joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508517
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00591690
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call sym.mininews.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00590c4b
leave
ret

Function at 0x50c7e7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0xb4]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x50c813
cmp ebx, dword [esi + 0x1f4]
je 0x50c813
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x1f4]
cmp ebx, eax
je 0x50c8ea
push edi
test eax, eax
je 0x50c872
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x17
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x1f4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x12c]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x1f4]
mov ecx, esi
call sym.mininews.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
mov dword [esi + 0x1f4], edi
test ebx, ebx
je 0x50c8e9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x50c8e9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xec]
test al, al
je 0x50c8e9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xf8]
test al, al
je 0x50c8e9
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x1f4], ebx
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x1f4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x12c]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x1f4]
mov ecx, esi
call sym.mininews.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x50d0af
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x2a4]
mov ecx, edi
xor ebx, ebx
call sym.mininews.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
test eax, eax
jle 0x50d0fe
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call sym.mininews.exe_public:_void____thiscall_DuiLib::CStdPtrArray::operator___int_const
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x50d162
mov ecx, edi
inc ebx
call sym.mininews.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
cmp ebx, eax
jl 0x50d0cd
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x50d1c7
sub eax, 4
je 0x50d166
dec eax
dec eax
jne 0x50d1be
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.00599115
pop ecx
mov ecx, dword [esi + 0x1f0]
push reloc.WS2_32.dll_select
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push sym.mininews.exe_private:_static_class_DuiLib::CControlUI____stdcall_DuiLib::CPaintManagerUI::__FindControlFromShortcut_class_DuiLib::CControlUI___void__
call dword [eax + 0x120]
mov esi, eax
test esi, esi
je 0x50d1be
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x114]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x50d1c0
cmp dword [esi + 0x1f4], 0
je 0x50d1be
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x204]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x208]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.005082fb
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x1f4]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x12c]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x50d1be
cmp dword [esi + 0x1f4], 0
je 0x50d225
mov ecx, dword [esi + 0x1f4]
mov eax, dword [ecx]
call dword [eax + 0xec]
test al, al
je 0x50d225
mov ecx, dword [esi + 0x1f4]
mov eax, dword [ecx]
call dword [eax + 0xf8]
test al, al
je 0x50d225
mov ecx, dword [esi + 0x1f4]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.00592a95
pop ecx
pop ecx
test eax, eax
je 0x50d225
mov ecx, dword [esi + 0x1f4]
call sym.mininews.exe_public:_bool___thiscall_DuiLib::CRichEditUI::IsWantTab_void_
test al, al
jne 0x50d1be
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx eax, al
push eax
mov ecx, esi
call sym.mininews.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::SetNextTabControl_bool_
jmp 0x50d162
Function at 0x5124f6
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov cl, byte [esp + 8]
mov byte [esi + 0x13], cl
test eax, eax
je 0x512572
test cl, cl
je 0x512516
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x512572
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
push 0xfffffffffffffff0
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0x10000000
mov ebx, 0x21000000
jne 0x51253f
mov byte [esi + 0x10], 1
jmp 0x512550
mov edx, eax
and edx, ebx
neg edx
sbb dl, dl
and dl, 0xfe
add dl, 7
mov byte [esi + 0x10], dl
test ecx, ecx
je 0x512570
test ebx, eax
jne 0x512570
push 4
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 8]
call edi
push eax
mov ecx, esi
call sym.mininews.exe_protected:_void___thiscall_DuiLib::CShadowUI::Update_struct_HWND____
pop edi
pop ebx
pop esi
ret 4

Function at 0x519aa1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x519b2d
cmp dword [esi + 0x10], ebx
je 0x519b2d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.00591cf0
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x519b2d
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x1c4
call fcn.0050781d
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call sym.mininews.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call sym.mininews.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::IsLayered_void_
test al, al
je 0x519b2d
mov ecx, dword [esi + 0x10]
call sym.mininews.exe_public:_void___thiscall_DuiLib::CControlUI::Invalidate_void_
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00590c4b
leave
ret 0x10
Function at 0x51fb02
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x604], ebx
je 0x51fb6a
cmp dword [ebp + 8], 0x100
jne 0x51fb59
cmp word [ebp + 0xc], 0xd
jne 0x51fb59
cmp byte [esi + 0x60a], bl
je 0x51fb40
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x51fb59
cmp byte [esi + 0x60b], bl
jne 0x51fb59
mov ecx, dword [esi + 0x44]
cmp ecx, ebx
je 0x51fb55
push ebx
push ebx
push ebx
push str.return
push esi
call sym.mininews.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x51fb6d
mov eax, dword [esi + 0x604]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x522470
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0x218]
sub esp, 0x298
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp + 0x214], eax
lea eax, [ebp - 0x7c]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x5224a1
xor eax, eax
jmp 0x522511
push 0xfe
lea eax, [ebp + 0x115]
push 0
push eax
mov byte [ebp + 0x114], 0
call fcn.00591690
add esp, 0xc
push 0xff
lea eax, [ebp + 0x114]
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp + 0x114]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x52249d
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 0x80]
push eax
call fcn.00596f90
movzx eax, byte [ebp - 0x80]
movzx ecx, byte [ebp - 0x7f]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x7e]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x7d]
shl eax, 8
add esp, 0xc
add eax, ecx
mov ecx, dword [ebp + 0x214]
xor ecx, ebp
call fcn.00590c4b
add ebp, 0x218
leave
ret

Function at 0x52a516
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, dword [ebp + 0xc]
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov esi, eax
cmp ebx, 0x21
jb 0x52a566
cmp ebx, 0x28
jbe 0x52a560
cmp ebx, 0x2c
jbe 0x52a566
cmp ebx, 0x2e
ja 0x52a566
or esi, 0x100
cmp dword [ebp + 0x10], 0
je 0x52a572
or esi, 0x1000000
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00591690
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
shl esi, 0x10
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call sym.mininews.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00590c4b
leave
ret 0xc
Function at 0x534cf4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x534d19
cmp eax, esi
jge 0x534d11
mov eax, edi
call fcn.00534782
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
xor ecx, ecx
cmp dword [edi + 8], ecx
jle 0x534d3b
mov al, byte [edi + 0xc]
shr dword [edi + 0xc], 8
add dword [edi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [edi + 8], 0
jg 0x534d20
cmp ecx, 4
jge 0x534d57
mov esi, dword [edi + 4]
mov eax, dword [edi]
cmp eax, esi
jb 0x534d48
xor dl, dl
jmp 0x534d4d
mov dl, byte [eax]
inc eax
mov dword [edi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x534d3e
movzx esi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl esi, 8
add esi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, esi
xor ecx, 0xffff
cmp eax, ecx
je 0x534d89
mov eax, str.zlib_corrupt
call fcn.0053018b
jmp 0x534dc5
mov eax, dword [edi]
add eax, esi
cmp eax, dword [edi + 4]
jbe 0x534d99
mov eax, str.read_past_buffer
jmp 0x534d82
mov eax, dword [edi + 0x10]
lea ecx, [eax + esi]
cmp ecx, dword [edi + 0x18]
jbe 0x534daf
push esi
call fcn.00534851
pop ecx
test eax, eax
je 0x534dc5
push esi
push dword [edi]
push dword [edi + 0x10]
call fcn.00596f90
add dword [edi], esi
add dword [edi + 0x10], esi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x53fca3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x53fcae
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x53fd69
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5e8548]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5e8548]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5e8548]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5e8548]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5e8548]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5e8548]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5e8548]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5e8548]
inc edx
sub edi, 8
dec esi
jne 0x53fcce
pop ebx
test edi, edi
je 0x53fd82
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x5e8548]
inc edx
dec edi
jne 0x53fd6d
pop edi
not eax
pop esi
ret

Function at 0x540219
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x54024d
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x540248
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x540275
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x54025e
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00596f90
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x541012
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5410bc
movzx ecx, word [esi]
test cx, cx
je 0x5410bc
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x541050
cmp cx, 0x5c
jne 0x541052
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x541044
cmp eax, esi
je 0x541090
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00592af6
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00541012
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0059b723
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0059b6f5
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00590c4b
leave
ret
Function at 0x5425ed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x542668
cmp dword [esi + 4], 0xffffffff
jne 0x542668
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x602b08
push edi
call fcn.0059b6f5
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x54263a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x54263a
mov eax, 0x2000000
jmp 0x54266d
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0054002f
add esp, 0x10
test eax, eax
jne 0x542658
mov eax, dword [ebp + 0x10]
jmp 0x54266d
push eax
call fcn.005421e9
mov dword [esi], eax
mov eax, dword [0x66f26c]
pop ecx
jmp 0x54266d
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x542ab0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x542b05
mov eax, dword [esp]
cmp al, 2
jne 0x542aff
shr eax, 8
cmp al, 2
jne 0x542aff
call fcn.00545350
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00590c4b
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.00590c4b
add esp, 0x194
ret
Function at 0x54ff20
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x54ff52
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x550090
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x5500ab
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x5500df
cmp eax, 2
jg 0x5500df
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x5eb280]
push 2
push edx
call fcn.0059502c
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.0059502c
add esp, 0x20
xor eax, eax
ret

Function at 0x5503f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + eax*4 + 0x154]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x55046d
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x550444
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.00544ac0
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.00550270
mov ecx, dword [esi]
add esp, 0x14
mov dword [ecx + 0x8624], ebp
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5521c0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x480], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x5521fe
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.005501e0
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x484]
push edx
mov dword [esp + 0xc], 1
call fcn.00554900
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x488]
push eax
call fcn.00554900
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x552277
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.005501e0
add esp, 0x10
add esp, 0x14
ret
Function at 0x552870
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
cmp dword [ebp + 0x8c], 2
push edi
mov edi, dword [ebp]
mov dword [esp + 0xc], edi
je 0x5529e5
cmp dword [ebp + 0x270], 0
push ebx
push esi
jne 0x5529da
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x5528fc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.00544ac0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.00550270
add esp, 0x18
jmp 0x5529e3
push ebx
lea edx, [esp + 0x1c]
push 0
push edx
mov dword [esp + 0x1c], ebx
call fcn.00591690
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x552949
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.00544ac0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.00550270
add esp, 0x18
jmp 0x5529e3
lea edi, [ebp + 0xb8]
lea ebx, [ebp + 0xe8]
lea esi, [esp + 0x98]
call fcn.00552830
test eax, eax
jne 0x55298a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.00544ac0
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.00550270
add esp, 0x18
jmp 0x5529e3
lea edi, [ebp + 0x58]
mov ecx, 0xb
lea esi, [ebp + 0xb8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [ebp + 0x11c]
lea edi, [ebp + 0xec]
lea esi, [esp + 0x18]
call fcn.00552830
test eax, eax
jne 0x5529da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.00544ac0
push eax
mov eax, dword [esp + 0x20]
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push eax
call fcn.00550270
add esp, 0x18
jmp 0x5529e3
push ebp
call fcn.005527d0
add esp, 4
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
xor ecx, esp
call fcn.00590c4b
add esp, 0x10c
ret

Function at 0x552a00
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x364]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x552a43
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00544ac0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.005501e0
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.005501e0
add esp, 8
pop esi
pop ecx
ret