joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a60c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor ecx, ecx
push 0x14
mov dword [ebp - 8], edi
lea esi, [edi + 0x5c]
sub ebx, esi
pop edi
movss xmm0, dword [ebx + esi]
mulss xmm0, dword [0x730b04]
cvttss2si eax, xmm0
mov dword [esi], eax
lea esi, [esi + 4]
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
cmovge eax, ecx
mov ecx, eax
sub edi, 1
jne 0x5a60e1
test ecx, ecx
je 0x5a6117
bsr eax, ecx
mov dword [ebp + 8], eax
xor eax, 0x1f
jmp 0x5a611a
push 0x20
pop eax
mov edi, dword [ebp - 8]
mov edx, 0x10000
push 0x10
pop ebx
push 9
pop ecx
mov dword [edi + 0xac], ebx
cmp eax, ecx
jge 0x5a615c
sub ecx, eax
mov eax, ebx
sub eax, ecx
mov dword [edi + 0xac], eax
xor eax, eax
movd xmm1, ecx
movups xmm0, xmmword [edi + eax*4 + 0x5c]
psrad xmm0, xmm1
movups xmmword [edi + eax*4 + 0x5c], xmm0
add eax, 4
cmp eax, 0x14
jl 0x5a6144
sar edx, cl
mov ecx, dword [edi + 0xa4]
mov eax, dword [edi + 0x90]
sub ecx, edx
or ecx, dword [edi + 0xa0]
or ecx, dword [edi + 0x9c]
or ecx, dword [edi + 0x98]
or eax, dword [edi + 0x7c]
or ecx, dword [edi + 0xa8]
or eax, dword [edi + 0x68]
or eax, ecx
mov ebx, dword [edi + 0xac]
je 0x5a61b7
cmp ebx, 0x10
mov eax, 0x5a5aa4
mov edx, 0x5a5a2a
cmove eax, edx
mov dword [edi + 0x58], eax
xor eax, eax
test ecx, ecx
sete al
mov dword [edi + 0xb0], eax
jmp 0x5a6237
mov dword [edi + 0xb0], 3
mov ecx, dword [edi + 0x8c]
mov eax, dword [edi + 0x74]
sub ecx, edx
sub eax, edx
or ecx, eax
mov eax, dword [edi + 0x5c]
sub eax, edx
or ecx, eax
mov eax, dword [edi + 0x88]
or eax, dword [edi + 0x84]
or eax, dword [edi + 0x78]
or eax, dword [edi + 0x70]
or eax, dword [edi + 0x64]
or eax, dword [edi + 0x60]
je 0x5a61fd
mov eax, 0x5a5957
mov ecx, 0x5a58fb
jmp 0x5a6228
test ecx, ecx
je 0x5a620d
mov eax, 0x5a5b74
mov ecx, 0x5a5b35
jmp 0x5a6228
mov eax, dword [edi + 0x94]
or eax, dword [edi + 0x80]
or eax, dword [edi + 0x6c]
je 0x5a6233
mov eax, 0x5a58c5
mov ecx, 0x5a5897
cmp ebx, 0x10
cmove eax, ecx
mov dword [edi + 0x58], eax
jmp 0x5a6237
and dword [edi + 0x58], 0
cmp dword [edi + 0x58], 0
je 0x5a625a
xor eax, eax
lea ecx, [ebx - 1]
inc eax
shl eax, cl
add dword [edi + 0x6c], eax
add dword [edi + 0x80], eax
add dword [edi + 0x94], eax
add dword [edi + 0xa8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5aaa30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 8]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push esi
push edi
test ebx, ebx
je 0x5aaace
xor esi, esi
cmp dword [ebp + 0x10], esi
jle 0x5aab84
movzx edi, byte [esi + ebx]
test edi, edi
je 0x5aaac3
mov eax, dword [ebp + 8]
movzx eax, word [eax + esi*2]
push eax
call fcn.00448021
push dword [ebp - 4]
mov dword [ebp + 0x14], eax
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + esi*4]
call fcn.005aa967
add esp, 0x10
mov edx, eax
cmp edi, 0xff
jae 0x5aaa9d
mov ecx, edi
shr ecx, 7
add ecx, edi
push ecx
push dword [ebp + 0x14]
push edx
call fcn.005aa967
add esp, 0xc
mov edx, eax
mov ecx, edx
mov eax, edx
shr ecx, 8
shr eax, 5
and ecx, 0xf800
and eax, 0x7e0
shr edx, 3
or ecx, eax
and edx, 0x1f
mov eax, dword [ebp + 8]
or ecx, edx
mov word [eax + esi*2], cx
inc esi
cmp esi, dword [ebp + 0x10]
jl 0x5aaa53
jmp 0x5aab84
xor edi, edi
mov dword [ebp + 0x14], edi
cmp dword [ebp + 0x10], edi
jle 0x5aab84
mov ebx, 0x100
sub ebx, eax
mov eax, dword [ebp + 8]
movzx eax, word [eax + edi*2]
push eax
call fcn.00448021
mov esi, eax
mov eax, dword [ebp + 0xc]
pop ecx
mov edx, dword [eax + edi*4]
mov edi, esi
shr edi, 8
mov ecx, edx
shr ecx, 8
mov eax, 0xffff00ff
and ecx, eax
and edi, eax
imul ecx, dword [ebp - 4]
mov eax, edx
imul edi, ebx
and eax, 0xff00ff
imul eax, dword [ebp - 4]
shr edx, 8
add edi, ecx
mov ecx, esi
and ecx, 0xff00ff
shr esi, 8
imul ecx, ebx
add ecx, eax
mov eax, 0xff00ff
and esi, eax
shr ecx, 8
and edx, eax
imul esi, ebx
imul edx, dword [ebp - 4]
xor edi, ecx
and edi, eax
add esi, edx
xor edi, esi
mov ecx, edi
mov eax, edi
shr ecx, 8
shr eax, 5
and ecx, 0xf800
and eax, 0x7e0
shr edi, 3
or ecx, eax
and edi, 0x1f
mov eax, dword [ebp + 8]
or ecx, edi
mov edi, dword [ebp + 0x14]
mov word [eax + edi*2], cx
inc edi
mov dword [ebp + 0x14], edi
cmp edi, dword [ebp + 0x10]
jl 0x5aaae6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5aab8d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov ecx, dword [ecx + 8]
mov dword [ebp - 4], ecx
push ebx
push esi
push edi
test edx, edx
je 0x5aac01
xor edi, edi
cmp dword [ebp + 0x10], edi
jle 0x5aac95
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp + 8], eax
movzx ebx, byte [edi + edx]
test ebx, ebx
je 0x5aabf3
push ecx
push dword [esi]
push dword [eax + esi]
call fcn.005aa967
add esp, 0xc
cmp ebx, 0xff
jae 0x5aabe8
mov ecx, ebx
shr ecx, 7
add ecx, ebx
push ecx
push dword [esi]
push eax
call fcn.005aa967
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [esi], eax
mov eax, dword [ebp + 8]
inc edi
add esi, 4
cmp edi, dword [ebp + 0x10]
jl 0x5aabb7
jmp 0x5aac95
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x5aac95
mov edx, dword [ebp + 0xc]
mov eax, 0x100
sub eax, ecx
mov ecx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], ecx
mov dword [ebp + 8], edx
mov edx, dword [ecx + edx]
mov edi, dword [ecx]
mov esi, edi
shr esi, 8
mov ecx, 0xffff00ff
and esi, ecx
imul esi, eax
mov eax, edx
shr eax, 8
and eax, ecx
mov ecx, edi
imul eax, dword [ebp - 4]
and ecx, 0xff00ff
imul ecx, dword [ebp + 0x10]
shr edi, 8
add esi, eax
mov eax, edx
and eax, 0xff00ff
shr edx, 8
imul eax, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp + 0x10]
shr ecx, 8
xor esi, ecx
mov ecx, 0xff00ff
and edi, ecx
and edx, ecx
imul edx, dword [ebp - 4]
and esi, ecx
mov ecx, dword [ebp + 0x14]
imul edi, eax
add edi, edx
mov edx, dword [ebp + 8]
xor esi, edi
mov dword [ecx], esi
add ecx, 4
mov dword [ebp + 0x14], ecx
sub ebx, 1
jne 0x5aac24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5c7e95
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0xc]
inc ecx
mov eax, ecx
xor eax, esi
cmp eax, 3
cmove eax, ecx
shl eax, 4
add eax, dword [ebp + 8]
inc ecx
mov dword [edx], eax
lea edx, [edx + 4]
cmp ecx, 3
jl 0x5c7ea9
mov eax, dword [ebp - 0xc]
movsd xmm1, qword [ebx + 8]
push ecx
push ecx
movsd xmm3, qword [eax]
movsd xmm4, qword [eax + 8]
mov eax, dword [ebp - 8]
subsd xmm1, xmm4
movsd qword [ebp - 0x24], xmm3
movsd qword [ebp - 0x14], xmm4
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 8]
subsd xmm0, xmm3
subsd xmm2, xmm4
mulsd xmm1, xmm0
movsd qword [ebp - 0x1c], xmm0
movsd xmm0, qword [ebx]
subsd xmm0, xmm3
movsd qword [ebp - 0x2c], xmm2
mulsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [ebp - 0x34], xmm1
movsd qword [esp], xmm1
call fcn.0056fa19
pop ecx
pop ecx
test al, al
jne 0x5c7f87
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
cmp eax, 3
jge 0x5c7f9d
movsd xmm1, qword [edi + 8]
movsd xmm0, qword [edi]
subsd xmm1, qword [ebp - 0x14]
subsd xmm0, qword [ebp - 0x24]
mulsd xmm1, qword [ebp - 0x1c]
mulsd xmm0, qword [ebp - 0x2c]
subsd xmm1, xmm0
movaps xmm0, xmm1
mulsd xmm0, qword [ebp - 0x34]
comisd xmm0, xmmword [0x70eee0]
jbe 0x5c7f81
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.00579533
pop ecx
pop ecx
test al, al
je 0x5c7f87
mov eax, dword [ebp - 4]
inc eax
add edi, 0x10
jmp 0x5c7f31
inc esi
add ebx, 0x10
cmp esi, 3
jl 0x5c7ea3
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
jmp 0x5c7f96
Function at 0x5c9e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0x10]
inc ecx
mov eax, ecx
xor eax, esi
shl eax, 4
add eax, dword [ebp + 8]
inc ecx
mov dword [edx], eax
lea edx, [edx + 4]
cmp ecx, 4
jl 0x5c9e8e
xor ecx, ecx
cmp ecx, 3
jge 0x5c9fd0
mov eax, dword [ebp + ecx*4 - 0x10]
inc ecx
mov dword [ebp - 0x18], ecx
movsd xmm3, qword [eax]
movsd xmm4, qword [eax + 8]
xor eax, eax
cmp ecx, 3
movsd qword [ebp - 0x30], xmm3
movsd qword [ebp - 0x38], xmm4
cmovne eax, ecx
mov eax, dword [ebp + eax*4 - 0x10]
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 8]
subsd xmm0, xmm3
subsd xmm2, xmm4
ucomisd xmm0, qword [0x70eee0]
movsd qword [ebp - 0x40], xmm0
movsd qword [ebp - 0x28], xmm2
lahf
test ah, 0x44
jp 0x5c9f0c
ucomisd xmm2, qword [0x70eee0]
lahf
test ah, 0x44
jnp 0x5c9ea5
movsd xmm1, qword [edi + 8]
subsd xmm1, xmm4
push ecx
push ecx
mulsd xmm1, xmm0
movsd xmm0, qword [edi]
subsd xmm0, xmm3
mulsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
movsd qword [esp], xmm1
call fcn.0056fa19
pop ecx
pop ecx
test al, al
jne 0x5c9fbf
mov ebx, dword [ebp + 0xc]
xor eax, eax
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov dword [ebp - 0x14], eax
movsd xmm2, qword [ebx + 8]
movsd xmm0, qword [ebx]
subsd xmm2, qword [ebp - 0x38]
subsd xmm0, xmm4
mulsd xmm2, qword [ebp - 0x40]
mulsd xmm0, xmm3
subsd xmm2, xmm0
movaps xmm0, xmm2
mulsd xmm0, xmm1
comisd xmm0, xmmword [0x70eee0]
jbe 0x5c9fab
push ecx
push ecx
movsd qword [esp], xmm2
call fcn.00579533
pop ecx
pop ecx
test al, al
je 0x5c9fbf
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
inc eax
add ebx, 0x10
mov dword [ebp - 0x14], eax
cmp eax, 4
jl 0x5c9f57
mov ecx, dword [ebp - 0x18]
jmp 0x5c9ea5
inc esi
add edi, 0x10
cmp esi, 4
jl 0x5c9e88
xor al, al
jmp 0x5c9fd2
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004584a2
mov esp, ebp
pop ebp
ret

Function at 0x5cd6af
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, edx
push esi
shr ebx, 4
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x5cd6e9
rol esi, 0xf
xor esi, dword [edi]
rol esi, 0xf
xor esi, dword [edi + 4]
rol esi, 0xf
xor esi, dword [edi + 8]
rol esi, 0xf
xor esi, dword [edi + 0xc]
add edi, 0x10
sub ebx, 1
jne 0x5cd6c8
xor ecx, ecx
shr edx, 2
xor ebx, ebx
and edx, 3
lea eax, [edi + edx*4]
lea edx, [edx*4 + 3]
shr edx, 2
cmp edi, eax
cmova edx, ebx
test edx, edx
je 0x5cd714
rol esi, 0xf
xor esi, dword [edi]
inc ecx
lea edi, [edi + 4]
cmp ecx, edx
jb 0x5cd707
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x5e4fa9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.005f09b3
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x5e4fd6
xor eax, eax
jmp 0x5e50d2
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x4ebc80
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.005e6054
push esi
push eax
call fcn.004ebca0
add esp, 0x14
test eax, eax
je 0x5e5011
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.005f0b5e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.005e6036
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.005e7755
add esp, 0x28
test eax, eax
jne 0x5e5048
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x5e5089
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005f0b2f
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x5e5084
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x5e50b9
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.005f0a84
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.005f0a3c
add esp, 0x14
jmp 0x5e4fcf
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.005f0902
push dword [ebp - 4]
call fcn.005e517c
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5e74fb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x5e7531
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x5e7524
push eax
call fcn.005f0a28
push 2
call fcn.005f099f
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.004ea000
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x5e8926
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.005f09b3
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x5e8953
xor eax, eax
jmp 0x5e8af7
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x4ebc80
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.005e6054
push esi
push eax
call fcn.004ebca0
add esp, 0x14
test eax, eax
je 0x5e89a0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.005f0b5e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.005e6036
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.005e7755
add esp, 0x28
test eax, eax
jne 0x5e89d7
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x5e8a13
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005f0b2f
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x5e8a13
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x5e7827
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.005e7876
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x5e8a93
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.00426560
add esp, 0xc
cmp eax, 0xfffffffa
je 0x5e8a7c
cmp eax, 0xfffffffc
je 0x5e8a75
cmp eax, 0xfffffffe
je 0x5e8a6e
test eax, eax
je 0x5e8a8e
push str.Unknown_zlib_error
jmp 0x5e8a81
push str.zlib_stream_error
jmp 0x5e8a81
push str.zlib_memory_error
jmp 0x5e8a81
push str.zlib_version_error
push dword [ebp - 4]
call fcn.005e6070
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x5e8ac3
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.005f0a84
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.005f0a3c
add esp, 0x14
jmp 0x5e894c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.005ed8fa
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5ff150
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x5ff199
mov al, byte [esi]
push eax
call fcn.0060b2d0
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x5ff177
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x600580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x6005a1
cmp dword [esi + 0x8c], 0
je 0x6005a1
push 2
push 3
push esi
call fcn.0060b8a0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.0060d460
add esp, 4
test esi, esi
je 0x6005c4
cmp dword [esi + 0x8c], 0
je 0x6005c4
push 3
push esi
call fcn.0060b8e0
add esp, 8
pop esi
pop ebp
ret

Function at 0x601250
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2b0], 2
jne 0x601265
pop ebp
jmp fcn.00601200
mov al, 1
pop ebp
ret
Function at 0x608650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x608], 0
je 0x608694
push esi
push 1
push edi
call fcn.005fb8c0
push dword [edi + 0x59c]
mov eax, dword [edi + 0x608]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.005fb8c0
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x6086ca
push dword [edi + 0x598]
lea eax, [eax + eax*2]
push 1
add eax, 0x74b908
push 2
push eax
call fcn.004ffdb2
push dword [edi + 0x598]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004ffdb2
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x608b10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ecx + eax*4 + 0x1a8]
push edi
mov edi, dword [ebp + 0x10]
push eax
push ecx
mov dword [ebp - 0x88], ecx
call fcn.00609050
add esp, 8
push 0
push dword [ebp + 0x14]
push edi
push esi
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov dword [ebx], 0
cmp esi, 0xffffffff
jne 0x608bca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x608b8c
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.00632050
push eax
mov eax, dword [ebp - 0x88]
push str.Send_failure:__s
push dword [eax]
call fcn.006086d0
mov eax, dword [ebp - 0x88]
add esp, 0x18
mov eax, dword [eax]
mov dword [eax + 0xcac], edi
mov eax, esi
mov dword [ebx], 0x37
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004584a2
mov esp, ebp
pop ebp
ret
Function at 0x609050
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
shl eax, 4
push edi
mov edx, dword [ebx + ecx*4 + 0x1a8]
lea esi, [ebx + 0x1cc]
add esi, eax
mov dword [ebp + 8], edx
mov eax, dword [ebx + 0x2a8]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x60910d
cmp dword [ebx + ecx*4 + 0x1bc], 0x608a20
jne 0x60910d
cmp dword [esi], 0
je 0x60909f
test edi, edi
je 0x60910d
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
call fcn.00608200
add esp, 0x14
cmp eax, 0xffffffff
je 0x60910d
test al, 1
je 0x60910d
cmp dword [esi], 0
jne 0x6090f4
mov eax, dword [ebx]
mov eax, dword [eax + 0x8e4]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x7ccbb0]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x6090f4
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x60910d
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x609200
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test byte [eax + 0x1f8], 1
je 0x609220
push eax
call fcn.00601bf0
add esp, 4
test eax, eax
jne 0x609242
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x1a8]
cmp eax, 0xffffffff
je 0x60921c
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x609242
xor al, al
pop ebp
ret
mov al, 1
pop ebp
ret

Function at 0x609a30
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x7fab10]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x609a81
push 3
push 2
push eax
push 6
call fcn.0060afa0
add esp, 0x10
test al, al
je 0x609a75
mov dword [0x7fab10], 2
mov esp, ebp
pop ebp
ret
mov dword [0x7fab10], 1
jmp 0x609a86
cmp eax, 2
je 0x609ac6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x609aad
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x609ac6
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x609cf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x90], 2
mov ebx, dword [esi]
je 0x609efc
test dword [esi + 0x284], 0x8000002
push edi
jne 0x609ef2
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], 0x80
push eax
push edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x609d89
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.00632050
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.006086d0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x104]
mov dword [ebp - 0x188], 0x80
push 0
push eax
call fcn.004ea000
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x609dfd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.00632050
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.006086d0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x138]
push eax
lea edi, [esi + 0x10a]
lea eax, [ebp - 0x184]
push edi
push eax
call fcn.0060a4c0
add esp, 0xc
test al, al
jne 0x609e61
call fcn.004ed41f
mov esi, eax
call fcn.004ed41f
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push dword [esi]
call fcn.00632050
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.006086d0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x28]
movups xmmword [esi + 0x5c], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [esi + 0x6c], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [esi + 0x7c], xmm0
mov dword [esi + 0x84], eax
mov ax, word [edi + 0x2c]
mov word [esi + 0x88], ax
lea eax, [esi + 0x16c]
push eax
lea eax, [esi + 0x13c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0060a4c0
add esp, 0xc
test al, al
jne 0x609ef2
call fcn.004ed41f
mov esi, eax
call fcn.004ed41f
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push dword [esi]
call fcn.00632050
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.006086d0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret
push esi
call fcn.00609950
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004584a2
mov esp, ebp
pop ebp
ret