joyce8/EMBER2024-capa huggingface dataset:
Function at 0x544e10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x40c
mov eax, dword [0x629d58]
xor eax, esp
mov dword [esp + 0x408], eax
xor eax, eax
mov dword [esp], eax
test esi, esi
je 0x544ede
push ebp
push 0x400
push eax
mov byte [esp + 0x10], al
lea eax, [esp + 0x11]
push eax
call fcn.004fc2f0
push ebx
push esi
call fcn.00544630
mov ebp, eax
add esp, 0x14
cmp ebp, 2
jbe 0x544ed3
cmp byte [esi], 0x7c
jne 0x544ed3
cmp byte [esi + ebp - 1], 0x7c
jne 0x544ed3
push edi
lea ecx, [esi + 1]
push ebx
push ecx
call fcn.00544830
mov edi, eax
push 0x5d5360
push edi
mov byte [edi + ebp - 2], 0
call fcn.0057f13d
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x544ebd
push ebp
push 0x400
lea edx, [esp + 0x14]
push 1
push edx
call fcn.00502fba
add esp, 0x10
test eax, eax
je 0x544eb4
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00544830
add esp, 8
mov dword [esp + 8], eax
push ebp
call fcn.00502cfc
add esp, 4
test edi, edi
je 0x544eca
push edi
call fcn.004fbea5
add esp, 4
mov eax, dword [esp + 8]
pop edi
test eax, eax
jne 0x544edd
push ebx
push esi
call fcn.00544830
add esp, 8
pop ebp
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.004fbd5c
add esp, 0x40c
ret

Function at 0x545ef0
Capabilities:
Reference wmi statements

Disassembly:
push ecx
push ebx
push ebp
push edi
xor ebx, ebx
push esi
mov ebp, 1
mov dword [esp + 0x10], ebx
call fcn.00549a00
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x545f30
cmp esi, ebx
je 0x546045
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x546045
push 0x8e
push str.Failed_to_create_WMI_object
jmp 0x54603b
push esi
push str.SELECT__FROM_Win32_BIOS
push edi
call fcn.00549420
add esp, 0xc
test eax, eax
jne 0x546026
push esi
push edi
call fcn.00549430
add esp, 8
test eax, eax
je 0x546009
lea esp, [esp]
lea edx, [esp + 0xc]
push edx
push str.Manufacturer
push edi
call fcn.00549400
add esp, 0xc
test eax, eax
jne 0x545f8e
mov eax, dword [esp + 0xc]
push esi
push str.innotek_GmbH
push eax
call fcn.00544440
add esp, 0xc
test eax, eax
je 0x546007
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004fbea5
lea edx, [esp + 0x10]
push edx
push str.SMBIOSBIOSVersion
push edi
mov dword [esp + 0x1c], ebx
call fcn.00549400
add esp, 0x10
test eax, eax
jne 0x545fca
mov eax, dword [esp + 0xc]
push esi
push str.VirtualBox
push eax
call fcn.00544440
add esp, 0xc
test eax, eax
je 0x546007
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004fbea5
push esi
push edi
mov dword [esp + 0x18], ebx
call fcn.00549430
add esp, 0xc
test eax, eax
jne 0x545f60
mov edx, dword [esp + 0xc]
push edx
call fcn.004fbea5
add esp, 4
push edi
call fcn.00549970
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
xor ebp, ebp
mov edx, dword [esp + 0xc]
push edx
call fcn.004fbea5
add esp, 4
push edi
call fcn.00549970
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
cmp esi, ebx
je 0x546045
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x546045
push 0xb5
push str.Error:_Cmn_Wmi_query_failed
mov ecx, dword [esi]
push 9
push ecx
call eax
add esp, 0x10
push edi
call fcn.00549970
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x546060
Capabilities:
Reference wmi statements

Disassembly:
push ecx
push ebx
push ebp
push edi
xor ebx, ebx
push esi
mov ebp, 1
mov dword [esp + 0x10], ebx
call fcn.00549a00
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x5460a0
cmp esi, ebx
je 0x546266
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x546266
push 0xcf
push str.Failed_to_create_WMI_object
jmp 0x54625c
push esi
push str.SELECT_Name_FROM_Win32_PROCESSOR
push edi
call fcn.00549420
add esp, 0xc
test eax, eax
jne 0x5461fc
push esi
push edi
call fcn.00549430
add esp, 8
test eax, eax
je 0x546113
lea edx, [esp + 0xc]
push edx
push str.Name
push edi
call fcn.00549400
add esp, 0xc
test eax, eax
jne 0x5460f3
mov eax, dword [esp + 0xc]
push esi
push str.QEMU_Virtual_CPU
push eax
call fcn.005446b0
add esp, 0xc
test eax, eax
jne 0x546111
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004fbea5
push esi
push edi
mov dword [esp + 0x18], ebx
call fcn.00549430
add esp, 0xc
test eax, eax
jne 0x5460c5
jmp 0x546113
xor ebp, ebp
mov edx, dword [esp + 0xc]
push edx
call fcn.004fbea5
add esp, 4
cmp ebp, ebx
je 0x546266
push esi
push str.SELECT__FROM_Win32_DiskDrive
push edi
call fcn.00549420
add esp, 0xc
test eax, eax
jne 0x546247
push esi
push edi
call fcn.00549430
add esp, 8
test eax, eax
je 0x54622a
lea edx, [esp + 0xc]
push edx
push str.Caption
push edi
call fcn.00549400
add esp, 0xc
test eax, eax
jne 0x546183
mov eax, dword [esp + 0xc]
push esi
push str.QEMU
push eax
call fcn.005446b0
add esp, 0xc
test eax, eax
jne 0x546228
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004fbea5
lea edx, [esp + 0x10]
push edx
push str.Model
push edi
mov dword [esp + 0x1c], ebx
call fcn.00549400
add esp, 0x10
test eax, eax
jne 0x5461bf
mov eax, dword [esp + 0xc]
push esi
push str.QEMU
push eax
call fcn.005446b0
add esp, 0xc
test eax, eax
jne 0x546228
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004fbea5
push esi
push edi
mov dword [esp + 0x18], ebx
call fcn.00549430
add esp, 0xc
test eax, eax
jne 0x546151
mov edx, dword [esp + 0xc]
push edx
call fcn.004fbea5
add esp, 4
push edi
call fcn.00549970
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
cmp esi, ebx
je 0x546128
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x546128
mov ecx, dword [esi]
push 0xe6
push str.Error:_Cmn_Wmi_query_failed
push 9
push ecx
call eax
add esp, 0x10
jmp 0x546128
xor ebp, ebp
mov edx, dword [esp + 0xc]
push edx
call fcn.004fbea5
add esp, 4
push edi
call fcn.00549970
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
cmp esi, ebx
je 0x546266
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x546266
push 0x112
push str.Error:_Cmn_Wmi_query_failed
mov ecx, dword [esi]
push 9
push ecx
call eax
add esp, 0x10
push edi
call fcn.00549970
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x546dc0
Capabilities:
Reference wmi statements

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor ebp, ebp
xor esi, esi
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
call fcn.00549a00
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x546e09
cmp edi, ebp
je 0x546f22
mov eax, dword [edi + 8]
cmp eax, ebp
je 0x546f22
mov ecx, dword [edi]
push 0x59
push str.Failed_to_create_WMI_object
push 9
push ecx
jmp 0x546f1d
push edi
push str.SELECT__FROM_Win32_NetworkAdapter
push ebx
call fcn.00549420
add esp, 0xc
test eax, eax
jne 0x546f06
push edi
push ebx
call fcn.00549430
add esp, 8
test eax, eax
je 0x546f22
lea edx, [esp + 0x10]
push edx
push str.PNPDeviceID
push ebx
call fcn.00549400
add esp, 0xc
test eax, eax
jne 0x546edb
mov eax, dword [esp + 0x10]
push edi
push 6
push str.VMBUS_
push eax
call fcn.00544560
add esp, 0x10
test eax, eax
jne 0x546edb
lea ecx, [esp + 0xc]
push ecx
push str.Guid
push ebx
call fcn.00549400
add esp, 0xc
test eax, eax
jne 0x546ec6
mov esi, dword [esp + 0xc]
call fcn.00546cf0
test eax, eax
je 0x546ec6
mov dword [esp + 0x14], 1
cmp edi, ebp
je 0x546ec6
mov eax, dword [edi + 8]
cmp eax, ebp
je 0x546eae
mov edx, dword [edi]
push 0x6b
push str.Azure_detected_on_the_following_NIC:
push 9
push edx
call eax
add esp, 0x10
mov eax, dword [edi + 8]
cmp eax, ebp
je 0x546ec6
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
push 0x6c
push ecx
push 9
push edx
call eax
add esp, 0x10
mov eax, dword [esp + 0xc]
push eax
call fcn.004fbea5
mov esi, dword [esp + 0x18]
add esp, 4
mov dword [esp + 0xc], ebp
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004fbea5
add esp, 4
mov dword [esp + 0x10], ebp
cmp esi, ebp
je 0x546e20
push ebx
call fcn.00549970
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp edi, ebp
je 0x546f22
mov eax, dword [edi + 8]
cmp eax, ebp
je 0x546f22
mov edx, dword [edi]
push 0x78
push str.Error:_Cmn_Wmi_query_failed
push 9
push edx
call eax
add esp, 0x10
push ebx
call fcn.00549970
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x548450
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
test esi, esi
je 0x5484cc
cmp byte [esi], 0xbc
push edi
jne 0x548488
cmp byte [esi + 1], 0xbd
jne 0x548488
push eax
lea eax, [esi + 2]
push eax
call fcn.00544830
push 0
push esi
mov edi, eax
call fcn.00544630
add esp, 0x10
mov byte [eax + edi - 4], 0
mov eax, edi
pop edi
pop esi
ret
push ebp
xor edi, edi
push edi
push esi
call fcn.00544630
inc eax
push eax
call fcn.004fbedf
mov cl, byte [esi]
xor cl, 0x23
mov ebp, eax
add esp, 0xc
mov byte [ebp], cl
cmp byte [esi], 0
je 0x5484c4
mov edx, ebp
mov ecx, esi
sub edx, esi
mov al, byte [ecx + 1]
inc ecx
dec al
xor al, byte [edx + ecx - 1]
inc edi
mov byte [edx + ecx], al
cmp byte [ecx], 0
jne 0x5484b1
mov byte [edi + ebp], 0
mov eax, ebp
pop ebp
pop edi
pop esi
ret
Function at 0x549a00
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push str.ROOTCIMV2
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor edi, edi
push 0x30
push 1
mov ebx, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.004fd927
push 4
push 1
mov esi, eax
call fcn.004fd927
add esp, 0x10
mov ebp, eax
mov dword [ebp], esi
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0x5494a0
mov dword [esi + 0x18], 0x549620
mov dword [esi + 0x1c], 0x549590
mov dword [esi + 0x20], 0x5496b0
mov dword [esi + 0x24], 0x549900
mov dword [esi + 0x28], 0x549940
mov dword [esi + 0x2c], 0x5499e0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [esi], eax
cmp eax, edi
jge 0x549abd
cmp eax, 0x80010106
je 0x549abd
mov edx, dword [esp + 0x20]
cmp edx, edi
je 0x549bcf
mov ecx, dword [edx + 4]
cmp ecx, edi
je 0x549bcf
push 0x1f7
push eax
mov eax, dword [edx]
push 0xe
push eax
call ecx
add esp, 0x10
jmp 0x549bcf
push edi
push edi
push edi
push 3
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, edi
jge 0x549b05
cmp eax, 0x80010119
je 0x549b05
mov edx, dword [esp + 0x20]
cmp edx, edi
je 0x549bcf
mov ecx, dword [edx + 4]
cmp ecx, edi
je 0x549bcf
mov edx, dword [edx]
push 0x1fe
push eax
push 0xe
push edx
call ecx
add esp, 0x10
jmp 0x549bcf
lea eax, [esp + 0x14]
push eax
push 0x5f0910
push 1
push edi
push 0x5f0900
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jge 0x549b4d
mov edx, dword [esp + 0x20]
cmp edx, edi
je 0x549bcf
mov ecx, dword [edx + 4]
cmp ecx, edi
je 0x549bcf
mov edx, dword [edx]
push 0x206
push eax
push 0xe
push edx
call ecx
add esp, 0x10
jmp 0x549bcf
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
push eax
mov eax, dword [ecx + 0xc]
call eax
cmp eax, edi
jge 0x549b8a
mov edx, dword [esp + 0x20]
cmp edx, edi
je 0x549bcf
mov ecx, dword [edx + 4]
cmp ecx, edi
je 0x549bcf
mov edx, dword [edx]
push 0x20d
push eax
push 0xe
push edx
call ecx
add esp, 0x10
jmp 0x549bcf
mov eax, dword [esp + 0x10]
push edi
push edi
push 3
push 3
push edi
push edi
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
cmp eax, edi
jge 0x549bc4
mov edx, dword [esp + 0x20]
cmp edx, edi
je 0x549bcf
mov ecx, dword [edx + 4]
cmp ecx, edi
je 0x549bcf
mov edx, dword [edx]
push 0x21d
push eax
push 0xe
push edx
call ecx
add esp, 0x10
jmp 0x549bcf
mov eax, dword [esp + 0x10]
mov dword [esi + 8], eax
mov dword [esp + 0x18], edi
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x549be6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [esp + 0x18], edi
je 0x549bff
push ebp
call fcn.00549970
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x549c10
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
lea ecx, [ebx + 2]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
push esi
lea edx, [edx*4 + 1]
xor esi, esi
cmp dword [esp + 0x20], edx
jae 0x549c59
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x549c50
mov eax, dword [ecx + 4]
test eax, eax
je 0x549c50
mov ecx, dword [ecx]
push 0x2d
push esi
push 0xc
push ecx
call eax
add esp, 0x10
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
test ebx, ebx
je 0x549df8
lea edx, [ebx - 1]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
push ebp
inc edx
push edi
mov edi, 1
mov dword [esp + 0x14], edx
jmp 0x549c82
mov ebx, ecx
mov edx, dword [esp + 0x1c]
mov cl, byte [edx + edi - 1]
cmp edi, ebx
jae 0x549c93
mov al, byte [edi + edx]
jmp 0x549c95
xor al, al
lea ebp, [edi + 1]
cmp ebp, ebx
jae 0x549ca6
mov dl, byte [edi + edx + 1]
mov byte [esp + 0x28], dl
jmp 0x549cab
mov byte [esp + 0x28], 0
mov dl, cl
and cl, 3
mov bl, al
shl cl, 4
shr bl, 4
or cl, bl
mov bl, byte [esp + 0x28]
and al, 0xf
mov byte [esp + 0x13], cl
add al, al
mov cl, bl
add al, al
shr cl, 6
shr dl, 2
or al, cl
and bl, 0x3f
cmp dl, 0x1a
jae 0x549ce2
movzx edx, dl
add edx, 0x41
jmp 0x549d07
cmp dl, 0x34
jae 0x549cef
movzx edx, dl
add edx, 0x47
jmp 0x549d07
cmp dl, 0x3e
jae 0x549cfc
movzx edx, dl
sub edx, 4
jmp 0x549d07
cmp dl, 0x3f
sbb edx, edx
and edx, 0xfffffffe
add edx, 0x2d
mov ecx, dword [esp + 0x24]
mov byte [esi + ecx], dl
mov cl, byte [esp + 0x13]
cmp cl, 0x1a
jae 0x549d1f
movzx ecx, cl
add ecx, 0x41
jmp 0x549d44
cmp cl, 0x34
jae 0x549d2c
movzx ecx, cl
add ecx, 0x47
jmp 0x549d44
cmp cl, 0x3e
jae 0x549d39
movzx ecx, cl
sub ecx, 4
jmp 0x549d44
cmp cl, 0x3f
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 0x2d
mov edx, dword [esp + 0x24]
mov byte [esi + edx + 1], cl
mov ecx, dword [esp + 0x20]
cmp edi, ecx
jae 0x549d90
cmp al, 0x1a
jae 0x549d63
movzx eax, al
add eax, 0x41
movsx eax, al
jmp 0x549d95
cmp al, 0x34
jae 0x549d72
movzx eax, al
add eax, 0x47
movsx eax, al
jmp 0x549d95
cmp al, 0x3e
jae 0x549d81
movzx eax, al
sub eax, 4
movsx eax, al
jmp 0x549d95
cmp al, 0x3f
sbb eax, eax
and eax, 0xfffffffe
add eax, 0x2d
movsx eax, al
jmp 0x549d95
mov eax, 0x3d
mov byte [esi + edx + 2], al
cmp ebp, ecx
jae 0x549ddd
cmp bl, 0x1a
jae 0x549dad
movzx eax, bl
add eax, 0x41
movsx eax, al
jmp 0x549de2
cmp bl, 0x34
jae 0x549dbd
movzx eax, bl
add eax, 0x47
movsx eax, al
jmp 0x549de2
cmp bl, 0x3e
jae 0x549dcd
movzx eax, bl
sub eax, 4
movsx eax, al
jmp 0x549de2
cmp bl, 0x3f
sbb eax, eax
and eax, 0xfffffffe
add eax, 0x2d
movsx eax, al
jmp 0x549de2
mov eax, 0x3d
mov byte [esi + edx + 3], al
add esi, 4
add edi, 3
dec dword [esp + 0x14]
jne 0x549c80
pop edi
pop ebp
mov edx, dword [esp + 0x1c]
mov byte [esi + edx], 0
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x54a990
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x34
mov eax, dword [0x629d58]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
mov esi, dword [esp + 0x54]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x54]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x54ab5a
cmp ebp, ebx
je 0x54ab5a
mov eax, dword [esp + 0x50]
cmp eax, 0xffff
ja 0x54ab5a
push eax
push 0x5adca4
lea eax, [esp + 0x40]
push 6
push eax
call fcn.004fcf21
xor eax, eax
add esp, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
test edi, edi
je 0x54aa62
mov eax, dword [edi + 4]
test eax, eax
je 0x54aa4e
cmp eax, 2
je 0x54aa4e
cmp eax, 0x17
je 0x54aa4e
lea edi, [ebx + 1]
test esi, esi
je 0x54ab79
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x54ab79
mov edx, dword [esi]
push 0x97
push eax
push edi
push edx
call ecx
jmp 0x54ab76
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
mov eax, dword [edi]
mov dword [esp + 0x24], ecx
or eax, 8
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x54aaac
mov edi, 2
test esi, esi
je 0x54ab79
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x54ab79
mov edx, dword [esi]
push 0xa6
push eax
push edi
push edx
call ecx
jmp 0x54ab76
push 0x20
push 1
call fcn.004fd927
mov ebx, eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x18]
movzx ecx, word [eax]
add esp, 8
xor edi, edi
test cx, cx
jne 0x54aae0
push esi
push 0x10
push eax
lea ecx, [ebx + 4]
push ecx
mov dword [ebx], 0x10
call fcn.00544740
jmp 0x54ab2d
cmp ecx, 2
jne 0x54aafa
push esi
push 0x10
push eax
lea edx, [ebx + 4]
push edx
mov dword [ebx], 0x10
call fcn.00544740
jmp 0x54ab2d
cmp ecx, 0x17
jne 0x54ab14
push esi
push 0x1c
push eax
lea eax, [ebx + 4]
push eax
mov dword [ebx], 0x1c
call fcn.00544740
jmp 0x54ab2d
mov edi, 1
test esi, esi
je 0x54ab30
mov eax, dword [esi + 4]
test eax, eax
je 0x54ab30
mov edx, dword [esi]
push 0x4e
push ecx
push edi
push edx
call eax
add esp, 0x10
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
jne 0x54ab79
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004fbd5c
add esp, 0x34
ret
mov edi, 1
cmp esi, ebx
je 0x54ab79
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x54ab79
mov edx, dword [esi]
push 0x84
push ebx
push edi
push edx
call eax
add esp, 0x10
push ebx
call fcn.004fbea5
mov ecx, dword [esp + 0x44]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fbd5c
add esp, 0x34
ret
Function at 0x54abc0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x629d58]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, dword [esp + 0x1ac]
push edi
mov edi, dword [esp + 0x1a0]
test edi, edi
jne 0x54ac15
mov edi, 1
test esi, esi
je 0x54acc6
mov eax, dword [esi + 4]
test eax, eax
je 0x54acc6
mov ecx, dword [esi]
push 0xee
push 0
push edi
push ecx
call eax
add esp, 0x10
jmp 0x54acc6
lea edx, [esp + 8]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
sbb eax, eax
neg eax
je 0x54ac56
mov edi, 2
test esi, esi
je 0x54acc6
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x54acc6
push 0xf6
push eax
mov eax, dword [esi]
push edi
push eax
call ecx
add esp, 0x10
jmp 0x54acc6
mov ecx, dword [esp + 0x1ac]
mov edx, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1a4]
push ebx
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x54aca5
mov edi, 2
test esi, esi
je 0x54acc5
cmp dword [esi + 4], 0
je 0x54acc5
push 0xfe
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push eax
push edi
push ecx
call edx
add esp, 0x10
jmp 0x54acc5
push 0xc
push 1
call fcn.004fd927
mov dword [eax + 4], 0
mov dword [eax], ebx
mov dword [eax + 8], 0
add esp, 8
mov dword [edi], eax
xor edi, edi
pop ebx
mov ecx, dword [esp + 0x198]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004fbd5c
add esp, 0x194
ret
Function at 0x54b010
Capabilities:
Connect socket

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x54b07d
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x54b07d
mov eax, dword [ecx]
test eax, eax
je 0x54b07d
push eax
mov eax, dword [edx]
add ecx, 4
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x54b0a1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x54b076
cmp eax, 0x2733
je 0x54b076
mov ecx, dword [esp + 0x10]
mov esi, 2
test ecx, ecx
je 0x54b0a1
mov edx, dword [ecx + 4]
test edx, edx
je 0x54b0a1
mov ecx, dword [ecx]
push 0x257
push eax
push esi
push ecx
call edx
add esp, 0x10
mov eax, esi
pop esi
ret
mov eax, 0x1b
pop esi
ret
mov eax, dword [esp + 0x10]
mov esi, 1
test eax, eax
je 0x54b0a1
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x54b0a1
mov edx, dword [eax]
push 0x248
push 0
push esi
push edx
call ecx
add esp, 0x10
mov eax, esi
pop esi
ret

Function at 0x54b0b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
xor edi, edi
test eax, eax
je 0x54b12f
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x54b12f
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x54b12f
mov esi, dword [esp + 0x14]
test esi, esi
je 0x54b12f
mov edx, dword [esi]
push edi
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x54b128
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
jne 0x54b0fb
pop ebx
lea eax, [edi + 0x1b]
pop edi
pop esi
ret
mov esi, dword [esp + 0x1c]
mov edi, 2
test esi, esi
je 0x54b122
cmp dword [esi + 4], 0
je 0x54b122
push 0x27a
call ebx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi]
push edi
push eax
call ecx
add esp, 0x10
pop ebx
mov eax, edi
pop edi
pop esi
ret
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0x18]
mov esi, 1
test eax, eax
je 0x54b153
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x54b153
mov edx, dword [eax]
push 0x26d
push 0
push esi
push edx
call ecx
add esp, 0x10
pop edi
mov eax, esi
pop esi
ret
Function at 0x54b160
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
xor edi, edi
test eax, eax
je 0x54b1df
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x54b1df
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x54b1df
mov esi, dword [esp + 0x14]
test esi, esi
je 0x54b1df
mov edx, dword [esi]
push edi
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x54b1d8
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
jne 0x54b1ab
pop ebx
lea eax, [edi + 0x1b]
pop edi
pop esi
ret
mov esi, dword [esp + 0x1c]
mov edi, 2
test esi, esi
je 0x54b1d2
cmp dword [esi + 4], 0
je 0x54b1d2
push 0x29f
call ebx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi]
push edi
push eax
call ecx
add esp, 0x10
pop ebx
mov eax, edi
pop edi
pop esi
ret
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0x18]
mov esi, 1
test eax, eax
je 0x54b203
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x54b203
mov edx, dword [eax]
push 0x292
push 0
push esi
push edx
call ecx
add esp, 0x10
pop edi
mov eax, esi
pop esi
ret