joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4de880
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x4de92b
mov eax, dword [ebx]
xor edx, edx
mov byte [eax + 0x16], 0
mov eax, dword [ebx]
mov byte [eax + 0x17], 0
mov eax, dword [ebx]
mov byte [eax + 0x18], 0
mov eax, dword [ebx]
mov byte [eax + 0x19], 0
xor eax, eax
mov ebp, dword [ebx + 4]
mov esi, dword [ebx]
test ebp, ebp
jle 0x4de8e1
mov edx, esi
add ebp, esi
xor eax, eax
nop
lea esi, [esi]
xor ecx, ecx
mov edi, eax
shr eax, 0x18
mov cl, byte [edx]
xor ecx, eax
inc edx
shl edi, 8
mov eax, dword [ecx*4 + 0x70e000]
xor eax, edi
cmp edx, ebp
jne 0x4de8c0
mov edx, eax
shr edx, 0x18
mov ebp, dword [ebx + 0xc]
test ebp, ebp
jle 0x4de911
mov edx, dword [ebx + 8]
add ebp, edx
lea esi, [esi]
xor ecx, ecx
mov edi, eax
shr eax, 0x18
mov cl, byte [edx]
xor ecx, eax
inc edx
shl edi, 8
mov eax, dword [ecx*4 + 0x70e000]
xor eax, edi
cmp edx, ebp
jne 0x4de8f0
mov edx, eax
shr edx, 0x18
mov byte [esi + 0x16], al
mov ecx, eax
shr ecx, 8
mov esi, dword [ebx]
shr eax, 0x10
mov byte [esi + 0x17], cl
mov ecx, dword [ebx]
mov byte [ecx + 0x18], al
mov eax, dword [ebx]
mov byte [eax + 0x19], dl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x508c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x48]
mov ecx, esi
shr ecx, 5
lea edx, [ecx + 1]
cmp esi, edx
jb 0x508e35
mov ebp, dword [esp + 0x44]
mov eax, dword [esp + 0x44]
xor ebp, 0xffffffff
add eax, esi
add ebp, edx
mov ebx, esi
sub ebp, ecx
nop
mov edi, ebx
mov ecx, ebx
shr edi, 2
shl ecx, 5
add ecx, edi
mov dword [esp + 0x18], ecx
mov cl, byte [eax - 1]
and ecx, 0xff
sub eax, edx
mov edi, ecx
mov ecx, dword [esp + 0x18]
add ecx, edi
xor ebx, ecx
lea ecx, [ebp + eax]
cmp edx, ecx
jbe 0x508cc0
mov edx, dword [esp + 0x40]
mov edx, dword [edx + 0x10]
mov dword [esp + 0x1c], edx
mov ecx, dword [edx + 8]
mov edx, dword [edx]
mov eax, ecx
dec eax
and eax, ebx
mov ebp, dword [edx + eax*4]
test ebp, ebp
je 0x508d64
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x44]
jmp 0x508d1a
mov ebp, dword [ebp]
test ebp, ebp
je 0x508d60
cmp dword [ebp + 0xc], esi
jne 0x508d13
lea eax, [ebp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x508d13
mov edx, dword [esp + 0x1c]
mov cl, byte [ebp + 5]
mov bl, cl
mov edi, ebp
mov al, byte [edx + 0x14]
and ebx, 3
xor eax, 3
test bl, al
je 0x508d54
xor ecx, 3
mov byte [ebp + 5], cl
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x18]
lea eax, [esi + 1]
cmp eax, 0xffffffed
ja 0x508e24
mov edx, dword [esp + 0x40]
lea eax, [esi + 0x11]
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00509400
mov ecx, dword [esp + 0x40]
mov edi, eax
mov edx, dword [esp + 0x44]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], esi
mov eax, dword [ecx + 0x10]
mov al, byte [eax + 0x14]
mov byte [edi + 4], 4
and eax, 3
mov byte [edi + 6], 0
mov byte [edi + 5], al
lea eax, [edi + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x40]
mov byte [edi + esi + 0x10], 0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + 8]
dec ecx
and ecx, ebx
mov ebx, dword [eax]
shl ecx, 2
mov ebx, dword [ebx + ecx]
mov dword [edi], ebx
mov ebx, dword [eax]
mov dword [ebx + ecx], edi
mov ecx, dword [eax + 4]
inc ecx
mov dword [eax + 4], ecx
mov eax, dword [eax + 8]
cmp ecx, eax
jbe 0x508d54
cmp eax, 0x3ffffffe
jg 0x508d54
add eax, eax
mov edx, dword [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00508b80
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x40]
mov dword [esp], ecx
call fcn.005093e0
jmp 0x508d70
mov ebx, esi
jmp 0x508ced
Function at 0x50fef0
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x10
cmp dword [eax + 0x14], 0xcc
je 0x50fe1d
mov eax, dword [eax + 0x1dc]
mov dword [esp], ebx
call dword [eax]
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x14], 0xcc
mov eax, dword [ebx + 0x1dc]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x50fed0
mov eax, dword [ebx + 0x8c]
lea esi, [ebx + 0x8c]
jmp 0x50fe7b
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
mov dword [esp], ebx
call dword [edx]
mov edi, dword [ebx + 0x8c]
mov eax, dword [ebx + 0x1e0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [eax + 4]
mov eax, dword [ebx + 0x8c]
cmp eax, edi
je 0x50fe90
mov ecx, dword [ebx + 0x74]
cmp ecx, eax
jbe 0x50fea0
mov edx, dword [ebx + 8]
test edx, edx
jne 0x50fe40
mov edi, eax
jmp 0x50fe51
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov eax, dword [ebx + 0x1dc]
mov dword [esp], ebx
call dword [eax + 4]
mov eax, dword [ebx + 0x1dc]
mov dword [esp], ebx
call dword [eax]
mov edx, dword [ebx + 0x1dc]
mov edx, dword [edx + 8]
xor eax, eax
mov dword [ebx + 0x8c], 0
test edx, edx
jne 0x50fe7b
cmp dword [ebx + 0x44], 1
sbb eax, eax
add eax, 0xce
mov dword [ebx + 0x14], eax
mov eax, 1
jmp 0x50fe92
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
je 0x50ff30
cmp eax, 0xcb
je 0x50ff4a
cmp eax, 0xcc
je 0x50ff23
mov edx, dword [ebx]
mov dword [edx + 0x18], eax
mov dword [edx + 0x14], 0x14
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax]
add esp, 0x18
mov eax, ebx
pop ebx
jmp 0x50fdf0
mov dword [esp], ebx
call fcn.00515780
mov eax, dword [ebx + 0x40]
test eax, eax
jne 0x50ffd0
mov dword [ebx + 0x14], 0xcb
mov eax, dword [ebx + 0x1ec]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x50ffb0
mov edx, dword [ebx + 8]
lea esi, [esi]
test edx, edx
je 0x50ff69
mov dword [esp], ebx
call dword [edx]
mov eax, dword [ebx + 0x1ec]
mov dword [esp], ebx
call dword [eax]
test eax, eax
je 0x50ffc7
cmp eax, 2
je 0x50ffb0
mov edx, dword [ebx + 8]
test edx, edx
je 0x50ff69
and eax, 0xfffffffd
dec eax
jne 0x50ff60
mov eax, dword [edx + 4]
mov ecx, dword [edx + 8]
inc eax
mov dword [edx + 4], eax
cmp eax, ecx
jl 0x50ff60
mov eax, dword [ebx + 0x178]
add ecx, eax
test edx, edx
mov dword [edx + 8], ecx
jne 0x50ff64
jmp 0x50ff69
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
add esp, 0x18
mov eax, ebx
pop ebx
jmp 0x50fdf0
xor eax, eax
add esp, 0x18
pop ebx
ret
mov dword [ebx + 0x14], 0xcf
mov eax, 1
jmp 0x50ffc9
Function at 0x512740
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x24
mov esi, dword [esp + 0x30]
mov dword [esi + 4], 0
mov dword [esp], esi
call fcn.00516640
mov dword [esp + 4], 0x54
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call fcn.005165d0
mov ebx, eax
test eax, eax
je 0x512870
mov eax, dword [esp + 0x1c]
mov dword [ebx], fcn.005118f0
mov dword [ebx + 4], fcn.00511ed0
mov dword [ebx + 8], fcn.00512080
mov dword [ebx + 0xc], fcn.00511fa0
mov dword [ebx + 0x10], 0x511b00
mov dword [ebx + 0x14], 0x511a80
mov dword [ebx + 0x18], 0x512160
mov dword [ebx + 0x1c], 0x512390
mov dword [ebx + 0x20], 0x511d20
mov dword [ebx + 0x24], fcn.00511b80
mov dword [ebx + 0x28], 0x511cc0
mov dword [ebx + 0x30], 0x3b9aca00
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
mov dword [esi + 4], ebx
mov dword [esp], str.JPEGMEM
call sub.msvcrt.dll_getenv
test eax, eax
je 0x51285b
lea edx, [esp + 0x1b]
mov dword [esp + 4], str._ld_c
mov dword [esp + 0xc], edx
lea edx, [esp + 0x1c]
mov dword [esp + 8], edx
mov dword [esp], eax
mov byte [esp + 0x1b], 0x78
call sub.msvcrt.dll_sscanf
test eax, eax
jle 0x51285b
mov al, byte [esp + 0x1b]
and eax, 0xffffffdf
cmp al, 0x4d
mov eax, dword [esp + 0x1c]
je 0x512861
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [ebx + 0x2c], eax
add esp, 0x24
pop ebx
pop esi
ret
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
jmp 0x51284c
mov dword [esp], esi
call fcn.00516650
mov eax, dword [esi]
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0x36
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax]
jmp 0x512776
Function at 0x516750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ecx, dword [eax + 0x204]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
cmp dword [eax + 0x58], 1
je 0x5168f1
mov ebx, dword [esp + 0x28]
mov eax, 0x100
mov dword [esp + 0x34], 0
mov dword [ebx + 0x1c], 0
mov ecx, dword [esp + 0x2c]
mov ebx, ecx
mov edx, dword [ecx + 4]
mov ecx, dword [ecx + 0x78]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [edx + 8]
mov ecx, dword [esp + 0x28]
mov esi, eax
mov dword [esp + 0x30], 0
mov dword [ecx + 0x18], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 0x78]
test eax, eax
jle 0x5168e9
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x34]
mov ebx, dword [eax + ecx*4 + 0x20]
mov eax, dword [esp + 0x38]
mov edx, eax
sar edx, 0x1f
idiv ebx
mov ecx, eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
shl eax, 2
test ebp, ebp
je 0x51680b
mov edi, dword [esi + eax]
mov edx, dword [esp + 0x28]
add edi, 0xff
mov dword [esi + eax], edi
mov esi, dword [edx + 0x18]
mov esi, dword [esi + eax]
lea eax, [ebx - 1]
mov dword [esp + 0x24], eax
add eax, eax
mov dword [esp + 0x3c], eax
lea eax, [ebx + 0xfe]
mov edx, eax
mov dword [esp + 0x1c], esi
sar edx, 0x1f
mov byte [esp + 0x23], cl
idiv dword [esp + 0x3c]
xor edi, edi
xor ebp, ebp
mov edx, eax
mov esi, dword [esp + 0x3c]
lea esi, [esi]
cmp edx, edi
jge 0x516878
lea ebx, [ebp + 1]
mov eax, ebx
shl eax, 9
lea edx, [ebx + ebx]
sub eax, edx
mov edx, dword [esp + 0x24]
lea ecx, [edx + eax + 0xff]
jmp 0x516861
inc ebx
mov edx, ecx
mov eax, ecx
sar edx, 0x1f
add ecx, 0x1fe
idiv esi
mov ebp, ebx
cmp eax, edi
jl 0x516860
mov edx, eax
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mul byte [esp + 0x23]
mov byte [ecx + edi], al
inc edi
cmp edi, 0x100
jne 0x516840
mov edx, dword [esp + 0x34]
test edx, edx
je 0x5168c7
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
sub ecx, 0x100
dec eax
add edx, 0x100
mov ebx, dword [esp + 0x1c]
mov esi, ecx
mov cl, byte [ebx]
mov byte [eax], cl
dec eax
mov cl, byte [ebx + 0xff]
mov byte [edx], cl
inc edx
cmp eax, esi
jne 0x5168b5
mov eax, dword [esp + 0x30]
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
cmp dword [eax + 0x78], ecx
jle 0x5168e9
mov ebx, dword [esp + 0x28]
mov esi, dword [ebx + 0x18]
jmp 0x5167cc
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ecx + 0x1c], 1
mov eax, 0x2fe
mov dword [esp + 0x34], 0x1fe
jmp 0x516787
Function at 0x518ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov eax, dword [esi + 4]
mov dword [esp + 8], 0x2c
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [eax]
cmp dword [esi + 0x78], 3
mov dword [esi + 0x204], eax
mov edi, eax
mov dword [eax], 0x5176a0
mov dword [eax + 0xc], 0x517680
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
je 0x518b2a
mov eax, dword [esi]
mov dword [eax + 0x14], 0x2f
mov dword [esp], esi
call dword [eax]
mov eax, dword [esi + 4]
mov dword [esp + 8], 0x80
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [eax]
xor ebx, ebx
mov dword [edi + 0x18], eax
jmp 0x518b53
mov eax, dword [edi + 0x18]
lea ebp, [eax + ebx]
mov eax, dword [esi + 4]
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 1
mov dword [esp], esi
add ebx, 4
call dword [eax + 4]
cmp ebx, 0x80
mov dword [ebp], eax
jne 0x518b50
mov edx, dword [esi + 0x6c]
mov dword [edi + 0x1c], 1
test edx, edx
je 0x518be8
mov ebx, dword [esi + 0x60]
cmp ebx, 7
jle 0x518c2d
cmp ebx, 0x100
jle 0x518bb6
mov eax, dword [esi]
mov dword [eax + 0x18], 0x100
mov dword [eax + 0x14], 0x39
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax]
mov eax, dword [esi + 4]
mov dword [esp + 0xc], 3
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [eax + 8]
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x58]
test eax, eax
jne 0x518bf6
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x58]
mov dword [edi + 0x10], 0
test eax, eax
je 0x518be0
mov eax, dword [esi + 0x70]
mov edx, dword [esi + 4]
mov dword [esi + 0x58], 2
mov dword [esp], esi
lea eax, [eax + eax*2]
mov dword [esp + 4], 1
lea eax, [eax + eax + 0xc]
mov dword [esp + 8], eax
call dword [edx + 4]
mov dword [edi + 0x20], eax
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.005175d0
mov eax, dword [esi]
mov dword [eax + 0x18], 8
mov dword [eax + 0x14], 0x38
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax]
jmp 0x518bb6
Function at 0x52a050
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call sub.ws2_32.dll_WSAStartup
test eax, eax
push edx
push edx
jne 0x52a0a0
mov eax, dword [esp + 0x10]
cmp al, 1
jne 0x52a090
mov edx, eax
xor eax, eax
shr dx, 8
dec dl
jne 0x52a090
add esp, 0x1ac
ret
call sub.ws2_32.dll_WSACleanup
or eax, 0xffffffff
add esp, 0x1ac
ret
or eax, 0xffffffff
jmp 0x52a084

Function at 0x52a1a0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x44
mov esi, dword [esp + 0x54]
cmp dword [esp + 0x50], 2
je 0x52a291
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.ws2_32.dll_socket
sub esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x40000
je 0x52a312
nop
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov word [esp + 0x30], 2
test esi, esi
je 0x52a237
mov eax, dword [esi + 4]
and eax, 0xffff
mov dword [esp], eax
call sub.ws2_32.dll_htons
push edx
mov word [esp + 0x32], ax
mov eax, dword [esi]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.ws2_32.dll_bind
sub esp, 0xc
inc eax
je 0x52a27d
test esi, esi
jne 0x52a261
add esp, 0x44
mov eax, ebx
pop ebx
pop esi
ret
cmp dword [esp + 0x50], 1
jne 0x52a259
mov dword [esp + 4], 0x7fffffff
mov dword [esp], ebx
call sub.ws2_32.dll_listen
inc eax
push esi
push esi
jne 0x52a259
mov dword [esp], ebx
or ebx, 0xffffffff
call sub.ws2_32.dll_closesocket
push eax
mov eax, ebx
add esp, 0x44
pop ebx
pop esi
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 2
call sub.ws2_32.dll_socket
sub esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x40000
je 0x52a312
lea eax, [esp + 0x28]
mov dword [esp + 4], 0x8004667e
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.ws2_32.dll_ioctlsocket
sub esp, 0xc
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1002
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
call sub.ws2_32.dll_setsockopt
sub esp, 0x14
jmp 0x52a1f0
or ebx, 0xffffffff
jmp 0x52a259
Function at 0x52a460
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x58
mov ebx, dword [esp + 0x64]
test ebx, ebx
je 0x52a4f0
mov eax, dword [ebx + 4]
mov word [esp + 0x40], 2
and eax, 0xffff
mov dword [esp], eax
call sub.ws2_32.dll_htons
push edx
mov edx, 0x10
mov word [esp + 0x42], ax
mov eax, dword [ebx]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call sub.ws2_32.dll_WSASendTo
sub esp, 0x24
inc eax
je 0x52a4f6
mov eax, dword [esp + 0x3c]
add esp, 0x58
pop ebx
ret
xor edx, edx
xor eax, eax
jmp 0x52a49c
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
sete al
add esp, 0x58
and eax, 0xff
dec eax
pop ebx
ret

Function at 0x52a510
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
sub esp, 0x58
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x34], 0x10
mov dword [esp + 0x38], 0
test ebx, ebx
je 0x52a5b3
lea edx, [esp + 0x34]
lea eax, [esp + 0x40]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edx
mov dword [esp], eax
call sub.ws2_32.dll_WSARecvFrom
sub esp, 0x24
inc eax
je 0x52a5c0
test byte [esp + 0x39], 0x80
jne 0x52a5d3
test ebx, ebx
je 0x52a5aa
mov eax, dword [esp + 0x44]
mov dword [ebx], eax
mov ax, word [esp + 0x42]
and eax, 0xffff
mov dword [esp], eax
call sub.ws2_32.dll_htons_1
push ecx
mov word [ebx + 4], ax
mov eax, dword [esp + 0x3c]
add esp, 0x58
pop ebx
ret
xor edx, edx
xor eax, eax
jmp 0x52a538
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x52a5d8
cmp eax, 0x2746
je 0x52a5d8
or eax, 0xffffffff
jmp 0x52a5ae
add esp, 0x58
xor eax, eax
pop ebx
ret
Function at 0x52a5e0
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x23c
mov edx, 0x10624dd3
mov ecx, dword [esp + 0x258]
mov ebx, dword [esp + 0x254]
mov eax, ecx
mov esi, dword [esp + 0x250]
mul edx
shr edx, 6
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], edx
mov dword [esp + 0x12c], 0
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
sub ecx, eax
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esp + 0x24], eax
mov eax, dword [ebx]
test al, 1
je 0x52a658
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], 1
test al, 2
je 0x52a668
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
lea eax, [esp + 0x20]
lea ebp, [esp + 0x12c]
mov dword [esp + 0x10], eax
lea edi, [esp + 0x28]
lea eax, [esi + 1]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.ws2_32.dll_select
sub esp, 0x14
cmp eax, 0
jl 0x52a6e5
mov dword [ebx], 0
jne 0x52a6b3
xor eax, eax
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], esi
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
push ebp
push ebp
jne 0x52a6e0
mov dword [esp], esi
mov dword [esp + 4], edi
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
push esi
push esi
je 0x52a6a6
or dword [ebx], 2
jmp 0x52a6a6
or dword [ebx], 1
jmp 0x52a6c5
or eax, 0xffffffff
jmp 0x52a6a8
Function at 0x571580
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, eax
test eax, eax
je 0x571674
cmp byte [eax + 0x5c], 0x77
jne 0x571674
mov ebp, edx
mov dword [eax + 4], 0
mov edx, dword [eax + 0x10]
xor ecx, ecx
mov edi, 0x4000
nop
mov esi, edi
sub esi, edx
jne 0x571630
test ecx, ecx
jne 0x57166f
mov edx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x10]
add edx, eax
mov dword [esp + 4], ebp
mov dword [ebx + 0x68], edx
mov dword [esp], ebx
call fcn.00573e00
mov ecx, dword [ebx + 0x68]
mov edx, dword [ebx + 0x10]
mov dword [ebx + 0x38], eax
sub ecx, edx
test esi, esi
mov dword [ebx + 0x68], ecx
jne 0x5715ec
cmp eax, 0xfffffffb
je 0x571620
mov esi, eax
mov ecx, 1
test edx, edx
jne 0x571603
cmp eax, 1
sete cl
and ecx, 0xff
cmp esi, 1
jbe 0x5715b0
cmp eax, 1
setne dl
and edx, 0xff
neg edx
and eax, edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx + 0x38], 0
xor esi, esi
xor eax, eax
jmp 0x5715ee
mov eax, dword [ebx + 0x40]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x48]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call sub.msvcrt.dll_fwrite
mov ecx, dword [esp + 0x1c]
cmp eax, esi
jne 0x571681
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x10], 0x4000
mov dword [ebx + 0xc], eax
test ecx, ecx
je 0x5715be
mov eax, dword [ebx + 0x38]
jmp 0x571608
add esp, 0x2c
mov eax, 0xfffffffe
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx + 0x38], 0xffffffff
or eax, 0xffffffff
jmp 0x571618

Function at 0x571770
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
mov eax, dword [eax + 0x3c]
test eax, eax
jne 0x5717e1
mov eax, dword [ebx + 4]
test eax, eax
je 0x571796
mov edx, dword [ebx]
dec eax
mov dword [ebx + 4], eax
xor eax, eax
mov al, byte [edx]
inc edx
mov dword [ebx], edx
add esp, 0x18
pop ebx
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0
mov eax, dword [ebx + 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x44]
mov dword [esp + 8], 0x4000
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebx + 4], eax
test eax, eax
jne 0x5717f0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x3c], 1
test byte [eax + 0xc], 0x20
je 0x5717e1
mov dword [ebx + 0x38], 0xffffffff
add esp, 0x18
or eax, 0xffffffff
pop ebx
ret
mov edx, dword [ebx + 0x44]
mov dword [ebx], edx
jmp 0x571786
Function at 0x571850
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov esi, dword [eax + 4]
cmp esi, 1
jbe 0x5718b0
mov edx, dword [eax]
cmp byte [edx], 0x1f
je 0x571875
mov dword [ebx + 0x58], 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret
cmp byte [edx + 1], 0x8b
jne 0x571867
mov eax, dword [ebx + 4]
add edx, 2
sub eax, 2
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov eax, ebx
call fcn.00571770
mov esi, eax
mov eax, ebx
call fcn.00571770
cmp esi, 8
mov edi, eax
je 0x571923
mov dword [ebx + 0x38], 0xfffffffd
jmp 0x57186e
test esi, esi
je 0x5718bd
mov edx, dword [ebx]
mov eax, dword [eax + 0x44]
mov dl, byte [edx]
mov byte [eax], dl
call sub.msvcrt.dll__errno
mov ecx, esi
mov edx, dword [ebx + 0x40]
mov dword [eax], 0
mov eax, 0x4000
sar eax, cl
mov ecx, dword [ebx + 0x44]
mov dword [esp + 0xc], edx
add esi, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
test eax, eax
jne 0x571905
mov edx, dword [ebx + 0x40]
test byte [edx + 0xc], 0x20
je 0x571905
mov dword [ebx + 0x38], 0xffffffff
mov edx, dword [ebx + 4]
add eax, edx
mov edx, dword [ebx + 0x44]
mov dword [ebx + 4], eax
mov dword [ebx], edx
cmp eax, 1
ja 0x571862
mov dword [ebx + 0x58], eax
jmp 0x57186e
mov si, 6
test al, 0xe0
jne 0x5718a4
nop
mov eax, ebx
call fcn.00571770
dec esi
jne 0x571930
test edi, 4
jne 0x5719a0
test edi, 8
jne 0x571990
test edi, 0x10
jne 0x571980
and edi, 2
je 0x571965
mov eax, ebx
call fcn.00571770
mov eax, ebx
call fcn.00571770
cmp dword [ebx + 0x3c], 1
sbb eax, eax
xor eax, 0xffffffff
and eax, 0xfffffffd
mov dword [ebx + 0x38], eax
jmp 0x57186e
mov eax, ebx
call fcn.00571770
test eax, eax
je 0x571952
inc eax
jne 0x571980
jmp 0x571952
mov eax, ebx
call fcn.00571770
test eax, eax
je 0x57194a
inc eax
jne 0x571990
jmp 0x57194a
mov eax, ebx
call fcn.00571770
mov esi, eax
mov eax, ebx
call fcn.00571770
shl eax, 8
add esi, eax
test esi, esi
je 0x571942
mov eax, ebx
dec esi
call fcn.00571770
inc eax
jne 0x5719b5
jmp 0x571942