joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a6d30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x28]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x1c]
mov byte [ecx], 0
push edi
mov edi, dword [ebp + 0x24]
mov byte [ebx], 0
mov byte [edi], 0
mov byte [eax], 0
cmp dword [esi + 0xa4], 0xffffffff
jne 0x5a6d84
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push str.This_socket_is_not_connected
call eax
mov byte [edi], 1
pop edi
mov byte [esi + 0xa0], 0
pop esi
xor al, al
pop ebx
pop ebp
ret 0x24
mov dword [0x7202e4], 0x6e
mov eax, dword [esi + 0x118]
test eax, eax
jne 0x5a6d9d
mov eax, 0x1499700
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push edi
push ecx
mov ecx, dword [ebp + 0x24]
push ebx
push ecx
push edx
push eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, esi
call fcn.005a66b0
test al, al
je 0x5a6dec
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
push ebx
push edx
lea ecx, [esi + 0xf0]
push eax
mov dword [0x7202e4], 0x6f
call fcn.005f3f40
cmp byte [ebx], 0
je 0x5a6dfe
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
push str.Aborted_by_application_while_download_throttling__2_
mov ecx, edi
call eax
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx], 0
xor al, al
pop ebx
pop ebp
ret 0x24
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [0x7202e4], 0x70
mov edx, dword [ebx]
mov ecx, dword [esi + 0xa4]
push 0
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x5a6e93
mov dword [0x7202e4], 0x72
mov eax, dword [ebx]
mov edx, dword [edi]
mov edx, dword [edx + 0x2c]
push eax
push str.numBytesRequested
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
push str.Connection_closed_by_server.
mov ecx, edi
call edx
mov eax, dword [esi + 0xa4]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [esi + 0xa4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp + 0x28]
mov dword [esi + 0xa4], 0xffffffff
mov byte [esi + 0xa0], 0
pop edi
mov byte [edx], 1
pop esi
mov dword [ebx], 0
xor al, al
pop ebx
pop ebp
ret 0x24
cmp eax, 0xffffffff
jne 0x5a6eda
mov ecx, edi
call fcn.00561e70
mov ecx, dword [ebx]
mov eax, dword [edi]
mov edx, dword [eax + 0x2c]
push ecx
push str.numBytesRequested
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
push str.Failed_to_receive_data_on_the_TCP_socket
mov ecx, edi
call edx
mov eax, dword [ebp + 0x24]
mov byte [eax], 1
mov dword [ebx], 0
pop edi
mov byte [esi + 0xa0], 0
pop esi
xor al, al
pop ebx
pop ebp
ret 0x24
mov dword [ebx], eax
mov dword [0x7202e4], 0x71
test eax, eax
jle 0x5a6f0f
push eax
lea ecx, [esi + 0xf0]
call fcn.005f3ed0
cmp byte [esi + 0x184], 0
je 0x5a6f0f
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
push ecx
push edx
lea ecx, [esi + 0x10]
call fcn.005ab480
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x5a6f22
mov eax, dword [ebp + 0x20]
mov edx, dword [ebx]
push eax
push edx
call fcn.0056d9e0
pop edi
pop esi
mov dword [0x7202e4], 0x73
mov al, 1
pop ebx
pop ebp
ret 0x24
Function at 0x5a6f40
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0x7d0
mov edi, ecx
call fcn.00419f69
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x5a6f76
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.Socket_receive_memory_allocation_failed.
call edx
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
call sub.KERNEL32.dll_GetTickCount
mov esi, eax
mov dword [ebp - 8], esi
call sub.KERNEL32.dll_GetTickCount
cmp eax, esi
jae 0x5a6f8f
mov dword [ebp - 8], eax
jmp 0x5a6f9a
sub eax, esi
cmp eax, 0x64
ja 0x5a7099
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 1]
push eax
push edx
lea ecx, [edi + 0xf0]
push 0
call fcn.005f3f40
cmp byte [ebp - 1], 0
jne 0x5a7019
mov eax, dword [edi + 0xa4]
push 0
push 0x7d0
push ebx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
je 0x5a7033
cmp esi, 0xffffffff
je 0x5a7083
test esi, esi
jle 0x5a6ffb
call sub.KERNEL32.dll_GetTickCount
cmp byte [edi + 0x184], 0
mov dword [ebp - 8], eax
je 0x5a6ffb
mov ecx, dword [ebp + 0x10]
push ecx
push esi
lea ecx, [edi + 0x10]
call fcn.005ab480
push esi
lea ecx, [edi + 0xf0]
call fcn.005f3ed0
mov ecx, dword [ebp + 8]
push esi
push ebx
call fcn.00540eb0
mov esi, dword [ebp - 8]
jmp 0x5a6f81
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push str.Aborted_by_application_while_download_throttling__3_
call eax
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0xa4]
push 2
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [edi + 0xa4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
push ebx
mov dword [edi + 0xa4], 0xffffffff
mov byte [edi + 0xa0], 0
call fcn.00419f98
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esp, 4
push str.Socket_already_closed_by_peer.
call edx
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x5a70a4
push ebx
call fcn.00419f98
add esp, 4
pop esi
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 0xc]
push esi
push eax
call fcn.005a5550
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
add esp, 8
push str.Failed_to_accumulate_data_on_socket.
mov ecx, esi
call edx
push ebx
call fcn.00419f98
add esp, 4
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5a7a30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 0x18], eax
call fcn.0053aff0
mov dword [edi], 0
mov eax, dword [ebx + 0xa4]
cmp eax, 0xffffffff
je 0x5a7add
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
push eax
mov dword [ebp - 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x5a7aa7
mov esi, dword [ebp - 0x18]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_getsockname
mov ecx, esi
call edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
push eax
call fcn.005a5550
add esp, 8
jmp 0x5a7aec
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, esi
call fcn.0053cb20
mov ecx, dword [ebp - 0x12]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
mov dword [edi], edx
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00521602
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.Cannot_get_socket_name:_INVALID_SOCKET.
call edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.00521602
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5a7b10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 0x24], eax
call fcn.0053aff0
mov dword [edi], 0
mov eax, dword [ebx + 0xa4]
cmp eax, 0xffffffff
je 0x5a7bbc
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x20]
push edx
push eax
mov dword [ebp - 0x28], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x5a7b87
mov esi, dword [ebp - 0x24]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_getsockname_ipv6
mov ecx, esi
call edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
push eax
call fcn.005a5550
add esp, 8
jmp 0x5a7bcb
mov ecx, esi
call fcn.0053aff0
mov edx, esi
lea ecx, [ebp - 0x18]
call fcn.005a4a40
mov eax, dword [ebp - 0x1e]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00521602
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push str.Cannot_get_socket_name:_INVALID_SOCKET.
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.00521602
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5a7fb0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x11c], ebx
cmp ebx, esi
jne 0x5a800c
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x109]
push eax
push esi
push esi
push edx
call fcn.005a6510
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00521602
mov esp, ebp
pop ebp
ret 0x18
push edi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
cmp dword [ebp + 8], esi
jbe 0x5a817c
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x5a8050
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp + 0x18]
jae 0x5a8050
lea ecx, [ebp - 0x109]
push ecx
push edi
mov ecx, ebx
mov byte [ebp - 0x109], 0
call fcn.0056d9e0
add dword [ebp - 0x114], edi
mov eax, dword [ebp + 8]
lea edx, [esi + 0xc8]
mov edi, 0xc8
cmp edx, eax
jbe 0x5a8070
mov edi, eax
sub edi, esi
cmp edi, 0xa
jae 0x5a8070
mov edi, 0xa
push 0x78
push 0
mov ecx, ebx
mov esi, edi
call fcn.0056d720
mov ecx, ebx
call fcn.0056d4d0
test al, al
je 0x5a80a1
mov ecx, dword [ebp - 0x110]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.Wait_for_data_aborted_by_app
call edx
xor bl, bl
jmp 0x5a8133
mov ebx, dword [ebp - 0x120]
mov ecx, dword [ebx + 0xa4]
cmp ecx, 0xffffffff
je 0x5a816a
test edi, edi
jne 0x5a80bf
mov esi, 0x14
mov eax, 0x10624dd3
mul esi
shr edx, 6
mov eax, edx
imul eax, eax, 0xfffffc18
add esi, eax
cmp esi, 0x7a120
jbe 0x5a80e0
mov esi, 0x7a120
imul esi, esi, 0x3e8
test edx, edx
jne 0x5a80f3
test esi, esi
jne 0x5a80f3
mov esi, 0x3e8
mov dword [ebp - 0x104], ecx
lea ecx, [ebp - 0x128]
push ecx
push 0
mov dword [ebp - 0x128], edx
push 0
lea edx, [ebp - 0x108]
push edx
push 0
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x5a8191
test eax, eax
setne bl
mov ecx, dword [ebp - 0x11c]
call fcn.0056d4d0
test al, al
jne 0x5a817c
test bl, bl
jne 0x5a81d2
mov eax, dword [ebp - 0x118]
add eax, edi
mov dword [ebp - 0x118], eax
cmp eax, dword [ebp + 8]
jae 0x5a817c
mov ebx, dword [ebp - 0x11c]
mov esi, eax
jmp 0x5a8022
mov ecx, dword [ebp - 0x110]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.Wait_for_data_passed_invalid_socket.
call edx
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00521602
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp - 0x110]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.The_peer_has_closed_the_socket__TCP__connection
call edx
mov eax, dword [ebx + 0xa4]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [ebx + 0xa4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx + 0xa4], 0xffffffff
mov byte [ebx + 0xa0], 0
jmp 0x5a817c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00521602
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5a8db0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640698
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x703eb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [0x711614], 0
mov edi, dword [ebp + 8]
je 0x5a8e12
mov ecx, edi
call fcn.005a5100
test al, al
jne 0x5a8e12
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
push str.startupWSA_failed.
mov ecx, edi
call edx
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0xa4]
cmp eax, 0xffffffff
je 0x5a8e48
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov eax, dword [esi + 0xa4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
lea ecx, [esi + 0xb0]
mov dword [esi + 0xa4], 0xffffffff
call fcn.005f4120
push 0
push 1
push 2
mov byte [esi + 0xa0], 0
mov bl, 1
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0xa4], eax
cmp eax, 0xffffffff
jne 0x5a8ed5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x276d
jne 0x5a8eb5
mov ecx, edi
call fcn.005a5100
test al, al
jne 0x5a8e87
push str.startupWSA_failed__3_
jmp 0x5a8eca
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0xa4], eax
cmp eax, 0xffffffff
jne 0x5a8ed5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push eax
call fcn.005a5550
add esp, 8
push str.Failed_to_create_TCP_socket__AF_INET_SOCK_STREAM_
jmp 0x5a8eca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push eax
call fcn.005a5550
add esp, 8
push str.Failed_to_create_TCP_socket__AF_INET___SOCK_STREAM_
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
xor bl, bl
mov ecx, esi
mov dword [esi + 0xa8], 2
call fcn.005a52f0
cmp byte [ebp + 0xc], 0
je 0x5a8f9a
lea ecx, [esi + 0x158]
call fcn.0053acf0
test eax, eax
jne 0x5a8f0b
cmp dword [esi + 0x180], eax
je 0x5a8f9a
mov ecx, dword [edi]
mov dword [ebp + 8], ecx
lea ebx, [esi + 0x158]
mov ecx, ebx
call fcn.00595640
mov edx, dword [ebp + 8]
push eax
mov eax, dword [edx + 0x28]
push str.BindIpAddr
mov ecx, edi
call eax
mov eax, dword [esi + 0x180]
test eax, eax
je 0x5a8f46
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x2c]
push str.BindPort
mov ecx, edi
call eax
push edi
mov ecx, ebx
call fcn.00595640
push eax
mov ecx, esi
call fcn.005a7ed0
mov bl, al
test bl, bl
jne 0x5a8f9a
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
push str.Failed_to_bind_to_local_IP_address
mov ecx, edi
call eax
lea ecx, [ebp + 0xc]
call fcn.00561fd0
lea ecx, [ebp + 0xc]
push ecx
push 2
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.005a64c0
or eax, 0xffffffff
lea ecx, [ebp + 0xc]
mov dword [esi + 0xa4], eax
mov dword [ebp - 4], eax
call fcn.00561ff0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5ab340
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 0xc], edi
je 0x5ab475
call sub.KERNEL32.dll_GetTickCount
cmp byte [ebp + 8], 0
jne 0x5ab3aa
cmp eax, dword [esi + 0x18]
jb 0x5ab36c
mov ecx, dword [esi + 0x28]
cmp eax, ecx
jae 0x5ab39d
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
mov dword [esi + 0x18], eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, eax
sub edx, ecx
cmp edx, dword [esi + 0x40]
jb 0x5ab475
mov ecx, dword [esi + 0x20]
push ebx
mov ebx, dword [esi + 0x24]
cmp ebx, edi
jg 0x5ab474
jl 0x5ab3c4
cmp ecx, 0xffffffff
ja 0x5ab474
mov dword [esi + 0x28], eax
sub eax, dword [esi + 0x18]
mov edx, eax
or eax, edi
je 0x5ab474
mov eax, dword [esi + 0x10]
add eax, ecx
mov ecx, dword [esi + 0x14]
adc ecx, ebx
mov ebx, dword [esi + 8]
push 0
add ebx, edx
mov edx, dword [esi + 0xc]
push 0x3e8
push ecx
adc edx, edi
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
mov dword [ebp + 8], edx
call fcn.00525a20
mov ecx, dword [ebp + 8]
push ecx
push ebx
push edx
push eax
call fcn.00525a60
mov ebx, edx
mov edi, eax
test ebx, ebx
jg 0x5ab474
jl 0x5ab41a
cmp edi, 0xffffffff
ja 0x5ab474
mov ecx, dword [esi + 0x30]
cmp ecx, dword [ebp - 8]
jne 0x5ab434
mov edx, dword [esi + 0x34]
cmp edx, dword [ebp - 4]
jne 0x5ab434
cmp dword [esi + 0x38], edi
jne 0x5ab434
cmp dword [esi + 0x3c], ebx
je 0x5ab45c
cmp dword [esi + 0x44], 1
mov ecx, dword [ebp + 0xc]
push edi
jne 0x5ab44e
mov eax, dword [esi + 0x20]
add eax, dword [esi + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x64]
push eax
call edx
jmp 0x5ab45c
mov edx, dword [esi + 0x20]
add edx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
push edx
call eax
mov ecx, dword [esi + 0x20]
add ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x24]
adc edx, dword [esi + 0x14]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x5bad50
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x34]
test ecx, ecx
jne 0x5bad63
or eax, 0xffffffff
or edx, eax
pop ebp
ret 4
pop ebp
jmp fcn.00560ad0

Function at 0x5bf480
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx + 0x10], 0x67452301
mov dword [ecx + 0x14], 0xefcdab89
mov dword [ecx + 0x18], 0x98badcfe
mov dword [ecx + 0x1c], 0x10325476
mov dword [ecx + 0x20], 0xc3d2e1f0
mov dword [ecx + 0x24], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
ret
Function at 0x5c0510
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [esi + 0x10], 0x67452301
mov dword [esi + 0x14], 0xefcdab89
mov dword [esi + 0x18], 0x98badcfe
mov dword [esi + 0x1c], 0x10325476
mov dword [esi + 0x20], 0xc3d2e1f0
mov dword [esi + 0x24], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0061c880
push eax
mov ecx, edi
call fcn.00595640
push eax
mov ecx, esi
call fcn.005bfaa0
mov eax, dword [ebp + 0xc]
push 0
push eax
mov ecx, esi
call fcn.005c0190
pop edi
pop esi
pop ebp
ret 8

Function at 0x5c0580
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x10], 0x67452301
mov dword [esi + 0x14], 0xefcdab89
mov dword [esi + 0x18], 0x98badcfe
mov dword [esi + 0x1c], 0x10325476
mov dword [esi + 0x20], 0xc3d2e1f0
mov dword [esi + 0x24], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.005bfaa0
mov edx, dword [ebp + 0x10]
push 0
push edx
mov ecx, esi
call fcn.005c0190
pop esi
pop ebp
ret 0xc
Function at 0x5cb860
Capabilities:
Hash data using sha256

Disassembly:
push 0xfc
call fcn.00419f69
xor ecx, ecx
add esp, 4
cmp eax, ecx
je 0x5cb8b8
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0xbb67ae85
mov dword [eax + 0xc], 0x3c6ef372
mov dword [eax + 0x10], 0xa54ff53a
mov dword [eax + 0x14], 0x510e527f
mov dword [eax + 0x18], 0x9b05688c
mov dword [eax + 0x1c], 0x1f83d9ab
mov dword [eax + 0x20], 0x5be0cd19
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax], 1
ret
xor eax, eax
ret
Function at 0x5cc3f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x24]
mov esi, 0x10
lea ecx, [ecx]
mov cl, byte [eax + 0x20]
mov dl, byte [eax - 0x10]
xor dl, cl
mov byte [eax], cl
mov byte [eax + 0x10], dl
inc eax
dec esi
jne 0x5cc400
xor cl, cl
xor ebx, ebx
lea esi, [edi + 0x15]
jmp 0x5cc420
mov eax, esi
mov edx, 8
jmp 0x5cc430
movzx edi, byte [eax - 1]
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax]
mov byte [eax - 1], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax + 1]
mov byte [eax], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax + 2]
mov byte [eax + 1], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax + 3]
mov byte [eax + 2], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax + 4]
mov byte [eax + 3], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
mov byte [eax + 4], cl
add eax, 6
dec edx
jne 0x5cc430
add cl, bl
inc ebx
cmp ebx, 0x12
jl 0x5cc420
pop edi
pop esi
pop ebx
ret

Function at 0x5cc4c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov cl, byte [eax + 0x13]
add eax, 4
mov edx, 4
push esi
mov edi, edi
movzx esi, byte [eax + 0x40]
movzx ecx, cl
xor esi, ecx
movzx ecx, byte [esi + str._.C]
movzx esi, byte [eax]
xor ecx, esi
movzx esi, byte [eax + 0x41]
mov byte [eax], cl
movzx ecx, cl
xor esi, ecx
movzx ecx, byte [esi + str._.C]
movzx esi, byte [eax + 1]
xor ecx, esi
movzx esi, byte [eax + 0x42]
mov byte [eax + 1], cl
movzx ecx, cl
xor esi, ecx
movzx ecx, byte [esi + str._.C]
movzx esi, byte [eax + 2]
xor ecx, esi
movzx esi, byte [eax + 0x43]
mov byte [eax + 2], cl
movzx ecx, cl
xor esi, ecx
movzx ecx, byte [esi + str._.C]
movzx esi, byte [eax + 3]
xor ecx, esi
mov byte [eax + 3], cl
add eax, 4
dec edx
jne 0x5cc4d0
pop esi
ret

Function at 0x5cc720
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.Md4.0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret
Function at 0x5ccda0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, edi
call fcn.0053e650
mov dword [ebp - 0x18], eax
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0053f070
push eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, esi
call fcn.005ccc20
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.005cccd0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov ecx, ebx
call fcn.00540eb0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00521602
mov esp, ebp
pop ebp
ret 8
Function at 0x5ddbf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
jne 0x5ddc03
xor al, al
pop edi
pop ebp
ret 4
mov eax, dword [edi + 4]
test eax, eax
je 0x5ddc13
push eax
call fcn.00419f98
add esp, 4
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
push 1
lea ebx, [edi + 8]
push 4
lea esi, [edi + 0xc]
push ebx
mov dword [edi + 4], 0
mov dword [ebx], 0
mov dword [esi], 0
call fcn.00527859
add esp, 0x10
cmp eax, 1
jne 0x5ddcbe
mov ecx, dword [ebp + 8]
push ecx
push eax
push 4
push esi
call fcn.00527859
add esp, 0x10
cmp eax, 1
je 0x5ddc68
pop esi
mov dword [ebx], 0
pop ebx
xor al, al
pop edi
pop ebp
ret 4
mov eax, dword [esi]
test eax, eax
je 0x5ddcc7
xor ecx, ecx
add eax, eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00419f69
mov ecx, dword [ebp + 8]
mov edx, dword [esi]
push ecx
push edx
push 8
push eax
mov dword [edi + 4], eax
call fcn.00527859
add esp, 0x14
cmp eax, dword [esi]
je 0x5ddcc7
mov eax, dword [edi + 4]
push eax
call fcn.00419f98
add esp, 4
mov dword [edi + 4], 0
mov dword [ebx], 0
mov dword [esi], 0
pop esi
pop ebx
xor al, al
pop edi
pop ebp
ret 4
pop esi
pop ebx
mov al, 1
pop edi
pop ebp
ret 4