joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510a20
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x510b70
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x56fb28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push ebx
push eax
lea ecx, [esp + 0xc]
call fcn.0050dc00
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0
call fcn.004a6630
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
mov eax, dword [esp + 4]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x510bda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00512cf0
mov ecx, dword [esp + 0x20]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x510c00
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x56fb50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [esp + 0x40]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x28]
call fcn.0050dc00
lea ecx, [esp + 0xc]
push ecx
xor ebx, ebx
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], ebx
call fcn.004a6630
mov edi, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
mov byte [esp + 0x58], 1
call esi
test eax, eax
jne 0x510ce2
push 0x57ef54
lea ecx, [esp + 0x10]
call fcn.0050e6a0
push 0x5c
lea ecx, [esp + 0x10]
call fcn.004b0170
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push eax
push edi
call esi
test eax, eax
jne 0x510ce2
lea eax, [edi - 0x10]
mov byte [esp + 0x44], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x510cbd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x24]
mov dword [esp + 0x44], 0xffffffff
call fcn.00512cf0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
mov esi, dword [esp + 0x14]
imul esi, dword [esp + 0x18]
imul esi, dword [esp + 0x1c]
lea eax, [edi - 0x10]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x44], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x510d12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x24]
mov dword [esp + 0x44], 0xffffffff
call fcn.00512cf0
mov ecx, dword [esp + 0x3c]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x510d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56fb70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push ebx
push esi
push eax
lea ecx, [esp + 0x10]
call fcn.0050dc00
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.004a6630
push 0x57ef54
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.0050e6a0
push 0x5c
lea ecx, [esp + 0xc]
call fcn.004b0170
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelA]
test eax, eax
lea eax, [esi - 0x10]
setne bl
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x510dd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00512cf0
mov ecx, dword [esp + 0x24]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x510e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push 0
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x510e19
pop esi
xor al, al
pop ebp
ret
push ebx
push edi
push esi
call fcn.0055047f
add esp, 4
mov edi, eax
push edi
push esi
mov bl, 1
call ebp
test eax, eax
jne 0x510e42
push edi
xor bl, bl
call fcn.0055047a
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
push edi
call fcn.004054c0
push edi
call fcn.0055047a
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
ret
Function at 0x517af0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5af710]
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x517b3c
mov ax, word [esp]
cmp al, 1
jne 0x517b36
cmp ah, al
jne 0x517b36
xor eax, eax
mov ecx, dword [esp + 0x190]
call fcn.0053aaae
add esp, 0x194
ret
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 2
call fcn.0053aaae
add esp, 0x194
ret
Function at 0x51e640
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
lea edx, [eax + ebp]
cmp ebp, edx
push esi
push edi
mov ecx, ebp
mov eax, 0x1505
jae 0x51e66d
lea ebx, [ebx]
movsx esi, byte [ecx]
imul eax, eax, 0x21
xor eax, esi
inc ecx
cmp ecx, edx
jb 0x51e660
