joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da430
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x4da4fc
mov eax, dword [ebx]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x7358d4
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx]
mov dword [esp + 8], 0x43
mov dword [esp + 4], 1
mov dword [esp], str._Y_es____N_o____A_lways____S_kip_all___A_u_to_rename_all____Q_uit_
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov ecx, ebx
call fcn.00474000
lea ecx, [esp + 0x14]
mov dword [esp + 4], 0
mov dword [esp], 0x855be8
call fcn.004da7e0
sub esp, 8
lea ecx, [esp + 0x14]
call fcn.00471b70
lea ecx, [esp + 0x14]
call fcn.00471b00
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4da555
mov edx, dword [esp + 0x14]
movzx eax, byte [edx]
lea esi, [eax - 0x41]
lea edi, [eax + 0x20]
mov ecx, esi
cmp cl, 0x19
cmovbe eax, edi
sub eax, 0x61
cmp al, 0x18
ja case.0x4da4e5.1
movzx eax, al
jmp dword [eax*4 + 0x73591c]
test edx, edx
je 0x4da4fc
mov dword [esp], edx
call fcn.006e9860
lea ecx, [esp + 0x14]
mov dword [esp + 4], 0
mov dword [esp], 0x855be8
call fcn.004da7e0
sub esp, 8
lea ecx, [esp + 0x14]
call fcn.00471b70
lea ecx, [esp + 0x14]
call fcn.00471b00
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
test ecx, ecx
je 0x4da4f0
movzx eax, byte [edx]
lea ebx, [eax - 0x41]
lea ecx, [eax + 0x20]
cmp bl, 0x19
cmovbe eax, ecx
sub eax, 0x61
cmp al, 0x18
ja case.0x4da54e.1
movzx eax, al
jmp dword [eax*4 + 0x735980]
mov edx, dword [esp + 0x14]
test edx, edx
je 0x4da464
mov dword [esp], edx
call fcn.006e9860
jmp 0x4da464
xor ebx, ebx
mov dword [esp], edx
call fcn.006e9860
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov ebx, 1
jmp 0x4da572
mov ebx, 2
jmp 0x4da572
mov ebx, 3
jmp 0x4da572
mov ebx, 4
jmp 0x4da572
mov ebx, 5
jmp 0x4da572
Function at 0x4e4820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
call fcn.004e4710
mov esi, eax
mov dword [ebx + 0x14], eax
xor eax, eax
test esi, esi
je 0x4e4901
mov eax, dword [ebx]
lea edi, [ebx + 0x18]
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 4]
mov dword [esi + 8], edi
mov dword [esi + 0x68], eax
mov dword [esp + 4], 0x208
mov dword [esp], edi
call fcn.004e1280
mov dword [esp + 4], edi
mov dword [esp], 0
call fcn.004e0580
mov eax, dword [esp + 0x3c]
mov dword [ebx + 0x40], eax
mov eax, dword [ebx]
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x38]
mov dword [esi], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
lea eax, [esi + 0x18]
mov dword [esp], eax
call fcn.004fca20
mov edx, dword [ebx + 4]
mov dword [esp + 4], 0
mov ecx, 1
mov dword [esp], esi
mov eax, dword [ebx]
call fcn.004e3940
test eax, eax
je 0x4e48e1
cmp dword [esi + 0xb0], 1
je 0x4e4920
mov edx, dword [ebx]
mov dword [ebx + 0x84], 0
mov eax, esi
call fcn.004e2520
test eax, eax
jne 0x4e4910
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x4e48f8
mov dword [esp], esi
call fcn.004e4750
mov dword [esp], esi
call fcn.004fda50
mov dword [ebx + 0x14], 0
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [esi + 0xb4], 3
jne 0x4e48ca
mov eax, dword [esi + 0x78]
test eax, eax
jg 0x4e48ca
mov ebp, dword [esi + 0xa4]
test ebp, ebp
jle 0x4e49a1
mov eax, dword [esi + 0xa8]
mov edx, dword [eax + 4]
cmp byte [edx], 0
jne 0x4e48ca
mov edx, dword [eax + 8]
cmp byte [edx], 0
jne 0x4e48ca
mov edx, dword [eax + 0xc]
cmp byte [edx], 0
jne 0x4e48ca
add eax, 0x228
xor edx, edx
jmp 0x4e499a
mov ecx, dword [eax]
mov edi, eax
cmp byte [ecx], 0
jne 0x4e48ca
mov ecx, dword [eax + 4]
cmp byte [ecx], 0
jne 0x4e48ca
mov ecx, dword [edi + 8]
add eax, 0x224
cmp byte [ecx], 0
jne 0x4e48ca
add edx, 1
cmp edx, ebp
jne 0x4e4970
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x84], 1
imul dword [esi + 0x64]
mov dword [esi + 0x14], 0
mov dword [esp + 8], 1
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004fd950
test eax, eax
mov dword [esi + 0x10], eax
jne 0x4e4910
mov dword [esi], 1
jmp 0x4e48e1
Function at 0x501155
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x5c]
mov edi, dword [esp + 0x50]
call fcn.00613324
mov eax, dword [esp + 0x58]
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
sub esp, 0x18
mov ebx, eax
call fcn.004db479
mov ebp, eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp ebx, 0xffffffff
mov dword [esi], eax
mov dword [esi + 4], ebp
je 0x501203
cmp edi, 0x17
lea edi, [esp + 0x28]
jne 0x5011ef
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 0x29
mov dword [esp], ebx
call dword [sym.imp.WSOCK32.DLL_setsockopt]
sub esp, 0x14
mov ecx, edi
call fcn.0062b79c
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi], eax
mov dword [esi + 4], edx
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x502452
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x12c
lea ebx, [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.asio_58CCDC44_6264_4842_90C2_F3C545CB8AA7__u__p
mov dword [esp + 4], pe_nt_image_headers32
call dword [sym.imp.msvcrt.dll__snwprintf]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
sub esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
test ebx, ebx
jne 0x5024b7
call ebp
jmp 0x502523
cmp eax, 0xb7
jne 0x5024d1
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push ecx
cmp byte [esi], 0
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jne 0x502511
lea eax, [esi + 4]
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
push edx
push edx
jne 0x50250e
call ebp
mov dword [esp], ebx
mov esi, eax
call edi
push ecx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
push ebx
jmp 0x502523
mov byte [esi], 1
mov dword [esp], ebx
call edi
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
xor eax, eax
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x502568
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, ecx
sub esp, 0x28
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp], 2
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebx + 4]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
xor eax, eax
lock xadd dword [0x717ff0], eax
test eax, eax
mov eax, dword [ebx]
je 0x5025d3
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x502602
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x50035c
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
push eax
add esp, 0x28
pop ebx
ret

Function at 0x50260a
Capabilities:
Initialize winsock library

Disassembly:
push ebx
shl ecx, 8
movzx edx, dl
or edx, ecx
mov ebx, eax
sub esp, 0x1a8
movzx edx, dx
lea eax, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
push edx
push edx
xchg dword [ebx + 4], eax
add esp, 0x1a8
pop ebx
ret
push ebx
mov eax, dword [esp + 8]
mov ebx, 1
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
lock xadd dword [eax], ebx
test ebx, ebx
jne 0x502630
pop ebx
movzx ecx, cl
movzx edx, dl
jmp 0x500462
pop ebx
ret

Function at 0x50371a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x3c
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov dword [esp], edi
call fcn.005021f0
mov ecx, dword [esi + 4]
push edx
call fcn.0061ab84
mov eax, ebp
test al, al
je 0x50375e
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
jmp 0x5037e9
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x50377a
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2719
jmp 0x5037e9
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov dword [esp], eax
mov dword [esp + 0x10], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 4], edx
call dword [sym.imp.WS2_32.dll_WSASend]
sub esp, 0x1c
mov edi, eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov edx, 0x274d
cmp eax, 0x4d2
mov ecx, dword [esi + 4]
cmove eax, edx
test edi, edi
je 0x5037f6
cmp eax, 0x3e5
je 0x5037f6
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0050347a
sub esp, 0xc
jmp 0x5037ff
mov dword [esp], ebx
call fcn.005034dc
push eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
Function at 0x5038e6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x3c
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov dword [esp], edi
call fcn.005021f0
mov ecx, dword [esi + 4]
push edx
call fcn.0061ab84
mov eax, ebp
test al, al
je 0x50392a
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
jmp 0x5039cc
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x503949
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2719
jmp 0x5039cc
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov dword [esp], eax
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x28]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 4], edx
call dword [sym.imp.WS2_32.dll_WSARecv]
sub esp, 0x1c
mov edi, eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x40
je 0x5039ad
cmp eax, 0x4d2
mov edx, 0x274d
cmove eax, edx
jmp 0x5039b2
mov eax, 0x2746
test edi, edi
mov ecx, dword [esi + 4]
je 0x5039d9
cmp eax, 0x3e5
je 0x5039d9
mov edx, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0050347a
sub esp, 0xc
jmp 0x5039e2
mov dword [esp], ebx
call fcn.005034dc
push eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18

Function at 0x5039ec
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x40
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x68]
mov dword [esp], edi
call fcn.005021f0
mov ecx, dword [esi + 4]
push edx
call fcn.0061ab84
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x503a2c
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2719
jmp 0x503ab3
mov edx, dword [esp + 0x60]
mov dword [esp + 0x38], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], ebx
mov dword [esp], eax
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x3c]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x38]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 4], edx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
sub esp, 0x24
mov edi, eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov edx, 0x274d
cmp eax, 0x4d2
mov ecx, dword [esi + 4]
cmove eax, edx
test edi, edi
je 0x503ac0
cmp eax, 0x3e5
je 0x503ac0
mov edx, dword [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0050347a
sub esp, 0xc
jmp 0x503ac9
mov dword [esp], ebx
call fcn.005034dc
push eax
add esp, 0x40
pop ebx
pop esi
pop edi
ret 0x1c
Function at 0x503ea0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [esp + 0x40], 0xffffffff
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
jne 0x503ecd
call fcn.004db479
mov dword [ebx], 0x2719
mov dword [ebx + 4], eax
jmp 0x503f56
mov eax, edi
mov esi, edi
test al, al
jne 0x503eeb
test byte [ebp], 1
je 0x503eeb
call fcn.004db479
mov dword [ebx], 0x2726
mov dword [ebx + 4], eax
jmp 0x503f58
call fcn.00613324
mov eax, edi
mov dword [esp + 4], 0x8004667e
movzx eax, al
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00613300
test eax, eax
js 0x503f56
lea ecx, [esp + 0x18]
call fcn.0062b79c
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebx], eax
mov eax, edi
mov dword [ebx + 4], edx
test al, al
je 0x503f4b
or byte [ebp], 2
jmp 0x503f58
and byte [ebp], 0xfd
mov esi, 1
jmp 0x503f58
xor esi, esi
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x50416a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [esp + 0x50]
call fcn.00613324
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSARecv]
sub esp, 0x1c
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00613300
mov esi, eax
mov eax, dword [ebx]
cmp eax, 0x40
jne 0x5041ea
call fcn.004db479
mov dword [ebx], 0x2746
jmp 0x5041fc
cmp eax, 0x4d2
jne 0x5041ff
call fcn.004db479
mov dword [ebx], 0x274d
mov dword [ebx + 4], eax
or eax, 0xffffffff
test esi, esi
jne 0x504220
lea ecx, [esp + 0x28]
call fcn.0062b79c
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 4], edx
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x5043ea
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [esp + 0x50]
call fcn.00613324
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASend]
sub esp, 0x1c
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00613300
mov esi, eax
mov eax, dword [ebx]
cmp eax, 0x40
jne 0x504462
call fcn.004db479
mov dword [ebx], 0x2746
jmp 0x504474
cmp eax, 0x4d2
jne 0x504477
call fcn.004db479
mov dword [ebx], 0x274d
mov dword [ebx + 4], eax
or eax, 0xffffffff
test esi, esi
jne 0x504498
lea ecx, [esp + 0x28]
call fcn.0062b79c
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], edx
add esp, 0x34
pop ebx
pop esi
ret

Function at 0x5044f7
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
sub esp, 0x44
mov ebx, dword [esp + 0x68]
call fcn.00613324
mov eax, dword [esp + 0x64]
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
sub esp, 0x24
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00613300
mov esi, eax
mov eax, dword [ebx]
cmp eax, 0x40
jne 0x50457f
call fcn.004db479
mov dword [ebx], 0x2746
jmp 0x504591
cmp eax, 0x4d2
jne 0x504594
call fcn.004db479
mov dword [ebx], 0x274d
mov dword [ebx + 4], eax
or eax, 0xffffffff
test esi, esi
jne 0x5045b5
lea ecx, [esp + 0x38]
call fcn.0062b79c
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 4], edx
add esp, 0x44
pop ebx
pop esi
ret
Function at 0x5045bb
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x60]
cmp ebp, 0xffffffff
jne 0x5045ea
call fcn.004db479
mov dword [esi], 0x2719
mov dword [esi + 4], eax
or eax, 0xffffffff
jmp 0x50464c
call fcn.00613324
mov eax, dword [esp + 0x58]
mov dword [esp + 8], edi
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00613300
test eax, eax
js 0x50464c
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
call fcn.0062b79c
cmp dword [esp + 0x58], 0x8004667e
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], edx
jne 0x50464c
cmp dword [edi], 0
je 0x504649
or byte [ebx], 1
jmp 0x50464c
and byte [ebx], 0xfc
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x504654
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x68]
mov ebp, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
call fcn.00613324
cmp dword [esp + 0x64], 0
jne 0x5046c2
test edi, edi
jne 0x5046c2
test ebp, ebp
jne 0x5046c2
test esi, esi
je 0x5046c2
mov eax, dword [esi + 4]
imul ecx, dword [esi], 0x3e8
mov esi, 0x3e8
cdq
idiv esi
mov edx, 1
add eax, ecx
cmove eax, edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
lea ecx, [esp + 0x38]
call fcn.0062b79c
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor eax, eax
jmp 0x504732
test esi, esi
je 0x5046e0
cmp dword [esi], 0
jne 0x5046e0
mov eax, dword [esi + 4]
lea edx, [eax - 1]
cmp edx, 0x3e6
ja 0x5046e0
mov dword [esi + 4], 0x3e8
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_select]
sub esp, 0x14
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00613300
test eax, eax
js 0x504732
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], eax
call fcn.0062b79c
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
mov dword [ebx], esi
mov dword [ebx + 4], edi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x50473a
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov edi, dword [esp + 0x160]
mov ebx, dword [esp + 0x164]
mov esi, dword [esp + 0x168]
cmp edi, 0xffffffff
jne 0x50476b
call fcn.004db479
mov dword [esi], 0x2719
jmp 0x5047e6
lea ebp, [esp + 0x2c]
and bl, 1
mov eax, 0
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 1
cmove ebp, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.00613324
lea eax, [esp + 0x3c]
inc edi
mov dword [esp + 0x10], ebp
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_select]
sub esp, 0x14
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00613300
cmp eax, 0
mov edi, eax
jne 0x5047eb
test bl, bl
je 0x5047ed
call fcn.004db479
mov dword [esi], 0x2733
mov dword [esi + 4], eax
jmp 0x504803
jle 0x504803
lea ecx, [esp + 0x34]
call fcn.0062b79c
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], edx
add esp, 0x14c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x504bce
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov edi, dword [esp + 0x160]
mov ebx, dword [esp + 0x164]
mov esi, dword [esp + 0x168]
cmp edi, 0xffffffff
jne 0x504bff
call fcn.004db479
mov dword [esi], 0x2719
jmp 0x504c7a
lea ebp, [esp + 0x2c]
and bl, 1
mov eax, 0
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 1
cmove ebp, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.00613324
lea eax, [esp + 0x3c]
inc edi
mov dword [esp + 0x10], ebp
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call dword [sym.imp.WSOCK32.DLL_select]
sub esp, 0x14
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00613300
cmp eax, 0
mov edi, eax
jne 0x504c7f
test bl, bl
je 0x504c81
call fcn.004db479
mov dword [esi], 0x2733
mov dword [esi + 4], eax
jmp 0x504c97
jle 0x504c97
lea ecx, [esp + 0x34]
call fcn.0062b79c
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], edx
add esp, 0x14c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x5056ba
Capabilities:
Connect socket

Disassembly:
push esi
push ebx
sub esp, 0x34
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x4c]
cmp esi, 0xffffffff
jne 0x5056df
call fcn.004db479
mov dword [ebx], 0x2719
mov dword [ebx + 4], eax
or eax, 0xffffffff
jmp 0x50572e
call fcn.00613324
mov eax, dword [esp + 0x48]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_connect]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00613300
test eax, eax
jne 0x50572e
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
call fcn.0062b79c
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 4], edx
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x505734
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [esp + 0x60], 0xffffffff
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov ebx, dword [esp + 0x78]
jne 0x505763
call fcn.004db479
mov dword [ebx], 0x2719
jmp 0x505780
cmp edi, 0xa5100000
sete dl
cmp esi, 2
jne 0x50578b
test dl, dl
je 0x50578b
call fcn.004db479
mov dword [ebx], 0x2726
mov dword [ebx + 4], eax
or eax, 0xffffffff
jmp 0x50582d
cmp esi, 1
jne 0x5057c3
test dl, dl
je 0x5057c3
cmp dword [esp + 0x74], 4
jne 0x505775
cmp dword [ebp], 0
je 0x5057a6
or byte [eax], 4
jmp 0x5057a9
and byte [eax], 0xfb
lea ecx, [esp + 0x38]
call fcn.0062b79c
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], edx
jmp 0x50582d
cmp edi, 0xffff
jne 0x5057d6
cmp esi, 0x80
jne 0x5057d6
or byte [eax], 8
call fcn.00613324
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_setsockopt]
sub esp, 0x14
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00613300
test eax, eax
jne 0x50582d
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], eax
call fcn.0062b79c
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
mov dword [ebx], esi
mov dword [ebx + 4], edi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret