joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510dda
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x12c
lea ebx, [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.asio_58CCDC44_6264_4842_90C2_F3C545CB8AA7__u__p
mov dword [esp + 4], pe_nt_image_headers32
call dword [sym.imp.msvcrt.dll__snwprintf]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
sub esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
test ebx, ebx
jne 0x510e3f
call ebp
jmp 0x510eab
cmp eax, 0xb7
jne 0x510e59
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push ecx
cmp byte [esi], 0
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jne 0x510e99
lea eax, [esi + 4]
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
push edx
push edx
jne 0x510e96
call ebp
mov dword [esp], ebx
mov esi, eax
call edi
push ecx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
push ebx
jmp 0x510eab
mov byte [esi], 1
mov dword [esp], ebx
call edi
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
xor eax, eax
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x510ef0
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, ecx
sub esp, 0x28
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp], 2
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebx + 4]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
xor eax, eax
lock xadd dword [0x72cb70], eax
test eax, eax
mov eax, dword [ebx]
je 0x510f5b
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x510f8a
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x50ec6c
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
push eax
add esp, 0x28
pop ebx
ret

Function at 0x510f92
Capabilities:
Initialize winsock library

Disassembly:
push ebx
shl ecx, 8
movzx edx, dl
or edx, ecx
mov ebx, eax
sub esp, 0x1a8
movzx edx, dx
lea eax, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
push edx
push edx
xchg dword [ebx + 4], eax
add esp, 0x1a8
pop ebx
ret
push ebx
mov eax, dword [esp + 8]
mov ebx, 1
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
lock xadd dword [eax], ebx
test ebx, ebx
jne 0x510fb8
pop ebx
movzx ecx, cl
movzx edx, dl
jmp 0x50ed80
pop ebx
ret
Function at 0x51203c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x3c
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov dword [esp], edi
call fcn.00510b78
mov ecx, dword [esi + 4]
push edx
call fcn.0062032c
mov eax, ebp
test al, al
je 0x512080
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
jmp 0x51210a
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x51209c
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2719
jmp 0x51210a
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov dword [esp], eax
mov dword [esp + 0x10], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 4], edx
call dword [sym.imp.WS2_32.dll_WSASend]
sub esp, 0x1c
mov edi, eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x4d2
jne 0x5120f0
mov eax, 0x274d
test edi, edi
mov ecx, dword [esi + 4]
je 0x512117
cmp eax, 0x3e5
je 0x512117
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.00511df6
sub esp, 0xc
jmp 0x512120
mov dword [esp], ebx
call fcn.00511d9c
push eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18

Function at 0x512204
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x3c
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov dword [esp], edi
call fcn.00510b78
mov ecx, dword [esi + 4]
push edx
call fcn.0062032c
mov eax, ebp
test al, al
je 0x512248
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
jmp 0x5122e9
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x512267
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2719
jmp 0x5122e9
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov dword [esp], eax
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x28]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 4], edx
call dword [sym.imp.WS2_32.dll_WSARecv]
sub esp, 0x1c
mov edi, eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x40
je 0x5122ca
cmp eax, 0x4d2
jne 0x5122cf
mov eax, 0x274d
jmp 0x5122cf
mov eax, 0x2746
test edi, edi
mov ecx, dword [esi + 4]
je 0x5122f6
cmp eax, 0x3e5
je 0x5122f6
mov edx, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.00511df6
sub esp, 0xc
jmp 0x5122ff
mov dword [esp], ebx
call fcn.00511d9c
push eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
Function at 0x51230a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x40
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x68]
mov dword [esp], edi
call fcn.00510b78
mov ecx, dword [esi + 4]
push edx
call fcn.0062032c
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x51234a
mov ecx, dword [esi + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2719
jmp 0x5123d0
mov edx, dword [esp + 0x60]
mov dword [esp + 0x38], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], ebx
mov dword [esp], eax
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x3c]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x38]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 4], edx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
sub esp, 0x24
mov edi, eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x4d2
jne 0x5123b6
mov eax, 0x274d
test edi, edi
mov ecx, dword [esi + 4]
je 0x5123dd
cmp eax, 0x3e5
je 0x5123dd
mov edx, dword [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.00511df6
sub esp, 0xc
jmp 0x5123e6
mov dword [esp], ebx
call fcn.00511d9c
push eax
add esp, 0x40
pop ebx
pop esi
pop edi
ret 0x1c

Function at 0x5127bb
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [esp + 0x40], 0xffffffff
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
jne 0x5127e8
call fcn.004e34b3
mov dword [ebx], 0x2719
mov dword [ebx + 4], eax
jmp 0x512871
mov eax, edi
mov esi, edi
test al, al
jne 0x512806
test byte [ebp], 1
je 0x512806
call fcn.004e34b3
mov dword [ebx], 0x2726
mov dword [ebx + 4], eax
jmp 0x512873
call fcn.00618a4c
mov eax, edi
mov dword [esp + 4], 0x8004667e
movzx eax, al
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
test eax, eax
js 0x512871
lea ecx, [esp + 0x18]
call fcn.00630950
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebx], eax
mov eax, edi
mov dword [ebx + 4], edx
test al, al
je 0x512866
or byte [ebp], 2
jmp 0x512873
and byte [ebp], 0xfd
mov esi, 1
jmp 0x512873
xor esi, esi
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x512a83
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [esp + 0x50]
call fcn.00618a4c
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSARecv]
sub esp, 0x1c
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
mov esi, eax
mov eax, dword [ebx]
cmp eax, 0x40
jne 0x512b03
call fcn.004e34b3
mov dword [ebx], 0x2746
jmp 0x512b15
cmp eax, 0x4d2
jne 0x512b18
call fcn.004e34b3
mov dword [ebx], 0x274d
mov dword [ebx + 4], eax
or eax, 0xffffffff
test esi, esi
jne 0x512b39
lea ecx, [esp + 0x28]
call fcn.00630950
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 4], edx
add esp, 0x34
pop ebx
pop esi
ret

Function at 0x512d04
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [esp + 0x50]
call fcn.00618a4c
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASend]
sub esp, 0x1c
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
mov esi, eax
mov eax, dword [ebx]
cmp eax, 0x40
jne 0x512d7c
call fcn.004e34b3
mov dword [ebx], 0x2746
jmp 0x512d8e
cmp eax, 0x4d2
jne 0x512d91
call fcn.004e34b3
mov dword [ebx], 0x274d
mov dword [ebx + 4], eax
or eax, 0xffffffff
test esi, esi
jne 0x512db2
lea ecx, [esp + 0x28]
call fcn.00630950
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], edx
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x512e11
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
sub esp, 0x44
mov ebx, dword [esp + 0x68]
call fcn.00618a4c
mov eax, dword [esp + 0x64]
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
sub esp, 0x24
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
mov esi, eax
mov eax, dword [ebx]
cmp eax, 0x40
jne 0x512e99
call fcn.004e34b3
mov dword [ebx], 0x2746
jmp 0x512eab
cmp eax, 0x4d2
jne 0x512eae
call fcn.004e34b3
mov dword [ebx], 0x274d
mov dword [ebx + 4], eax
or eax, 0xffffffff
test esi, esi
jne 0x512ecf
lea ecx, [esp + 0x38]
call fcn.00630950
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 4], edx
add esp, 0x44
pop ebx
pop esi
ret

Function at 0x512ed5
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
cmp ebp, 0xffffffff
jne 0x512f04
call fcn.004e34b3
mov dword [ebx], 0x2719
mov dword [ebx + 4], eax
or eax, 0xffffffff
jmp 0x512f6b
call fcn.00618a4c
mov eax, dword [esp + 0x58]
mov dword [esp + 8], edi
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
test eax, eax
js 0x512f6b
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
call fcn.00630950
cmp dword [esp + 0x58], 0x8004667e
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 4], edx
jne 0x512f6b
mov dl, byte [esi]
mov cl, dl
or edx, 1
and ecx, 0xfffffffc
cmp dword [edi], 0
cmove edx, ecx
mov byte [esi], dl
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x512f73
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x68]
mov ebp, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
call fcn.00618a4c
cmp dword [esp + 0x64], 0
jne 0x512fe0
test edi, edi
jne 0x512fe0
test ebp, ebp
jne 0x512fe0
test esi, esi
je 0x512fe0
mov eax, dword [esi + 4]
imul ecx, dword [esi], 0x3e8
mov esi, 0x3e8
cdq
idiv esi
add ecx, eax
jne 0x512fbc
mov ecx, 1
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
lea ecx, [esp + 0x38]
call fcn.00630950
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor eax, eax
jmp 0x513050
test esi, esi
je 0x512ffe
cmp dword [esi], 0
jne 0x512ffe
mov eax, dword [esi + 4]
lea edx, [eax - 1]
cmp edx, 0x3e6
ja 0x512ffe
mov dword [esi + 4], 0x3e8
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_select]
sub esp, 0x14
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
test eax, eax
js 0x513050
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], eax
call fcn.00630950
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
mov dword [ebx], esi
mov dword [ebx + 4], edi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x513058
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov edi, dword [esp + 0x160]
mov ebx, dword [esp + 0x164]
mov esi, dword [esp + 0x168]
cmp edi, 0xffffffff
jne 0x513089
call fcn.004e34b3
mov dword [esi], 0x2719
jmp 0x513104
lea ebp, [esp + 0x2c]
and bl, 1
mov eax, 0
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 1
cmove ebp, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.00618a4c
lea eax, [esp + 0x3c]
inc edi
mov dword [esp + 0x10], ebp
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_select]
sub esp, 0x14
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00618a28
cmp eax, 0
mov edi, eax
jne 0x513109
test bl, bl
je 0x51310b
call fcn.004e34b3
mov dword [esi], 0x2733
mov dword [esi + 4], eax
jmp 0x513121
jle 0x513121
lea ecx, [esp + 0x34]
call fcn.00630950
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], edx
add esp, 0x14c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5134dd
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov edi, dword [esp + 0x160]
mov ebx, dword [esp + 0x164]
mov esi, dword [esp + 0x168]
cmp edi, 0xffffffff
jne 0x51350e
call fcn.004e34b3
mov dword [esi], 0x2719
jmp 0x513589
lea ebp, [esp + 0x2c]
and bl, 1
mov eax, 0
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 1
cmove ebp, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.00618a4c
lea eax, [esp + 0x3c]
inc edi
mov dword [esp + 0x10], ebp
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call dword [sym.imp.WSOCK32.DLL_select]
sub esp, 0x14
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00618a28
cmp eax, 0
mov edi, eax
jne 0x51358e
test bl, bl
je 0x513590
call fcn.004e34b3
mov dword [esi], 0x2733
mov dword [esi + 4], eax
jmp 0x5135a6
jle 0x5135a6
lea ecx, [esp + 0x34]
call fcn.00630950
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], edx
add esp, 0x14c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x513f8a
Capabilities:
Connect socket

Disassembly:
push esi
push ebx
sub esp, 0x34
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x4c]
cmp esi, 0xffffffff
jne 0x513faf
call fcn.004e34b3
mov dword [ebx], 0x2719
mov dword [ebx + 4], eax
or eax, 0xffffffff
jmp 0x513ffe
call fcn.00618a4c
mov eax, dword [esp + 0x48]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_connect]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
test eax, eax
jne 0x513ffe
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
call fcn.00630950
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 4], edx
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x514004
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [esp + 0x60], 0xffffffff
mov edx, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov ebx, dword [esp + 0x78]
jne 0x514033
call fcn.004e34b3
mov dword [ebx], 0x2719
jmp 0x514050
cmp edi, 0xa5100000
sete al
cmp esi, 2
jne 0x51405b
test al, al
je 0x51405b
call fcn.004e34b3
mov dword [ebx], 0x2726
mov dword [ebx + 4], eax
or eax, 0xffffffff
jmp 0x514102
cmp esi, 1
jne 0x514098
test al, al
je 0x514098
cmp dword [esp + 0x74], 4
jne 0x514045
mov al, byte [edx]
mov cl, al
or eax, 4
and ecx, 0xfffffffb
cmp dword [ebp], 0
cmove eax, ecx
lea ecx, [esp + 0x38]
mov byte [edx], al
call fcn.00630950
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor eax, eax
jmp 0x514102
cmp edi, 0xffff
jne 0x5140ab
cmp esi, 0x80
jne 0x5140ab
or byte [edx], 8
call fcn.00618a4c
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_setsockopt]
sub esp, 0x14
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
test eax, eax
jne 0x514102
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], eax
call fcn.00630950
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
mov dword [ebx], esi
mov dword [ebx + 4], edi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5142c2
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x60]
mov eax, dword [esp + 0x68]
lea esi, [esp + 0x38]
mov ebx, dword [esp + 0x6c]
cmp edi, 0xffffffff
jne 0x5142f9
mov ecx, esi
xor ebp, ebp
call fcn.00630950
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx], eax
mov dword [ebx + 4], edx
jmp 0x514407
test al, al
je 0x514349
mov eax, dword [esp + 0x64]
test byte [eax], 8
je 0x514349
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00630950
lea eax, [esp + 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 8], 0xffff
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00514004
call fcn.00618a4c
mov eax, dword [sym.imp.WSOCK32.DLL_closesocket]
mov dword [esp], edi
mov dword [esp + 0x2c], eax
call eax
push ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
test eax, eax
mov ebp, eax
je 0x5142de
call fcn.004e34b3
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
mov dword [esp], ebx
mov dword [esp + 0x30], 0x2733
mov dword [esp + 4], eax
call fcn.006314e0
test al, al
je 0x5143de
mov dword [esp + 0x38], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x8004667e
mov dword [esp], edi
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
sub esp, 0xc
mov eax, dword [esp + 0x64]
and byte [eax], 0xfc
call fcn.00618a4c
mov dword [esp], edi
mov eax, dword [esp + 0x2c]
call eax
push edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
mov ebp, eax
jmp 0x5143ff
call fcn.004e34b3
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x38], 0x4d5
mov dword [esp + 0x3c], eax
call fcn.006314e0
test al, al
jne 0x514398
test ebp, ebp
je 0x5142de
add esp, 0x4c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x514908
Capabilities:
Get socket status

Disassembly:
push edi
push esi
xor edi, edi
push ebx
sub esp, 0x240
lea eax, [esp + 0x28]
mov esi, dword [esp + 0x250]
mov ebx, dword [esp + 0x254]
mov dword [esp + 0x38], 1
mov dword [esp + 0x13c], 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x13c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x3c], esi
mov dword [esp + 0x140], esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
lea eax, [esi + 1]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_select]
sub esp, 0x14
test eax, eax
je 0x5149ff
lea eax, [esp + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], 0x1007
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov edi, 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 4
mov dword [esp + 0x10], eax
call fcn.00514702
test eax, eax
jne 0x5149ff
cmp dword [esp + 0x20], 0
je 0x5149e9
call fcn.004e34b3
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx], edx
jmp 0x5149ff
lea ecx, [esp + 0x30]
call fcn.00630950
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [ebx], eax
mov dword [ebx + 4], edx
add esp, 0x240
mov eax, edi
pop ebx
pop esi
pop edi
ret

Function at 0x514b20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x58]
mov ebx, dword [esp + 0x5c]
cmp ebp, 0xffffffff
jne 0x514b4b
call fcn.004e34b3
mov dword [ebx], 0x2719
mov dword [ebx + 4], eax
or eax, 0xffffffff
jmp 0x514ba4
call fcn.00618a4c
mov eax, dword [edi]
lea esi, [esp + 0x28]
mov dword [esp], ebp
mov dword [esp + 8], esi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_getsockname]
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [edi], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00618a28
test eax, eax
jne 0x514ba4
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.00630950
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 4], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret