joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e186c
Capabilities:
Check if file exists

Disassembly:
push 0xb4
mov eax, 0x5f7646
call fcn.0059bbd7
mov esi, ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x80], esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004d6c63
mov edi, str._bkinfocustommyCustomizeList
mov byte [ebp - 4], 1
push edi
call fcn.005c2f90
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e18e9
mov byte [ebp - 0x7c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x7c]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.004046c1
jmp 0x4e1a8b
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
push eax
push str.loop_wallpaper_id
mov edx, str.Software360360huabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.004261bf
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0xa0]
call fcn.00404ba6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0xa0]
cmovae ecx, dword [ebp - 0x28]
call fcn.0043b83c
test eax, eax
je 0x4e1a69
lea ecx, [ebp - 0xa0]
call fcn.004056d7
test al, al
jne 0x4e195f
push 0x236a
push str.GetCurCustomLoopData
push str.__s__d___jValue_is_not_object
call fcn.0040a649
add esp, 0xc
jmp 0x4e1a69
push str.list
lea ecx, [ebp - 0xa0]
call fcn.00405401
push eax
lea ecx, [ebp - 0xb0]
call fcn.00404cc0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 3
call fcn.004056c6
test al, al
je 0x4e1a5e
lea eax, [ebp - 0x90]
push eax
call fcn.004057e8
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004057b0
jmp 0x4e1a44
lea ecx, [ebp - 0x88]
call fcn.004049ac
push eax
lea ecx, [ebp - 0xc0]
call fcn.00404cc0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc0]
push 0x63dc28
mov dword [ebp - 0x7c], ebx
call fcn.00405401
lea edx, [ebp - 0x7c]
mov ecx, eax
call fcn.0043bf56
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x80]
jne 0x4e1a2a
lea ecx, [ebp - 0x60]
call fcn.00406b04
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00406b1f
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x78]
call fcn.00404812
lea ecx, [ebp - 0x60]
call fcn.004065e4
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 3
call fcn.00404dbc
lea ecx, [ebp - 0x88]
call fcn.004049b2
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x88]
call fcn.004049b7
test al, al
je 0x4e19b5
lea ecx, [ebp - 0xb0]
call fcn.00404dbc
mov byte [ebp - 0x7c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x7c]
mov dword [esi + 0x10], ebx
mov ecx, esi
push eax
mov dword [esi + 0x14], ebx
call fcn.004046c1
lea ecx, [ebp - 0xa0]
call fcn.00404dbc
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.00404812
mov eax, esi
call fcn.0059bb81
ret
Function at 0x4e5315
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4e546c
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4e546c
cmp eax, 0x29
jne 0x4e5352
cmp dword [esi + 0x10], 0
jne 0x4e546c
cmp eax, eax
jne 0x4e5352
test dword [esi + 0x50], edx
je 0x4e5472
cmp eax, 0x2e
jne 0x4e536d
push 5
lea ecx, [esi + 0x24]
call fcn.0042c5a9
mov ecx, esi
call fcn.004e52ec
jmp 0x4e5456
cmp eax, 0x5c
jne 0x4e53c2
mov ecx, esi
call fcn.004e52ec
test byte [esi + 0x50], 0x80
je 0x4e53b6
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x4e539e
push 4
lea ecx, [esi + 0x24]
call fcn.0042c5a9
mov ecx, esi
call fcn.004e52ec
jmp 0x4e545d
cmp eax, 0x42
jne 0x4e53b6
push 4
lea ecx, [esi + 0x24]
call fcn.0042c5a9
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4e5392
mov ecx, esi
call fcn.004e6221
jmp 0x4e5456
cmp eax, 0x5b
jne 0x4e53e2
mov ecx, esi
call fcn.004e52ec
mov ecx, esi
call fcn.004e61d5
cmp dword [esi + 0x4c], 0x5d
je 0x4e5361
push 4
jmp 0x4e5474
cmp eax, 0x28
jne 0x4e53ff
mov ecx, esi
call fcn.004e52ec
mov ecx, esi
call fcn.004e6302
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4e5472
jmp 0x4e544b
cmp eax, 0x5e
jne 0x4e5408
push 2
jmp 0x4e538a
cmp eax, 0x24
jne 0x4e5414
push 3
jmp 0x4e538a
cmp eax, 0x2a
je 0x4e5468
cmp eax, 0x2b
je 0x4e5468
cmp eax, 0x3f
je 0x4e5468
cmp eax, 0x7b
je 0x4e5468
cmp eax, 0x7d
jne 0x4e5432
test dword [esi + 0x50], edx
je 0x4e5464
cmp eax, 0x5d
jne 0x4e543c
test dword [esi + 0x50], edx
je 0x4e53db
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004e64e1
mov bl, 1
mov ecx, esi
call fcn.004e52ec
test bl, bl
je 0x4e545d
mov ecx, esi
call fcn.004e6407
mov cl, 1
jmp 0x4e531c
push 6
jmp 0x4e5474
push 0xa
jmp 0x4e5474
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.0042b7cd
int3

Function at 0x4e9386
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x5e1f80
call fcn.0059bbd7
mov esi, ecx
call fcn.00414f5f
test eax, eax
je 0x46b29f
mov ecx, esi
call fcn.0046b4dc
jmp 0x46b2b6
push 0xce
push str.C360SafeHbMgr::RunTask
push str.__s__d___not_run_OnTimerEver5Second
call fcn.0040a649
add esp, 0xc
call fcn.0046c398
test eax, eax
je 0x46b32c
lea ecx, [ebp - 0x40]
call fcn.00425665
and dword [ebp - 4], 0
lea edx, [ebp - 0x40]
push str.360browser_bkinfolocalbk_
lea ecx, [ebp - 0x28]
call fcn.00411559
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46b308
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.00428292
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.0040b67e
mov al, 1
call fcn.0059bb81
ret
call fcn.0046b334
mov ecx, eax
jmp 0x46b27f

Function at 0x4e9471
Capabilities:
Check if file exists

Disassembly:
call fcn.0045625e
jmp fcn.00455ff0
Function at 0x4ea6ae
Capabilities:
Check if file exists

Disassembly:
push 0x74
mov eax, 0x5f820d
call fcn.0059bbd7
xor ebx, ebx
lea ecx, [ebp - 0x58]
mov edi, ebx
mov dword [ebp - 0x74], edi
call fcn.004cb6c0
push 0x63424c
lea edx, [ebp - 0x58]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
call fcn.00411559
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ea7e5
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.004272ec
test eax, eax
je 0x4ea7dd
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
lea edx, [ebp - 0x80]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.004280c1
mov esi, dword [ebp - 0x80]
jmp 0x4ea7cc
sub esp, 0x18
mov ecx, esp
push esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040b155
lea ecx, [ebp - 0x70]
call fcn.00435a2c
add esp, 0x18
mov byte [ebp - 4], 4
or edi, 1
mov ecx, eax
mov dword [ebp - 0x74], edi
call fcn.004274ba
test al, al
je 0x4ea793
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov ecx, esi
cmovae edx, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x4ea788
mov ecx, dword [esi]
call fcn.004275c6
test eax, eax
jns 0x4ea793
mov bl, 1
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 3
and edi, 0xfffffffe
call fcn.00404812
test bl, bl
je 0x4ea7c6
sub esp, 0x18
lea ecx, [ebp - 0x58]
mov eax, esp
push esi
push ecx
push eax
call fcn.0042adda
add esp, 0xc
mov cl, 1
call fcn.0042602c
add esp, 0x18
push 0
add esi, 0x18
pop ebx
cmp esi, dword [ebp - 0x7c]
jne 0x4ea742
lea ecx, [ebp - 0x80]
call fcn.004132fb
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x58]
call fcn.0040b67e
call fcn.0059bb81
ret
Function at 0x4ea803
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x5e58d6
call fcn.0059bbd7
mov esi, ecx
push 0x216
mov ebx, str.TaskRunner::RelaunchProcess
push ebx
push str.__s__d___Update:_RelaunchProcess
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x40]
push 0x63424c
call fcn.0040b0d5
and dword [ebp - 4], 0
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.004cb96f
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040b67e
add esi, 0x30
push 8
pop edi
mov ecx, esi
cmp dword [esi + 0x14], edi
jb 0x4ea860
mov ecx, dword [esi]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 0x219
push ebx
push str.__s__d___szExePath___s_m_strCmd__s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004352fd
pop ecx
test eax, eax
je 0x4ea8d0
push 0x21c
push ebx
push str.__s__d___ShellExecute_start___
call fcn.0040a649
add esp, 0xc
cmp dword [esi + 0x14], edi
jb 0x4ea8ae
mov esi, dword [esi]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push 1
cmovae eax, dword [ebp - 0x28]
push 0
push esi
push eax
push 0x63afc8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x28]
call fcn.0040b67e
call fcn.0059bb81
ret
Function at 0x4f3820
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x4f38bf
push edi
call fcn.00505b50
add esp, 4
test al, al
jne 0x4f38bf
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4f3848
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.00510d40
add esp, 0xc
test eax, eax
je 0x4f387c
sub eax, edi
push eax
push 0x2e
push edi
call fcn.00510d40
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4f387e
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [edi + esi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x4f38b7
mov al, byte [edi]
push eax
call fcn.00501b00
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x4f3896
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x4fd6a0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x712], 0
je 0x4fd726
cmp dword [edi + 0x1b0], 0
je 0x4fd6ed
push esi
push 1
push edi
call fcn.004eef10
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.004eef10
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x4fd726
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x600098
push 2
push eax
call fcn.005c2f38
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.005c2f38
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x4fdad0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x6d35ac]
xor eax, esp
mov dword [esp + 0x108], eax
mov edx, dword [esp + 0x114]
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x124]
push ebp
mov ebp, dword [esp + 0x118]
push esi
lea esi, [edx + 0x17]
mov dword [esp + 0x10], eax
shl esi, 4
mov ecx, dword [ebp + 0xc]
add esi, ecx
push edi
mov eax, dword [ecx + edx*4 + 0x148]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x2a0]
test byte [eax + 0x44], 3
je 0x4fdbd5
cmp dword [ecx + edx*4 + 0x160], 0x4fd980
jne 0x4fdbd5
cmp dword [esi], 0
je 0x4fdb52
test edi, edi
je 0x4fdbd5
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [esp + 0x20]
call fcn.0050d1e0
add esp, 0x14
cmp eax, 0xffffffff
je 0x4fdbd5
test al, 1
je 0x4fdbd5
mov ecx, dword [esi]
test ecx, ecx
jne 0x4fdba7
mov eax, dword [ebp + 0x4e0]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x4fdbc3
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x4fdbce
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4fdbd5
add dword [esi + 8], eax
jmp 0x4fdbd5
mov dword [ebx], 0x1b
or eax, 0xffffffff
jmp 0x4fdc40
mov dword [esi + 4], 0
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov dword [ebx], 0
cmp esi, 0xffffffff
jne 0x4fdc3e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x4fdc13
xor esi, esi
mov dword [ebx], 0x51
jmp 0x4fdc3e
push 0x100
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.00510200
push eax
push str.Send_failure:__s
push ebp
call fcn.004fd730
mov dword [ebp + 0x964], edi
add esp, 0x18
mov dword [ebx], 0x37
mov eax, esi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059a7a2
add esp, 0x10c
ret
Function at 0x4fe350
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x6d35ac]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call fcn.005b24a0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4fe3d7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.00510200
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x4fe417
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.004fdf60
add esp, 0x10
test al, al
jne 0x4fe420
call fcn.005c6364
mov esi, dword [eax]
call fcn.005c6364
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.00510200
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004fd730
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0059a7a2
add esp, 0x188
ret
Function at 0x5000a0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x5000ba
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push 0x600500
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x600510
push esi
call fcn.005c1490
add esp, 8
test eax, eax
je 0x500102
test ebp, ebp
je 0x5000f3
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x500128
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x500128
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x5001df
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x500145
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x5001d5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x5001d5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x500177
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x500190
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x5001a0
test ebp, ebp
je 0x5001cc
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x6d3004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x6d3004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x505c80
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x505c92
mov eax, dword [eax + 0x70]
mov al, byte [eax + 0xe3]
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x505ca6
xor al, al
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
ret
Function at 0x511710
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.00505090
push dword [esp + 0x38]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call fcn.005cd527
push dword [esp + 0x40]
mov edi, eax
call fcn.005cd527
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x5117a5
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.00505090
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.00505140
add esp, 0x20
test edx, edx
ja 0x5117c9
jb 0x511797
cmp eax, 0x3e8
ja 0x5117c9
push 1
call ebp
push 1
push esi
push edi
call ebx
test eax, eax
je 0x511760
test edi, edi
je 0x5117b2
push edi
call fcn.005c13b1
add esp, 4
test esi, esi
je 0x5117bf
push esi
call fcn.005c13b1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edi, edi
je 0x5117d6
push edi
call fcn.005c13b1
add esp, 4
test esi, esi
je 0x5117e3
push esi
call fcn.005c13b1
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x5117f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x34
mov eax, dword [0x6d35ac]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov edi, dword [esp + 0x4c]
push 6
push 1
push 2
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x5119e2
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [esp + 0x24], xmm0
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x1c], eax
xor eax, eax
push 4
mov word [esp + 0x1e], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push esi
mov dword [edi + 4], 0xffffffff
mov dword [edi], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x5119d0
push 0x10
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x5119d0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x5119d0
cmp dword [esp + 8], 0x10
jl 0x5119d0
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x5119d0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x5119d0
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x5119d0
push 1
push esi
call fcn.00529750
add esp, 8
test eax, eax
js 0x5119d0
push 0
push 0x2710
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
push 1
push eax
mov dword [esp + 0x24], 1
call fcn.0050cdd0
add esp, 0x10
push 0
push 0
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x5119d0
lea eax, [esp + 8]
mov dword [esp + 8], 0x10
push eax
lea eax, [esp + 0x1c]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x5119d0
cmp dword [esp + 8], 0x10
jl 0x5119d0
lea eax, [esp + 8]
mov dword [esp + 8], 0x10
push eax
lea eax, [esp + 0x2c]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x5119d0
cmp dword [esp + 8], 0x10
jl 0x5119d0
mov ax, word [esp + 0x18]
cmp ax, word [esp + 0x28]
jne 0x5119d0
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x2c]
jne 0x5119d0
mov ax, word [esp + 0x1a]
cmp ax, word [esp + 0x2a]
jne 0x5119d0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0059a7a2
add esp, 0x34
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi]
call esi
push dword [edi + 4]
call esi
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.0059a7a2
add esp, 0x34
ret
Function at 0x511a30
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [eax], ebx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 4], eax
test eax, eax
jne 0x511bc1
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x511bac
push ebp
push edi
mov eax, dword [esi + 0x14]
test eax, eax
je 0x511a8e
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x511a80
sub eax, edx
lea ecx, [eax + 1]
jmp 0x511a90
xor ecx, ecx
mov eax, dword [esi + 4]
mov dword [esp + 0x14], ecx
cmp eax, 2
jne 0x511aa1
lea ebp, [eax + 0xe]
jmp 0x511aad
cmp eax, 0x17
jne 0x511b4e
lea ebp, [eax + 5]
cmp dword [esi + 0x18], 0
je 0x511b4e
mov eax, dword [esi + 0x10]
test eax, eax
je 0x511b4e
cmp eax, ebp
jb 0x511b4e
lea eax, [ecx + 0x20]
add eax, ebp
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
je 0x511b9d
mov ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x20]
push ebp
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
push dword [esi + 0x18]
push eax
call fcn.005b2600
mov ecx, dword [esp + 0x20]
add esp, 0xc
test ecx, ecx
je 0x511b3a
mov eax, dword [edi + 0x18]
add eax, ebp
push ecx
mov dword [edi + 0x14], eax
push dword [esi + 0x14]
push eax
call fcn.005b2600
add esp, 0xc
mov eax, dword [esp + 0x18]
test ebx, ebx
cmove ebx, edi
test eax, eax
je 0x511b4a
mov dword [eax + 0x1c], edi
mov dword [esp + 0x18], edi
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x511a72
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
test eax, eax
je 0x511b6e
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x511ba8
test ebx, ebx
je 0x511b8d
mov esi, dword [ebx + 0x1c]
push ebx
call dword [0x6d3004]
add esp, 4
mov ebx, esi
test esi, esi
jne 0x511b76
mov esi, dword [esp + 8]
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
mov esi, 8
mov dword [esp + 0x10], esi
jmp 0x511b5d
test ebx, ebx
jne 0x511bb8
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret