joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58b570
Capabilities:
Set socket configuration
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov eax, 0x69d2ab
xor edx, edx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x30], 0x6db754
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x34], eax
mov word [ebp - 0x28], 0
mov dword [ebp - 0x1c], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x38], ecx
lea eax, [ebp - 0x38]
mov dword fs:[0], eax
mov edx, dword [ebx + 0xdc]
test edx, edx
jne 0x58b5c7
mov al, 0x12
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
jmp 0x58b72c
mov ecx, dword [ebx + 0x14]
cmp ecx, 7
je 0x58b5e0
mov al, 8
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
jmp 0x58b72c
mov eax, dword [ebx + 0x70]
test eax, eax
je 0x58b60e
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x58b60e
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov word [ebp - 0x28], 0x14
push 3
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
mov word [ebp - 0x28], 8
add esp, 8
push 0x30
call fcn.0067ac68
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x58b642
mov word [ebp - 0x28], 0x2c
mov edx, dword [ebx + 0x10]
lea ecx, [ebp - 0x39]
push edx
push ecx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0060919c
add esp, 0xc
mov word [ebp - 0x28], 0x20
mov edi, dword [ebp - 0xc]
jmp 0x58b645
mov edi, dword [ebp - 0xc]
mov dword [ebx + 0x70], edi
mov al, byte [ebp - 0x39]
test al, al
je 0x58b68c
mov esi, edi
mov dword [ebp - 0x14], esi
test esi, esi
je 0x58b676
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov word [ebp - 0x28], 0x44
push 3
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [edx]
call dword [ecx]
mov word [ebp - 0x28], 0x38
add esp, 8
xor eax, eax
mov dword [ebx + 0x70], eax
mov al, 0x15
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
jmp 0x58b72c
mov ecx, dword [ebx + 4]
mov eax, dword [0x6db428]
push ecx
push eax
mov edx, dword [ebx + 8]
mov ecx, dword [0x6db424]
push edx
push ecx
mov al, byte [ebx + 0xc]
push eax
mov edx, dword [ebx + 0x70]
push edx
call fcn.0060b64c
mov eax, ebx
add esp, 0x18
mov dword [ebp - 0x40], 1
mov cl, byte [eax + 0xc]
mov edx, dword [ebx + 0x10]
test cl, cl
jne 0x58b6d6
push 4
lea eax, [ebp - 0x40]
push eax
push 1
push 6
push edx
call sub.WSOCK32.DLL_setsockopt
jmp 0x58b6e7
push 4
lea ecx, [ebp - 0x40]
push ecx
push 1
push 6
push edx
push eax
call fcn.00592624
mov dl, byte [ebp + 0xc]
mov byte [ebx + 0x74], dl
xor eax, eax
mov byte [ebx + 0x76], al
mov byte [ebx + 0x77], al
mov byte [ebx + 0x75], 1
mov edx, dword [ebx + 0x128]
test edx, edx
je 0x58b71b
mov ecx, dword [ebx + 0x13c]
test ecx, ecx
je 0x58b71b
xor eax, eax
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
jmp 0x58b72c
push ebx
call fcn.0058b74c
pop ecx
mov ecx, dword [ebp - 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58d8ec
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov ecx, dword [0x6db340]
test ecx, ecx
jne 0x58d90b
mov al, 9
jmp 0x58da33
mov ecx, dword [ebx + 0xe0]
test ecx, ecx
je 0x58d91c
mov al, 0x11
jmp 0x58da33
mov ecx, dword [ebx + 0x150]
test ecx, ecx
je 0x58d92d
mov al, 0x11
jmp 0x58da33
mov cl, byte [ebx + 0x90]
test cl, cl
je 0x58d946
mov ecx, dword [ebx + 0x14]
cmp ecx, 7
jne 0x58d946
mov al, 0x11
jmp 0x58da33
mov ecx, dword [ebx + 0xdc]
test ecx, ecx
jne 0x58d957
mov al, 0x12
jmp 0x58da33
test eax, eax
jg 0x58d962
xor eax, eax
jmp 0x58da33
mov ecx, dword [ebx + 0x10]
cmp ecx, 0xffffffff
jne 0x58d971
mov al, 0x12
jmp 0x58da33
mov ecx, edx
and ecx, 1
mov dword [ebx + 0x158], ecx
mov dword [ebx + 0x150], 1
mov ecx, dword [ebx + 0x50]
test ecx, ecx
je 0x58d997
xor ecx, ecx
mov dword [ebx + 0x54], ecx
xor ecx, ecx
mov dword [ebx + 0x44], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x168], ecx
mov dword [ebx + 0x164], ecx
mov dword [ebx + 0x170], eax
mov dword [ebx + 0x16c], eax
mov dword [ebp - 4], 1
test dl, 2
je 0x58d9fb
mov edx, dword [ebx + 0x14]
cmp edx, 7
jne 0x58d9fb
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58d9e7
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
push edx
call sub.WSOCK32.DLL_setsockopt
jmp 0x58d9fb
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push edx
push eax
call fcn.00592624
xor edx, edx
mov dword [ebx + 0x174], edx
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x178], eax
test eax, eax
je 0x58da14
xor edx, edx
mov dword [eax], edx
mov byte [ebx + 0x160], 2
push 1
mov eax, dword [0x6db3d4]
mov ecx, dword [ebx + 0x10]
push ecx
push 0x401
push eax
call sub.USER32.DLL_PostMessageA
xor eax, eax
pop ebx
pop ecx
pop ebp
ret

Function at 0x58da38
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x6db340]
test eax, eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
jne 0x58da54
mov al, 9
jmp 0x58daf5
mov edx, dword [ebx + 0x14]
cmp edx, 7
je 0x58da63
mov al, 8
jmp 0x58daf5
mov edx, dword [ebx + 0xe0]
test edx, edx
je 0x58da74
mov al, 0x11
jmp 0x58daf5
mov dl, byte [ebx + 0x90]
test dl, dl
je 0x58da82
mov al, 0x11
jmp 0x58daf5
mov edx, dword [ebx + 0x128]
test edx, edx
je 0x58da90
mov al, 0x11
jmp 0x58daf5
mov edx, dword [ebx + 0x12c]
test edx, edx
je 0x58da9e
mov al, 0x11
jmp 0x58daf5
mov edx, dword [ebx + 0xdc]
test edx, edx
jne 0x58daac
mov al, 0x12
jmp 0x58daf5
mov edx, dword [ebx + 0x10]
cmp edx, 0xffffffff
jne 0x58dab8
mov al, 0x12
jmp 0x58daf5
lea edi, [esi + 3]
push edi
call fcn.0067ac46
pop ecx
mov dword [ebx + 0x134], eax
mov dword [ebx + 0x140], edi
xor eax, eax
mov dword [ebx + 0x144], eax
mov dword [ebx + 0x13c], eax
mov dword [ebx + 0x12c], 1
push 0
push 3
push ebx
call fcn.0058f630
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x58dbf8
Capabilities:
Set socket configuration
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x6db340]
test eax, eax
jne 0x58dc15
mov al, 9
jmp 0x58dd3e
mov edx, dword [ebx + 0x14]
cmp edx, 7
je 0x58dc24
mov al, 8
jmp 0x58dd3e
mov edx, dword [ebx + 0xe0]
test edx, edx
je 0x58dc35
mov al, 0x11
jmp 0x58dd3e
mov dl, byte [ebx + 0x90]
test dl, dl
je 0x58dc46
mov al, 0x11
jmp 0x58dd3e
mov edx, dword [ebx + 0x150]
test edx, edx
je 0x58dc57
mov al, 0x11
jmp 0x58dd3e
mov edx, dword [ebx + 0xdc]
test edx, edx
jne 0x58dc68
mov al, 0x12
jmp 0x58dd3e
cmp esi, 3
jge 0x58dc74
mov al, 0x15
jmp 0x58dd3e
mov edx, dword [ebx + 0x10]
cmp edx, 0xffffffff
jne 0x58dc83
mov al, 0x12
jmp 0x58dd3e
push esi
call fcn.0067ac46
mov edi, eax
pop ecx
mov dword [ebx + 0x164], edi
mov dword [ebx + 0x168], edi
mov dword [ebx + 0x170], esi
mov dword [ebx + 0x16c], esi
xor eax, eax
xor edx, edx
mov dword [ebx + 0x174], eax
xor ecx, ecx
mov dword [ebx + 0x150], 1
mov dword [ebx + 0x154], 1
mov dword [ebx + 0x15c], edx
mov dword [ebx + 0x158], ecx
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x58dcdc
xor edx, edx
mov dword [ebx + 0x44], edx
mov dword [ebp - 4], 1
test byte [ebp + 0x10], 2
je 0x58dd26
mov ecx, dword [ebx + 0x14]
cmp ecx, 7
jne 0x58dd26
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58dd12
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
push edx
call sub.WSOCK32.DLL_setsockopt
jmp 0x58dd26
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push edx
push eax
call fcn.00592624
push 1
mov eax, dword [0x6db3d4]
mov edx, dword [ebx + 0x10]
push edx
push 0x401
push eax
call sub.USER32.DLL_PostMessageA
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x58de58
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edx, dword [0x6db340]
test edx, edx
jne 0x58de77
mov al, 9
jmp 0x58e064
mov ecx, dword [ebx + 0xdc]
test ecx, ecx
jne 0x58de88
mov al, 0x12
jmp 0x58e064
test eax, eax
je 0x58dea1
mov edx, dword [ebx + 0x58]
test edx, edx
jle 0x58de97
cmp edx, eax
jle 0x58de9a
mov dword [ebx + 0x58], eax
mov al, 0x11
jmp 0x58e064
xor edx, edx
xor eax, eax
mov al, dl
mov byte [ebx + 0x90], dl
mov dword [ebx + 0x128], eax
xor edx, edx
mov dword [ebx + 0x150], eax
mov byte [ebx + 0x77], dl
mov byte [ebx + 0x75], dl
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x58decd
xor ecx, ecx
mov dword [ebx + 0x54], ecx
mov eax, dword [ebx + 0x88]
test eax, eax
jne 0x58dee9
mov dword [ebx + 0x88], 1
xor edx, edx
mov dword [ebx + 0x8c], edx
mov ecx, dword [ebx + 0x70]
test ecx, ecx
je 0x58df12
mov byte [ebx + 0x76], 1
push 1
mov edx, dword [0x6db3d4]
mov eax, dword [ebx + 0x10]
push eax
push 0x401
push edx
call sub.USER32.DLL_PostMessageA
mov al, 0x11
jmp 0x58e064
mov eax, ebx
mov edx, dword [0x6db3d4]
mov esi, dword [ebx + 0x10]
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58df31
push 0
push 0
push edx
push esi
call sub.WSOCK32.DLL_WSAAsyncSelect
jmp 0x58df3d
push 0
push 0
push edx
push esi
push eax
call fcn.0059370c
mov edx, dword [ebx + 0x14]
cmp edx, 7
jne 0x58dfce
mov word [ebp - 4], 0
mov word [ebp - 2], 0x1e
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58df79
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
push edx
call sub.WSOCK32.DLL_setsockopt
jmp 0x58df90
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push edx
push eax
call fcn.00592624
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58dfa6
push 0
push edx
call sub.WSOCK32.DLL_shutdown
jmp 0x58dfaf
push 0
push edx
push eax
call fcn.0059299c
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58dfc5
push 1
push edx
call sub.WSOCK32.DLL_shutdown
jmp 0x58dfce
push 1
push edx
push eax
call fcn.0059299c
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 8]
mov dword [ebp - 8], edx
push eax
push 0x6db34c
mov esi, ebx
call fcn.00589c90
add esp, 8
mov dl, byte [esi + 0xc]
test dl, dl
jne 0x58dff9
mov ecx, dword [ebp - 8]
push ecx
call sub.WSOCK32.DLL_closesocket
jmp 0x58e003
mov eax, dword [ebp - 8]
push eax
push esi
call fcn.005919d4
mov esi, eax
inc esi
jne 0x58e040
mov esi, ebx
mov dl, byte [esi + 0xc]
test dl, dl
jne 0x58e018
call sub.WSOCK32.DLL_WSAGetLastError
jmp 0x58e01e
push esi
call fcn.00592df0
mov esi, eax
push ebx
call fcn.0058e2e8
pop ecx
push 0x1d
push 6
push ebx
call fcn.0058f630
add esp, 0xc
push esi
push ebx
call fcn.0058f584
add esp, 8
jmp 0x58e064
push 0x1c
push 6
push ebx
call fcn.0058f630
add esp, 0xc
xor ecx, ecx
mov dword [ebx + 0x88], ecx
mov dword [ebx + 0xdc], ecx
mov dword [ebx + 0x10], 0xffffffff
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x58e06c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x104]
test eax, eax
je 0x58e08c
mov al, 0x11
jmp 0x58e22b
mov dl, byte [esi]
test dl, dl
jne 0x58e099
mov al, 0x15
jmp 0x58e22b
xor edx, edx
mov dword [ebx + 0x11c], edx
mov byte [ebx + 0x108], 5
mov ecx, dword [ebx + 0x50]
test ecx, ecx
je 0x58e0b4
xor eax, eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x110], esi
lea ecx, [ebp - 0x10]
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
mov dword [ebx + 0x114], edx
push ecx
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0x6da7bb
push esi
call fcn.006a0b4c
add esp, 0x18
cmp eax, 4
jne 0x58e0f2
mov dword [ebx + 0x120], 1
jmp 0x58e0fa
xor eax, eax
mov dword [ebx + 0x120], eax
mov edx, dword [ebx + 0x10c]
test edx, edx
jne 0x58e10f
call fcn.00590db0
mov dword [ebx + 0x10c], eax
mov ecx, dword [ebx + 0x120]
test ecx, ecx
je 0x58e19e
mov edi, esi
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov dl, byte [eax + 0xc]
test dl, dl
jne 0x58e134
push edi
call sub.WSOCK32.DLL_inet_addr
jmp 0x58e13e
push edi
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00592170
mov dword [ebp - 0x14], eax
mov edi, dword [0x6db3d4]
mov esi, dword [ebx + 0x10c]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
mov dl, byte [eax + 0xc]
test dl, dl
jne 0x58e175
push 0x400
push esi
push 2
push 4
lea ecx, [ebp - 0x14]
push ecx
push 0x402
push edi
call sub.WSOCK32.DLL_WSAAsyncGetHostByAddr
jmp 0x58e192
push 0x400
push esi
push 2
lea eax, [ebp - 0x14]
push 4
push eax
push 0x402
push edi
mov edx, dword [ebp - 0x1c]
push edx
call fcn.005935b0
mov dword [ebx + 0x124], eax
test eax, eax
je 0x58e20b
jmp 0x58e1fd
mov edi, dword [ebx + 0x10c]
mov dword [ebp - 0x20], esi
mov edx, dword [0x6db3d4]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x28]
mov al, byte [ecx + 0xc]
test al, al
jne 0x58e1d7
push 0x400
push edi
mov edx, dword [ebp - 0x20]
push edx
push 0x402
mov ecx, dword [ebp - 0x24]
push ecx
call sub.WSOCK32.DLL_WSAAsyncGetHostByName
jmp 0x58e1f3
push 0x400
push edi
mov eax, dword [ebp - 0x20]
push eax
push 0x402
mov edx, dword [ebp - 0x24]
push edx
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.005934fc
mov dword [ebx + 0x124], eax
test eax, eax
je 0x58e20b
mov dword [ebx + 0x104], 1
xor eax, eax
jmp 0x58e22b
mov esi, ebx
mov dl, byte [esi + 0xc]
test dl, dl
jne 0x58e21b
call sub.WSOCK32.DLL_WSAGetLastError
jmp 0x58e221
push esi
call fcn.00592df0
push eax
push ebx
call fcn.0058f584
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58e2e8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x69d2ab
xor edx, edx
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], 0x6db898
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x28], eax
mov word [ebp - 0x1c], 0
mov dword [ebp - 0x10], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x2c]
mov dword fs:[0], eax
mov eax, dword [ebx + 0x70]
test eax, eax
je 0x58e356
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x58e351
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov word [ebp - 0x1c], 0x14
push 3
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
mov word [ebp - 0x1c], 8
add esp, 8
xor eax, eax
mov dword [ebx + 0x70], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0xffffffff
je 0x58e452
mov esi, eax
mov eax, ebx
mov edx, dword [0x6db3d4]
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58e380
push 0
push 0
push edx
push esi
call sub.WSOCK32.DLL_WSAAsyncSelect
jmp 0x58e38c
push 0
push 0
push edx
push esi
push eax
call fcn.0059370c
mov edx, dword [ebx + 0x14]
cmp edx, 7
jne 0x58e41d
mov word [ebp - 0x30], 1
mov word [ebp - 0x2e], 0
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58e3c8
push 4
lea eax, [ebp - 0x30]
push eax
push 0x80
push 0xffff
push edx
call sub.WSOCK32.DLL_setsockopt
jmp 0x58e3df
push 4
lea ecx, [ebp - 0x30]
push ecx
push 0x80
push 0xffff
push edx
push eax
call fcn.00592624
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58e3f5
push 0
push edx
call sub.WSOCK32.DLL_shutdown
jmp 0x58e3fe
push 0
push edx
push eax
call fcn.0059299c
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov cl, byte [eax + 0xc]
test cl, cl
jne 0x58e414
push 1
push edx
call sub.WSOCK32.DLL_shutdown
jmp 0x58e41d
push 1
push edx
push eax
call fcn.0059299c
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edx
push eax
push 0x6db34c
mov esi, ebx
call fcn.00589c90
add esp, 8
mov dl, byte [esi + 0xc]
test dl, dl
jne 0x58e448
mov ecx, dword [ebp - 0x34]
push ecx
call sub.WSOCK32.DLL_closesocket
jmp 0x58e452
mov eax, dword [ebp - 0x34]
push eax
push esi
call fcn.005919d4
mov dword [ebx + 0x10], 0xffffffff
xor edx, edx
xor eax, eax
mov byte [ebx + 0x77], dl
mov byte [ebx + 0x75], dl
mov byte [ebx + 0x76], dl
test eax, eax
setne dl
mov dword [ebx + 0x88], eax
mov dword [ebx + 0xe0], eax
and edx, 1
xor eax, eax
mov al, dl
mov byte [ebx + 0x90], dl
mov dword [ebx + 0x128], eax
mov dword [ebx + 0x150], eax
xor edx, edx
xor ecx, ecx
mov dword [ebx + 0xdc], edx
mov dword [ebx + 0x144], ecx
xor eax, eax
mov dword [ebx + 0x174], eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58e4b8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x10]
cmp eax, 0xffffffff
jne 0x58e4d0
xor eax, eax
jmp 0x58e525
mov edi, ebx
mov dword [ebp - 4], 0x10
mov dl, byte [edi + 0xc]
mov esi, dword [ebx + 0x10]
test dl, dl
jne 0x58e4f3
lea ecx, [ebp - 4]
lea eax, [ebp - 0x14]
push ecx
push eax
push esi
call sub.WSOCK32.DLL_getsockname
jmp 0x58e502
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x14]
push ecx
push esi
push edi
call fcn.00591cd0
inc eax
jne 0x58e509
xor eax, eax
jmp 0x58e525
mov si, word [ebp - 0x12]
mov edi, ebx
mov dl, byte [edi + 0xc]
test dl, dl
jne 0x58e51e
push esi
call sub.WSOCK32.DLL_ntohs
jmp 0x58e525
push esi
push edi
call fcn.005922e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x590db0
Capabilities:
Terminate process

Disassembly:
push ebx
add esp, 0xffffffa0
mov eax, dword [0x6db408]
test eax, eax
je 0x590e8b
mov eax, 0x6db3d8
mov edx, dword [eax + 8]
mov dword [esp + 8], edx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], edx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x14], eax
mov eax, 0x6db3d8
mov ecx, dword [esp + 8]
mov edx, dword [eax + 8]
mov ebx, dword [ecx]
mov dword [esp + 0x20], edx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x28], edx
mov eax, dword [eax + 0x14]
add dword [0x6db3e0], 4
dec dword [0x6db408]
mov dword [esp + 0x2c], eax
mov ecx, dword [0x6db408]
test ecx, ecx
sete al
and eax, 1
test al, al
jne 0x590e7c
mov eax, 0x6db3d8
mov edx, 0x6db3d8
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x40], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x30]
mov ecx, dword [eax + 8]
mov eax, dword [edx + 8]
mov dword [esp + 0x50], eax
mov eax, dword [edx + 0xc]
mov dword [esp + 0x54], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x48]
mov edx, dword [edx + 0x14]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x10]
cmp ecx, edx
jne 0x590e87
push 0x6db3d8
call fcn.00588ec0
pop ecx
mov eax, ebx
jmp 0x590e96
push 0x401
call fcn.0067ac46
pop ecx
add esp, 0x60
pop ebx
ret
Function at 0x591a68
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x591a82
mov esi, dword [eax + 4]
test eax, eax
je 0x591a89
mov edi, dword [eax + 8]
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.WSOCK32.DLL_connect
mov ebx, eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x6fccb0], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x6fccb0]
push edx
call fcn.00592e6c
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push esi
push str.Sock_ID_lu_connect__u_0x_p__d_______d___s_
lea eax, [ebp - 0xa0]
push eax
call fcn.006a0ad0
add esp, 0x20
lea edx, [ebp - 0xa0]
mov ecx, dword [0x6db428]
mov eax, dword [0x6db424]
push edx
push edi
push ecx
push eax
call sub.USER32.DLL_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x591cd0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x591cea
mov esi, dword [eax + 4]
test eax, eax
je 0x591cf1
mov edi, dword [eax + 8]
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.WSOCK32.DLL_getsockname
mov ebx, eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x6fccb0], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x6fccb0]
push edx
call fcn.00592e6c
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push esi
push str.Sock_ID_lu_getsockname__u_0x_p_0x_p_______d___s_
lea eax, [ebp - 0xa0]
push eax
call fcn.006a0ad0
add esp, 0x20
lea edx, [ebp - 0xa0]
mov ecx, dword [0x6db428]
mov eax, dword [0x6db424]
push edx
push edi
push ecx
push eax
call sub.USER32.DLL_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x592170
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x59218a
mov esi, dword [eax + 4]
test eax, eax
je 0x592191
mov edi, dword [eax + 8]
mov eax, dword [ebp + 0xc]
push eax
call sub.WSOCK32.DLL_inet_addr
mov ebx, eax
push ebx
mov eax, dword [ebp + 0xc]
push eax
push esi
push str.Sock_ID_lu_inet_addr__s______0x_lX
lea edx, [ebp - 0xa0]
push edx
call fcn.006a0ad0
add esp, 0x14
lea ecx, [ebp - 0xa0]
mov eax, dword [0x6db428]
mov edx, dword [0x6db424]
push ecx
push edi
push eax
push edx
call sub.USER32.DLL_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x592354
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x59236e
mov esi, dword [eax + 4]
test eax, eax
je 0x592375
mov edi, dword [eax + 8]
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x6fccb0], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x6fccb0]
push edx
call fcn.00592e6c
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
push esi
push str.Sock_ID_lu_recv__u_0x_p__d__d_______d___s_
lea edx, [ebp - 0xa0]
push edx
call fcn.006a0ad0
add esp, 0x24
lea ecx, [ebp - 0xa0]
mov eax, dword [0x6db428]
mov edx, dword [0x6db424]
push ecx
push edi
push eax
push edx
call sub.USER32.DLL_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x592400
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x59241a
mov esi, dword [eax + 4]
test eax, eax
je 0x592421
mov edi, dword [eax + 8]
mov eax, dword [ebp + 0x20]
push eax
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.WSOCK32.DLL_recvfrom
mov ebx, eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x6fccb0], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x6fccb0]
push edx
call fcn.00592e6c
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x20]
push eax
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push esi
push str.Sock_ID_lu_recvfrom__u_0x_p__d__d_0x_p_0x_p_______d___s_
lea eax, [ebp - 0xa0]
push eax
call fcn.006a0ad0
add esp, 0x2c
lea edx, [ebp - 0xa0]
mov ecx, dword [0x6db428]
mov eax, dword [0x6db424]
push edx
push edi
push ecx
push eax
call sub.USER32.DLL_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c