joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7890
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x2c]
mov ebx, eax
mov edi, esi
xor eax, eax
sub esp, 0x5c
mov dword [ebp - 0x3c], edx
rep stosd dword es:[edi], eax
mov dword [esp], ebx
call sub.WS2_32.DLL_gethostbyname
mov ebx, eax
test eax, eax
push ecx
je 0x4d78cc
lea eax, [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x4c], eax
movzx eax, word [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x4d7940
mov dword [esp + 8], str.Failed_to_resolve_host
jmp 0x4d78ef
cmp word [ebx + 8], 2
jne 0x4d794a
mov cx, word [ebx + 0xa]
cmp cx, 4
jbe 0x4d7905
mov dword [esp + 8], str.address_size_mismatch_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.004772c8
jmp 0x4d794a
mov edi, dword [ebp - 0x4c]
movsx ecx, cx
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x40], edx
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x2c]
push edx
call fcn.004d7674
mov edx, dword [ebp - 0x40]
add edx, 4
cmp eax, 0xffffffff
jne 0x4d794d
mov eax, dword [ebx + 0xc]
mov esi, dword [eax + edx]
test esi, esi
jne 0x4d78d6
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4d7955
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x12c], ecx
test edx, edx
je 0x4d797b
xor edi, edi
test byte [eax + 0x18], 1
jne 0x4d7a42
xor edi, edi
jmp 0x4d7a4e
mov eax, dword [ebp - 0x12c]
mov dword [esp + 0xc], 0
sub eax, edi
mov dword [esp + 8], eax
lea eax, [esi + edi]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.WS2_32.DLL_send
sub esp, 0x10
test eax, eax
jle 0x4d79b6
add edi, eax
jmp 0x4d7a42
inc eax
jne 0x4d79f4
call sub.WS2_32.DLL_WSAGetLastError
cmp eax, 0xb
je 0x4d79f4
call sub.WS2_32.DLL_WSAGetLastError
cmp eax, 0x2733
je 0x4d79f4
mov dword [esp + 8], str.send_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.004772c8
test edi, edi
jne 0x4d7a4e
or edi, 0xffffffff
jmp 0x4d7a4e
mov eax, dword [ebx + 0x14]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x120], eax
mov dword [esp + 0x10], edx
inc eax
lea edx, [ebp - 0x124]
mov dword [ebp - 0x20], 0x3c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x124], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.WS2_32.DLL_select
sub esp, 0x14
cmp edi, dword [ebp - 0x12c]
jl 0x4d7982
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4d7d30
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
cmp dword [0x6974e8], 0
jne 0x4d7dbe
lea eax, [ebp - 0x198]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call sub.WS2_32.DLL_WSAStartup
test eax, eax
push edx
push edx
jne 0x4d7dbe
cmp dword [0x6974d8], 0
jne 0x4d7db4
mov dword [0x6974f8], 0x50
mov dword [esp], str.no_proxy
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4d7d8c
cmp byte [eax], 0x2a
jne 0x4d7d8c
cmp byte [eax + 1], 0
je 0x4d7db4
mov dword [esp], str.http_proxy
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x4d7dac
mov dword [esp], str.HTTP_PROXY
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4d7db4
mov dword [esp], eax
call fcn.004d75b6
mov dword [0x6974e8], 1
leave
ret
Function at 0x4d9d21
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, edx
sub esp, 0x10
mov ebx, eax
call fcn.004d8a17
test esi, esi
jne 0x4d9d57
cmp dword [ebx + 0x7c], 0
jne 0x4d9e04
mov eax, dword [ebx]
mov dword [esp], str.DTD_node_is_NULL_n
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x4d9e04
cmp dword [esi + 4], 0xe
je 0x4d9d74
add esp, 0x10
mov eax, ebx
mov ecx, str.Node_is_not_a_DTD
mov edx, 0x139e
pop ebx
pop esi
pop ebp
jmp fcn.004d8ebd
cmp dword [ebx + 0x7c], 0
jne 0x4d9df5
mov edx, dword [esi + 8]
mov eax, dword [ebx]
test edx, edx
je 0x4d9d99
mov dword [esp + 8], edx
mov dword [esp + 4], str.DTD__s_
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4d9da9
mov dword [esp + 4], eax
mov dword [esp], 0x671024
call sub.msvcrt.dll_fputs
mov eax, dword [esi + 0x34]
test eax, eax
je 0x4d9dc6
mov dword [esp + 8], eax
mov dword [esp + 4], str.__PUBLIC__s
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esi + 0x38]
test eax, eax
je 0x4d9de3
mov dword [esp + 8], eax
mov dword [esp + 4], str.__SYSTEM__s
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [ebx]
mov dword [esp], 0xa
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add esp, 0x10
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.004d9ab4
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x4da123
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, edx
mov ebx, eax
call fcn.004d8a17
test esi, esi
jne 0x4da157
cmp dword [ebx + 0x7c], 0
jne 0x4da1d3
mov eax, dword [ebx]
mov dword [esp], str.Attr_is_NULL
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x4da1d3
cmp dword [ebx + 0x7c], 0
jne 0x4da1ac
mov eax, dword [ebx]
mov dword [esp], str.ATTRIBUTE
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov edx, dword [esi + 8]
mov eax, ebx
call fcn.004d92e2
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
cmp dword [esi + 0xc], 0
je 0x4da1ac
inc dword [ebx + 0x6c]
mov edi, dword [esi + 0xc]
jmp 0x4da1a5
mov edx, edi
mov eax, ebx
call fcn.004da0be
mov edi, dword [edi + 0x18]
test edi, edi
jne 0x4da199
dec dword [ebx + 0x6c]
cmp dword [esi + 8], 0
jne 0x4da1c3
mov ecx, str.Attribute_has_no_name
mov edx, 0x1397
mov eax, ebx
call fcn.004d8ebd
add esp, 0x1c
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004d9ab4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4dd505
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x130
mov edi, dword [ebp + 0xc]
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp eax, 0xffffffff
je 0x4dd582
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0x128
push eax
push esi
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4dd57c
cmp dword [ebp - 0x124], edi
jne 0x4dd56d
push dword [ebp - 0x134]
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test eax, eax
je 0x4dd56d
push 0xffffffffffffffff
push eax
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x13c]
push eax
push esi
call sub.KERNEL32.DLL_Process32Next
jmp 0x4dd53b
push esi
call sub.KERNEL32.DLL_CloseHandle
push 0xffffffffffffffff
push dword [ebp + 8]
call sub.KERNEL32.DLL_TerminateProcess
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4f50e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
test esi, esi
je 0x4f5194
mov eax, dword [esi]
xor ecx, ecx
xor ebx, ebx
mov byte [eax + 0x16], 0
mov eax, dword [esi]
mov byte [eax + 0x17], 0
mov eax, dword [esi]
mov byte [eax + 0x18], 0
mov eax, dword [esi]
mov byte [eax + 0x19], 0
mov edi, dword [esi + 4]
cmp ecx, edi
jge 0x4f5145
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
mov edx, ecx
shl edx, 8
shr ecx, 0x18
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x14]
movzx eax, byte [ebx + edx]
xor eax, ecx
inc ebx
mov ecx, dword [ebp - 0x18]
xor ecx, dword [eax*4 + 0x677f80]
cmp ebx, edi
jl 0x4f5122
xor ebx, ebx
mov edi, dword [esi + 0xc]
cmp ebx, edi
jge 0x4f5177
mov eax, dword [esi + 8]
mov dword [ebp - 0x10], eax
mov edx, ecx
shl edx, 8
shr ecx, 0x18
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
movzx eax, byte [ebx + edx]
xor eax, ecx
inc ebx
mov ecx, dword [ebp - 0x18]
xor ecx, dword [eax*4 + 0x677f80]
cmp ebx, edi
jl 0x4f5154
mov eax, dword [esi]
mov byte [eax + 0x16], cl
shr ecx, 8
mov eax, dword [esi]
mov byte [eax + 0x17], cl
shr ecx, 8
mov eax, dword [esi]
mov byte [eax + 0x18], cl
shr ecx, 8
mov eax, dword [esi]
mov byte [eax + 0x19], cl
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x50a7d6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x214
mov edi, eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], edx
push eax
mov ebx, dword [ebp + 8]
push edi
mov esi, 0x200
call fcn.0050401e
pop ecx
pop eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00504312
pop edx
cmp esi, ebx
jbe 0x50a814
mov esi, ebx
push dword [ebp - 0x220]
push esi
push 1
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
add dword [ebp - 0x21c], eax
sub ebx, eax
setne dl
cmp eax, esi
sete al
movzx eax, al
test edx, eax
jne 0x50a801
lea eax, [ebp - 0x21c]
xor esi, esi
push eax
call fcn.0050426a
pop ecx
test ebx, ebx
je 0x50a85e
push 0xffffffffffffffff
push edi
call fcn.00505004
pop edi
test eax, eax
pop edx
je 0x50a863
mov esi, 1
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x50bf58
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x110
mov edi, edx
push dword [ebp + 8]
mov ebx, eax
mov esi, dword [ebp + 0xc]
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
jne 0x50bf81
push esi
push ebx
call fcn.005051a5
jmp 0x50bfaa
push 0x679d18
push 0x679d1c
push eax
push ebx
call fcn.0050438d
push esi
push 0x679d1f
push eax
push ebx
call fcn.0050438d
add esp, 0x20
push 0xfffffffffffffffe
push ebx
call fcn.00504bd3
pop esi
lea esi, [ebp - 0x11c]
pop eax
push 0x105
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
sete dl
cmp eax, 0x105
sete al
or eax, edx
test al, 1
jne 0x50bfe0
push 0x5c
push esi
call sub.msvcrt.dll_strrchr
pop edx
test eax, eax
pop ecx
jne 0x50bfed
push str.unable_to_get_ModuleFileName
push ebx
call fcn.00503acb
jmp 0x50c015
mov byte [eax], 0
push esi
push 0x679d3e
push 0
push 0xffffffffffffffff
push ebx
call fcn.00504f97
add esp, 0xc
push eax
push ebx
call fcn.0050438d
add esp, 0x10
push 0xfffffffffffffffe
push ebx
call fcn.00504bd3
pop esi
pop eax
push edi
push 0xfffffffffffffffe
push ebx
call fcn.00505554
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x517e4e
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xca
jne 0x517e83
push ebx
call fcn.0051bd4f
pop eax
cmp dword [ebx + 0x40], 0
je 0x517e7c
mov eax, 1
mov dword [ebx + 0x14], 0xcf
jmp 0x517f1e
mov dword [ebx + 0x14], 0xcb
mov eax, dword [ebx + 0x14]
cmp eax, 0xcb
jne 0x517ef5
mov eax, dword [ebx + 0x1ec]
cmp dword [eax + 0x10], 0
je 0x517ee7
mov eax, dword [ebx + 8]
test eax, eax
je 0x517ea4
push ebx
call dword [eax]
pop ecx
mov eax, dword [ebx + 0x1ec]
push ebx
call dword [eax]
pop edx
test eax, eax
je 0x517f1c
cmp eax, 2
je 0x517ee7
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x517e99
cmp eax, 3
sete dl
dec eax
sete al
or eax, edx
test al, 1
je 0x517e99
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
inc eax
mov dword [ecx + 4], eax
cmp eax, edx
jl 0x517e99
add edx, dword [ebx + 0x178]
mov dword [ecx + 8], edx
jmp 0x517e99
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x517f11
cmp eax, 0xcc
je 0x517f11
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebx]
push ebx
call dword [eax]
pop eax
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
jmp fcn.00517d80
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x5194eb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push ecx
push ecx
mov esi, dword [ebp + 8]
mov dword [esi + 4], 0
push esi
call fcn.0051c108
push 0x54
push esi
mov dword [ebp - 0x10], eax
call fcn.0051c0b0
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x519533
push esi
call fcn.0051c10f
mov eax, dword [esi]
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0x36
mov eax, dword [esi]
push esi
call dword [eax]
pop eax
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebx], fcn.00518ad6
mov dword [ebx + 4], fcn.00518bf2
mov dword [ebx + 8], fcn.00518c8e
mov dword [ebx + 0xc], fcn.00518d23
mov dword [ebx + 0x10], 0x518dc9
mov dword [ebx + 0x14], 0x518e31
mov dword [ebx + 0x18], 0x518e99
mov dword [ebx + 0x1c], 0x51915f
mov dword [ebx + 0x20], 0x51928e
mov dword [ebx + 0x24], fcn.005193bb
mov dword [ebx + 0x28], 0x5194af
mov dword [ebx + 0x30], 0x3b9aca00
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
mov dword [esi + 4], ebx
push str.JPEGMEM
call sub.msvcrt.dll_getenv
pop ecx
mov edx, eax
test eax, eax
je 0x519616
lea eax, [ebp - 9]
mov byte [ebp - 9], 0x78
push eax
lea eax, [ebp - 0x10]
push eax
push str._ld_c
push edx
call sub.msvcrt.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x519616
mov al, byte [ebp - 9]
cmp al, 0x6d
sete dl
cmp al, 0x4d
sete al
or eax, edx
test al, 1
je 0x51960c
imul eax, dword [ebp - 0x10], 0x3e8
mov dword [ebp - 0x10], eax
imul eax, dword [ebp - 0x10], 0x3e8
mov dword [ebx + 0x2c], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x52aac8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov word [eax + 4], 0xffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov word [eax + 0x10], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0x20
mov dword [eax + 0x60], 0x20
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 2
mov dword [eax + 0x70], 2
mov dword [eax + 0x74], 0x1388
mov dword [eax + 0x78], 0x1f4
mov dword [eax + 0x7c], 0x1f4
mov dword [eax + 0x80], 0
mov dword [eax + 0x84], 0
mov dword [eax + 0x88], 0x1f4
mov dword [eax + 0x8c], 0
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
mov dword [eax + 0x98], 0
mov word [eax + 0x90], dx
mov dword [eax + 0x9c], 0
mov dword [eax + 0x94], 0x8000
pop ebp
jmp fcn.0052aa1a

Function at 0x52b18a
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
cmp dword [ebp + 8], 2
sete al
inc eax
push 0
mov esi, dword [ebp + 0xc]
push eax
push 2
call sub.WS2_32.DLL_socket
mov ebx, eax
mov dword [ebp - 0x20], 1
or eax, 0xffffffff
mov dword [ebp - 0x24], 0x40000
cmp ebx, 0xffffffff
je 0x52b266
cmp dword [ebp + 8], 2
jne 0x52b1f1
lea eax, [ebp - 0x20]
push eax
push 0x8004667e
push ebx
call sub.WS2_32.DLL_ioctlsocket
lea eax, [ebp - 0x24]
push 4
push eax
push 0x1002
push 0xffff
push ebx
call sub.WS2_32.DLL_setsockopt
cld
xor eax, eax
lea edi, [ebp - 0x1c]
mov ecx, 4
test esi, esi
rep stosd dword es:[edi], eax
mov word [ebp - 0x1c], 2
je 0x52b21d
movzx eax, word [esi + 4]
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1a], ax
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
jmp 0x52b22a
mov word [ebp - 0x1a], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x1c]
push 0x10
push eax
push ebx
call sub.WS2_32.DLL_bind
inc eax
je 0x52b259
cmp dword [ebp + 8], 1
sete dl
xor eax, eax
test esi, esi
setne al
test edx, eax
je 0x52b264
push 0x7fffffff
push ebx
call sub.WS2_32.DLL_listen
inc eax
jne 0x52b264
push ebx
call sub.WS2_32.DLL_closesocket
or eax, 0xffffffff
jmp 0x52b266
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x52b319
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x52b340
mov word [ebp - 0x14], 2
movzx eax, word [ebx + 4]
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
cmp ebx, 1
push 0
sbb eax, eax
push 0
not eax
and eax, 0x10
push eax
xor eax, eax
test ebx, ebx
je 0x52b358
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push 0
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.WS2_32.DLL_WSASendTo
inc eax
jne 0x52b383
call sub.WS2_32.DLL_WSAGetLastError
cmp eax, 0x2733
sete al
movzx eax, al
dec eax
jmp 0x52b386
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x52b419
Capabilities:
Get socket status

Disassembly:
push ebp
mov edx, 0x3e8
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x228
mov ecx, edx
mov eax, dword [ebp + 0x10]
xor edx, edx
div ecx
imul edx, edx, 0x3e8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], eax
mov eax, dword [esi]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x230], edx
test al, 1
je 0x52b475
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], 1
test al, 2
je 0x52b4a8
xor eax, eax
mov edx, dword [ebp - 0x11c]
cmp eax, edx
jae 0x52b491
cmp dword [ebp + eax*4 - 0x118], ebx
je 0x52b491
inc eax
jmp 0x52b481
cmp eax, edx
jne 0x52b4a8
cmp eax, 0x3f
ja 0x52b4a8
mov dword [ebp + eax*4 - 0x118], ebx
inc eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x234]
lea edi, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x11c]
push 0
push edi
push eax
lea eax, [ebx + 1]
push eax
call sub.WS2_32.DLL_select
or edx, 0xffffffff
test eax, eax
jl 0x52b4fb
mov dword [esi], 0
je 0x52b4f9
push edi
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x52b4e5
or dword [esi], 1
lea ecx, [ebp - 0x11c]
push ecx
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x52b4f9
or dword [esi], 2
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x55ed1a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x55ef64
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, eax
test esi, esi
not ecx
jmp 0x55ed52
test dl, 3
je 0x55ed54
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x6906a0]
dec esi
jne 0x55ed3a
mov ebx, edx
cmp esi, 0x1f
jbe 0x55ef07
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x690ea0]
xor eax, dword [edx*4 + 0x6912a0]
movzx edx, cl
xor eax, dword [edx*4 + 0x690aa0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6906a0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x690ea0]
xor eax, dword [edx*4 + 0x6912a0]
movzx edx, cl
xor eax, dword [edx*4 + 0x690aa0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6906a0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x690ea0]
xor eax, dword [edx*4 + 0x6912a0]
movzx edx, cl
xor eax, dword [edx*4 + 0x690aa0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6906a0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x690ea0]
xor eax, dword [edx*4 + 0x6912a0]
movzx edx, cl
xor eax, dword [edx*4 + 0x690aa0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6906a0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x690ea0]
xor eax, dword [edx*4 + 0x6912a0]
movzx edx, cl
xor eax, dword [edx*4 + 0x690aa0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6906a0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x690ea0]
xor eax, dword [edx*4 + 0x6912a0]
movzx edx, cl
xor eax, dword [edx*4 + 0x690aa0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6906a0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x690ea0]
xor eax, dword [edx*4 + 0x6912a0]
movzx edx, cl
xor eax, dword [edx*4 + 0x690aa0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6906a0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x690ea0]
xor eax, dword [edx*4 + 0x6912a0]
sub esi, 0x20
shr ecx, 0x10
movzx edx, cl
xor eax, dword [edx*4 + 0x690aa0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6906a0]
jmp 0x55ed56
cmp esi, 3
jbe 0x55ef45
xor ecx, dword [ebx]
sub esi, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x690ea0]
add ebx, 4
shr ecx, 0x10
xor eax, dword [edx*4 + 0x6912a0]
movzx edx, cl
xor eax, dword [edx*4 + 0x690aa0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6906a0]
jmp 0x55ef07
mov edx, ebx
test esi, esi
je 0x55ef60
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x6906a0]
dec esi
jmp 0x55ef49
mov eax, ecx
not eax
pop ebx
pop esi
pop ebp
ret
Function at 0x55fccb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x55fcea
mov ebx, dword [edi + 0x1c]
test ebx, ebx
je 0x55fcea
cmp dword [edi + 0x20], 0
je 0x55fcea
cmp dword [edi + 0x24], 0
jne 0x55fcf4
mov eax, 0xfffffffe
jmp 0x55fdf4
mov dword [edi + 0x2c], 2
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [ebx + 0x14], 0
test eax, eax
jns 0x55fd29
neg eax
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x18]
cmp edx, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
cmp edx, 2
mov dword [ebx + 4], eax
jne 0x55fd4c
push 0
push 0
push 0
call fcn.0055ed1a
jmp 0x55fd57
push 0
push 0
push 0
call fcn.00562530
add esp, 0xc
mov dword [edi + 0x30], eax
mov dword [ebx + 0x28], 0
push ebx
call fcn.005628ef
pop edi
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x44]
add eax, eax
cld
mov dword [ebx + 0x3c], eax
mov word [edi + ecx*2 - 2], 0
xor eax, eax
lea ecx, [ecx + ecx - 2]
rep stosb byte es:[edi], al
imul edx, dword [ebx + 0x84], 0xc
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
movzx eax, word [edx + 0x6926e2]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0
movzx eax, word [edx + 0x6926e0]
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x78], 2
movzx eax, word [edx + 0x6926e4]
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x60], 2
movzx eax, word [edx + 0x6926e6]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x48], 0
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret