joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53de10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x75a0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x44]
xorps xmm0, xmm0
mov edx, dword [ecx + 0x10]
mov esi, edx
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0
mov al, byte [ecx]
movq xmm0, qword [ecx + 4]
mov byte [esp + 0x47], al
mov byte [esp + 0xc], al
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], eax
lea eax, [ecx + 0x10]
movq qword [esp + 0x20], xmm0
movq qword [esp + 0x10], xmm0
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edx
mov dword [eax], 0
mov dword [esp + 0x1c], esi
mov edx, dword [esp + 0x48]
mov dword [esp + 0x3c], 0
movzx eax, byte [edx]
lea edi, [edx + 0x10]
mov byte [ecx], al
movq xmm0, qword [edx + 4]
movq qword [ecx + 4], xmm0
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x30]
cmp ecx, edi
je 0x53ded7
mov eax, dword [edi]
mov dword [edi], 0
mov edi, dword [esp + 0x30]
mov ecx, dword [ecx]
mov dword [edi], eax
lea edi, [edx + 0x10]
test ecx, ecx
je 0x53ded7
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [esp + 0x48]
mov al, byte [esp + 0x47]
movq xmm0, qword [esp + 0x20]
mov byte [edx], al
mov eax, dword [esp + 0x2c]
movq qword [edx + 4], xmm0
mov dword [edx + 0xc], eax
lea eax, [esp + 0x1c]
cmp edi, eax
je 0x53df0f
mov ecx, dword [edi]
xor esi, esi
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], esi
mov dword [edi], eax
test ecx, ecx
je 0x53df0f
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x3c], 0xffffffff
test esi, esi
je 0x53df23
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret
Function at 0x5422a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x75ab88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x38], 0
test ecx, ecx
jne 0x542325
cmp dword [edi + 0x20], 0x10
lea eax, [edi + 0xc]
mov dword [eax + 0x10], ecx
jb 0x5422e8
mov eax, dword [eax]
lea ecx, [edi + 0x24]
mov byte [eax], 0
call fcn.005404f0
mov eax, dword [edi + 0x54]
lea ecx, [edi + 0x54]
push dword [eax + 4]
call fcn.004844a0
mov eax, dword [edi + 0x54]
mov ecx, 1
mov dword [eax + 4], eax
mov eax, dword [edi + 0x54]
mov dword [eax], eax
mov eax, dword [edi + 0x54]
mov dword [eax + 8], eax
mov dword [edi + 0x58], 0
mov dword [esp + 0xa0], ecx
mov eax, dword [edi]
or eax, dword [edi + 4]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
je 0x54233f
cmp ecx, 1
jne 0x542344
mov eax, esi
or eax, edx
je 0x542344
mov dword [edi], esi
mov dword [edi + 4], edx
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x54]
mov dword [esp + 0x34], 0xf
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00404c20
mov dword [esp + 0x14], vtable.wbs::StringBase_char_.0
mov eax, dword [esp + 0xa0]
mov byte [esp + 0x38], 1
test eax, eax
je 0x542395
cmp dword [edi + 0x1c], 0
je 0x542395
cmp eax, 1
jne 0x5423a2
cmp dword [esp + 0x28], 0
je 0x5423a2
lea eax, [esp + 0x14]
push eax
lea ecx, [edi + 8]
call fcn.004f59b0
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x14], vtable.wbs::StringBase_char_.0
jb 0x5423bd
push dword [esp + 0x18]
call fcn.006f75a9
add esp, 4
sub esp, 0x18
lea ecx, [esp + 0xb8]
mov eax, esp
mov dword [eax], vtable.std::_Func_impl_struct_std::_Callable_obj_class__lambda_ad3a902302d133132e228757bd8cf14e___0___class_std::allocator_class_std::_Func_class_void__class_cmserver::acl::Cluster_____void__class_cmserver::acl::Cluster__.0
mov dword [eax + 8], ecx
lea ecx, [esp + 0x58]
mov dword [eax + 4], edi
mov dword [eax + 0x10], eax
mov byte [esp + 0x50], 0
call fcn.005424d0
push dword [esp + 0xa0]
lea eax, [esp + 0x68]
sub esp, 0x30
mov ecx, esp
push eax
call fcn.00480a60
lea ecx, [edi + 0x24]
call fcn.00540350
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.00480d70
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 0x64
Function at 0x543320
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x75ad30
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
mov ebx, dword [esp + 0x30]
lea eax, [esp + 0x18]
mov edi, dword [esp + 0x34]
mov esi, dword [ebp]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], 0
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
call fcn.0053dc80
mov ecx, dword [esp + 0x90]
xor edx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
cmp dword [eax], esi
lea eax, [esp + 0x30]
cmove ecx, edx
push ecx
sub esp, 0x60
mov ecx, esp
mov dword [esp + 0x78], esp
push eax
call fcn.00480990
lea eax, [esp + 0x7c]
mov byte [esp + 0x8c], 1
push eax
mov ecx, ebp
call fcn.00543190
mov ecx, eax
mov byte [esp + 0x8c], 0
call fcn.005422a0
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.00480d70
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x64

Function at 0x545920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x75b209
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov eax, dword [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 1
push eax
call fcn.004403f0
add esp, 8
mov ecx, eax
mov byte [esp + 0x4c], 1
mov eax, dword [ecx]
mov dword [esp + 0x50], eax
lea eax, [ecx + 4]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x2c], 2
call fcn.0043f330
mov eax, dword [esp + 0x14]
mov byte [esp + 0x28], 1
test eax, eax
je 0x5459a3
push eax
call fcn.006f75a9
add esp, 4
lea eax, [esp + 0x38]
xorps xmm0, xmm0
push eax
push dword [esp + 0x38]
mov ecx, esi
movq qword [esi], xmm0
call fcn.00544ab0
lea ecx, [esp + 0x38]
mov dword [esp + 8], 1
mov byte [esp + 0x28], 0
call fcn.0043f200
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x5459f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x75b209
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov eax, dword [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 1
push eax
call fcn.004403f0
add esp, 8
mov ecx, eax
mov byte [esp + 0x4c], 1
mov eax, dword [ecx]
mov dword [esp + 0x50], eax
lea eax, [ecx + 4]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x2c], 2
call fcn.0043f330
mov eax, dword [esp + 0x14]
mov byte [esp + 0x28], 1
test eax, eax
je 0x545a73
push eax
call fcn.006f75a9
add esp, 4
lea eax, [esp + 0x38]
xorps xmm0, xmm0
push eax
push dword [esp + 0x38]
mov ecx, esi
movq qword [esi], xmm0
call fcn.00544ca0
lea ecx, [esp + 0x38]
mov dword [esp + 8], 1
mov byte [esp + 0x28], 0
call fcn.0043f200
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x545b10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x75b251
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
lea ecx, [edi + 8]
mov dword [edi], vtable.std::_Associated_state_struct_std::pair_class_wbs::InetAddress__class_wbs::StringBase_char___.0
call fcn.0050ffd0
mov dword [edi + 0x24], 0xf
mov dword [edi + 0x20], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0xc], vtable.wbs::StringBase_char_.0
lea eax, [edi + 0x28]
mov dword [esp + 0x18], 0
push eax
call fcn.006fa279
lea eax, [edi + 0x30]
mov byte [esp + 0x1c], 1
push 2
push eax
call fcn.006f35fa
add esp, 0xc
test eax, eax
je 0x545b91
push eax
call fcn.006f392d
add esp, 4
lea eax, [edi + 0x34]
mov byte [esp + 0x18], 2
push eax
call fcn.006f3741
add esp, 4
test eax, eax
je 0x545baf
push eax
call fcn.006f392d
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [edi + 0x44], eax
mov eax, edi
mov byte [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov word [edi + 0x40], 0
mov byte [edi + 0x42], 0
mov dword [edi + 4], 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x5473e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x75b5d1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x14], 0
call fcn.0050ffd0
push ecx
mov eax, esp
mov byte [esp + 0x28], 2
lea ecx, [esp + 0x18]
mov dword [eax], 0xf
lea eax, [esp + 0x34]
push eax
call fcn.00510870
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0050fef0
push 0xffffffffffffffff
lea ecx, [esi + 8]
mov byte [esp + 0x28], 3
lea eax, [esp + 0x38]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00404c20
mov dword [esi + 4], vtable.wbs::StringBase_char_.0
lea ecx, [esp + 0x14]
mov dword [esp + 8], 1
mov byte [esp + 0x24], 1
call fcn.00510050
cmp dword [esp + 0x48], 0x10
mov dword [esp + 0x30], vtable.wbs::StringBase_char_.0
jb 0x5474bf
push dword [esp + 0x34]
call fcn.006f75a9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x20
ret
Function at 0x54cec0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x75bf81
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.HttpMessage.0
mov byte [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
lea ecx, [edi + 0x14]
mov dword [esp + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.00532110
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], vtable.YS0073::YS0080_unsigned_char_.0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x30], 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov ecx, edi
mov byte [esp + 0x18], 2
mov dword [edi + 0x44], 0
call fcn.0054d5e0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5507c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x81f390]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x550813
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x55080d
shr eax, 8
cmp al, 2
jne 0x55080d
call fcn.00553840
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret

Function at 0x55d3f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x130]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x55d46e
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x55d43e
pop esi
pop edi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push esi
push dword [ebp + 8]
call fcn.0054fda0
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.0055d0d0
mov eax, dword [ebp + 8]
add esp, 0x14
mov eax, dword [eax]
mov dword [eax + 0x8594], esi
mov eax, edi
mov dword [ebx], 0x37
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x55d580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x164]
test eax, eax
je 0x55d5a9
push dword [esi + 0xf4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x55d5df
push dword [esi + 0xf0]
lea eax, [eax + eax*2]
push 1
add eax, 0x78fe48
push 2
push eax
call fcn.00700a90
push dword [esi + 0xf0]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00700a90
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret

Function at 0x55d7b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x558]
cmp ecx, 0xffffffff
je 0x55d812
mov eax, dword [eax + 0x54c]
mov eax, dword [eax]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x55d812
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x55d7d9
mov dword [ecx], eax
cmp dword [eax + 0x150], 0
push esi
mov esi, dword [eax + 0x130]
je 0x55d7fc
push eax
call fcn.00728540
add esp, 4
test eax, eax
jne 0x55d80d
or eax, 0xffffffff
pop esi
pop ebp
ret
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x55d7f2
mov eax, esi
pop esi
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret
Function at 0x55dad0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x81f390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x224], 0
mov ebx, dword [edi]
jne 0x55dc43
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x55db4e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0054fda0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.0055d0d0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0x80
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x55dba1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0054fda0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.0055d0d0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xcc]
push eax
lea eax, [edi + 0x9e]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0055e140
add esp, 0xc
test eax, eax
jne 0x55dbf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0054fda0
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0055d0d0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x100]
push eax
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0055e140
add esp, 0xc
test eax, eax
jne 0x55dc43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0054fda0
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0055d0d0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret
push edi
call fcn.0055d820
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret
Function at 0x55e580
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 4
cmp dword [esi + 0x410], eax
setne al
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 8
push 0xffff
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x55e5c0
push dword [ebp + 0xc]
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0055d170
add esp, 0xc
pop esi
pop ebp
ret

Function at 0x55e5d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov esi, dword [edi]
mov eax, dword [esi + 0x314]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x55e61a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0054fda0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0055d170
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0055d170
add esp, 8
pop edi
pop esi
pop ebp
ret

Function at 0x55ff00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x55ff11
jmp dword [eax*4 + 0x55ff84]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret
Function at 0x561a30
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x561bc4
push edi
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x561bb0
push esi
lea esp, [esp]
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x561a7f
mov eax, 0x10
jmp 0x561a8d
cmp eax, 0x17
jne 0x561b41
mov eax, 0x1c
cmp dword [edi + 0x18], 0
mov dword [ebp - 4], eax
je 0x561b41
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x561b41
cmp ecx, eax
jb 0x561b41
push 0x20
call dword [0x8057dc]
mov esi, eax
add esp, 4
test esi, esi
je 0x561ba5
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x8057dc]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x561b94
push dword [ebp - 4]
push dword [edi + 0x18]
push eax
call fcn.006f8110
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x561b2f
push eax
call dword [0x8057e8]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x561b7a
mov eax, dword [ebp - 8]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x561b3e
mov dword [eax + 0x1c], esi
mov dword [ebp - 8], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x561a70
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
pop esi
test eax, eax
je 0x561b5e
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x561bac
push ebx
call fcn.005619e0
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x8057e0]
push esi
call dword [0x8057e0]
add esp, 8
jmp 0x561b4f
push esi
mov edi, 8
call dword [0x8057e0]
add esp, 4
jmp 0x561b4f
mov edi, 8
jmp 0x561b4f
test ebx, ebx
jne 0x561bbc
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x561ef0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x29c], 2
jne 0x561f05
pop ebp
jmp fcn.00561ea0
mov eax, 1
pop ebp
ret

Function at 0x562f10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.007025b3
add esp, 0x18
test eax, eax
je 0x562f32
cmp eax, 0xffffffff
jne 0x562f34
xor eax, eax
pop ebp
ret
Function at 0x567720
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x81f390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00704056
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x567784
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x567784
lea eax, [ebp - 0x108]
push eax
call dword [0x8057e8]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret

Function at 0x5677a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00567720