mov ebx, dword [esp + 0x14]
xor edx, edx
div dword [ebx + 8]
mov ecx, dword [ebx]
mov edi, dword [ecx + edx*4]
mov eax, dword [edi]
test eax, eax
mov dword [esp + 0x18], edi
je 0x51e6b3
mov ebx, dword [eax]
mov edi, dword [ebx + 8]
cmp edi, dword [esp + 0x1c]
mov esi, dword [ebx + 4]
jne 0x51e6a4
mov dl, byte [esi]
cmp dl, byte [ebp]
jne 0x51e6a4
mov ecx, edi
mov edi, ebp
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x51e702
mov eax, dword [eax + 8]
test eax, eax
jne 0x51e685
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push 0xc
call dword [0x5ae5e8]
mov esi, eax
add esp, 4
test esi, esi
je 0x51e73d
push ebp
call dword [0x5ae5f4]
add esp, 4
test eax, eax
je 0x51e718
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi], ebp
mov eax, dword [edi + 4]
push esi
push eax
push edi
call fcn.0052f0e0
add esp, 0xc
test eax, eax
je 0x51e729
mov eax, dword [ebx + 0xc]
pop edi
inc eax
mov dword [ebx + 0xc], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
push eax
call dword [ecx + 4]
mov eax, dword [ebx]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [0x5ae5ec]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ecx, dword [esi + 4]
push ecx
call dword [0x5ae5ec]
push esi
call dword [0x5ae5ec]
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x51e750
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
lea edx, [eax + ebp]
cmp ebp, edx
push esi
push edi
mov ecx, ebp
mov eax, 0x1505
jae 0x51e77d
lea ebx, [ebx]
movsx esi, byte [ecx]
imul eax, eax, 0x21
xor eax, esi
inc ecx
cmp ecx, edx
jb 0x51e770
mov ecx, dword [esp + 0x14]
xor edx, edx
div dword [ecx + 8]
mov ecx, dword [ecx]
mov edx, dword [ecx + edx*4]
mov edx, dword [edx]
test edx, edx
je 0x51e7b7
mov eax, dword [edx]
mov edi, dword [eax + 8]
cmp edi, dword [esp + 0x1c]
mov esi, dword [eax + 4]
jne 0x51e7b0
mov cl, byte [esi]
cmp cl, byte [ebp]
jne 0x51e7b0
mov ecx, edi
mov edi, ebp
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x51e7be
mov edx, dword [edx + 8]
test edx, edx
jne 0x51e791
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [eax]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x521650
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
mov ebp, dword [eax + 0x9c]
test ebp, ebp
mov esi, dword [edi + 0x334]
mov dword [esp + 0x14], eax
jne 0x52167f
mov eax, dword [eax + 0x98]
test eax, eax
mov ebp, eax
jne 0x52167f
mov ebp, 0x12c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul ebp, ebp, 0x3e8
mov eax, dword [esi + 0x18]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x14]
push ecx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esi + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebx
mov eax, dword [esi + 0x18]
push eax
mov dword [esi + 0x14], 0
call ebx
test ebp, ebp
mov dword [esi + 0x18], 0
mov bl, 1
jne 0x5216e7
mov ecx, dword [esi]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x52173f
mov edx, dword [esi]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ebp, [esi + 8]
mov byte [edi + 0x32c], bl
mov dword [ebp], 0xffffffff
mov eax, dword [esp + 0x18]
test eax, eax
je 0x521707
mov edx, dword [edi + 0x328]
mov dword [eax], edx
mov eax, dword [edi + 0x328]
xor esi, esi
test eax, eax
jne 0x5217e9
mov ebp, dword [ebp]
cmp ebp, 0x1b
jne 0x52175b
push ebp
mov esi, ebp
call fcn.0052e990
push eax
mov eax, dword [esp + 0x1c]
push str.Could_not_resolve_host:__s
push eax
call fcn.00521d00
add esp, 0x10
jmp 0x5217e9
mov eax, dword [edi + 0x330]
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esi]
lea ebp, [esi + 8]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x5216f7
mov al, byte [edi + 0x32c]
test al, al
je 0x5217bd
mov ecx, dword [edi + 0x330]
mov al, byte [edi + 0xe7]
test al, al
push ecx
push edi
je 0x52179a
call fcn.0052eff0
mov edx, dword [edi + 0x48]
push eax
mov eax, dword [esp + 0x20]
push edx
push str.Could_not_resolve_proxy:__s___s
push eax
call fcn.00521d00
add esp, 0x18
mov esi, 5
jmp 0x5217e9
call fcn.0052eff0
mov edx, dword [edi + 0x34]
push eax
mov eax, dword [esp + 0x20]
push edx
push str.Could_not_resolve_host:__s___s
push eax
call fcn.00521d00
add esp, 0x18
mov esi, 6
jmp 0x5217e9
cmp ebp, 0xffffffff
je 0x5217ce
cmp dword [edi + 0x330], 0x2afc
jne 0x5217e4
mov ecx, dword [edi + 0x34]
mov edx, dword [esp + 0x14]
push ecx
push str.Resolving_host_timed_out:__s
push edx
call fcn.00521d00
add esp, 0xc
mov esi, 0x1c
lea eax, [edi + 0x320]
push eax
call fcn.005213d0
mov eax, dword [edi + 0x328]
add esp, 4
test eax, eax
mov eax, esi
jne 0x52180a
mov byte [edi + 0xe4], bl
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x521860
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [edi]
push esi
mov dword [eax], 0
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x521896
mov ecx, dword [esp + 0x18]
push ecx
push esi
push eax
call fcn.00521150
add esp, 0xc
pop edi
pop esi
pop ebx
ret
push ebp
mov ebp, dword [esp + 0x1c]
push ebp
push esi
call fcn.005214b0
add esp, 8
test al, al
je 0x5218ba
mov edx, dword [esp + 0x20]
pop ebp
pop edi
pop esi
mov dword [edx], 1
xor eax, eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.0052eff0
push eax
push esi
push str.init_resolve_thread___failed_for__s___s_n
push ebx
call fcn.00521c20
add esp, 0x18
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x521907
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0052eff0
push eax
push ebp
push esi
push str.gethostbyname_2__failed_for__s:_d___s_n
push ebx
call fcn.00521c20
add esp, 0x1c
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret
push ebp
push eax
call fcn.005210a0
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5219c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [eax + 0xa4]
xor ecx, ecx
cmp edx, esi
sete cl
push edi
mov edi, dword [esp + 0x20]
mov dword [edi], 0
mov bl, byte [ecx + eax + 0xb0]
test bl, bl
je 0x521a0e
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push edx
push ecx
push eax
call fcn.00510b50
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x521a50
pop edi
pop esi
or eax, eax
pop ebx
ret
mov dword [edi], 0
mov ecx, dword [eax + 0x168]
test ecx, ecx
je 0x521a23
or esi, 0xffffffff
jmp 0x521a3d
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x521a50
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x2733
jne 0x521a50
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov dword [edi], esi
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x521df0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0xa4]
xor eax, eax
cmp ecx, esi
sete al
mov dl, byte [eax + edi + 0xb0]
test dl, dl
je 0x521e3d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
push eax
push edi
call fcn.00510b50
mov ecx, dword [esp + 0x2c]
mov esi, eax
add esp, 0x10
xor eax, eax
cmp esi, 0xffffffff
setne al
pop edi
mov dword [ecx], esi
pop esi
dec eax
and eax, 0x37
ret
mov eax, dword [edi + 0x168]
test eax, eax
je 0x521e4c
or esi, 0xffffffff
jmp 0x521e66
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push eax
push edx
push ecx
call dword [sym.imp.WSOCK32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne 0x521ea1
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x2733
jne 0x521e89
mov ecx, dword [esp + 0x1c]
xor esi, esi
xor eax, eax
cmp esi, 0xffffffff
setne al
pop edi
mov dword [ecx], esi
pop esi
dec eax
and eax, 0x37
ret
push eax
push edi
call fcn.0052eff0
push eax
mov eax, dword [edi]
push str.Send_failure:__s
push eax
call fcn.00521d00
add esp, 0x14
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp esi, 0xffffffff
setne al
pop edi
mov dword [ecx], esi
pop esi
dec eax
and eax, 0x37
ret
Function at 0x522050
Capabilities:
Get socket status

Disassembly:
sub esp, 0x314
mov eax, dword [esp + 0x320]
cdq
mov ecx, 0x3e8
idiv ecx
