joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61a990
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push ebx
push 0x64
push 4
mov dword [esi], 1
call fcn.006192c0
push esi
mov dword [esi + 4], eax
mov dword [esi + 0x5bc], ebx
call fcn.00613360
mov eax, dword [esp + 0x20]
lea edx, [esi + 0xc]
add esp, 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x61a9c3
mov eax, dword [esp + 0x14]
lea edx, [esi + 0x2c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x61a9d6
mov eax, dword [esp + 0x18]
lea edx, [esi + 0x4c]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x61a9f0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x480], eax
mov dword [esi + 0x484], ecx
mov ecx, 0x65016c
or eax, 0xffffffff
mov dword [esi + 0x488], ecx
mov dword [esi + 0x490], ebx
mov dword [esi + 0x4a0], eax
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x47c], eax
mov dword [esi + 0x478], ebx
mov dword [esi + 0x49c], ecx
mov dword [esi + 0x494], ebx
mov dword [esi + 0x4a8], edx
call sub.kernel32.dll_GetTickCount
push eax
call fcn.0061f762
add esp, 4
pop esi
pop ebx
jmp fcn.00618940

Function at 0x61b250
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x210
mov eax, dword [0x67e540]
push esi
mov esi, dword [esp + 0x218]
mov dword [esp + 0x210], eax
mov eax, dword [esi + 0x4a0]
push edi
push eax
mov dword [esp + 0x10], 0x10
call fcn.00618a30
add esp, 4
test eax, eax
je 0x61b33b
lea ebx, [ebx]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x4a0]
lea edx, [esp + 0x14]
push edx
push 0
push 0x1f3
lea eax, [esp + 0x30]
push eax
push ecx
call sub.ws2_32.dll_recvfrom
cmp eax, 0xffffffff
je 0x61b324
mov edx, dword [esp + 0x12]
mov eax, dword [esp + 0x14]
push edx
push eax
push esi
call fcn.0061a6d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x61b324
mov ecx, dword [esp + 0x12]
mov edx, dword [esp + 0x14]
push ecx
push edx
push esi
call fcn.00613250
mov edi, eax
push edi
call fcn.00613320
add esp, 0x10
test eax, eax
jne 0x61b380
push 0x11
push edi
call fcn.006132c0
mov ecx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], edi
call fcn.00619750
mov edx, dword [esi + 0x484]
mov eax, dword [esp + 0x18]
push edx
push eax
push 0
push esi
call dword [esi + 0x480]
add esp, 0x20
mov ecx, dword [esi + 0x4a0]
push ecx
call fcn.00618a30
add esp, 4
test eax, eax
jne 0x61b290
call sub.kernel32.dll_GetTickCount
sub eax, dword [esi + 0x4a4]
cmp eax, 0x7d0
jbe 0x61b369
mov edx, dword [esi + 0x4a0]
push edx
call sub.wsock32.dll_closesocket
mov dword [esi + 0x4a0], 0xffffffff
mov dword [esi], 1
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
call fcn.006245e9
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
pop edi
mov eax, 5
pop esi
call fcn.006245e9
add esp, 0x210
ret
Function at 0x61b3a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30c
mov eax, dword [0x67e540]
mov dword [esp + 0x308], eax
mov eax, dword [esp + 0x314]
test eax, eax
jne 0x61b3c8
mov dword [esp + 0x314], 0x65016c
push ebp
mov ebp, dword [esp + 0x31c]
test ebp, ebp
jne 0x61b3d9
mov ebp, 0x65016c
mov eax, dword [esp + 0x318]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x61b3e3
sub eax, edx
cmp eax, 0x100
ja 0x61b408
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x61b3f8
sub eax, edx
cmp eax, 0x100
jbe 0x61b421
mov eax, 6
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.006245e9
add esp, 0x30c
ret
push edi
mov edi, dword [esp + 0x318]
call fcn.0061a0b0
test eax, eax
jne 0x61b5a4
push ebx
push esi
mov esi, dword [esp + 0x32c]
push edi
mov dword [edi + 0x5b4], esi
call fcn.0061a230
mov eax, dword [edi + 0x4a8]
mov dword [esp + 0x21], eax
lea ecx, [esp + 0x25]
add esp, 4
lea eax, [edi + 0xc]
lea ebx, [esp + 0x10]
lea edx, [esp + 0x14]
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 1
mov byte [esp + 0x1c], 3
mov dword [esp + 0x10], 9
mov dword [esp + 0x14], ecx
call fcn.0061a1f0
lea eax, [edi + 0x2c]
call fcn.0061a1f0
mov eax, dword [esp + 0x14]
lea edx, [edi + 0x6c]
mov ebx, dword [edx]
mov ecx, eax
mov dword [ecx], ebx
mov edx, dword [edx + 4]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x10]
add eax, 8
add edx, 8
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
lea ebx, [esp + 0x10]
mov eax, ebp
lea edx, [esp + 0x14]
call fcn.0061a1f0
mov eax, dword [esp + 0x324]
call fcn.0061a1f0
push esi
call sub.wsock32.dll_htonl
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [ecx], eax
mov al, byte [edi + 0x5b4]
add esi, 4
add ecx, 4
test al, 8
je 0x61b4fd
mov eax, dword [edi + 0x494]
mov dword [ecx], eax
add esi, 4
add ecx, 4
mov al, byte [edi + 0x5b4]
test al, al
jns 0x61b513
mov edx, dword [esp + 0x330]
mov dword [ecx], edx
add esi, 4
push esi
call sub.wsock32.dll_htons
mov ecx, dword [edi + 0x4a0]
xor ebx, ebx
push ebx
mov word [esp + 0x1c], ax
push esi
lea eax, [esp + 0x20]
push eax
push ecx
call sub.wsock32.dll_send
test eax, eax
jg 0x61b55c
push edi
call fcn.0061aba0
add esp, 4
pop esi
pop ebx
pop edi
mov eax, 3
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.006245e9
add esp, 0x30c
ret
cmp dword [edi + 0x74], ebx
mov dword [edi], 3
mov dword [edi + 0x5b8], ebx
jne 0x61b5a0
push 0x1000
call fcn.006243e4
add esp, 4
cmp eax, ebx
mov dword [edi + 0x74], eax
jne 0x61b59d
pop esi
pop ebx
pop edi
mov eax, 5
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.006245e9
add esp, 0x30c
ret
mov dword [edi + 0x78], ebx
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x310]
pop edi
pop ebp
call fcn.006245e9
add esp, 0x30c
ret
Function at 0x61b5c0
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x67e540]
push ebx
push esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
cmp dword [esi], 1
mov ebx, 2
mov dword [esp + 8], 1
mov byte [esp + 0xc], 0xfe
mov byte [esp + 0xd], 0xfd
mov byte [esp + 0xe], bl
mov byte [esp + 0xf], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
je 0x61b614
push esi
call fcn.0061aba0
add esp, 4
push 0x11
push ebx
push ebx
call sub.ws2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x4a0], eax
je 0x61b640
push 4
lea ecx, [esp + 0xc]
push ecx
push 0x20
push 0xffff
push eax
call sub.ws2_32.dll_setsockopt
test eax, eax
je 0x61b654
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.006245e9
add esp, 0x20
ret
mov eax, dword [esp + 0x30]
mov word [esp + 0x14], bx
mov ebx, dword [esp + 0x34]
movzx edx, ax
movzx ecx, bx
sub ecx, edx
cmp ecx, 0x1f4
mov dword [esp + 0x18], 0xffffffff
jle 0x61b67f
lea ebx, [eax + 0x1f4]
cmp ax, bx
push edi
mov edi, eax
ja 0x61b6d3
push ebp
mov ebp, dword [esp + 0x40]
lea esp, [esp]
push edi
call sub.wsock32.dll_htons
cmp ebp, 1
push 0x10
lea edx, [esp + 0x20]
push edx
mov word [esp + 0x26], ax
push 0
jne 0x61b6b9
mov ecx, dword [esi + 0x4a0]
push 8
lea eax, [esp + 0x24]
push eax
push ecx
jmp 0x61b6c7
mov eax, dword [esi + 0x4a0]
push 0xa
push str.echo_test
push eax
call sub.ws2_32.dll_sendto
inc edi
cmp di, bx
jbe 0x61b690
pop ebp
mov dword [esi], 0
call sub.kernel32.dll_GetTickCount
mov ecx, dword [esp + 0x28]
pop edi
mov dword [esi + 0x4a4], eax
pop esi
xor eax, eax
pop ebx
call fcn.006245e9
add esp, 0x20
ret
Function at 0x61b910
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x78]
xor ebx, ebx
cmp eax, 3
push edi
jl 0x61b81d
mov eax, dword [esi + 0x74]
movzx eax, word [eax]
push eax
call sub.wsock32.dll_ntohs
cmp ax, 0x1000
ja 0x61b7f9
movzx edi, ax
cmp dword [esi + 0x78], edi
jl 0x61b823
