joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b600
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x42b634
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42b634
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x42b6ee
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x42b64b
cmp al, 0x5c
jne 0x42b64d
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x42b643
cmp esi, ebx
je 0x42b681
sub esi, ebx
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0053eee0
lea ecx, [ebp - 0x20c]
push ecx
push edi
mov byte [ebp + esi - 0x20c], 0
call fcn.0042b600
add esp, 0x14
mov byte [ebp - 0x108], 0
test edi, edi
je 0x42b6a0
lea edx, [ebp - 0x108]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42b696
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b6a4
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x42b6b4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
cmp eax, 0xffffffff
jne 0x42b6ee
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0053e66f
mov esp, ebp
pop ebp
ret

Function at 0x42d3f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
cmp dword [ebx], 0
jne 0x42d4bb
cmp dword [ebx + 4], 0xffffffff
jne 0x42d4bb
push edi
lea edi, [ebx + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d421
sub eax, edx
mov al, byte [eax + ebx + 0x13f]
cmp al, 0x5c
je 0x42d451
cmp al, 0x2f
je 0x42d451
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42d440
mov ax, word [0x5b222c]
mov word [edi], ax
mov edi, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
cmp edi, 1
jne 0x42d47b
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42d47b
pop esi
pop edi
mov eax, 0x2000000
pop ebx
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push edi
push edx
push esi
call fcn.00429ca0
add esp, 0x10
test eax, eax
jne 0x42d49b
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push eax
call fcn.0042ce10
add esp, 4
mov dword [ebx], eax
neg eax
sbb eax, eax
pop esi
and eax, 0xfffffe00
pop edi
add eax, 0x200
pop ebx
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
pop ebp
ret 0xc
Function at 0x442c03
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x442c4a
call fcn.00444073
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x442c4a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x442c66
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00442708
mov esi, eax
test edi, edi
je 0x442c64
test ebx, ebx
je 0x442c64
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x443776
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5a03dd
call fcn.005410fb
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x44379b
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4437ed
call fcn.0042f84e
push eax
lea ecx, [ebp - 0x10]
call fcn.00402580
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00540f2c
push eax
call fcn.00407df0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401fb0
mov eax, esi
call fcn.005411d3
ret 8

Function at 0x4482b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00444073
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4482e5
xor eax, eax
jmp 0x44838c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x4482de
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4482de
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042e0a0
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x44833d
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 2
cmp eax, edx
jl 0x44832b
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00446f81
push edi
mov ebx, eax
call fcn.0042e0da
pop ecx
test ebx, ebx
je 0x44837f
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.004475a0
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00447654
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4
Function at 0x44a5ee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00444073
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44a627
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0044a230
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x44a685
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x44a6a9
cmp dword [edi + 0x74], 0
jne 0x44a6a9
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00444073
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0044a646
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x44c4fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x44c516
mov edi, dword [esi + 0xc]
jmp 0x44c556
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x44c52f
call fcn.00444f67
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x44c544
call fcn.00444f67
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x44c556
call fcn.00444f67
call fcn.00444073
cmp dword [eax + 0x3c], 0
je 0x44c56b
push edi
mov ecx, ebx
call fcn.0044b3bf
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0044c418
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x44c589
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x44c595
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44f349
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0044ef48
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x44f393
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00422ee0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00419650
jmp 0x44f39e
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004640ce
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x44f3a4
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.004433ed
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x44f3e1
call fcn.0044ef48
mov dword [esi + 0xc], 1
jmp 0x44f3e6
call fcn.0044ef48
cmp dword [esi], 0
je 0x44f42f
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x44f407
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00422ee0
jmp 0x44f419
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00402690
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00419650
jmp 0x44f453
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x44f453
push dword [esi]
push dword [ebp + 8]
call fcn.004640ce
pop esi
pop ebp
ret 0xc

Function at 0x45a34f
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 1
mov ecx, esi
test al, 1
je 0x45a373
mov eax, dword [esi]
push 0
call dword [eax + 0xe0]
test eax, eax
jne 0x45a381
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0xe0]
jmp 0x45a36d
xor eax, eax
inc eax
pop esi
ret

Function at 0x4613ef
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x46142d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x46143b
push str.MoveFileTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46143b
push dword [esi]
push 2
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x46143d
cmp dword [esi + 4], 0
je 0x46143b
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileA]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4c18ae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4c18c8
call fcn.00444073
mov esi, dword [eax + 0xc]
push dword [0x61540c]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4c18e6
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4c18de
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4c1913
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x4c18e0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004c17dc
mov esi, eax
jmp 0x4c1905

Function at 0x4f3d33
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00441083
call fcn.00408010
cmp eax, esi
pop esi
jne 0x4f3d4f
mov ecx, 0x613850
jmp fcn.00468583
ret

Function at 0x53e66f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x60fdb4]
jne 0x53e679
repz ret
jmp fcn.00547e3c
Function at 0x555ed1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0054783b
and dword [ebp - 0x14], 0
cmp dword [0x617c1c], 0
mov dword [ebp - 0x18], eax
jne 0x555f84
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x55602c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x55602c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5dadd8
push ebx
mov dword [0x617c1c], eax
call edi
push eax
call esi
push 0x5dadc4
push ebx
mov dword [0x617c20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x617c24], eax
call edi
push eax
call esi
mov dword [0x617c2c], eax
test eax, eax
je 0x555f84
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x617c28], eax
mov eax, dword [0x617c28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x555fdd
cmp dword [0x617c2c], ecx
je 0x555fdd
push eax
call esi
push dword [0x617c2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x555fdd
test ebx, ebx
je 0x555fdd
call edi
test eax, eax
je 0x555fd4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x555fd4
test byte [ebp - 8], 1
jne 0x555fdd
or dword [ebp + 0x10], 0x200000
jmp 0x556010
mov eax, dword [0x617c20]
cmp eax, dword [ebp - 0x18]
je 0x556010
push eax
call esi
test eax, eax
je 0x556010
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x556010
mov eax, dword [0x617c24]
cmp eax, dword [ebp - 0x18]
je 0x556010
push eax
call esi
test eax, eax
je 0x556010
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x617c1c]
call esi
test eax, eax
je 0x55602c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x55602e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053e66f
leave
ret

Function at 0x55a0e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x55a133
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x55a12d
shr eax, 8
cmp al, 2
jne 0x55a12d
call fcn.0055a4f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 2
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
Function at 0x566e20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x566e53
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret

Function at 0x566fa0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x566fbb
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
js 0x566fef
cmp eax, 2
jg 0x566fef
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x5dbec0]
push 2
push edx
call fcn.0053fba1
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.0053fba1
add esp, 0x20
xor eax, eax
ret

Function at 0x567550
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [eax + ecx*4 + 0x190]
mov edx, ecx
add edx, edx
push esi
lea esi, [eax + edx*8 + 0x1b8]
mov edx, dword [eax + 0x440]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x3c], 3
je 0x5675f0
cmp dword [eax + ecx*4 + 0x1a8], 0x5672e0
jne 0x5675f0
cmp dword [esi], 0
je 0x56758d
test edi, edi
je 0x5675f0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.0055a800
add esp, 0x14
cmp eax, 0xffffffff
je 0x5675f0
test al, 1
je 0x5675f0
cmp dword [esi], 0
jne 0x5675d2
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x6112c4]
mov edi, dword [esi + 4]
xor ecx, ecx
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
cmp eax, ecx
je 0x5675ed
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x5675f0
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebx
ret

Function at 0x567600
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + ecx*4 + 0x190]
mov eax, esi
call fcn.00567550
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push 0
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x567683
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x2733
jne 0x567658
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push eax
push esi
call fcn.0056d2d0
mov edx, dword [esi]
push eax
push str.Send_failure:__s
push edx
call fcn.00567160
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x473c], ecx
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x569610
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [esi + 0x538], eax
push 4
lea ecx, [ebp - 0x14]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x569663
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.005670e0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x53c]
push edx
mov dword [ebp - 0x10], 1
call fcn.0056af30
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x540]
push eax
call fcn.0056af30
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0xc
lea edx, [ebp - 0x10]
push edx
push 0x98000004
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x5696d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.005670e0
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
Function at 0x569d70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x8c], 2
mov ebx, dword [esi]
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x110], ebx
je 0x569f59
cmp dword [esi + 0x3a0], 0
push edi
jne 0x569f4f
cmp dword [esi + 0x410], 0
jne 0x569f4f
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push edi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x569e14
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.0056d2d0
push eax
push edi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.00567160
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
push 0x80
lea edx, [ebp - 0x84]
push 0
push edx
mov dword [ebp - 0x10c], 0x80
call fcn.0053f9d0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x84]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x569e7d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.0056d2d0
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.00567160
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0x102]
lea ebx, [esi + 0x130]
lea esi, [ebp - 0x104]
mov dword [ebp - 0x114], edi
call fcn.00569d30
test eax, eax
jne 0x569eda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x108]
mov esi, eax
push esi
push edx
call fcn.0056d2d0
push eax
mov eax, dword [ebp - 0x110]
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push eax
call fcn.00567160
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x108]
mov esi, dword [ebp - 0x114]
lea edi, [eax + 0x58]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [eax + 0x164]
lea edi, [eax + 0x134]
lea esi, [ebp - 0x84]
call fcn.00569d30
test eax, eax
jne 0x569f49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x108]
mov esi, eax
push esi
push ecx
call fcn.0056d2d0
mov edx, dword [ebp - 0x110]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.00567160
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x108]
push esi
call fcn.00569cb0
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0053e66f
mov esp, ebp
pop ebp
ret