joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d5a0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x59e068]
sub esp, 0x3e8
test eax, eax
push ebp
push esi
mov ebp, edx
mov esi, ecx
je 0x50d6c4
lea esp, [esp]
cmp eax, esi
je 0x50d5d9
mov eax, dword [eax + 0x3cc]
test eax, eax
jne 0x50d5c0
pop esi
pop ebp
add esp, 0x3e8
ret 8
mov ecx, dword [esi]
push edi
call fcn.004dbfb0
mov edi, eax
test edi, edi
je 0x50d6c3
push ebx
mov bl, byte [esp + 0x400]
test bl, 1
je 0x50d642
xor edx, edx
mov ecx, 0x1391
call fcn.0041c9e0
push eax
push 1
push 0
push 1
mov edx, 1
mov ecx, esi
call fcn.00529eb0
push ebp
lea eax, [esi + 0x234]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x1c]
push str.NOTICE__s_:DCC_Send__s___s__n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push edi
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.0053ec90
test bl, 2
je 0x50d665
mov eax, dword [esi + 0x364]
mov edx, dword [esp + 0x3fc]
xor ecx, ecx
mov cx, word [esi + 0x354]
push edi
push 0
push eax
push ecx
push edx
jmp 0x50d698
test bl, 4
je 0x50d6a6
mov eax, dword [esi + 0x340]
mov ecx, dword [esi + 0x364]
xor edx, edx
mov dx, word [esi + 0x354]
push edi
push eax
push ecx
lea eax, [esi + 0xcc]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
lea ecx, [esi + 4]
lea edx, [esi + 0x234]
call fcn.0050d420
xor edx, edx
mov ecx, 0x1392
call fcn.0041c9e0
push eax
push 0
push 0
push 0
xor edx, edx
mov ecx, esi
call fcn.00529eb0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x3e8
ret 8
Function at 0x50ea00
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
mov ecx, dword [esi + 0x3c8]
call fcn.004dbea0
test eax, eax
jne 0x50ea2a
push 0x574b10
xor edx, edx
mov ecx, esi
call fcn.0050e340
xor eax, eax
pop esi
add esp, 0x1c
ret
push edi
lea edi, [esi + 0xcc]
push edi
mov dword [esi + 0x33c], 1
mov dword [esi + 0x39c], 0
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov ecx, dword [0x597618]
mov dword [esp + 8], eax
jne 0x50ea97
test ecx, ecx
je 0x50ea69
mov edx, dword [0x597614]
test edx, edx
jne 0x50ea97
mov eax, dword [esi + 0x378]
test eax, eax
je 0x50ea8d
mov ecx, dword [esi]
push 8
push 0
push edi
lea edx, [esi + 4]
call fcn.0046d660
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
mov ecx, 0x138d
jmp 0x50ebbb
test ecx, ecx
je 0x50eaf8
xor edx, edx
mov ecx, 0x138e
call fcn.0041c9e0
push eax
push 1
push 0
push 1
mov edx, 1
mov ecx, esi
call fcn.00529eb0
mov eax, dword [esi + 0x340]
test eax, eax
jne 0x50eacf
call fcn.0041df60
mov dword [esi + 0x340], eax
mov eax, dword [esi + 0x3c8]
mov ecx, dword [esi + 0x340]
mov dx, word [esi + 0x354]
push eax
push ecx
push 0
mov ecx, edi
call fcn.00486340
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
lea edx, [esp + 8]
mov dword [esp + 0xc], edx
xor edx, edx
mov dx, word [esi + 0x354]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], ecx
push edx
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], eax
call dword [sym.imp.WSOCK32.dll_htons]
mov dx, word [0x589910]
mov word [esp + 0x16], ax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 0
push 2
mov dword [esp + 0x20], ecx
mov cx, word [0x58990c]
push 0
call fcn.004fd380
cmp eax, 0xffffffff
mov dword [esi + 0x3c4], eax
jne 0x50eb6f
mov ecx, 0x138f
jmp 0x50ebbb
mov ecx, eax
call fcn.0053e860
mov edx, dword [0x5a1b00]
mov eax, dword [esi + 0x3c4]
push 0x10
push 0x8014
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov edx, dword [esi + 0x3c4]
push 0x10
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x50ebcc
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x50ebcc
mov ecx, 0x1390
xor edx, edx
call fcn.0041c9e0
mov ecx, esi
xor edx, edx
push eax
call fcn.0050e340
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
Function at 0x50ed80
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
mov eax, 0x2004
call fcn.00565660
push esi
mov esi, ecx
test esi, esi
je 0x50efc5
mov edx, dword [esi + 0x3c4]
push 1
push 2
mov ecx, 0x8017
mov dword [esi + 0x39c], 0
call fcn.0053f9b0
test eax, eax
jne 0x50efc5
push ebx
push ebp
push edi
mov edi, edi
mov ecx, dword [esi + 0x3c0]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x3c0], ecx
jl 0x50edfa
mov edx, dword [esi + 0x3c4]
push 0
push 2
mov ecx, 0x8017
mov dword [esi + 0x3c0], 0
call fcn.0053f9b0
test eax, eax
jne 0x50efc2
cmp dword [esi + 0x33c], 2
jne 0x50efc2
mov eax, dword [0x59e644]
test eax, eax
jne 0x50ee2b
mov eax, dword [0x589bb4]
test eax, eax
jne 0x50ee2b
mov eax, dword [esi + 0x350]
cmp eax, dword [esi + 0x358]
jb 0x50efc2
mov eax, dword [esi + 0x3ac]
test eax, eax
mov edi, dword [esi + 0x34c]
je 0x50ee68
mov ecx, esi
call fcn.0050d240
test eax, eax
jne 0x50ee66
mov edx, dword [esi + 0x3c4]
push eax
push 2
mov ecx, 0x8017
call fcn.0053f9b0
test eax, eax
jne 0x50efc2
mov eax, 0x200
mov edi, eax
cmp edi, 0x200
jge 0x50ee77
mov edi, 0x200
jmp 0x50ee84
cmp edi, 0x2000
jbe 0x50ee84
mov edi, 0x2000
mov ecx, dword [esi + 0x338]
push 1
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x338]
push 0
lea edx, [esp + 0x14]
push edx
mov ebp, eax
push edi
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x50ef79
mov eax, dword [esp + 0x10]
test eax, eax
mov ebx, eax
jl 0x50ef79
je 0x50efc2
push 0
push eax
mov eax, dword [esi + 0x3c4]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
je 0x50ef80
cmp edi, ebx
jge 0x50ef12
mov edx, dword [esi + 0x338]
push 0
push 0
lea ecx, [edi + ebp]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, edi
mov ecx, dword [esi + 0x3b0]
mov edx, dword [esi + 0x358]
add ecx, ebx
add edx, ebx
mov dword [esi + 0x3b0], ecx
mov ecx, esi
mov dword [esi + 0x358], edx
call fcn.0050d6d0
mov eax, dword [0x59e644]
test eax, eax
jne 0x50edc0
mov eax, dword [0x589bb4]
test eax, eax
je 0x50efc2
mov eax, dword [esi + 0x34c]
mov ecx, dword [esi + 0x358]
mov ebx, dword [esi + 0x350]
lea edx, [eax + eax*4]
sub ecx, ebx
shl edx, 1
cmp ecx, edx
jb 0x50edc0
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x2004
ret
mov ecx, 0x1397
jmp 0x50efb1
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x50efac
mov eax, dword [esi + 0x338]
push 0
push 0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x2004
ret
mov ecx, 0x139a
xor edx, edx
call fcn.0041c9e0
mov ecx, esi
xor edx, edx
push eax
call fcn.0050e340
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x2004
ret
Function at 0x50efd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x50f0c9
cmp dword [esi + 0x33c], 2
jne 0x50f0c9
mov ecx, dword [esi + 0x3c4]
push 0
push 4
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esi + 0x39c], 0
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
jne 0x50f03a
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x50f0c9
xor edx, edx
mov ecx, 0x139a
call fcn.0041c9e0
push eax
xor edx, edx
mov ecx, esi
call fcn.0050e340
xor eax, eax
pop esi
pop ecx
ret
test eax, eax
jle 0x50f067
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.WSOCK32.dll_ntohl]
cmp eax, dword [esi + 0x350]
jbe 0x50f067
mov ecx, dword [esi + 0x364]
cmp eax, ecx
mov dword [esi + 0x350], eax
jb 0x50f07a
mov dword [esi + 0x350], ecx
push 0x574b10
xor edx, edx
mov ecx, esi
call fcn.0050e340
xor eax, eax
pop esi
pop ecx
ret
mov ecx, esi
call fcn.0050d6d0
mov edx, dword [esi + 0x358]
cmp edx, dword [esi + 0x364]
jae 0x50f0c9
mov eax, dword [esi + 0x34c]
mov ecx, dword [esi + 0x350]
push edi
lea eax, [eax + eax*4]
shl eax, 1
mov edi, edx
sub edi, ecx
cmp edi, eax
sbb eax, eax
neg eax
cmp ecx, edx
mov dword [esp + 8], eax
pop edi
jae 0x50f0c2
mov ecx, dword [0x589bb4]
test ecx, ecx
je 0x50f0c9
test eax, eax
je 0x50f0c9
mov ecx, esi
call fcn.0050ed80
xor eax, eax
pop esi
pop ecx
ret
Function at 0x50f0d0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, dword [0x59e068]
test eax, eax
push esi
push edi
mov esi, ecx
je 0x50ed35
cmp eax, esi
je 0x50ec02
mov eax, dword [eax + 0x3cc]
test eax, eax
jne 0x50ebf1
pop edi
pop esi
ret
mov ecx, dword [esi + 0x3c8]
call fcn.004dbea0
test eax, eax
jne 0x50ec24
push 0x574b10
xor edx, edx
mov ecx, esi
call fcn.0050e340
pop edi
xor eax, eax
pop esi
ret
mov dword [esi + 0x33c], 1
mov dword [esi + 0x39c], 0
mov eax, dword [0x597618]
test eax, eax
je 0x50ecf6
mov eax, dword [esi + 0x3c8]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
xor edx, edx
xor ecx, ecx
call fcn.00486340
mov al, byte [0x5974e0]
test al, al
je 0x50ecda
mov eax, dword [0x597620]
test eax, eax
mov edx, 0x64
lea edi, [esi + 0xcc]
je 0x50ec7d
push 0x5974e0
jmp 0x50ec8a
mov ecx, dword [esi + 0x3c8]
add ecx, 0x8a4
push ecx
mov ecx, edi
call fcn.0041e120
mov eax, dword [esi + 0x340]
test eax, eax
mov word [esi + 0x354], 0
jne 0x50ecaf
call fcn.0041df60
mov dword [esi + 0x340], eax
push edi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x50ece1
mov eax, dword [esi + 0x3c8]
mov ecx, dword [eax]
push 9
push 0
push edi
mov edx, str.firewall
call fcn.0046d660
test eax, eax
jne 0x50ed6b
mov ecx, 0x1393
jmp 0x50ed24
push 5
push 0
mov edx, edi
mov ecx, esi
call fcn.0050d5a0
pop edi
mov eax, 1
pop esi
ret
mov dx, word [0x589910]
push 1
lea ecx, [esi + 0x354]
push 0
push ecx
mov cx, word [0x58990c]
call fcn.004fd380
cmp eax, 0xffffffff
mov dword [esi + 0x3c4], eax
jne 0x50ed3a
mov ecx, 0x138f
xor edx, edx
call fcn.0041c9e0
push eax
xor edx, edx
mov ecx, esi
call fcn.0050e340
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [0x5a1b00]
push 8
push 0x8016
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [esi + 0x3c8]
mov ecx, dword [eax + 0x908]
push 3
push ecx
lea edx, [eax + 0x8a4]
mov ecx, esi
call fcn.0050d5a0
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [0x59e068]
test ecx, ecx
je 0x50f0f4
lea ebx, [ebx]
mov eax, dword [ecx + 0x3a0]
test eax, eax
jne 0x50f110
mov ecx, dword [ecx + 0x3cc]
test ecx, ecx
jne 0x50f0e0
mov eax, dword [0x5a1b00]
push 0x85
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x59e648], 0
ret
mov eax, dword [ecx + 0x378]
test eax, eax
mov dword [ecx + 0x3a0], 0
je 0x50f129
jmp fcn.0050ea00
jmp 0x50ebe0
Function at 0x510190
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, ecx
call fcn.004dbea0
test eax, eax
je 0x5101d9
mov eax, dword [esi + 0xc]
test eax, eax
je 0x5101d9
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jne 0x5101b3
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x5101a3
jmp 0x5101c1
mov dword [eax + 0x1c], 0
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x5101c8
mov eax, dword [esi + 0xc]
test eax, eax
je 0x5101d9
mov ecx, dword [eax]
mov edx, esi
mov dword [eax + 0x1c], 1
pop esi
jmp fcn.0050feb0
pop esi
ret
Function at 0x5112e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
push esi
mov dword [esp + 0x10], edx
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
push 0x461
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
jne 0x511312
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x58f8d0
push 0x3e7
push 0xd
push 0x480
push edi
call ebp
mov al, byte [0x58f8d0]
xor ebx, ebx
cmp al, bl
je 0x511527
push 0x2a
push 0x58f8d0
call fcn.00563730
add esp, 8
test eax, eax
jne 0x511527
push 0x3f
push 0x58f8d0
call fcn.00563730
add esp, 8
test eax, eax
jne 0x511527
push 0x59e070
push 0x64
push 0xd
push 0x98
push esi
call ebp
push 0x58f4e8
push 0x64
push 0xd
push 0x98
push esi
mov byte [0x59e070], bl
call ebp
cmp byte [0x58f4e8], 0x20
mov eax, 0x58f4e8
jne 0x5113a9
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x5113a0
cmp byte [eax], bl
je 0x5113e8
mov edx, 0x59e070
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x5113b4
mov eax, 0x59e070
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5113c6
sub eax, edx
dec eax
cmp eax, ebx
jle 0x5113e8
cmp byte [eax + 0x59e070], 0x20
jne 0x5113e8
mov byte [eax + 0x59e070], bl
dec eax
cmp eax, ebx
jg 0x5113d4
cmp byte [0x59e070], bl
jne 0x511415
push 0x98
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor ecx, ecx
call fcn.0041c8e0
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x90
push esi
call edi
dec eax
neg eax
sbb eax, eax
push 0x97
inc eax
push esi
mov dword [0x59e640], eax
call edi
dec eax
neg eax
sbb eax, eax
push 0x92
inc eax
push esi
mov dword [0x589bb4], eax
call edi
mov ecx, dword [esp + 0x10]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [0x589bbc], eax
call fcn.00510ee0
cmp byte [0x59f250], bl
jne 0x511483
push 0x460
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ah, ah
jns 0x5114c9
push 0x53
call edi
test ah, ah
js 0x5114c9
push 9
push 0x59f250
call fcn.00563730
add esp, 8
test eax, eax
jne 0x5114be
call fcn.004dbf30
push eax
xor edx, edx
mov ecx, 0x59f250
call fcn.00517a40
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push ebx
push ebx
push 0x147
push 0x9a
push esi
call ebp
cmp eax, 0xffffffff
jne 0x5114df
xor eax, eax
cmp eax, ebx
mov ecx, 0x200
mov dword [0x589bb8], ecx
jle 0x511527
mov edi, edi
add ecx, ecx
dec eax
jne 0x5114f0
cmp ecx, 0x200
mov dword [0x589bb8], ecx
jge 0x511515
pop ebp
pop edi
pop esi
mov dword [0x589bb8], 0x200
xor eax, eax
pop ebx
pop ecx
ret
cmp ecx, 0x2000
jle 0x511527
mov dword [0x589bb8], 0x2000
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x511a90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push 0x461
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
je 0x511b4f
push 0x58f8d0
push 0x3e7
push 0xd
push 0x480
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov al, byte [0x58f8d0]
test al, al
je 0x511b4f
push 0x2a
push 0x58f8d0
call fcn.00563730
add esp, 8
test eax, eax
jne 0x511b4f
push 0x3f
push 0x58f8d0
call fcn.00563730
add esp, 8
test eax, eax
jne 0x511b4f
test edi, edi
je 0x511b4f
mov ecx, edi
call fcn.00510ee0
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x511b4f
mov al, byte [0x59f250]
test al, al
je 0x511b46
push 9
push 0x59f250
call fcn.00563730
add esp, 8
test eax, eax
jne 0x511b46
call fcn.004dbf30
push eax
xor edx, edx
mov ecx, 0x59f250
call fcn.00517a40
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x514690
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
sub esp, 0x94
push esi
mov esi, ecx
lea eax, [esi + 0x64]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x5146b9
mov eax, 3
pop esi
add esp, 0x94
ret
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp + 8], eax
xor eax, eax
mov ax, word [esi + 0xc8]
push ebx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], 0
push eax
mov dword [esp + 0x1c], edx
mov word [esp + 0x10], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [esp + 0x24]
mov word [esp + 0xe], ax
mov edx, dword [ecx]
mov dword [esp + 0x10], edx
push 0x59c9f8
mov edx, 0x64
lea ecx, [esp + 0x40]
call fcn.0041e120
mov al, byte [esi + 0xca]
test al, al
mov ebx, dword [0x59c9f4]
lea edi, [esi + 0xca]
je 0x51474a
push edi
mov edx, 0x64
mov ecx, 0x59c9f8
call fcn.0041e120
mov dword [0x59c9f4], 2
mov dx, word [0x589910]
mov cx, word [0x58990c]
push 0
push 2
push 0
call fcn.004fd380
mov dword [esi + 0x18c], eax
lea eax, [esp + 0x3c]
push eax
mov edx, 0x64
mov ecx, 0x59c9f8
call fcn.0041e120
mov dword [0x59c9f4], ebx
mov ecx, dword [esi + 0x18c]
cmp ecx, 0xffffffff
jne 0x51479d
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x94
ret
call fcn.0053e860
mov ecx, dword [0x5a1b00]
mov edx, dword [esi + 0x18c]
push 0x10
push 0x8039
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [esi + 0x18c]
cmp eax, 0xffffffff
je 0x51480f
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x28], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jne 0x51480f
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
mov edx, 0x64
mov ecx, edi
call fcn.0041e120
mov ecx, dword [esp + 0x2e]
push ecx
call dword [sym.imp.WSOCK32.dll_ntohs]
mov word [esi + 0x12e], ax
mov eax, dword [esi + 0x18c]
push 0x10
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x514843
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x514843
pop edi
pop ebx
mov eax, 2
pop esi
add esp, 0x94
ret
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x94
ret
Function at 0x514850
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
xor esi, esi
test eax, eax
mov dword [esp + 0x14], edx
mov ebp, 1
mov dword [esp + 0x10], 0
je 0x5148b9
cmp byte [eax], 0x2d
jne 0x5148b9
push 0x575cf0
push eax
call fcn.00572b46
add esp, 8
test eax, eax
jne 0x51488c
mov esi, ebp
test esi, esi
mov ebp, 2
je 0x5148b9
mov eax, dword [edi + 8]
test eax, eax
je 0x514a93
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x514950
mov dword [esp + 0x10], ebp
mov ebp, 3
mov ecx, dword [edi + ebp*4]
test ecx, ecx
je 0x514a93
mov eax, dword [edi + ebp*4 + 4]
test eax, eax
je 0x514a93
mov eax, dword [edi + ebp*4 + 8]
test eax, eax
je 0x514a93
call fcn.00513240
test eax, eax
je 0x5148f8
xor edx, edx
mov ecx, 0x1453
call fcn.0041c9e0
push eax
mov eax, dword [edi + ebp*4]
push eax
jmp 0x51491f
mov eax, dword [edi + ebp*4]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x514900
sub eax, edx
cmp eax, 0x5a
jbe 0x51493c
xor edx, edx
mov ecx, 0x1452
call fcn.0041c9e0
mov ecx, dword [edi + ebp*4]
push eax
push ecx
push str.__sockopen:__s__s
push 0x595d60
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov edx, dword [edi + ebp*4 + 8]
push edx
call fcn.00563a14
mov ebx, eax
add esp, 4
test bx, bx
ja 0x514964
mov edx, dword [edi]
push 3
xor ecx, ecx
push ecx
call fcn.00475f10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call fcn.00513010
mov esi, eax
test esi, esi
jne 0x514983
mov edx, dword [edi]
push 2
xor ecx, ecx
push ecx
call fcn.00475f10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [edi + ebp*4]
push eax
mov edx, 0x64
mov ecx, esi
call fcn.0041e120
mov ecx, dword [edi + ebp*4 + 4]
push ecx
lea ecx, [esi + 0x64]
mov edx, 0x64
call fcn.0041e120
push 0
mov word [esi + 0xc8], bx
mov dword [esi + 0x14c], 3
mov dword [esi + 0x150], 0
call fcn.00563e36
mov dword [esi + 0x17c], eax
mov dword [esi + 0x180], eax
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x5149f2
mov edx, dword [edi + eax*4]
push edx
lea ecx, [esi + 0xca]
mov edx, 0x64
call fcn.0041e120
mov ebx, dword [esp + 0x14]
mov dword [esi + 0x190], ebx
mov eax, dword [edi + ebp*4 + 4]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x514a5d
mov dword [esi + 0x150], 4
mov ecx, dword [edi + ebp*4 + 4]
mov edx, dword [edi + ebp*4]
push 4
push 0
push ecx
mov ecx, dword [ebx]
call fcn.0046d660
test eax, eax
jne 0x514a50
mov edx, dword [esi + 0x18c]
push 0x274d0010
push edx
mov dword [esi + 0x150], eax
mov eax, dword [0x5a1b00]
push 0x8039
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov ecx, esi
call fcn.00514690
test eax, eax
jle 0x514a86
mov ecx, dword [esi + 0x18c]
mov edx, dword [0x5a1b00]
push 0x274d0010
push ecx
push 0x8039
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov edx, dword [edi]
push 0
xor ecx, ecx
push ecx
call fcn.00475f10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x514ab0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [0x59f670]
test esi, esi
mov eax, edx
je 0x514bc8
cmp dword [esi + 0x18c], ecx
je 0x514adb
mov esi, dword [esi + 0x194]
test esi, esi
jne 0x514ac4
pop esi
add esp, 0x14
ret
shr eax, 0x10
test ax, ax
je 0x514b1e
movzx eax, ax
mov dword [esi + 0x184], eax
mov eax, dword [0x59ca60]
test eax, eax
je 0x514b05
push 3
push 0x3d
mov edx, esi
mov ecx, str.SOCKOPEN
call fcn.00513350
mov ecx, esi
call fcn.00513210
test eax, eax
je 0x514bc8
call fcn.00513140
pop esi
add esp, 0x14
ret
push 0
mov dword [esi + 0x14c], 2
call fcn.00563e36
mov edx, dword [esi + 0x18c]
add esp, 4
push 0x23
mov dword [esi + 0x17c], eax
mov dword [esi + 0x180], eax
mov ecx, dword [0x5a1b00]
push 0x8038
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [esi + 0x18c]
cmp eax, 0xffffffff
je 0x514baf
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x10], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jne 0x514baf
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea ecx, [esi + 0xca]
mov edx, 0x64
call fcn.0041e120
mov ecx, dword [esp + 0xa]
push ecx
call dword [sym.imp.WSOCK32.dll_ntohs]
mov word [esi + 0x12e], ax
mov eax, dword [0x59ca60]
test eax, eax
je 0x514bc8
push 0
push 0x3d
mov edx, esi
mov ecx, str.SOCKOPEN
call fcn.00513350
pop esi
add esp, 0x14
ret