mov eax, dword [esi + 0x74]
movsx ecx, byte [eax + 2]
dec ecx
cmp ecx, 3
ja case.default.0x61b746
jmp dword [ecx*4 + 0x61b82c]
lea ecx, [edi - 3]
push ecx
add eax, 3
mov ecx, esi
call fcn.0061b0b0
add esp, 4
mov ebx, eax
jmp case.default.0x61b746
lea edx, [edi - 3]
push edx
add eax, 3
push eax
call fcn.0061b180
add esp, 8
mov ebx, eax
jmp case.default.0x61b746
push 0
push edi
push eax
mov eax, dword [esi + 0x4a0]
push eax
call sub.wsock32.dll_send
test eax, eax
jg case.default.0x61b746
pop edi
pop esi
mov eax, 3
pop ebx
ret
lea ecx, [edi - 3]
cmp ecx, 6
jge 0x61b7a2
mov ebx, 4
jmp case.default.0x61b746
mov ecx, dword [eax + 3]
movzx eax, word [eax + 7]
push eax
push ecx
push esi
call fcn.0061a6d0
add esp, 0xc
cmp eax, 0xffffffff
je 0x61b7c3
push eax
push esi
call fcn.0061a740
add esp, 8
xor ebx, ebx
mov eax, dword [esi + 0x78]
sub eax, edi
mov dword [esi + 0x78], eax
mov ecx, eax
je 0x61b7e5
mov eax, dword [esi + 0x74]
test eax, eax
je 0x61b7e5
push ecx
add edi, eax
push edi
push eax
call fcn.0061ed90
add esp, 0xc
test ebx, ebx
jne 0x61b7fe
cmp dword [esi + 0x78], 3
jge 0x61b713
pop edi
pop esi
mov eax, ebx
pop ebx
ret
mov ebx, 4
mov edx, dword [esi + 0x484]
mov eax, dword [0x69bfa8]
push edx
push eax
push 4
push esi
call dword [esi + 0x480]
push esi
call fcn.0061aba0
add esp, 0x14
pop edi
pop esi
mov eax, ebx
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
push esi
mov esi, eax
mov eax, dword [esi + 0x4a0]
push eax
call fcn.00618a30
add esp, 4
test eax, eax
jne 0x61b858
pop esi
ret
mov edx, dword [esi + 0x74]
mov eax, dword [esi + 0x4a0]
push edi
mov edi, dword [esi + 0x78]
push 0
mov ecx, 0x1000
sub ecx, edi
push ecx
add edx, edi
push edx
push eax
call sub.wsock32.dll_recv
cmp eax, 0xffffffff
je 0x61b8dc
test eax, eax
je 0x61b8dc
mov edx, dword [esi + 0x78]
mov ecx, dword [esi]
add edx, eax
cmp ecx, 2
mov dword [esi + 0x78], edx
mov eax, edx
je 0x61b89c
mov ecx, dword [esi + 0x5b8]
test ecx, ecx
jle 0x61b8b4
mov ecx, dword [esi + 0x74]
sub eax, edi
push eax
add ecx, edi
push ecx
lea edx, [esi + 0x4ac]
push edx
call fcn.0061e7b0
add esp, 0xc
cmp dword [esi], 3
jne 0x61b8c2
call fcn.0061ad40
test eax, eax
jne 0x61b901
cmp dword [esi], 2
jne 0x61b8d7
mov eax, dword [esi + 0x78]
test eax, eax
jle 0x61b8d7
pop edi
mov eax, esi
pop esi
jmp 0x61b700
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x484]
mov ecx, dword [0x69bfa8]
push eax
push ecx
push 4
push esi
call dword [esi + 0x480]
push esi
call fcn.0061aba0
add esp, 0x14
mov eax, 3
pop edi
pop esi
ret
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0061a7e0
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x61b93a
cmp eax, 1
jle 0x61b936
cmp eax, 3
jg 0x61b936
mov eax, esi
pop esi
jmp 0x61b840
xor eax, eax
pop esi
ret
push esi
call fcn.0061b250
add esp, 4
pop esi
ret
Function at 0x61b950
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, eax
mov ebp, 1
xor ebx, ebx
lea ecx, [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x4a0]
push ebx
push eax
push ecx
push edx
dec ebp
call sub.wsock32.dll_send
cmp eax, ebx
jg 0x61ba16
cmp ebp, ebx
jl 0x61ba0c
mov eax, dword [esi + 0x74]
cmp eax, ebx
je 0x61b998
push eax
call fcn.00624027
add esp, 4
mov eax, dword [esi + 0x4a0]
or edi, 0xffffffff
cmp eax, edi
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
je 0x61b9b1
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 0x4a0], edi
mov dword [esi], 1
call fcn.0061ab00
mov dword [esi + 0x47c], edi
call fcn.0061aa70
push ebx
push 2
push ebx
push ebx
push esi
call fcn.0061b3a0
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x61b960
mov eax, dword [esi + 0x484]
mov ecx, dword [0x69bfa8]
push eax
push ecx
push 4
push esi
call dword [esi + 0x480]
push esi
call fcn.0061aba0
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x61bab0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x67e540]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp dword [esi], 1
jne 0x61baf1
push 0
push 2
push 0
push 0
push esi
call fcn.0061b3a0
mov eax, dword [esi]
add esp, 0x14
cmp eax, 1
jne 0x61baf1
mov eax, 3
pop esi
mov ecx, dword [esp + 0x10]
call fcn.006245e9
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x30]
lea eax, [edi + 9]
push eax
call sub.wsock32.dll_htons
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov word [esp + 8], ax
lea eax, [esp + 8]
push 9
push eax
mov eax, esi
mov byte [esp + 0x12], 2
mov dword [esp + 0x13], ecx
mov word [esp + 0x17], dx
call fcn.0061b950
add esp, 8
test eax, eax
jne 0x61bb50
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x4a0]
push eax
push edi
push ecx
push edx
call sub.wsock32.dll_send
xor ecx, ecx
test eax, eax
setge cl
dec ecx
and ecx, 3
mov eax, ecx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
call fcn.006245e9
add esp, 0x14
ret

Function at 0x61c5b0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push 0
push esi
call fcn.0061c440
call fcn.00618940
push esi
call fcn.0061c4d0
add esp, 0x10
test eax, eax
jne 0x61c5e4
mov dword [esi + 0xc0], 1
mov dword [esi + 0x34], 3
pop esi
ret
push edi
mov edi, dword [0x714df8]
test edi, edi
jne 0x61c5f2
mov edi, dword [esi + 0x18]
push edi
call sub.ws2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
jne 0x61c628
push edi
call sub.ws2_32.dll_gethostbyname
test eax, eax
jne 0x61c61e
pop edi
mov dword [esi + 0xc0], 1
mov dword [esi + 0x34], 4
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esi + 0x1c], edx
push 0
push 0
push esi
mov dword [esi + 0x10], 1
call fcn.0061c440
add esp, 0xc
pop edi
pop esi
ret
Function at 0x61c640
Capabilities:
Connect socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x67e540]
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x44], 0xffffffff
push edi
mov edi, 1
jne 0x61c73c
push 6
push edi
push 2
call sub.ws2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x44], eax
je 0x61c682
push 0
push eax
call fcn.006189d0
add esp, 8
test eax, eax
jne 0x61c694
mov dword [esi + 0xc0], edi
mov dword [esi + 0x34], 5
jmp 0x61c79c
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x61c6b0
mov eax, dword [0x67ddd4]
mov ecx, dword [esi + 0x44]
push eax
push ecx
call fcn.00618a00
add esp, 8
mov eax, dword [0x714df8]
xor edx, edx
test eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov word [esp + 0xc], 2
je 0x61c6dd
xor eax, eax
mov ax, word [0x714df4]
push eax
jmp 0x61c6e4
xor ecx, ecx
mov cx, word [esi + 0x20]
push ecx
call sub.wsock32.dll_htons
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x1c]
mov word [esp + 0xe], ax
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], edx
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x61c73c
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x61c73c
cmp eax, 0x2734
je 0x61c73c
mov dword [esi + 0xc0], edi
pop edi
mov dword [esi + 0x34], 6
mov dword [esi + 0x48], eax
pop esi
mov ecx, dword [esp + 0x14]
call fcn.006245e9
add esp, 0x18
ret
mov ecx, dword [esi + 0x44]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push ecx
call fcn.0061d410
add esp, 0x10
test eax, eax
je 0x61c78b
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x61c78b
mov eax, dword [esp + 8]
test eax, eax
je 0x61c7a4
push 0
push 0
push esi
mov dword [esi + 0x10], 2
call fcn.0061c440
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x14]
call fcn.006245e9
add esp, 0x18
ret
test eax, eax
mov dword [esi + 0xc0], edi
mov dword [esi + 0x34], 6
jne 0x61c7a4
call sub.ws2_32.dll_WSAGetLastError
mov dword [esi + 0x48], eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
call fcn.006245e9
add esp, 0x18
ret
Function at 0x61d410
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x314
push ebx
push ebp
xor edx, edx
push esi
cmp eax, edx
mov eax, dword [esp + 0x324]
push edi
mov ecx, 1
je 0x61d43e
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x18]
jmp 0x61d440
xor edi, edi
cmp dword [esp + 0x330], edx
je 0x61d460
mov dword [esp + 0x120], eax
mov dword [esp + 0x11c], ecx
lea ebx, [esp + 0x11c]
jmp 0x61d462
xor ebx, ebx
cmp dword [esp + 0x334], edx
je 0x61d482
mov dword [esp + 0x224], eax
mov dword [esp + 0x220], ecx
lea ebp, [esp + 0x220]
jmp 0x61d484
xor ebp, ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
push edi
push 0x40
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
call sub.wsock32.dll_select
mov esi, eax
cmp esi, 0xffffffff
jne 0x61d4af
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x314
ret
mov eax, dword [esp + 0x32c]
test eax, eax
je 0x61d4ec
test esi, esi
jle 0x61d4df
mov ecx, dword [esp + 0x328]
push edi
push ecx
call sub.wsock32.dll___WSAFDIsSet
test eax, eax
je 0x61d4df
mov edx, dword [esp + 0x32c]
mov dword [edx], 1
jmp 0x61d4ec
mov eax, dword [esp + 0x32c]
mov dword [eax], 0
mov edi, dword [esp + 0x330]
test edi, edi
je 0x61d51b
test esi, esi
jle 0x61d515
mov ecx, dword [esp + 0x328]
push ebx
push ecx
call sub.wsock32.dll___WSAFDIsSet
test eax, eax
je 0x61d515
mov dword [edi], 1
jmp 0x61d51b
mov dword [edi], 0
mov edi, dword [esp + 0x334]
test edi, edi
je 0x61d558
test esi, esi
jle 0x61d552
mov edx, dword [esp + 0x328]
push ebp
push edx
call sub.wsock32.dll___WSAFDIsSet
test eax, eax
je 0x61d552
mov dword [edi], 1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x314
ret
mov dword [edi], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x314
ret

Function at 0x61d570
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xf8]
push edi
mov edi, dword [ebx]
dec edi
test eax, eax
je 0x61d5ae
call sub.kernel32.dll_GetTickCount
mov ecx, dword [esi + 0xfc]
add ecx, dword [0x67ddd8]
cmp eax, ecx
jb 0x61d5fb
mov dword [esi + 0xfc], eax
mov eax, dword [0x67ddd4]
cmp edi, eax
jl 0x61d5ae
mov edi, eax
mov edx, dword [esi + 0x44]
push 0
push edi
mov edi, dword [esp + 0x1c]
push edi
push edx
call sub.wsock32.dll_recv
cmp eax, 0xffffffff
jne 0x61d604
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x61d5fb
cmp eax, 0x2734
je 0x61d5fb
mov ecx, 1
pop edi
mov dword [esi + 0x48], eax
mov dword [esi + 0xc0], ecx
mov dword [esi + 0x34], 5
mov dword [esi + 0xf4], ecx
pop esi
mov eax, 3
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret
test eax, eax
jne 0x61d61b
pop edi
mov dword [esi + 0xf4], 1
pop esi
mov eax, 2
pop ebx
ret
mov byte [eax + edi], 0
pop edi
mov dword [ebx], eax
pop esi
xor eax, eax
pop ebx
ret
Function at 0x61d630
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi + 0x44]
push 0
push eax
push ecx
push edx
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x61d678
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x61d65f
xor eax, eax
pop esi
ret
mov dword [esi + 0x48], eax
mov dword [esi + 0xc0], 1
mov dword [esi + 0x34], 5
or eax, 0xffffffff
pop esi
ret
cmp dword [esi + 0x10], 3
jne 0x61d684
add dword [esi + 0x10c], eax
pop esi
ret

Function at 0x61f8d6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x61f8f6
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.00621857
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x61f919
test byte [esp + 8], 2
je 0x61f919
call fcn.00621845
mov dword [eax], 0xd
call fcn.0062184e
mov dword [eax], 5
jmp 0x61f8f2
xor eax, eax
ret

Function at 0x621551
Capabilities:
Terminate process

Disassembly:
push 8
push 0x649d80
call fcn.00625710
push 8
call fcn.006256df
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x69caa8], esi
jne 0x621585
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x69caa4], esi
mov al, byte [ebp + 0x10]
mov byte [0x69caa0], al
cmp dword [ebp + 0xc], edi
jne 0x6215cf
cmp dword [0x715634], edi
je 0x6215bf
mov eax, dword [0x715630]
sub eax, 4
mov dword [0x715630], eax
cmp eax, dword [0x715634]
jb 0x6215bf
mov eax, dword [eax]
cmp eax, edi
je 0x6215a0
call eax
jmp 0x6215a0
push 0x670040
mov eax, 0x670034
call fcn.006214cf
pop ecx
push 0x67004c
mov eax, 0x670044
call fcn.006214cf
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x621600
cmp dword [ebp + 0x10], edi
jne 0x62160e
mov dword [0x69caa8], esi
push dword [ebp + 8]
call fcn.0062148d
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x62160d
push 8
call fcn.0062562a
pop ecx
ret
call fcn.0062574b
ret

Function at 0x621e08
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x621e24
call fcn.00621845
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x621e96
push esi
push 0x8c
push 1
call fcn.00625e70
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x621e7c
push esi
call fcn.00625fec
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x621d76
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x621e74
push edi
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x621e93
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00624027
test ebx, ebx
pop ecx
je 0x621e8e
push ebx
call fcn.00621857
pop ecx
or eax, 0xffffffff
jmp 0x621e95
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x623354
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x64a048
call fcn.00625710
mov edi, 0x94
mov eax, edi
call fcn.00623680
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x69ca68], ecx
mov eax, dword [esi + 4]
mov dword [0x69ca74], eax
mov edx, dword [esi + 8]
mov dword [0x69ca78], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x69ca6c], esi
cmp ecx, 2
je 0x6233b4
or esi, 0x8000
mov dword [0x69ca6c], esi
shl eax, 8
add eax, edx
mov dword [0x69ca70], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x6233ef
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6233ef
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x623407
cmp eax, 0x20b
je 0x6233f4
mov dword [ebp - 0x1c], esi
jmp 0x62341b
cmp dword [ecx + 0x84], 0xe
jbe 0x6233ef
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x623415
cmp dword [ecx + 0x74], 0xe
jbe 0x6233ef
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0062d41e
pop ecx
test eax, eax
jne 0x62342f
push 0x1c
call fcn.00623330
pop ecx
call fcn.006261e6
test eax, eax
jne 0x623440
push 0x10
call fcn.00623330
pop ecx
call fcn.00629a8c
mov dword [ebp - 4], esi
call fcn.00625c72
test eax, eax
jge 0x623459
push 0x1b
call fcn.0062330b
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x715628], eax
call fcn.0062d2e2
mov dword [0x69cbb4], eax
call fcn.0062d240
test eax, eax
jge 0x62347f
push 8
call fcn.0062330b
pop ecx
call fcn.0062d00d
test eax, eax
jge 0x623490
push 9
call fcn.0062330b
pop ecx
push 1
call fcn.006214e7
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x6234a6
push eax
call fcn.0062330b
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
call fcn.0062cfb0
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x6234c7
movzx eax, word [ebp - 0x40]
jmp 0x6234ca
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0053cc10
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x6234e8
push edi
call fcn.00621614
call fcn.00621636
jmp 0x62351a
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0062574b
ret