joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c71a0
Capabilities:
Generate random numbers via rtlgenrandom
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, edx
mov esi, ecx
mov ebx, dword [esp + 0x18]
jmp 0x4c71c1
mov ecx, esi
call fcn.004c6ee0
xor ecx, ecx
test ecx, ecx
jne 0x4c729d
mov eax, dword [esi]
cmp eax, 2
je 0x4c71e0
cmp eax, 1
je 0x4c7286
cmp eax, 4
jne 0x4c71b0
jmp 0x4c7239
xor ebp, ebp
nop word cs:[eax + eax]
lea eax, [edi + ebp]
mov ecx, ebx
sub ecx, ebp
push dword [esi + 8]
push ecx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
add ebp, eax
xor ecx, ecx
cmp ebp, ebx
sete cl
test eax, eax
mov eax, ecx
mov edx, 6
cmove eax, edx
test eax, eax
je 0x4c71f0
cmp eax, 6
jne 0x4c71b9
cmp dword [esi], 2
jne 0x4c71b0
push dword [esi + 8]
call fcn.00786c28
add esp, 4
jmp 0x4c71b0
mov eax, dword [esi + 0x108]
mov ecx, dword [esi + 0x10c]
test ebx, ebx
je 0x4c728f
xor edx, edx
mov ebx, ecx
mov dword [esp], edi
inc eax
movzx eax, al
mov ch, byte [esi + eax + 8]
add bl, ch
movzx ebp, bl
mov cl, byte [esi + ebp + 8]
mov byte [esi + eax + 8], cl
mov byte [esi + ebp + 8], ch
add ch, byte [esi + eax + 8]
movzx ecx, ch
movzx ecx, byte [esi + ecx + 8]
mov edi, dword [esp]
mov byte [edi + edx], cl
mov edi, dword [esp + 0x18]
inc edx
cmp edi, edx
jne 0x4c7250
jmp 0x4c7291
push ebx
push edi
call sub.ADVAPI32.dll_SystemFunction036
jmp 0x4c729d
mov ebp, ecx
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c8cb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
push esi
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0xb4]
test esi, esi
je 0x4c8cea
mov esi, dword [esi + 0xc]
test esi, esi
je 0x4c8cea
push dword [edi + 0xb8]
push 0
push 0
push 0
push edx
push ecx
push eax
call esi
add esp, 0x1c
pop esi
pop edi
ret
push 0
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
pop esi
pop edi
ret

Function at 0x4c8d00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ebp, dword [eax + 0xb4]
test ebp, ebp
je 0x4c8d43
mov ebp, dword [ebp + 0xc]
test ebp, ebp
je 0x4c8d43
push dword [eax + 0xb8]
push ebx
push edi
push esi
push edx
push ecx
push dword [esp + 0x30]
call ebp
add esp, 0x1c
jmp 0x4c8d52
push ebx
push edi
push esi
push edx
push ecx
push dword [esp + 0x2c]
call dword [sym.imp.WS2_32.dll_recvfrom]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c8d60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov esi, dword [eax]
mov edi, dword [esi + 0x208]
mov esi, dword [edi + 0xb4]
test esi, esi
je 0x4c8da9
mov esi, dword [esi + 0x10]
test esi, esi
je 0x4c8da9
mov dword [esp], ecx
mov dword [esp + 4], edx
mov ecx, esp
push dword [edi + 0xb8]
push 1
push ecx
push dword [eax + 4]
call esi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov ebx, dword [eax + 0x1c]
test bl, 4
je 0x4c8db7
and ebx, 0xfffffffb
mov dword [eax + 0x1c], ebx
push 0
push edx
push ecx
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_send]
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x4c93b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov dword [esp + 0xc], pe_nt_image_headers32
xor eax, eax
cmp dword [ecx + 8], 0
je 0x4c93d3
lea esp, [ebp - 4]
pop esi
pop ebp
ret
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
lea eax, [esp + 0xc]
lea edx, [esp + 0x10]
push eax
push edx
mov esi, ecx
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, eax
mov eax, 0xb
test ecx, ecx
jne 0x4c93cd
movzx ecx, word [esp + 0x10]
cmp ecx, 0x17
je 0x4c9440
cmp ecx, 2
jne 0x4c93cd
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 2
mov dword [esi + 0xc], eax
jmp 0x4c9450
mov dword [esi + 8], 0x17
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0xc], xmm0
xor eax, eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x4c94a0
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
nop word cs:[eax + eax]
mov eax, dword [edi + 0xb4]
test eax, eax
je 0x4c94f0
mov eax, dword [eax + 8]
test eax, eax
je 0x4c94f0
push dword [edi + 0xb8]
push dword [esp + 0x24]
push dword [esp + 0x24]
push ebp
call eax
add esp, 0x10
jmp 0x4c94ff
push dword [esp + 0x20]
push dword [esp + 0x20]
push ebp
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
call ebx
mov ecx, eax
cmp esi, 0xffffffff
sete al
lea edx, [ecx - 0x2735]
cmp edx, 0xfffffffe
setb dl
test al, dl
jne 0x4c952c
xor eax, eax
cmp esi, 0xffffffff
jne 0x4c9531
cmp ecx, 0x2714
je 0x4c94c0
jmp 0x4c9531
mov eax, 0xb
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4cb820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4cb8b1
mov ecx, dword [esp + 0x10]
mov edx, edi
and edx, 3
cmp edi, 4
jae 0x4cb845
xor esi, esi
jmp 0x4cb88a
and edi, 0xfffffffc
xor esi, esi
nop word [eax + eax]
movzx ebx, byte [ecx + esi]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 1]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 2]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 3]
xor ebx, eax
imul eax, ebx, 0x1000193
add esi, 4
cmp edi, esi
jne 0x4cb850
test edx, edx
je 0x4cb8b1
add ecx, esi
xor esi, esi
nop word cs:[eax + eax]
movzx edi, byte [ecx + esi]
xor edi, eax
imul eax, edi, 0x1000193
inc esi
cmp edx, esi
jne 0x4cb8a0
pop esi
pop edi
pop ebx
ret

Function at 0x4cb8c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4cb8fd
mov ebx, dword [esp + 0x14]
xor ebp, ebp
nop word cs:[eax + eax]
movzx eax, byte [ebx + ebp]
push eax
call fcn.004c5f00
add esp, 4
movzx eax, al
xor eax, esi
imul esi, eax, 0x1000193
inc ebp
cmp edi, ebp
jne 0x4cb8e0
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4cf090
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov esi, ecx
and esi, 0xff
je 0x4cf0c1
test dl, 3
je 0x4cf123
movzx eax, byte [edx]
test al, al
sete ah
cmp al, cl
sete al
or al, ah
je 0x4cf0d0
mov eax, edx
pop esi
pop edi
pop ebx
ret
push 0
push edx
call fcn.004cfdd0
add esp, 8
pop esi
pop edi
pop ebx
ret
lea eax, [edx + 1]
test al, 3
je 0x4cf121
movzx ebx, byte [eax]
test bl, bl
sete bh
cmp bl, cl
sete bl
or bl, bh
jne 0x4cf16d
lea eax, [edx + 2]
test al, 3
je 0x4cf121
movzx ebx, byte [eax]
test bl, bl
sete bh
cmp bl, cl
sete bl
or bl, bh
jne 0x4cf16d
lea eax, [edx + 3]
test al, 3
je 0x4cf121
movzx ebx, byte [eax]
test bl, bl
sete bh
cmp bl, cl
sete bl
or bl, bh
jne 0x4cf16d
add edx, 4
jmp 0x4cf123
mov edx, eax
imul esi, esi, 0x1010101
add edx, 0xfffffffb
mov eax, edx
nop
mov edi, dword [eax + 5]
mov edx, 0x1010100
sub edx, edi
or edx, edi
xor edi, esi
mov ebx, 0x1010100
sub ebx, edi
or ebx, edi
and edx, ebx
not edx
add eax, 4
test edx, 0x80808080
je 0x4cf130
jmp 0x4cf164
cmp dl, cl
je 0x4cf16d
movzx edx, byte [eax + 1]
inc eax
test dl, dl
jne 0x4cf160
pop esi
pop edi
pop ebx
ret

Function at 0x4cfdd0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
test dl, 3
je 0x4cfe10
cmp byte [edx], cl
jne 0x4cfde8
mov eax, edx
pop esi
pop edi
ret
lea eax, [edx + 1]
test al, 3
je 0x4cfe0e
cmp byte [eax], cl
je 0x4cfe4a
lea eax, [edx + 2]
test al, 3
je 0x4cfe0e
cmp byte [eax], cl
je 0x4cfe4a
lea eax, [edx + 3]
test al, 3
je 0x4cfe0e
cmp byte [eax], cl
je 0x4cfe4a
add edx, 4
jmp 0x4cfe10
mov edx, eax
movzx eax, cl
imul eax, eax, 0x1010101
add edx, 0xfffffffb
nop dword [eax]
mov esi, dword [edx + 5]
xor esi, eax
mov edi, 0x1010100
sub edi, esi
or edi, esi
not edi
add edx, 4
test edi, 0x80808080
je 0x4cfe20
nop dword [eax + eax]
lea eax, [edx + 1]
cmp byte [edx + 1], cl
mov edx, eax
jne 0x4cfe40
pop esi
pop edi
ret
Function at 0x4e2230
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1004
call fcn.00787ee0
mov esi, dword [esp + 0x1018]
cmp dword [esp + 0x1020], 1
jne 0x4e22e3
push 0xa5bb44
push dword [esp + 0x1020]
call fcn.00786c50
add esp, 8
mov dword [esp], eax
test eax, eax
je 0x4e22ec
lea eax, [esi + 4]
push eax
call fcn.004e2ef0
add esp, 4
xor edi, edi
test eax, eax
je 0x4e2315
mov ebp, eax
lea ebx, [esp + 8]
nop
mov dword [esp + 4], 0
mov ecx, esi
mov edx, ebp
push 1
lea eax, [esp + 8]
push eax
push 0xffc
push ebx
call fcn.004e1f60
add esp, 0x10
test eax, eax
jne 0x4e2313
mov edi, esi
mov esi, dword [esp + 4]
push dword [esp]
push esi
push 1
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, esi
jne 0x4e2302
push ebp
call fcn.004e2f00
add esp, 4
mov ebp, eax
test eax, eax
mov esi, edi
jne 0x4e2290
xor edi, edi
jmp 0x4e2315
push str.Unsupported_type_of_known_host_information_store
push 0xffffffffffffffdf
jmp 0x4e22f3
push str.Failed_to_open_file
push 0xfffffffffffffff0
push dword [esi]
call fcn.004e28e0
add esp, 0x1010
jmp 0x4e2328
push str.Write_failed
push 0xfffffffffffffff0
push dword [edi]
call fcn.004e28e0
add esp, 0xc
mov edi, eax
push dword [esp]
call fcn.00786c28
add esp, 4
mov eax, edi
add esp, 0x1004
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e2cf0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov dword [eax], 0
test ebx, ebx
jne 0x4e2d1c
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ebx, eax
lea eax, [ebx*4]
mov ecx, 0xaaaaaaab
mul ecx
shr edx, 1
add edx, 4
push edi
push edx
call dword [edi + 4]
add esp, 8
test eax, eax
je 0x4e2de9
mov dword [esp], eax
mov esi, eax
mov dword [esp + 4], ebx
test ebx, ebx
je 0x4e2e4f
mov eax, dword [esp + 4]
lea ecx, [eax - 2]
mov dword [esp + 8], ecx
dec eax
mov dword [esp + 0xc], eax
xor ebx, ebx
mov esi, dword [esp]
nop word cs:[eax + eax]
movzx edx, byte [ebp + ebx]
cmp dword [esp + 0xc], ebx
je 0x4e2df0
movzx ecx, byte [ebp + ebx + 1]
cmp dword [esp + 8], ebx
je 0x4e2e12
mov eax, dword [esp + 0x28]
movzx ebp, byte [eax + ebx + 2]
mov edi, edx
shr edi, 2
shl edx, 4
and edx, 0x30
movzx eax, byte [edi + 0xa5c36f]
mov byte [esi], al
mov eax, ecx
shr eax, 4
movzx eax, byte [eax + edx + 0xa5c36f]
and ecx, 0xf
mov byte [esi + 1], al
mov eax, ebp
shr eax, 6
movzx eax, byte [eax + ecx*4 + 0xa5c36f]
mov byte [esi + 2], al
and ebp, 0x3f
movzx eax, byte [ebp + 0xa5c36f]
mov ebp, dword [esp + 0x28]
mov byte [esi + 3], al
add esi, 4
add ebx, 3
cmp dword [esp + 4], ebx
jne 0x4e2d70
jmp 0x4e2e4f
xor eax, eax
add esp, 0x10
jmp 0x4e2e64
mov ecx, edx
shr ecx, 2
shl edx, 4
and edx, 0x30
movzx ecx, byte [ecx + 0xa5c36f]
mov byte [esi], cl
movzx ecx, byte [edx + 0xa5c36f]
mov byte [esi + 1], cl
mov cl, 0x3d
jmp 0x4e2e45
mov eax, edx
shr eax, 2
mov ebx, ecx
shr bl, 4
shl dl, 4
or dl, bl
and dl, 0x3f
and ecx, 0xf
movzx ebx, byte [eax + 0xa5c36f]
mov byte [esi], bl
movzx edx, dl
movzx edx, byte [edx + 0xa5c36f]
mov byte [esi + 1], dl
movzx ecx, byte [ecx*4 + 0xa5c36f]
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp]
mov dword [eax], ecx
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e83a0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x228
mov esi, dword [ebp + 8]
mov dword [esi + 0x170], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.004f4240
add esp, 8
test eax, eax
jne 0x4e8502
mov eax, dword [esp + 4]
imul edx, eax, 0x3e8
mov ebx, dword [esi + 0x164]
test ebx, ebx
mov ecx, 0x3e8
cmovne ecx, edx
mov edx, dword [esi + 0x64]
test edx, edx
jle 0x4e844e
test eax, eax
sete al
cmp ecx, edx
setg dl
or dl, al
cmp dl, 1
jne 0x4e844e
mov edi, dword [ebp + 0x10]
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
push edi
push dword [ebp + 0xc]
push edx
push eax
call sub.api_ms_win_crt_time_l1_1_0.dll__difftime64
add esp, 0x10
fstp qword [esp + 0x10]
movsd xmm0, qword [esp + 0x10]
mulsd xmm0, qword [0xa5d398]
cvttsd2si edx, xmm0
mov ecx, dword [esi + 0x64]
mov eax, str.API_timeout_expired
sub ecx, edx
jl 0x4e84f6
mov dword [esp], 0
jmp 0x4e8456
test ecx, ecx
setle al
mov dword [esp], eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
shr eax, 0x1f
sar edx, 6
add edx, eax
mov dword [esp + 8], edx
imul eax, edx, 0xfffffc18
add eax, ecx
imul eax, eax, 0x3e8
mov dword [esp + 0xc], eax
xor eax, eax
mov ecx, 0
test bl, 1
je 0x4e84aa
mov ecx, dword [esi + 0x15c]
mov dword [esp + 0x124], ecx
mov dword [esp + 0x120], 1
lea ecx, [esp + 0x120]
mov edx, dword [esi + 0x15c]
test bl, 2
je 0x4e84c5
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x1c]
inc edx
xor edi, edi
cmp byte [esp], 0
lea ebx, [esp + 8]
cmovne ebx, edi
push ebx
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x4e84f1
mov eax, 0
jns 0x4e8502
mov eax, str.Error_waiting_on_socket
jmp 0x4e84f6
mov eax, str.Timed_out_waiting_on_socket
push eax
push 0xfffffffffffffff7
push esi
call fcn.004e28e0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f24c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov esi, ecx
push 0xa5ead5
push dword [esp + 0x38]
call fcn.00786c50
add esp, 8
test eax, eax
je 0x4f24fa
mov ebp, eax
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
add esp, 4
test eax, eax
je 0x4f2501
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
add esp, 4
jmp 0x4f254e
push str.Unable_to_open_public_key_file
jmp 0x4f255c
mov dword [esp + 8], edi
xor edi, edi
lea ebx, [esp + 3]
nop dword [eax + eax]
push ebp
push 1
push 1
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x4f2540
movzx eax, byte [esp + 3]
cmp eax, 0xa
je 0x4f2540
cmp eax, 0xd
je 0x4f2540
inc edi
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
add esp, 4
test eax, eax
je 0x4f2510
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
add esp, 4
cmp edi, 1
ja 0x4f256c
push ebp
call fcn.00786c28
add esp, 4
push str.Invalid_data_in_public_key_file
push 0xfffffffffffffff0
push esi
call fcn.004e28e0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
push edi
call dword [esi + 4]
add esp, 8
test eax, eax
je 0x4f25c5
mov ebx, eax
push ebp
push edi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, edi
jne 0x4f25d7
push ebp
call fcn.00786c28
add esp, 4
mov ebp, edi
neg ebp
dec edi
nop dword [eax]
movzx eax, byte [ebx + edi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
add esp, 4
test eax, eax
je 0x4f25f2
dec edi
inc ebp
jne 0x4f25a0
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push str.Missing_public_key_data
jmp 0x4f255c
push ebp
call fcn.00786c28
add esp, 4
push str.Unable_to_allocate_memory_for_public_key_data
push 0xfffffffffffffffa
jmp 0x4f255e
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push ebp
call fcn.00786c28
add esp, 4
push str.Unable_to_read_public_key_from_file
jmp 0x4f255c
mov eax, ebp
neg eax
push eax
push 0x20
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memchr
add esp, 0xc
test eax, eax
je 0x4f2666
mov edi, ebx
sub edi, ebp
inc eax
mov ecx, ebx
sub ecx, eax
mov dword [esp + 4], ecx
mov ecx, eax
cmova ecx, ebx
mov edx, ebx
sub edx, ecx
sub edx, ebp
push edx
push 0x20
push eax
mov ebp, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memchr
add esp, 0xc
test eax, eax
cmovne edi, eax
sub edi, ebp
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push edi
push ebp
push eax
push ecx
push esi
call fcn.004e2b70
add esp, 0x14
test eax, eax
je 0x4f2678
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push str.Invalid_key_data__not_base64_encoded
push 0xfffffffffffffff0
push esi
call fcn.004e28e0
add esp, 0xc
jmp 0x4f26a1
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push str.Invalid_public_key_data
jmp 0x4f255c
mov ecx, dword [esp + 4]
neg ecx
mov eax, dword [esp + 8]
mov dword [eax], ebx
dec ecx
mov eax, dword [esp + 0x28]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
xor eax, eax
add esp, 0x14
jmp 0x4f2567
Function at 0x5651a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov edi, dword [ecx + 4]
xor eax, eax
test edi, edi
je 0x5651c7
mov ebx, dword [ecx]
movzx ecx, byte [ebx]
shr ecx, 6
mov esi, 1
shl esi, cl
cmp edi, esi
jae 0x5651cf
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
call fcn.005e6f00
add esp, 4
sub edi, esi
je 0x5652bb
and eax, 0xfffffffe
xor eax, 2
or eax, edx
mov eax, 0
jne 0x5651c7
add ebx, esi
movzx ecx, byte [ebx]
shr ecx, 6
mov edx, 1
shl edx, cl
cmp edi, edx
jb 0x5651c7
sub edi, edx
je 0x5651c7
add ebx, edx
movzx ecx, byte [ebx]
shr ecx, 6
mov edx, 1
shl edx, cl
cmp edi, edx
jb 0x5651c7
sub edi, edx
je 0x5651c7
add ebx, edx
movzx ecx, byte [ebx]
shr ecx, 6
mov esi, 1
shl esi, cl
sub edi, esi
jb 0x5651c7
push ebx
call fcn.005e6f00
add esp, 4
mov dword [esp + 4], eax
mov dword [esp], edx
or eax, edx
je 0x56529b
add ebx, esi
xor eax, eax
xor edx, edx
xor esi, esi
test edi, edi
je 0x5651c7
movzx ecx, byte [ebx]
shr ecx, 6
mov ebp, 1
shl ebp, cl
cmp edi, ebp
jb 0x5651c7
sub edi, ebp
je 0x5651c7
add ebx, ebp
movzx ecx, byte [ebx]
shr ecx, 6
mov ebp, 1
shl ebp, cl
sub edi, ebp
jb 0x5651c7
add ebx, ebp
add edx, 1
adc esi, 0
cmp edx, dword [esp + 4]
mov ecx, esi
sbb ecx, dword [esp]
jb 0x56524c
mov ecx, dword [esp + 4]
add ecx, 1
mov edx, dword [esp]
adc edx, 0
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, 1
jmp 0x5651c7
xor eax, eax
jmp 0x5651c7
Function at 0x57fa50
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, 1
cmp byte [0xb5f36c], 0
jne 0x57faf3
mov byte [0xb5f36c], 1
push 0x190
push 0
push 0xb5f1dc
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0xb5f1dc
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x57faf3
call fcn.005b5560
push str.BIO_sock_init
push 0x96
push str.crypto_bio_bio_sock.c
call fcn.005b5660
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_wsastartup__
push eax
push 2
call fcn.005b5750
add esp, 0xc
call fcn.005b5560
push str.BIO_sock_init
push 0x98
push str.crypto_bio_bio_sock.c
call fcn.005b5660
add esp, 0xc
push 0
push 0x7a
push 0x20
call fcn.005b5750
add esp, 0xc
mov esi, 0xffffffff
mov eax, esi
pop esi
ret

Function at 0x57fff0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test eax, eax
jns 0x580044
call fcn.005b5560
push str.BIO_socket_ioctl
push 0xf4
push str.crypto_bio_bio_sock.c
call fcn.005b5660
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_ioctlsocket__
push eax
push 2
call fcn.005b5750
add esp, 0xc
xor eax, eax
test esi, esi
sete al
add esp, 4
pop esi
ret

Function at 0x580140
Capabilities:
Get socket status

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10c
mov esi, dword [esp + 0x11c]
cmp esi, 0xffffffff
je 0x5801ba
mov ebx, dword [esp + 0x128]
mov edi, dword [esp + 0x124]
mov eax, edi
or eax, ebx
je 0x5801c1
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov ecx, eax
xor eax, eax
sub edi, ecx
sbb ebx, edx
jl 0x5801c6
mov eax, dword [esp + 0x120]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], edi
inc esi
xor ecx, ecx
test eax, eax
lea edx, [esp + 8]
cmovne eax, edx
cmove ecx, edx
mov edx, esp
push edx
push 0
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
jmp 0x5801c6
mov eax, 0xffffffff
jmp 0x5801c6
mov eax, 1
add esp, 0x10c
pop esi
pop edi
pop ebx
ret
Function at 0x580260
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x14]
mov dword [esp], 1
cmp edi, 0xffffffff
je 0x58030b
mov ebx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call fcn.0057fff0
add esp, 8
test eax, eax
je 0x580335
test bl, 4
je 0x58033e
mov eax, esp
push 4
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x58033e
call fcn.005b5560
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.005b5660
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0xa78882
push eax
push 2
call fcn.005b5750
add esp, 0xc
call fcn.005b5560
push str.BIO_connect
push 0x62
push str.crypto_bio_bio_sock2.c
call fcn.005b5660
add esp, 0xc
push 0
push 0x89
jmp 0x58032b
call fcn.005b5560
push str.BIO_connect
push 0x56
push str.crypto_bio_bio_sock2.c
call fcn.005b5660
add esp, 0xc
push 0
push 0x87
push 0x20
call fcn.005b5750
add esp, 0xc
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
ret
test bl, 0x10
je 0x5803a8
mov eax, esp
push 4
push eax
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x5803a8
call fcn.005b5560
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.005b5660
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0xa78882
push eax
push 2
call fcn.005b5750
add esp, 0xc
call fcn.005b5560
push str.BIO_connect
push 0x6c
push str.crypto_bio_bio_sock2.c
call fcn.005b5660
add esp, 0xc
push 0
push 0x8a
jmp 0x58032b
mov ebx, dword [esp + 0x18]
push ebx
call fcn.0057ae80
add esp, 4
mov esi, eax
push ebx
call fcn.0057aea0
add esp, 4
push eax
push esi
push edi
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, eax
mov eax, 1
cmp ecx, 0xffffffff
jne 0x580337
push 0xffffffffffffffff
call fcn.00583990
add esp, 4
test eax, eax
jne 0x580335
call fcn.005b5560
push str.BIO_connect
push 0xb2
push str.crypto_bio_bio_sock2.c
call fcn.005b5660
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_connect__
push eax
push 2
call fcn.005b5750
add esp, 0xc
call fcn.005b5560
push str.BIO_connect
push 0xb4
push str.crypto_bio_bio_sock2.c
call fcn.005b5660
add esp, 0xc
push 0
push 0x67
jmp 0x58032b