joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f8c80
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.00502080
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0
push 1
mov dword [esp + 0x18], 0
movzx ecx, byte [esi + 0x51]
push ecx
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov eax, dword [esi + 0x4c]
test byte [eax + 0x20], 1
je 0x4f8d77
cmp edi, 0xffffffff
jne 0x4f8cc6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x4f8d62
push 4
add eax, 0x24
push eax
push 0x700b
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [esi + 0x4c]
test byte [eax + 0x14], 1
jne 0x4f8cf2
push edi
call fcn.004f97f0
mov eax, dword [esi + 0x4c]
add esp, 4
push 1
push edi
push dword [eax + 0x2c]
call fcn.00502320
add esp, 0xc
test eax, eax
jns 0x4f8d14
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
movzx eax, byte [esi + 0x50]
lea ebx, [esi + 0x18]
push ebx
shr eax, 1
lea ecx, [esp + 0x14]
push ecx
push eax
push eax
push 0
lea eax, [esi + 0x58]
mov dword [esi + 0x30], edi
push eax
mov eax, dword [esi + 0x4c]
push edi
push dword [eax + 0x24]
mov eax, dword [ebp]
call eax
test eax, eax
je 0x4f8d55
push 1
push 0
push 1
push ebx
call fcn.004f8880
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4f8d77
mov dword [esi + 0x34], eax
lea eax, [esi + 0x38]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 0x28]
call fcn.004ef920
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4f97f0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4f9829
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.004fdb30
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x4f9900
Capabilities:
Hash data using murmur3

Disassembly:
push ecx
mov ecx, dword [0x644d48]
mov dword [esp], 0
test ecx, ecx
je 0x4f991d
push ecx
push 0
call fcn.004feb90
add esp, 8
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [0x62c6d0]
test edi, edi
je 0x4f9981
mov eax, esi
xor edx, edx
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
div dword [0x62c6d4]
mov eax, dword [edi + edx*4]
lea ecx, [edi + edx*4]
test eax, eax
je 0x4f9981
cmp dword [eax + 4], esi
je 0x4f996f
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x4f9960
jmp 0x4f9971
mov eax, dword [ecx]
test eax, eax
je 0x4f9981
mov eax, dword [eax + 8]
mov dword [esp + 8], eax
jmp 0x4f9aa8
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x4f99d7
mov edx, dword [esp + 8]
test edx, edx
je 0x4f9a08
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f99b0
sub ecx, edi
je 0x4f9a08
cmp byte [ecx + edx - 1], 0xa
jne 0x4f9a08
sub ecx, 1
mov byte [ecx + edx], al
je 0x4f9a08
cmp byte [ecx + edx - 1], 0xd
jne 0x4f9a08
mov byte [ecx + edx - 1], al
jmp 0x4f9a08
push 0x32
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 8], eax
test eax, eax
jne 0x4f99f7
mov eax, 0x62c750
mov dword [esp + 8], eax
jmp 0x4f9aa8
push esi
push str.winsock_error_0x_08x
push 0x32
push eax
call fcn.004f9ae0
add esp, 0x10
push 0xc
call fcn.004ef290
mov edi, eax
add esp, 4
test edi, edi
jne 0x4f9a2d
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, str.malloc_failed_during_Winsock_error
mov dword [esp + 8], eax
jmp 0x4f9aa8
mov dword [edi + 4], esi
mov eax, dword [esp + 8]
mov dword [edi + 8], eax
mov esi, dword [0x62c6d0]
mov eax, dword [0x62c6d8]
test esi, esi
je 0x4f9a4e
cmp eax, dword [0x62c6dc]
jb 0x4f9a68
inc eax
push eax
push 0x62c6d0
call fcn.004fca60
mov eax, dword [0x62c6d8]
add esp, 8
mov esi, dword [0x62c6d0]
inc eax
xor edx, edx
mov dword [0x62c6d8], eax
mov ecx, dword [edi + 4]
shr ecx, 0x10
xor ecx, dword [edi + 4]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
div dword [0x62c6d4]
mov eax, dword [esi + edx*4]
mov dword [edi], eax
mov dword [esi + edx*4], edi
mov eax, dword [esp + 8]
lea ecx, [esi + edx*4]
mov ecx, dword [0x644d48]
pop edi
pop esi
test ecx, ecx
je 0x4f9ac3
push ecx
push 0
call fcn.004feba0
mov eax, dword [esp + 8]
add esp, 8
pop ecx
ret
Function at 0x4fae10
Capabilities:
Connect socket

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x1c]
cmp dword [esi], ebp
jge 0x4fae50
movzx eax, word [edi]
push ebp
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
test eax, eax
js 0x4faeec
push eax
mov ebp, 1
call fcn.004f97f0
add esp, 4
test eax, eax
js 0x4faede
push dword [esp + 0x20]
push edi
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x4faefd
mov ebx, dword [esi]
mov dword [esp + 0x18], 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x4faeaa
test ebx, ebx
js 0x4faeaa
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push 0x1007
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4faef5
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4faeac
mov eax, edi
cmp eax, 0x2733
je 0x4faef5
cmp eax, 0x2714
je 0x4faef5
cmp eax, 0x2734
je 0x4faef5
cmp eax, 0x2726
je 0x4faef5
cmp eax, 0x274d
jne 0x4faeda
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
pop ecx
ret
test ebp, ebp
je 0x4faeec
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4fbbc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x632f90]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
lea eax, [esp + 4]
push esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
test edx, edx
je 0x4fbc8f
mov ecx, ebx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4fbc00
sub ecx, esi
lea eax, [edx + 2]
add eax, ecx
cmp eax, 0x104
jae 0x4fbc8f
mov edx, 0x62c864
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4fbc20
push edi
lea edi, [esp + 0xc]
sub edx, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4fbc30
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4fbc48
lea edi, [esp + 0xc]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4fbc56
mov ecx, ebx
lea eax, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00526f37
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.00526f37
add esp, 0x108
ret

Function at 0x4fbd40
Capabilities:
Set socket configuration

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
push edi
push 0
push 1
push 2
call fcn.004faf80
add esp, 0x10
test eax, eax
jne 0x4fbdc1
push esi
mov esi, dword [edi]
lea eax, [esp + 8]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4fbdac
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.004fdb30
add esp, 0xc
push dword [edi]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi + 4]
call esi
pop esi
mov dword [edi + 4], 0xffffffff
or eax, 0xffffffff
mov dword [edi], 0xffffffff
pop edi
pop ecx
ret
push dword [edi + 4]
call fcn.004fbee0
add esp, 4
test eax, eax
js 0x4fbd89
pop esi
xor eax, eax
pop edi
pop ecx
ret
mov dword [edi + 4], 0xffffffff
or eax, 0xffffffff
mov dword [edi], 0xffffffff
pop edi
pop ecx
ret

Function at 0x4fbee0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4fbf19
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.004fdb30
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x4fca60
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [0x62c6e4]
mov ecx, dword [esi + 0x10]
lea eax, [edi - 1]
cmp ecx, eax
je 0x4fcc3f
mov ebx, dword [esp + 0x24]
cmp dword [esi + 0xc], ebx
ja 0x4fcc3f
mov esi, ecx
push ebp
nop
mov ebp, dword [esi*4 + 0x62c6ec]
inc esi
mov eax, ebp
mov dword [esp + 0x10], ebp
shr eax, 0x1f
movd xmm0, ebp
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x5c2d50]
mulsd xmm0, qword [0x5c40b8]
call fcn.005276f0
mov dword [esp + 0x1c], eax
cmp eax, ebx
ja 0x4fcacb
cmp esi, edi
jl 0x4fca90
lea edi, [ebp*4]
mov dword [esp + 0x14], esi
push edi
call fcn.004ef290
mov esi, dword [esp + 0x28]
add esp, 4
mov ebx, eax
push edi
test ebx, ebx
je 0x4fcb8a
push 0
push ebx
call fcn.00528d10
xor ebp, ebp
add esp, 0xc
mov dword [esp + 0x18], ebp
cmp dword [esi + 4], ebp
jbe 0x4fcb5a
mov eax, dword [esi]
mov edi, dword [eax + ebp*4]
test edi, edi
je 0x4fcb50
mov ebp, dword [esp + 0x10]
mov ecx, dword [edi + 4]
xor edx, edx
shr ecx, 0x10
xor ecx, dword [edi + 4]
imul ecx, ecx, 0x85ebca6b
mov esi, dword [edi]
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
div ebp
mov eax, dword [ebx + edx*4]
mov dword [edi], eax
mov dword [ebx + edx*4], edi
mov edi, esi
test esi, esi
jne 0x4fcb11
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
inc ebp
mov dword [esp + 0x18], ebp
cmp ebp, dword [esi + 4]
jb 0x4fcb04
mov eax, dword [esi]
test eax, eax
je 0x4fcb69
push eax
call fcn.004ef3b0
add esp, 4
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], ebp
pop ebp
pop edi
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x10], ecx
pop esi
pop ebx
add esp, 0x10
ret
push dword [esi]
call fcn.004ef3a0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4fcba5
pop ebp
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
mov ecx, dword [esi + 4]
mov eax, ebp
sub eax, ecx
shl eax, 2
push eax
lea eax, [ebx + ecx*4]
push 0
push eax
call fcn.00528d10
xor eax, eax
add esp, 0xc
mov dword [esp + 0x10], eax
cmp dword [esi + 4], eax
jbe 0x4fcb6d
mov ecx, ebx
mov dword [esp + 0x18], ebx
nop
mov esi, dword [ecx]
mov edi, ecx
test esi, esi
je 0x4fcc25
mov ecx, dword [esi + 4]
xor edx, edx
shr ecx, 0x10
xor ecx, dword [esi + 4]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
div ebp
mov eax, dword [esp + 0x10]
cmp edx, eax
jne 0x4fcc0b
mov edi, esi
jmp 0x4fcc1b
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [ebx + edx*4]
mov dword [esi], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + edx*4], esi
mov esi, dword [edi]
test esi, esi
jne 0x4fcbd8
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
inc eax
add ecx, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
cmp eax, dword [esi + 4]
jb 0x4fcbd0
jmp 0x4fcb6d
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x504100
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x632f90]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
push esi
push edi
or edi, 0xffffffff
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x504134
push eax
push 0
call fcn.004feb90
add esp, 8
test byte [ebp + 0x1c], 2
jne 0x5041f4
mov esi, dword [esp + 0xa4]
test esi, esi
js 0x50414e
cmp esi, dword [ebp + 0xc]
jbe 0x504151
mov esi, dword [ebp + 0xc]
test esi, esi
jle 0x5041f4
mov edi, dword [ebp]
xor ebx, ebx
cmp dword [ebp + 0x18], ebx
je 0x50417f
call fcn.004feb40
test eax, eax
je 0x50417f
push dword [ebp + 0x18]
call fcn.004fec20
add esp, 4
test eax, eax
je 0x504221
test edi, edi
je 0x5041f2
lea ecx, [esp + 0x14]
cmp ebx, 0x10
jge 0x5041b3
test esi, esi
je 0x5041b3
mov eax, dword [edi + 0x18]
inc ebx
add eax, dword [edi + 8]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0xc]
cmp esi, eax
jb 0x5041b1
mov dword [ecx], eax
add ecx, 8
sub esi, dword [edi + 0xc]
mov edi, dword [edi]
test edi, edi
jne 0x504187
jmp 0x5041b3
mov dword [ecx], esi
test ebx, ebx
je 0x5041f2
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xb8]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x5041de
or edi, 0xffffffff
jmp 0x5041f4
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x5041f4
push edi
push ebp
call fcn.00503f40
add esp, 8
jmp 0x5041f4
xor edi, edi
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x504206
push eax
push 0
call fcn.004feba0
add esp, 8
mov ecx, dword [esp + 0x94]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00526f37
add esp, 0x88
ret
push 0x6318d8
push 0x6318e4
push 0x978
push 0x631914
push 0x631920
push 0xdeaddead
call fcn.004fdc30
add esp, 0x18
push 0x631944
push str.evthread_is_debug_lock_held___buffer___lock_
push 0x978
push 0x631980
push 0x63198c
push 2
call fcn.00559d7d
add esp, 4
push eax
call fcn.004212e0
add esp, 0x18
call fcn.0055d4ee
int3
Function at 0x504280
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
sub esp, 0x50
mov eax, dword [0x632f90]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
push edi
mov edi, dword [esp + 0x5c]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x5042a6
push eax
push 0
call fcn.004feb90
add esp, 8
test byte [edi + 0x1c], 4
je 0x5042b4
or esi, 0xffffffff
jmp 0x504403
push ebx
mov ebx, dword [esp + 0x64]
lea eax, [esp + 0xc]
push eax
push 0x4004667f
push ebx
mov dword [esp + 0x18], 0x1000
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x5042e5
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x5042e5
cmp eax, 0x1000
jle 0x5042ea
mov eax, 0x1000
mov esi, dword [esp + 0x68]
test esi, esi
js 0x5042f6
cmp esi, eax
jle 0x5042f8
mov esi, eax
push 4
push esi
push edi
call fcn.00505c20
add esp, 0xc
cmp eax, 0xffffffff
jne 0x504310
or esi, eax
jmp 0x504402
push ebp
push 1
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x28]
push eax
push esi
push edi
call fcn.00505ff0
mov ebp, eax
add esp, 0x18
xor ecx, ecx
test ebp, ebp
jle 0x504346
mov eax, dword [esp + ecx*8 + 0x1c]
mov dword [esp + ecx*8 + 0x40], eax
mov eax, dword [esp + ecx*8 + 0x20]
mov dword [esp + ecx*8 + 0x3c], eax
inc ecx
cmp ecx, ebp
jl 0x504331
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x20]
push eax
push ebp
lea eax, [esp + 0x50]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x504382
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
je 0x504393
or esi, 0xffffffff
jmp 0x504401
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
jne 0x50438f
or esi, esi
jmp 0x504401
test esi, esi
jne 0x504397
xor esi, esi
jmp 0x504401
mov dword [esp + 0x10], 0
mov ebx, esi
test ebp, ebp
jle 0x5043f2
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], connect
mov ecx, dword [edx]
test byte [ecx + 0x10], 8
je 0x5043bd
xor eax, eax
jmp 0x5043d0
mov eax, dword [ecx + 4]
sub eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
cmp eax, 0x7fffffff
cmova eax, dword [esp + 0x14]
cmp eax, ebx
jge 0x5043ea
add dword [ecx + 0xc], eax
sub ebx, eax
mov eax, dword [esp + 0x10]
mov edx, dword [edx]
inc eax
mov dword [esp + 0x10], eax
cmp eax, ebp
jl 0x5043b1
jmp 0x5043f2
mov eax, ecx
add dword [eax + 0xc], ebx
mov dword [edi + 8], edx
add dword [edi + 0xc], esi
add dword [edi + 0x10], esi
push edi
call fcn.005061f0
add esp, 4
pop ebp
pop ebx
mov eax, dword [edi + 0x18]
test eax, eax
je 0x504415
push eax
push 0
call fcn.004feba0
add esp, 8
mov ecx, dword [esp + 0x54]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00526f37
add esp, 0x50
ret
Function at 0x50b0b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x94
mov eax, dword [0x632f90]
xor eax, esp
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0xa0]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 8], eax
test esi, esi
je 0x50b25d
test byte [esi + 0x1c], 0x10
je 0x50b25d
mov eax, dword [esi + 0x18]
mov dword [esp + 0xc], 0
test eax, eax
je 0x50b103
push eax
push 0
call fcn.004feb90
add esp, 8
mov eax, dword [esi + 0x4c]
test al, 2
jne 0x50b276
push ebx
push ebp
push edi
or edi, 0xffffffff
test byte [esi + 0x1c], 4
jne 0x50b230
or edi, edi
test al, 1
jne 0x50b230
push 0x80
lea eax, [esi + 0x58]
mov dword [esi + 0x50], 0
push 0
push eax
mov dword [esi + 0x54], 0
call fcn.00528d10
mov ebx, dword [esp + 0xb8]
or edi, 0xffffffff
push 0x10
push ebx
push esi
call fcn.00505c20
add esp, 0x18
cmp eax, edi
je 0x50b230
push 0
push esi
call fcn.005054f0
push 1
lea eax, [esp + 0x1c]
push eax
push 0x10
lea eax, [esp + 0x34]
push eax
push ebx
push esi
call fcn.00505ff0
mov ebp, eax
add esp, 0x20
xor edx, edx
test ebp, ebp
jle 0x50b1a6
lea ecx, [esi + 0x58]
nop
mov eax, dword [esp + edx*8 + 0x20]
lea ecx, [ecx + 8]
mov dword [ecx - 4], eax
mov eax, dword [esp + edx*8 + 0x24]
inc edx
mov dword [ecx - 8], eax
cmp edx, ebp
jl 0x50b190
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov dword [esi + 0x54], ebp
mov edi, dword [eax]
mov dword [esi + 0x50], edi
test edi, edi
je 0x50b1ca
push 0x10
push edi
call fcn.005059d0
mov edi, dword [edi]
add esp, 8
inc ebx
test edi, edi
jne 0x50b1b8
cmp ebx, ebp
jne 0x50b2cd
push esi
call fcn.00505980
add esp, 4
lea eax, [esp + 0x18]
mov edi, esi
push 0
push dword [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
push ebp
lea eax, [esi + 0x58]
push eax
push dword [edi + 0x48]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x50b22a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x50b22a
push 0x10
push edi
call fcn.0050b7c0
push 0
push esi
call fcn.00505530
push esi
call fcn.005027f0
add esp, 0x14
or edi, 0xffffffff
jmp 0x50b230
or dword [esi + 0x4c], 1
xor edi, edi
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x50b242
push ecx
push 0
call fcn.004feba0
add esp, 8
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00526f37
add esp, 0x94
ret
mov ecx, dword [esp + 0x94]
or eax, 0xffffffff
pop esi
xor ecx, esp
call fcn.00526f37
add esp, 0x94
ret
push 0x632d74
push 0x632d84
push 0x105
push 0x632da0
push 0x632db0
push 0xdeaddead
call fcn.004fdc30
add esp, 0x18
push 0x632dd4
push str._buf_o__write_in_progress
push 0x105
push 0x632e00
push 0x632e10
push 2
call fcn.00559d7d
add esp, 4
push eax
call fcn.004212e0
add esp, 0x18
call fcn.0055d4ee
push 0x632e34
push 0x632e44
push 0x121
push 0x632e54
push 0x632e64
push 0xdeaddead
call fcn.004fdc30
add esp, 0x18
push 0x632e88
push str.npin__nvecs
push 0x121
push str.buffer_iocp.c
push str._s:_d:_Assertion__s_failed_in__s
push 2
call fcn.00559d7d
add esp, 4
push eax
call fcn.004212e0
add esp, 0x18
call fcn.0055d4ee
int3
Function at 0x50b330
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebp
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x50b364
test byte [edi + 0x1c], 0x10
je 0x50b364
mov ebp, edi
mov eax, dword [edi + 0x18]
test eax, eax
je 0x50b357
push eax
push 0
call fcn.004feb90
add esp, 8
mov eax, dword [ebp + 0x4c]
test al, 1
jne 0x50b4a6
jmp 0x50b373
xor ebp, ebp
test edi, edi
jne 0x50b345
pop edi
or eax, 0xffffffff
pop ebp
add esp, 8
ret
push esi
or esi, 0xffffffff
test byte [edi + 0x1c], 2
jne 0x50b48b
or esi, esi
test al, 2
jne 0x50b48b
mov eax, dword [edi + 0xc]
test eax, eax
je 0x50b489
push ebx
mov ebx, dword [esp + 0x20]
test ebx, ebx
js 0x50b3a3
cmp ebx, eax
jbe 0x50b3a5
mov ebx, eax
push 1
push edi
call fcn.005054f0
push 0x80
lea eax, [ebp + 0x58]
mov dword [ebp + 0x50], 0
push 0
push eax
mov dword [ebp + 0x54], 0
call fcn.00528d10
mov esi, dword [edi]
lea ecx, [ebp + 0x58]
add esp, 0x14
mov dword [ebp + 0x50], esi
xor edx, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
test esi, esi
je 0x50b42b
mov eax, dword [esi + 0x18]
add eax, dword [esi + 8]
push 0x20
push esi
mov dword [ecx + 4], eax
call fcn.005059d0
mov edx, dword [esp + 0x24]
add esp, 8
mov eax, dword [esi + 0xc]
inc edx
mov dword [esp + 0x1c], edx
cmp ebx, eax
jbe 0x50b421
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
add ecx, 8
sub ebx, dword [esi + 0xc]
mov esi, dword [esi]
mov dword [esp + 0x10], ecx
cmp edx, 0x10
jl 0x50b3e0
jmp 0x50b42b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
mov dword [eax], ebx
push edi
mov dword [ebp + 0x54], edx
call fcn.00505980
add esp, 4
lea eax, [esp + 0x14]
push 0
push dword [esp + 0x28]
push 0
push eax
push dword [esp + 0x2c]
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x48]
call dword [sym.imp.WS2_32.dll_WSASend]
pop ebx
test eax, eax
je 0x50b485
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x50b485
push 0x20
push ebp
call fcn.0050b7c0
push 1
push edi
call fcn.00505530
push edi
call fcn.005027f0
add esp, 0x14
or esi, 0xffffffff
jmp 0x50b48b
or dword [ebp + 0x4c], 2
xor esi, esi
mov eax, dword [edi + 0x18]
test eax, eax
je 0x50b49d
push eax
push 0
call fcn.004feba0
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebp
add esp, 8
ret
push 0x632cb4
push 0x632cc4
push 0xbb
push 0x632ce0
push 0x632cf0
push 0xdeaddead
call fcn.004fdc30
add esp, 0x18
push 0x632d14
push str._buf_o__read_in_progress
push 0xbb
push 0x632d40
push 0x632d50
push 2
call fcn.00559d7d
add esp, 4
push eax
call fcn.004212e0
add esp, 0x18
call fcn.0055d4ee
int3
Function at 0x55ec1b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x646528]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x55ec5b
cmp byte [ebx], 0xa
jne 0x55ec5b
or byte [eax + edi + 0x28], 4
jmp 0x55ec60
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x55ed5e
mov al, byte [edx]
cmp al, 0x1a
je 0x55ed40
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x55ec8f
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x55ecb4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x55ecbe
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x55ec71
jmp 0x55ed5e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x55ed3b
cmp dword [ebp - 0xc], 0
je 0x55ed3b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x646528]
test byte [eax + edi + 0x28], 0x48
je 0x55ed15
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x55ed00
mov byte [esi], dl
jmp 0x55ed11
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x646528]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x55ed5e
cmp byte [ebp - 1], 0xa
jne 0x55ed24
cmp esi, ebx
jne 0x55ed24
mov byte [esi], 0xa
jmp 0x55ed5d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0056d0a2
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x55ed5e
mov byte [esi], 0xd
jmp 0x55ed5d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x646528]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x55ed5a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x55ed5e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret