joyce8/EMBER2024-capa huggingface dataset:
Function at 0x586d3a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0x10]
inc ecx
mov eax, ecx
xor eax, esi
shl eax, 4
add eax, dword [ebp + 8]
inc ecx
mov dword [edx], eax
lea edx, [edx + 4]
cmp ecx, 4
jl 0x586d58
xor ecx, ecx
cmp ecx, 3
jge 0x586e9a
mov eax, dword [ebp + ecx*4 - 0x10]
inc ecx
mov dword [ebp - 0x18], ecx
movsd xmm3, qword [eax]
movsd xmm4, qword [eax + 8]
xor eax, eax
cmp ecx, 3
movsd qword [ebp - 0x30], xmm3
movsd qword [ebp - 0x38], xmm4
cmovne eax, ecx
mov eax, dword [ebp + eax*4 - 0x10]
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 8]
subsd xmm0, xmm3
subsd xmm2, xmm4
ucomisd xmm0, qword [0x5fbfa8]
movsd qword [ebp - 0x40], xmm0
movsd qword [ebp - 0x28], xmm2
lahf
test ah, 0x44
jp 0x586dd6
ucomisd xmm2, qword [0x5fbfa8]
lahf
test ah, 0x44
jnp 0x586d6f
movsd xmm1, qword [edi + 8]
subsd xmm1, xmm4
push ecx
push ecx
mulsd xmm1, xmm0
movsd xmm0, qword [edi]
subsd xmm0, xmm3
mulsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
movsd qword [esp], xmm1
call fcn.0052c774
pop ecx
pop ecx
test al, al
jne 0x586e89
mov ebx, dword [ebp + 0xc]
xor eax, eax
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov dword [ebp - 0x14], eax
movsd xmm2, qword [ebx + 8]
movsd xmm0, qword [ebx]
subsd xmm2, qword [ebp - 0x38]
subsd xmm0, xmm4
mulsd xmm2, qword [ebp - 0x40]
mulsd xmm0, xmm3
subsd xmm2, xmm0
movaps xmm0, xmm2
mulsd xmm0, xmm1
comisd xmm0, xmmword [0x5fbfa8]
jbe 0x586e75
push ecx
push ecx
movsd qword [esp], xmm2
call fcn.00536257
pop ecx
pop ecx
test al, al
je 0x586e89
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
inc eax
add ebx, 0x10
mov dword [ebp - 0x14], eax
cmp eax, 4
jl 0x586e21
mov ecx, dword [ebp - 0x18]
jmp 0x586d6f
inc esi
add edi, 0x10
cmp esi, 4
jl 0x586d52
xor al, al
jmp 0x586e9c
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret

Function at 0x58a393
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, edx
push esi
shr ebx, 4
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x58a3cd
rol esi, 0xf
xor esi, dword [edi]
rol esi, 0xf
xor esi, dword [edi + 4]
rol esi, 0xf
xor esi, dword [edi + 8]
rol esi, 0xf
xor esi, dword [edi + 0xc]
add edi, 0x10
sub ebx, 1
jne 0x58a3ac
xor ecx, ecx
shr edx, 2
xor ebx, ebx
and edx, 3
lea eax, [edi + edx*4]
lea edx, [edx*4 + 3]
shr edx, 2
cmp edi, eax
cmova edx, ebx
test edx, edx
je 0x58a3f8
rol esi, 0xf
xor esi, dword [edi]
inc ecx
lea edi, [edi + 4]
cmp ecx, edx
jb 0x58a3eb
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x5a1d53
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.005ad75f
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x5a1d80
xor eax, eax
jmp 0x5a1e7c
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x4aed7b
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.005a2dfe
push esi
push eax
call fcn.004aed90
add esp, 0x14
test eax, eax
je 0x5a1dbb
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.005ad90a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.005a2de0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.005a44ff
add esp, 0x28
test eax, eax
jne 0x5a1df2
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x5a1e33
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005ad8db
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x5a1e2e
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x5a1e63
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.005ad830
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.005ad7e8
add esp, 0x14
jmp 0x5a1d79
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.005ad6ae
push dword [ebp - 4]
call fcn.005a1f26
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5a42a5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x5a42db
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x5a42ce
push eax
call fcn.005ad7d4
push 2
call fcn.005ad74b
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.004ac380
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x5a56d2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.005ad75f
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x5a56ff
xor eax, eax
jmp 0x5a58a3
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x4aed7b
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.005a2dfe
push esi
push eax
call fcn.004aed90
add esp, 0x14
test eax, eax
je 0x5a574c
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.005ad90a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.005a2de0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.005a44ff
add esp, 0x28
test eax, eax
jne 0x5a5783
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x5a57bf
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005ad8db
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x5a57bf
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x5a45d1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.005a4620
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x5a583f
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.005b4d50
add esp, 0xc
cmp eax, 0xfffffffa
je 0x5a5828
cmp eax, 0xfffffffc
je 0x5a5821
cmp eax, 0xfffffffe
je 0x5a581a
test eax, eax
je 0x5a583a
push str.Unknown_zlib_error
jmp 0x5a582d
push str.zlib_stream_error
jmp 0x5a582d
push str.zlib_memory_error
jmp 0x5a582d
push str.zlib_version_error
push dword [ebp - 4]
call fcn.005a2e1a
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x5a586f
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.005ad830
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.005ad7e8
add esp, 0x14
jmp 0x5a56f8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.005aa6a6
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5b3355
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 8], edx
cmp dword [edi + 0x6c], eax
jb 0x5b33f1
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004ab1c0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 4], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x5b33a6
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x5b33cd
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x5b3516
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x5b341e
xor eax, eax
jmp 0x5b346a
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x5b343b
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.005b6a0b
jmp 0x5b344b
cmp eax, 2
jne 0x5b3454
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.005b4f21
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 0x30], eax
push ecx
push dword [esi]
push dword [ebp - 8]
call fcn.004ab1c0
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x5b3492
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x5b34a7
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x5b3363
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x5b3516
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x5b34e6
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.004ac380
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x5b3516
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x5b3516
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
add eax, ecx
push esi
push 0
push eax
call fcn.004ac380
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b4f21
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x5b4f2e
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.005b4f34
Function at 0x5b8ac0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004ac380
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jg 0x5b8b32
cmp dword [ebp - 0x118], 2
jg 0x5b8b32
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret

Function at 0x5b8b90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x5b8bbc
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x5b8bad
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x5b8bf0
cmp dword [esi + 8], 0
jne 0x5b8be0
push 0x5f96b4
push dword [eax + 8]
call fcn.004bc90f
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x5b8be0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004bcbe8
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x5b8c12
mov eax, dword [esi + 8]
test eax, eax
je 0x5b8c0c
push eax
call fcn.004bc99c
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x5b8ee0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5b8f30
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x5b8f2a
shr eax, 8
cmp al, 2
jne 0x5b8f2a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret

Function at 0x5b9660
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x130]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x5b96de
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x5b96ae
pop esi
pop edi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push esi
push dword [ebp + 8]
call fcn.005c6d60
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.005b9340
mov eax, dword [ebp + 8]
add esp, 0x14
mov eax, dword [eax]
mov dword [eax + 0x856c], esi
mov eax, edi
mov dword [ebx], 0x37
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5b98c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x164]
test eax, eax
je 0x5b98e9
push dword [esi + 0xf4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x5b991f
push dword [esi + 0xf0]
lea eax, [eax + eax*2]
push 1
add eax, 0x63404c
push 2
push eax
call fcn.004c0fa3
push dword [esi + 0xf0]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004c0fa3
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5bcae0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x48
push 1
call dword [0x66ca90]
mov esi, dword [ebp + 8]
mov edi, eax
add esp, 8
mov ebx, 8
mov dword [esi + 0x3bc], edi
test edi, edi
je 0x5bcbbc
push dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
lea eax, [edi + 0x10]
push ecx
push dword [ebp + 0xc]
mov dword [esi + 0x3ac], ecx
mov dword [esi + 0x3b4], 0
mov dword [esi + 0x3b8], 0
mov dword [esi + 0x3b0], 0
push eax
mov dword [edi + 4], 0xffffffff
mov dword [edi], 0
call fcn.005bcbf0
add esp, 0x10
test eax, eax
je 0x5bcbbc
mov eax, dword [esi + 0x3a8]
test eax, eax
je 0x5bcb74
push eax
call dword [0x66ca84]
add esp, 4
mov dword [esi + 0x3a8], 0
push dword [ebp + 0xc]
call dword [0x66ca8c]
add esp, 4
mov dword [esi + 0x3a8], eax
test eax, eax
je 0x5bcbbc
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x5bcbbc
lea eax, [edi + 0x10]
push eax
push 0x5bca50
call fcn.005c93a0
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x5bcbd9
call fcn.004b4d11
mov ebx, dword [eax]
lea eax, [esi + 0x3a8]
push eax
call fcn.005bc960
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x5c5390
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x530]
cmp ecx, 0xffffffff
je 0x5c53eb
mov eax, dword [eax + 0x524]
mov eax, dword [eax]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x5c53eb
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x5c53b9
mov dword [ecx], eax
cmp dword [eax + 0x148], 0
push esi
mov esi, dword [eax + 0x130]
je 0x5c53cf
or eax, 0xffffffff
pop esi
pop ebp
ret
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
or ecx, 0xffffffff
test eax, eax
cmove esi, ecx
mov eax, esi
pop esi
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret
Function at 0x5c55d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x19c], 0
mov ebx, dword [edi]
jne 0x5c5743
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x5c564e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.005c6d60
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.005b9340
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0x80
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x5c56a1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.005c6d60
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.005b9340
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xcc]
push eax
lea eax, [edi + 0x9e]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.005c5b40
add esp, 0xc
test eax, eax
jne 0x5c56f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.005c6d60
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.005b9340
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x100]
push eax
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.005c5b40
add esp, 0xc
test eax, eax
jne 0x5c5743
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.005c6d60
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.005b9340
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
push edi
call fcn.005c53f0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
Function at 0x5c5fb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov esi, dword [edi]
mov eax, dword [esi + 0x314]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x5c5ffa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.005c6d60
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.005b93e0
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.005b93e0
add esp, 8
pop edi
pop esi
pop ebp
ret

Function at 0x5c7e60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x5c7e71
jmp dword [eax*4 + 0x5c7ee4]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret
Function at 0x5c8c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x69130c], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x5c8740
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x5c89e0
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.005c86f0
jne 0x5c8db2
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x5c8da8
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004c2240
push str.ws2_32
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.005e1831
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x5c8d08
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x5c8d5d
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004c2240
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.005e1831
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5c8da5
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x5c8d5d
push edi
call esi
jmp 0x5c8da5
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x5c8d9e
inc esi
cmp esi, 3
jl 0x5c8d60
mov eax, dword [ebp - 0x22c]
mov dword [0x66ca98], eax
mov eax, dword [ebp - 0x224]
mov dword [0x66caa0], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.005c86f0], eax
jmp 0x5c8da5
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x69130c], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax*8 + 0x66ca98]
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret 4