joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513a22
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
lea edx, [ebp - 0x428]
push esi
push ecx
call fcn.00513bc2
pop ecx
test eax, eax
jg 0x513a50
call fcn.005555d1
mov dword [eax], 0x26
or eax, 0xffffffff
jmp 0x513b47
lea eax, [ebp - 0x428]
push eax
call fcn.0060951d
mov esi, eax
pop ecx
cmp esi, 0xffffffff
jne 0x513b45
call fcn.005555d1
cmp dword [eax], 0xd
jne 0x513b1d
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x513aa9
lea eax, [ebp - 0x428]
push eax
call fcn.0060951d
pop ecx
mov esi, eax
jmp 0x513b1d
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x200]
and dword [ebp - 0x20c], 0
lea ecx, [ebp - 0x21c]
push 0x2c6
push str..._bnl_base_source_baseFileIO.cpp
mov dword [ebp - 0x218], str.Removing_READ_ONLY_attribute_failed_with_error_code:__d
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], 0x200
mov dword [ebp - 0x208], 4
mov dword [ebp - 0x204], str.FileIO
call fcn.00496d52
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00497382
lea ecx, [ebp - 0x21c]
call fcn.0042bc04
call fcn.005555d1
cmp dword [eax], 2
je 0x513b45
call fcn.005555d1
cmp dword [eax], 0x14
je 0x513b45
call fcn.005131ea
lea eax, [ebp - 0x428]
push eax
call fcn.0060951d
pop ecx
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x513bd9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
xor edi, edi
push ebx
push eax
mov esi, ecx
inc edi
call fcn.00544d60
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x104
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
lea eax, [ebp - 0x208]
mov esi, 0x104
push eax
push esi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
ja 0x513cd7
lea eax, [ebp - 0x208]
push 0x5c
push eax
call fcn.0060901a
pop ecx
pop ecx
test eax, eax
je 0x513cd7
xor ecx, ecx
mov word [eax + 2], cx
mov ecx, 0x6b1148
lea eax, [ebp - 0x208]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x513c8c
test dx, dx
je 0x513c90
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x513c8c
add eax, 4
add ecx, 4
test dx, dx
jne 0x513c68
jmp 0x513c90
sbb ebx, ebx
or ebx, edi
test ebx, ebx
jne 0x513c99
push 2
pop eax
jmp 0x513cd9
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, edi
je 0x513cd7
test eax, eax
je 0x513cd7
dec eax
sub eax, 1
je 0x513cd4
sub eax, 1
je 0x513cd0
sub eax, 1
je 0x513ccc
sub eax, 1
je 0x513cd4
sub eax, 1
jne 0x513cd7
push 5
jmp 0x513cd6
push 2
jmp 0x513cd6
push 3
jmp 0x513cd6
push 4
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52e9bb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x56074d
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00560652

Function at 0x563dec
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00563c6b

Function at 0x5684b1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00568171

Function at 0x570390
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x6e7070]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, edx
movlpd qword [ebp - 0x64], xmm0
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x5c], 0x67452301
lea edi, [eax + 1]
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5703d1
sub eax, edi
lea ecx, [ebp - 0x64]
push eax
push edx
call fcn.00570cf0
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
shrd ecx, eax, 3
shr eax, 3
mov eax, 0xfffffff7
sub eax, ecx
lea ecx, [ebp - 0x64]
and eax, 0x3f
inc eax
push eax
push 0x62fd40
call fcn.00570cf0
push 8
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x64]
call fcn.00570cf0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov eax, dword [ebp - 0x58]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x50]
pop edi
mov dword [esi + 0xc], eax
pop esi
call fcn.0052c3c6
mov esp, ebp
pop ebp
ret

Function at 0x570450
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x6e7070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x64]
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x64], xmm0
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
call fcn.00570cf0
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
shrd ecx, eax, 3
shr eax, 3
mov eax, 0xfffffff7
sub eax, ecx
lea ecx, [ebp - 0x64]
and eax, 0x3f
inc eax
push eax
push 0x62fd40
call fcn.00570cf0
push 8
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x64]
call fcn.00570cf0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov eax, dword [ebp - 0x58]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x50]
mov dword [esi + 0xc], eax
pop esi
call fcn.0052c3c6
mov esp, ebp
pop ebp
ret
Function at 0x570cc0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret

Function at 0x5710a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x6e7070]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5710f5
mov eax, dword [esp]
cmp al, 2
jne 0x5710ef
shr eax, 8
cmp al, 2
jne 0x5710ef
call fcn.00574fc0
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0052c3c6
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 2
xor ecx, esp
call fcn.0052c3c6
add esp, 0x194
ret

Function at 0x575a40
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x575a5c
cmp dword [esi + 0x48], 0
je 0x575a5c
push 2
push 3
push esi
call fcn.00589d10
add esp, 0xc
push dword [esp + 0xc]
call fcn.005804b0
add esp, 4
test esi, esi
je 0x575a7d
cmp dword [esi + 0x48], 0
je 0x575a7d
push 3
push esi
call fcn.00589d50
add esp, 8
pop esi
ret
Function at 0x57e2d0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
lea ebx, [edi + 0x554]
push 0x4000
push ebx
call fcn.00588af0
mov eax, dword [edi + 0x120]
add esp, 0x10
test eax, eax
je 0x57e321
cmp byte [edi + 0x8580], 0
jne 0x57e321
push ebx
push 0x690f94
push 0x100
push eax
call fcn.00588a00
add esp, 0x10
mov byte [edi + 0x8580], 1
cmp byte [edi + 0x2d0], 0
je 0x57e396
push esi
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x57e330
sub esi, ecx
cmp esi, 0x3fff
jae 0x57e351
mov byte [edi + esi + 0x554], 0xa
inc esi
mov byte [edi + esi + 0x554], al
mov eax, dword [edi + 0x190]
test eax, eax
je 0x57e36f
push dword [edi + 0x11c]
push esi
push ebx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
push dword [edi + 0x118]
push 1
push 2
push 0x630bdc
call fcn.00558d61
push dword [edi + 0x118]
push 1
push esi
push ebx
call fcn.00558d61
add esp, 0x20
pop esi
pop edi
pop ebx
ret

Function at 0x57e3a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x6e7070]
xor eax, esp
mov dword [esp + 0x804], eax
push edi
mov edi, dword [esp + 0x810]
test edi, edi
je 0x57e469
cmp byte [edi + 0x2d0], 0
je 0x57e469
push esi
lea eax, [esp + 0x81c]
push eax
push dword [esp + 0x81c]
lea eax, [esp + 0x10]
push 0x801
push eax
call fcn.00588af0
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x57e400
mov eax, dword [edi + 0x190]
sub esi, ecx
test eax, eax
je 0x57e43e
push dword [edi + 0x11c]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0052c3c6
add esp, 0x808
ret
push dword [edi + 0x118]
push 1
push 2
push 0x630bdc
call fcn.00558d61
push dword [edi + 0x118]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.00558d61
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.0052c3c6
add esp, 0x808
ret

Function at 0x57e660
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [ebp + eax*4 + 0x154]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x57e6db
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x57e6b1
pop esi
pop edi
pop ebp
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push esi
push ebp
call fcn.0058b160
push eax
push str.Send_failure:__s
push dword [ebp]
call fcn.0057e2d0
mov eax, dword [ebp]
add esp, 0x14
mov dword [eax + 0x8584], esi
mov eax, edi
mov dword [ebx], 0x37
pop esi
pop edi
pop ebp
pop ebx
ret
Function at 0x57e980
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x57e9a9
push dword [esi + 0x11c]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push esi
call eax
add esp, 0x14
pop esi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x57e9e2
push dword [esi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x630bdc
push 2
push eax
call fcn.00558d61
push dword [esi + 0x118]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.00558d61
add esp, 0x20
xor eax, eax
pop esi
ret

Function at 0x57eba0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x548]
test esi, esi
je 0x57ebf6
mov eax, dword [edi + 0x44]
test eax, eax
jne 0x57ebbf
cmp dword [edi + 0x40], eax
je 0x57ebf6
mov dword [esp + 8], esi
mov byte [esp + 0xc], 0
test eax, eax
jne 0x57ebcf
mov eax, dword [edi + 0x40]
push 0x57fb00
lea ecx, [esp + 0xc]
add eax, 0x68
push ecx
push eax
call fcn.00584e90
add esp, 0xc
cmp byte [esp + 0xc], 0
jne 0x57ebff
mov dword [edi + 0x548], 0
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x57ec09
mov dword [eax], esi
cmp byte [esi + 0x178], 0
mov edi, dword [esi + 0x154]
je 0x57ec2e
push esi
call fcn.00408ad0
add esp, 4
test eax, eax
jne 0x57ec42
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
push 2
push 1
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x57ebf6
mov eax, edi
pop edi
pop esi
add esp, 8
ret

Function at 0x57f0e0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xac
mov eax, dword [0x6e7070]
xor eax, esp
mov dword [esp + 0xa8], eax
mov eax, dword [0x71300c]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
push esi
test eax, eax
jne 0x57f1a3
push 0x9c
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00544d60
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [esp + 0x10], 0x9c
mov dword [esp + 0x14], 6
push 3
push 2
push 0
push 0
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x57f197
mov dword [0x71300c], 2
pop esi
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.0052c3c6
add esp, 0xac
ret
mov dword [0x71300c], 1
jmp 0x57f1a8
cmp eax, 2
je 0x57f1f0
mov esi, dword [esp + 0xb4]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x57f1d8
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
jg 0x57f1f0
push 4
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esp + 0xac]
pop esi
xor ecx, esp
call fcn.0052c3c6
add esp, 0xac
ret
Function at 0x57f300
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [esp + 0x20]
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x57f348
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0058b160
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0057e3a0
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0057e3a0
add esp, 8
pop edi
pop esi
ret
Function at 0x57f430
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x108
mov eax, dword [0x6e7070]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push edi
mov edi, dword [esp + 0x114]
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x57f616
cmp byte [edi + 0x251], 0
push esi
jne 0x57f60c
mov esi, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x94]
mov dword [esp + 0x10], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x57f4c8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0058b160
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.0057e2d0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052c3c6
add esp, 0x108
push 0x80
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x80
push 0
push eax
call fcn.00544d60
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x57f530
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0058b160
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.0057e2d0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052c3c6
add esp, 0x108
ret
lea eax, [edi + 0xe8]
push eax
lea esi, [edi + 0xb8]
lea eax, [esp + 0x94]
push esi
push eax
call fcn.0057fb20
add esp, 0xc
test al, al
jne 0x57f589
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0058b160
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0057e2d0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052c3c6
add esp, 0x108
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movups xmmword [edi + 0x58], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x11c]
push eax
lea eax, [edi + 0xec]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0057fb20
add esp, 0xc
test al, al
jne 0x57f60c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0058b160
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0057e2d0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052c3c6
add esp, 0x108
ret
push edi
call fcn.0057f020
add esp, 4
pop esi
mov ecx, dword [esp + 0x10c]
pop edi
pop ebx
xor ecx, esp
call fcn.0052c3c6
add esp, 0x108
ret
Function at 0x57fe80
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x6e7070]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
xor eax, eax
push edi
mov edi, dword [esp + 0x28]
push 4
cmp byte [esi + 0x3f0], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x57fee0
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0057e3a0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0052c3c6
add esp, 0x18
ret
push dword [esi + 0x3f4]
mov dword [esp + 0x14], 1
call fcn.00587a30
push dword [esi + 0x3f8]
imul eax, eax, 0x3e8
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
call fcn.00587a30
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x57ff57
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0057e3a0
add esp, 0x10
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.0052c3c6
add esp, 0x18
ret
Function at 0x589d90
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov bl, byte [esi]
test bl, bl
je 0x589e41
mov cl, byte [edi]
test cl, cl
je 0x589e41
movsx eax, bl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x589dba
jmp dword [eax*4 + 0x589e68]
mov bl, 0x41
jmp case.default.0x589dba
mov bl, 0x42
jmp case.default.0x589dba
mov bl, 0x43
jmp case.default.0x589dba
mov bl, 0x44
jmp case.default.0x589dba
mov bl, 0x45
jmp case.default.0x589dba
mov bl, 0x46
jmp case.default.0x589dba
mov bl, 0x47
jmp case.default.0x589dba
mov bl, 0x48
jmp case.default.0x589dba
mov bl, 0x49
jmp case.default.0x589dba
mov bl, 0x4a
jmp case.default.0x589dba
mov bl, 0x4b
jmp case.default.0x589dba
mov bl, 0x4c
jmp case.default.0x589dba
mov bl, 0x4d
jmp case.default.0x589dba
mov bl, 0x4e
jmp case.default.0x589dba
mov bl, 0x4f
jmp case.default.0x589dba
mov bl, 0x50
jmp case.default.0x589dba
mov bl, 0x51
jmp case.default.0x589dba
mov bl, 0x52
jmp case.default.0x589dba
mov bl, 0x53
jmp case.default.0x589dba
mov bl, 0x54
jmp case.default.0x589dba
mov bl, 0x55
jmp case.default.0x589dba
mov bl, 0x56
jmp case.default.0x589dba
mov bl, 0x57
jmp case.default.0x589dba
mov bl, 0x58
jmp case.default.0x589dba
mov bl, 0x59
jmp case.default.0x589dba
mov bl, 0x5a
push ecx
call fcn.0058a040
add esp, 4
cmp bl, al
jne 0x589e41
mov bl, byte [esi + 1]
inc esi
inc edi
test bl, bl
jne 0x589da5
movzx eax, byte [esi]
push eax
call fcn.0058a040
movzx ecx, byte [edi]
mov bl, al
push ecx
call fcn.0058a040
add esp, 8
xor ecx, ecx
cmp bl, al
sete cl
pop edi
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x589ed0
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
mov bl, byte [edi]
test bl, bl
je 0x589f96
nop word [eax + eax]
mov cl, byte [ebp]
test cl, cl
je 0x589f96
test esi, esi
je 0x589f9a
movsx eax, bl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x589f0e
jmp dword [eax*4 + 0x589fcc]
mov bl, 0x41
jmp case.default.0x589f0e
mov bl, 0x42
jmp case.default.0x589f0e
mov bl, 0x43
jmp case.default.0x589f0e
mov bl, 0x44
jmp case.default.0x589f0e
mov bl, 0x45
jmp case.default.0x589f0e
mov bl, 0x46
jmp case.default.0x589f0e
mov bl, 0x47
jmp case.default.0x589f0e
mov bl, 0x48
jmp case.default.0x589f0e
mov bl, 0x49
jmp case.default.0x589f0e
mov bl, 0x4a
jmp case.default.0x589f0e
mov bl, 0x4b
jmp case.default.0x589f0e
mov bl, 0x4c
jmp case.default.0x589f0e
mov bl, 0x4d
jmp case.default.0x589f0e
mov bl, 0x4e
jmp case.default.0x589f0e
mov bl, 0x4f
jmp case.default.0x589f0e
mov bl, 0x50
jmp case.default.0x589f0e
mov bl, 0x51
jmp case.default.0x589f0e
mov bl, 0x52
jmp case.default.0x589f0e
mov bl, 0x53
jmp case.default.0x589f0e
mov bl, 0x54
jmp case.default.0x589f0e
mov bl, 0x55
jmp case.default.0x589f0e
mov bl, 0x56
jmp case.default.0x589f0e
mov bl, 0x57
jmp case.default.0x589f0e
mov bl, 0x58
jmp case.default.0x589f0e
mov bl, 0x59
jmp case.default.0x589f0e
mov bl, 0x5a
push ecx
call fcn.0058a040
add esp, 4
cmp bl, al
jne 0x589f96
mov bl, byte [edi + 1]
inc edi
dec esi
inc ebp
test bl, bl
jne 0x589ef0
test esi, esi
jne 0x589fa4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
movzx eax, byte [edi]
push eax
call fcn.0058a040
movzx ecx, byte [ebp]
mov bl, al
push ecx
call fcn.0058a040
add esp, 8
xor ecx, ecx
cmp bl, al
sete cl
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x58a040
Capabilities:
Parse pe header

Disassembly:
mov cl, byte [esp + 4]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x58a04f
jmp dword [eax*4 + 0x58a0a8]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, cl
ret
Function at 0x58a110
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp esi, 1
jb 0x58a1be
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
sub edi, edx
nop dword [eax]
mov cl, byte [edx]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x58a13d
jmp dword [eax*4 + 0x58a1c0]
mov cl, 0x41
jmp case.default.0x58a13d
mov cl, 0x42
jmp case.default.0x58a13d
mov cl, 0x43
jmp case.default.0x58a13d
mov cl, 0x44
jmp case.default.0x58a13d
mov cl, 0x45
jmp case.default.0x58a13d
mov cl, 0x46
jmp case.default.0x58a13d
mov cl, 0x47
jmp case.default.0x58a13d
mov cl, 0x48
jmp case.default.0x58a13d
mov cl, 0x49
jmp case.default.0x58a13d
mov cl, 0x4a
jmp case.default.0x58a13d
mov cl, 0x4b
jmp case.default.0x58a13d
mov cl, 0x4c
jmp case.default.0x58a13d
mov cl, 0x4d
jmp case.default.0x58a13d
mov cl, 0x4e
jmp case.default.0x58a13d
mov cl, 0x4f
jmp case.default.0x58a13d
mov cl, 0x50
jmp case.default.0x58a13d
mov cl, 0x51
jmp case.default.0x58a13d
mov cl, 0x52
jmp case.default.0x58a13d
mov cl, 0x53
jmp case.default.0x58a13d
mov cl, 0x54
jmp case.default.0x58a13d
mov cl, 0x55
jmp case.default.0x58a13d
mov cl, 0x56
jmp case.default.0x58a13d
mov cl, 0x57
jmp case.default.0x58a13d
mov cl, 0x58
jmp case.default.0x58a13d
mov cl, 0x59
jmp case.default.0x58a13d
mov cl, 0x5a
mov byte [edi + edx], cl
mov al, byte [edx]
inc edx
test al, al
je 0x58a1bd
sub esi, 1
jne 0x58a130
pop edi
pop esi
ret