joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aca90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push 0xffffffffffffffff
push 0x579de8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
push str.ck_getsockname_ipv4
mov ebp, ecx
push esi
lea ecx, [esp + 0x20]
call fcn.00437740
mov ecx, edi
mov dword [esp + 0x40], 0
call fcn.0042c9c0
mov dword [ebx], 0
mov eax, dword [ebp + 0x294]
or ebp, 0xffffffff
cmp eax, ebp
je 0x4acb78
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x20], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, ebp
je 0x4acb56
test eax, eax
jl 0x4acb56
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, edi
call fcn.0042eba0
mov ecx, dword [esp + 0x26]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
lea ecx, [esp + 0x18]
mov dword [ebx], edx
mov dword [esp + 0x40], ebp
call fcn.004377b0
mov al, 1
jmp 0x4acb95
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push str.Failed_to_getsockname
mov ecx, esi
call edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
push 0
push eax
call fcn.004aae50
add esp, 0xc
jmp 0x4acb86
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push str.Cannot_get_socket_name:_INVALID_SOCKET.
mov ecx, esi
call edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], ebp
call fcn.004377b0
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005550b0
add esp, 0x30
ret 0xc
Function at 0x4acbc0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push 0xffffffffffffffff
push 0x579e18
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, dword [esp + 0x5c]
mov edi, dword [esp + 0x54]
mov ebx, dword [esp + 0x58]
push str.ck_getsockname_ipv6
mov ebp, ecx
push esi
lea ecx, [esp + 0x20]
call fcn.00437740
mov ecx, edi
mov dword [esp + 0x4c], 0
call fcn.0042c9c0
mov dword [ebx], 0
mov eax, dword [ebp + 0x294]
or ebp, 0xffffffff
cmp eax, ebp
je 0x4acca7
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x20], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, ebp
je 0x4acc85
test eax, eax
jl 0x4acc85
mov ecx, edi
call fcn.0042c9c0
mov edx, edi
lea ecx, [esp + 0x2c]
call fcn.004a9f20
mov eax, dword [esp + 0x26]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
mov dword [ebx], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x4c], ebp
call fcn.004377b0
mov al, 1
jmp 0x4accc4
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Failed_to_getsockname_ipv6
mov ecx, esi
call eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
push 0
push eax
call fcn.004aae50
add esp, 0xc
jmp 0x4accb5
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Cannot_get_socket_name:_INVALID_SOCKET.
mov ecx, esi
call eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x4c], ebp
call fcn.004377b0
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.005550b0
add esp, 0x3c
ret 0xc

Function at 0x4accf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57cbe8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
push str.domainLookup_ipv4
push esi
lea ecx, [esp + 0x14]
call fcn.00437740
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ecx
push esi
push edx
push eax
mov dword [esp + 0x40], 0
call fcn.004ab320
add esp, 0x20
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.004377b0
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x4ad910
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x579f1b
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x164]
mov dword fs:[0], eax
mov eax, dword [esp + 0x178]
mov edi, ecx
cmp dword [edi + 0x294], 0xffffffff
mov ecx, dword [esp + 0x17c]
mov dword [esp + 0x14], ecx
je 0x4ada44
mov ebp, dword [esp + 0x174]
test ebp, ebp
je 0x4ad97f
cmp ebp, 0x7530
jbe 0x4ad984
mov ebp, 0x7530
push eax
lea ecx, [esp + 0x1c]
call fcn.00472330
mov dword [esp + 0x16c], 0
call sub.KERNEL32.dll_GetTickCount
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push 0
push 0x20
lea edx, [esp + 0x148]
mov esi, eax
mov eax, dword [edi + 0x294]
push edx
push eax
call ebx
test eax, eax
je 0x4ad9ff
cmp eax, 0xffffffff
je 0x4ad9c8
test eax, eax
jge 0x4ad9d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4ada30
call sub.KERNEL32.dll_GetTickCount
cmp eax, esi
jae 0x4ad9e0
mov esi, eax
sub eax, esi
cmp eax, ebp
jae 0x4ada30
mov edx, dword [edi + 0x294]
push 0
push 0x20
lea ecx, [esp + 0x148]
push ecx
push edx
call ebx
test eax, eax
jne 0x4ad9bf
mov ecx, dword [esp + 0x14]
cmp byte [ecx + 0x121], 0
je 0x4ada18
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
push str.TCP_connection_cleanly_closed_by_peer.
call edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x16c], 0xffffffff
call fcn.00472410
mov al, 1
jmp 0x4ada46
lea ecx, [esp + 0x18]
mov dword [esp + 0x16c], 0xffffffff
call fcn.00472410
xor al, al
mov ecx, dword [esp + 0x164]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.005550b0
add esp, 0x15c
ret 0xc
Function at 0x4adf70
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0xffffffffffffffff
push 0x577f08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x34]
movzx eax, byte [edi + 0x121]
push eax
push str.createSocket_ipv4
push edi
lea ecx, [esp + 0x20]
call fcn.00437770
xor ebx, ebx
mov dword [esp + 0x28], ebx
call fcn.004aa7f0
test al, al
jne 0x4adfdb
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.004377b0
xor al, al
jmp 0x4ae1ac
mov ecx, esi
call fcn.004ac2f0
mov ebp, dword [sym.imp.WS2_32.dll_socket]
push ebx
push 1
push 2
mov byte [esp + 0x40], 1
call ebp
mov dword [esi + 0x294], eax
cmp eax, 0xffffffff
jne 0x4ae05c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2726
jne 0x4ae01f
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
push str.Retry_with_IPPROTO_TCP_explicitly_specified...
mov ecx, edi
call eax
jmp 0x4ae04e
cmp ebx, 0x2734
jne 0x4ae05c
push 0x14
call fcn.004357f0
add esp, 4
push 0
push 1
push 2
call ebp
mov dword [esi + 0x294], eax
cmp eax, 0xffffffff
jne 0x4ae05c
push 0x14
call fcn.004357f0
add esp, 4
push 6
push 1
push 2
call ebp
mov dword [esi + 0x294], eax
cmp dword [esi + 0x294], 0xffffffff
jne 0x4ae0c9
cmp ebx, 0x276d
jne 0x4ae0a4
mov ecx, edi
call fcn.004aa600
test al, al
jne 0x4ae07f
push str.startupWSA_failed__B_
jmp 0x4ae0bb
push 0
push 1
push 2
call ebp
mov dword [esi + 0x294], eax
cmp eax, 0xffffffff
jne 0x4ae0c9
push edi
push 0
call fcn.004aca70
add esp, 8
push str.Failed_to_create_TCP_socket__AF_INET_SOCK_STREAM_
jmp 0x4ae0bb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push 0
push eax
call fcn.004aae50
add esp, 0xc
push str.Failed_to_create_TCP_socket__AF_INET___SOCK_STREAM_
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
mov byte [esp + 0x34], 0
cmp dword [esi + 0x294], 0xffffffff
mov dword [esi + 0x298], 2
je 0x4ae197
mov ebp, dword [esp + 0x30]
cmp byte [ebp + 0xb90], 0
jne 0x4ae0f5
push edi
mov ecx, esi
call fcn.004aaa90
cmp byte [ebp + 0xb98], 0
jne 0x4ae106
push edi
mov ecx, esi
call fcn.004aab10
cmp byte [esp + 0x38], 0
je 0x4ae197
lea ebx, [ebp + 0xb9c]
mov ecx, ebx
call fcn.0042bab0
test eax, eax
jne 0x4ae12a
cmp dword [ebp + 0xc10], eax
je 0x4ae197
push ebx
push str.bindIpAddr1
mov ecx, edi
call fcn.004370f0
mov eax, dword [ebp + 0xc10]
test eax, eax
je 0x4ae14e
push eax
push str.bindPort
mov ecx, edi
call fcn.004373b0
push edi
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebx
mov byte [esp + 0x40], 0
call fcn.0051b3b0
movzx edx, word [ebp + 0xc10]
push eax
push edx
mov ecx, esi
call fcn.004ad450
mov byte [esp + 0x34], al
test al, al
jne 0x4ae197
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
push str.Failed_to_bind_to_local_IP_address
mov ecx, edi
call edx
mov ecx, esi
call fcn.004ac2f0
mov dword [esi + 0x294], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.004377b0
mov al, byte [esp + 0x34]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x4ae430
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [ecx + 0x298], 2
jne 0x4ae43e
jmp fcn.004aca90
jmp fcn.004acbc0
Function at 0x4aede0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x579fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
mov esi, ecx
mov eax, dword [esi + 0x294]
cmp eax, 0xffffffff
jne 0x4aee28
mov byte [esi + 0x290], 0
cmp byte [esi + 0x290], 0
je 0x4aee68
cmp byte [esi + 0xd6], 0
jne 0x4aee68
cmp byte [esi + 0xd5], 0
jne 0x4aeeb9
cmp byte [esi + 0xd4], 0
jne 0x4aeeb9
push 2
push 1
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x4aee6c
push edi
mov ecx, esi
call fcn.004ad620
xor al, al
jmp 0x4aeebb
cmp eax, 0xffffffff
je 0x4aee75
test eax, eax
jge 0x4aeeb9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4aeeb9
push str.isConnected_recv_peek
push edi
lea ecx, [esp + 0x14]
call fcn.00437740
push edi
push 0
mov dword [esp + 0x34], 0
call fcn.004aca70
add esp, 8
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004377b0
xor al, al
jmp 0x4aeebb
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005550b0
add esp, 0x24
ret 4
Function at 0x4b4b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57ace6
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov edi, dword [esp + 0xb4]
mov esi, dword [esp + 0xb8]
lea ecx, [esp + 0xc]
call fcn.00447240
push 0
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0
call fcn.00447e40
push 0
lea ecx, [esp + 0x10]
call fcn.00447e40
push 0
lea ecx, [esp + 0x10]
call fcn.00447e40
push 7
lea ecx, [esp + 0x10]
call fcn.00447e40
push 7
push str.ssh_rsa
lea ecx, [esp + 0x14]
call fcn.00448260
lea eax, [esp + 0xc]
push eax
lea ecx, [edi + 0x84]
call fcn.004b4a20
lea ecx, [esp + 0x10]
push ecx
lea ecx, [edi + 0x98]
call fcn.004b4a20
add esp, 8
lea ecx, [esp + 0x28]
call fcn.0048ea60
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xb4], 1
call fcn.0048ed60
mov ecx, esi
call fcn.0042c960
push 0x5d5950
mov ecx, esi
call fcn.0042cd60
mov ecx, edi
call fcn.004b8a40
push eax
mov ecx, esi
call fcn.0042ff90
push 0x20
mov ecx, esi
call fcn.0042f880
push esi
push 1
lea ecx, [esp + 0x8c]
push 0x10
push ecx
call fcn.00448d10
add esp, 0x10
mov ecx, esi
call fcn.0042e860
lea ecx, [esp + 0x28]
mov byte [esp + 0xac], 0
call fcn.0048ea90
lea ecx, [esp + 0xc]
mov dword [esp + 0xac], 0xffffffff
call fcn.004479b0
mov al, 1
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005550b0
add esp, 0xa4
ret
Function at 0x4ba610
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx + 0x10], 0x67452301
mov dword [ecx + 0x14], 0xefcdab89
mov dword [ecx + 0x18], 0x98badcfe
mov dword [ecx + 0x1c], 0x10325476
mov dword [ecx + 0x20], 0xc3d2e1f0
mov dword [ecx + 0x24], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
ret
Function at 0x4bb430
Capabilities:
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x57b2e8
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
mov ebx, dword [esp + 0xa0]
mov edi, dword [esp + 0xa4]
mov ebp, dword [esp + 0xa8]
push 0x40
xor esi, esi
mov dword [esp + 0x24], eax
xor eax, eax
lea edx, [esp + 0x50]
push esi
push edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], vtable._ckSha1.0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call fcn.00554cc0
push 0x4e28
mov dword [esp + 0xa8], esi
mov dword [esp + 0x44], 0x67452301
mov dword [esp + 0x48], 0xefcdab89
mov dword [esp + 0x4c], 0x98badcfe
mov dword [esp + 0x50], 0x10325476
mov dword [esp + 0x54], 0xc3d2e1f0
mov dword [esp + 0x58], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
call fcn.004144e0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4bb512
xor al, al
jmp 0x4bb5c3
mov ecx, ebx
mov dword [esp + 0x18], 0
mov byte [esp + 0x17], 1
call fcn.004f3490
test al, al
jne 0x4bb5a6
lea ebx, [ebx]
push ebp
push edi
lea eax, [esp + 0x20]
push eax
push 0x4e20
push esi
mov ecx, ebx
call fcn.004f3f80
test al, al
je 0x4bb5a6
