joyce8/EMBER2024-capa huggingface dataset:
Function at 0x592470
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push esi
mov esi, ecx
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x24
call sub.WS2_32.dll_htonl
mov dword [esp + 0xc], eax
mov eax, dword [0x6de2b8]
push 0x1c
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_htonl
mov ecx, dword [0x6de2e8]
push 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call sub.WS2_32.dll_htonl
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x78]
push eax
call sub.WS2_32.dll_htonl
push 1
mov dword [esp + 0x28], eax
call sub.WS2_32.dll_htonl
mov esi, dword [esi + 0xcc]
mov dword [esp + 0x2a], eax
push esi
call sub.WS2_32.dll_htonl
mov ecx, dword [esp + 0x34]
lea edx, [esp + 8]
mov dword [esp + 0x28], eax
push 0
push edx
lea eax, [esp + 0x14]
push 0x24
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x594a40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x6256a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], 0x62d760
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x6e7b6c]
lea edi, [esi + 0x18]
mov dword [esp + 0x28], ebx
mov dword [edi], eax
mov ecx, dword [0x6e7b6c]
mov dword [esi + 0x1c], ecx
mov edx, dword [0x6e7b6c]
mov dword [esi + 0x20], edx
mov eax, dword [0x6e7b6c]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x6e7b6c]
mov dword [esi + 0x30], ecx
lea ebp, [esi + 0x34]
lea edx, [ebp + 4]
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
mov word [edx], bx
mov ecx, dword [0x6e7b6c]
lea eax, [esi + 0x40]
mov dword [eax], ecx
mov edx, dword [esp + 0x30]
mov byte [esp + 0x28], 7
push edx
push 0x6bc090
push eax
mov dword [esi], 0x6567b0
call fcn.005f368b
mov eax, dword [esp + 0x40]
add esp, 0xc
push eax
push 0x6bc090
push edi
call fcn.005f368b
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp eax, ebx
je 0x594b0d
push eax
lea eax, [esi + 0x1c]
push 0x6bc090
push eax
call fcn.005f368b
add esp, 0xc
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x594b27
push eax
lea eax, [esi + 0x20]
push 0x6bc090
push eax
call fcn.005f368b
add esp, 0xc
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
push eax
lea eax, [esi + 0x2c]
push 0x6bc090
push eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
call fcn.005f368b
mov edx, dword [esp + 0x58]
add esp, 0xc
cmp edx, ebx
je 0x594b73
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x594b73
push edx
lea eax, [esi + 0x30]
push 0x6bc090
push eax
call fcn.005f368b
add esp, 0xc
mov edi, dword [esp + 0x50]
cmp edi, ebx
je 0x594c40
push edi
call fcn.005de123
add esp, 4
test eax, eax
je 0x594c40
cmp dword [ebp], ebx
je 0x594bfc
push edi
call fcn.005de123
add esp, 4
test eax, eax
je 0x594bfc
mov eax, dword [ebp]
cmp eax, edi
ja 0x594bfc
push eax
call fcn.005de123
mov ecx, dword [ebp]
add esp, 4
lea edx, [ecx + eax*2]
cmp edx, edi
jb 0x594bfc
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x1c], bx
call fcn.004023e0
mov eax, dword [esp + 0x14]
mov byte [esp + 0x28], 8
cmp eax, ebx
jne 0x594be4
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call fcn.004023e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 7
call fcn.00401070
jmp 0x594c40
mov ecx, ebp
call fcn.00401070
push edi
call fcn.005de123
add esp, 4
test eax, eax
je 0x594c40
push edi
call fcn.005de123
lea eax, [eax + eax + 2]
push eax
call fcn.005f6c5c
add esp, 8
cmp eax, ebx
mov dword [ebp], eax
je 0x594c40
push edi
call fcn.005de123
mov ecx, dword [ebp]
push edi
push ecx
mov dword [ebp + 8], eax
call fcn.005de2e9
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x24
Function at 0x594c80
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x625710
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x6567b0
mov dword [esp + 0x10], 7
call fcn.00594d50
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 6
call fcn.005fa859
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 5
call fcn.00401070
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 4
call fcn.005fa859
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 3
call fcn.005fa859
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 2
call fcn.005fa859
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 1
call fcn.005fa859
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 0
call fcn.005fa859
add esi, 4
mov dword [esp + 4], esi
mov dword [esi], method.CCommandLineInfo.virtual_0
mov eax, dword [esi + 4]
mov dword [esp + 0x10], 8
test eax, eax
je 0x594d3d
mov ecx, dword [esi + 8]
push ecx
push eax
call fcn.005f3718
mov edx, dword [esi + 4]
push edx
call fcn.005f6c85
add esp, 4
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x596390
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6257c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov eax, dword [esi]
mov edi, dword [esi + 0x8c]
mov dword [ebp - 4], ebx
call dword [eax + 0x1c]
mov eax, dword [esi + 0x31dc]
cmp dword [eax + 0x134], 2
jne 0x5963ff
cmp dword [esi + 0x54], ebx
jl 0x5963ff
jg 0x5963de
cmp dword [esi + 0x50], ebx
jbe 0x5963ff
mov dword [esi + 0x8c], 7
mov dword [esi + 0x84], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0x18
je 0x596409
cmp edi, 0x15
jne 0x5963ee
cmp dword [esi + 0xd0], ebx
je 0x5963ee
cmp dword [eax + 0x140], 0x757b
jne 0x5963ee
mov ecx, esi
call fcn.0059cfe0
cmp eax, ebx
je 0x596516
push 0x6de69c
mov ecx, esi
call fcn.005474d0
mov ecx, dword [esi + 0x90]
lea eax, [ebp - 0x20]
mov edx, dword [ecx + 0x60]
push edx
push 0x6c3570
push eax
call fcn.005deb38
mov edx, dword [esi + 0x31dc]
add esp, 0xc
lea ecx, [ebp - 0x20]
mov eax, dword [edx + 0x104]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esi + 0x90]
mov edx, dword [ecx + 0x10]
lea ecx, [esi + 0x10]
push edx
call fcn.0054f8d0
mov ecx, dword [esi + 0x90]
mov dword [esi + 0x50], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x6c], ebx
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
fild qword [ebp - 0x18]
cmp eax, ebx
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd8], ebx
fstp qword [esi + 0x31e0]
jne 0x5964d9
mov eax, dword [esi + 0x31dc]
cmp ecx, dword [eax + 0xb0]
jne 0x5964d9
push 0x6de684
mov ecx, esi
call fcn.005474d0
mov byte [esi + 0x31f1], 1
mov byte [esi + 0x31f3], bl
jmp 0x5964e0
mov byte [esi + 0x31f3], 1
mov byte [esi + 0x31f5], bl
mov byte [esi + 0x31f6], bl
mov dword [esi + 0x4a18], ebx
mov dword [esi + 0x4a1c], ebx
mov byte [esi + 0x31ed], bl
mov byte [esi + 0x31ec], bl
mov dword [esi + 0x3228], ebx
mov byte [esi + 0x31f9], bl
mov byte [esi + 0x31f8], bl
mov ecx, esi
mov byte [esi + 0xcb], 1
call fcn.0054b290
mov edx, dword [esi]
lea eax, [esi + 0x31d8]
push eax
mov ecx, esi
call dword [edx + 0x14]
cmp eax, ebx
je 0x5963ee
mov ecx, dword [esi + 0x31dc]
cmp eax, 0x7569
mov dword [ecx + 0x140], eax
jne 0x5963ee
mov ecx, dword [esi + 0x31dc]
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x596580
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6257d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
call fcn.00597e80
mov eax, dword [esi + 0x3208]
mov byte [esi + 0x31ed], bl
cmp eax, ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0x49e4], ebx
mov byte [esi + 0x31f9], bl
mov byte [esi + 0xcb], bl
jne 0x5965eb
push 0x601
call fcn.005f6c5c
add esp, 4
mov dword [esi + 0x3208], eax
mov eax, dword [esi + 0x3208]
cmp eax, ebx
jne 0x59660b
mov eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], 3
lea eax, [ebp - 0x24]
push eax
call fcn.005dfac7
mov ecx, dword [ebp - 0x24]
add esp, 4
push ecx
call sub.WS2_32.dll_htonl
mov edx, dword [esi + 0x3208]
mov edi, 9
mov dword [edx + 1], eax
mov eax, dword [esi + 0x3208]
add eax, 5
mov dword [eax], ebx
cmp edi, 0x600
jg 0x596664
call fcn.005e079a
and eax, 0x800000ff
jns 0x596657
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [esi + 0x3208]
inc edi
mov byte [ecx + edi - 1], al
jmp 0x59663c
mov edx, dword [esi + 0xb0]
cmp dword [edx + 0x24], 5
jne 0x59668a
mov eax, dword [esi + 0x3208]
push 0x601
push eax
push 0x6de70c
mov ecx, esi
call fcn.005975d0
jmp 0x5966b0
mov ecx, dword [esi + 0x3208]
mov edx, dword [esi + 0x31d8]
push 0x6de6fc
push ebx
push 0x601
push ecx
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.00547580
mov edi, eax
mov eax, dword [0x6e7b6c]
mov dword [ebp - 0x14], eax
push edi
lea ecx, [ebp - 0x14]
push 0x6de6dc
push ecx
mov byte [ebp - 4], 1
call fcn.005f368b
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov ecx, esi
push edx
call fcn.005474d0
mov ecx, esi
mov dword [esi + 0x320c], ebx
mov dword [esi + 0x3210], ebx
mov byte [esi + 0x31ee], bl
mov byte [esi + 0x31ef], bl
call fcn.00549570
lea ecx, [ebp - 0x14]
mov dword [esi + 0x8c], 0x14
mov byte [ebp - 4], bl
call fcn.005fa859
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x596800
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6257f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x322c]
mov dword [ebp - 0x10], esp
test eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0
jne 0x596862
push 0x3ff
call fcn.005de9fe
add esp, 4
mov edi, eax
mov ecx, 0xff
xor eax, eax
mov dword [ebx + 0x322c], edi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebx + 0x3238], 0x3ff
mov eax, dword [ebx + 0x3238]
mov ecx, dword [ebx + 0x322c]
push eax
push 0
push ecx
call fcn.005df110
mov ecx, dword [ebx + 0x322c]
add esp, 0xc
sub eax, ecx
mov byte [ebp - 0x11], 0
mov edi, eax
mov dword [ebp - 0x1c], edi
mov edx, dword [ebx + 0x38c]
test edx, edx
jle 0x5969bf
mov ecx, dword [ebx + 0x388]
mov eax, 0x200
sub eax, ecx
mov esi, edx
cmp edx, eax
jl 0x5968ae
mov esi, eax
push esi
lea edx, [ecx + ebx + 0x323c]
push 0xa
push edx
call fcn.005df110
add esp, 0xc
test eax, eax
je 0x5968db
mov edx, dword [ebx + 0x388]
sub eax, ebx
sub eax, edx
sub eax, 0x323b
mov esi, eax
mov dword [ebp - 0x18], esi
jmp 0x5968de
mov dword [ebp - 0x18], esi
mov eax, dword [ebx + 0x3238]
mov ecx, eax
sub ecx, edi
dec ecx
cmp esi, ecx
jl 0x596927
mov edx, dword [ebx + 0x322c]
lea eax, [eax + esi + 1]
push eax
push edx
mov dword [ebx + 0x3238], eax
call fcn.005dfca7
add esp, 8
mov dword [ebx + 0x322c], eax
test eax, eax
jne 0x596927
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x322c]
mov eax, dword [ebx + 0x388]
mov ecx, esi
add edi, edx
mov edx, ecx
lea esi, [ebx + eax + 0x323c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebx + 0x388]
mov edx, dword [ebx + 0x38c]
add eax, ecx
add esi, ecx
sub edx, ecx
mov ecx, dword [ebx + 0x322c]
mov dword [ebx + 0x388], esi
mov dword [ebx + 0x38c], edx
mov dword [ebp - 0x1c], eax
mov byte [eax + ecx], 0
mov edx, dword [ebx + 0x322c]
cmp byte [eax + edx - 1], 0xa
je 0x596a43
mov al, byte [ebp - 0x11]
test al, al
je 0x5969bf
mov eax, dword [ebx + 0x31d8]
push 0
push eax
mov ecx, ebx
call fcn.00548d60
test eax, eax
je 0x5969bf
mov eax, 0x7533
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x31d8]
lea edi, [ebx + 0x323c]
push 0
push 0x200
push edi
push ecx
call sub.WS2_32.dll_recv
mov esi, eax
push 0x6dc2f4
push esi
mov ecx, ebx
call fcn.00547580
cmp eax, 0x2733
jne 0x596a00
mov edx, dword [ebx + 0x31d8]
push 0
push 0x200
push edi
push edx
jmp 0x5969d4
test eax, eax
jne 0x596a45
mov edi, dword [ebp - 0x1c]
mov dword [ebx + 0x388], eax
mov dword [ebx + 0x38c], esi
mov byte [ebp - 0x11], 1
jmp 0x59688b
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x597050
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor ebx, ebx
mov edi, 0x1f4
cmp dword [ebp + 0x343c], ebx
je 0x59707a
cmp byte [ebp + 0x3464], bl
je 0x59707a
mov byte [ebp + 0x3464], bl
mov byte [ebp + 0x3465], bl
mov al, byte [ebp + 0x3464]
mov byte [esp + 0x13], bl
cmp al, bl
je 0x5970a3
mov ecx, ebp
call fcn.00596eb0
cmp eax, ebx
jne 0x597173
mov byte [ebp + 0x3465], 1
mov byte [esp + 0x13], 1
cmp byte [ebp + 0x3465], bl
je 0x597145
cmp dword [ebp + 0x343c], ebx
je 0x59713f
mov edx, dword [ebp + 0x38c]
cmp edx, ebx
jle 0x5970e6
mov ecx, dword [ebp + 0x388]
mov al, byte [ecx + ebp + 0x323c]
inc ecx
dec edx
mov byte [esp + 0x12], al
mov dword [ebp + 0x388], ecx
mov dword [ebp + 0x38c], edx
jmp 0x597115
mov ecx, dword [ebp + 0x31d8]
push ebx
lea eax, [esp + 0x16]
push 1
push eax
push ecx
call sub.WS2_32.dll_recv
mov esi, eax
push 0x6de79c
push esi
mov ecx, ebp
call fcn.00547580
test eax, eax
jne 0x597255
mov al, byte [esp + 0x12]
cmp al, bl
jle 0x59712f
cmp al, 0x22
jge 0x59712f
movsx eax, al
lea edx, [eax + eax*8 + 0xc8]
mov dword [ebp + 0x344c], edx
jmp 0x597139
cmp al, 0x21
jle 0x597139
mov dword [ebp + 0x344c], edi
dec dword [ebp + 0x343c]
mov byte [ebp + 0x3465], bl
cmp dword [ebp + 0x343c], ebx
jne 0x597199
mov eax, dword [ebp + 0x38c]
mov byte [ebp + 0x3464], 1
cmp eax, ebx
mov dword [ebp + 0x3460], ebx
jg 0x59705e
cmp byte [esp + 0x13], bl
jne 0x597184
jmp 0x59705e
push eax
call sub.WS2_32.dll_WSASetLastError
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
push 0x2733
call sub.WS2_32.dll_WSASetLastError
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [ebp + 0x38c]
cmp eax, ebx
jle 0x597200
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jl 0x5971ad
mov eax, ecx
mov edx, dword [ebp + 0x388]
mov edi, dword [esp + 0x18]
mov ecx, eax
lea esi, [edx + ebp + 0x323c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x388]
mov edx, dword [ebp + 0x38c]
mov ecx, dword [ebp + 0x343c]
add esi, eax
sub edx, eax
sub ecx, eax
mov dword [ebp + 0x388], esi
pop edi
mov dword [ebp + 0x38c], edx
mov dword [ebp + 0x343c], ecx
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [ebp + 0x343c]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jl 0x597210
mov eax, ecx
mov ecx, dword [ebp + 0x31d8]
push ebx
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call sub.WS2_32.dll_recv
mov esi, eax
push 0x6de790
push esi
mov ecx, ebp
call fcn.00547580
test eax, eax
jne 0x597255
mov eax, dword [ebp + 0x343c]
sub eax, esi
mov dword [ebp + 0x343c], eax
jne 0x597255
cmp dword [ebp + 0xd4], ebx
jbe 0x597255
mov ecx, ebp
call fcn.00595580
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x597330
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push 0xffffffffffffffff
push 0x625840
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x6e7b6c]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0xb0]
lea eax, [esp + 0x10]
xor ebx, ebx
mov edx, dword [ecx]
mov dword [esp + 0x20], ebx
push edx
push 0x6de81c
push eax
call fcn.005f368b
add esp, 0xc
mov ecx, esi
push 0x6de804
call fcn.005474d0
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.005474d0
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push 0x6de7f8
dec ecx
push ebx
push ecx
push edx
mov edx, dword [esi + 0x31d8]
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.00547580
mov edi, eax
cmp edi, ebx
jne 0x59744a
mov ecx, dword [esi + 0x31d8]
push 0x6de7e8
push ebx
lea eax, [esp + 0x17]
push 1
push eax
push ecx
mov byte [esp + 0x23], bl
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.00547580
mov byte [esi + 0x3464], 1
mov dword [esi + 0x343c], ebx
mov dword [esi + 0x38c], ebx
mov dword [esi + 0x8c], 0x1b
mov dword [esi + 0x3460], ebx
mov edx, dword [0x6e7b6c]
mov edi, eax
mov dword [esp + 0x14], edx
push edi
lea eax, [esp + 0x18]
push 0x6de7d8
push eax
mov byte [esp + 0x2c], 1
call fcn.005f368b
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
mov ecx, esi
call fcn.005474d0
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.005fa859
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.005fa859
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x597470
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push 0xffffffffffffffff
push 0x625860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x6e7b6c]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0xb0]
lea eax, [esp + 0x10]
xor ebx, ebx
mov edx, dword [ecx]
mov dword [esp + 0x20], ebx
push edx
push 0x6de8ec
push eax
call fcn.005f368b
add esp, 0xc
mov ecx, esi
push 0x6de8d8
call fcn.005474d0
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.005474d0
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push 0x6de8c8
dec ecx
push ebx
push ecx
push edx
mov edx, dword [esi + 0x31d8]
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.00547580
mov edi, eax
cmp edi, ebx
jne 0x59759c
mov ecx, dword [esi + 0x31d8]
push 0x6de8c8
push ebx
lea eax, [esp + 0x17]
push 1
push eax
push ecx
mov byte [esp + 0x23], bl
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.00547580
mov dword [esi + 0x345c], ebx
mov byte [esi + 0x3464], 1
mov dword [esi + 0x343c], ebx
mov dword [esi + 0x38c], ebx
mov dword [esi + 0x8c], 0x19
mov dword [esi + 0x3454], ebx
mov dword [esi + 0x3458], ebx
mov dword [esi + 0x3460], ebx
mov edx, dword [0x6e7b6c]
mov edi, eax
mov dword [esp + 0x14], edx
push edi
lea eax, [esp + 0x18]
push 0x6de7d8
push eax
mov byte [esp + 0x2c], 1
call fcn.005f368b
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
mov ecx, esi
call fcn.005474d0
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.005fa859
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.005fa859
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5975d0
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push 0xffffffffffffffff
push 0x625878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6e7b6c]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esi + 0xb0]
mov ebx, dword [esp + 0x28]
mov eax, dword [esi + 0x345c]
push ebx
mov edx, dword [ecx]
mov ecx, dword [esi + 0x3450]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
lea eax, [esp + 0x20]
push 0x6de9a0
push eax
mov dword [esp + 0x34], 0
call fcn.005f368b
mov edi, dword [esi + 0x345c]
mov eax, dword [esp + 0x28]
add esp, 0x1c
inc edi
mov dword [esi + 0x345c], edi
mov ecx, dword [eax - 8]
push 0x6de994
push 0
push ecx
mov ecx, dword [esi + 0x31d8]
push eax
push ecx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.00547580
mov edi, eax
test edi, edi
je 0x59768d
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.005fa859
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov edx, dword [esp + 0x24]
mov eax, dword [esi + 0x31d8]
push 0x6de994
push 0
push ebx
push edx
push eax
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.00547580
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
call fcn.005fa859
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x598b20
Capabilities:
Enumerate pe sections
Receive data
Receive data on socket

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xb0]
mov dword [edi + 0x3220], 0
cmp dword [eax + 0x24], 5
jne 0x598b4b
lea ecx, [esp + 0xb]
push 1
push ecx
mov ecx, edi
call fcn.00597050
jmp 0x598b60
mov eax, dword [edi + 0x31d8]
push 0
lea edx, [esp + 0xf]
push 1
push edx
push eax
call sub.WS2_32.dll_recv
push 0x6dec4c
push eax
mov ecx, edi
call fcn.00547580
mov ecx, eax
test ecx, ecx
je 0x598b84
sub eax, 0x2733
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ecx
ret 4
mov ecx, edi
call fcn.00549570
mov cl, byte [esp + 0xb]
mov esi, dword [esp + 0x10]
mov al, cl
sar al, 6
and al, 3
and cl, 0x3f
mov byte [esi + 4], al
mov byte [esi + 6], cl
jne 0x598bae
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret 4
cmp cl, 1
jne 0x598bbc
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret 4
and eax, 0xff
mov eax, dword [eax*4 + 0x6567b4]
cmp eax, 0xc
mov dword [edi + 0x49bc], eax
jne 0x598bd7
mov byte [esi + 0x10], 1
cmp dword [edi + 0x49bc], 0xc
jge 0x598c3c
mov ecx, esi
call fcn.0059da30
xor eax, eax
mov al, byte [esi + 6]
lea ecx, [eax + eax*4]
mov dl, byte [edi + ecx*8 + 0x349c]
lea eax, [edi + ecx*8 + 0x3498]
mov byte [esi + 4], dl
mov cl, byte [eax + 5]
mov byte [esi + 5], cl
mov dl, byte [eax + 6]
mov byte [esi + 6], dl
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov cl, byte [eax + 0x10]
mov byte [esi + 0x10], cl
mov edx, dword [eax + 0x14]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x1c], edx
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x20], ecx
mov dl, byte [eax + 0x24]
mov byte [esi + 0x24], dl
mov ecx, dword [edi + 0x49bc]
xor eax, eax
dec ecx
mov dword [edi + 0x49bc], ecx
lea ecx, [edi + 0x49c0]
mov dword [edi + 0x49c0], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [edi + 0x3214], eax
mov eax, dword [edi + 0x49bc]
mov dword [edi + 0x8c], 0x16
test eax, eax
jle 0x598c8a
mov ecx, edi
call fcn.005967b0
test eax, eax
je 0x598c8a
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
push esi
mov ecx, edi
call fcn.00598ca0
pop edi
pop esi
pop ecx
ret 4