joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61f540
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push ebx
push 0x64
push 4
mov dword [esi], 1
call fcn.0061de50
push esi
mov dword [esi + 4], eax
mov dword [esi + 0x5bc], ebx
call fcn.00617ef0
mov eax, dword [esp + 0x20]
lea edx, [esi + 0xc]
add esp, 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x61f573
mov eax, dword [esp + 0x14]
lea edx, [esi + 0x2c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x61f586
mov eax, dword [esp + 0x18]
lea edx, [esi + 0x4c]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x61f5a0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x480], eax
mov dword [esi + 0x484], ecx
mov ecx, 0x65517c
or eax, 0xffffffff
mov dword [esi + 0x488], ecx
mov dword [esi + 0x490], ebx
mov dword [esi + 0x4a0], eax
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x47c], eax
mov dword [esi + 0x478], ebx
mov dword [esi + 0x49c], ecx
mov dword [esi + 0x494], ebx
mov dword [esi + 0x4a8], edx
call sub.KERNEL32.dll_GetTickCount
push eax
call fcn.00624312
add esp, 4
pop esi
pop ebx
jmp fcn.0061d4d0

Function at 0x61fe00
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x210
mov eax, dword [0x684540]
push esi
mov esi, dword [esp + 0x218]
mov dword [esp + 0x210], eax
mov eax, dword [esi + 0x4a0]
push edi
push eax
mov dword [esp + 0x10], 0x10
call fcn.0061d5c0
add esp, 4
test eax, eax
je 0x61feeb
lea ebx, [ebx]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x4a0]
lea edx, [esp + 0x14]
push edx
push 0
push 0x1f3
lea eax, [esp + 0x30]
push eax
push ecx
call sub.WS2_32.dll_recvfrom
cmp eax, 0xffffffff
je 0x61fed4
mov edx, dword [esp + 0x12]
mov eax, dword [esp + 0x14]
push edx
push eax
push esi
call fcn.0061f280
add esp, 0xc
cmp eax, 0xffffffff
jne 0x61fed4
mov ecx, dword [esp + 0x12]
mov edx, dword [esp + 0x14]
push ecx
push edx
push esi
call fcn.00617e00
mov edi, eax
push edi
call fcn.00617ed0
add esp, 0x10
test eax, eax
jne 0x61ff30
push 0x11
push edi
call fcn.00617e70
mov ecx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], edi
call fcn.0061e2f0
mov edx, dword [esi + 0x484]
mov eax, dword [esp + 0x18]
push edx
push eax
push 0
push esi
call dword [esi + 0x480]
add esp, 0x20
mov ecx, dword [esi + 0x4a0]
push ecx
call fcn.0061d5c0
add esp, 4
test eax, eax
jne 0x61fe40
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [esi + 0x4a4]
cmp eax, 0x7d0
jbe 0x61ff19
mov edx, dword [esi + 0x4a0]
push edx
call sub.WSOCK32.dll_closesocket
mov dword [esi + 0x4a0], 0xffffffff
mov dword [esi], 1
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
call fcn.006293e9
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
pop edi
mov eax, 5
pop esi
call fcn.006293e9
add esp, 0x210
ret
Function at 0x61ff50
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30c
mov eax, dword [0x684540]
mov dword [esp + 0x308], eax
mov eax, dword [esp + 0x314]
test eax, eax
jne 0x61ff78
mov dword [esp + 0x314], 0x65517c
push ebp
mov ebp, dword [esp + 0x31c]
test ebp, ebp
jne 0x61ff89
mov ebp, 0x65517c
mov eax, dword [esp + 0x318]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x61ff93
sub eax, edx
cmp eax, 0x100
ja 0x61ffb8
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x61ffa8
sub eax, edx
cmp eax, 0x100
jbe 0x61ffd1
mov eax, 6
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.006293e9
add esp, 0x30c
ret
push edi
mov edi, dword [esp + 0x318]
call fcn.0061ec60
test eax, eax
jne 0x620154
push ebx
push esi
mov esi, dword [esp + 0x32c]
push edi
mov dword [edi + 0x5b4], esi
call fcn.0061ede0
mov eax, dword [edi + 0x4a8]
mov dword [esp + 0x21], eax
lea ecx, [esp + 0x25]
add esp, 4
lea eax, [edi + 0xc]
lea ebx, [esp + 0x10]
lea edx, [esp + 0x14]
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 1
mov byte [esp + 0x1c], 3
mov dword [esp + 0x10], 9
mov dword [esp + 0x14], ecx
call fcn.0061eda0
lea eax, [edi + 0x2c]
call fcn.0061eda0
mov eax, dword [esp + 0x14]
lea edx, [edi + 0x6c]
mov ebx, dword [edx]
mov ecx, eax
mov dword [ecx], ebx
mov edx, dword [edx + 4]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x10]
add eax, 8
add edx, 8
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
lea ebx, [esp + 0x10]
mov eax, ebp
lea edx, [esp + 0x14]
call fcn.0061eda0
mov eax, dword [esp + 0x324]
call fcn.0061eda0
push esi
call sub.WSOCK32.dll_htonl
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [ecx], eax
mov al, byte [edi + 0x5b4]
add esi, 4
add ecx, 4
test al, 8
je 0x6200ad
mov eax, dword [edi + 0x494]
mov dword [ecx], eax
add esi, 4
add ecx, 4
mov al, byte [edi + 0x5b4]
test al, al
jns 0x6200c3
mov edx, dword [esp + 0x330]
mov dword [ecx], edx
add esi, 4
push esi
call sub.WSOCK32.dll_htons
mov ecx, dword [edi + 0x4a0]
xor ebx, ebx
push ebx
mov word [esp + 0x1c], ax
push esi
lea eax, [esp + 0x20]
push eax
push ecx
call sub.WSOCK32.dll_send
test eax, eax
jg 0x62010c
push edi
call fcn.0061f750
add esp, 4
pop esi
pop ebx
pop edi
mov eax, 3
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.006293e9
add esp, 0x30c
ret
cmp dword [edi + 0x74], ebx
mov dword [edi], 3
mov dword [edi + 0x5b8], ebx
jne 0x620150
push 0x1000
call fcn.006291e4
add esp, 4
cmp eax, ebx
mov dword [edi + 0x74], eax
jne 0x62014d
pop esi
pop ebx
pop edi
mov eax, 5
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.006293e9
add esp, 0x30c
ret
mov dword [edi + 0x78], ebx
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x310]
pop edi
pop ebp
call fcn.006293e9
add esp, 0x30c
ret
Function at 0x620170
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x684540]
push ebx
push esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
cmp dword [esi], 1
mov ebx, 2
mov dword [esp + 8], 1
mov byte [esp + 0xc], 0xfe
mov byte [esp + 0xd], 0xfd
mov byte [esp + 0xe], bl
mov byte [esp + 0xf], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
je 0x6201c4
push esi
call fcn.0061f750
add esp, 4
push 0x11
push ebx
push ebx
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x4a0], eax
je 0x6201f0
push 4
lea ecx, [esp + 0xc]
push ecx
push 0x20
push 0xffff
push eax
call sub.WS2_32.dll_setsockopt
test eax, eax
je 0x620204
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.006293e9
add esp, 0x20
ret
mov eax, dword [esp + 0x30]
mov word [esp + 0x14], bx
mov ebx, dword [esp + 0x34]
movzx edx, ax
movzx ecx, bx
sub ecx, edx
cmp ecx, 0x1f4
mov dword [esp + 0x18], 0xffffffff
jle 0x62022f
lea ebx, [eax + 0x1f4]
cmp ax, bx
push edi
mov edi, eax
ja 0x620283
push ebp
mov ebp, dword [esp + 0x40]
lea esp, [esp]
push edi
call sub.WSOCK32.dll_htons
cmp ebp, 1
push 0x10
lea edx, [esp + 0x20]
push edx
mov word [esp + 0x26], ax
push 0
jne 0x620269
mov ecx, dword [esi + 0x4a0]
push 8
lea eax, [esp + 0x24]
push eax
push ecx
jmp 0x620277
mov eax, dword [esi + 0x4a0]
push 0xa
push str.echo_test
push eax
call sub.WS2_32.dll_sendto
inc edi
cmp di, bx
jbe 0x620240
pop ebp
mov dword [esi], 0
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x28]
pop edi
mov dword [esi + 0x4a4], eax
pop esi
xor eax, eax
pop ebx
call fcn.006293e9
add esp, 0x20
ret
Function at 0x6204c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x78]
xor ebx, ebx
cmp eax, 3
push edi
jl 0x6203cd
mov eax, dword [esi + 0x74]
movzx eax, word [eax]
push eax
call sub.WSOCK32.dll_ntohs
cmp ax, 0x1000
ja 0x6203a9
movzx edi, ax
cmp dword [esi + 0x78], edi
jl 0x6203d3
mov eax, dword [esi + 0x74]
movsx ecx, byte [eax + 2]
dec ecx
cmp ecx, 3
ja case.default.0x6202f6
jmp dword [ecx*4 + 0x6203dc]
lea ecx, [edi - 3]
push ecx
add eax, 3
mov ecx, esi
call fcn.0061fc60
add esp, 4
mov ebx, eax
jmp case.default.0x6202f6
lea edx, [edi - 3]
push edx
add eax, 3
push eax
call fcn.0061fd30
add esp, 8
mov ebx, eax
jmp case.default.0x6202f6
push 0
push edi
push eax
mov eax, dword [esi + 0x4a0]
push eax
call sub.WSOCK32.dll_send
test eax, eax
jg case.default.0x6202f6
pop edi
pop esi
mov eax, 3
pop ebx
ret
lea ecx, [edi - 3]
cmp ecx, 6
jge 0x620352
mov ebx, 4
jmp case.default.0x6202f6
mov ecx, dword [eax + 3]
movzx eax, word [eax + 7]
push eax
push ecx
push esi
call fcn.0061f280
add esp, 0xc
cmp eax, 0xffffffff
je 0x620373
push eax
push esi
call fcn.0061f2f0
add esp, 8
xor ebx, ebx
mov eax, dword [esi + 0x78]
sub eax, edi
mov dword [esi + 0x78], eax
mov ecx, eax
je 0x620395
mov eax, dword [esi + 0x74]
test eax, eax
je 0x620395
push ecx
add edi, eax
push edi
push eax
call fcn.00623940
add esp, 0xc
test ebx, ebx
jne 0x6203ae
cmp dword [esi + 0x78], 3
jge 0x6202c3
pop edi
pop esi
mov eax, ebx
pop ebx
ret
mov ebx, 4
mov edx, dword [esi + 0x484]
mov eax, dword [0x6a2728]
push edx
push eax
push 4
push esi
call dword [esi + 0x480]
push esi
call fcn.0061f750
add esp, 0x14
pop edi
pop esi
mov eax, ebx
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
push esi
mov esi, eax
mov eax, dword [esi + 0x4a0]
push eax
call fcn.0061d5c0
add esp, 4
test eax, eax
jne 0x620408
pop esi
ret
mov edx, dword [esi + 0x74]
mov eax, dword [esi + 0x4a0]
push edi
mov edi, dword [esi + 0x78]
push 0
mov ecx, 0x1000
sub ecx, edi
push ecx
add edx, edi
push edx
push eax
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x62048c
test eax, eax
je 0x62048c
mov edx, dword [esi + 0x78]
mov ecx, dword [esi]
add edx, eax
cmp ecx, 2
mov dword [esi + 0x78], edx
mov eax, edx
je 0x62044c
mov ecx, dword [esi + 0x5b8]
test ecx, ecx
jle 0x620464
mov ecx, dword [esi + 0x74]
sub eax, edi
push eax
add ecx, edi
push ecx
lea edx, [esi + 0x4ac]
push edx
call fcn.00623360
add esp, 0xc
cmp dword [esi], 3
jne 0x620472
call fcn.0061f8f0
test eax, eax
jne 0x6204b1
cmp dword [esi], 2
jne 0x620487
mov eax, dword [esi + 0x78]
test eax, eax
jle 0x620487
pop edi
mov eax, esi
pop esi
jmp 0x6202b0
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x484]
mov ecx, dword [0x6a2728]
push eax
push ecx
push 4
push esi
call dword [esi + 0x480]
push esi
call fcn.0061f750
add esp, 0x14
mov eax, 3
pop edi
pop esi
ret
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0061f390
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x6204ea
cmp eax, 1
jle 0x6204e6
cmp eax, 3
jg 0x6204e6
mov eax, esi
pop esi
jmp 0x6203f0
xor eax, eax
pop esi
ret
push esi
call fcn.0061fe00
add esp, 4
pop esi
ret
Function at 0x620500
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, eax
mov ebp, 1
xor ebx, ebx
lea ecx, [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x4a0]
push ebx
push eax
push ecx
push edx
dec ebp
call sub.WSOCK32.dll_send
cmp eax, ebx
jg 0x6205c6
cmp ebp, ebx
jl 0x6205bc
mov eax, dword [esi + 0x74]
cmp eax, ebx
je 0x620548
push eax
call fcn.00628e27
add esp, 4
mov eax, dword [esi + 0x4a0]
or edi, 0xffffffff
cmp eax, edi
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
je 0x620561
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 0x4a0], edi
mov dword [esi], 1
call fcn.0061f6b0
mov dword [esi + 0x47c], edi
call fcn.0061f620
push ebx
push 2
push ebx
push ebx
push esi
call fcn.0061ff50
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x620510
mov eax, dword [esi + 0x484]
mov ecx, dword [0x6a2728]
push eax
push ecx
push 4
push esi
call dword [esi + 0x480]
push esi
call fcn.0061f750
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x620660
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x684540]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp dword [esi], 1
jne 0x6206a1
push 0
push 2
push 0
push 0
push esi
call fcn.0061ff50
mov eax, dword [esi]
add esp, 0x14
cmp eax, 1
jne 0x6206a1
mov eax, 3
pop esi
mov ecx, dword [esp + 0x10]
call fcn.006293e9
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x30]
lea eax, [edi + 9]
push eax
call sub.WSOCK32.dll_htons
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov word [esp + 8], ax
lea eax, [esp + 8]
push 9
push eax
mov eax, esi
mov byte [esp + 0x12], 2
mov dword [esp + 0x13], ecx
mov word [esp + 0x17], dx
call fcn.00620500
add esp, 8
test eax, eax
jne 0x620700
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x4a0]
push eax
push edi
push ecx
push edx
call sub.WSOCK32.dll_send
xor ecx, ecx
test eax, eax
setge cl
dec ecx
and ecx, 3
mov eax, ecx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
call fcn.006293e9
add esp, 0x14
ret

Function at 0x621160
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push 0
push esi
call fcn.00620ff0
call fcn.0061d4d0
push esi
call fcn.00621080
add esp, 0x10
test eax, eax
jne 0x621194
mov dword [esi + 0xc0], 1
mov dword [esi + 0x34], 3
pop esi
ret
push edi
mov edi, dword [0x723108]
test edi, edi
jne 0x6211a2
mov edi, dword [esi + 0x18]
push edi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
jne 0x6211d8
push edi
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x6211ce
pop edi
mov dword [esi + 0xc0], 1
mov dword [esi + 0x34], 4
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esi + 0x1c], edx
push 0
push 0
push esi
mov dword [esi + 0x10], 1
call fcn.00620ff0
add esp, 0xc
pop edi
pop esi
ret
Function at 0x6211f0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x684540]
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x44], 0xffffffff
push edi
mov edi, 1
jne 0x6212ec
push 6
push edi
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x44], eax
je 0x621232
push 0
push eax
call fcn.0061d560
add esp, 8
test eax, eax
jne 0x621244
mov dword [esi + 0xc0], edi
mov dword [esi + 0x34], 5
jmp 0x62134c
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x621260
mov eax, dword [0x683dd4]
mov ecx, dword [esi + 0x44]
push eax
push ecx
call fcn.0061d590
add esp, 8
mov eax, dword [0x723108]
xor edx, edx
test eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov word [esp + 0xc], 2
je 0x62128d
xor eax, eax
mov ax, word [0x723104]
push eax
jmp 0x621294
xor ecx, ecx
mov cx, word [esi + 0x20]
push ecx
call sub.WSOCK32.dll_htons
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x1c]
mov word [esp + 0xe], ax
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], edx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x6212ec
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x6212ec
cmp eax, 0x2734
je 0x6212ec
mov dword [esi + 0xc0], edi
pop edi
mov dword [esi + 0x34], 6
mov dword [esi + 0x48], eax
pop esi
mov ecx, dword [esp + 0x14]
call fcn.006293e9
add esp, 0x18
ret
mov ecx, dword [esi + 0x44]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push ecx
call fcn.00621fc0
add esp, 0x10
test eax, eax
je 0x62133b
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x62133b
mov eax, dword [esp + 8]
test eax, eax
je 0x621354
push 0
push 0
push esi
mov dword [esi + 0x10], 2
call fcn.00620ff0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x14]
call fcn.006293e9
add esp, 0x18
ret
test eax, eax
mov dword [esi + 0xc0], edi
mov dword [esi + 0x34], 6
jne 0x621354
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0x48], eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
call fcn.006293e9
add esp, 0x18
ret
Function at 0x621fc0
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x314
push ebx
push ebp
xor edx, edx
push esi
cmp eax, edx
mov eax, dword [esp + 0x324]
push edi
mov ecx, 1
je 0x621fee
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x18]
jmp 0x621ff0
xor edi, edi
cmp dword [esp + 0x330], edx
je 0x622010
mov dword [esp + 0x120], eax
mov dword [esp + 0x11c], ecx
lea ebx, [esp + 0x11c]
jmp 0x622012
xor ebx, ebx
cmp dword [esp + 0x334], edx
je 0x622032
mov dword [esp + 0x224], eax
mov dword [esp + 0x220], ecx
lea ebp, [esp + 0x220]
jmp 0x622034
xor ebp, ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
push edi
push 0x40
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
call sub.WSOCK32.dll_select
mov esi, eax
cmp esi, 0xffffffff
jne 0x62205f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x314
ret
mov eax, dword [esp + 0x32c]
test eax, eax
je 0x62209c
test esi, esi
jle 0x62208f
mov ecx, dword [esp + 0x328]
push edi
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x62208f
mov edx, dword [esp + 0x32c]
mov dword [edx], 1
jmp 0x62209c
mov eax, dword [esp + 0x32c]
mov dword [eax], 0
mov edi, dword [esp + 0x330]
test edi, edi
je 0x6220cb
test esi, esi
jle 0x6220c5
mov ecx, dword [esp + 0x328]
push ebx
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x6220c5
mov dword [edi], 1
jmp 0x6220cb
mov dword [edi], 0
mov edi, dword [esp + 0x334]
test edi, edi
je 0x622108
test esi, esi
jle 0x622102
mov edx, dword [esp + 0x328]
push ebp
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x622102
mov dword [edi], 1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x314
ret
mov dword [edi], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x314
ret

Function at 0x622120
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xf8]
push edi
mov edi, dword [ebx]
dec edi
test eax, eax
je 0x62215e
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 0xfc]
add ecx, dword [0x683dd8]
cmp eax, ecx
jb 0x6221ab
mov dword [esi + 0xfc], eax
mov eax, dword [0x683dd4]
cmp edi, eax
jl 0x62215e
mov edi, eax
mov edx, dword [esi + 0x44]
push 0
push edi
mov edi, dword [esp + 0x1c]
push edi
push edx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x6221b4
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x6221ab
cmp eax, 0x2734
je 0x6221ab
mov ecx, 1
pop edi
mov dword [esi + 0x48], eax
mov dword [esi + 0xc0], ecx
mov dword [esi + 0x34], 5
mov dword [esi + 0xf4], ecx
pop esi
mov eax, 3
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret
test eax, eax
jne 0x6221cb
pop edi
mov dword [esi + 0xf4], 1
pop esi
mov eax, 2
pop ebx
ret
mov byte [eax + edi], 0
pop edi
mov dword [ebx], eax
pop esi
xor eax, eax
pop ebx
ret
Function at 0x6221e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi + 0x44]
push 0
push eax
push ecx
push edx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x622228
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x62220f
xor eax, eax
pop esi
ret
mov dword [esi + 0x48], eax
mov dword [esi + 0xc0], 1
mov dword [esi + 0x34], 5
or eax, 0xffffffff
pop esi
ret
cmp dword [esi + 0x10], 3
jne 0x622234
add dword [esi + 0x10c], eax
pop esi
ret

Function at 0x624486
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x6244a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00626477
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x6244c9
test byte [esp + 8], 2
je 0x6244c9
call fcn.00626465
mov dword [eax], 0xd
call fcn.0062646e
mov dword [eax], 5
jmp 0x6244a2
xor eax, eax
ret

Function at 0x626171
Capabilities:
Terminate process

Disassembly:
push 8
push 0x64ed80
call fcn.0062a510
push 8
call fcn.0062a4df
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x6a3228], esi
jne 0x6261a5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x6a3224], esi
mov al, byte [ebp + 0x10]
mov byte [0x6a3220], al
cmp dword [ebp + 0xc], edi
jne 0x6261ef
cmp dword [0x723954], edi
je 0x6261df
mov eax, dword [0x723950]
sub eax, 4
mov dword [0x723950], eax
cmp eax, dword [0x723954]
jb 0x6261df
mov eax, dword [eax]
cmp eax, edi
je 0x6261c0
call eax
jmp 0x6261c0
push 0x676040
mov eax, 0x676034
call fcn.006260ef
pop ecx
push 0x67604c
mov eax, 0x676044
call fcn.006260ef
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x626220
cmp dword [ebp + 0x10], edi
jne 0x62622e
mov dword [0x6a3228], esi
push dword [ebp + 8]
call fcn.006260ad
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x62622d
push 8
call fcn.0062a42a
pop ecx
ret
call fcn.0062a54b
ret

Function at 0x626c08
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x626c24
call fcn.00626465
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x626c96
push esi
push 0x8c
push 1
call fcn.0062ac70
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x626c7c
push esi
call fcn.0062adec
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x626b76
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x626c74
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x626c93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00628e27
test ebx, ebx
pop ecx
je 0x626c8e
push ebx
call fcn.00626477
pop ecx
or eax, 0xffffffff
jmp 0x626c95
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x628154
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x64f048
call fcn.0062a510
mov edi, 0x94
mov eax, edi
call fcn.00628480
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x6a31e8], ecx
mov eax, dword [esi + 4]
mov dword [0x6a31f4], eax
mov edx, dword [esi + 8]
mov dword [0x6a31f8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x6a31ec], esi
cmp ecx, 2
je 0x6281b4
or esi, 0x8000
mov dword [0x6a31ec], esi
shl eax, 8
add eax, edx
mov dword [0x6a31f0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x6281ef
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6281ef
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x628207
cmp eax, 0x20b
je 0x6281f4
mov dword [ebp - 0x1c], esi
jmp 0x62821b
cmp dword [ecx + 0x84], 0xe
jbe 0x6281ef
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x628215
cmp dword [ecx + 0x74], 0xe
jbe 0x6281ef
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00632226
pop ecx
test eax, eax
jne 0x62822f
push 0x1c
call fcn.00628130
pop ecx
call fcn.0062afe6
test eax, eax
jne 0x628240
push 0x10
call fcn.00628130
pop ecx
call fcn.0062f143
mov dword [ebp - 4], esi
call fcn.0062aa72
test eax, eax
jge 0x628259
push 0x1b
call fcn.0062810b
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x723948], eax
call fcn.006320ea
mov dword [0x6a3334], eax
call fcn.00632048
test eax, eax
jge 0x62827f
push 8
call fcn.0062810b
pop ecx
call fcn.00631e15
test eax, eax
jge 0x628290
push 9
call fcn.0062810b
pop ecx
push 1
call fcn.00626107
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x6282a6
push eax
call fcn.0062810b
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00631db8
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x6282c7
movzx eax, word [ebp - 0x40]
jmp 0x6282ca
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.005414e0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x6282e8
push edi
call fcn.00626234
call fcn.00626256
jmp 0x62831a
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0062a54b
ret