joyce8/EMBER2024-capa huggingface dataset:
Function at 0x605b66
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4ec
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], 0xc8
lea eax, [ebp - 0x338]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0xc8
lea eax, [ebp - 0x270]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0xc8
lea eax, [ebp - 0x1a8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xc8
lea eax, [ebp - 0xe0]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x78]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x74]
mov dword [esp], eax
call fcn.0060a0f0
test eax, eax
je 0x605c63
cmp dword [ebx + 0x2c], 0
jle 0x605c0f
mov eax, dword [ebx + 4]
mov edx, dword [eax]
mov dword [esp + 4], str.Received_incoming_RTSP_request:
mov dword [esp], eax
call dword [edx + 0x24]
mov edx, dword [eax]
mov ecx, dword [ebx + 0x74]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x24]
mov edx, dword [eax]
mov dword [esp + 4], 0xa1ace7
mov dword [esp], eax
call dword [edx + 0x24]
lea eax, [ebp - 0x338]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.RTSP_1.0_405_Method_Not_Allowed_r_nCSeq:__s_r_n_r_n
mov dword [esp + 4], 0x190
lea esi, [ebp - 0x4c8]
mov dword [esp], esi
call sub.msvcrt.dll__snprintf
mov edi, esi
mov al, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x60c5f2
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
add esp, 0xffffff80
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.005e3b3e
mov dword [ebx], method.4E.virtual_0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
fldz
fst qword [ebx + 0x40]
fstp qword [ebx + 0x48]
mov dword [ebx + 0x54], 0x3f800000
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x50], 0
mov dword [esp + 4], 0x64
lea eax, [ebp - 0x6d]
mov dword [esp], eax
call sub.WS2_32.dll_gethostname
sub esp, 8
mov byte [ebp - 9], 0
lea eax, [ebp - 0x6d]
mov dword [esp], eax
call fcn.00620600
mov dword [ebx + 0x2c], eax
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret
Function at 0x61aeb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
mov ecx, dword [esi + 0x20]
test ecx, ecx
jne 0x61aed2
cmp dword [esi + 0x1c], 0
je 0x61af34
mov edx, dword [eax + 0xc]
sub edx, ecx
mov ecx, dword [eax + 8]
sub ecx, dword [esi + 0x1c]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 6
add edx, ecx
test edx, edx
jle 0x61af34
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
fild qword [ebp - 0x30]
fmul dword [0xa1cdc0]
push edx
fidiv dword [esp]
lea esp, [esp + 4]
fnstcw word [ebp - 0x22]
mov dx, word [ebp - 0x22]
mov dh, 0xc
mov word [ebp - 0x24], dx
fldcw word [ebp - 0x24]
fistp qword [ebp - 0x20]
fldcw word [ebp - 0x22]
mov edx, dword [ebp - 0x20]
cmp edx, dword [esi + 0x24]
jbe 0x61af34
mov dword [esi + 0x24], edx
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edx
cmp dword [esi + 0x30], 0
je 0x61af64
test edi, edi
je 0x61af64
mov eax, 0
mov dl, byte [ebx + eax]
mov cl, byte [ebx + eax + 1]
mov byte [ebx + eax], cl
mov byte [ebx + eax + 1], dl
add eax, 2
cmp eax, edi
jb 0x61af4f
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x30], eax
mov edx, dword [eax + 0x4c]
mov dword [ebp - 0x34], edx
mov eax, dword [esi + 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.0061adf2
add eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x4c], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x30], eax
mov edx, dword [eax + 0x4c]
mov dword [ebp - 0x34], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.0061adf2
add eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x4c], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esi + 0xc]
add dword [eax + 0x4c], edi
test edi, 1
je 0x61b00a
mov ebx, dword [esi + 0xc]
mov edi, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x30]
mov edx, dword [eax + 4]
dec edx
mov dword [eax + 4], edx
test edx, edx
js 0x61aff6
mov edx, dword [eax]
mov byte [edx], 0
inc edx
mov dword [eax], edx
jmp 0x61b006
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.msvcrt.dll__flsbuf
inc edi
mov dword [ebx + 0x4c], edi
inc dword [esi + 0x50]
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret

Function at 0x61d280
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0061d214
test eax, eax
je 0x61d2c9
mov eax, dword [ebx + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0xb
lea eax, [ebx + 0x4c]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 1
jne 0x61d2d0
inc dword [ebx + 0x38]
jmp 0x61d2d5
mov eax, 0
jmp 0x61d2d5
mov eax, 0
add esp, 0x14
pop ebx
leave
ret
Function at 0x61fdf9
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
leave
ret

Function at 0x620267
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
cmp dword [ebp + 8], 0
je 0x6203cb
mov ebx, 0xaaaaaaab
mov eax, dword [ebp + 0xc]
mul ebx
mov ebx, edx
shr ebx, 1
lea eax, [ebx + ebx*2]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 0xc]
cmp eax, edx
setb al
movzx eax, al
mov dword [ebp - 0x1c], eax
add eax, ebx
shl eax, 2
mov dword [ebp - 0x20], eax
inc eax
mov dword [esp], eax
call fcn.008f478c
mov dword [ebp - 0x24], eax
test ebx, ebx
je 0x62032d
mov edx, dword [ebp + 8]
mov ecx, 0
mov dword [ebp - 0x2c], ebx
mov bl, byte [edx]
shr bl, 2
mov esi, ebx
and esi, 0xff
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ecx*4], bl
movzx edi, byte [edx]
and edi, 3
shl edi, 4
movzx esi, byte [edx + 1]
sar esi, 4
or esi, edi
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ecx*4 + 1], bl
movzx edi, byte [edx + 2]
sar edi, 6
movzx esi, byte [edx + 1]
shl esi, 2
or esi, edi
and esi, 0x3f
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ecx*4 + 2], bl
movzx esi, byte [edx + 2]
and esi, 0x3f
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ecx*4 + 3], bl
inc ecx
add edx, 3
cmp dword [ebp - 0x2c], ecx
ja 0x6202bf
mov ebx, dword [ebp - 0x2c]
jmp 0x620332
mov ebx, 0
cmp dword [ebp - 0x1c], 0
je 0x6203c2
lea edx, [ebx*4]
lea edi, [ebx + ebx*2]
mov ecx, dword [ebp + 8]
add ecx, edi
mov bl, byte [ecx]
shr bl, 2
mov esi, ebx
and esi, 0xff
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edx], bl
mov esi, dword [ebp - 0x28]
add esi, 2
cmp dword [ebp + 0xc], esi
jne 0x6203a5
mov ebx, dword [ebp + 8]
lea esi, [ebx + edi + 1]
movzx ebx, byte [esi]
mov edi, ebx
sar edi, 4
movzx ebx, byte [ecx]
and ebx, 3
shl ebx, 4
or ebx, edi
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edx + 1], cl
movzx ecx, byte [esi]
shl ecx, 2
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edx + 2], cl
jmp 0x6203bd
movzx ecx, byte [ecx]
and ecx, 3
shl ecx, 4
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edx + 1], cl
mov byte [eax + edx + 2], 0x3d
mov byte [eax + edx + 3], 0x3d
mov edx, dword [ebp - 0x20]
mov byte [eax + edx], 0
jmp 0x6203d2
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x622b45
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], eax
mov edi, edx
mov esi, ecx
call fcn.00622af1
mov ebx, eax
cmp eax, dword [ebp + 8]
jae 0x622b9e
mov dword [esp + 0x10], 4
lea eax, [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0xffff
mov dword [esp], esi
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
js 0x622b90
mov eax, dword [ebp + 8]
jmp 0x622baa
mov eax, ebx
add eax, dword [ebp + 8]
shr eax, 1
mov dword [ebp + 8], eax
cmp ebx, eax
jb 0x622b61
mov ecx, esi
mov edx, edi
mov eax, dword [ebp - 0x1c]
call fcn.00622af1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x622bb2
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, eax
mov esi, edx
mov ebx, ecx
mov dword [esp + 0x10], 4
lea eax, [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0xffff
mov dword [esp], ecx
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
mov ecx, ebx
mov edx, esi
mov eax, edi
call fcn.00622af1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x622c19
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov esi, dword [ebp + 0xc]
call fcn.00623c28
test eax, eax
jne 0x622c48
mov edx, str.Failed_to_initialize_winsock:
mov eax, dword [ebp + 8]
call fcn.00622a50
mov edi, 0xffffffff
jmp 0x622dac
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 2
call sub.WS2_32.dll_socket
sub esp, 0xc
mov ebx, eax
mov edi, eax
test eax, eax
jns 0x622c81
mov edx, str.unable_to_create_datagram_socket:
mov eax, dword [ebp + 8]
call fcn.00622a50
jmp 0x622dac
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x91aee8
mov dword [esp + 8], 4
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
jns 0x622cd2
mov edx, str.setsockopt_SO_REUSEADDR__error:
mov eax, dword [ebp + 8]
call fcn.00622a50
mov dword [esp], ebx
call sub.WS2_32.dll_closesocket
sub esp, 4
mov edi, 0xffffffff
jmp 0x622dac
test si, si
jne 0x622cde
mov eax, dword [0xc12d84]
jmp 0x622ce3
mov eax, 0
mov word [ebp - 0x2c], 2
mov dword [ebp - 0x28], eax
mov word [ebp - 0x2a], si
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.WS2_32.dll_bind
sub esp, 0xc
test eax, eax
je 0x622d55
movzx esi, si
mov dword [esp], esi
call sub.WS2_32.dll_ntohs
sub esp, 4
movzx eax, ax
mov dword [esp + 8], eax
mov dword [esp + 4], str.bind___error__port_number:__d_:
lea esi, [ebp - 0x90]
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.00622a50
mov dword [esp], ebx
call sub.WS2_32.dll_closesocket
sub esp, 4
mov edi, 0xffffffff
jmp 0x622dac
mov eax, dword [0xc12d80]
test eax, eax
je 0x622dac
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x10], 4
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 9
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
jns 0x622dac
mov edx, str.error_setting_outgoing_multicast_interface:
mov eax, dword [ebp + 8]
call fcn.00622a50
mov dword [esp], ebx
call sub.WS2_32.dll_closesocket
sub esp, 4
mov edi, 0xffffffff
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x622e1e
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov esi, dword [ebp + 0xc]
call fcn.00623c28
test eax, eax
jne 0x622e4d
mov edx, str.Failed_to_initialize_winsock:
mov eax, dword [ebp + 8]
call fcn.00622a50
mov edi, 0xffffffff
jmp 0x622f7d
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_socket
sub esp, 0xc
mov ebx, eax
mov edi, eax
test eax, eax
jns 0x622e86
mov edx, str.unable_to_create_stream_socket:
mov eax, dword [ebp + 8]
call fcn.00622a50
jmp 0x622f7d
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x91aee8
mov dword [esp + 8], 4
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
jns 0x622ed7
mov edx, str.setsockopt_SO_REUSEADDR__error:
mov eax, dword [ebp + 8]
call fcn.00622a50
mov dword [esp], ebx
call sub.WS2_32.dll_closesocket
sub esp, 4
mov edi, 0xffffffff
jmp 0x622f7d
mov word [ebp - 0x28], 2
mov eax, dword [0xc12d84]
mov dword [ebp - 0x24], eax
mov word [ebp - 0x26], si
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.WS2_32.dll_bind
sub esp, 0xc
test eax, eax
je 0x622f4e
movzx esi, si
mov dword [esp], esi
call sub.WS2_32.dll_ntohs
sub esp, 4
movzx eax, ax
mov dword [esp + 8], eax
mov dword [esp + 4], str.bind___error__port_number:__d_:
lea esi, [ebp - 0x8c]
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.00622a50
mov dword [esp], ebx
call sub.WS2_32.dll_closesocket
sub esp, 4
mov edi, 0xffffffff
jmp 0x622f7d
cmp dword [ebp + 0x10], 0
je 0x622f7d
mov dword [esp], ebx
call fcn.00622db6
test eax, eax
jne 0x622f7d
mov edx, str.failed_to_make_non_blocking:
mov eax, dword [ebp + 8]
call fcn.00622a50
mov dword [esp], ebx
call sub.WS2_32.dll_closesocket
sub esp, 4
mov edi, 0xffffffff
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x622f87
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_recvfrom
sub esp, 0x18
mov ebx, eax
test eax, eax
jns 0x623009
mov eax, dword [edi]
mov dword [esp], edi
call dword [eax + 0x20]
cmp eax, 0x6f
je 0x622fef
test eax, eax
je 0x622fef
cmp eax, 0x2733
je 0x622fef
cmp eax, 0x71
jne 0x622ffd
mov dword [esi + 4], 0
mov ebx, 0
jmp 0x623009
mov edx, str.recvfrom___error:
mov eax, edi
call fcn.00622a50
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x623013
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x20]
mov al, byte [ebp + 0x18]
test al, al
je 0x623076
movzx eax, al
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x10], 4
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
jns 0x623076
mov edx, str.setsockopt_IP_MULTICAST_TTL__error:
mov eax, edi
call fcn.00622a50
mov eax, 0
jmp 0x6230f1
mov word [ebp - 0x2c], 2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov word [ebp - 0x2a], ax
mov dword [esp + 0x14], 0x10
lea eax, [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov eax, dword [ebp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.WS2_32.dll_sendto
sub esp, 0x18
cmp esi, eax
je 0x6230ec
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.writeSocket__d___sendTo___error:_wrote__d_bytes_instead_of__u:
lea ebx, [ebp - 0x90]
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov edx, ebx
mov eax, edi
call fcn.00622a50
mov eax, 0
jmp 0x6230f1
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x6231a1
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [esp], ebx
call fcn.00625df3
test eax, eax
je 0x623216
mov dword [ebp - 0x10], ebx
mov eax, dword [0xc12d84]
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 8
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
jns 0x62321d
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0x20]
test eax, eax
je 0x623224
mov edx, str.setsockopt_IP_ADD_MEMBERSHIP__error:
mov eax, esi
call fcn.00622a50
mov eax, 0
jmp 0x623229
mov eax, 1
jmp 0x623229
mov eax, 1
jmp 0x623229
mov eax, 1
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret

Function at 0x623230
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp], ebx
call fcn.00625df3
test eax, eax
je 0x623285
mov dword [ebp - 0x10], ebx
mov eax, dword [0xc12d84]
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 8
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xd
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
not eax
shr eax, 0x1f
jmp 0x62328a
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x62328f
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp], ebx
call fcn.00625df3
test eax, eax
je 0x6232fb
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [0xc12d84]
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 0xc
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xf
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
jns 0x623302
mov edx, str.setsockopt_IP_ADD_SOURCE_MEMBERSHIP__error:
mov eax, dword [ebp + 8]
call fcn.00622a50
mov eax, 0
jmp 0x623307
mov eax, 1
jmp 0x623307
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x62330c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp], ebx
call fcn.00625df3
test eax, eax
je 0x623367
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [0xc12d84]
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 0xc
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
not eax
shr eax, 0x1f
jmp 0x62336c
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x623c28
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
cmp dword [0xc12da8], 0
jne 0x623ca3
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sub.WS2_32.dll_WSAStartup
sub esp, 8
test eax, eax
je 0x623c74
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
mov dword [esp], 0x101
call sub.WS2_32.dll_WSAStartup
sub esp, 8
test eax, eax
jne 0x623caa
mov eax, dword [ebp - 0x198]
cmp ax, 0x202
je 0x623c92
cmp ax, 0x101
je 0x623c92
call sub.WS2_32.dll_WSACleanup
mov eax, 0
jmp 0x623caf
mov dword [0xc12da8], 1
mov eax, 1
jmp 0x623caf
mov eax, 1
jmp 0x623caf
mov eax, 0
leave
ret
Function at 0x6552a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
cmp dword [eax + 0x14], 0xcc
je 0x6552cd
mov eax, dword [eax + 0x180]
mov dword [esp], esi
call dword [eax]
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
lea edi, [esi + 0x78]
cmp byte [eax + 8], 0
je 0x65535a
mov eax, dword [esi + 0x78]
nop
cmp dword [esi + 0x60], eax
jbe 0x655330
mov edx, dword [esi + 8]
test edx, edx
je 0x6552fd
mov dword [edx + 4], eax
mov eax, dword [esi + 0x60]
mov dword [edx + 8], eax
mov dword [esp], esi
call dword [edx]
mov eax, dword [esi + 0x78]
mov ebx, eax
mov eax, dword [esi + 0x184]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [eax + 4]
mov eax, dword [esi + 0x78]
cmp eax, ebx
jne 0x6552e0
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x180]
mov dword [esp], esi
call dword [eax + 4]
mov eax, dword [esi + 0x180]
mov dword [esp], esi
call dword [eax]
mov eax, dword [esi + 0x180]
mov dword [esi + 0x78], 0
cmp byte [eax + 8], 0
jne 0x6552dc
cmp byte [esi + 0x41], 1
sbb eax, eax
add eax, 0xce
mov dword [esi + 0x14], eax
mov eax, 1
jmp 0x655328

Function at 0x6555e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
je 0x65569b
cmp eax, 0xcb
je 0x655633
cmp eax, 0xcc
je 0x65561c
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x15
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax]
mov eax, ebx
call fcn.006552a0
movzx eax, al
add esp, 4
pop ebx
pop ebp
ret
mov dword [ebx + 0x14], 0xcb
mov eax, dword [ebx + 0x190]
cmp byte [eax + 0x10], 0
je 0x655690
mov edx, dword [ebx + 8]
test edx, edx
je 0x65564b
mov dword [esp], ebx
call dword [edx]
mov eax, dword [ebx + 0x190]
mov dword [esp], ebx
call dword [eax]
test eax, eax
je 0x655626
cmp eax, 2
je 0x655690
mov edx, dword [ebx + 8]
test edx, edx
je 0x65564b
cmp eax, 3
je 0x655672
sub eax, 1
nop
jne 0x655642
mov eax, dword [edx + 4]
mov ecx, dword [edx + 8]
add eax, 1
cmp eax, ecx
mov dword [edx + 4], eax
jl 0x655642
add ecx, dword [ebx + 0x11c]
mov dword [edx + 8], ecx
jmp 0x655642
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x84], eax
jmp 0x65561c
mov dword [esp], ebx
call fcn.00657390
cmp byte [ebx + 0x40], 0
je 0x65562c
mov eax, 1
mov dword [ebx + 0x14], 0xcf
jmp 0x655626
Function at 0x655d20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esp], esi
call fcn.00657710
mov dword [esp + 4], 0x54
mov dword [esp], esi
mov dword [ebp - 0x10], eax
call fcn.00657760
test eax, eax
mov ebx, eax
je 0x655e4c
mov eax, dword [ebp - 0x10]
mov dword [ebx], fcn.00655ac0
mov dword [ebx + 4], fcn.00656330
mov dword [ebx + 8], fcn.006564c0
mov dword [ebx + 0xc], fcn.006563f0
mov dword [ebx + 0x10], 0x655c90
mov dword [ebx + 0x14], 0x655c00
mov dword [ebx + 0x18], 0x656580
mov dword [ebx + 0x1c], 0x6561a0
mov dword [ebx + 0x20], 0x656010
mov dword [ebx + 0x24], fcn.00655e70
mov dword [ebx + 0x28], 0x655fb0
mov dword [ebx + 0x30], 0x3b9aca00
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
mov dword [esi + 4], ebx
mov dword [esp], 0xb00940
call sub.msvcrt.dll_getenv
test eax, eax
mov edx, eax
je 0x655e34
lea eax, [ebp - 9]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 9], 0x78
mov dword [esp + 8], eax
mov dword [esp + 4], str._ld_c
mov dword [esp], edx
call sub.msvcrt.dll_sscanf
test eax, eax
jle 0x655e34
movzx eax, byte [ebp - 9]
cmp al, 0x6d
je 0x655e40
cmp al, 0x4d
je 0x655e40
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x3e8
mov dword [ebx + 0x2c], eax
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
imul eax, dword [ebp - 0x10], 0x3e8
mov dword [ebp - 0x10], eax
jmp 0x655e2b
mov dword [esp], esi
call fcn.00657720
mov eax, dword [esi]
mov dword [eax + 0x14], 0x37
mov dword [eax + 0x18], 0
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax]
jmp 0x655d57