joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55ea80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x7db1e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
push 0x73a9f8
push eax
lea ecx, [edi + 0x18]
lea ebx, [edi + 0x50]
mov dword [ebp - 0x80], ecx
call fcn.007003d9
mov esi, eax
add esp, 8
mov dword [ebp - 0x84], esi
test esi, esi
jne 0x55eb07
mov ebx, dword [ebp - 0x80]
test ebx, ebx
je 0x55eaf2
call fcn.006fba38
push dword [eax]
call fcn.006fc12d
mov edx, eax
add esp, 4
lea esi, [edx + 1]
nop dword [eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x55eae0
sub edx, esi
mov ecx, ebx
push edx
push eax
call fcn.0044f130
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4db8
mov esp, ebp
pop ebp
ret 4
test ebx, ebx
je 0x55eb12
mov ecx, dword [ebx]
mov dword [ebp - 0x80], ecx
jmp 0x55eb19
mov dword [ebp - 0x80], 0
cmp dword [edi + 0x14], 0x10
xorps xmm0, xmm0
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0
mov eax, edi
mov dword [edi + 0x10], 0
jb 0x55eb38
mov eax, dword [edi]
push 2
push 0
push esi
mov byte [eax], 0
call fcn.007009e8
push esi
call fcn.00701086
push 0
push 0
push esi
mov ebx, eax
call fcn.007009e8
add esp, 0x1c
test ebx, ebx
je 0x55eb90
push ebx
call fcn.006f4bad
push dword [ebp - 0x84]
mov esi, eax
push 1
push ebx
push esi
call fcn.007005d6
add esp, 0x14
mov ecx, edi
push ebx
push esi
call fcn.0044f130
push esi
call fcn.006f4bb6
mov esi, dword [ebp - 0x84]
add esp, 4
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x7c]
push str._s_d_bytes
push eax
call fcn.004fbfd0
lea ebx, [edi + 0x18]
add esp, 0x10
test ebx, ebx
je 0x55ebc8
lea ecx, [ebp - 0x7c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x55ebb3
sub ecx, edx
lea eax, [ebp - 0x7c]
push ecx
push eax
mov ecx, ebx
call fcn.0044f130
push esi
call fcn.007001bb
lea eax, [edi + 0x50]
add esp, 4
test eax, eax
je 0x55ebdd
mov ecx, dword [ebp - 0x80]
mov dword [eax], ecx
mov ecx, edi
call fcn.0055fc90
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f4db8
mov esp, ebp
pop ebp
ret 4

Function at 0x561890
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
sub edi, edx
xor esi, esi
cmp edx, dword [ebp + 0xc]
cmova edi, ebx
test edi, edi
je 0x5618c3
nop
movsx ecx, byte [edx]
lea edx, [edx + 1]
imul eax, eax, 0x1000193
inc esi
xor eax, ecx
cmp esi, edi
jb 0x5618b0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x562390
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72b1a5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x7db1e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x5623ea
mov dword [esi + 4], 0x742c10
mov dword [esi + 0x90], vtable.cmx::TStreamStatus.0
mov dword [esi + 0x94], 0
mov dword [ebp - 0x10], 1
mov eax, dword [esi + 4]
mov dword [esi], vtable.cmx::TWriteStream.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.cmx::TWriteStream.1.0
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 8]
and eax, 0xfffffff9
or eax, 1
mov dword [ecx + esi + 8], eax
mov eax, dword [esi + 4]
mov dword [esi], vtable.cmx::TChecksumBase.1.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.cmx::TChecksumBase.0
mov eax, dword [esi + 4]
lea ecx, [esi + 0x78]
mov dword [esi], vtable.cmx::TSHA1Checksum.0
mov dword [ebp - 4], 1
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.cmx::TSHA1Checksum.1.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [esi + 0x20], 0
xorps xmm0, xmm0
mov dword [esi + 0x1c], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
push 0
movups xmmword [esi + 0x64], xmm0
push 0x7c4968
mov byte [ebp - 4], 2
mov dword [esi + 0x74], 0
call fcn.0044f130
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x562690
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 0x20], 0
xorps xmm0, xmm0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], 0xc3d2e1f0
movups xmmword [ecx + 0x64], xmm0
push 0
mov dword [ecx + 0x74], 0
add ecx, 0x78
push 0x7c4968
call fcn.0044f130
ret
Function at 0x5637b0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov dword [ebp - 4], esi
je 0x5637db
mov dword [esi + 4], 0x742c18
mov dword [esi + 0x98], vtable.cmx::TStreamStatus.0
mov dword [esi + 0x9c], 0
mov eax, dword [esi + 4]
mov dword [esi], vtable.cmx::TWriteStream.0
push 0x40
push 0
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.cmx::TWriteStream.1.0
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 8]
and eax, 0xfffffff9
or eax, 1
mov dword [ecx + esi + 8], eax
mov eax, dword [esi + 4]
mov dword [esi], vtable.cmx::TChecksumBase.1.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.cmx::TChecksumBase.0
mov eax, dword [esi + 4]
mov dword [esi], vtable.cmx::TRMD160Checksum.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.cmx::TRMD160Checksum.1.0
lea eax, [esi + 0x1c]
push eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.006f7570
push 0x29
lea eax, [esi + 0x68]
push 0
push eax
call fcn.006f7570
add esp, 0x18
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov eax, esi
mov dword [esi + 0x64], 0
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x564f40
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x1c]
mov dword [esi + 8], 0x67452301
push eax
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.006f7570
push 0x29
lea eax, [esi + 0x68]
push 0
push eax
call fcn.006f7570
add esp, 0x18
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
pop esi
ret
Function at 0x56a4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
add edi, ebx
lea esi, [ebx + 8]
cmp esi, edi
ja 0x56a4d7
lea ebx, [ecx + 0x78]
nop word [eax + eax]
push ebx
push eax
push eax
call fcn.00569a90
mov eax, esi
add esp, 0xc
lea esi, [eax + 8]
cmp esi, edi
jbe 0x56a4c0
mov ebx, dword [ebp + 8]
mov edx, edi
xor esi, esi
sub edx, eax
xor ecx, ecx
cmp eax, edi
cmova edx, esi
test edx, edx
je 0x56a549
cmp edx, 0x40
jb 0x56a538
movaps xmm1, xmmword [0x743400]
mov esi, edx
and esi, 0xffffffc0
nop dword [eax]
movups xmm0, xmmword [eax]
add ecx, 0x40
pxor xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [eax + 0x10]
pxor xmm0, xmm1
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
pxor xmm0, xmm1
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
pxor xmm0, xmm1
movups xmmword [eax + 0x30], xmm0
add eax, 0x40
cmp ecx, esi
jb 0x56a500
cmp ecx, edx
jae 0x56a549
nop dword [eax]
xor byte [eax], 0xc5
inc ecx
inc eax
cmp ecx, edx
jb 0x56a540
pop edi
pop esi
sub eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x56a560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72b1c8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x7db1e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x40]
call fcn.0055d0f0
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x10]
shr eax, 2
lea eax, [eax + eax*2]
push eax
call fcn.0055d550
push dword [ebp - 0x28]
push dword [ebp - 0x30]
push esi
call fcn.005575f0
mov ecx, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x14], eax
lea edi, [ecx + eax]
lea esi, [ecx + 8]
cmp esi, edi
ja 0x56a5f7
mov eax, dword [ebp - 0x10]
add eax, 0x78
mov dword [ebp - 0x10], eax
nop word [eax + eax]
push eax
push ecx
push ecx
call fcn.00569a90
mov eax, dword [ebp - 0x10]
mov ecx, esi
add esp, 0xc
lea esi, [ecx + 8]
cmp esi, edi
jbe 0x56a5e0
mov edx, edi
xor esi, esi
sub edx, ecx
xor eax, eax
cmp ecx, edi
cmova edx, esi
test edx, edx
je 0x56a66b
cmp edx, 0x40
jb 0x56a658
movaps xmm1, xmmword [0x743400]
mov esi, edx
and esi, 0xffffffc0
nop dword [eax]
movups xmm0, xmmword [ecx]
add eax, 0x40
pxor xmm0, xmm1
movups xmmword [ecx], xmm0
movups xmm0, xmmword [ecx + 0x10]
pxor xmm0, xmm1
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [ecx + 0x20]
pxor xmm0, xmm1
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [ecx + 0x30]
pxor xmm0, xmm1
movups xmmword [ecx + 0x30], xmm0
add ecx, 0x40
cmp eax, esi
jb 0x56a620
cmp eax, edx
jae 0x56a66b
nop dword [eax]
xor byte [ecx], 0xc5
lea ecx, [ecx + 1]
inc eax
cmp eax, edx
jb 0x56a660
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x30]
call fcn.0044f130
lea ecx, [ebp - 0x1c]
call fcn.0055d210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x56a6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
add edi, ebx
lea esi, [ebx + 8]
cmp esi, edi
ja 0x56a6d7
lea ebx, [ecx + 0x10]
nop word [eax + eax]
push ebx
push eax
push eax
call fcn.00569a90
mov eax, esi
add esp, 0xc
lea esi, [eax + 8]
cmp esi, edi
jbe 0x56a6c0
mov ebx, dword [ebp + 8]
mov edx, edi
xor esi, esi
sub edx, eax
xor ecx, ecx
cmp eax, edi
cmova edx, esi
test edx, edx
je 0x56a749
cmp edx, 0x40
jb 0x56a738
movaps xmm1, xmmword [0x743400]
mov esi, edx
and esi, 0xffffffc0
nop dword [eax]
movups xmm0, xmmword [eax]
add ecx, 0x40
pxor xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [eax + 0x10]
pxor xmm0, xmm1
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
pxor xmm0, xmm1
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
pxor xmm0, xmm1
movups xmmword [eax + 0x30], xmm0
add eax, 0x40
cmp ecx, esi
jb 0x56a700
cmp ecx, edx
jae 0x56a749
nop dword [eax]
xor byte [eax], 0xc5
inc ecx
inc eax
cmp ecx, edx
jb 0x56a740
pop edi
pop esi
sub eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x56a760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72b1f8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x7db1e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
call fcn.0055d0f0
mov esi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0x10
jb 0x56a7aa
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x34]
push eax
call fcn.0055d710
mov eax, dword [ebp - 0x2c]
mov edi, dword [esi + 0x10]
add edi, eax
lea esi, [eax + 8]
cmp esi, edi
ja 0x56a7e7
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [ebp - 0x10], ecx
nop
push ecx
push eax
push eax
call fcn.00569a90
mov ecx, dword [ebp - 0x10]
mov eax, esi
add esp, 0xc
lea esi, [eax + 8]
cmp esi, edi
jbe 0x56a7d0
mov edx, edi
xor esi, esi
sub edx, eax
xor ecx, ecx
cmp eax, edi
cmova edx, esi
test edx, edx
je 0x56a85b
cmp edx, 0x40
jb 0x56a848
movaps xmm1, xmmword [0x743400]
mov esi, edx
and esi, 0xffffffc0
nop dword [eax]
movups xmm0, xmmword [eax]
add ecx, 0x40
pxor xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [eax + 0x10]
pxor xmm0, xmm1
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
pxor xmm0, xmm1
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
pxor xmm0, xmm1
movups xmmword [eax + 0x30], xmm0
add eax, 0x40
cmp ecx, esi
jb 0x56a810
cmp ecx, edx
jae 0x56a85b
nop dword [eax]
xor byte [eax], 0xc5
lea eax, [eax + 1]
inc ecx
cmp ecx, edx
jb 0x56a850
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0x7c4968
call fcn.0044f130
push esi
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00557880
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0055d210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5b71f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18
call fcn.006f5ae0
mov dword [ebp - 8], 0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.005b6cb0
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005b6b90
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5b729c
mov dword [ebp - 0x14], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5b7276
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x5b726a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
shl eax, 3
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005b6c40
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.005b6df0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x5b72aa
mov eax, dword [ebp - 8]
jmp 0x5b735c
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.005b6cb0
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005b6b90
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5b7345
mov dword [ebp - 0x18], 0
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5b731f
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x5b7313
mov edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0x18]
shl ecx, 3
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005b6c40
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.005b6df0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x5b7350
mov eax, dword [ebp - 8]
jmp 0x5b735c
mov edx, dword [ebp + 8]
push edx
call fcn.005b6df0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x5bcdf0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f3108], 0
jne 0x5bce93
mov dword [0x7f3108], 1
push 0x190
push 0
push 0x7f3110
call fcn.006f7570
add esp, 0xc
push 0x7f3110
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x5bce93
call fcn.00576670
push str.BIO_sock_init
push 0x92
push str.crypto_bio_bio_sock.c
call fcn.005766c0
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00576710
add esp, 0xc
call fcn.00576670
push str.BIO_sock_init
push 0x94
push str.crypto_bio_bio_sock.c
call fcn.005766c0
add esp, 0xc
push 0
push 0x7a
push 0x20
call fcn.00576710
add esp, 0xc
or eax, 0xffffffff
jmp 0x5bce98
mov eax, 1
pop ebp
ret

Function at 0x5bcea0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.006f5ae0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x5bcefa
call fcn.00576670
push str.BIO_socket_ioctl
push 0xcf
push str.crypto_bio_bio_sock.c
call fcn.005766c0
add esp, 0xc
push str.calling_ioctlsocket__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00576710
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5be980
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006f5ae0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 0x18]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5bea58
mov eax, dword [ebp - 4]
movsx ecx, word [eax + 8]
cmp ecx, 2
jne 0x5bea38
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0xa]
cmp eax, 4
jne 0x5bea38
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc], edx
jmp 0x5be9f5
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0
je 0x5bea38
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
movzx edx, word [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005be840
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x5bea2b
mov eax, 8
jmp 0x5bea9d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
add edx, 0x1c
mov dword [ebp - 8], edx
jmp 0x5be9ec
push 0x400
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
push 0x401
mov edx, dword [ebp + 0x18]
push edx
call fcn.0070bf3e
add esp, 0x10
xor eax, eax
jmp 0x5bea9d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0x2af9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
ja case.default.0x5bea75
mov ecx, dword [ebp - 0x10]
jmp dword [ecx*4 + 0x5beaa4]
mov eax, 0x2af9
jmp 0x5bea9d
mov eax, 0x2afa
jmp 0x5bea9d
mov eax, 0x2afb
jmp 0x5bea9d
mov eax, 0x2af9
jmp 0x5bea9d
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5df7f0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xec
call fcn.006f5ae0
mov eax, dword [0x7db1e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xe8], 0
mov eax, dword [ebp + 0x14]
push eax
push str.SHA512
mov ecx, dword [ebp + 8]
push ecx
call fcn.0057afc0
add esp, 0xc
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jne 0x5df83c
xor eax, eax
jmp 0x5df91b
push 0
mov edx, dword [ebp - 0xe8]
push edx
push 0
lea eax, [ebp - 0x44]
push eax
push 0x20
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0057a2c0
add esp, 0x18
mov dword [ebp - 0xec], eax
mov edx, dword [ebp - 0xe8]
push edx
call fcn.0057b000
add esp, 4
cmp dword [ebp - 0xec], 0
jne 0x5df88c
push 0x40
lea eax, [ebp - 0x44]
push eax
call fcn.00403ae0
add esp, 8
xor eax, eax
jmp 0x5df91b
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [ebp + edx - 0x44]
and eax, 0xf8
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x44], al
mov eax, 1
imul ecx, eax, 0x1f
movzx edx, byte [ebp + ecx - 0x44]
and edx, 0x3f
mov eax, 1
imul ecx, eax, 0x1f
mov byte [ebp + ecx - 0x44], dl
mov edx, 1
imul eax, edx, 0x1f
movzx ecx, byte [ebp + eax - 0x44]
or ecx, 0x40
mov edx, 1
imul eax, edx, 0x1f
mov byte [ebp + eax - 0x44], cl
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xe4]
push edx
call fcn.005df270
add esp, 8
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005df190
add esp, 8
push 0x40
lea edx, [ebp - 0x44]
push edx
call fcn.00403ae0
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4db8
mov esp, ebp
pop ebp
ret
Function at 0x5ef610
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.006f5ae0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [ebp + 0x14]
jne 0x5ef648
mov edx, dword [ebp - 8]
movzx eax, byte [edx]
cmp eax, 0x6a
je 0x5ef67a
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx]
cmp edx, 0x6b
je 0x5ef67a
call fcn.00576670
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.005766c0
add esp, 0xc
push 0
push 0x89
push 4
call fcn.00576710
add esp, 0xc
or eax, 0xffffffff
jmp 0x5ef7b7
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 0x14], 0x6b
jne 0x5ef757
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x5ef6b1
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
jge 0x5ef717
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 1], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
movzx eax, byte [ebp - 1]
cmp eax, 0xba
jne 0x5ef6d7
jmp 0x5ef717
movzx ecx, byte [ebp - 1]
cmp ecx, 0xbb
je 0x5ef715
call fcn.00576670
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.005766c0
add esp, 0xc
push 0
push 0x8a
push 4
call fcn.00576710
add esp, 0xc
or eax, 0xffffffff
jmp 0x5ef7b7
jmp 0x5ef6a8
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x10], 0
jne 0x5ef755
call fcn.00576670
push str.RSA_padding_check_X931
push 0x56
push str.crypto_rsa_rsa_x931.c
call fcn.005766c0
add esp, 0xc
push 0
push 0x8a
push 4
call fcn.00576710
add esp, 0xc
or eax, 0xffffffff
jmp 0x5ef7b7
jmp 0x5ef760
mov eax, dword [ebp + 0x14]
sub eax, 2
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp edx, 0xcc
je 0x5ef7a0
call fcn.00576670
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.005766c0
add esp, 0xc
push 0
push 0x8b
push 4
call fcn.00576710
add esp, 0xc
or eax, 0xffffffff
jmp 0x5ef7b7
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006f6ff0
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x5f21d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.006f5ae0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x5f2244
cmp dword [ebp + 0xc], 0
je 0x5f2244
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
and edx, 0
je 0x5f221c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00701442
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x5f2238
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00701442
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5f2244
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x602230
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.006f5ae0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov ecx, dword [ebp + 8]
push ecx
call fcn.005912c0
add esp, 8
cmp dword [ebp - 4], 0
jg 0x602298
mov edx, dword [ebp - 4]
push edx
call fcn.00602630
add esp, 4
test eax, eax
je 0x602298
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00591e10
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret