joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50a590
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push 0x44
lea eax, [esp + 0x14]
push 0
push eax
call fcn.006e1410
add esp, 0xc
lea eax, [esp]
xorps xmm0, xmm0
movups xmmword [esp], xmm0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x78]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
add esp, 0x54
ret

Function at 0x50a640
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
cmp dword [esp + 0x14], 0
mov eax, dword [esp + 8]
push ebx
push ebp
mov bh, byte [eax]
lea ebp, [eax + 2]
mov cl, byte [eax + 1]
jbe 0x50a6ac
push esi
push edi
mov edi, dword [esp + 0x20]
mov al, cl
sub dword [esp + 0x1c], edi
inc bh
lea edi, [edi + 1]
movzx esi, bh
mov bl, byte [esi + ebp]
add al, bl
movzx edx, al
movzx ecx, byte [edx + ebp]
mov byte [esi + ebp], cl
mov byte [edx + ebp], bl
movzx ecx, byte [esi + ebp]
movzx edx, bl
add edx, ecx
movzx ecx, dl
mov edx, dword [esp + 0x1c]
movzx ecx, byte [ecx + ebp]
xor cl, byte [edx + edi - 1]
sub dword [esp + 0x24], 1
mov byte [edi - 1], cl
jne 0x50a662
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x18]
mov cl, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov byte [eax], bh
mov byte [eax + 1], cl
pop ebx
pop ecx
ret

Function at 0x50a6c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor eax, eax
mov edx, 0x100
lea esi, [edi + 2]
mov word [edi], 0
mov ecx, esi
nop word [eax + eax]
mov byte [ecx], al
lea ecx, [ecx + 1]
inc eax
cmp ax, dx
jb 0x50a6e0
mov ebp, 0xfffffffe
mov dword [esp + 0x18], 0
sub ebp, edi
mov dword [esp + 0x10], edx
nop
lea eax, [esi + ebp]
mov bl, byte [esi]
xor edx, edx
lea esi, [esi + 1]
div dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
movzx ecx, byte [edx + eax]
movzx eax, bl
add cx, ax
mov eax, 0xff
add cx, word [esp + 0x18]
and cx, ax
sub dword [esp + 0x10], 1
movzx eax, cx
movzx ecx, ax
mov dword [esp + 0x18], eax
mov al, byte [ecx + edi + 2]
mov byte [esi - 1], al
mov byte [ecx + edi + 2], bl
jne 0x50a700
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x50bcf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7186a7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7f9c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x50bd4d
lea ecx, [edi + 0x78]
mov dword [edi], 0x72c228
mov dword [edi + 0x10], 0x72c230
call fcn.004ac380
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 0x18]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004ad7c0
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [edi + eax + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0xc], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
push 8
mov dword [ebp - 4], 5
mov dword [ebp + 8], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ecx + edi - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.006debec
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x50be57
push 1
mov byte [ebp - 4], 6
call fcn.006dcea2
add esp, 4
mov dword [ebx + 4], eax
jmp 0x50be59
xor ebx, ebx
mov ecx, esi
mov dword [esi + 0x34], ebx
call fcn.00456340
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov byte [esi + 0x48], 0
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea edx, [esi + 0x14]
mov byte [esi + 0x3d], 0
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
lea ebx, [esi + 0x18]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ebx
mov dword [ecx], 0
mov dword [ebx], 0
mov dword [eax], 0
mov dword [esi + 4], 0
mov dword [edx], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x7febd0]
mov ecx, dword [0x7febd4]
mov dword [esi + 0x40], eax
mov eax, edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50e460
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x404], eax
mov eax, dword [esp + 0x40c]
push esi
mov esi, dword [esp + 0x414]
push 0x71b894
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call fcn.006ebfdf
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
je 0x50e522
push eax
push 0x400
lea eax, [esp + 0x10]
mov dword [esi + 4], 0
push 1
push eax
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
call fcn.006ec36b
add esp, 0x10
test eax, eax
je 0x50e510
push eax
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0050e3a0
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push 0x400
push 1
push eax
call fcn.006ec36b
add esp, 0x1c
test eax, eax
jne 0x50e4e8
push esi
call fcn.0050e290
push dword [esp + 8]
call fcn.006ec162
add esp, 8
mov ecx, dword [esp + 0x408]
pop esi
xor ecx, esp
call fcn.006def69
add esp, 0x408
ret
Function at 0x50fd60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x718bad
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x7f9c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x7f55c8]
cmp eax, 0xffffffff
jne 0x50fd94
xor ebx, ebx
jmp 0x50fd9d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x50fe9b
nop
cmp dword [ebx + 0x18], 0
jne 0x50fdc5
cmp dword [ebx + 0xc], 0
je 0x50fe54
mov esi, dword [ebx + 0xc]
jmp 0x50fdd0
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x50fe12
nop dword [eax]
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x50fdfb
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x50fdd0
cmp dword [ebx + 0x18], 0
je 0x50fdb6
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x50fe35
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x50fe35
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea ecx, [ebx + 0x14]
call fcn.0049f680
push 0x20
push eax
call fcn.006dec1c
add esp, 8
cmp dword [ebx + 0x18], 0
jne 0x50fe18
jmp 0x50fdb0
push 0x50f1b0
push 0x7ff3c4
call fcn.0050efc0
mov eax, dword [0x7f55c8]
add esp, 8
cmp eax, 0xffffffff
je 0x50fe79
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x50fe9b
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50feb0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x50ff10
push 0
push 0
call fcn.006ebbfa
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x50fed9
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x50fef7
cmp eax, 0xffffffff
je 0x50fef7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x5156b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
mov ebx, dword [esp + 0x70]
lea eax, [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x78]
xorps xmm0, xmm0
push esi
mov esi, dword [esp + 0x74]
mov ecx, 0x72de68
push ebp
push ebx
push eax
movups xmmword [esp + 0x5c], xmm0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
call fcn.005126f0
mov eax, dword [esp + 0x4c]
add eax, 0xffffffff
je 0x515741
cmp eax, 1
jne 0x515729
movq xmm0, qword [esp + 0x3c]
mov eax, dword [esp + 0x44]
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov dword [esi + 0x1c], 2
jmp 0x515885
xorps xmm0, xmm0
xor eax, eax
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov dword [esi + 0x1c], 2
jmp 0x515885
lea eax, [esp + 0x3c]
movups xmm0, xmmword [eax]
push edi
mov edi, dword [ebx]
mov eax, ebp
sub eax, edi
movups xmmword [esp + 0x54], xmm0
cmp eax, 3
jl 0x51580d
cmp byte [edi], 0x25
jne 0x51580d
cmp byte [edi + 1], 0x32
jne 0x51580d
cmp byte [edi + 2], 0x35
jne 0x51580d
lea eax, [edi + 3]
mov dword [ebx], eax
lea eax, [esp + 0x20]
movups xmm0, xmmword [0x72de70]
push eax
push ebp
movups xmmword [esp + 0x28], xmm0
lea eax, [esp + 0x18]
movups xmm0, xmmword [0x72de80]
push ebx
push eax
movups xmmword [esp + 0x40], xmm0
call fcn.00511810
mov eax, dword [esp + 0x2c]
add esp, 0x10
add eax, 0xffffffff
jne 0x5157e1
cmp dword [esp + 0x14], eax
je 0x5157e1
movups xmm1, xmmword [esp + 0x54]
lea eax, [esp + 0x10]
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movups xmmword [esi], xmm1
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 1
jmp 0x515884
push 0
push 5
lea ecx, [esp + 0x18]
mov dword [ebx], edi
call fcn.00510e80
mov eax, dword [esp + 0x18]
movq xmm0, qword [esp + 0x10]
test eax, eax
je 0x515876
cmp eax, 1
je 0x515876
and eax, 1
or eax, 0x72dfec
jmp 0x515876
mov ecx, dword [0x7f5600]
mov eax, dword [0x7f5604]
cmp ecx, 0x257edfd1
jne 0x515827
cmp eax, 0xb2ab117a
je 0x515836
cmp ecx, 0x257edfd0
jne 0x51583a
cmp eax, 0xb2ab117a
jne 0x51583a
mov al, 1
jmp 0x51584b
mov eax, dword [0x7f55f8]
mov ecx, 0x7f55f8
push 5
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [esp + 0x10], 5
mov ecx, eax
mov dword [esp + 0x14], 0x7f55f8
movq xmm0, qword [esp + 0x10]
cmp ecx, 1
je 0x515876
and eax, 1
or eax, 0x72de90
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov dword [esi + 0x1c], 2
pop edi
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006def69
add esp, 0x64
ret 0xc
Function at 0x51e280
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x51e32f
push esi
call fcn.00537530
add esp, 4
test al, al
jne 0x51e32f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x51e2a7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.005410b0
add esp, 0xc
test eax, eax
je 0x51e2db
sub eax, esi
push eax
push 0x2e
push esi
call fcn.005410b0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x51e2dd
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x51e30e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.00530df0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x51e2f0
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x5258c0
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x14
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x28]
mov eax, dword [eax + 4]
and eax, 0xa
cmp al, 0xa
mov eax, dword [ecx + 0xc]
jne 0x5258f7
mov esi, dword [eax + 0x78]
mov ebx, dword [eax + 0x7c]
mov ebp, dword [eax + 0x80]
jmp 0x525903
mov esi, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
mov ebp, dword [eax + 0x3cc]
test esi, esi
je 0x5259e4
mov eax, dword [edi]
test eax, eax
je 0x525940
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x525933
test dl, dl
je 0x52592f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x525933
add ecx, 2
add eax, 2
test dl, dl
jne 0x525913
xor eax, eax
jmp 0x525938
sbb eax, eax
or eax, 1
test eax, eax
je 0x5259e4
push edi
call fcn.00525870
push esi
call dword [0x7f5658]
mov edx, eax
add esp, 8
mov dword [edi], edx
test edx, edx
je 0x52599a
test ebx, ebx
je 0x5259bb
mov ecx, ebx
nop
mov al, byte [esi]
cmp al, byte [ecx]
jne 0x525980
test al, al
je 0x52597c
mov al, byte [esi + 1]
cmp al, byte [ecx + 1]
jne 0x525980
add esi, 2
add ecx, 2
test al, al
jne 0x525960
xor eax, eax
jmp 0x525985
sbb eax, eax
or eax, 1
test eax, eax
je 0x5259bb
push ebx
call dword [0x7f5658]
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jne 0x5259be
push edi
call fcn.00525870
add esp, 4
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.006def69
add esp, 0x14
ret
mov dword [edi + 4], edx
mov esi, dword [edi]
test esi, esi
je 0x525a1a
cmp byte [esi], 0
je 0x525a1a
mov ebx, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [esp + 0x10]
push eax
push esi
push 2
call ebx
test eax, eax
je 0x525a03
mov dword [edi + 0xc], 1
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006def69
add esp, 0x14
ret
lea eax, [esp + 0x10]
push eax
push esi
push 0x17
call ebx
test eax, eax
je 0x525a1a
mov dword [edi + 0xc], 2
jmp 0x5259e4
mov ecx, dword [edi]
mov dword [edi + 0xc], 0
cmp byte [ecx], 0
je 0x5259e4
mov esi, ecx
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x525a30
sub esi, edx
je 0x525a43
cmp byte [ecx + esi - 1], 0x2e
jne 0x525a43
dec esi
cmp esi, 0xffff
jae 0x5259e4
lea eax, [esi + 1]
push eax
push 1
call dword [0x7f565c]
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x52599a
push esi
push dword [edi]
push eax
call fcn.00530e50
mov eax, dword [edi + 8]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x5259e4
Function at 0x52f1e0
Capabilities:
Get common file path
Initialize winsock library
Link many functions at runtime

Disassembly:
sub esp, 0x198
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x194], eax
test byte [esp + 0x19c], 2
je 0x52f241
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x52f227
mov eax, dword [esp + 4]
cmp al, 2
jne 0x52f221
shr eax, 8
cmp al, 2
je 0x52f241
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.006def69
add esp, 0x198
ret
push ebp
push esi
push edi
push str.kernel32
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x52f268
mov dword [0x7ff4d4], esi
jmp 0x52f38b
push ebx
push str.LoadLibraryExA
push edi
call ebp
push 0x72bf08
push str.iphlpapi.dll
mov ebx, eax
call fcn.006f6b40
add esp, 8
test eax, eax
je 0x52f2b1
test ebx, ebx
je 0x52f29f
push 8
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x52f36f
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x52f36f
test ebx, ebx
je 0x52f2d6
push str.AddDllDirectory
push edi
call ebp
test eax, eax
je 0x52f2d6
push 0x800
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x52f36f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x52f36f
lea ecx, [eax + 0xd]
push ecx
call dword [0x7f564c]
mov edi, eax
add esp, 4
test edi, edi
je 0x52f365
push dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x52f365
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x52f313
sub ecx, edx
mov eax, 0x5c
mov word [ecx + edi], ax
mov ecx, edi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x52f330
sub ecx, edx
mov edx, str.iphlpapi.dll
sub ecx, edx
add ecx, edi
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x52f342
test ebx, ebx
je 0x52f35c
push 8
push 0
push edi
call ebx
jmp 0x52f363
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
call dword [0x7f5650]
add esp, 4
mov dword [0x7ff4d4], esi
pop ebx
test esi, esi
je 0x52f38b
push str.if_nametoindex
push esi
call ebp
test eax, eax
je 0x52f38b
mov dword [0x7ff4c4], eax
push 0x73059c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x52f3c3
push str.FreeAddrInfoExW
push esi
call ebp
push str.GetAddrInfoExCancel
push esi
mov dword [0x7ff4c8], eax
call ebp
push str.GetAddrInfoExW
push esi
mov dword [0x7ff4cc], eax
call ebp
mov dword [0x7ff4d0], eax
push 3
push 2
push 0
push 0
push 6
call fcn.005641b0
push 3
push 2
push 0
test al, al
push 2
push 6
setne byte [0x801a89]
call fcn.005641b0
add esp, 0x28
test al, al
setne byte [0x801a88]
push 0x801a90
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp + 0x1a0]
xor eax, eax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.006def69
add esp, 0x198
ret
Function at 0x532440
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x7ff4d8]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x532491
push 3
push 2
push eax
push eax
push 6
call fcn.005641b0
add esp, 0x14
test al, al
je 0x532485
mov dword [0x7ff4d8], 2
add esp, 0xc
ret
mov dword [0x7ff4d8], 1
jmp 0x532496
cmp eax, 2
je 0x5324dc
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x5324c1
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x5324dc
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x532fc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x104
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x100], eax
mov ecx, dword [esp + 0x10c]
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
push esi
push edi
mov eax, dword [ebx]
mov edi, dword [esp + 0x124]
push 0
push dword [esp + 0x124]
mov ebp, dword [eax + 8]
push ecx
mov dword [edi], 0
push dword [ebp + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x533060
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x53302d
mov dword [edi], 0x51
jmp 0x53305d
push 0x100
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00540440
push eax
push str.Recv_failure:__s
push dword [ebx + 4]
call fcn.0052b8c0
mov eax, dword [ebx + 4]
add esp, 0x18
mov dword [eax + 0x8d0], esi
mov dword [edi], 0x38
or esi, 0xffffffff
push dword [edi]
push esi
push dword [ebp + 0x98]
push dword [esp + 0x12c]
push str.nw_in_read_len_zu__fd_d______d__err_d
push dword [ebx]
push dword [ebx + 4]
call fcn.0052b9d0
mov ecx, dword [esp + 0x12c]
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006def69
add esp, 0x104
ret

Function at 0x5330a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x194]
push esi
mov esi, dword [eax + 8]
push edi
mov edi, dword [esi + 0x98]
cmp edi, 0xffffffff
je 0x5331d8
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x29c]
test dword [eax + 0x48], 0x800
jne 0x5331d8
push 0x80
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x80
push 0
push eax
call fcn.006e1410
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x533166
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.00540440
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.0052b8c0
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.006def69
add esp, 0x188
ret
lea eax, [esi + 0x11c]
push eax
lea eax, [esi + 0xea]
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.0052dc80
add esp, 0x10
test al, al
jne 0x5331d8
call fcn.006f5dc9
mov esi, dword [eax]
call fcn.006f5dc9
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.00540440
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0052b8c0
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.006def69
add esp, 0x188
ret
mov ecx, dword [esp + 0x190]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006def69
add esp, 0x188
ret
Function at 0x537530
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x537578
lea eax, [esp + 8]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
pop esi
setg al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.006def69
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov al, 1
pop esi
xor ecx, esp
call fcn.006def69
add esp, 0x18
ret

Function at 0x5376d0
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x53770e
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x144], 0
jne 0x5376ff
push 0
call fcn.005376d0
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x144], cl
mov eax, dword [esi + 0x7c]
pop esi
cmp byte [eax + 0x144], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x537728
xor esi, esi
test esi, esi
pop esi
setne al
ret
push eax
mov esi, 1
call dword [sym.imp.WS2_32.dll_closesocket]
test esi, esi
pop esi
setne al
ret