joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d5a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.00546ac0
mov eax, dword [0x5b3094]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x48d606
cmp edi, dword [esi]
je 0x48d5fd
test ebp, ebp
je 0x48d680
test ebx, ebx
js 0x48d680
mov eax, 1
mov dword [esi], edi
jmp 0x48d60c
mov edi, dword [esi]
test edi, edi
je 0x48d680
test ebp, ebp
je 0x48d79a
push edi
call fcn.00483fb0
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x48d640
push 0x28
push str.cryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.00475400
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x48d69b
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.0046d860
add esp, 0xc
test eax, eax
je 0x48d680
push ebx
push ebp
push dword [esi + 4]
call fcn.0046da10
add esp, 0xc
test eax, eax
je 0x48d680
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.0046d7c0
add esp, 0xc
test eax, eax
jne 0x48d6b7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00547055
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x48d680
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x48d6da
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x48d6e0
push edx
push edi
push dword [esi + 8]
call fcn.0046d860
add esp, 0xc
test eax, eax
je 0x48d680
push edi
call fcn.00483fb0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.0046da10
add esp, 0x10
test eax, eax
je 0x48d680
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x48d730
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.0046d860
add esp, 0xc
test eax, eax
je 0x48d680
push edi
call fcn.00483fb0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.0046da10
add esp, 0x10
test eax, eax
je 0x48d680
push dword [esi + 8]
push dword [esi + 4]
call fcn.0046da40
add esp, 8
test eax, eax
je 0x48d680
mov eax, 1
jmp 0x48d682
test eax, eax
je 0x48d77a
jmp 0x48d6de
Function at 0x4bf780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x4bf7b1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4bf7b8
add edx, 4
add esi, 4
sub ecx, 4
jae 0x4bf7a0
xor edi, edi
cmp ecx, 0xfffffffc
je 0x4bf7f3
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x4bf7f3
cmp ecx, 0xfffffffd
je 0x4bf7f3
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x4bf7f3
cmp ecx, 0xfffffffe
je 0x4bf7f3
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x4bf7f3
cmp ecx, 0xffffffff
je 0x4bf7f3
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x4bf80e
push 0x157
push str.cryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call fcn.00475400
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x4bf82d
mov esi, edi
mov edx, ebp
sub esi, ebp
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x4bf82d
inc ecx
inc edx
cmp ecx, ebx
jl 0x4bf820
lea edx, [ebx - 1]
test edx, edx
js 0x4bf851
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
nop dword [eax + eax]
cmp byte [eax + esi], 0
jne 0x4bf851
cmp byte [eax], 0xff
jne 0x4bf851
dec eax
sub edx, 1
jns 0x4bf840
cmp ecx, edx
jl case.0x4bf87d.2
jle 0x4bf863
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x4bf87d.2
movzx eax, byte [eax + 0x4bf8f0]
jmp dword [eax*4 + 0x4bf8d0]
mov eax, 7
jmp 0x4bf8b3
mov eax, 6
jmp 0x4bf8b3
mov eax, 5
jmp 0x4bf8b3
mov eax, 4
jmp 0x4bf8b3
mov eax, 3
jmp 0x4bf8b3
mov eax, 2
jmp 0x4bf8b3
mov eax, 1
test dl, dh
jne case.0x4bf87d.2
and bl, dl
cmp bl, dl
jne case.0x4bf87d.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x4ccf70
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x4cd05c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x4ccfed
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + 0x57dbd0]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x57dbd0]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x57dbd0]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + 0x57dbd0]
mov byte [edx], al
jmp 0x4cd041
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x4cd001
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + 0x57dbd0]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x57dbd0]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x4cd02b
lea eax, [esi + 0x3c]
jmp 0x4cd038
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x57dbd0]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x4ccf90
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret
Function at 0x4e5dc0
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0x6c
call fcn.00546ac0
mov eax, dword [0x5b3094]
xor eax, esp
mov dword [esp + 0x68], eax
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4e5e36
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4e5e2a
mov eax, 8
call fcn.00546ac0
movsd xmm0, qword [0x594490]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.004813d0
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4e5e9a
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4e5e8e
mov eax, 8
call fcn.00546ac0
movsd xmm0, qword [0x594490]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.004813d0
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.004e5f20
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.00546ac0
movsd xmm0, qword [0x54c740]
lea eax, [esp + 0x10]
movsd qword [esp], xmm0
push 0x20
push eax
call fcn.004813d0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov eax, 8
call fcn.00546ac0
movsd xmm0, qword [0x54c740]
lea eax, [esp + 0xc]
movsd qword [esp], xmm0
push 4
push eax
call fcn.004813d0
mov ecx, dword [esp + 0x78]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.00547055
add esp, 0x6c
ret
Function at 0x50dcb0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5b3094]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x50dd05
mov eax, dword [esp]
cmp al, 2
jne 0x50dcff
shr eax, 8
cmp al, 2
jne 0x50dcff
call fcn.00516470
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00547055
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 2
xor ecx, esp
call fcn.00547055
add esp, 0x194
ret
Function at 0x5110e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x527790
push ecx
push 2
push 1
lea eax, [esp + 0xb]
push eax
mov eax, dword [esp + 0x14]
push dword [eax + 0x168]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x527809
cmp eax, 1
jne 0x5277ba
mov eax, 1
pop ecx
ret
cmp eax, 0xffffffff
jne 0x52780d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x5277b3
cmp eax, 0xb
je 0x5277b3
cmp eax, 0x2733
je 0x5277b3
cmp eax, 0x2746
je 0x527809
cmp eax, 0x2745
je 0x527809
cmp eax, 0x2742
je 0x527809
cmp eax, 0x2744
je 0x527809
cmp eax, 0x274a
je 0x527809
cmp eax, 0x274c
je 0x527809
cmp eax, 0x2749
jne 0x52780d
xor eax, eax
pop ecx
ret
or eax, 0xffffffff
pop ecx
ret

Function at 0x511c10
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x14]
lea ebp, [ebx + 0x5cc]
push 0x4000
push ebp
call fcn.00512750
mov eax, dword [ebx + 0x160]
add esp, 0x10
test eax, eax
je 0x511c61
cmp byte [ebx + 0x85fc], 0
jne 0x511c61
push ebp
push 0x54c52c
push 0x100
push eax
call fcn.00512660
add esp, 0x10
mov byte [ebx + 0x85fc], 1
cmp byte [ebx + 0x318], 0
je 0x511cd8
push edi
mov edi, ebp
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x511c70
sub edi, ecx
cmp edi, 0x3fff
jae 0x511c91
mov byte [ebx + edi + 0x5cc], 0xa
inc edi
mov byte [ebx + edi + 0x5cc], al
mov eax, dword [ebx + 0x1d0]
test eax, eax
je 0x511caf
push dword [ebx + 0x15c]
push edi
push ebp
push 0
push ebx
call eax
add esp, 0x14
pop edi
pop ebp
pop ebx
ret
push dword [ebx + 0x158]
push 1
push 2
push 0x59c184
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebx + 0x158]
push 1
push edi
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
pop edi
pop ebp
pop ebx
ret

Function at 0x511ce0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x5b3094]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov ebx, dword [esp + 0x810]
test ebx, ebx
je 0x511dab
cmp byte [ebx + 0x318], 0
je 0x511dab
push edi
lea eax, [esp + 0x81c]
push eax
push dword [esp + 0x81c]
lea eax, [esp + 0x10]
push 0x801
push eax
call fcn.00512750
lea edi, [esp + 0x18]
add esp, 0x10
lea ecx, [edi + 1]
nop word [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x511d40
mov eax, dword [ebx + 0x1d0]
sub edi, ecx
test eax, eax
je 0x511d7e
push dword [ebx + 0x15c]
lea ecx, [esp + 0xc]
push edi
push ecx
push 0
push ebx
call eax
add esp, 0x14
pop edi
pop ebx
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.00547055
add esp, 0x808
ret
push dword [ebx + 0x158]
push 1
push 2
push 0x59c184
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebx + 0x158]
lea eax, [esp + 0x1c]
push 1
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
pop edi
mov ecx, dword [esp + 0x808]
pop ebx
xor ecx, esp
call fcn.00547055
add esp, 0x808
ret
Function at 0x511fe0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x168]
call fcn.00512390
add esp, 8
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [ebp], 0
cmp ebx, 0xffffffff
jne 0x512066
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x51203e
pop edi
pop esi
mov dword [ebp], 0x51
xor eax, eax
pop ebp
pop ebx
ret
push esi
push edi
call fcn.0052ba10
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.00511c10
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x8600], esi
mov eax, ebx
mov dword [ebp], 0x37
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x512390
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov eax, edx
push ebx
push esi
shl eax, 4
lea esi, [ecx + 0x18c]
mov ebx, dword [ecx + edx*4 + 0x168]
add esi, eax
mov eax, dword [ecx + 0x248]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x3c], 3
je 0x51243e
cmp dword [ecx + edx*4 + 0x17c], 0x511f40
jne 0x51243e
cmp dword [esi], 0
je 0x5123d7
test edi, edi
je 0x51243e
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.0051d930
add esp, 0x10
cmp eax, 0xffffffff
je 0x51243e
test al, 1
je 0x51243e
cmp dword [esi], 0
jne 0x512427
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x5b3018]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x512427
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x51243e
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret

Function at 0x512450
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi + 0x1d0]
test eax, eax
je 0x512479
push dword [edi + 0x15c]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call eax
add esp, 0x14
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x5124b4
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x59c184
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x158]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x515ba0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x515bbc
cmp dword [esi + 0x48], 0
je 0x515bbc
push 2
push 3
push esi
call fcn.0052af60
add esp, 0xc
push dword [esp + 0xc]
call fcn.00521270
add esp, 4
test esi, esi
je 0x515bdd
cmp dword [esi + 0x48], 0
je 0x515bdd
push 3
push esi
call fcn.0052afa0
add esp, 8
pop esi
ret

Function at 0x516310
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x250], 2
je fcn.005162c0
mov al, 1
ret
Function at 0x51ded0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x5c0]
test esi, esi
je 0x51df26
mov eax, dword [edi + 0x44]
test eax, eax
jne 0x51deef
cmp dword [edi + 0x40], eax
je 0x51df26
mov dword [esp + 8], esi
mov byte [esp + 0xc], 0
test eax, eax
jne 0x51deff
mov eax, dword [edi + 0x40]
push 0x51ee10
lea ecx, [esp + 0xc]
add eax, 0x68
push ecx
push eax
call fcn.00525e10
add esp, 0xc
cmp byte [esp + 0xc], 0
jne 0x51df2f
mov dword [edi + 0x5c0], 0
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x51df39
mov dword [eax], esi
cmp byte [esi + 0x1ac], 0
mov edi, dword [esi + 0x168]
je 0x51df5e
push esi
call fcn.005110e0
add esp, 4
test eax, eax
jne 0x51df77
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
cmp edi, 0xffffffff
je 0x51df77
push 2
push 1
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x51df26
mov eax, edi
pop edi
pop esi
add esp, 8
ret

Function at 0x51e600
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [esp + 0x20]
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x51e648
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0052ba10
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00511ce0
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00511ce0
add esp, 8
pop edi
pop esi
ret
Function at 0x51e730
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x108
mov eax, dword [0x5b3094]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push edi
mov edi, dword [esp + 0x114]
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x51e923
cmp byte [edi + 0x21a], 0
push esi
jne 0x51e919
cmp byte [edi + 0x234], 0
jne 0x51e919
mov esi, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x94]
mov dword [esp + 0x10], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x51e7d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0052ba10
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.00511c10
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00547055
add esp, 0x108
ret
push 0x80
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x80
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x51e83d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0052ba10
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.00511c10
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00547055
add esp, 0x108
ret
lea eax, [edi + 0xfc]
push eax
lea esi, [edi + 0xcc]
lea eax, [esp + 0x94]
push esi
push eax
call fcn.0051ee30
add esp, 0xc
test al, al
jne 0x51e896
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0052ba10
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00511c10
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00547055
add esp, 0x108
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movups xmmword [edi + 0x58], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x130]
push eax
lea eax, [edi + 0x100]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0051ee30
add esp, 0xc
test al, al
jne 0x51e919
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0052ba10
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00511c10
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00547055
add esp, 0x108
ret
push edi
call fcn.0051e3b0
add esp, 4
pop esi
mov ecx, dword [esp + 0x10c]
pop edi
pop ebx
xor ecx, esp
call fcn.00547055
add esp, 0x108
ret
Function at 0x51f1b0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x5b3094]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
xor eax, eax
push edi
mov edi, dword [esp + 0x28]
push 4
cmp byte [esi + 0x434], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x51f210
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00511ce0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00547055
add esp, 0x18
ret
push dword [esi + 0x438]
mov dword [esp + 0x14], 1
call fcn.005139c0
push dword [esi + 0x43c]
imul eax, eax, 0x3e8
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
call fcn.005139c0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x51f287
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00511ce0
add esp, 0x10
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.00547055
add esp, 0x18
ret
Function at 0x52cd30
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [eax], ebx
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x52cec2
push ebp
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x52ceac
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x52cd7f
lea ebp, [eax + 0xe]
jmp 0x52cd8b
cmp eax, 0x17
jne 0x52ce39
lea ebp, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x52ce39
mov eax, dword [edi + 0x10]
test eax, eax
je 0x52ce39
cmp eax, ebp
jb 0x52ce39
push 0x20
call dword [0x5b3018]
mov esi, eax
add esp, 4
test esi, esi
je 0x52cea1
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebp
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebp
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x5b3018]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x52ce90
push ebp
push dword [edi + 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x52ce25
push eax
call dword [0x5b3024]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x52ce76
mov eax, dword [esp + 0x10]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x52ce35
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x52cd72
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x52ce58
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x52cea8
push ebx
call fcn.0052ccf0
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, ebp
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebp, 8
call dword [0x5b301c]
push esi
call dword [0x5b301c]
add esp, 8
jmp 0x52ce48
push esi
mov ebp, 8
call dword [0x5b301c]
add esp, 4
jmp 0x52ce48
mov ebp, 8
jmp 0x52ce48
test ebx, ebx
jne 0x52ceb8
mov ebp, 0x2af9
push ebp
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebx
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x52d1c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x52d1e2
cmp eax, 0xffffffff
jne 0x52d1e4
xor eax, eax
ret