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x11c], esi
imul edx, edx, 0x3e8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x328]
mov dword [esp + 0x14], edx
or edx, 0xffffffff
cmp eax, 0xffffffff
je 0x5220b2
mov ecx, 1
mov dword [esp + 0x120], eax
mov dword [esp + 0x11c], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov edx, eax
mov ebp, dword [esp + 0x32c]
cmp ebp, 0xffffffff
mov dword [esp + 0x220], esi
je 0x522102
xor eax, eax
cmp ecx, esi
mov dword [esp + 0x224], ebp
mov dword [esp + 0x220], 1
jbe 0x5220eb
lea ecx, [ecx]
cmp dword [esp + eax*4 + 0x1c], ebp
je 0x5220eb
inc eax
cmp eax, ecx
jb 0x5220e0
cmp eax, ecx
jne 0x5220fc
cmp ecx, 0x40
jae 0x5220fc
mov dword [esp + eax*4 + 0x1c], ebp
inc dword [esp + 0x18]
cmp ebp, edx
jbe 0x522102
mov edx, ebp
mov ebx, dword [sym.imp.WSOCK32.dll_select]
lea edi, [edx + 1]
jmp 0x522110
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x128]
push edx
push edi
call ebx
cmp eax, 0xffffffff
jne 0x52214a
call sub.KERNEL32.dll_GetLastError
cmp eax, 4
je 0x522110
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x314
ret
cmp eax, esi
jge 0x52215c
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x314
ret
jne 0x52216b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x314
ret
mov edi, dword [esp + 0x328]
cmp edi, 0xffffffff
je 0x5221a0
lea eax, [esp + 0x11c]
push eax
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x52218e
mov esi, 1
lea ecx, [esp + 0x18]
push ecx
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x5221a0
or esi, 4
cmp ebp, 0xffffffff
je 0x5221cc
lea edx, [esp + 0x220]
push edx
push ebp
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x5221ba
or esi, 2
lea eax, [esp + 0x18]
push eax
push ebp
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x5221cc
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
Function at 0x5222b0
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x5af710]
mov dword [esp + 0x11c], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
mov edx, dword [esi + 0x74]
mov eax, edx
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5222d7
sub eax, edi
cmp eax, 0xff
jae 0x5224c1
mov byte [esp + 0x20], cl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
mov dword [esp + 0xc], 0
stosb byte es:[edi], al
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x522362
mov edx, dword [esi + 0x74]
push 0x100
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.00510b50
add esp, 0xc
test eax, eax
je 0x522362
mov edi, dword [ebp + 8]
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x28]
push ecx
push edi
call fcn.00518090
add esp, 0x10
cmp eax, 1
jne 0x522358
lea edx, [esp + 8]
push edx
push edi
call fcn.00521650
add esp, 8
mov eax, dword [esp + 8]
test eax, eax
jne 0x5223aa
jmp 0x522365
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0x74]
lea eax, [esp + 8]
push eax
push 0
push ecx
push edi
call fcn.00518090
add esp, 0x10
cmp eax, 1
jne 0x52238c
lea edx, [esp + 8]
push edx
push edi
call fcn.00521650
add esp, 8
mov eax, dword [esp + 8]
test eax, eax
je 0x5223aa
mov eax, dword [esi + 0x74]
lea edx, [esp + 0x20]
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5223a0
mov al, byte [esp + 0x20]
test al, al
jne 0x5223c0
mov eax, dword [esi + 0x74]
push eax
push str.Couldnt_bind_to__s
jmp 0x5224b8
lea ecx, [esp + 0x20]
push ecx
push str.We_bind_local_end_to__s_n
push esi
call fcn.00521c20
add esp, 0xc
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x5224ae
mov eax, dword [esp + 8]
test eax, eax
je 0x5224a7
mov edi, dword [eax]
push eax
push esi
call fcn.00518260
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov edi, dword [ebp + 0xc]
add esp, 8
push eax
push ecx
push edi
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
jl 0x522457
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jge 0x522493
push str.getsockname___failed
push esi
call fcn.00521d00
add esp, 8
mov eax, 0x2d
mov ecx, dword [esp + 0x124]
call fcn.0053aaae
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov dword [esi + 0x8310], eax
call fcn.0052eff0
push eax
push str.bind_failure:__s
push esi
call fcn.00521d00
add esp, 0x14
mov eax, 0x2d
mov ecx, dword [esp + 0x124]
call fcn.0053aaae
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [esp + 0x124]
call fcn.0053aaae
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x20]
push edx
jmp 0x5224b3
lea eax, [esp + 0x20]
push eax
push 0x583e80
push esi
call fcn.00521d00
add esp, 0xc
mov ecx, dword [esp + 0x124]
mov eax, 0x2d
call fcn.0053aaae
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5225e0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
movzx eax, byte [esi + 0x1b2]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jge 0x522624
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.0052eff0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00521c20
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00521c20
add esp, 8
pop esi
pop ecx
ret
Function at 0x522640
Capabilities:
Connect socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x5af710]
push ebx
push ebp
mov ebp, dword [esp + 0x98]
mov edx, dword [ebp + 4]
push esi
push edi
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
mov ecx, dword [edi + 0x28]
mov esi, dword [edi]
push eax
push ecx
push edx
mov dword [esp + 0x1c], esi
call dword [sym.imp.WSOCK32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x522835
mov eax, dword [esp + 0xa8]
push 0x80
lea ecx, [esp + 0x1c]
push ecx
push ebp
mov byte [eax], 0
call fcn.00517ee0
lea edx, [esp + 0x24]
push edx
push str.__Trying__s...
push esi
call fcn.00521c20
mov al, byte [esi + 0x1b2]
add esp, 0x18
test al, al
je 0x5226c0
mov edx, ebx
call fcn.005225e0
mov eax, dword [edi]
mov ecx, dword [eax + 0x74]
test ecx, ecx
je 0x5226db
push ebx
push edi
call fcn.005222b0
add esp, 8
test eax, eax
jne 0x52282e
lea ecx, [esp + 0x14]
push ecx
push 0x8004667e
push ebx
mov dword [esp + 0x20], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp dword [edi + 0x28], 1
jne 0x522760
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
push edx
push eax
push ebx
call dword [sym.imp.WSOCK32.dll_connect]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x522799
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb
mov dword [esp + 0x14], esi
je 0x522764
cmp esi, 0x2732
jle 0x522735
cmp esi, 0x2734
jle 0x522764
push esi
push edi
call fcn.0052eff0
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.Failed_to_connect_to__s:__s
push edx
call fcn.00521d00
mov eax, dword [esp + 0x28]
add esp, 0x18
mov dword [eax + 0x8310], esi
jmp 0x5227a7
xor ebp, ebp
jmp 0x5227a7
mov ecx, dword [esp + 0xa4]
push ecx
push ebx
push 0xffffffffffffffff
call fcn.00522050
add esp, 0xc
cmp eax, 0xffffffff
jne 0x522780
or ebp, eax
jmp 0x5227a7
test eax, eax
jne 0x52278f
mov esi, dword [esp + 0x10]
mov ebp, 1
jmp 0x52279e
movsx ebp, al
and ebp, 4
shr ebp, 1
jmp 0x5227a7
cmp ebp, 1
jne 0x5227a7
cmp dword [esi + 0x2d0], 2
je 0x5227d8
push ebx
lea esi, [esp + 0x18]
call fcn.005224e0
add esp, 4
test ebp, ebp
jne 0x5227f1
test al, al
je 0x52280a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xa8]
push str.connected_n
push eax
mov byte [edx], 1
call fcn.00521c20
add esp, 8
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x88]
call fcn.0053aaae
add esp, 0x8c
ret
cmp ebp, 1
jne 0x52280a
mov ecx, dword [esp + 0x10]
push str.Timeout_n
push ecx
call fcn.00521c20
add esp, 8
jmp 0x52282e
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
push eax
push edi
mov dword [esi + 0x8310], eax
call fcn.0052eff0
push eax
push 0x583bf0
push esi
call fcn.00521c20
add esp, 0x14
push ebx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
call fcn.0053aaae
add esp, 0x8c
ret