joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51545a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c3049
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebx + 0x18]
mov al, byte [esi]
mov byte [ebx], al
mov al, byte [esi + 1]
mov byte [ebx + 1], al
mov al, byte [esi + 2]
mov byte [ebx + 2], al
mov al, byte [esi + 3]
mov byte [ebx + 3], al
mov al, byte [esi + 4]
mov byte [ebx + 4], al
mov al, byte [esi + 5]
mov byte [ebx + 5], al
mov al, byte [esi + 6]
mov byte [ebx + 6], al
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
lea eax, [esi + 0x18]
movsd xmm0, qword [esi + 0x10]
push eax
movsd qword [ebx + 0x10], xmm0
call fcn.004037b9
mov eax, dword [esi + 0x30]
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x30], eax
lea eax, [esi + 0x34]
push eax
call fcn.004037b9
lea eax, [esi + 0x4c]
push eax
lea ecx, [ebx + 0x4c]
call fcn.004037b9
mov al, byte [esi + 0x64]
lea ecx, [ebx + 0x68]
mov byte [ebx + 0x64], al
lea eax, [esi + 0x68]
push eax
call fcn.004037b9
lea eax, [esi + 0x80]
push eax
lea ecx, [ebx + 0x80]
call fcn.0041f54e
lea eax, [esi + 0x8c]
push eax
lea ecx, [ebx + 0x8c]
call fcn.0041f54e
lea edi, [ebx + 0x98]
and dword [ebp - 4], 0
lea eax, [esi + 0x98]
mov dword [ebp - 0x10], eax
cmp edi, eax
je 0x515566
mov byte [ebp - 4], 1
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.0050dfc2
mov eax, dword [edi]
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
and dword [edi + 4], 0
mov ecx, dword [edi]
mov eax, dword [edx]
mov esi, dword [ebp + 8]
mov dword [edi], eax
mov dword [edx], ecx
mov ecx, dword [edi + 4]
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov dword [edx + 4], ecx
lea eax, [esi + 0xa0]
push eax
lea ecx, [ebx + 0xa0]
call fcn.004037b9
mov eax, dword [esi + 0xb8]
lea edi, [ebx + 0xc0]
mov dword [ebx + 0xb8], eax
mov ecx, edi
mov eax, dword [esi + 0xbc]
add esi, 0xc0
push esi
mov dword [ebx + 0xbc], eax
call fcn.004037b9
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.0041f54e
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov al, byte [ecx + 0xe4]
mov ecx, dword [ebp - 0xc]
mov byte [ebx + 0xe4], al
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x51bfdb
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x51bfeb
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
add eax, edx
cmp dword [ecx + 0x14], 0x10
jb 0x51bff8
mov ecx, dword [ecx]
push ebx
push esi
xor edx, edx
mov esi, eax
sub esi, ecx
xor ebx, ebx
cmp ecx, eax
push edi
cmova esi, ebx
mov edi, edx
test esi, esi
je 0x51c034
movsx eax, byte [ecx]
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, edx
rol eax, 0xd
imul edx, eax, 5
sub edx, 0x19ab949c
inc ecx
inc edi
cmp edi, esi
jne 0x51c00e
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret 4
Function at 0x522e24
Capabilities:
Initialize winhttp library

Disassembly:
mov eax, 0x6c4066
call fcn.006b6d3c
sub esp, 0x2c8
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov ecx, edi
mov dword [ebp - 0x34], edi
call fcn.004be087
cmp dword [esi + 0x10], 0
jne 0x522e52
xor al, al
jmp 0x522f90
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x522e4b
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
inc ecx
test eax, eax
je 0x522e7c
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x44], eax
jmp 0x522e90
cmp dword [ebp - 0x20], 0
je 0x522f5f
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], 3
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x38], ecx
jb 0x522e9b
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x2d4]
call fcn.0046aea9
push 9
pop ecx
xor edx, edx
lea edi, [ebp - 0x70]
push edx
push edx
mov dword [ebp - 4], edx
mov esi, 0x7b4210
mov eax, dword [ebp - 0x2d0]
push edx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x70]
push edx
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
test edi, edi
je 0x522f3c
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x30]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
push edi
mov esi, eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test esi, esi
je 0x522f3c
cmp dword [ebp - 0x2c], 3
jne 0x522f0a
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x522f15
mov ecx, dword [ebp - 0x34]
call fcn.00522d1e
cmp dword [ebp - 0x28], 0
je 0x522f15
push dword [ebp - 0x28]
call ebx
cmp dword [ebp - 0x24], 0
je 0x522f20
push dword [ebp - 0x24]
call ebx
lea eax, [ebp - 0x2cc]
cmp dword [ebp - 0x2d0], eax
je 0x522f6d
push dword [ebp - 0x2d0]
call fcn.0053b990
pop ecx
jmp 0x522f6d
lea eax, [ebp - 0x2cc]
cmp dword [ebp - 0x2d0], eax
je 0x522e4b
push dword [ebp - 0x2d0]
call fcn.0053b990
pop ecx
jmp 0x522e4b
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x522f83
mov ecx, edi
call fcn.00522d1e
cmp dword [ebp - 0x1c], 0
je 0x522f78
push dword [ebp - 0x1c]
call ebx
cmp dword [ebp - 0x18], 0
je 0x522f83
push dword [ebp - 0x18]
call ebx
cmp dword [ebp - 0x14], 0
je 0x522f8e
push dword [ebp - 0x14]
call ebx
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x526787
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3b0
lea eax, [esp + 0x220]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0x190
push ebx
push eax
mov byte [esi], bl
call fcn.005530b0
add esp, 0xc
lea eax, [esp + 0x228]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5267cd
mov byte [esi], 1
jmp 0x526816
push 0x12
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], ebx
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_base_source_base_socketsresources.cpp
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 0x7b4a3c
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x200
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], str.SocketResources
call fcn.00492518
lea ecx, [esp + 0xc]
call fcn.0042e42b
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52686d
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x52688f
mov ecx, 0x2000
test ecx, eax
jne 0x52688f
or eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x526891
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x62c
lea eax, [esp + 0x424]
push ebx
push esi
push edi
mov ebx, 0x208
mov edi, edx
push ebx
push 0
push eax
mov esi, ecx
call fcn.005530b0
add esp, 0xc
lea eax, [esp + 0x228]
push ebx
push 0
push eax
call fcn.005530b0
pop ecx
pop ecx
lea edx, [esp + 0x434]
mov ecx, esi
call fcn.0052723f
pop ecx
test eax, eax
jle 0x526a18
push ecx
lea edx, [esp + 0x22c]
mov ecx, edi
call fcn.0052723f
pop ecx
test eax, eax
jle 0x526a18
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edi, edi
jmp 0x526945
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
jb 0x526931
cmp esi, 3
jbe 0x5269a6
cmp esi, 5
je 0x526970
cmp esi, 8
je 0x526999
cmp esi, 0xe
je 0x526999
cmp esi, 0x11
je 0x526989
inc edi
cmp edi, 0xc8
ja 0x5269b3
push 0
push 0xa
call fcn.0052681e
pop ecx
pop ecx
push 1
lea eax, [esp + 0x22c]
push eax
lea eax, [esp + 0x438]
push eax
call ebx
test eax, eax
je 0x526907
lea ecx, [esp + 0x228]
call fcn.0052686d
xor eax, eax
jmp 0x526a26
inc edi
cmp edi, 0xc8
jbe 0x52693a
call fcn.00563d3e
mov dword [eax], 1
jmp 0x526a23
call fcn.00563d3e
mov dword [eax], 0x12
jmp 0x526a23
call fcn.00563d3e
mov dword [eax], 0xc
jmp 0x526a23
call fcn.00563d3e
mov dword [eax], 2
jmp 0x526a23
and dword [esp + 0xc], 0
lea eax, [esp + 0x28]
and dword [esp + 0x1c], 0
lea ecx, [esp + 0xc]
push 0x140
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_base_source_base_fileio.cpp
mov dword [esp + 0x18], str.bnl_rename_failed_with_unexpected_error_code_:__d
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x200
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], str.FileIO
call fcn.00492518
push esi
lea ecx, [esp + 0x10]
call fcn.00492a9a
lea ecx, [esp + 0xc]
call fcn.0042e42b
call fcn.00563d3e
mov dword [eax], 5
jmp 0x526a23
call fcn.00563d3e
mov dword [eax], 0x26
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52701a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
lea edx, [esp + 4]
push esi
push ecx
call fcn.0052723f
pop ecx
test eax, eax
jg 0x527046
call fcn.00563d3e
mov dword [eax], 0x26
or eax, 0xffffffff
jmp 0x52709e
lea eax, [esp + 8]
push eax
call fcn.006b6cb4
mov esi, eax
pop ecx
cmp esi, 0xffffffff
jne 0x527093
call fcn.00563d3e
cmp dword [eax], 2
je 0x52709c
call fcn.00563d3e
cmp dword [eax], 0x14
je 0x52709c
call fcn.00563d3e
cmp dword [eax], 0x11
je 0x52709c
push 0
push 1
call fcn.0052681e
lea eax, [esp + 0x10]
push eax
call fcn.006b6cb4
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x52709c
lea ecx, [esp + 8]
call fcn.0052686d
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5270a3
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
lea edx, [esp + 0x21c]
push esi
push ecx
call fcn.0052723f
pop ecx
test eax, eax
jg 0x5270d5
call fcn.00563d3e
mov dword [eax], 0x26
or eax, 0xffffffff
jmp 0x5271c1
lea eax, [esp + 0x220]
push eax
call fcn.006b6d2e
mov esi, eax
pop ecx
cmp esi, 0xffffffff
jne 0x5271bf
call fcn.00563d3e
cmp dword [eax], 0xd
jne 0x527190
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x527132
lea eax, [esp + 0x220]
push eax
call fcn.006b6d2e
pop ecx
mov esi, eax
jmp 0x527190
and dword [esp + 4], 0
lea eax, [esp + 0x20]
and dword [esp + 0x14], 0
lea ecx, [esp + 4]
push 0x2c8
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_base_source_base_fileio.cpp
mov dword [esp + 0x10], str.Removing_READ_ONLY_attribute_failed_with_error_code:__d
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x200
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], str.FileIO
call fcn.00492518
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 8]
call fcn.00492a9a
lea ecx, [esp + 4]
call fcn.0042e42b
call fcn.00563d3e
cmp dword [eax], 2
je 0x5271bf
call fcn.00563d3e
cmp dword [eax], 0x14
je 0x5271bf
push 0
push 0xa
call fcn.0052681e
lea eax, [esp + 0x228]
push eax
call fcn.006b6d2e
add esp, 0xc
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x527256
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
xor edi, edi
push ebx
push eax
mov esi, ecx
inc edi
call fcn.005530b0
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x104
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
lea eax, [ebp - 0x208]
mov esi, 0x104
push eax
push esi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
ja 0x527354
lea eax, [ebp - 0x208]
push 0x5c
push eax
call fcn.006b659d
pop ecx
pop ecx
test eax, eax
je 0x527354
xor ecx, ecx
mov word [eax + 2], cx
mov ecx, 0x7b4cdc
lea eax, [ebp - 0x208]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x527309
test dx, dx
je 0x52730d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x527309
add eax, 4
add ecx, 4
test dx, dx
jne 0x5272e5
jmp 0x52730d
sbb ebx, ebx
or ebx, edi
test ebx, ebx
jne 0x527316
push 2
pop eax
jmp 0x527356
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, edi
je 0x527354
test eax, eax
je 0x527354
dec eax
sub eax, 1
je 0x527351
sub eax, 1
je 0x52734d
sub eax, 1
je 0x527349
sub eax, 1
je 0x527351
sub eax, 1
jne 0x527354
push 5
jmp 0x527353
push 2
jmp 0x527353
push 3
jmp 0x527353
push 4
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x53e26c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x56ec3f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056ebc2

Function at 0x572606
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00572483

Function at 0x578474
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00578116
Function at 0x584900
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x7ec06c]
xor eax, esp
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x5849da
lea eax, [esp + 4]
push eax
push edi
push 2
call fcn.0058f930
add esp, 0xc
test eax, eax
jne 0x5849da
lea eax, [esp + 8]
push eax
push edi
push 0x17
call fcn.0058f930
add esp, 0xc
test eax, eax
jne 0x5849da
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x584955
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.0058f900
add esp, 0xc
test eax, eax
je 0x584989
sub eax, edi
push eax
push 0x2e
push edi
call fcn.0058f900
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x58498b
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [esi + edi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x5849c4
mov al, byte [edi]
push eax
call fcn.00582b30
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x5849a3
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0053bd3e
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
xor ecx, esp
call fcn.0053bd3e
add esp, 0x18
ret
Function at 0x58e240
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x1d0], 0
je 0x58e284
push esi
push 1
push edi
call fcn.00591d90
push dword [edi + 0x15c]
mov eax, dword [edi + 0x1d0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00591d90
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x58e2bd
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x6deea4
push 2
push eax
call fcn.00567889
push dword [edi + 0x158]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.00567889
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x58e990
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, 0x1cc
mov ecx, dword [edi + 0x1ac]
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1a8]
mov ebp, dword [eax + edi]
mov eax, 0x1dc
cmove esi, eax
mov eax, dword [edi + 0x2c8]
add esi, edi
mov ebx, dword [esi + 4]
sub ebx, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x58ea68
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1bc]
cmp dword [eax + edi], 0x58e5e0
jne 0x58ea68
cmp dword [esi], 0
je 0x58e9f8
test ebx, ebx
je 0x58ea68
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.005aef30
add esp, 0x14
cmp eax, 0xffffffff
je 0x58ea68
test al, 1
je 0x58ea68
mov ecx, dword [esi]
test ecx, ecx
jne 0x58ea48
mov eax, dword [edi]
mov eax, dword [eax + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x7eca8c]
mov ebx, dword [esi + 4]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x58ea61
mov eax, dword [esi + 8]
push 0
push ebx
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x58ea68
add dword [esi + 8], eax
jmp 0x58ea68
mov dword [esi + 4], 0
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x58ead1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x58eaa2
mov ecx, dword [esp + 0x24]
lea eax, [ebx + 0x52]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
ret
push esi
push edi
call fcn.005b6f10
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.0058e2d0
mov eax, dword [edi]
add esp, 0x14
mov ecx, dword [esp + 0x24]
pop edi
mov dword [eax + 0x8e4], esi
mov eax, 0x37
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
ret
Function at 0x58ef70
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x7ec06c]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [0x8073ec]
mov ecx, eax
inc eax
mov dword [0x8073ec], eax
test ecx, ecx
je 0x58efac
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0053bd3e
add esp, 0x194
ret
cmp byte [esp + 0x19c], 0
je 0x58efe8
mov dword [fcn.00568984], 0x568984
mov dword [fcn.0055bc34], 0x55bc34
mov dword [fcn.00563cba], 0x563cba
mov dword [0x7eca98], 0x5ced6a
mov dword [fcn.0055bc7b], 0x55bc7b
push ebx
call fcn.0058dcf0
test eax, eax
je 0x58f02a
mov ebx, dword [esp + 0x19c]
test bl, 2
je 0x58f04d
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x58f02a
mov eax, dword [esp + 4]
cmp al, 2
jne 0x58f045
shr eax, 8
cmp al, 2
jne 0x58f045
call fcn.005b7900
test eax, eax
je 0x58f04d
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0053bd3e
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x58f02a
call fcn.00408d70
test eax, eax
jne 0x58f02a
call fcn.005916b0
mov eax, dword [0x807430]
test bl, 4
mov ecx, 1
mov dword [0x8073f0], ebx
cmovne eax, ecx
mov dword [0x807430], eax
call fcn.005b7960
mov ecx, dword [esp + 0x194]
xor eax, eax
pop ebx
xor ecx, esp
call fcn.0053bd3e
add esp, 0x194
ret
Function at 0x591240
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [eax], ebx
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x5913d2
push ebp
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x5913bc
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x59128f
lea ebp, [eax + 0xe]
jmp 0x59129b
cmp eax, 0x17
jne 0x591349
lea ebp, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x591349
mov eax, dword [edi + 0x10]
test eax, eax
je 0x591349
cmp eax, ebp
jb 0x591349
push 0x20
call dword [0x7eca8c]
mov esi, eax
add esp, 4
test esi, esi
je 0x5913b1
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebp
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebp
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x7eca8c]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x5913a0
push ebp
push dword [edi + 0x18]
push eax
call fcn.00552b30
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x591335
push eax
call dword [0x7eca98]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x591386
mov eax, dword [esp + 0x10]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x591345
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x591282
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x591368
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x5913b8
push ebx
call fcn.00591200
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, ebp
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebp, 8
call dword [0x7eca90]
push esi
call dword [0x7eca90]
add esp, 8
jmp 0x591358
push esi
mov ebp, 8
call dword [0x7eca90]
add esp, 4
jmp 0x591358
mov ebp, 8
jmp 0x591358
test ebx, ebx
jne 0x5913c8
mov ebp, 0x2af9
push ebp
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebx
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x5916b0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [0x7ecaa0]
cmp eax, 0xffffffff
jne 0x5916f2
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x5916d8
xor eax, eax
test eax, eax
mov dword [0x7ecaa0], eax
setg al
ret
push eax
push 0
mov dword [0x7ecaa0], 1
call fcn.005946e0
mov eax, dword [0x7ecaa0]
add esp, 8
test eax, eax
setg al
ret
Function at 0x591700
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2d0], 2
jne 0x591755
mov eax, dword [0x7ecaa0]
cmp eax, 0xffffffff
jne 0x59174f
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x591735
xor eax, eax
test eax, eax
mov dword [0x7ecaa0], eax
setg al
ret
push eax
push 0
mov dword [0x7ecaa0], 1
call fcn.005946e0
mov eax, dword [0x7ecaa0]
add esp, 8
test eax, eax
setg al
ret
mov al, 1
ret
Function at 0x5947a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1ec], 0
je 0x5947bd
push eax
call fcn.0058d4a0
add esp, 4
test eax, eax
jne 0x5947dc
xor al, al
ret
mov eax, dword [eax + 0x1a8]
cmp eax, 0xffffffff
je 0x5947ba
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x5947ba
mov al, 1
ret