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4bb585
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4bb563
push eax
push esi
call fcn.00448260
mov eax, dword [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x2c]
call fcn.004baae0
test edi, edi
je 0x4bb585
mov ecx, dword [esp + 0x18]
push ebp
push 0
push ecx
mov ecx, edi
call fcn.004854e0
test al, al
jne 0x4bb592
mov ecx, ebx
call fcn.004f3490
test al, al
je 0x4bb530
jmp 0x4bb5a6
mov edx, dword [ebp]
mov eax, dword [edx + 0x14]
push str.Digest_SHA1_aborted_by_application
mov ecx, ebp
call eax
mov byte [esp + 0x17], 0
push esi
call fcn.00554bd9
mov ecx, dword [esp + 0x24]
add esp, 4
push 0
push ecx
lea ecx, [esp + 0x2c]
call fcn.004bb060
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.005550b0
add esp, 0x88
ret
Function at 0x4bb5f0
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x57b328
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov edi, dword [esp + 0x94]
mov esi, dword [esp + 0x90]
push 0x14
mov ecx, edi
call fcn.0044bb40
mov ebx, eax
xor ebp, ebp
cmp ebx, ebp
je 0x4bb6de
xor eax, eax
push 0x40
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x40]
push ebp
push eax
mov dword [esp + 0x20], vtable._ckSha1.0
call fcn.00554cc0
add esp, 0xc
mov ecx, esi
mov dword [esp + 0x88], ebp
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
mov dword [esp + 0x34], 0xc3d2e1f0
mov dword [esp + 0x38], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.0051d090
push eax
mov ecx, esi
call fcn.00446f60
push eax
lea ecx, [esp + 0x1c]
call fcn.004baae0
push ebp
push ebx
lea ecx, [esp + 0x1c]
call fcn.004bb060
push 0x14
mov ecx, edi
call fcn.00446f70
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005550b0
add esp, 0x78
ret

Function at 0x4bb700
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x6c
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
mov esi, dword [esp + 0x74]
xor eax, eax
push edi
mov edi, dword [esp + 0x80]
push 0x40
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x14], vtable._ckSha1.0
call fcn.00554cc0
mov ecx, dword [esp + 0x88]
add esp, 0xc
push ecx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x34], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.004baae0
push 0
push edi
lea ecx, [esp + 0x10]
call fcn.004bb060
mov ecx, dword [esp + 0x70]
pop edi
pop esi
xor ecx, esp
call fcn.005550b0
add esp, 0x6c
ret
Function at 0x4bb7c0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x70
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x78]
push ebx
mov ebx, dword [esp + 0x78]
push edi
mov dword [esp + 8], eax
xor eax, eax
push 0x40
push eax
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x18], vtable._ckSha1.0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.00554cc0
xor edi, edi
add esp, 0xc
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
mov dword [esp + 0x2c], 0xc3d2e1f0
mov dword [esp + 0x30], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
cmp dword [ebx + 0x804], edi
jbe 0x4bb880
push esi
lea esi, [ebx + 4]
jmp 0x4bb860
mov edx, dword [esi + 0x400]
mov eax, dword [esi]
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.004baae0
inc edi
add esi, 4
cmp edi, dword [ebx + 0x804]
jb 0x4bb860
pop esi
mov ecx, dword [esp + 8]
push 0
push ecx
lea ecx, [esp + 0x14]
call fcn.004bb060
mov ecx, dword [esp + 0x74]
pop edi
pop ebx
xor ecx, esp
call fcn.005550b0
add esp, 0x70
ret
Function at 0x4c35c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x57ba76
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.TlsRawRecord.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
call fcn.00447240
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call fcn.00447240
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 1
call fcn.00447240
mov byte [esi + 0x68], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4c3640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57bab6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.TlsRawRecord.0
lea ecx, [esi + 0x4c]
mov dword [esp + 0x14], 1
call fcn.004479b0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.004479b0
lea ecx, [esi + 0x14]
mov dword [esp + 0x14], 0xffffffff
call fcn.004479b0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4c3750
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x57bb39
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00412750
xor ebx, ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.TlsServerHello.0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.00447240
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 1
call fcn.00447240
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 2
mov dword [esi + 0x6c], ebx
call fcn.00447240
lea ecx, [esi + 0x94]
mov byte [esp + 0x18], 3
mov byte [esi + 0x8e], bl
mov byte [esi + 0x8f], bl
mov byte [esi + 0x90], bl
mov byte [esi + 0x91], bl
call fcn.00447240
mov byte [esi + 0xb0], bl
mov byte [esi + 0xb1], bl
mov byte [esi + 0x8c], bl
mov byte [esi + 0x8d], bl
mov dword [esi + 0x28], 2
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4c3930
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x57bc17
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00412750
xor ebx, ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.TlsServerKeyExchange.0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.00447240
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 1
call fcn.00447240
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 2
call fcn.00447240
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 3
call fcn.00447240
lea ecx, [esi + 0xa4]
mov byte [esp + 0x18], 4
call fcn.00447240
mov byte [esi + 0xc0], bl
mov dword [esi + 0xc4], ebx
mov dword [esi + 0x1c8], ebx
mov dword [esi + 0x28], 0xc
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4c7660
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x582ee8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 0x304]
test edi, edi
je 0x4c7698
cmp byte [esp + 0x38], 0
je 0x4c76a5
lea ecx, [esi + 0x2e4]
call fcn.0051d090
mov edi, eax
lea ecx, [esp + 0xc]
call fcn.00447240
push 0x40
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
mov byte [esp + 0x28], 1
call fcn.0044b660
test al, al
jne 0x4c76f1
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004479b0
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x14
cmp dword [esi + 0x5c], 2
jne 0x4c7700
lea eax, [esp + 0xc]
push eax
push 2
jmp 0x4c7707
lea ecx, [esp + 0xc]
push ecx
push 7
push edi
lea ecx, [esi + 0x2e4]
call fcn.00446f60
push eax
call fcn.00468990
add esp, 0x10
cmp byte [esp + 0x3c], 0
mov edi, str.client_finished
jne 0x4c772d
mov edi, str.server_finished
mov edx, dword [esi + 0x74]
mov eax, dword [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0x14]
call fcn.0051d090
push eax
lea ecx, [esp + 0x18]
call fcn.00446f60
push eax
push edi
push 0x30
lea ecx, [esi + 0x2c8]
call fcn.00446f60
push eax
mov ecx, esi
call fcn.004bee50
mov ecx, dword [esi + 0x74]
mov edx, dword [esp + 0x48]
mov dword [edx], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004479b0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x14