joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417531
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00432d9e
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x417568
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00417587
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x41d2d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x41d319
call fcn.00432d9e
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41d319
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x41d335
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00432f4d
mov ebx, eax
test edi, edi
je 0x41d333
test esi, esi
je 0x41d333
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41dd51
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41de0f
cmp dword [esi + 0x20], 0
je 0x41de0f
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41de0f
cmp dword [ebp + 8], 0
je 0x41de0f
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00432d9e
push 0x5c0f98
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41dde0
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41de0f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0044e4c4
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x41de00
test edi, edi
je 0x41de00
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x41de0b
mov ecx, esi
call fcn.0041daf3
mov eax, ebx
jmp 0x41de11
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4223b0
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5b0119
call fcn.0054fccd
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x4223d6
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x422436
call fcn.00416de3
push eax
lea ecx, [ebp - 0x10]
call fcn.00404040
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5bea70]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00596ac8
push eax
call fcn.00404100
add esp, 0x14
test esi, esi
je 0x422429
push esi
call fcn.00596ad3
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404680
mov eax, ebx
call fcn.0054fc96
ret 8

Function at 0x42f2e4
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x42f337
push esi
push dword [ebp + 8]
call fcn.0042f4cd
mov edi, eax
test edi, edi
je 0x42f332
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42f332
mov eax, dword [ebp - 8]
jmp 0x42f349
mov eax, dword [ebp + 0x10]
jmp 0x42f349
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x450abf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x450b15
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x450aee
call fcn.00418dac
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x450b03
call fcn.00418dac
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x450b15
call fcn.00418dac
call fcn.00432d9e
cmp dword [eax + 0x3c], 0
je 0x450b2a
push edi
mov ecx, ebx
call fcn.004501ef
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00450cfc
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x450b53
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x450b5f
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4592cd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x4592e7
call fcn.00432d9e
mov esi, dword [eax + 0xc]
push 0x5c4b2c
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x45933d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x45933d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x45931c
xor esi, esi
jmp 0x459332
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00459346
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x45933f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4c5b8d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.004222f6
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.004c5da6
cmp esi, 3
je 0x4c5bcb
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x4c5c14
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4c5bee
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00416abf
jmp 0x4c5bff
push 0xff
mov ecx, esi
call fcn.004047d0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00413ef0
jmp 0x4c5c38
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4c5c38
push dword [esi]
push dword [ebp - 4]
call fcn.00435b5e
pop edi
pop esi
leave
ret 0xc

Function at 0x4c5cfd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004c5da6
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4c5d45
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00416abf
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00413ef0
jmp 0x4c5d50
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00435b5e
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4c815a
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.005359bc
call fcn.00432df2
cmp dword [eax + 0x14], 0
jne 0x4c8175
mov ecx, esi
pop esi
jmp fcn.004c7485
pop esi
ret
Function at 0x517777
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.005983da
pop ecx
test eax, eax
jne 0x5177b9
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0042f89a
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x51777f
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x531b94
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401dd0
call fcn.00432df2
cmp dword [eax + 0x14], 0
jne 0x531baf
mov ecx, esi
pop esi
jmp fcn.00531410
pop esi
ret

Function at 0x55261d
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x552664
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x55265e
shr eax, 8
cmp al, 2
jne 0x55265e
call fcn.00556292
jmp 0x552667
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f54f
leave
ret

Function at 0x556abd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x556adb
cmp dword [esi + 0x48], 0
je 0x556adb
push 2
push 3
push esi
call fcn.00568428
add esp, 0xc
push dword [ebp + 0xc]
call fcn.005608b2
pop ecx
test esi, esi
je 0x556af8
cmp dword [esi + 0x48], 0
je 0x556af8
push 3
push esi
call fcn.00568460
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x55edea
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x190]
call fcn.0055f08d
pop ecx
pop ecx
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov esi, eax
and dword [ebx], 0
cmp esi, 0xffffffff
jne 0x55ee64
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x2733
jne 0x55ee3c
xor esi, esi
mov dword [ebx], 0x51
jmp 0x55ee64
push eax
push edi
call fcn.0056a7b8
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.0055eacb
mov eax, dword [edi]
add esp, 0x14
mov ecx, dword [ebp + 8]
mov dword [eax + 0x4668], ecx
mov dword [ebx], 0x37
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x55f08d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
add edi, edi
mov eax, dword [esi + 0x390]
mov ebx, dword [esi + edi*8 + 0x1b8]
sub ebx, dword [esi + edi*8 + 0x1bc]
test byte [eax + 0x3c], 3
je 0x55f16f
cmp dword [esi + ecx*4 + 0x1a4], 0x55ed59
jne 0x55f16f
xor edx, edx
cmp dword [esi + edi*8 + 0x1b4], edx
je 0x55f0df
test ebx, ebx
je 0x55f16f
mov eax, dword [esi + ecx*4 + 0x190]
push edx
push edx
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
mov dword [ebp + 0xc], eax
call fcn.0055e4dc
add esp, 0x14
cmp eax, 0xffffffff
je 0x55f16f
test al, 1
je 0x55f16f
mov ecx, dword [esi + edi*8 + 0x1b4]
test ecx, ecx
jne 0x55f144
mov eax, 0x8000
push eax
mov dword [esi + edi*8 + 0x1b8], eax
call dword [0x624060]
and dword [esi + edi*8 + 0x1bc], 0
and dword [esi + edi*8 + 0x1c0], 0
mov ebx, dword [esi + edi*8 + 0x1b8]
pop ecx
mov ecx, eax
mov dword [esi + edi*8 + 0x1b4], ecx
test ecx, ecx
je 0x55f167
mov eax, dword [esi + edi*8 + 0x1bc]
push 0
push ebx
add eax, ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x55f16f
add dword [esi + edi*8 + 0x1bc], eax
jmp 0x55f16f
and dword [esi + edi*8 + 0x1b8], 0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x55f174
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x55f19c
push dword [esi + 0x11c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
jmp 0x55f1d4
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x55f1d2
push dword [esi + 0x118]
imul eax, eax, 3
push 1
push 2
add eax, 0x5ed78c
push eax
call fcn.0058a053
push dword [esi + 0x118]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0058a053
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x55f27f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax + 0x1d4], 0
je 0x55f29d
push eax
call fcn.0040d110
pop ecx
test eax, eax
jne 0x55f2b9
xor al, al
pop ebp
ret
mov ecx, dword [eax + 0x190]
cmp ecx, 0xffffffff
je 0x55f299
push 2
push 1
lea edx, [ebp + 0xb]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x55f295
mov al, 1
pop ebp
ret

Function at 0x55f828
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
mov eax, dword [0x62cb1c]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 0xc], 4
push esi
push 2
pop esi
test eax, eax
jne 0x55f86f
push 3
push esi
push eax
push 6
call fcn.00569c2c
add esp, 0x10
test al, al
je 0x55f867
mov dword [0x62cb1c], esi
jmp 0x55f8af
xor eax, eax
inc eax
mov dword [0x62cb1c], eax
cmp eax, esi
je 0x55f8af
push ebx
lea eax, [ebp - 0xc]
mov esi, 0x1001
push eax
lea eax, [ebp - 4]
mov ebx, 0xffff
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x55f89d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x55f8ae
push 4
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
pop ebx
pop esi
leave
ret

Function at 0x55f96f
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
xor ecx, ecx
push eax
mov esi, dword [edi]
inc ecx
push ecx
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x55f9b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0056a7b8
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0055eb66
add esp, 0x14
jmp 0x55f9c0
push str.TCP_NODELAY_set_n
push esi
call fcn.0055eb66
pop ecx
pop ecx
pop edi
pop esi
pop ebp
ret
Function at 0x55fa97
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x55fbf4
cmp byte [edi + 0x356], 0
push esi
jne 0x55fbec
cmp byte [edi + 0x372], 0
jne 0x55fbec
lea eax, [ebp - 0x108]
mov esi, 0x80
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x55fb1a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0056a7b8
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
jmp 0x55fbe1
push esi
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], esi
push 0
push eax
call fcn.00583860
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x55fb65
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0056a7b8
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x55fbe1
lea eax, [edi + 0x130]
push eax
lea esi, [edi + 0x102]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00560042
add esp, 0xc
test al, al
jne 0x55fb9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0056a7b8
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
jmp 0x55fbe1
push 0x2e
lea eax, [edi + 0x58]
push esi
push eax
call fcn.005839c0
lea eax, [edi + 0x164]
push eax
lea eax, [edi + 0x134]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00560042
add esp, 0x18
test al, al
jne 0x55fbec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0056a7b8
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0055eacb
add esp, 0x18
jmp 0x55fbf3
push edi
call fcn.0055f7b2
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0054f54f
leave
ret
Function at 0x5603ae
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 4
cmp byte [esi + 0x48c], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x5603fd
push dword [ebp + 0xc]
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0055eb66
add esp, 0xc
jmp 0x56046e
push dword [esi + 0x490]
mov dword [ebp - 0x10], 1
call fcn.0056761e
push dword [esi + 0x494]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.0056761e
pop ecx
pop ecx
imul eax, eax, 0x3e8
xor ecx, ecx
push ecx
push ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push ecx
push ecx
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x56046e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 0xc]
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0055eb66
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0054f54f
leave
ret

Function at 0x567602
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.0056762b
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005a4cd8
add esp, 0x10
pop ebp
ret

Function at 0x569b26
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x5ef50c
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
je 0x569c29
push ebx
push edi
push 0x5ef520
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp + 8]
mov ebx, eax
push 0x5ef530
push edi
call fcn.00597cb4
pop ecx
pop ecx
test eax, eax
je 0x569b78
test ebx, ebx
je 0x569b6f
push 8
jmp 0x569b93
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x569b97
test ebx, ebx
je 0x569b9e
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x569b9e
push 0x800
push esi
push edi
call ebx
mov esi, eax
jmp 0x569c25
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 4], eax
test eax, eax
je 0x569c25
push edi
call fcn.00596ad3
mov ecx, dword [ebp - 4]
add ecx, eax
lea ecx, [ecx*2 + 2]
push ecx
call dword [0x624060]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x569c1d
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x569c1d
push 0x6029b4
push edi
call fcn.00596ad3
pop ecx
lea eax, [edi + eax*2]
push eax
call fcn.0059dd18
pop ecx
pop ecx
push dword [ebp + 8]
push edi
call fcn.00596ad3
pop ecx
lea eax, [edi + eax*2]
push eax
call fcn.0059dd18
pop ecx
pop ecx
test ebx, ebx
je 0x569c14
push 8
push esi
push edi
call ebx
jmp 0x569c1b
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push edi
call dword [0x624064]
pop ecx
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret
Function at 0x569d92
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push esi
xor esi, esi
and dword [ebp - 0x10], esi
and dword [eax], esi
lea eax, [ebp - 0xc]
push edi
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
test edi, edi
jne 0x569efa
push ebx
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x569ee6
cmp dword [ebx + 4], 2
jne 0x569dda
push 0x10
jmp 0x569de6
cmp dword [ebx + 4], 0x17
jne 0x569e8e
push 0x1c
cmp dword [ebx + 0x18], 0
pop eax
mov dword [ebp - 8], eax
je 0x569e8e
cmp dword [ebx + 0x10], 0
jbe 0x569e8e
cmp dword [ebx + 0x10], eax
jb 0x569e8e
push 0x20
call dword [0x624060]
mov esi, eax
pop ecx
test esi, esi
je 0x569ebe
mov ecx, dword [ebx]
mov dword [esi], ecx
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [esi + 8], ecx
xor ecx, ecx
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 8]
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], ecx
call dword [0x624060]
mov dword [esi + 0x18], eax
pop ecx
test eax, eax
je 0x569eb2
push dword [ebp - 8]
push dword [ebx + 0x18]
push eax
call fcn.005839c0
add esp, 0xc
cmp dword [ebx + 0x14], 0
je 0x569e76
push dword [ebx + 0x14]
call dword [0x62406c]
mov dword [esi + 0x14], eax
pop ecx
test eax, eax
je 0x569e9b
mov eax, dword [ebp - 4]
test eax, eax
cmove eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x569e8b
mov dword [eax + 0x1c], esi
mov dword [ebp - 0x10], esi
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x569dd0
jmp 0x569ec1
push 8
pop edi
push dword [esi + 0x18]
call dword [0x624064]
push esi
call dword [0x624064]
pop ecx
pop ecx
jmp 0x569ec1
push 8
pop edi
push esi
call dword [0x624064]
jmp 0x569eaf
push 8
pop edi
cmp dword [ebp - 0xc], 0
je 0x569ed0
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov esi, dword [ebp - 4]
test edi, edi
je 0x569ee2
push esi
call fcn.00569d5d
pop ecx
xor esi, esi
jmp 0x569ef2
test esi, esi
jne 0x569ef2
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x56afe4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.005968fc
add esp, 0x18
test eax, eax
je 0x56b004
cmp eax, 0xffffffff
jne 0x56b006
xor eax, eax
pop ebp
ret
Function at 0x56b320
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0xf0000040
push 1
xor edi, edi
lea eax, [ebp - 4]
push edi
push edi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x56b346
push 2
pop eax
jmp 0x56b36e
push esi
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x56b35f
push 2
pop esi
jmp 0x56b361
mov esi, edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop edi
leave
ret