joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5334e0
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push ebx
push eax
call fcn.005d2385
add esp, 4
movzx ebx, ax
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x1b4], 0x114
push eax
call dword [0x648e54]
cmp dword [ebp - 0x1a4], 2
jne 0x533755
push esi
push edi
movzx eax, bx
push eax
lea eax, [ebp - 0x44]
push 0x5efab0
push eax
call fcn.0047c390
add esp, 0xc
lea eax, [ebp - 0x44]
push 0
push 0
push 3
push 0
push 3
push accept
push eax
call dword [0x648de0]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
je 0x53358b
push 0
lea eax, [ebp - 0x2e0]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2d4], 0
push ebx
call fcn.005d2385
add esp, 4
movzx ebx, ax
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0x2c8], 0x114
push eax
call dword [0x648e54]
cmp dword [ebp - 0x2b8], 2
jne 0x53362d
push ebx
lea eax, [ebp - 0x84]
push 0x5efab0
push eax
call fcn.0047c390
add esp, 0xc
lea eax, [ebp - 0x84]
push 0
push 0
push 3
push 0
push 3
push accept
push eax
call dword [0x648de0]
mov esi, eax
cmp esi, 0xffffffff
je 0x53371e
push 0
lea eax, [ebp - 0x2d8]
push eax
push 0
push 0
push 0
push 0
push 0x90018
push esi
call edi
test eax, eax
jne 0x533719
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
jmp 0x533719
xor edi, edi
push edi
push 0x4000000
push edi
push edi
push edi
push edi
push 0x5fcfcc
mov dword [ebp - 0x2d0], edi
call dword [0x648de0]
mov esi, eax
cmp esi, 0xffffffff
je 0x533713
mov eax, ebx
mov dword [ebp - 0x2cc], eax
lea ebx, [eax - 0x40]
mov dword [ebp - 0x94], 0x440d
mov dword [ebp - 0x98], 0x84a
mov dword [ebp - 0x88], 1
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], 0
test edi, edi
je 0x53369c
mov dword [ebp - 0x9c], 4
push 0
lea eax, [ebp - 0x2d8]
push eax
push 0x1c
lea eax, [ebp - 0xa0]
push eax
push 0x1c
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x5336dd
test byte [ebp - 0x88], 1
jne 0x5336dd
inc edi
cmp edi, 1
ja 0x5336d3
cmp dword [ebp + 0xc], 0
jne 0x533660
mov dword [ebp - 0x2d0], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
shl esi, 8
add esi, dword [ebp - 0x2cc]
cmp dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], esi
jne 0x533713
lea eax, [ebp - 0x2cc]
push eax
call fcn.00533b60
mov esi, dword [ebp - 0x2cc]
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp esi, 0xffffffff
jne 0x533742
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2d4]
mov ebx, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2d4], eax
cmp eax, 5
jb 0x533595
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
push ebx
call fcn.00533900
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
Function at 0x533770
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x648e54]
lea eax, [ebp - 0x118]
push esi
mov esi, dword [ebp + 8]
push eax
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x118], 0x114
call ebx
cmp dword [ebp - 0x108], 2
jne 0x533892
push 0
push 0
push 3
push 0
push 3
push accept
push esi
call dword [0x648de0]
mov esi, eax
cmp esi, 0xffffffff
je 0x5337f5
push 0
lea eax, [ebp - 0x234]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
xor edi, edi
nop dword [eax + eax]
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x114
push eax
or esi, 0xffffffff
call ebx
cmp dword [ebp - 0x21c], 2
jne 0x53386c
push 0
push 0
push 3
push 0
push 3
push accept
push dword [ebp - 0x230]
call dword [0x648de0]
mov esi, eax
cmp esi, 0xffffffff
je 0x533871
push 0
lea eax, [ebp - 0x238]
push eax
push 0
push 0
push 0
push 0
push 0x90018
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x53386c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
cmp esi, 0xffffffff
jne 0x53387f
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 3
jb 0x533800
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret

Function at 0x5338b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x5338c8
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret
push eax
call fcn.00533460
add esp, 4
test eax, eax
je 0x5338ec
push edi
call fcn.00533b60
add esp, 4
mov esi, eax
cmp dword [ebp + 0xc], 0
je 0x5338ec
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x534320
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
push 0
push dword [esi]
call fcn.0058c440
add eax, dword [ebp + 0x14]
push 0
push dword [esi + 4]
adc edx, 0
push edx
push eax
call fcn.0058c440
add eax, dword [esi + 0x10]
mov dword [ebp - 0x220], eax
adc edx, dword [esi + 0x14]
cmp dword [0x6527d8], 0
mov dword [ebp - 0x21c], edx
je 0x5343ae
push 0
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 0x20]
lea eax, [ebp - 0x220]
push ebx
push 8
push eax
push 0x560020
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x20], 0x18
jb 0x53446b
mov eax, dword [esi + 0x18]
or eax, dword [esi + 0x1c]
je 0x53446b
mov eax, dword [0x5fa998]
mov dword [ebp - 0xc], eax
movzx eax, word [0x5fa99c]
mov word [ebp - 8], ax
movzx eax, word [esi + 0xc]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x53446b
lea eax, [ebp - 0x218]
push str.Harddisk
push eax
call fcn.005c9f6c
mov edi, eax
add esp, 8
test edi, edi
je 0x53446b
movzx ecx, word [edi + 0x10]
add edi, 0x10
push ecx
call fcn.005d22cc
add esp, 4
test eax, eax
je 0x53446b
push 0xa
push 0
push edi
mov dword [ebx], 1
call fcn.005d1ea6
add esp, 0xc
mov dword [ebx + 8], eax
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
add ecx, dword [ebp - 0x220]
pop edi
adc eax, dword [ebp - 0x21c]
mov dword [ebx + 0x14], eax
mov eax, 1
pop esi
mov dword [ebx + 0x10], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
Function at 0x5365f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x53660e
push ebx
push 0
push dword [ebp + 0x14]
call fcn.005c9220
add esp, 0xc
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x53661b
mov dword [eax], 0
push 0
lea eax, [ebp + 0x18]
mov dword [edi + 0x18], 0
push eax
push 4
lea eax, [ebp + 8]
push eax
push dword [edi + 0x38]
lea esi, [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x536651
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [esi], eax
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp dword [ebp + 0x18], 4
jne 0x53675c
push 0
lea eax, [ebp + 0x18]
push eax
push 4
lea eax, [ebp + 0x10]
push eax
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x53663e
cmp dword [ebp + 0x18], 4
jne 0x53675c
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5366a8
push 0
lea ecx, [ebp + 0x18]
push ecx
push eax
push dword [ebp + 0xc]
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x53663e
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x10]
jne 0x53675c
push 0
lea eax, [ebp + 0x18]
push eax
push 4
push esi
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53663e
cmp dword [ebp + 0x18], 4
jne 0x53674b
push 0
lea eax, [ebp + 0x18]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53663e
cmp dword [ebp + 0x18], 4
jne 0x53674b
mov eax, dword [ebp - 4]
test eax, eax
je 0x536740
cmp eax, ebx
mov ecx, ebx
push 0
cmovb ecx, eax
lea eax, [ebp + 0x18]
push eax
push ecx
push dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x18]
mov edx, eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x53671d
mov dword [eax], ecx
test edx, edx
je 0x53663e
cmp ecx, dword [ebp + 0xc]
jne 0x53674b
cmp dword [ebp - 4], ebx
jbe 0x536740
pop edi
mov dword [esi], 0x7a
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
mov dword [esi], 0x1e
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
mov dword [esi], 0x1d
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x537090
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edi
push 0x14
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x537107
push ebx
push esi
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
test ebx, ebx
je 0x5370de
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push eax
push 4
push edi
call fcn.00537120
add esp, 0x10
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, ebx
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0058bb64
mov esp, ebp
pop ebp
ret

Function at 0x537120
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov dword [ebp - 4], 1
call ebx
mov edi, dword [ebp + 0x10]
mov esi, eax
add esi, dword [ebp + 0x14]
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x537192
mov eax, dword [ebp + 0xc]
cmp dword [edi + 4], eax
je 0x53721f
call ebx
cmp eax, esi
ja 0x53720b
cmp dword [ebp - 4], 0
jne 0x53719b
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 4]
jne 0x53719b
mov eax, dword [edi + 0x14]
cmp eax, dword [ebp - 8]
ja 0x5371ab
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, dword [edi + 0x18]
jbe 0x5371b3
push 0x41d
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 8], eax
call ebx
mov dword [ebp - 0xc], eax
mov eax, 0xcccccccd
mul dword [edi + 0x18]
mov esi, edx
shr esi, 3
cmp esi, 0x3e8
jae 0x5371cf
mov esi, 0x3e8
jmp 0x5371dd
cmp esi, 0x2710
mov eax, 0x2710
cmova esi, eax
call ebx
mov ecx, dword [ebp - 0x10]
sub ecx, eax
cmp ecx, dword [ebp + 0x14]
ja 0x5371f5
cmp esi, ecx
cmovbe ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x537192
mov esi, dword [ebp - 0x10]
jmp 0x537151
push 0x5b4
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x537560
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov edi, ecx
lea ecx, [ebp - 4]
push ecx
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x24]
test eax, eax
je 0x5375fa
mov ebx, dword [ebp + 0xc]
nop
mov esi, dword [ebp + 8]
push 2
push ebx
push esi
push dword [edi + 0x194]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [edi + 0x1a0], eax
cmp eax, 0xffffffff
jne 0x5375b7
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2738
jne 0x53761a
mov dword [edi + 0x1a0], ebx
mov eax, ebx
jmp 0x5375bf
test eax, eax
je 0x53764f
mov ecx, dword [ebp + 8]
dec eax
add eax, ecx
mov esi, ecx
cmp ecx, eax
jae 0x5375e0
nop dword [eax + eax]
cmp byte [esi], 0xd
jne 0x5375db
cmp byte [esi + 1], 0xa
je 0x53762f
inc esi
cmp esi, eax
jb 0x5375d0
cmp dword [edi + 0x1a0], ebx
je 0x537636
push dword [ebp + 0x10]
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
mov ecx, edi
call dword [eax + 0x24]
test eax, eax
jne 0x537580
mov eax, dword [ebp - 4]
mov ecx, 0x274c
test eax, eax
mov dword [edi + 0x1a0], 0
cmove eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [edi + 0x1a0], 0
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, esi
sub ebx, ecx
add ebx, 2
mov eax, esi
sub eax, ecx
push 0xffffffffffffffff
mov dword [edi + 0x1a0], eax
mov eax, dword [edi]
push ebx
push ecx
mov ecx, edi
call dword [eax + 0x14]
test eax, eax
jne 0x537611
pop edi
mov byte [esi], 0
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x537660
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp esi, 0xffffffff
jne 0x537681
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x537678
sub esi, ecx
mov dword [edi + 0x19c], 0
test esi, esi
jle 0x5376b7
nop
push 0
push esi
push ebx
push dword [edi + 0x194]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x5376cc
test eax, eax
je 0x5376c0
add dword [edi + 0x19c], eax
sub esi, eax
add ebx, eax
test esi, esi
jg 0x537690
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop edi
pop esi
mov eax, 0x2749
pop ebx
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x537720
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ecx + 0x194]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp ecx, 0xffffffff
jne 0x537761
test esi, esi
je 0x53774d
mov dword [esi], 0x2736
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 1
test edi, edi
js 0x5377a5
cmp edi, 0x3e8
jl 0x537795
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14], eax
imul eax, eax, 0xfffffc18
add edi, eax
jmp 0x53779c
mov dword [ebp - 0x14], 0
imul eax, edi, 0x3e8
mov dword [ebp - 0x10], eax
xor edx, edx
lea eax, [ebp - 0x14]
test edi, edi
cmovs eax, edx
push eax
push edx
push edx
lea eax, [ebp - 0xc]
push eax
lea eax, [ecx + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov edi, eax
test esi, esi
je 0x5377db
cmp edi, 0xffffffff
jne 0x5377d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
jmp 0x5377db
mov dword [esi], 0
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
setg al
xor ecx, ebp
pop esi
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 8
Function at 0x537850
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6527ec], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
jne 0x537923
push dword [ebp + 8]
mov eax, 2
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
movsx eax, byte [esi]
push eax
call fcn.005d4660
add esp, 4
push esi
test eax, eax
je 0x5378d3
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x5379e0
movzx ecx, word [eax + 0xa]
mov edx, 4
cmp dx, cx
jge 0x5378bc
mov ecx, edx
jmp 0x5378bf
movsx ecx, cx
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.005c9900
add esp, 0xc
jmp 0x5378e5
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x5379e0
mov eax, dword [ebx + 0x194]
cmp eax, 0xffffffff
jne 0x53790e
movzx eax, word [ebp - 0x14]
push 6
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 0x194], eax
cmp eax, 0xffffffff
je 0x537a35
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jmp 0x537a6c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x48], 8
push esi
push 2
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 1
call fcn.00570f10
add esp, 0xc
cmp eax, 1
jne 0x537969
mov dword [ebp - 0x44], 2
jmp 0x537984
lea eax, [ebp - 0x24]
push eax
push esi
push 0x17
call fcn.00570f10
add esp, 0xc
cmp eax, 1
jne 0x537988
mov dword [ebp - 0x44], 0x17
or dword [ebp - 0x48], 4
push 0xc
call fcn.00479f2b
mov edi, eax
add esp, 4
test edi, edi
jne 0x5379ae
lea eax, [edi + 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 8]
push 0x5fdd34
push 0xc
push edi
call fcn.0051f150
add esp, 0x10
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push esi
call dword [0x6527f4]
push edi
mov esi, eax
call fcn.0058bb5f
add esp, 4
test esi, esi
je 0x5379f8
pop edi
pop esi
mov eax, 0x16
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0x194]
cmp ecx, 0xffffffff
jne 0x537a4e
mov eax, dword [ebp - 0x28]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, eax
mov dword [ebx + 0x194], ecx
cmp ecx, 0xffffffff
jne 0x537a4e
push dword [ebp - 0x28]
call dword [0x6527f8]
push 0
call fcn.0058bb5f
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x28]
push dword [eax + 0x10]
push dword [eax + 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
push dword [ebp - 0x28]
mov esi, eax
call dword [0x6527f8]
cmp esi, 0xffffffff
je 0x537a35
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 8
Function at 0x539ea0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, 1
xor ebx, ebx
call fcn.0050e9a0
mov edi, eax
add esp, 4
test edi, edi
je 0x539f9b
lea eax, [ebp - 4]
push eax
push edi
call fcn.00504f60
mov edx, dword [ebp - 4]
add esp, 8
movzx eax, word [edx]
cmp eax, 0x5c
je 0x539ee2
cmp eax, 0x2f
jne 0x539ee8
add edx, 2
mov dword [ebp - 4], edx
cmp word [edx], bx
je 0x539f90
movzx eax, word [edx]
test ax, ax
je 0x539f1c
nop dword [eax]
cmp ax, 0x5c
je 0x539f1c
cmp ax, 0x2f
je 0x539f1c
add edx, 2
mov dword [ebp - 4], edx
movzx ecx, word [edx]
mov eax, ecx
test cx, cx
jne 0x539f00
movzx esi, word [edx]
xor eax, eax
mov word [edx], ax
lea eax, [ebp - 8]
push eax
push edi
call fcn.00506140
add esp, 8
test eax, eax
je 0x539f42
cmp dword [ebp - 8], 0
je 0x539f8e
mov ebx, 1
jmp 0x539f50
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x539f8e
mov eax, dword [ebp - 4]
mov word [eax], si
cmp esi, 0x5c
je 0x539f6b
mov eax, dword [ebp - 4]
mov word [eax], si
cmp esi, 0x2f
je 0x539f6b
mov edx, dword [ebp - 4]
jmp 0x539f74
mov edx, dword [ebp - 4]
add edx, 2
mov dword [ebp - 4], edx
cmp word [edx], 0
jne 0x539ef1
push edi
mov esi, 1
call fcn.0058bb5f
add esp, 4
jmp 0x539f9d
xor esi, esi
push edi
call fcn.0058bb5f
add esp, 4
jmp 0x539f9d
xor esi, esi
mov ecx, dword [ebp + 0xc]
mov eax, esi
test ecx, ecx
je 0x539fa8
mov dword [ecx], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5546c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
mov eax, ebx
cmovne edx, ebx
sub eax, dword [ebp + 8]
neg ebx
mov dword [ebp - 4], edx
push edi
mov edi, ecx
sbb ebx, ebx
and ebx, eax
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x20]
cmp eax, ecx
cmovbe ecx, eax
mov dword [ebp + 0x10], ecx
cmp edx, ecx
jb 0x554708
xor eax, eax
xor ecx, ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 8], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi]
xor edx, edx
mov eax, dword [ebp + 0xc]
dec eax
push esi
movzx esi, word [ecx + 6]
add eax, esi
div esi
mov edx, dword [ebp - 4]
sub dword [ebp + 0x10], edx
mov edx, dword [edi + 0xc]
sub edx, ebx
cmp dword [ebp + 0x10], edx
push ecx
cmovbe edx, dword [ebp + 0x10]
cmp eax, edx
cmovbe edx, eax
mov eax, ebx
imul eax, esi
push edx
mov dword [ebp + 0x10], edx
add eax, dword [edi + 4]
push eax
push 0
push dword [ebp - 4]
call fcn.004faf40
add esp, 0x14
pop esi
test eax, eax
jne 0x554763
mov dword [edi + 0x10], eax
mov dword [edi + 8], eax
mov eax, 0x12
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
add ecx, ebx
mov dword [edi + 0x10], ecx
mov dword [edi + 8], eax
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x555fd0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x124], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x128], eax
mov eax, esi
push edi
xor edi, edi
and eax, 3
jne 0x55601d
mov edi, accept
jmp 0x556034
cmp eax, 1
jne 0x556029
mov edi, 0x40000000
jmp 0x556034
cmp eax, 2
mov ecx, 0xc0000000
cmove edi, ecx
mov eax, esi
xor edx, edx
and eax, 0x30000000
cmp eax, 0x10000000
je 0x55608a
cmp eax, 0x20000000
je 0x556085
cmp eax, 0x30000000
je 0x55607e
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [0x648e54]
xor edx, edx
cmp dword [ebp - 0x108], 2
sete dl
lea edx, [edx*4 + 3]
jmp 0x55608a
mov edx, 2
jmp 0x55608a
mov edx, 1
mov ecx, esi
mov eax, esi
and ecx, 0x10
shl ecx, 0x18
mov ebx, ecx
or ebx, 0x8000000
and al, 0x20
cmove ebx, ecx
test esi, 0x100
je 0x5560ca
test esi, 0x400
je 0x5560b8
mov esi, 1
jmp 0x5560da
and esi, 0x200
neg esi
sbb esi, esi
and esi, 0xfffffffe
add esi, 4
jmp 0x5560da
and esi, 0x200
neg esi
sbb esi, esi
and esi, 2
add esi, 3
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
mov eax, dword [ebp - 0x120]
pop edi
mov dword [eax], edx
mov eax, dword [ebp - 0x124]
mov dword [eax], esi
mov eax, dword [ebp - 0x128]
pop esi
mov dword [eax], ebx
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret