joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401396
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
cmp dword [0x1a13eb8], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x2c], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x4013cc
push 0
lea eax, [ebp - 0x44c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x41a308]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [0x41a30c]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x28], eax
call fcn.0040138c
mov ecx, dword [0x41a310]
mov eax, dword [0x41a314]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x1a13eb8], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1a13eb4]
cmove eax, edx
xor edx, edx
cmp dword [0x1a13eb8], 0x3eb
mov dword [0x1a13eb4], eax
mov eax, dword [0x1a138a4]
cmove eax, edx
add ecx, ebx
mov dword [0x1a138a4], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x1c]
mov ecx, dword [0x1a13eb8]
xor eax, edx
mov dword [0x1a13eb0], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x401500
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea eax, [ebp - 0xc4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1a13eb8]
sub edi, eax
cmp ecx, 0xc
jne 0x40150e
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.00401393
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x40155a
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
jmp 0x40140a
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e9ad
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4197a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040af87
mov dword [ebp - 0x14], eax
cmp dword [0x44dcc0], esi
jne 0x40eaa0
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40ea2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40eb80
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40eb80
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40eb80
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x44dcc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x44dcc4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x44dcc8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44dcd0], eax
test eax, eax
je 0x40ea9d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44dccc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40eac5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40eab8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40eada
push 4
pop eax
jmp 0x40eb82
cmp dword [ebp - 0x14], esi
je 0x40eada
push dword [0x44dcc0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40eabf
mov eax, dword [0x44dccc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40eb38
cmp dword [0x44dcd0], edi
je 0x40eb38
push eax
call ebx
push dword [0x44dcd0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40eb38
test eax, eax
je 0x40eb38
call ecx
test eax, eax
je 0x40eb2d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40eb2d
test byte [ebp - 8], 1
jne 0x40eb38
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40eb68
mov eax, dword [0x44dcc4]
cmp eax, edi
je 0x40eb65
push eax
call ebx
test eax, eax
je 0x40eb65
call eax
mov esi, eax
test esi, esi
je 0x40eb65
mov eax, dword [0x44dcc8]
cmp eax, edi
je 0x40eb65
push eax
call ebx
test eax, eax
je 0x40eb65
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x44dcc0]
call ebx
test eax, eax
je 0x40eb80
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40eb82
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403e80
mov esp, ebp
pop ebp
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100062fa
pop dword [ebp - 0x44]
mov eax, 0x58faf091
add eax, 0xb7057269
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3c6d8
push 0
mov eax, 0x202c47ea
add eax, 0xefd4f87a
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x611fb3e9
sub ecx, 0x611f5e4a
mov edx, eax
mov edi, 0x10018600
add edi, dword [ebp - 0x44]
mov esi, 0x4d52a4a4
sub esi, 0xf780228c
mov dword [ebp - 0xc], 0x20e1a16c
mov ebx, dword [edi]
xor dword [ebp - 0x30], edi
add ebx, esi
mov dword [ebp - 0x20], 0xa2f15958
mov dword [edx], ebx
add edx, 0xf97fa984
add edx, 0x6805680
add edi, 0xc14e3122
sub edi, 0xc14e311e
loop 0x10006353
add eax, 0x9223f945
sub eax, 0x9222aff6
xor ebx, ebx
add ebx, eax
add eax, 0x360c1ed5
add eax, 0xc9f3e130
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401444
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x30
call sym._malloc
add esp, 4
mov eax, eax
mov edx, eax
mov eax, edx
mov dword [ebp - 4], eax
test eax, eax
jne 0x401478
push 0x4013e0
call sym._printf
add esp, 4
push 1
call sym._exit
add esp, 4
mov eax, dword [ebp - 4]
push eax
push 0x401420
call sym._printf
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sym._strcpy
add esp, 8
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 0
mov edx, dword [ebp - 4]
mov eax, edx
jmp 0x4014b0
mov esp, ebp
pop ebp
ret
Function at 0x6d66259d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x6d6625ac
pop dword [ebp - 0x2c]
mov eax, 0x107c0e02
add eax, 0x5cea17aa
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1e613bb3
add dword [ebp - 0x3c], 0x2ff10998
mov dword [ebp - 0x38], 0xc6ed6f5a
sub dword [ebp - 0x38], 0x94ba2315
mov dword [ebp - 0x34], 0xdb7a5ec0
sub dword [ebp - 0x34], 0x8f2e1a92
mov dword [ebp - 0x30], 0x7617b938
sub dword [ebp - 0x30], 0x7617b938
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x6c1db4e3
sub eax, 0xfeb6f4a7
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x6aca1364
add dword [ebp - 0x3c], 0x9a855f2
mov dword [ebp - 0x38], 0xbe377ae4
sub dword [ebp - 0x38], 0x7ccb196f
mov dword [ebp - 0x34], 0xe150e88a
sub dword [ebp - 0x34], 0x7de17c1e
mov dword [ebp - 0x30], 0xe66c9fb4
sub dword [ebp - 0x30], 0xe66c9fb4
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xbcf2d95b
add eax, 0xb073e6f1
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x33dd6
push 0
call eax
mov ecx, 0x3a80
mov edx, eax
mov esi, 0xafe96750
add esi, 0xbd7dd8b0
add esi, dword [ebp - 0x2c]
mov ebx, 0x1e2e5f63
sub ebx, 0x1d8f7e4c
mov edi, dword [esi]
sub edi, ebx
xor dword [ebp - 0xc], 0xe67f02d3
mov dword [edx], edi
add dword [ebp - 0x24], 0x48365adb
add edx, 4
add esi, 0x20a09be3
sub esi, 0x20a09bdf
loop 0x6d6626c8
add eax, 0xdcd3
mov ebx, eax
add eax, 0x5d0930af
sub eax, 0x5d0930aa
mov ecx, 0xb2619c3d
add ecx, 0xbb0463c3
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x6d665180
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x6d6715b4]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x6d6651b6
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d6652b0
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x6d6651ea
push str.create
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d6652af
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x6d67117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x6d66529c
push dword [0x6d6715a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x6d665245
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d665262
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6d665280
push str.create
push esi
call fcn.6d663a00
pop ecx
pop ecx
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x6d67117c]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
jmp 0x6d6652ae
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x6d67117c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x6d6652ae
push 0
push dword [0x6d6715a8]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x6d6662df
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x28], eax
call fcn.6d664fdf
push edi
mov ebx, eax
call fcn.6d66500b
pop ecx
pop ecx
test ebx, ebx
jns 0x6d66633c
test eax, eax
jns 0x6d66633a
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
leave
ret 0x10
mov ebx, eax
cmp dword [ebp + 0x10], 0xf
jne 0x6d6663d1
mov dword [ebp - 0x30], 0x1c
cmp ebx, 0xffffffff
jne 0x6d66635b
push edi
call fcn.6d66500b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x6d666383
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
add esp, 0xc
jmp 0x6d666326
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
mov edi, eax
test edi, edi
je 0x6d666326
push dword [ebp - 0x28]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d666326
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x28]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x6d666329
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x6d6663ef
push str.Invalid_option
jmp 0x6d66631b
mov edi, 0x80
mov dword [ebp - 0x2c], 4
cmp dword [ebp + 0x10], edi
je 0x6d666404
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
test eax, eax
jns 0x6d66642e
push str.getsockopt
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d666326
mov eax, dword [ebp + 0x10]
cmp eax, 8
jg 0x6d66644c
je 0x6d666465
dec eax
je 0x6d666465
dec eax
dec eax
je 0x6d666476
dec eax
je 0x6d666465
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x6d66631b
cmp eax, edi
je 0x6d66647e
cmp eax, 0x1000
jle 0x6d666442
cmp eax, 0x1002
jle 0x6d666476
cmp eax, 0x1003
jne 0x6d666442
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x6d666329
mov eax, dword [ebp - 0x24]
jmp 0x6d666329
cmp word [ebp - 0x24], 0
je 0x6d666326
movzx eax, word [ebp - 0x22]
jmp 0x6d666329
Function at 0x6d6664df
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push dword [0x6d6715b4]
mov esi, dword [esp + 0xc]
push dword [esp + 0x10]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
test eax, eax
jne 0x6d666507
push str.Socket_closed
push str.java_net_SocketException
jmp 0x6d66654c
push dword [0x6d67117c]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x190]
cmp eax, 0xffffffff
je 0x6d6664fb
push 1
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x6d666540
push str.send
push esi
call fcn.6d663a00
pop ecx
pop ecx
jmp 0x6d666552
cmp eax, 0xfffffffe
jne 0x6d666552
push 0
push str.java_io_InterruptedIOException
push esi
call sub.java.dll__JNU_ThrowByName_12
pop esi
ret 0xc

Function at 0x6d66659a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
xor eax, eax
cmp byte [ebp + 0x10], al
push esi
sete al
push 0
inc eax
push eax
push 0x17
call fcn.6d66465c
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x6d6665d8
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
or eax, esi
jmp 0x6d66660f
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6d666602
push str.create
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
push 0
push 1
push esi
call dword [sym.imp.kernel32.dll_SetHandleInformation]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x6d66667f
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push 1
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
test eax, eax
jne 0x6d666701
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d666704
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x6d6666dc
push 0xfffffffffffffffe
pop eax
jmp 0x6d666704
cmp eax, 0x2741
jne 0x6d6666f5
push str.connect:_Address_is_invalid_on_local_machine__or_port_is_not_valid_on_remote_machine
push str.java_net_ConnectException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d666701
push str.connect
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d66b1da
leave
ret 0x14
Function at 0x6d666713
Capabilities:
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0x198], eax
xor eax, eax
inc eax
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0x1b0]
cdq
mov ecx, 0x3e8
idiv ecx
push ebx
push esi
mov esi, dword [ebp + 0x1ac]
push edi
mov edi, dword [ebp + 0x1a4]
xor ebx, ebx
mov dword [ebp - 0x78], 4
mov dword [ebp - 0x6c], esi
mov dword [ebp + 0x98], esi
mov dword [ebp - 0x80], eax
imul edx, edx, 0x3e8
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x94]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x7c], edx
call dword [sym.imp.ws2_32.dll_select]
mov dword [ebp - 0x74], eax
cmp eax, ebx
jne 0x6d6667b1
push str.connect_timed_out
push str.java_net_SocketTimeoutException
push edi
call sub.java.dll__JNU_ThrowByName_12
push 2
push esi
call dword [sym.imp.ws2_32.dll_shutdown]
jmp 0x6d666814
lea eax, [ebp + 0x94]
push eax
push esi
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x6d666814
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x1007
push 0xffff
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
cmp dword [ebp - 0x74], 0
jne 0x6d666806
push 0
call dword [sym.imp.kernel32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x6d6667c2
cmp dword [ebp - 0x74], 0
jne 0x6d666806
push str.Unable_to_establish_connection
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d666814
push str.connect
push dword [ebp - 0x74]
push edi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
add ebp, 0x19c
leave
ret 0x10

Function at 0x6d66682e
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d666895
push esi
mov esi, dword [sym.imp.ws2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2736
jne 0x6d666881
push str.Socket_closed
push str.java_net_SocketException
push edi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d66688f
push str.getsockname_failed
call esi
push eax
push edi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
or eax, 0xffffffff
pop esi
jmp 0x6d6668a3
movzx eax, word [ebp - 0x1e]
push eax
call dword [sym.imp.ws2_32.dll_ntohs]
movzx eax, ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.6d66b1da
leave
ret 0xc
Function at 0x6d6668b2
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d6668fb
push str.Error_getting_socket_name
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
jmp 0x6d66693c
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
mov ebx, eax
test ebx, ebx
je 0x6d66693b
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x6d66693b
mov ecx, dword [esi]
push ebx
push eax
push edi
push esi
call dword [ecx + 0x1a0]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.6d66b1da
leave
ret 0x10

Function at 0x6d666bf1
Capabilities:
Send data
Send data on socket

Disassembly:
push 1
push 1
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x6d666c20
push str.send
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [esp + 0xc]
call sym.net.dll__Java_java_net_Inet4AddressImpl_isReachable0_24
jmp 0x6d666c35
cmp eax, 0xfffffffe
jne 0x6d666c35
push 0
push str.java_io_InterruptedIOException
push dword [esp + 0xc]
call sub.java.dll__JNU_ThrowByName_12
ret 0x10