joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53f51b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00532d71
and dword [ebp - 4], 0
cmp dword [0x5ef464], 0
mov ebx, eax
jne 0x53f5cc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x53f67d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x53f67d
push eax
call fcn.00532cff
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5ef464], eax
call esi
push eax
call fcn.00532cff
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5ef468], eax
call esi
push eax
call fcn.00532cff
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5ef46c], eax
call esi
push eax
call fcn.00532cff
pop ecx
mov dword [0x5ef474], eax
test eax, eax
je 0x53f5cc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00532cff
pop ecx
mov dword [0x5ef470], eax
mov eax, dword [0x5ef470]
cmp eax, ebx
je 0x53f624
cmp dword [0x5ef474], ebx
je 0x53f624
push eax
call fcn.00532d7a
push dword [0x5ef474]
mov esi, eax
call fcn.00532d7a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x53f624
test edi, edi
je 0x53f624
call esi
test eax, eax
je 0x53f61b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x53f61b
test byte [ebp - 0xc], 1
jne 0x53f624
or dword [ebp + 0x10], 0x200000
jmp 0x53f65d
mov eax, dword [0x5ef468]
cmp eax, ebx
je 0x53f65d
push eax
call fcn.00532d7a
pop ecx
test eax, eax
je 0x53f65d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x53f65d
mov eax, dword [0x5ef46c]
cmp eax, ebx
je 0x53f65d
push eax
call fcn.00532d7a
pop ecx
test eax, eax
je 0x53f65d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5ef464]
call fcn.00532d7a
pop ecx
test eax, eax
je 0x53f67d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x53f67f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x548130
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
xor esi, esi
mov edx, 0x5f1f60
mov eax, esi
mov ecx, 8
mov edi, eax
and edi, 1
dec edi
not edi
and edi, 0xedb88320
shr eax, 1
xor eax, edi
dec ecx
jne 0x548140
mov dword [edx], eax
add edx, 4
inc esi
cmp edx, 0x5f2360
jl 0x548139
cmp esi, 0x800
jae 0x54819a
lea ecx, [esi*4 + 0x5f1f60]
mov eax, dword [ecx - 0x400]
add ecx, 4
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x5f1f60]
xor edx, eax
cmp ecx, 0x5f3f60
mov dword [ecx - 4], edx
jl 0x548172
mov dword [0x5ef4c4], fcn.00548c40
call fcn.00548e20
pop edi
pop esi
test eax, eax
jne 0x5481b9
mov dword [0x5ef4c4], 0x548cf0
ret
Function at 0x54b3f0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x54b442
mov eax, dword [esp]
cmp al, 2
jne 0x54b43c
shr eax, 8
cmp al, 2
jne 0x54b43c
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.005273c3
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.005273c3
add esp, 0x194
ret

Function at 0x54b590
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], esi
lea ecx, [ecx]
test esi, esi
jne 0x54b6bd
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x18], esi
call fcn.00558b00
mov ecx, dword [eax + 0xc]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov ebp, dword [eax + 8]
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x1c]
push edx
push 0x3e8
push esi
push esi
push eax
mov dword [esp + 0x40], ecx
call fcn.00557540
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x54b6bd
cmp dword [esp + 0x18], esi
jne 0x54b676
lea ecx, [esp + 0x3c]
push ecx
call fcn.00558b00
mov edx, dword [esp + 0x2c]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], edx
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
call fcn.00558b40
add esp, 0x20
cmp edx, esi
jg 0x54b676
jl 0x54b63e
cmp eax, 0xa
ja 0x54b676
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 2
mov dword [esp + 0x10], eax
jle 0x54b67a
cmp eax, 0xa
jge 0x54b666
lea ecx, [eax - 1]
mov eax, 1
shl eax, cl
push eax
call fcn.0054f520
add esp, 4
jmp 0x54b67a
mov eax, 0x3e8
push eax
call fcn.0054f520
add esp, 4
jmp 0x54b67a
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.005589c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x54b6bd
cmp dword [esp + 0x14], eax
jne 0x54b5a0
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.005565c0
add esp, 8
test eax, eax
je 0x54b5a0
mov eax, dword [eax + 8]
test esi, esi
je 0x54b6cc
sub esi, 3
neg esi
sbb esi, esi
and esi, 0x10
add esi, 0x1b
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x558e60
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x558e92
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x558fc0
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, eax
cmp dword [esi + 0x1e0], ebx
je 0x559004
push 1
push esi
call fcn.00557200
mov eax, dword [esi + 0x16c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x1e0]
push eax
push ebp
push ecx
push edi
push esi
call edx
push ebx
push esi
mov edi, eax
call fcn.00557200
add esp, 0x24
mov eax, edi
pop edi
pop ebp
pop ebx
ret
test edi, edi
jl 0x55903c
cmp edi, 2
jg 0x55903c
mov eax, dword [esi + 0x168]
push eax
push 1
lea ecx, [edi + edi*2 + 0x593090]
push 2
push ecx
call fcn.0052cdaa
mov edx, dword [esi + 0x168]
mov eax, dword [esp + 0x20]
push edx
push 1
push ebp
push eax
call fcn.0052cdaa
add esp, 0x20
pop edi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x559620
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [ebx + 0x330]
push ebp
mov ebp, dword [ebx + eax*4 + 0x1a8]
push esi
lea esi, [eax + 0x1d]
shl esi, 4
add esi, ebx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [ecx + 0x40], 3
je 0x5596bf
cmp dword [ebx + eax*4 + 0x1c0], 0x559390
jne 0x5596bf
cmp dword [esi], 0
je 0x55965a
test edi, edi
je 0x5596bf
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.0054f550
add esp, 0x14
cmp eax, 0xffffffff
je 0x5596bf
test al, 1
je 0x5596bf
cmp dword [esi], 0
jne 0x5596a1
mov edx, dword [ebx]
mov eax, dword [edx + 0x500]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x5eb614]
mov edi, dword [esi + 4]
xor ecx, ecx
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
cmp eax, ecx
je 0x5596bc
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x5596bf
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
ret
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebp
ret
Function at 0x5596d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [ebx + eax*4 + 0x1a8]
push edi
call fcn.00559620
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [esp + 0x20]
mov esi, eax
mov dword [edi], 0
cmp esi, 0xffffffff
jne 0x559752
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x559729
pop ebp
mov dword [edi], 0x51
pop edi
pop esi
xor eax, eax
pop ebx
ret
push ebp
push ebx
call fcn.005610a0
mov edx, dword [ebx]
push eax
push str.Send_failure:__s
push edx
call fcn.005591d0
mov eax, dword [ebx]
mov dword [eax + 0x4964], ebp
add esp, 0x14
mov dword [edi], 0x37
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x55d3a0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x6e8], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x55d3de
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00559140
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x6ec]
push edx
mov dword [esp + 0xc], 1
call fcn.0055b980
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x6f0]
push eax
call fcn.0055b980
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x55d457
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00559140
add esp, 0x10
add esp, 0x14
ret
Function at 0x55dae0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x108
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
cmp dword [ebx + 0x94], 2
push ebp
mov ebp, dword [ebx]
je 0x55dc6f
cmp dword [ebx + 0x288], 0
push esi
push edi
jne 0x55dc64
cmp dword [ebx + 0x2f8], 0
jne 0x55dc64
mov esi, dword [esp + 0x120]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x98]
push ecx
mov edi, 0x80
push esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x55db74
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.005610a0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebp
call fcn.005591d0
add esp, 0x18
jmp 0x55dc6d
push edi
lea edx, [esp + 0x18]
push 0
push edx
mov dword [esp + 0x1c], edi
call fcn.0052e300
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x55dbc1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.005610a0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebp
call fcn.005591d0
add esp, 0x18
jmp 0x55dc6d
lea edx, [ebx + 0x138]
push edx
lea esi, [ebx + 0x10a]
lea eax, [esp + 0x98]
push esi
push eax
call fcn.0055da80
add esp, 0xc
test eax, eax
jne 0x55dc0e
call fcn.0052fb30
mov esi, eax
call fcn.0052fb30
mov ecx, dword [esi]
push ecx
push ebx
mov edi, eax
call fcn.005610a0
mov edx, dword [edi]
push eax
push edx
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.005591d0
add esp, 0x18
jmp 0x55dc6d
lea edi, [ebx + 0x60]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x16c]
push eax
lea ecx, [ebx + 0x13c]
push ecx
lea edx, [esp + 0x1c]
push edx
movsw word es:[edi], word [esi]
call fcn.0055da80
add esp, 0xc
test eax, eax
jne 0x55dc64
call fcn.0052fb30
mov esi, eax
call fcn.0052fb30
mov edi, eax
mov eax, dword [esi]
push eax
push ebx
call fcn.005610a0
mov ecx, dword [edi]
push eax
push ecx
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.005591d0
add esp, 0x18
jmp 0x55dc6d
push ebx
call fcn.0055da00
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x10c]
pop ebp
pop ebx
xor ecx, esp
call fcn.005273c3
add esp, 0x108
ret

Function at 0x55dc90
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x55dcd9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.005610a0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00559140
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00559140
add esp, 8
pop edi
pop esi
ret
Function at 0x55f0e0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push ebp
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [esp + 0x20]
push edx
push eax
push ecx
mov dword [esp + 0x18], ebx
xor ebp, ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x55f291
push edi
mov edi, dword [esp + 0x14]
cmp edi, ebx
je 0x55f26f
push esi
jmp 0x55f130
cmp dword [edi + 4], 2
jne 0x55f1e8
cmp dword [edi + 0x18], ebx
je 0x55f1e8
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x55f1e8
cmp eax, 0x10
jb 0x55f1e8
push 0x20
call dword [0x5eb614]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x55f1f5
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [0x5eb614]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x55f1ff
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x55f1d5
push eax
call dword [0x5eb620]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x55f213
cmp dword [esp + 0x10], ebx
jne 0x55f1df
mov dword [esp + 0x10], esi
cmp ebp, ebx
je 0x55f1e6
mov dword [ebp + 0x1c], esi
mov ebp, esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x55f130
jmp 0x55f22f
mov dword [esp + 0x14], 8
jmp 0x55f22f
push esi
mov dword [esp + 0x18], 8
call dword [0x5eb618]
add esp, 4
jmp 0x55f22f
mov edx, dword [esi + 0x18]
push edx
mov dword [esp + 0x18], 8
call dword [0x5eb618]
push esi
call dword [0x5eb618]
add esp, 8
mov eax, dword [esp + 0x18]
pop esi
cmp eax, ebx
je 0x55f23f
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [esp + 0x10], ebx
je 0x55f269
mov eax, dword [esp + 0xc]
push eax
call fcn.0055f0a0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
mov ecx, ebx
pop ebp
mov dword [esp + 4], ebx
mov dword [edx], ecx
pop ebx
add esp, 0xc
ret
cmp dword [esp + 0xc], ebx
jne 0x55f282
push 0x2af9
mov dword [esp + 0x14], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov dword [edx], ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x560910
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.0052e132
add esp, 0x18
test eax, eax
je 0x560933
cmp eax, 0xffffffff
jne 0x560935
xor eax, eax
ret
Function at 0x568a30
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x592e70
push ecx
call fcn.00559140
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.00567b80
test eax, eax
jne 0x568a60
mov eax, esi
jmp fcn.00568020
ret
Function at 0x56abb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x1a8]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x56abf4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.005591d0
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.0056aab0
add esp, 4
pop esi
pop ecx
ret
Function at 0x56b520
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x90c
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x908], eax
push ebx
push ebp
push esi
push edi
push 0x7f
lea eax, [esp + 0x9d]
mov ebx, ecx
push 0
push eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0xa4], 0
call fcn.0052e300
push 0x7f
lea ecx, [esp + 0x29]
push 0
push ecx
mov byte [esp + 0x30], 0
call fcn.0052e300
mov ebp, dword [ebx]
mov edi, dword [ebp + 0x164]
mov edx, dword [edi + 0x1eb4]
sub edx, dword [edi + 0x1eb0]
lea eax, [edi + 0x1cb0]
add edx, 2
push edx
push 0x3c
mov esi, ebp
mov dword [esp + 0x30], ebp
call fcn.0056af40
mov eax, dword [edi + 0x1eb0]
movzx ecx, byte [eax]
inc eax
add esp, 0x20
mov dword [edi + 0x1eb0], eax
cmp ecx, 0x18
je 0x56b708
cmp ecx, 0x23
je 0x56b6e2
cmp ecx, 0x27
jne 0x56b79a
push 0
push ecx
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [esp + 0x12c]
push 0x800
push eax
call fcn.0055fda0
mov esi, dword [edi + 0x1cac]
add esp, 0x1c
mov ebp, 4
test esi, esi
je 0x56b676
lea esp, [esp]
mov ebx, dword [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x56b607
sub eax, edx
lea edi, [eax + ebp + 1]
cmp edi, 0x7fa
jae 0x56b66b
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x9c]
push edx
push str._127_____127s
push ebx
call fcn.0052ae0f
add esp, 0x10
test eax, eax
je 0x56b66b
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0xa0]
push ecx
push 0
mov edx, 0x800
push str._c_s_c_s
sub edx, ebp
push edx
lea eax, [esp + ebp + 0x130]
push eax
call fcn.0055fda0
add esp, 0x1c
mov ebp, edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x56b600
mov ebx, dword [esp + 0x14]
push 0xf0
push 0xff
mov ecx, 0x800
push 0x5967b8
sub ecx, ebp
push ecx
lea edx, [esp + ebp + 0x128]
push edx
call fcn.0055fda0
mov ecx, dword [ebx + 0x1a8]
add esp, 0x14
push 0
add ebp, 2
push ebp
lea eax, [esp + 0x120]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x56b6d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push edx
call fcn.005591d0
add esp, 0xc
mov esi, dword [esp + 0x10]
add ebp, 0xfffffffe
push ebp
jmp 0x56b789
lea ecx, [edi + 0x1c28]
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x56b6f0
push 0xf0
push 0xff
push ecx
push 0
push 0x23
jmp 0x56b729
lea ecx, [edi + 0x1c08]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x56b713
push 0xf0
push 0xff
push ecx
push 0
push 0x18
push 0xfa
push 0xff
sub eax, esi
push str._c_c_c_c_s_c_c
lea edi, [eax + 6]
lea eax, [esp + 0x138]
push 0x800
push eax
call fcn.0055fda0
mov edx, dword [ebx + 0x1a8]
add esp, 0x28
push 0
push edi
lea ecx, [esp + 0x120]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x56b783
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebp
call fcn.005591d0
add esp, 0xc
add edi, 0xfffffffe
mov esi, ebp
push edi
push 0x3e
lea eax, [esp + 0x122]
call fcn.0056af40
add esp, 8
mov ecx, dword [esp + 0x918]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005273c3
add esp, 0x90c
ret
Function at 0x56b980
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebp
mov ebp, dword [eax + 0x164]
mov dword [esp + 4], eax
jne 0x56bad9
push ebx
push esi
push edi
lea ebx, [ebp + 0x1cb0]
lea edi, [ebp + 0x1eb0]
mov dword [edi], ebx
cmp ebx, edi
jae 0x56b9b7
mov byte [ebx], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x56b9c2
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x56b9cd
mov byte [eax], 0x1f
inc dword [edi]
movzx ecx, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push ecx
call esi
movzx edx, ax
movzx eax, word [ebp + 0x1caa]
push eax
mov dword [esp + 0x20], edx
call esi
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x56b9ff
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x56ba0d
mov dl, byte [esp + 0x1d]
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x56ba17
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x56ba21
mov byte [eax], ch
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x56ba2c
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x56ba37
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
mov esi, dword [esp + 0x10]
mov ecx, eax
sub ecx, ebx
sub ecx, 2
push ecx
mov dword [ebp + 0x1eb4], eax
lea eax, [ebp + 0x1cb2]
push 0x3e
mov dword [edi], ebx
call fcn.0056af40
mov edi, dword [esp + 0x20]
mov edx, dword [edi + 0x1a8]
add esp, 8
push 0
push 3
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push edx
call ebx
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jge 0x56ba94
call esi
push eax
mov eax, dword [esp + 0x14]
push str.Sending_data_failed___d_
push eax
call fcn.005591d0
add esp, 0xc
lea ecx, [ebp + 0x1cb3]
push ecx
push edi
mov eax, 4
call fcn.0056b7c0
mov edx, dword [edi + 0x1a8]
add esp, 8
push 0
push 2
add ebp, 0x1cb7
push ebp
push edx
call ebx
test eax, eax
jge 0x56bad6
call esi
push eax
mov eax, dword [esp + 0x14]
push str.Sending_data_failed___d_
push eax
call fcn.005591d0
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret
Function at 0x56c590
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebp, dword [esi + 0x1ac]
mov edi, dword [esi]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebp
or ebx, 0xffffffff
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x56c5e7
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push ebp
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
push ebp
push esi
call fcn.0055de70
add esp, 8
cmp ebx, 0xffffffff
jne 0x56c61c
push str.Error_accept__ing_server_connect
push edi
call fcn.005591d0
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1e
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005273c3
add esp, 0x18
ret
push str.Connection_accepted_from_server_n
push edi
call fcn.00559140
push 1
push ebx
mov dword [esi + 0x2b0], 0
mov dword [esi + 0x1ac], ebx
call fcn.0057dfc0
add esp, 0x10
mov dword [esi + 0x1bc], 1
cmp dword [edi + 0x1e8], 0
je 0x56c69d
push 1
push edi
call fcn.00557200
mov ecx, dword [edi + 0x1ec]
mov edx, dword [edi + 0x1e8]
push 1
push ebx
push ecx
call edx
push 0
push edi
mov ebx, eax
call fcn.00557200
add esp, 0x1c
test ebx, ebx
je 0x56c69d
call fcn.0056c4c0
pop edi
pop esi
pop ebp
mov eax, 0x2a
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005273c3
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005273c3
add esp, 0x18
ret
Function at 0x56fc60
Capabilities:
Check http status code

Disassembly:
push ebx
mov ebx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebp
mov ebp, dword [esp + 0xc]
mov eax, edx
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
push edi
mov edi, dword [ebx]
cmp eax, 2
je 0x56fc9a
push str.Couldnt_set_desired_mode
push edi
call fcn.005591d0
add esp, 8
pop edi
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x56fcb1
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edi
call fcn.00559140
add esp, 0xc
cmp ebp, 0x13
jne 0x56fcc6
push ebx
call fcn.0056fbf0
add esp, 4
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x56fcd7
call fcn.0056d080
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x56fcea
mov eax, ebx
call fcn.0056fc40
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x56fcf8
mov eax, ebx
call fcn.0056fc50
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret