joyce8/EMBER2024-capa huggingface dataset:
Function at 0x572f26
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x5c]
push edi
push esi
call fcn.0054ef0e
mov eax, dword [esi]
lea ecx, [ebp - 0x5c]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
and dword [ebp - 0x34], 0
push ecx
mov ecx, esi
mov dword [ebp - 0x5c], 0x6676c0
mov dword [ebp - 0x54], 0x66cd98
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edi
call dword [eax + 0x94]
cmp dword [ebp - 0x34], 0
jne 0x573117
cmp dword [ebp + 0x10], 0
jne 0x572f95
cmp dword [esi + 0x264], 0
jne 0x572f88
cmp dword [esi + 0x260], 0
je 0x572fc5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x572fc5
cmp edi, 0xffffffff
je 0x5730ec
imul ecx, edi, 0xc
xor eax, eax
push edi
add ecx, dword [esi + 0x26c]
cmp dword [ecx + 8], eax
sete al
mov dword [ecx + 8], eax
mov ecx, esi
mov dword [esi + 0x220], edi
call fcn.005735c5
jmp 0x5730ec
cmp dword [esi + 0x264], 0
jne 0x572fdb
cmp dword [esi + 0x260], 0
je 0x573071
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x573071
cmp edi, 0xffffffff
je 0x5730ec
xor eax, eax
cmp ebx, 0xffffffff
cmovne eax, ebx
mov ebx, eax
mov eax, edi
cmp ebx, edi
mov ecx, ebx
cmovg eax, ebx
cmp eax, ebx
mov dword [ebp - 8], eax
cmove ecx, edi
and dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
mov ecx, esi
call fcn.00572800
test eax, eax
jle 0x5730ec
mov edi, dword [ebp + 0x10]
mov dword [ebp + 8], ebx
xor ebx, ebx
mov eax, dword [esi + 0x26c]
add eax, ebx
mov ecx, dword [eax + 8]
cmp edi, dword [ebp - 4]
jl 0x57304c
cmp edi, dword [ebp - 8]
jg 0x57304c
mov dword [eax + 8], 1
jmp 0x573050
and dword [eax + 8], 0
cmp ecx, dword [eax + 8]
je 0x57305d
push edi
mov ecx, esi
call fcn.005735c5
mov ecx, esi
inc edi
add ebx, 0xc
call fcn.00572800
cmp edi, eax
jl 0x57302e
mov edi, dword [ebp + 0xc]
jmp 0x5730e9
or dword [esi + 0x220], 0xffffffff
mov ecx, esi
xor ebx, ebx
call fcn.00572800
test eax, eax
jle 0x5730c5
xor ecx, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + 0x26c]
cmp ebx, edi
je 0x5730b0
mov edx, dword [eax + ecx + 8]
test edx, edx
je 0x5730b0
and dword [eax + ecx + 8], 0
test edx, edx
je 0x5730b0
push ebx
mov ecx, esi
call fcn.005735c5
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
inc ebx
mov dword [ebp + 0xc], ecx
mov ecx, esi
call fcn.00572800
mov ecx, dword [ebp + 0xc]
cmp ebx, eax
jl 0x57308a
cmp edi, 0xffffffff
je 0x5730e9
mov eax, dword [esi + 0x26c]
imul ecx, edi, 0xc
push edi
mov dword [eax + ecx + 8], 1
mov ecx, esi
mov dword [esi + 0x220], edi
call fcn.005735c5
mov ebx, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x30]
call fcn.0054ef0e
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov dword [ebp - 0x30], 0x6676c0
mov dword [ebp - 0x28], 0x66ce04
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
call dword [eax + 0x94]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x574bd8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x78
pop ecx
mov ax, word [edi + 0x210]
add ax, word [ebp + 0xc]
cwde
cdq
idiv ecx
movzx eax, ax
mov dword [ebp + 0xc], eax
cwde
mov word [edi + 0x210], dx
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
xor eax, eax
cmp ax, bx
jge 0x574c7e
xor ecx, ecx
cmp word [ebp + 0xc], ax
setle cl
xor edx, edx
mov dword [ebp - 4], ecx
inc edx
mov eax, dword [edi]
push 0
push ecx
push edx
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
je 0x574c46
mov ecx, edi
call fcn.005760ad
mov ecx, dword [ebp - 4]
inc esi
push 1
pop edx
cmp si, bx
jl 0x574c21
cmp si, bx
jge 0x574c7e
push dword [ebp + 0x14]
or eax, 0xffffffff
mov ecx, ebx
push dword [ebp + 0x10]
sub ecx, esi
cmp word [ebp + 0xc], 0
push 1
pop edx
cmovg eax, edx
movsx ecx, cx
cwde
imul ecx, eax
movsx eax, cx
mov ecx, edi
imul eax, eax, 0x78
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.00556955
test bx, bx
je 0x574cbd
mov ecx, edi
call fcn.005548a9
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
movzx edx, word [ebp + 0x14]
mov edi, eax
movzx ecx, word [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
shl edx, 0x10
or edx, ecx
push edx
push dword [ebp + 8]
push 0x200
push edi
call esi
push 0x2000001
push edi
push 0x20
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x577af3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
mov edi, ecx
sub eax, 9
je 0x577b54
sub eax, 1
je 0x577b36
sub eax, 3
je 0x577b36
test dword [edi + 0x370], 0x2000
je 0x577b6f
push esi
call fcn.005f59cc
pop ecx
test eax, eax
jne 0x577b6f
cmp esi, 0x2d
je 0x577b6f
cmp esi, 0x2e
je 0x577b6f
cmp esi, 0x2c
je 0x577b6f
jmp 0x577b8a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x577b6f
test dword [edi + 0x370], 0x1000
jmp 0x577b6d
test byte [edi + 0x374], 0x80
jne 0x577b6f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x577b8a
mov eax, dword [edi + 0x380]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x577df7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x2c]
push edi
push esi
call fcn.0054ef0e
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 0x2c], 0x6676c0
mov dword [ebp - 0x24], 0x66d1b0
mov byte [ebp - 4], bl
mov dword [ebp - 0xc], edi
call dword [eax + 0x94]
cmp byte [ebp - 4], bl
jne 0x577e60
cmp edi, 0xd
jne 0x577e65
test dword [esi + 0x370], 0x1000
jne 0x577e65
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x577e65
mov dword [esi + 0x10], ebx
jmp 0x577e7f
mov eax, dword [esi + 0x380]
push ebx
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x57ba9b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 9
je 0x57baa8
xor eax, eax
jmp 0x57bad6
push dword [ecx + 4]
call fcn.0057b18c
pop ecx
test eax, eax
je 0x57bac3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x98]
test al, 2
jne 0x57baa4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor eax, 0x8000
shr eax, 0xf
pop ebp
ret 4
Function at 0x57bbc4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.0057ba9b
test eax, eax
je 0x57bbf9
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, ebx
and al, 1
movzx eax, al
push eax
call fcn.0057b647
xor eax, eax
inc eax
jmp 0x57bcf6
push esi
push dword [ebx + 4]
call fcn.0057b18c
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
test esi, esi
je 0x57bca3
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
je 0x57bca3
cmp edi, 0x25
je 0x57bc33
cmp edi, 0x27
je 0x57bc41
cmp edi, 0x26
je 0x57bc33
cmp edi, 0x28
jne 0x57bca3
cmp edi, 0x27
je 0x57bc41
cmp edi, 0x28
je 0x57bc41
push 2
jmp 0x57bc43
push 3
pop edi
jmp 0x57bc51
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x57bc8d
push edi
mov ecx, esi
call fcn.005550d5
mov esi, eax
test esi, esi
jne 0x57bc46
mov ecx, dword [ebp - 4]
cmp edi, 3
setne al
push eax
call fcn.00554dcb
mov ecx, eax
jmp 0x57bc80
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x57bc8d
push edi
mov ecx, esi
call fcn.005550d5
mov esi, eax
test esi, esi
jne 0x57bc72
jmp 0x57bc9e
push 1
mov ecx, esi
call fcn.004b9ff0
push eax
mov ecx, ebx
call fcn.0057bf49
xor eax, eax
inc eax
jmp 0x57bcf5
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x12
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
shr eax, 0xf
lea ecx, [ebp + 8]
and al, 1
movzx eax, al
push eax
push edi
call fcn.00599032
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.0057bd4a
xor ebx, ebx
lea ecx, [ebp + 8]
test al, al
setne bl
call fcn.00414520
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5837d9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.005e0dd0
add esp, 0xc
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x583834
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x583848
cmp byte [ebp - 6], 1
jne 0x583848
cmp dword [ebp - 0x11c], 6
jne 0x583848
xor eax, eax
inc eax
jmp 0x58384a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00545b50
