joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5524b0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], 0xb
push esi
mov dword [eax + 4], ebx
mov eax, dword [ebp + 0xc]
push edi
test eax, eax
je 0x5524d3
mov eax, dword [eax]
jmp 0x5524d5
xor eax, eax
mov dword [ebp + 0xc], eax
call fcn.00555280
mov edi, eax
mov esi, edx
test edi, edi
je 0x5525cd
mov eax, dword [edi + 0x88]
push 0x10
mov dword [ebp - 4], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x5525cd
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx], edi
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
test ecx, ecx
je 0x55254d
mov eax, dword [ecx + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x84], eax
cmp dword [ecx + 0x14], 0
mov eax, dword [ecx + 0x10]
mov dword [ebp - 4], eax
jne 0x552554
call sym._b015226917.exe_pthread_self
mov dword [ebp - 4], edx
mov eax, dword [eax + 0x88]
mov dword [ebp - 4], eax
jmp 0x552554
mov dword [ebp - 0xc], 0
lea eax, [edi + 0x98]
mov dword [edi + 0x18], 0
push eax
push 4
push ebx
push 0x555a80
push dword [ebp - 0xc]
mov dword [edi + 0x30], 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0xc], ecx
mov dword [edi + 8], ecx
test ecx, ecx
je 0x5525ad
cmp dword [ebp + 0xc], 0
je 0x5525a3
push dword [ebp - 4]
push 0
push esi
push edi
call fcn.00555830
mov ecx, dword [ebp - 0xc]
add esp, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, 0xb
test ecx, ecx
cmovne eax, edx
mov dword [ebp - 0xc], eax
je 0x5525cd
mov ecx, dword [ebp + 8]
mov dword [ecx], edi
pop edi
mov dword [ecx + 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.00555940
add esp, 8
test ebx, ebx
je 0x5525e5
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5529a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
jne 0x5529c2
mov eax, dword [ebp + 8]
mov dword [eax], esi
lea eax, [esi + 0xc]
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x5529ea
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], 0
mov eax, 0xb
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x552a05
mov dword [esi + 4], ecx
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [esi + 8], 0
mov dword [ecx], esi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x554270
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x751578]
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, eax
je 0x554324
call sym._b015226917.exe_pthread_self
mov edi, eax
mov dword [ebp - 4], edx
test edi, edi
je 0x554338
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
test esi, esi
je 0x55431b
test edi, edi
je 0x554306
cmp dword [esi + 4], ebx
je 0x554306
test ecx, ecx
je 0x554306
lea eax, [ebp - 0x20]
push eax
lea eax, [esi + 8]
push eax
call fcn.00555090
lea eax, [ebp - 0x10]
push eax
lea eax, [edi + 0x1c]
push eax
call fcn.00555090
mov eax, dword [edi + 0x30]
add esp, 0x10
test eax, eax
je 0x5542e1
cmp dword [eax + 4], esi
je 0x5542ed
mov eax, dword [eax + 8]
test eax, eax
jne 0x5542d5
push esi
push edi
call fcn.00555c20
add esp, 8
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
call fcn.005550e0
lea eax, [ebp - 0x20]
push eax
call fcn.005550e0
add esp, 8
test ebx, ebx
jne 0x55431b
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
mov ecx, 0xb
cmove ebx, ecx
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
call sym._b015226917.exe_pthread_getspecific
mov ecx, dword [ebp + 0xc]
add esp, 4
test eax, eax
jne 0x554350
test ecx, ecx
jne 0x554343
pop edi
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov dword [ebp - 4], eax
jmp 0x55429d
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
jmp 0x55429d

Function at 0x554730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.005553d0
mov esi, eax
mov dword [0x751594], 1
push 0x400
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x55479f
push 0xc
push str.QUSEREX.DLL
lea eax, [ebp - 0x404]
push 0x400
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
add esp, 0x10
test eax, eax
jne 0x55479f
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x7515b0], eax
jmp 0x5547a4
mov eax, dword [0x7515b0]
test eax, eax
je 0x5547c3
push str.QueueUserAPCEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [0x7515b0]
mov dword [0x751570], ecx
jmp 0x5547c9
mov ecx, dword [0x751570]
test ecx, ecx
jne 0x5547de
mov dword [0x751570], 0x5549d0
test eax, eax
je 0x55482b
push eax
jmp 0x554825
push str.QueueUserAPCEx_Init
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x554815
call eax
test eax, eax
je 0x554815
cmp dword [0x7515b0], 0
mov eax, esi
je 0x554837
or dword [0x751594], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
push dword [0x7515b0]
mov dword [0x751570], 0x5549d0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov dword [0x7515b0], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x554850
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [0x751574], 0
je 0x5548bd
push dword [0x751578]
call sym._b015226917.exe_pthread_getspecific
add esp, 4
test eax, eax
je 0x554891
cmp dword [eax + 0x84], 1
jne 0x554891
push dword [eax + 0x10]
push dword [eax + 0xc]
call fcn.00555940
mov eax, dword [0x751578]
add esp, 8
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.00555420
mov eax, dword [0x7515b0]
test eax, eax
je 0x5548bd
push str.QueueUserAPCEx_Fini
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5548b1
call eax
push dword [0x7515b0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
ret

Function at 0x554900
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x751574], 0
je 0x5549c6
push edi
push dword [0x751578]
call sym._b015226917.exe_pthread_getspecific
mov edi, eax
add esp, 4
test edi, edi
je 0x5549bc
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.00554a30
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 0x20]
push eax
call fcn.00555090
lea eax, [ebp - 0x14]
mov dword [edi + 0x18], 6
push eax
call fcn.005550e0
add esp, 0x14
cmp dword [edi + 0x7c], 0
je 0x554996
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push esi
mov eax, dword [edi + 0x7c]
push edi
mov esi, dword [eax]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
call fcn.00555640
mov eax, dword [esi + 0x18]
add esp, 8
add eax, 4
push 0xffffffffffffffff
push eax
call ebx
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [edi + 0x7c], 0
jne 0x554965
pop esi
pop ebx
cmp dword [edi + 0x84], 1
jne 0x5549bc
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.00555940
mov eax, dword [0x751578]
add esp, 8
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x554a30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x554b5f
push esi
push edi
xor ecx, ecx
lea esi, [ebx + 0x1c]
nop dword [eax]
lea eax, [ebp - 0x20]
mov dword [ebp - 8], ecx
push eax
inc ecx
xor edi, edi
push esi
mov dword [ebp + 0xc], edi
mov dword [ebp - 0x10], ecx
call fcn.00555090
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x34], eax
lea eax, [ebp - 0x20]
push eax
call fcn.005550e0
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.00555090
mov esi, dword [ebx + 0x34]
add esp, 0x14
test esi, esi
je 0x554b43
nop dword [eax]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [esi + 4]
add eax, 8
push eax
call fcn.00555140
add esp, 8
cmp eax, 0x10
jne 0x554abe
lea eax, [ebp - 0x20]
push eax
call fcn.005550e0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x554b25
mov eax, dword [esi + 8]
mov dword [ebx + 0x34], eax
mov edi, dword [esi + 4]
mov eax, dword [edi + 4]
push dword [edi]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push dword [edi]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp - 4]
test edi, edi
je 0x554b0a
cmp dword [ebp - 8], 4
jge 0x554b0a
lea eax, [ebp - 0x20]
push eax
call fcn.005550e0
lea eax, [ebp - 0x30]
push eax
call fcn.005550e0
inc dword [ebp + 0xc]
push edi
call dword [ebp - 0xc]
jmp 0x554b22
push esi
call fcn.00555c80
lea eax, [ebp - 0x20]
push eax
call fcn.005550e0
lea eax, [ebp - 0x30]
push eax
call fcn.005550e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebx + 0x1c]
push eax
call fcn.00555090
mov esi, dword [ebx + 0x34]
add esp, 8
test esi, esi
jne 0x554a90
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.005550e0
mov ecx, dword [ebp - 0x10]
lea esi, [ebx + 0x1c]
add esp, 4
test edi, edi
jne 0x554a50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x555b60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [0x751578]
call sym._b015226917.exe_pthread_getspecific
mov edi, dword [ebp + 8]
mov esi, eax
add esp, 4
mov dword [esi + 0x18], 5
cmp edi, 2
je 0x555b91
cmp edi, 1
je 0x555b91
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
test byte [esi + 0x94], 1
je 0x555bba
mov eax, edi
xor ecx, ecx
sub eax, 1
je 0x555bad
sub eax, 1
jne 0x555bb0
or ecx, 0xffffffff
jmp 0x555bb0
mov ecx, dword [esi + 0x28]
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
add esp, 4
push 1
call fcn.005553b0
add esp, 4
lea eax, [esi + 0x38]
push edi
push eax
call sub.VCRUNTIME140.dll_longjmp
int3

Function at 0x556ae0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x556af1
mov eax, 1
pop ebp
ret
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
add esp, 4
neg eax
sbb eax, eax
neg eax
pop ebp
ret
Function at 0x556b10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x6f15a8
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x556b38
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, 0x84
pop edi
pop ebp
ret
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [esi]
push 1
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push edi
mov dword [esi], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
xor eax, eax
pop esi
pop edi
pop ebp
ret

Function at 0x556b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x68ef08
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x556b9c
push esi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
push esi
cmp eax, 1
je 0x556ba4
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, 1
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop esi
pop ebp
ret

Function at 0x556c50
Capabilities:
Set thread local storage value

Disassembly:
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp sym._b015226917.exe_pthread_win32_process_detach_np

Function at 0x556c60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x556c99
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
call sym._b015226917.exe_pthread_win32_process_attach_np
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret

Function at 0x556d10
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 0x18]
push 0
push 0x3e8
push dword [ebp + 0x1c]
push edi
call fcn.0066b190
mov dword [ebp - 8], eax
mov ecx, edi
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 4], eax
jg 0x556d50
jl 0x556d4c
test edi, edi
jae 0x556d50
xor eax, eax
jmp 0x556d53
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
inc eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_select]
xor ecx, ecx
test eax, eax
pop edi
sets cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x556f10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], eax
or esi, 0xffffffff
mov dword [eax + 8], 0
or edi, esi
mov eax, 2
mov dword [ebp - 0x18], 0x10
movups xmmword [ebp - 0x14], xmm0
push 0x7f000001
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, esi
je 0x557035
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, esi
je 0x55701c
push 5
push ebx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, esi
je 0x55701c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, esi
je 0x55701c
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x55701c
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x55701c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
cmp edi, 0xffffffff
je 0x55701c
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x55701c
push esi
call fcn.00556e00
push edi
call fcn.00556e00
mov eax, dword [ebp - 0x1c]
add esp, 8
mov dword [eax + 4], edi
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
call ebx
cmp esi, 0xffffffff
je 0x55702d
push esi
call ebx
cmp edi, 0xffffffff
je 0x557035
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x557050
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebx]
cmp ecx, edi
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp + 0x18]
cmovle ecx, edi
mov edx, dword [esi]
mov dword [ebp - 0xd0], eax
xor eax, eax
mov dword [ebp + 0xc], ecx
test edx, edx
je 0x5570a5
lea ecx, [esi + 4]
cmp dword [ecx], edi
je 0x5570a2
inc eax
add ecx, 4
cmp eax, edx
jb 0x557096
mov ecx, dword [ebp + 0xc]
cmp eax, edx
jne 0x5570b4
cmp edx, 0x40
jae 0x5570b4
mov dword [esi + eax*4 + 4], edi
inc dword [esi]
push dword [ebp + 0x20]
mov dword [ebx + 8], 0
push dword [ebp + 0x1c]
push dword [ebp - 0xd0]
push dword [ebp - 0xd4]
push esi
push ecx
call fcn.00556d10
add esp, 0x18
test eax, eax
jne 0x557120
push esi
push dword [ebx]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x55711e
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0
push 0xc8
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
js 0x55711e
mov dword [ebx + 8], 1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret

Function at 0x557140
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d8
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x2d4]
push dword [ebp + 0xc]
mov dword [ebp - 0x3d8], 0
push ecx
mov eax, dword [esi]
lea ecx, [ebp - 0x3d8]
push ecx
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x1cc], eax
push ecx
xor ecx, ecx
mov dword [ebp - 0x2d4], 0
test eax, eax
mov dword [ebp - 0x1d0], 1
mov dword [esi + 8], 0
cmovs eax, ecx
push eax
call fcn.00556d10
add esp, 0x18
test eax, eax
jne 0x5571fe
lea eax, [ebp - 0x1d0]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x5571fc
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0
push 0xc8
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
js 0x5571fc
mov dword [esi + 8], 1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00669a1e
mov esp, ebp
pop ebp
ret

Function at 0x557210
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push 2
push 0x73e870
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
cmp eax, 2
setne cl
mov eax, ecx
pop ebp
ret
Function at 0x566a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
sar eax, 3
and ecx, 7
push 0x7973
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp + 8]
xor edi, edi
movzx eax, ax
cdq
mov esi, edx
mov ebx, eax
mov edx, dword [ebp - 4]
test edx, edx
jle 0x566add
cmp edx, 4
jb 0x566ac1
mov eax, edx
and eax, 0x80000003
jns 0x566a7c
dec eax
or eax, 0xfffffffc
inc eax
sub edx, eax
xorps xmm2, xmm2
xorps xmm1, xmm1
movups xmm0, xmmword [ecx]
add edi, 4
pxor xmm2, xmm0
movups xmm0, xmmword [ecx + 0x10]
add ecx, 0x20
pxor xmm1, xmm0
cmp edi, edx
jl 0x566a84
pxor xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movd edx, xmm1
psrldq xmm1, 4
movd eax, xmm1
xor ebx, edx
mov edx, dword [ebp - 4]
xor esi, eax
cmp edi, edx
jge 0x566add
mov eax, edx
sub eax, edi
nop dword [eax]
xor ebx, dword [ecx]
lea ecx, [ecx + 8]
xor esi, dword [ecx - 4]
sub eax, 1
jne 0x566ad0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x566b06
push eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
lea eax, [eax + edx*8]
push eax
lea eax, [ebp - 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
xor ebx, dword [ebp - 8]
add esp, 0xc
xor esi, dword [ebp - 4]
mov edx, esi
xor ecx, ecx
xor edx, ebx
xor ecx, esi
mov eax, edx
shrd eax, ecx, 0x10
xor ax, dx
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x566c60
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x75320c], 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x90], ebx
je 0x566e2f
push esi
push edi
push 0x11
push 2
push 0x17
mov dword [ebp - 0x84], 0x1c
mov byte [ebp - 0x7d], 0
call dword [sym.imp.WS2_32.dll_socket]
push dword [ebp - 0x84]
mov esi, eax
lea eax, [ebp - 0x60]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x17
mov word [ebp - 0x60], ax
push 0xffff
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp - 0x84]
mov word [ebp - 0x5e], ax
lea eax, [ebp - 0x60]
push eax
push esi
mov byte [ebp - 0x58], 0x20
call dword [sym.imp.WS2_32.dll_connect]
mov edi, dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x566d16
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call edi
cmp eax, 0xffffffff
je 0x566d16
movups xmm0, xmmword [ebp - 0x74]
mov byte [ebp - 0x7d], 1
movups xmmword [0x753216], xmm0
push esi
call fcn.00556c40
add esp, 4
cmp byte [ebp - 0x7d], 0
je 0x566e0a
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x75320c]
call edi
cmp eax, 0xffffffff
je 0x566e0a
push dword [ebp - 0x7a]
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [0x753226], ax
call fcn.0054cc20
push 0
push 0x3e8
mov esi, edx
mov ebx, eax
push esi
push ebx
call fcn.0066b190
push 0
push 0xea60
push esi
push ebx
mov edi, eax
call fcn.0066b190
push 0
push 0x3c
mov esi, edx
mov dword [ebp - 0x88], eax
push esi
push eax
call fcn.0066b190
push 0x40
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x44]
push eax
push 0x753216
push 0x17
call sub.WS2_32.dll_inet_ntop
movzx ecx, word [0x753226]
mov edx, dword [ebp - 0x88]
push ecx
push eax
imul eax, edi, 0x3e8
sub ebx, eax
mov eax, edx
push ebx
mov ebx, dword [ebp - 0x8c]
mov ecx, ebx
shl eax, 4
sub eax, edx
shl ecx, 4
shl eax, 2
sub ecx, ebx
sub edi, eax
shl ecx, 2
push edi
mov eax, edx
sub eax, ecx
push eax
push 0
push 0x5a0
push esi
push edx
call fcn.0066b190
lea eax, [eax + eax*2]
shl eax, 3
sub ebx, eax
push ebx
push str._TitanSDK___02d:_02d:_02d._03d__udp__listen_port_v6_s__d_n
call fcn.00551730
mov ebx, dword [ebp - 0x90]
add esp, 0x1c
movups xmm0, xmmword [0x753216]
pop edi
pop esi
movups xmmword [ebx], xmm0
mov ax, word [0x753226]
mov word [ebx + 0x10], ax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov word [ebx + 0x10], 0
xor ecx, ebp
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x566e50
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.005666d0
add esp, 4
test eax, eax
je 0x566e85
mov eax, 0x67
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov eax, 0x17
mov dword [ebp - 0x24], 1
push esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
movups xmm0, xmmword [0x6d16f0]
push 0x11
push 2
push 0x17
mov word [ebp - 0x1e], ax
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x566f14
push 0x1c
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x566f14
push 0x100000
push esi
call fcn.00556e30
push 0x80000
push esi
call fcn.00556e90
push esi
call fcn.00556e00
add esp, 0x14
mov dword [0x75320c], esi
jmp 0x566f27
push esi
call fcn.00556c40
add esp, 4
mov dword [0x75320c], 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, 0x752ac0
and eax, 0xfffffff8
xor ecx, ebp
add eax, 8
mov dword [0x753200], eax
mov eax, 0x753100
and eax, 0xfffffff8
add eax, 8
mov dword [0x753204], eax
xor eax, eax
pop esi
call fcn.00669a1e
mov esp, ebp
pop ebp
ret