joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x44c
call fcn.005bd7a0
mov eax, dword [0x6ce8d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x440], 0
cmp dword [ebp + 8], 0
jne 0x4b67be
xor eax, eax
jmp 0x4b6974
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005edd88
add esp, 8
test eax, eax
jge 0x4b67dc
xor eax, eax
jmp 0x4b6974
mov eax, 8
call fcn.005bd7a0
xorps xmm0, xmm0
movsd qword [esp], xmm0
push 0x30
lea edx, [ebp - 0x434]
push edx
call fcn.004b6450
add esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x4b6810
mov eax, dword [ebp - 0x440]
jmp 0x4b6974
push 0x63de8c
mov eax, dword [ebp + 8]
push eax
call fcn.005e46a5
add esp, 8
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x4b6835
jmp 0x4b696e
xor ecx, ecx
jne 0x4b6848
movzx edx, word [ebp - 0x42e]
and edx, 0x2000
je 0x4b6881
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4b685a
mov dword [ebp - 0x448], 0x800
jmp 0x4b6863
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp + 0xc], ecx
push 0
push 4
push 0
mov edx, dword [ebp - 0x43c]
push edx
call fcn.005e590c
add esp, 0x10
cmp dword [ebp + 0xc], 0
jle 0x4b68b3
cmp dword [ebp + 0xc], 0x400
jge 0x4b689b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44c], eax
jmp 0x4b68a5
mov dword [ebp - 0x44c], 0x400
mov ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x438], ecx
jmp 0x4b68bd
mov dword [ebp - 0x438], 0x400
mov edx, dword [ebp - 0x43c]
push edx
mov eax, dword [ebp - 0x438]
push eax
push 1
lea ecx, [ebp - 0x404]
push ecx
call fcn.005e497e
add esp, 0x10
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0
jg 0x4b68ed
jmp 0x4b694b
cvtsi2sd xmm0, dword [ebp - 0x444]
mov eax, 8
call fcn.005bd7a0
movsd qword [esp], xmm0
mov edx, dword [ebp - 0x438]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.004b6450
add esp, 0x10
mov ecx, dword [ebp - 0x440]
add ecx, dword [ebp - 0x444]
mov dword [ebp - 0x440], ecx
cmp dword [ebp + 0xc], 0
jle 0x4b6946
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x438]
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
jg 0x4b6946
jmp 0x4b694b
jmp 0x4b6881
mov eax, dword [ebp - 0x43c]
push eax
call fcn.005e4732
add esp, 4
push 0x400
lea ecx, [ebp - 0x404]
push ecx
call fcn.004c7a90
add esp, 8
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret
Function at 0x4c8de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.005bd7a0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
jmp 0x4c8e0f
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x4c8e36
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor edx, ecx
movzx eax, byte [ebp - 1]
or eax, edx
mov byte [ebp - 1], al
jmp 0x4c8e06
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x51d740
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.005bd7a0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [ebp + 0x14]
jne 0x51d778
mov edx, dword [ebp - 8]
movzx eax, byte [edx]
cmp eax, 0x6a
je 0x51d79b
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx]
cmp edx, 0x6b
je 0x51d79b
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.004b9f10
add esp, 0x14
or eax, 0xffffffff
jmp 0x51d8b1
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 0x14], 0x6b
jne 0x51d85d
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x51d7d2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
jge 0x51d829
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 1], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
movzx eax, byte [ebp - 1]
cmp eax, 0xba
jne 0x51d7f8
jmp 0x51d829
movzx ecx, byte [ebp - 1]
cmp ecx, 0xbb
je 0x51d827
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.004b9f10
add esp, 0x14
or eax, 0xffffffff
jmp 0x51d8b1
jmp 0x51d7c9
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x10], 0
jne 0x51d85b
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.004b9f10
add esp, 0x14
or eax, 0xffffffff
jmp 0x51d8b1
jmp 0x51d866
mov eax, dword [ebp + 0x14]
sub eax, 2
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp edx, 0xcc
je 0x51d89a
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.004b9f10
add esp, 0x14
or eax, 0xffffffff
jmp 0x51d8b1
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005d78a0
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x527ef0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.005bd7a0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
jmp 0x527f15
mov ecx, dword [ebp - 8]
sub ecx, 3
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jle 0x52809e
cmp dword [ebp - 8], 3
jl 0x527fd8
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + eax]
shl edx, 0x10
mov eax, 1
shl eax, 0
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + eax]
shl eax, 8
or edx, eax
mov ecx, 1
shl ecx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + ecx]
or edx, ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
shr edx, 0x12
and edx, 0x3f
mov eax, dword [ebp + 8]
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
mov eax, dword [ebp - 4]
shr eax, 0xc
and eax, 0x3f
mov ecx, dword [ebp + 8]
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
shr ecx, 6
and ecx, 0x3f
mov edx, dword [ebp + 8]
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
and edx, 0x3f
mov eax, dword [ebp + 8]
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x528087
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + ecx]
shl eax, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 2
jne 0x52800b
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + ecx]
shl eax, 8
or eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
and ecx, 0x3f
mov edx, dword [ebp + 8]
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
shr edx, 0xc
and edx, 0x3f
mov eax, dword [ebp + 8]
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
cmp dword [ebp - 8], 1
jne 0x528054
mov dword [ebp - 0x10], 0x3d
jmp 0x528067
mov eax, dword [ebp - 4]
shr eax, 6
and eax, 0x3f
movzx ecx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
mov al, byte [ebp - 0x10]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 8]
mov byte [edx], 0x3d
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 4
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
add edx, 3
mov dword [ebp + 0xc], edx
jmp 0x527f0c
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x536a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.005bd7a0
mov dword [ebp - 4], 0
jmp 0x536a6f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x536abd
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
shl eax, 1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], al
mov edx, dword [ebp + 0x10]
sub edx, 1
cmp dword [ebp - 4], edx
jge 0x536abb
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movzx ecx, byte [eax + 1]
and ecx, 0x80
je 0x536abb
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
or eax, 1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], al
jmp 0x536a66
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + eax]
and edx, 0x80
je 0x536b00
cmp dword [ebp + 0x10], 0x10
jne 0x536ae3
mov dword [ebp - 8], 0x87
jmp 0x536aea
mov dword [ebp - 8], 0x1b
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0x10]
movzx ecx, byte [eax - 1]
xor ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ebp + 0x10]
mov byte [edx - 1], cl
mov esp, ebp
pop ebp
ret
Function at 0x5ce700
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push esi
mov esi, dword [esp + 0x30]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], 0
movups xmmword [esp + 0x18], xmm0
cmp dword [esi + 0x14], 0x10
mov dword [esp + 8], eax
jb 0x5ce72f
mov eax, dword [esi]
jmp 0x5ce731
mov eax, esi
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0xc]
push ecx
push 0
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x5ce768
push dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
call fcn.005ce0f0
push dword [esp + 0x34]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [esp + 0x2c]
pop esi
add esp, 0x24
ret
push esi
push eax
call fcn.005ce570
int3

Function at 0x5cf210
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x634b88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004531b0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push edx
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::Net::HTTPBufferAllocator_.0
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
call fcn.005d56e0
mov ecx, dword [ebp + 0x10]
add esp, 8
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub ecx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
add edx, ecx
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5d3880
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6351c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x10], 0
cmp dword [eax + 0x10], 0
je 0x5d3926
cmp dword [eax + 0x14], 0x10
xorps xmm0, xmm0
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x4c], 4
movups xmmword [ebp - 0x3c], xmm0
jb 0x5d38c6
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x4c]
push ecx
push 0
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x5d3926
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
mov eax, dword [eax + 0x18]
push dword [eax + 0x18]
add eax, 8
push eax
call fcn.005d3150
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.005d30f0
lea ecx, [ebp - 0x2c]
call fcn.005d31b0
mov eax, dword [ebp + 8]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.005d3180
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5d41e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x5d4204
mov al, 1
add esp, 0x94
ret
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x5d421f
jne 0x5d4216
cmp dword [esp + 8], 2
jb 0x5d421f
xor eax, eax
add esp, 0x94
ret
mov eax, 1
add esp, 0x94
ret

Function at 0x5d4250
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6353e8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebx + 8], 0xffffffff
jne 0x5d428b
mov esi, dword [ebx]
mov ecx, edi
call fcn.005c9bc0
push eax
mov ecx, ebx
call dword [esi + 0x90]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, edi
call fcn.005c9e90
push eax
mov ecx, edi
call fcn.005c9b50
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x5d42ec
call esi
cmp eax, 0x2714
je 0x5d4291
call esi
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x24]
push eax
call fcn.005ca0b0
push eax
push esi
mov dword [ebp - 4], 0
call fcn.005d45b0
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 0x10
jb 0x5d42ec
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00451330
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5d4300
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6352b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
cmp dword [edi + 8], 0xffffffff
jne 0x5d4341
mov esi, dword [edi]
mov ecx, ebx
call fcn.005c9bc0
push eax
mov ecx, edi
call dword [esi + 0x90]
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x84]
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.005c9e90
mov ecx, ebx
mov esi, eax
call fcn.005c9b50
push esi
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x5d441d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2734
je 0x5d43b4
cmp esi, 0x2733
je 0x5d43b4
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.005ca0b0
push eax
push esi
mov byte [ebp - 4], 1
call fcn.005d45b0
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00450230
mov eax, dword [edi]
mov ecx, edi
push 7
push dword [ebp + 0xc]
mov eax, dword [eax + 0x50]
call eax
test al, al
jne 0x5d4409
push str.connect_timed_out
lea ecx, [ebp - 0x44]
call fcn.00453280
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.005ca0b0
push 0
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x88]
call fcn.005bf1d0
push 0x6c44dc
lea eax, [ebp - 0x88]
push eax
call fcn.005d7454
mov ecx, edi
call fcn.005d56c0
test eax, eax
je 0x5d441d
push eax
call fcn.005d4540
add esp, 4
mov eax, dword [edi]
mov ecx, edi
push 1
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x84]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5d4460
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6353e8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 8], 0xffffffff
jne 0x5d449b
mov esi, dword [edi]
mov ecx, ebx
call fcn.005c9bc0
push eax
mov ecx, edi
call dword [esi + 0x90]
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x84]
mov ecx, ebx
call fcn.005c9e90
push eax
mov ecx, ebx
call fcn.005c9b50
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x5d4500
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2734
je 0x5d4500
cmp esi, 0x2733
je 0x5d4500
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.005ca0b0
push eax
push esi
mov dword [ebp - 4], 0
call fcn.005d45b0
add esp, 8
lea ecx, [ebp - 0x24]
call fcn.00450230
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5d4eb0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x635410
push eax
mov dword fs:[0], esp
sub esp, 0x360
push ebx
push esi
mov esi, dword [ecx + 8]
push edi
cmp esi, 0xffffffff
jne 0x5d4ef1
push 0
lea ecx, [ebp - 0x60]
call fcn.005ccbb0
push 0x6c56d0
lea eax, [ebp - 0x60]
push eax
call fcn.005d7454
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x164], 0
test al, 1
je 0x5d4f26
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x36c], 1
test al, 2
je 0x5d4f3a
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x268], 1
test al, 4
je 0x5d4f4e
mov dword [ebp - 0x160], esi
mov dword [ebp - 0x164], 1
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.005c03a0
lea eax, [esi + 1]
xor ebx, ebx
mov dword [ebp + 0xc], eax
push dword [0x6815fc]
mov esi, dword [ebp - 0x10]
push dword [0x6815f8]
mov edi, dword [ebp - 0x14]
push esi
push edi
call fcn.005bde00
push 0
push 0xf4240
push esi
push edi
mov dword [ebp - 0x34], eax
call fcn.005bde00
imul eax, eax, 0xf4240
lea ecx, [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 0x30], edi
call fcn.005c3e70
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x36c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jns 0x5d5033
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2714
jne 0x5d5033
lea ecx, [ebp - 0x24]
call fcn.005c3e70
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
sbb eax, dword [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.005c0400
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jg 0x5d501f
jl 0x5d5011
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jae 0x5d501f
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.005c0420
jmp 0x5d502b
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.005c0400
lea ecx, [ebp - 0x24]
call fcn.0040d410
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040d410
test esi, esi
jns 0x5d505d
cmp ebx, 0x2714
je 0x5d4f61
push ebx
call fcn.005d4540
add esp, 4
test esi, esi
mov ecx, dword [ebp - 0xc]
setg al
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x5d5080
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x2c
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x5d50a7
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
or eax, dword [ecx + 4]
je 0x5d50a7
mov eax, dword [esi]
push 1
push ecx
mov ecx, esi
mov eax, dword [eax + 0x50]
call eax
test al, al
je 0x5d5116
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebp
mov ebp, dword [esp + 0x44]
push edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x5d5149
push ebp
push dword [esp + 0x48]
push dword [esp + 0x48]
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp byte [esi + 0x20], 0
mov edi, eax
je 0x5d50e5
test edi, edi
jns 0x5d510a
call ebx
cmp eax, 0x2714
je 0x5d50b4
test edi, edi
jns 0x5d510a
call ebx
cmp eax, 0x2733
jne 0x5d50fa
cmp byte [esi + 0x20], 0
je 0x5d510a
jmp 0x5d5130
cmp eax, 0x274c
je 0x5d5130
push eax
call fcn.005d4540
add esp, 4
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x2c
ret 0xc
push 0
lea ecx, [esp + 8]
call fcn.005bf200
push 0x6c44dc
lea eax, [esp + 8]
push eax
call fcn.005d7454
push eax
lea ecx, [esp + 0x14]
call fcn.005bf200
push 0x6c44dc
lea eax, [esp + 0x14]
push eax
call fcn.005d7454
push 0
lea ecx, [esp + 0x14]
call fcn.005ccbb0
push 0x6c56d0
lea eax, [esp + 0x14]
push eax
call fcn.005d7454
int3

Function at 0x5d5170
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x635428
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x21], 0
je 0x5d51c9
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
or eax, dword [ecx + 4]
je 0x5d51c9
mov eax, dword [esi]
push 1
push ecx
mov ecx, esi
mov eax, dword [eax + 0x50]
call eax
test al, al
jne 0x5d51c9
push 0
lea ecx, [ebp - 0x58]
call fcn.005bf200
push 0x6c44dc
lea eax, [ebp - 0x58]
push eax
call fcn.005d7454
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], 0x1c
nop word [eax + eax]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x5d5297
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp byte [esi + 0x20], 0
mov edi, eax
je 0x5d5219
test edi, edi
jns 0x5d521d
call ebx
cmp eax, 0x2714
je 0x5d51e0
test edi, edi
js 0x5d5246
push dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 0x14]
call fcn.005c98d0
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ebp - 4], 0
call fcn.005c9aa0
lea ecx, [ebp + 0x14]
call fcn.005cd780
jmp 0x5d5282
call ebx
cmp eax, 0x2733
jne 0x5d5272
cmp byte [esi + 0x20], 0
je 0x5d5282
push eax
lea ecx, [ebp - 0x84]
call fcn.005bf200
push 0x6c44dc
lea eax, [ebp - 0x84]
push eax
call fcn.005d7454
cmp eax, 0x274c
je 0x5d5255
push eax
call fcn.005d4540
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push 0
lea ecx, [ebp - 0x58]
call fcn.005ccbb0
push 0x6c56d0
lea eax, [ebp - 0x58]
push eax
call fcn.005d7454
int3