mov esp, ebp
pop ebp
ret
Function at 0x58cc5a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
push 0x12
call esi
push 0x11
mov edi, eax
call esi
and eax, 0x8000
push 0x10
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
and eax, 0x8000
and edi, 0x8000
jne 0x58ccbd
test ecx, ecx
jne 0x58cca3
test eax, eax
jne 0x58cc9c
inc eax
jmp 0x58ccf1
push 2
pop eax
push 4
jmp 0x58ccf0
test eax, eax
jne 0x58ccae
push 4
pop eax
push 2
jmp 0x58ccf0
push 6
pop eax
push 0x10
mov word [ebx + 0x170], ax
pop eax
jmp 0x58ccf8
test ecx, ecx
jne 0x58cccf
test eax, eax
jne 0x58cccb
push 8
pop eax
inc ecx
jmp 0x58ccf1
test ecx, ecx
je 0x58ccde
test eax, eax
jne 0x58ccda
push 0x40
pop eax
push 3
jmp 0x58ccf0
test ecx, ecx
jne 0x58cce9
test eax, eax
je 0x58cce9
push 0x20
pop eax
push 5
jmp 0x58ccf0
mov eax, 0x80
push 7
pop ecx
mov word [ebx + 0x170], cx
test word [ebx + 0x174], ax
je 0x58cd0f
mov ax, word [ebx + 0x176]
mov word [ebx + 0x170], ax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0054ef0e
mov ax, word [ebx + 0x170]
lea ecx, [ebp - 0x28]
mov word [ebp - 6], ax
mov ax, word [ebx + 0x172]
mov word [ebp - 8], ax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
mov dword [ebp - 0x28], 0x6676c0
mov dword [ebp - 0x20], 0x67023c
call dword [eax + 0x94]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x599158
Capabilities:
Log keystrokes
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x6dc0e4]
push esi
mov esi, dword [ebp + 8]
movzx edx, cx
mov dword [esi], eax
cmp edx, 0x25
ja 0x5991ec
je 0x5991e2
mov eax, edx
sub eax, 0xd
je 0x5991d8
sub eax, 0xe
je 0x5991ce
sub eax, 5
je 0x5991c4
sub eax, 1
je 0x5991ba
sub eax, 1
je 0x5991b0
sub eax, 1
je 0x5991a6
sub eax, 1
jne 0x599225
push str.Home
jmp 0x59934c
push 0x671c7c
jmp 0x59934c
push str.PageDown
jmp 0x59934c
push str.PageUp
jmp 0x59934c
push str.Space
jmp 0x59934c
push 0x671c30
jmp 0x59934c
push 0x671c38
jmp 0x59934c
push str.Left
jmp 0x59934c
mov eax, edx
sub eax, 0x26
je 0x599347
sub eax, 1
je 0x599340
sub eax, 1
je 0x599339
dec eax
sub eax, 1
je 0x599332
sub eax, 3
je 0x59932b
sub eax, 1
je 0x599324
cmp cx, 0x30
jb 0x599231
cmp cx, 0x39
jbe 0x59923a
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x599252
movzx eax, cx
mov ecx, esi
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
call fcn.0045e970
jmp 0x599353
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x599266
lea eax, [edx - 0x60]
push eax
push str.Num__d
jmp 0x5992a8
cmp cx, 0x6a
jne 0x599276
push 0x671ce0
jmp 0x59934c
cmp cx, 0x6b
jne 0x599286
push str.Num_
jmp 0x59934c
cmp cx, 0x6e
jne 0x599296
push str.Num_Del
jmp 0x59934c
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x5992d1
lea eax, [edx - 0x6f]
push eax
push 0x671d08
lea eax, [ebp + 8]
push eax
push esi
call fcn.004bb090
mov ecx, dword [ebp + 8]
add esp, 0x10
add ecx, 0xfffffff4
cmp ecx, dword [0x6dc0e0]
je 0x599353
call fcn.0045f5f0
jmp 0x599353
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov cl, al
movsx eax, cl
cmp eax, 0x3d
jg 0x5992fc
je 0x59930b
cmp eax, 0x27
je 0x59930b
cmp eax, 0x2b
jle 0x599353
cmp eax, 0x2f
jle 0x59930b
cmp eax, 0x3b
je 0x59930b
jmp 0x599353
cmp eax, 0x5b
jl 0x599353
cmp eax, 0x5d
jle 0x59930b
cmp eax, 0x60
jne 0x599353
movsx ax, cl
mov ecx, esi
movzx eax, ax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
call fcn.004c0740
jmp 0x599353
push str.Delete
jmp 0x59934c
push str.Insert
jmp 0x59934c
push str.Print
jmp 0x59934c
push str.Down
jmp 0x59934c
push str.Right
jmp 0x59934c
push 0x671c44
mov ecx, esi
call fcn.00492a30
mov eax, esi
pop esi
pop ebp
ret

Function at 0x5aadca
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5aae31
push esi
call fcn.005ab0ad
pop ecx
test al, al
jne 0x5aae31
push ebx
push edi
lea eax, [ebp + 8]
push eax
push esi
call fcn.005ab04c
pop ecx
mov esi, eax
mov ebx, 0x1505
pop ecx
mov ecx, dword [ebp + 8]
xor eax, eax
and dword [ebp + 8], 0
add ecx, esi
mov edi, ecx
sub edi, esi
cmp esi, ecx
cmova edi, eax
test edi, edi
je 0x5aae2a
mov al, byte [esi]
push eax
call fcn.005b6315
imul ebx, ebx, 0x21
pop ecx
movsx ecx, al
mov eax, dword [ebp + 8]
xor ebx, ecx
inc esi
inc eax
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x5aae0d
pop edi
movzx eax, bl
pop ebx
jmp 0x5aae33
xor eax, eax
pop esi
pop ebp
ret
Function at 0x5abb41
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5abb62
cmp dword [esi + 0x8c], 0
je 0x5abb62
push 2
push 3
push esi
call fcn.005b67e5
add esp, 0xc
push dword [ebp + 0xc]
call fcn.005b6bff
pop ecx
test esi, esi
je 0x5abb82
cmp dword [esi + 0x8c], 0
je 0x5abb82
push 3
push esi
call fcn.005b6820
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x5b3d6f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x608], edi
je 0x5b3dae
push 1
push esi
call fcn.005a77d2
push dword [esi + 0x59c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [esi + 0x608]
push 0
push esi
mov edi, eax
call fcn.005a77d2
add esp, 0x24
jmp 0x5b3de4
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x5b3de4
push dword [esi + 0x598]
imul eax, eax, 3
push 1
push 2
add eax, 0x67482c
push eax
call fcn.005f05c3
push dword [esi + 0x598]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.005f05c3
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x5b41b4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebx + eax*4 + 0x1a8]
push eax
push ebx
mov dword [ebp - 0x88], ecx
call fcn.005b4668
pop ecx
pop ecx
push 0
push dword [ebp + 0x14]
push edi
push esi
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov eax, dword [ebp - 0x88]
and dword [eax], 0
cmp esi, 0xffffffff
jne 0x5b425f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x5b4229
mov eax, dword [ebp - 0x88]
xor esi, esi
mov dword [eax], 0x51
jmp 0x5b425f
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.005d68b8
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.005b3dea
mov eax, dword [ebx]
add esp, 0x18
mov dword [eax + 0xcac], edi
mov eax, dword [ebp - 0x88]
mov dword [eax], 0x37
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00545b50
mov esp, ebp
pop ebp
ret
Function at 0x5b4668
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
add edi, edi
mov eax, dword [esi + 0x2a8]
mov edx, dword [esi + ecx*4 + 0x1a8]
mov dword [ebp + 8], edx
mov ebx, dword [esi + edi*8 + 0x1d0]
sub ebx, dword [esi + edi*8 + 0x1d4]
test byte [eax + 0x40], 3
je 0x5b4750
cmp dword [esi + ecx*4 + 0x1bc], 0x5b40ef
jne 0x5b4750
xor eax, eax
cmp dword [esi + edi*8 + 0x1cc], eax
je 0x5b46c4
test ebx, ebx
je 0x5b4750
push eax
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
call fcn.005b398f
add esp, 0x14
cmp eax, 0xffffffff
je 0x5b4750
test al, 1
je 0x5b4750
xor ecx, ecx
cmp dword [esi + edi*8 + 0x1cc], ecx
jne 0x5b472b
mov eax, dword [esi]
mov eax, dword [eax + 0x8e4]
add eax, eax
push eax
mov dword [esi + edi*8 + 0x1d0], eax
call dword [0x6dc26c]
mov ebx, dword [esi + edi*8 + 0x1d0]
pop ecx
xor ecx, ecx
mov dword [esi + edi*8 + 0x1cc], eax
mov dword [esi + edi*8 + 0x1d4], ecx
mov dword [esi + edi*8 + 0x1d8], ecx
test eax, eax
jne 0x5b472b
mov dword [esi + edi*8 + 0x1d0], ecx
jmp 0x5b4750
mov eax, dword [esi + edi*8 + 0x1cc]
add eax, dword [esi + edi*8 + 0x1d4]
push ecx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x5b4750
add dword [esi + edi*8 + 0x1d4], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5b4814
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test byte [eax + 0x1f8], 1
je 0x5b4832
push eax
call fcn.005ae06a
pop ecx
test eax, eax
jne 0x5b484e
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x1a8]
cmp eax, 0xffffffff
je 0x5b482e
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x5b482a
mov al, 1
pop ebp
ret

Function at 0x5b4f2f
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
mov eax, dword [0x6e1b68]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 0xc], 4
push esi
push 2
pop esi
test eax, eax
jne 0x5b4f76
push 3
push esi
push eax
push 6
call fcn.005b608b
add esp, 0x10
test al, al
je 0x5b4f6e
mov dword [0x6e1b68], esi
jmp 0x5b4fb6
xor eax, eax
inc eax
mov dword [0x6e1b68], eax
cmp eax, esi
je 0x5b4fb6
push ebx
lea eax, [ebp - 0xc]
mov esi, 0x1001
push eax
lea eax, [ebp - 4]
mov ebx, 0xffff
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x5b4fa4
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x5b4fb5
push 4
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5b518a
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
cmp dword [ebx + 0x90], 2
mov edi, dword [ebx]
mov dword [ebp - 0x18c], edi
je 0x5b5323
test dword [ebx + 0x284], 0x8000002
push esi
jne 0x5b531b
lea eax, [ebp - 0x188]
mov esi, 0x80
push eax
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x5b5211
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.005d68b8
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
jmp 0x5b5265
push esi
lea eax, [ebp - 0x104]
mov dword [ebp - 0x188], esi
push 0
push eax
call fcn.005e0dd0
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x5b526b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.005d68b8
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
jmp 0x5b5311
lea eax, [ebx + 0x138]
push eax
lea esi, [ebx + 0x10a]
lea eax, [ebp - 0x184]
push esi
push eax
call fcn.005b5776
add esp, 0xc
test al, al
jne 0x5b52b7
call fcn.005e740f
mov esi, eax
call fcn.005e740f
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push dword [esi]
call fcn.005d68b8
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
jmp 0x5b530b
push 0xb
pop ecx
lea edi, [ebx + 0x5c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebx + 0x13c]
push eax
lea eax, [ebp - 0x104]
movsw word es:[edi], word [esi]
push eax
call fcn.005b5776
add esp, 0xc
test al, al
jne 0x5b531b
call fcn.005e740f
mov esi, eax
call fcn.005e740f
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push dword [esi]
call fcn.005d68b8
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push dword [ebp - 0x18c]
call fcn.005b3dea
add esp, 0x1c
jmp 0x5b5322
push ebx
call fcn.005b4ebc
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00545b50
mov esp, ebp
pop ebp
ret
Function at 0x5b5ae9
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 4
mov eax, dword [esi + 0xa90]
shr eax, 0xd
and eax, 1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x5b5b39
push dword [ebp + 0xc]
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.005b3ec0
add esp, 0xc
jmp 0x5b5baa
push dword [esi + 0xa50]
mov dword [ebp - 0x10], 1
call fcn.005b5d62
push dword [esi + 0xa54]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.005b5d62
pop ecx
pop ecx
imul eax, eax, 0x3e8
xor ecx, ecx
push ecx
push ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push ecx
push ecx
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x5b5baa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 0xc]
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.005b3ec0
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00545b50
mov esp, ebp
pop ebp
ret

Function at 0x5b5bb9
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push 4
inc ecx
mov esi, dword [eax]
lea eax, [ebp - 0x88]
push eax
push ecx
push 6
push dword [ebp + 0xc]
mov dword [ebp - 0x88], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x5b5c1d
push 0x80
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.005d68b8
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.005b3ec0
add esp, 0x18
jmp 0x5b5c2a
push str.TCP_NODELAY_set_n
push esi
call fcn.005b3ec0
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00545b50
mov esp, ebp
pop ebp
ret

Function at 0x5b5d48
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0060347a