joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49afa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5308a0
mov eax, dword fs:[0]
push eax
mov eax, dword [0x587084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5870a4]
cmp eax, 0xffffffff
je 0x49b00e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49b00e
mov eax, dword [0x5870a4]
cmp eax, 0xffffffff
jne 0x49afe5
xor eax, eax
jmp 0x49afec
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x49b00e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x49b940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cc3e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x587084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5870a4]
cmp eax, 0xffffffff
jne 0x49b976
xor ebx, ebx
jmp 0x49b97f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
mov dword [ebp - 4], 0
setne cl
test cl, cl
je 0x49b9cb
lea edi, [ebx + 0x14]
cmp dword [edi + 4], 0
mov esi, dword [ebx + 0xc]
sete al
test al, al
je 0x49ba0a
test esi, esi
jne 0x49ba10
push 0x49a760
push 0x59d8c4
call fcn.0049a3d0
mov eax, dword [0x5870a4]
add esp, 8
cmp eax, 0xffffffff
je 0x49b9cb
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x49b9f8
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x49b9f8
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x49ba55
nop
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x49ba3b
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x49ba10
lea edi, [ebx + 0x14]
cmp dword [ebx + 0x18], 0
je 0x49b995
nop
mov esi, dword [edi]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x49ba78
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x49ba78
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0042b520
cmp dword [ebx + 0x18], 0
jne 0x49ba60
jmp 0x49b995
Function at 0x49ba90
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x49bc90
push 0
push 0
call fcn.004ea4aa
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x49bab9
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x49bad7
cmp eax, 0xffffffff
je 0x49bad7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret

Function at 0x4ae1b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ecx, ecx
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
sub ebp, edi
xor ebx, ebx
cmp edi, dword [esp + 0x18]
cmova ebp, ecx
test ebp, ebp
je 0x4ae1f1
nop
movsx ecx, byte [edi]
lea edi, [edi + 1]
mov edx, esi
mov eax, esi
shl edx, 6
add ecx, 0x9e3779b9
shr eax, 2
inc ebx
add edx, eax
add ecx, edx
xor esi, ecx
cmp ebx, ebp
jne 0x4ae1d0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x4bf670
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor ecx, ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
sub ebx, edi
xor ebp, ebp
inc ebx
shr ebx, 1
cmp edi, dword [esp + 0x18]
cmova ebx, ecx
test ebx, ebx
je 0x4bf6b3
movzx ecx, word [edi]
lea edi, [edi + 2]
mov edx, esi
mov eax, esi
shl edx, 6
add ecx, 0x9e3779b9
shr eax, 2
inc ebp
add edx, eax
add ecx, edx
xor esi, ecx
cmp ebp, ebx
jne 0x4bf692
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4cebf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x587084]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x5612c4
mov dword [esp + 4], 0x548b40
mov dword [esp + 8], 0x55c1b8
mov dword [esp + 0xc], 0x548b44
mov dword [esp + 0x10], 0x548b48
mov dword [esp + 0x14], 0x55ba64
mov dword [esp + 0x18], 0x55a77c
mov dword [esp + 0x1c], 0x548b4c
mov dword [esp + 0x20], 0x562404
mov dword [esp + 0x24], 0x5633a0
mov dword [esp + 0x28], 0x561ea0
mov dword [esp + 0x2c], 0x548b50
mov dword [esp + 0x30], 0x548b54
mov dword [esp + 0x34], 0x548b58
mov dword [esp + 0x38], 0x544d08
mov dword [esp + 0x3c], 0x548b5c
mov dword [esp + 0x40], 0x548b60
mov dword [esp + 0x44], 0x548b64
mov dword [esp + 0x48], 0x548768
mov dword [esp + 0x4c], 0x54876c
mov dword [esp + 0x50], 0x562450
mov dword [esp + 0x54], 0x562564
mov dword [esp + 0x58], 0x5612c4
mov dword [esp + 0x5c], 0x5612c4
mov dword [esp + 0x60], 0x548b70
mov dword [esp + 0x64], 0x548b74
mov dword [esp + 0x68], 0x55ba9c
mov dword [esp + 0x6c], 0x548b78
mov dword [esp + 0x70], 0x562420
mov dword [esp + 0x74], 0x548770
mov dword [esp + 0x78], 0x548774
mov dword [esp + 0x7c], 0x54382c
mov dword [esp + 0x80], 0x548778
mov dword [esp + 0x84], 0x54877c
mov dword [esp + 0x88], 0x548780
mov dword [esp + 0x8c], 0x548784
mov dword [esp + 0x90], 0x562710
mov dword [esp + 0x94], 0x548b7c
mov dword [esp + 0x98], 0x548788
mov dword [esp + 0x9c], 0x5612c4
mov dword [esp + 0xa0], 0x5612c4
mov dword [esp + 0xa4], 0x5612c4
mov dword [esp + 0xa8], 0x5612c4
mov dword [esp + 0xac], 0x5612c4
mov dword [esp + 0xb0], 0x5612c4
mov dword [esp + 0xb4], 0x5612c4
mov dword [esp + 0xb8], 0x5612c4
mov dword [esp + 0xbc], 0x54878c
mov dword [esp + 0xc0], 0x548790
mov dword [esp + 0xc4], 0x548794
mov dword [esp + 0xc8], 0x55a780
mov dword [esp + 0xcc], 0x548798
mov dword [esp + 0xd0], 0x54879c
mov dword [esp + 0xd4], 0x5626c4
mov dword [esp + 0xd8], 0x5487a0
mov dword [esp + 0xdc], 0x5487a4
mov dword [esp + 0xe0], 0x5487a8
mov dword [esp + 0xe4], 0x548b80
mov dword [esp + 0xe8], 0x5487ac
mov dword [esp + 0xec], 0x5487b0
cmp cl, 0x3c
jb 0x4cee56
mov eax, 0x5612c4
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.00497fef
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.00497fef
add esp, 0xf4
ret
Function at 0x4cee80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x587084]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x4cefeb
add eax, 4
cmp word [eax], cx
jb 0x4cefe3
sub eax, 2
cmp cx, word [eax]
jb 0x4cf010
cmp cx, word [eax + 2]
ja 0x4cf010
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00497fef
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor al, al
xor ecx, esp
call fcn.00497fef
add esp, 0x9c
ret

Function at 0x4edc8d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ed950

Function at 0x4edc98
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004edad1

Function at 0x4f5091
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f4d51

Function at 0x4faf30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x587084]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4faf80
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4faf7a
shr eax, 8
cmp al, 2
jne 0x4faf7a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497fef
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.00497fef
mov esp, ebp
pop ebp
ret
Function at 0x4ff380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4ff39e
cmp dword [esi + 0x48], 0
je 0x4ff39e
push 2
push 3
push esi
call fcn.005124c0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00508af0
add esp, 4
test esi, esi
je 0x4ff3be
cmp dword [esi + 0x48], 0
je 0x4ff3be
push 3
push esi
call fcn.00512500
add esp, 8
pop esi
pop ebp
ret
Function at 0x506ed0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x154]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x506f4e
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x506f1e
pop esi
pop edi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push esi
push dword [ebp + 8]
call fcn.00512b90
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.00506bb0
mov eax, dword [ebp + 8]
add esp, 0x14
mov eax, dword [eax]
mov dword [eax + 0x8584], esi
mov eax, edi
mov dword [ebx], 0x37
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x507130
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x507159
push dword [esi + 0x11c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x50718f
push dword [esi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x55355c
push 2
push eax
call fcn.004de5b7
push dword [esi + 0x118]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004de5b7
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret

Function at 0x507300
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x548]
test esi, esi
je 0x507354
mov eax, dword [edi + 0x44]
test eax, eax
jne 0x507321
cmp dword [edi + 0x40], eax
je 0x507354
mov dword [ebp - 8], esi
mov byte [ebp - 4], 0
test eax, eax
jne 0x50732f
mov eax, dword [edi + 0x40]
push 0x508190
lea ecx, [ebp - 8]
add eax, 0x68
push ecx
push eax
call fcn.0050d370
add esp, 0xc
cmp byte [ebp - 4], 0
jne 0x50735d
mov dword [edi + 0x548], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x507366
mov dword [eax], esi
cmp byte [esi + 0x178], 0
mov edi, dword [esi + 0x154]
jne 0x507354
cmp edi, 0xffffffff
je 0x50738d
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x507354
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5077c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x587084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x59e36c]
mov dword [ebp - 0xa8], 0x4020
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xac], 4
push esi
test eax, eax
jne 0x50788a
push 0x9c
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.004d2710
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
mov dword [ebp - 0x9c], 6
push 3
push 2
push 0
push 0
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x50787e
mov dword [0x59e36c], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497fef
mov esp, ebp
pop ebp
ret
mov dword [0x59e36c], 1
jmp 0x50788f
cmp eax, 2
je 0x5078dd
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x5078c3
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xa8]
jg 0x5078dd
push 4
lea eax, [ebp - 0xa8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00497fef
mov esp, ebp
pop ebp
ret

Function at 0x5079b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x5079f8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00512b90
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00506c50
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00506c50
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x507ae0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x587084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x507cad
cmp byte [edi + 0x1ca], 0
push esi
jne 0x507ca3
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x507b6b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.00512b90
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.00506bb0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497fef
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push 0
push eax
call fcn.004d2710
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x507bd4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.00512b90
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.00506bb0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497fef
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xe8]
push eax
lea esi, [edi + 0xb8]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.005081b0
add esp, 0xc
test al, al
jne 0x507c25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.00512b90
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00506bb0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497fef
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movups xmmword [edi + 0x58], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x11c]
push eax
lea eax, [edi + 0xec]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.005081b0
add esp, 0xc
test al, al
jne 0x507ca3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.00512b90
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00506bb0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497fef
mov esp, ebp
pop ebp
ret
push edi
call fcn.00507700
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00497fef
mov esp, ebp
pop ebp
ret
Function at 0x508530
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x587084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x3e0], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x50858d
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00506c50
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497fef
mov esp, ebp
pop ebp
ret
push dword [esi + 0x3e4]
mov dword [ebp - 0x10], 1
call fcn.00510010
push dword [esi + 0x3e8]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.00510010
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x5085fd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00506c50
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00497fef
mov esp, ebp
pop ebp
ret
Function at 0x50fff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00510020
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.004f1639

Function at 0x5127f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x51296b
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x512957
push esi
nop dword [eax]
cmp dword [edi + 4], 2
jne 0x5128e8
cmp dword [edi + 0x18], 0
je 0x5128e8
mov eax, dword [edi + 0x10]
test eax, eax
je 0x5128e8
cmp eax, 0x10
jb 0x5128e8
push 0x20
call dword [0x587cb0]
mov esi, eax
add esp, 4
test esi, esi
je 0x51294c
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x587cb0]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x51293b
mov ecx, dword [edi + 0x18]
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x5128d6
push eax
call dword [0x587cbc]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x512921
mov eax, dword [ebp - 4]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x5128e5
mov dword [eax + 0x1c], esi
mov dword [ebp - 4], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x512830
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x512905
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x512953
push ebx
call fcn.005127b0
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x587cb4]
push esi
call dword [0x587cb4]
add esp, 8
jmp 0x5128f6
push esi
mov edi, 8
call dword [0x587cb4]
add esp, 4
jmp 0x5128f6
mov edi, 8
jmp 0x5128f6
test ebx, ebx
jne 0x512963
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5133a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.004ea4aa
add esp, 0x18
test eax, eax
je 0x5133c2
cmp eax, 0xffffffff
jne 0x5133c4
xor eax, eax
pop ebp
ret