eca58
mov ecx, dword [ebp + 8]
push ecx
call fcn.02615e00
add esp, 0xc
push edx
mov ecx, ebp
push eax
lea edx, [0x2621388]
call fcn.026a5faa
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.026a6086
add esp, 0x11c
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x26213c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov ecx, 0x23e5500
call fcn.026a74de
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x642]
test ecx, ecx
je 0x26213f9
mov dword [ebp - 0x10], 1
jmp 0x2621400
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov esi, esp
push 4
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jge 0x2621454
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.026a5ffe
push eax
mov edx, dword [ebp + 0xc]
push edx
push 0x23eca78
mov eax, dword [ebp + 8]
push eax
call fcn.02615e00
add esp, 0x10
jmp 0x2621579
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5e8]
push edx
call fcn.0261c650
add esp, 4
mov dword [ebp - 8], eax
imul eax, dword [ebp - 8], 0x3e8
mov dword [ebp - 8], eax
mov esi, esp
push 4
lea ecx, [ebp - 8]
push ecx
push 3
push 6
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jge 0x26214b9
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.026a5ffe
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0x23ecaa8
mov ecx, dword [ebp + 8]
push ecx
call fcn.02615e00
add esp, 0x10
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5ec]
push eax
call fcn.0261c650
add esp, 4
mov dword [ebp - 8], eax
imul ecx, dword [ebp - 8], 0x3e8
mov dword [ebp - 8], ecx
mov esi, esp
push 4
lea edx, [ebp - 8]
push edx
push 0x11
push 6
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jge 0x262151e
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.026a5ffe
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x23ecad8
mov edx, dword [ebp + 8]
push edx
call fcn.02615e00
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5f0]
push ecx
call fcn.0261c650
add esp, 4
mov dword [ebp - 8], eax
mov esi, esp
push 4
lea edx, [ebp - 8]
push edx
push 0x10
push 6
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jge 0x2621579
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.026a5ffe
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x23ecb08
mov edx, dword [ebp + 8]
push edx
call fcn.02615e00
add esp, 0x10
push edx
mov ecx, ebp
push eax
lea edx, [0x262159c]
call fcn.026a5faa
pop eax
pop edx
pop esi
add esp, 0x10
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x2622c00
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x23e5500
call fcn.026a74de
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xffffffff
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x2622c39
jmp 0x2622c63
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x98]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp esi, esp
call fcn.026a5ffe
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop esi
add esp, 8
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x26231f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x23f6480]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x23e5500
call fcn.026a74de
nop
lea eax, [ebp - 0x44]
push eax
call fcn.025fc910
add esp, 4
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x2c], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x28], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 8]
add eax, 0x130
sub esp, 0x10
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x30]
mov dword [ecx], edx
mov eax, dword [ebp - 0x2c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x28]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x24]
mov dword [ecx + 0xc], eax
call fcn.025fca70
add esp, 0x20
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 0
jl 0x262333f
jg 0x26232a5
cmp dword [ebp - 0x4c], 0x3e8
jbe 0x262333f
mov esi, esp
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 4
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0x4004747b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x98]
push ecx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x2623320
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x140]
je 0x2623320
mov esi, esp
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x1001
push 0xffff
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x98]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x2623320
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x140], edx
mov eax, dword [ebp + 8]
add eax, 0x130
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc], edx
push edx
mov ecx, ebp
push eax
lea edx, [0x262336c]
call fcn.026a5faa
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.026a6086
add esp, 0x4c
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x2623c10
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov ecx, 0x23e5500
call fcn.026a74de
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 1
xor edx, edx
jne 0x2623c45
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x98]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp esi, esp
call fcn.026a5ffe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x2623ca4
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.026a5ffe
push eax
mov edx, dword [ebp - 4]
add edx, 0x9c
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.02622100
add esp, 0xc
jmp 0x2623d2c
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14a], 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.02622530
add esp, 8
mov ecx, dword [ebp - 4]
cmp dword [ecx], 5
jne 0x2623ccf
mov dword [ebp - 0x10], 0x23ecf38
jmp 0x2623cd6
mov dword [ebp - 0x10], 0x23ecf40
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xf8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x9c
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xfc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0xca
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x98]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x23ecf44
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.02615e90
add esp, 0x24
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x14], edx
xor eax, eax
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x262ba90
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov ecx, 0x23e5a2d
call fcn.026a74de
cmp dword [ebp + 8], 0
je 0x262bb5d
xor eax, eax
jne 0x262bac8
xor ecx, ecx
jne 0x262bacc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x80]
movzx ecx, byte [eax + 0x14c]
test ecx, ecx
jne 0x262bb1b
push 0
call fcn.0262ba90
add esp, 4
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
test edx, edx
je 0x262bb02
mov dword [ebp - 0x10], 2
jmp 0x262bb09
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov dl, byte [ebp - 0x10]
mov byte [ecx + 0x14c], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
movzx edx, byte [ecx + 0x14c]
cmp edx, 2
jne 0x262bb39
mov dword [ebp - 0x14], 1
jmp 0x262bb40
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x262bb4f
mov dword [ebp - 0x18], 0
jmp 0x262bb56
mov dword [ebp - 0x18], 1
mov al, byte [ebp - 0x18]
jmp 0x262bbd5
mov dword [ebp - 8], 0xffffffff
mov esi, esp
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp esi, esp
call fcn.026a5ffe
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x262bb8b
mov dword [ebp - 8], 0
jmp 0x262bba6
mov dword [ebp - 8], 1
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp esi, esp
call fcn.026a5ffe
nop
cmp dword [ebp - 8], 0
jle 0x262bbb5
mov dword [ebp - 0x1c], 1
jmp 0x262bbbc
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0
jne 0x262bbcb
mov dword [ebp - 0x20], 0
jmp 0x262bbd2
mov dword [ebp - 0x20], 1
mov al, byte [ebp - 0x20]
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret