joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5823e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
cmp dword [ebp + 0xdc], 0
je 0x582615
push ebx
push esi
lea ebx, [esp + 0xc]
mov esi, ebp
call fcn.005803b0
push edi
cmp dword [ebp + 0xdc], 0
je 0x582612
mov eax, dword [ebp + 0xd8]
mov ebx, dword [eax]
test ebx, ebx
je 0x582612
mov eax, dword [ebx + 0x38]
mov esi, dword [esp + 0x10]
cmp eax, esi
jne 0x582439
mov ecx, dword [ebx + 0x3c]
xor eax, eax
cmp ecx, dword [esp + 0x14]
setg al
jmp 0x582442
xor edx, edx
cmp eax, esi
setg dl
mov eax, edx
test eax, eax
jne 0x582612
cmp dword [0x62a2a4], eax
je 0x58246a
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [ebx + 0x1c]
cdq
push edx
push eax
push ebx
push str.event_del:__p__fd__I64d___callback__p
call fcn.00596cf0
add esp, 0x14
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x5825e5
cmp dword [eax + 0x14c], 0
je 0x582483
call fcn.005963f0
test byte [ebx + 8], 0x40
jne 0x5825e5
test byte [ebx + 0x34], 8
mov edi, dword [ebx + 0x20]
je 0x5824a9
cmp word [ebx + 0x2c], 0
je 0x5824a9
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x5824a9
xor ecx, ecx
mov word [eax], cx
test byte [ebx + 8], 1
je 0x5824b6
mov esi, ebx
call fcn.00581be0
movzx eax, word [ebx + 8]
test al, 8
je 0x5824c7
mov esi, ebx
call fcn.00580e40
jmp 0x5824d2
test al, 0x20
je 0x5824d2
mov esi, ebx
call fcn.00580ea0
test byte [ebx + 8], 2
je 0x58253c
cmp dword [edi + 0x14c], 0
je 0x5824e6
call fcn.005963f0
movsx edx, word [ebx + 8]
sar edx, 4
not edx
and edx, 1
sub dword [edi + 0x78], edx
and word [ebx + 8], 0xfffd
test byte [ebx + 0x34], 0x86
push ebx
je 0x58250d
mov eax, dword [ebx + 0x1c]
push eax
push edi
call fcn.005977b0
jmp 0x582517
mov ecx, dword [ebx + 0x1c]
push ecx
push edi
call fcn.00597a20
add esp, 0xc
cmp eax, 1
jne 0x58253c
cmp dword [edi + 0x98], 0
je 0x58253c
call fcn.00596310
cmp dword [edi + 0x148], eax
je 0x58253c
mov esi, edi
call fcn.00580d10
cmp dword [0x62a1ec], 0
je 0x5825db
mov esi, dword [0x62a1f8]
test esi, esi
je 0x582564
push esi
push 0
call fcn.00596370
mov esi, dword [0x62a1f8]
add esp, 8
mov ecx, dword [0x621a98]
test ecx, ecx
je 0x58259e
mov eax, ebx
shr eax, 6
xor edx, edx
div dword [0x621a9c]
mov eax, dword [ecx + edx*4]
lea ecx, [ecx + edx*4]
test eax, eax
je 0x582592
cmp dword [eax + 4], ebx
je 0x582592
mov ecx, eax
mov eax, dword [ecx]
test eax, eax
jne 0x582585
mov ecx, dword [ecx]
test ecx, ecx
je 0x58259e
and dword [ecx + 8], 0xfffffffe
jmp 0x5825cc
movsx edx, word [ebx + 8]
mov eax, dword [ebx + 0x1c]
push edx
cdq
push edx
push eax
movsx eax, word [ebx + 0x34]
push eax
push ebx
push str.event_del_nolock_
push str._s:_noting_a_del_on_a_non_setup_event__p__events:_0x_x__fd:__I64d__flags:_0x_x_
push 0xdeaddead
call fcn.00596c60
mov esi, dword [0x62a1f8]
add esp, 0x20
test esi, esi
je 0x5825db
push esi
push 0
call fcn.00596380
add esp, 8
mov dword [0x62a1f4], 1
cmp dword [0x62a2a4], 0
je 0x582600
mov ecx, dword [ebx + 0xc]
push ecx
push ebx
push str.timeout_process:_event:__p__call__p
call fcn.00596cf0
add esp, 0xc
push 1
push 1
push ebx
call fcn.00582300
add esp, 0xc
jmp 0x582403
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x587320
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x61df80]
xor eax, esp
mov dword [esp + 0x108], eax
push 0
push 0x25
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x58735e
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004c7d13
add esp, 0x10c
ret
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x587364
push esi
sub eax, edx
lea esi, [eax + 0x13]
push edi
push esi
call fcn.00581170
push str.driversetchosts
lea ecx, [esp + 0x10]
push ecx
push 0x5b1b68
mov edi, eax
push esi
push edi
call fcn.0058f070
mov ecx, dword [esp + 0x128]
add esp, 0x18
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004c7d13
add esp, 0x10c
ret

Function at 0x587c70
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [edi + 0x74]
cmp dword [eax + 0xf0], 0
je 0x587c81
call fcn.005963f0
cmp dword [esi + 0x128], 1
jne 0x587cb1
mov ecx, dword [edi + 0x74]
cmp dword [ecx + 0xf4], 0
je 0x587cb1
lea edx, [esi + 0x94]
push 0
push edx
call fcn.005840c0
add esp, 8
test eax, eax
jge 0x587cb1
mov eax, 1
ret
mov eax, dword [esi + 0x88]
mov edx, dword [edi + 8]
push eax
mov eax, dword [edi]
lea ecx, [esi + 8]
push ecx
mov ecx, dword [esi]
push 0
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x587d05
mov edx, dword [esi]
push edx
call fcn.0058db60
add esp, 4
cmp eax, 0x2733
je 0x587cab
cmp eax, 0x2714
je 0x587cab
push eax
call fcn.00590230
mov ecx, dword [edi + 0x1c]
push ecx
mov ecx, eax
call fcn.005879a0
add esp, 8
mov eax, 2
ret
xor edx, edx
cmp eax, dword [edi + 8]
setne dl
mov eax, edx
ret

Function at 0x589790
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
cmp dword [eax + 0xf0], esi
je 0x5897b9
call fcn.005963f0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push esi
push ebx
push ebp
call edi
cmp eax, 0xea
je 0x5897e0
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0xc]
push eax
call fcn.00581170
mov esi, eax
add esp, 4
test esi, esi
je 0x5897d6
lea ecx, [esp + 0xc]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push 0
push ebx
push ebp
call edi
test eax, eax
jne 0x589832
cmp dword [esp + 0xc], 1
jbe 0x589832
mov eax, dword [esp + 0x1c]
push eax
mov eax, esi
call fcn.005894e0
add esp, 4
push esi
mov edi, eax
call fcn.00581290
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
mov edi, dword [esp + 0x14]
push esi
call fcn.00581290
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x58bfd0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x84
push ebx
push esi
mov esi, dword [eax]
push edi
mov ebx, ecx
xor edi, edi
test ebx, ebx
jge 0x58bff0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret
cmp dword [eax + 0x18], edi
je 0x58bffa
call fcn.005963f0
test esi, esi
je 0x58c034
mov edi, edi
cmp edi, 0x10
jge 0x58c030
test ebx, ebx
je 0x58c030
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 8]
mov dword [esp + edi*8 + 0x14], eax
cmp ebx, dword [esi + 0x10]
jb 0x58c02b
mov ecx, dword [esi + 0x10]
mov dword [esp + edi*8 + 0x10], ecx
sub ebx, dword [esi + 0x10]
mov esi, dword [esi]
inc edi
test esi, esi
jne 0x58c000
jmp 0x58c030
mov dword [esp + edi*8 + 0x10], ebx
inc edi
test edi, edi
jne 0x58c040
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret
mov ecx, dword [esp + 0x94]
push 0
push 0
push 0
lea edx, [esp + 0x18]
push edx
push edi
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x58bfe3
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x84
ret

Function at 0x58d980
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, eax
sub esp, 0x40
mov dword [ecx], eax
mov dword [edx], eax
cmp dword [esp + 0x50], eax
je 0x58d99c
mov eax, 0x8000
push ebp
push 0
push eax
mov eax, dword [esp + 0x50]
push eax
call fcn.004df151
mov ebp, eax
add esp, 0xc
test ebp, ebp
jge 0x58d9bb
or eax, 0xffffffff
pop ebp
add esp, 0x40
ret
lea ecx, [esp + 0xc]
push ecx
push ebp
call fcn.0059ac1b
add esp, 8
test eax, eax
jne 0x58da96
cmp dword [esp + 0x28], eax
ja 0x58da96
mov eax, dword [esp + 0x24]
jb 0x58d9ec
cmp eax, 0x7ffffffe
ja 0x58da96
inc eax
push ebx
push eax
call fcn.00581170
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x58da0f
push ebp
call fcn.004d7ca5
add esp, 4
lea eax, [ebx - 2]
pop ebx
pop ebp
add esp, 0x40
ret
mov eax, dword [esp + 0x28]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x34]
xor edx, edx
mov ecx, eax
sub ecx, esi
sbb edi, edx
mov dword [esp + 0x14], edi
js 0x58da3a
jg 0x58da33
cmp ecx, 0x7fffffff
jbe 0x58da3a
mov eax, closesocket
jmp 0x58da3c
sub eax, esi
push eax
lea eax, [ebx + esi]
push eax
push ebp
call fcn.004d6dc5
mov edi, eax
add esp, 0xc
test edi, edi
jle 0x58da5a
mov eax, dword [esp + 0x30]
add esi, edi
cmp esi, eax
jb 0x58da17
push ebp
call fcn.004d7ca5
add esp, 4
test edi, edi
pop edi
jge 0x58da7d
push ebx
call fcn.00581290
add esp, 4
pop esi
pop ebx
mov eax, 0xfffffffe
pop ebp
add esp, 0x40
ret
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x54]
mov byte [ebx + esi], 0
mov dword [ecx], esi
pop esi
mov dword [edx], ebx
pop ebx
xor eax, eax
pop ebp
add esp, 0x40
ret
push ebp
call fcn.004d7ca5
add esp, 4
mov eax, 0xfffffffe
pop ebp
add esp, 0x40
ret
Function at 0x58dab0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x58dae9
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.00596c30
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x58daf0
Capabilities:
Set socket configuration

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x8004667e
push esi
mov dword [esp + 0xc], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x58db22
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.00596c30
add esp, 0xc
or eax, 0xffffffff
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x58dbc0
Capabilities:
Connect socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
cmp dword [esi], edi
jge 0x58dbf6
movzx eax, word [ebx]
push edi
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
test eax, eax
jl 0x58dc53
push eax
mov edi, 1
call fcn.0058dab0
add esp, 4
test eax, eax
jl 0x58dc44
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
push ecx
push ebx
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jge 0x58dc60
mov eax, dword [esi]
push eax
call fcn.0058db60
add esp, 4
cmp eax, 0x2733
je 0x58dc5a
cmp eax, 0x2714
je 0x58dc5a
cmp eax, 0x2734
je 0x58dc5a
cmp eax, 0x2726
je 0x58dc5a
cmp eax, 0x274d
jne 0x58dc40
pop edi
pop esi
mov eax, 2
pop ebx
ret
test edi, edi
je 0x58dc53
mov ecx, dword [esi]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x58df50
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x2c
push ebx
xor eax, eax
push ebp
push esi
mov esi, dword [sym.imp.WS2_32.dll_getaddrinfo]
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
xor edi, edi
push 0x5dc23c
push str.1.2.3.4
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], 0xc
call esi
lea edx, [esp + 0x10]
push edx
mov ebx, eax
lea eax, [esp + 0x20]
push eax
push edi
push str.1.2.3.4
call esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x5dc23c
mov ebp, 1
push str.1.2.3.4
mov dword [esp + 0x34], ebp
call esi
test eax, eax
jne 0x58dff0
cmp ebx, edi
je 0x58dff0
mov dword [0x62a220], ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, ecx
cmp ecx, edi
je 0x58e020
mov edi, edi
cmp dword [eax + 0xc], edi
jne 0x58e00e
mov eax, dword [eax + 0x1c]
cmp eax, edi
jne 0x58e000
jmp 0x58e020
mov eax, edx
cmp edx, edi
je 0x58e020
cmp dword [eax + 0xc], edi
jne 0x58e026
mov eax, dword [eax + 0x1c]
cmp eax, edi
jne 0x58e014
mov dword [0x62a224], ebp
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp eax, edi
je 0x58e03f
push eax
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
cmp ecx, edi
je 0x58e04a
push ecx
call esi
mov edx, dword [esp + 0x10]
cmp edx, edi
je 0x58e051
push edx
call esi
pop edi
pop esi
mov dword [0x62a228], ebp
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x58e350
Capabilities:
Hash data using murmur3

Disassembly:
push edi
mov edi, dword [ebx]
test edi, edi
jne 0x58e35b
xor eax, eax
pop edi
ret
mov eax, dword [esp + 8]
push esi
mov esi, dword [eax + 4]
mov eax, esi
shr eax, 0x10
xor eax, esi
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
xor edx, edx
div dword [ebx + 4]
mov ecx, dword [edi + edx*4]
lea eax, [edi + edx*4]
test ecx, ecx
je 0x58e3a0
cmp dword [ecx + 4], esi
je 0x58e3a0
mov eax, ecx
mov ecx, dword [eax]
test ecx, ecx
jne 0x58e393
pop esi
pop edi
ret
Function at 0x58ea70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x61df80]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
push esi
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x58eb20
mov ecx, ebx
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x58eaa6
sub ecx, esi
lea ecx, [ecx + eax + 2]
cmp ecx, 0x104
jae 0x58eb20
push edi
lea edi, [esp + 0xc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x58eac1
mov dx, word [0x5b1fe8]
mov eax, ebx
mov word [edi], dx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x58ead7
lea edi, [esp + 0xc]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x58eae7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004c7d13
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004c7d13
add esp, 0x108
ret

Function at 0x58eb40
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
push eax
mov ecx, edi
and ecx, 0x7bffffff
push ecx
push edx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
jl 0x58eba1
test edi, 0x4000000
je 0x58eba7
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x58eba7
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.00596c30
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x58f010
Capabilities:
Hash data using murmur3

Disassembly:
cmp dword [esi], 0
je 0x58f01d
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jb 0x58f02b
mov ecx, dword [esi + 8]
inc ecx
push ecx
push esi
call fcn.0058e3b0
add esp, 8
inc dword [esi + 8]
mov ecx, dword [edi + 4]
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
mov ecx, dword [eax + edx*4]
mov dword [edi], ecx
mov dword [eax + edx*4], edi
lea eax, [eax + edx*4]
ret

Function at 0x590060
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
xor ebx, ebx
push edi
mov dword [esp + 0x10], 0xffffffff
cmp esi, ebx
je 0x590086
mov ecx, 8
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
jmp 0x5900ac
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
lea eax, [esp + 0x40]
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
push esi
push ebp
call fcn.0058fb60
add esp, 0x14
cmp eax, ebx
je 0x5901ca
cmp eax, 8
je 0x5901ca
cmp eax, 0x2af9
je 0x5901ca
cmp dword [0x62a228], ebx
jne 0x5900f6
call fcn.0058df50
cmp dword [0x62a220], ebx
je 0x59013d
cmp esi, ebx
je 0x59013d
cmp dword [esp + 0x1c], ebx
jne 0x59013d
call fcn.0058de60
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x59013d
mov ebx, 1
test ebp, ebp
jne 0x59013b
lea edx, [esp + 0x10]
push edx
push edi
lea eax, [esp + 0x1c]
push eax
push esi
push ebp
call fcn.0058fb60
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
xor esi, esi
cmp dword [0x62a228], 0
jne 0x59014b
call fcn.0058df50
cmp dword [0x62a224], 0
je 0x59015d
lea eax, [esp + 0x14]
call fcn.0058df00
and dword [esp + 0x14], 0x7fffffff
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test ebx, ebx
je 0x590188
mov edx, dword [esp + 0x10]
push edx
mov eax, edi
call fcn.0058e060
add esp, 4
cmp dword [0x62a228], 0
jne 0x590196
call fcn.0058df50
cmp dword [0x62a224], 0
je 0x5901c8
mov eax, dword [edi]
call fcn.0058e0d0
test eax, eax
jge 0x5901c8
mov eax, dword [edi]
push eax
call fcn.0058e190
add esp, 4
mov dword [edi], 0
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x24
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x590330
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push esi
push 0
push 1
push 2
call fcn.0058ebf0
add esp, 0x10
test eax, eax
jne 0x5903be
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
push edi
mov edi, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push edi
mov dword [esp + 0x18], 1
call ebx
cmp eax, 0xffffffff
jne 0x59039a
push edi
push str.fcntl__d__F_GETFL_
push edi
call fcn.00596c30
mov edx, dword [esi]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
add esp, 0xc
push edx
call edi
mov eax, dword [esi + 4]
push eax
call edi
pop edi
or eax, 0xffffffff
pop ebx
mov dword [esi + 4], eax
mov dword [esi], eax
pop esi
pop ecx
ret
mov edi, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edi
mov dword [esp + 0x18], 1
call ebx
cmp eax, 0xffffffff
je 0x59036d
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret
or eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi], eax
pop esi
pop ecx
ret

Function at 0x5916d0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov dword [esp + 8], 1
test edi, edi
je 0x5916e6
mov eax, dword [edi + 4]
jmp 0x5916eb
mov eax, 2
push 0
push 0x84000001
push eax
call fcn.0058eb40
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x591716
push str.socket
push eax
call fcn.00596c30
add esp, 8
pop edi
or eax, esi
pop esi
pop ecx
ret
push 4
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jl 0x59175b
cmp dword [esp + 0x10], 0
je 0x591743
push esi
call fcn.0058db30
add esp, 4
test eax, eax
jl 0x59175b
test edi, edi
je 0x59177a
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 0x18]
push ecx
push edx
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x59177a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
mov edi, eax
call fcn.0058db40
add esp, 4
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ecx
ret

Function at 0x591860
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x5918e1
test ax, ax
jne 0x5918e1
push 0
push 0x84000001
push 2
mov dword [esp + 0x14], 1
call fcn.0058eb40
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x5918a3
push str.socket
push eax
call fcn.00596c30
add esp, 8
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret
push 4
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x5918db
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
mov edi, eax
call fcn.0058db40
add esp, 4
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ecx
ret
push eax
call fcn.00591780
mov esi, eax
add esp, 4
test esi, esi
je 0x59189c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005916d0
push esi
mov edi, eax
call fcn.0058e190
add esp, 8
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x5953e0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push edi
call fcn.00597030
mov ebx, eax
movzx eax, byte [esi + 0x51]
push 0
push 1
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov eax, dword [esi + 0x4c]
test byte [eax + 0x20], 1
jne 0x595412
pop edi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
cmp edi, 0xffffffff
jne 0x595423
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x5954be
push 4
add eax, 0x24
push eax
push 0x700b
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esi + 0x4c]
test byte [ecx + 0x14], 1
jne 0x59544c
push edi
call fcn.0058dab0
add esp, 4
mov edx, dword [esi + 0x4c]
mov eax, dword [edx + 0x2c]
push 1
push edi
push eax
call fcn.00596e50
add esp, 0xc
test eax, eax
jge 0x595471
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebp
pop edi
or eax, 0xffffffff
pop ebx
pop ecx
ret
movzx eax, byte [esi + 0x50]
lea ebp, [esi + 0x18]
push ebp
shr eax, 1
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
mov eax, dword [esi + 0x4c]
push 0
lea edx, [esi + 0x58]
push edx
mov dword [esi + 0x30], edi
mov ecx, dword [eax + 0x24]
mov edx, dword [ebx]
push edi
push ecx
call edx
test eax, eax
je 0x5954b1
push 1
push 0
push 1
push ebp
call fcn.005951e0
add esp, 0x10
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x5954d4
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x34], eax
mov edx, dword [ecx + 0x28]
lea eax, [esi + 0x38]
push eax
push edx
call fcn.00581b40
add esp, 8
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret