joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56022e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 4
cmp byte [esi + 0x48c], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x56027d
push dword [ebp + 0xc]
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0055e9e6
add esp, 0xc
jmp 0x5602ee
push dword [esi + 0x490]
mov dword [ebp - 0x10], 1
call fcn.0056749e
push dword [esi + 0x494]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.0056749e
pop ecx
pop ecx
imul eax, eax, 0x3e8
xor ecx, ecx
push ecx
push ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push ecx
push ecx
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x5602ee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 0xc]
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0055e9e6
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0054f3d2
leave
ret

Function at 0x567482
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.005674ab
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005a4b58
add esp, 0x10
pop ebp
ret

Function at 0x5699a6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x5ef50c
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
je 0x569aa9
push ebx
push edi
push 0x5ef520
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp + 8]
mov ebx, eax
push 0x5ef530
push edi
call fcn.00597b34
pop ecx
pop ecx
test eax, eax
je 0x5699f8
test ebx, ebx
je 0x5699ef
push 8
jmp 0x569a13
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x569a17
test ebx, ebx
je 0x569a1e
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x569a1e
push 0x800
push esi
push edi
call ebx
mov esi, eax
jmp 0x569aa5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 4], eax
test eax, eax
je 0x569aa5
push edi
call fcn.00596953
mov ecx, dword [ebp - 4]
add ecx, eax
lea ecx, [ecx*2 + 2]
push ecx
call dword [0x624060]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x569a9d
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x569a9d
push 0x6029b4
push edi
call fcn.00596953
pop ecx
lea eax, [edi + eax*2]
push eax
call fcn.0059db98
pop ecx
pop ecx
push dword [ebp + 8]
push edi
call fcn.00596953
pop ecx
lea eax, [edi + eax*2]
push eax
call fcn.0059db98
pop ecx
pop ecx
test ebx, ebx
je 0x569a94
push 8
push esi
push edi
call ebx
jmp 0x569a9b
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push edi
call dword [0x624064]
pop ecx
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret
Function at 0x569c12
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push esi
xor esi, esi
and dword [ebp - 0x10], esi
and dword [eax], esi
lea eax, [ebp - 0xc]
push edi
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
test edi, edi
jne 0x569d7a
push ebx
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x569d66
cmp dword [ebx + 4], 2
jne 0x569c5a
push 0x10
jmp 0x569c66
cmp dword [ebx + 4], 0x17
jne 0x569d0e
push 0x1c
cmp dword [ebx + 0x18], 0
pop eax
mov dword [ebp - 8], eax
je 0x569d0e
cmp dword [ebx + 0x10], 0
jbe 0x569d0e
cmp dword [ebx + 0x10], eax
jb 0x569d0e
push 0x20
call dword [0x624060]
mov esi, eax
pop ecx
test esi, esi
je 0x569d3e
mov ecx, dword [ebx]
mov dword [esi], ecx
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [esi + 8], ecx
xor ecx, ecx
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 8]
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], ecx
call dword [0x624060]
mov dword [esi + 0x18], eax
pop ecx
test eax, eax
je 0x569d32
push dword [ebp - 8]
push dword [ebx + 0x18]
push eax
call fcn.00583840
add esp, 0xc
cmp dword [ebx + 0x14], 0
je 0x569cf6
push dword [ebx + 0x14]
call dword [0x62406c]
mov dword [esi + 0x14], eax
pop ecx
test eax, eax
je 0x569d1b
mov eax, dword [ebp - 4]
test eax, eax
cmove eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x569d0b
mov dword [eax + 0x1c], esi
mov dword [ebp - 0x10], esi
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x569c50
jmp 0x569d41
push 8
pop edi
push dword [esi + 0x18]
call dword [0x624064]
push esi
call dword [0x624064]
pop ecx
pop ecx
jmp 0x569d41
push 8
pop edi
push esi
call dword [0x624064]
jmp 0x569d2f
push 8
pop edi
cmp dword [ebp - 0xc], 0
je 0x569d50
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov esi, dword [ebp - 4]
test edi, edi
je 0x569d62
push esi
call fcn.00569bdd
pop ecx
xor esi, esi
jmp 0x569d72
test esi, esi
jne 0x569d72
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x56ae64
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.0059677c
add esp, 0x18
test eax, eax
je 0x56ae84
cmp eax, 0xffffffff
jne 0x56ae86
xor eax, eax
pop ebp
ret
Function at 0x56b1a0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0xf0000040
push 1
xor edi, edi
lea eax, [ebp - 4]
push edi
push edi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x56b1c6
push 2
pop eax
jmp 0x56b1ee
push esi
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x56b1df
push 2
pop esi
jmp 0x56b1e1
mov esi, edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop edi
leave
ret
Function at 0x57146f
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push edi
push ecx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x88], 0x80
mov eax, dword [esi + 0x194]
or edi, 0xffffffff
mov ebx, dword [esi]
push ecx
push eax
mov dword [ebp - 0x8c], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x5714e2
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push dword [ebp - 0x8c]
push esi
call fcn.0055f057
pop ecx
pop ecx
cmp edi, 0xffffffff
jne 0x571507
push str.Error_accept__ing_server_connect
push ebx
call fcn.0055e94b
pop ecx
pop ecx
push 0x1e
pop eax
jmp 0x57155a
push str.Connection_accepted_from_server_n
push ebx
call fcn.0055e9e6
push 1
mov byte [esi + 0x360], 0
push edi
mov dword [esi + 0x194], edi
call fcn.0057c0ec
mov byte [esi + 0x1a1], 1
add esp, 0x10
mov eax, dword [ebx + 0x198]
test eax, eax
je 0x571558
push 1
push edi
push dword [ebx + 0x19c]
call eax
add esp, 0xc
test eax, eax
je 0x571558
push esi
call fcn.0057192a
pop ecx
push 0x2a
jmp 0x571504
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054f3d2
leave
ret

Function at 0x5734c6
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x5734f2
push str.Couldnt_set_desired_mode
push edx
call fcn.0055e94b
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x573543
cmp ecx, 0xc8
je 0x573509
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.0055e9e6
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x573519
push edi
call fcn.0057329a
jmp 0x57353e
cmp eax, 0x14
jne 0x573526
push edi
call fcn.00572570
jmp 0x57353e
cmp eax, 0x15
jne 0x573533
push edi
call fcn.00573286
jmp 0x57353e
cmp eax, 0x16
jne 0x573541
push edi
call fcn.005733d1
mov esi, eax
pop ecx
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x576cad
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x576ce8
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.0055e94b
add esp, 0xc
jmp 0x576d10
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x576d03
shr eax, 8
test al, al
jne 0x576d03
xor eax, eax
jmp 0x576d13
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.0055e94b
pop ecx
pop ecx
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0054f3d2
leave
ret

Function at 0x577435
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov byte [ebp + 0xa], al
lea eax, [ebp + 8]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x190]
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x57747d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0055e94b
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push dword [esi]
call fcn.00576dd9
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x577541
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x114]
jne 0x57768f
push edi
lea eax, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], eax
cmp eax, edi
jae 0x57758c
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x57758c
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x57758c
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [ebp + 0xc], eax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov edx, dword [ebp + 0xc]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x5775f5
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x5775f5
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x5775f5
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x5775f5
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x5775f5
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x5775f5
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov dword [ebx + 0x1eb4], eax
lea esi, [ebx + 0x1cb0]
sub eax, esi
mov dword [edi], esi
mov edi, dword [ebp - 4]
sub eax, 2
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push edi
call fcn.00576ec0
add esp, 0x10
push 0
push 3
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x190]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x57764b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0055e94b
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push esi
call fcn.00577495
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [esi + 0x190]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x57768e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0055e94b
add esp, 0xc
pop edi
pop ebx
leave
ret
Function at 0x5777b9
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x104]
push esi
push edi
mov esi, 0x80
mov dword [ebp - 0x908], ebx
push esi
push 0
push eax
call fcn.005836e0
push esi
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.005836e0
mov edi, dword [ebx]
mov dword [ebp - 0x90c], edi
mov ebx, dword [edi + 0x114]
mov eax, dword [ebx + 0x1eb4]
sub eax, dword [ebx + 0x1eb0]
add eax, 2
push eax
lea eax, [ebx + 0x1cb0]
push eax
push 0x3c
push edi
call fcn.00576ec0
mov eax, dword [ebx + 0x1eb0]
add esp, 0x28
mov cl, byte [eax]
inc eax
mov dword [ebx + 0x1eb0], eax
cmp cl, 0x18
je 0x577985
cmp cl, 0x23
je 0x577964
cmp cl, 0x27
jne 0x577a0e
push 0
push 0x27
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [ebp - 0x904]
push 0x800
push eax
call fcn.005686e9
mov ebx, dword [ebx + 0x1cac]
add esp, 0x1c
push 4
pop esi
test ebx, ebx
je 0x5778fe
push dword [ebx]
call fcn.00596970
lea edi, [esi + 1]
add edi, eax
pop ecx
cmp edi, 0x7fa
jae 0x5778f1
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
push str._127_____127s
push dword [ebx]
call fcn.00555f28
add esp, 0x10
test eax, eax
je 0x5778f1
lea eax, [ebp - 0x84]
push eax
push 1
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, 0x800
sub eax, esi
push str._c_s_c_s
push eax
lea eax, [ebp - 0x904]
add eax, esi
push eax
call fcn.005686e9
add esp, 0x1c
mov esi, edi
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x577889
mov edi, dword [ebp - 0x90c]
push 0xf0
push 0xff
mov eax, 0x800
sub eax, esi
push str._c_c
push eax
lea eax, [ebp - 0x904]
add eax, esi
push eax
call fcn.005686e9
add esp, 0x14
lea eax, [esi + 2]
push 0
push eax
lea eax, [ebp - 0x904]
push eax
mov eax, dword [ebp - 0x908]
push dword [eax + 0x190]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x57795e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0055e94b
add esp, 0xc
push esi
jmp 0x5779fc
lea esi, [ebx + 0x1c28]
push esi
call fcn.00596970
push 0xf0
lea ebx, [eax + 6]
mov eax, 0xff
push eax
push esi
push 0
push 0x23
jmp 0x5779a4
lea esi, [ebx + 0x1c08]
push esi
call fcn.00596970
push 0xf0
lea ebx, [eax + 6]
mov eax, 0xff
push eax
push esi
push 0
push 0x18
push 0xfa
push eax
push str._c_c_c_c_s_c_c
lea eax, [ebp - 0x904]
push 0x800
push eax
call fcn.005686e9
add esp, 0x2c
lea eax, [ebp - 0x904]
push 0
push ebx
push eax
mov eax, dword [ebp - 0x908]
push dword [eax + 0x190]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x5779f8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0055e94b
add esp, 0xc
lea eax, [ebx - 2]
push eax
lea eax, [ebp - 0x902]
push eax
push 0x3e
push edi
call fcn.00576ec0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054f3d2
leave
ret
Function at 0x5784c4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x5c0]
mov edi, dword [eax]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [esi + 0x154]
lea ebx, [esi + 0x15c]
push 0
add eax, 4
push eax
push dword [ebx]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x578557
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.00583840
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x578587
push str.Received_too_short_packet
push edi
call fcn.0055e94b
pop ecx
pop ecx
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054f3d2
leave
ret
push ebx
call fcn.0057818d
movzx eax, ax
mov dword [esi + 0xc], eax
pop ecx
sub eax, 3
je 0x578600
sub eax, 1
je 0x578666
sub eax, 1
je 0x5785de
sub eax, 1
je 0x5785c1
push str.Internal_error:_Unexpected_packet
push 0x5ed7a4
push edi
call fcn.0055e94b
jmp 0x578663
lea eax, [edx - 2]
push eax
mov eax, dword [ebx]
add eax, 2
push eax
push esi
call fcn.005782e7
add esp, 0xc
test eax, eax
je 0x578666
jmp 0x578578
push ebx
call fcn.00578174
movzx eax, ax
mov dword [esi + 8], eax
mov eax, dword [ebx]
add eax, 4
push eax
push 0x5ecab8
push edi
call fcn.0055e9e6
add esp, 0x10
jmp 0x578666
cmp edx, 4
jle 0x578666
push ebx
call fcn.00578174
pop ecx
movzx ecx, word [esi + 0x40]
inc ecx
cmp cx, ax
jne 0x578666
lea eax, [edx - 4]
push eax
mov eax, dword [ebx]
add eax, 4
push eax
push 1
push dword [ebp - 0x8c]
call fcn.0055e861
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x578647
push 5
push esi
call fcn.00578ccb
pop ecx
pop ecx
mov eax, ebx
jmp 0x578578
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x70], eax
adc dword [edi + 0x74], edx
push dword [edi + 0x74]
push dword [edi + 0x70]
push edi
call fcn.005666e4
add esp, 0xc
push dword [ebp - 0x8c]
call fcn.00566a15
pop ecx
test eax, eax
je 0x578576
push 5
push esi
call fcn.00578ccb
pop ecx
pop ecx
push 0x2a
pop eax
jmp 0x578578
Function at 0x57868c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 3
pop esi
mov eax, dword [edi + 0x10]
mov ebx, dword [eax]
mov eax, dword [ebp + 0xc]
sub eax, esi
je 0x5787cc
dec eax
sub eax, 1
je 0x57878a
sub eax, 1
je 0x578736
sub eax, 1
je 0x5786d6
push str.tftp_rx:_internal_error
push 0x5ed7a4
push ebx
call fcn.0055e94b
add esp, 0xc
push 0x47
jmp 0x57886f
inc dword [edi + 0x18]
movzx eax, word [edi + 0x40]
push dword [edi + 0x18]
inc eax
movzx eax, ax
push eax
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebx
call fcn.0055e9e6
mov eax, dword [edi + 0x18]
add esp, 0x10
cmp eax, dword [edi + 0x20]
jle 0x578709
mov dword [edi + 8], 0xffffff9d
mov dword [edi], esi
jmp 0x5788a8
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
push 0
push 4
push dword [edi + 0x160]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x5788a8
jmp 0x57884f
xor eax, eax
lea esi, [edi + 0x160]
and dword [edi + 0x18], eax
push 4
push esi
mov word [edi + 0x40], ax
call fcn.005781c1
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.005781a5
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x57884f
mov dword [edi], 1
jmp 0x57888c
lea esi, [edi + 0x160]
push 5
push esi
call fcn.005781c1
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.005781a5
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
push 3
pop eax
mov dword [edi], eax
jmp 0x5788a8
lea eax, [edi + 0x15c]
push eax
call fcn.00578174
movzx esi, word [edi + 0x40]
pop ecx
movzx edx, ax
mov word [ebp + 0xa], ax
lea ecx, [esi + 1]
movzx ecx, cx
cmp ecx, edx
jne 0x5787f4
and dword [edi + 0x18], 0
jmp 0x57880f
cmp esi, edx
jne 0x578898
push edx
push str.Received_last_DATA_packet_block__d_again._n
push ebx
call fcn.0055e9e6
mov ax, word [ebp + 0xa]
add esp, 0xc
lea esi, [edi + 0x160]
mov word [edi + 0x40], ax
push 4
push esi
call fcn.005781c1
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.005781a5
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x578872
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [edi + 0x10]
call fcn.0056a638
push eax
push 0x5ed7a4
push ebx
call fcn.0055e94b
add esp, 0x14
push 0x37
pop eax
jmp 0x5788aa
mov eax, dword [edi + 0x154]
xor ecx, ecx
add eax, 4
inc ecx
cmp dword [edi + 0x14c], eax
push 3
pop eax
cmovge eax, ecx
mov dword [edi], eax
lea eax, [edi + 0x38]
push eax
call fcn.0058cc7a
pop ecx
jmp 0x5788a8
push ecx
push edx
push str.Received_unexpected_DATA_packet_block__d__expecting_block__d_n
push ebx
call fcn.0055e9e6
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x57cadf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 3
jne 0x57cb05
mov eax, dword [esi + 0xc]
test eax, eax
je 0x57cb57
push dword [ecx + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call eax
jmp 0x57cb35
mov eax, dword [esi + 8]
test eax, eax
jne 0x57cb27
push 0x5ecd0c
push dword [ecx + 8]
call fcn.00589c84
mov dword [esi + 8], eax
pop ecx
pop ecx
test eax, eax
jne 0x57cb27
or eax, 0xffffffff
jmp 0x57cb57
push eax
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00598db8
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x57cb55
cmp dword [esi + 8], eax
je 0x57cb4f
push dword [esi + 8]
call fcn.00589fa1
and dword [esi + 8], edi
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x57f6ee
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 4], ecx
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
mov edi, dword [ecx + 0x1d4]
test edi, edi
jne 0x57f710
mov edi, dword [eax + 0x28]
push dword [eax + 0x24]
push dword [eax + 0x20]
call fcn.005561fb
push edx
push eax
call fcn.00556174
mov ecx, eax
mov esi, edx
mov eax, edi
add esp, 0x10
cdq
mov edi, eax
mov ebx, edx
mov eax, dword [ebp + 8]
sub edi, ecx
sbb ebx, esi
cmp dword [eax + 0x1c8], 0
je 0x57f77e
mov eax, dword [ebp - 4]
push dword [eax + 0x184]
push dword [eax + 0x180]
call fcn.005561fb
push edx
push eax
call fcn.00556174
mov ecx, eax
mov esi, edx
mov eax, dword [ebp + 8]
add esp, 0x10
mov eax, dword [eax + 0x1c8]
cdq
sub eax, ecx
sbb edx, esi
cmp ebx, edx
jl 0x57f77e
jg 0x57f77a
cmp edi, eax
jb 0x57f77e
mov edi, eax
mov ebx, edx
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebx
leave
ret