joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c55d0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [edx - 0xc8]
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
mov ecx, dword [ebx]
cmp eax, 0x64
jb 0x4c5602
push str.Couldnt_set_desired_mode
push ecx
call fcn.004aef10
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 0xc8
je 0x4c5619
push edx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ecx
call fcn.004aee40
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x4c5631
mov ecx, ebx
call fcn.004c4760
mov esi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x14
jne 0x4c574d
mov eax, dword [ebx]
xor edi, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
cmp dword [eax + 0x348], 2
mov esi, dword [eax + 0x48b4]
jne 0x4c56ab
test esi, esi
je 0x4c56ab
cmp byte [esi], 0
je 0x4c56ab
push 0x2f
push esi
call fcn.006d2640
add esp, 8
test eax, eax
je 0x4c56a8
push esi
call fcn.006e5360
add esp, 4
cmp byte [eax + esi - 1], 0x2f
je 0x4c5688
push 0x2f
push esi
call fcn.006d4b00
add esp, 8
sub eax, esi
push 1
push 0
lea ecx, [ebp - 4]
mov edx, esi
push ecx
push eax
call fcn.004bbce0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4c576b
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3b8]
test ecx, ecx
jne 0x4c56c9
cmp byte [eax + 0x35d], 0
mov ecx, str.NLST
mov edx, str.LIST
cmove ecx, edx
mov edx, 0x78c138
test edi, edi
mov eax, edx
cmovne eax, edi
push eax
mov eax, 0x797cc8
cmove eax, edx
push eax
push ecx
push 0x793bd8
call fcn.004ba780
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
jne 0x4c570b
push edi
call fcn.006d6340
mov esi, 0x1b
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
lea eax, [ebx + 0x510]
push 0x7964ec
push eax
call fcn.004d4be0
add esp, 0xc
mov esi, eax
push edi
call fcn.006d6340
add esp, 4
push dword [ebp - 8]
call fcn.006d6340
add esp, 4
test esi, esi
jne 0x4c576b
mov dword [ebx + 0x578], 0x1f
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x15
jne 0x4c5756
push 0xd
jmp 0x4c575d
cmp eax, 0x16
jne 0x4c576b
push 0xe
mov dl, 1
mov ecx, ebx
call fcn.004c4af0
add esp, 4
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c89a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
mov esi, ecx
mov byte [ebp - 2], al
push 3
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xff
push eax
push dword [esi + 0x198]
mov edi, dword [esi]
mov ebx, edx
mov byte [ebp - 3], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c89e9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004aef10
add esp, 0xc
push dword [ebp + 8]
mov ecx, dword [esi]
mov edx, str.SENT
push ebx
call fcn.004c8890
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c9050
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0x108]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x90c], ebx
call fcn.006d4310
add esp, 0xc
lea eax, [ebp - 0x88]
push 0x80
push 0
push eax
call fcn.006d4310
mov ebx, dword [ebx]
add esp, 0xc
mov edx, 0x3c
mov dword [ebp - 0x910], ebx
mov ecx, ebx
mov esi, dword [ebx + 0x130]
mov eax, dword [esi + 0x1eb4]
sub eax, dword [esi + 0x1eb0]
add eax, 2
push eax
lea eax, [esi + 0x1cb0]
push eax
call fcn.004c8a10
mov eax, dword [esi + 0x1eb0]
add esp, 8
mov cl, byte [eax]
inc eax
mov dword [esi + 0x1eb0], eax
cmp cl, 0x18
je 0x4c9230
cmp cl, 0x23
je 0x4c9210
cmp cl, 0x27
jne 0x4c92c3
push 0
push 0x27
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [ebp - 0x908]
push 0x800
push eax
call fcn.004ba680
mov esi, dword [esi + 0x1cac]
add esp, 0x1c
mov edi, 4
mov eax, 0x800
test esi, esi
je 0x4c91af
push dword [esi]
call fcn.006e5360
lea ebx, [edi + 1]
add esp, 4
add ebx, eax
cmp ebx, 0x7fa
jae 0x4c919d
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x108]
push eax
push str._127_____127s
push dword [esi]
call fcn.004a7f90
add esp, 0x10
test eax, eax
je 0x4c919d
lea eax, [ebp - 0x88]
push eax
push 1
lea eax, [ebp - 0x108]
push eax
push 0
mov eax, 0x800
sub eax, edi
push str._c_s_c_s
push eax
lea eax, [ebp - 0x908]
add eax, edi
push eax
call fcn.004ba680
add esp, 0x1c
mov edi, ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x4c9133
mov ebx, dword [ebp - 0x910]
mov eax, 0x800
push 0xf0
push 0xff
sub eax, edi
push 0x798a28
push eax
lea eax, [ebp - 0x908]
add eax, edi
push eax
call fcn.004ba680
add esp, 0x14
lea eax, [edi + 2]
push 0
push eax
lea eax, [ebp - 0x908]
push eax
mov eax, dword [ebp - 0x90c]
push dword [eax + 0x198]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c920a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004aef10
add esp, 0xc
push edi
jmp 0x4c92ad
add esi, 0x1c28
push esi
call fcn.006e5360
add esp, 4
push 0xf0
push 0xff
push esi
push 0
push 0x23
jmp 0x4c924e
add esi, 0x1c08
push esi
call fcn.006e5360
add esp, 4
push 0xf0
push 0xff
push esi
push 0
push 0x18
push 0xfa
push 0xff
push str._c_c_c_c_s_c_c
lea edi, [eax + 6]
lea eax, [ebp - 0x908]
push 0x800
push eax
call fcn.004ba680
add esp, 0x28
lea eax, [ebp - 0x908]
push 0
push edi
push eax
mov eax, dword [ebp - 0x90c]
push dword [eax + 0x198]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c92a9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004aef10
add esp, 0xc
lea eax, [edi - 2]
push eax
lea eax, [ebp - 0x906]
mov edx, 0x3e
push eax
mov ecx, ebx
call fcn.004c8a10
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x4c92e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov dword [ebp - 0xc], eax
push ebx
push esi
mov eax, dword [eax]
mov dword [ebp - 8], eax
push edi
mov ebx, dword [eax + 0x130]
cmp edx, 0x1f
jne 0x4c9430
lea edi, [ebx + 0x1cb0]
lea esi, [ebx + 0x1eb0]
mov dword [esi], edi
cmp edi, esi
jae 0x4c931d
mov byte [edi], 0xff
inc dword [esi]
mov eax, dword [esi]
jmp 0x4c931f
mov eax, edi
cmp eax, esi
jae 0x4c9333
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4c9333
mov byte [eax], 0x1f
inc dword [esi]
movzx eax, word [ebx + 0x1ca8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [ebx + 0x1caa]
push ecx
mov word [ebp - 2], ax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esi]
mov dx, word [ebp - 2]
cmp ecx, esi
jae 0x4c939a
mov byte [ecx], dl
inc dword [esi]
mov ecx, dword [esi]
cmp ecx, esi
jae 0x4c939a
mov byte [ecx], dh
inc dword [esi]
mov ecx, dword [esi]
cmp ecx, esi
jae 0x4c939a
mov byte [ecx], al
inc dword [esi]
mov ecx, dword [esi]
cmp ecx, esi
jae 0x4c939a
shr ax, 8
mov byte [ecx], al
inc dword [esi]
mov ecx, dword [esi]
cmp ecx, esi
jae 0x4c939a
mov byte [ecx], 0xff
inc dword [esi]
mov ecx, dword [esi]
cmp ecx, esi
jae 0x4c939a
mov byte [ecx], 0xf0
mov ecx, dword [esi]
inc ecx
mov dword [ebx + 0x1eb4], ecx
lea eax, [ebx + 0x1cb2]
sub ecx, edi
mov dword [esi], edi
mov esi, dword [ebp - 8]
sub ecx, 2
push ecx
push eax
mov edx, 0x3e
mov ecx, esi
call fcn.004c8a10
add esp, 8
push 0
push 3
push edi
mov edi, dword [ebp - 0xc]
push dword [edi + 0x198]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c93ee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004aef10
add esp, 0xc
push 4
lea edx, [ebx + 0x1cb3]
mov ecx, edi
call fcn.004c9c20
add esp, 4
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [edi + 0x198]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c9430
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004aef10
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d2700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 3
jne 0x4d2735
mov edi, dword [esi + 0xc]
test edi, edi
jne 0x4d2720
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push dword [ecx + 8]
mov ecx, edi
push dword [ebp + 8]
push 1
push ebx
call dword [0x70d440]
call edi
jmp 0x4d2767
mov eax, dword [esi + 8]
test eax, eax
jne 0x4d275b
push 0x793d74
push dword [ecx + 8]
call fcn.006e5218
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4d275b
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
push eax
push dword [ebp + 8]
push 1
push ebx
call fcn.006eb820
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4d2789
mov eax, dword [esi + 8]
test eax, eax
je 0x4d2783
push eax
call fcn.006e4d89
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4d4760
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [eax + 0x1f4]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4d478c
mov eax, dword [ebx + 0x28]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
push 0
mov edi, edx
shr edi, 6
imul eax, edi, 0x3e8
push 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
sub eax, dword [ebx + 0x24]
cdq
push edx
push eax
call fcn.00702460
mov ecx, eax
mov esi, edx
mov eax, dword [ebp - 4]
cdq
mov ebx, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
sub ebx, ecx
mov ecx, edx
sbb ecx, esi
sub edi, dword [eax + 0x20]
imul eax, edi, 0x3e8
cdq
sub ebx, eax
sbb ecx, edx
mov edx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp dword [edx + 0x1e8], 0
je 0x4d487b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
push 0
mov edi, edx
shr edi, 6
imul eax, edi, 0x3e8
push 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov ecx, dword [ebp - 0xc]
sub eax, dword [ecx + 0x18c]
cdq
push edx
push eax
call fcn.00702460
mov ecx, eax
mov esi, edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1e8]
cdq
sub eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
sbb edx, esi
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov esi, dword [ebp - 8]
sub edi, dword [eax + 0x188]
imul eax, edi, 0x3e8
cdq
sub ecx, eax
sbb esi, edx
mov edx, dword [ebp - 4]
cmp edx, esi
jl 0x4d487d
jg 0x4d4870
cmp ebx, ecx
jb 0x4d487d
mov eax, ecx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c1a90
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x408]
push edi
push 0x401
mov ebx, ecx
mov dword [ebp - 0x824], edx
push 0
push eax
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x810], esi
mov dword [ebp - 0x818], 0
call fcn.006d4310
push 0x401
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.006d4310
push 0x400
push ebx
lea eax, [ebp - 0x408]
push 0x401
push eax
mov dword [ebp - 0x81c], eax
lea edi, [ebp - 0x80c]
call fcn.006ed8e6
add esp, 0x28
nop dword [eax]
nop word [eax + eax]
push dword [ebp - 0x820]
mov ebx, esi
mov dword [esi], 0
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
mov dword [ebp - 0x814], ecx
test ecx, ecx
je 0x5c1c58
cmp word [ecx + 8], 2
jne 0x5c1b8f
cmp word [ecx + 0xa], 4
jne 0x5c1b8f
mov esi, dword [ecx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x5c1b8f
nop
push dword [eax]
mov edx, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x824]
call fcn.005c1a10
mov dword [ebx], eax
test eax, eax
je 0x5c1c04
add esi, 4
lea ebx, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x5c1b60
mov ecx, dword [ebp - 0x814]
push 0x400
push dword [ecx]
push 0x401
push edi
call fcn.006ed8e6
mov eax, dword [ebp - 0x810]
xor esi, esi
add esp, 0x10
cmp dword [eax], esi
jne 0x5c1c0b
push edi
call fcn.006e5360
add esp, 4
test eax, eax
je case.0x5c1c68.11003
mov ebx, dword [ebp - 0x81c]
push edi
push ebx
call fcn.006e5280
add esp, 8
test eax, eax
je case.0x5c1c68.11003
mov esi, dword [ebp - 0x818]
inc esi
mov dword [ebp - 0x818], esi
cmp esi, 0x10
je case.0x5c1c68.11003
mov esi, dword [ebp - 0x810]
mov eax, ebx
mov dword [ebp - 0x81c], edi
mov edi, eax
jmp 0x5c1b20
mov esi, 8
jmp 0x5c1c82
cmp dword [ebp + 0x10], esi
je 0x5c1c82
push edi
call fcn.006e5360
inc eax
push eax
push 1
mov dword [ebp - 0x814], eax
call fcn.006d7a40
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x5c1c3e
push edi
push dword [ebp - 0x814]
push ebx
call fcn.006ee695
add esp, 0xc
mov ecx, dword [ebp - 0x810]
mov eax, dword [ecx]
mov dword [eax + 0x14], ebx
mov eax, dword [ecx]
mov ecx, 8
cmp dword [eax + 0x14], esi
cmove esi, ecx
jmp 0x5c1c82
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x5c1c68.11001
jmp dword [eax*4 + 0x5c1c98]
mov esi, 0x2afa
jmp 0x5c1c82
mov esi, 0x2afb
jmp 0x5c1c82
mov esi, 0x2af9
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006d0856
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5c22a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x7cd4c8], 0
push ebx
push esi
push edi
mov bx, cx
mov dword [ebp - 0x238], 0x7a466c
mov dword [ebp - 0x234], 0x5c1d00
mov dword [ebp - 0x230], 0x7a464c
mov dword [ebp - 0x22c], 0x5c2070
mov dword [ebp - 0x228], 0x7a4658
mov dword [ebp - 0x224], fcn.005c1cb0
jne 0x5c2433
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x5c2429
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x118]
push 0x10c
push eax
call fcn.006ee695
add esp, 0xc
lea eax, [ebp - 0x118]
push str.ws2_32
push 0x10c
push eax
call fcn.006eebcd
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5c237a
push 0x7a466c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x5c23d1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x118]
push 0x10c
push eax
call fcn.006ee695
add esp, 0xc
lea eax, [ebp - 0x118]
push str.wship6
push 0x10c
push eax
call fcn.006eebcd
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5c2429
push 0x7a466c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5c2422
xor esi, esi
nop dword [eax]
nop word [eax + eax]
push dword [ebp + esi*8 - 0x238]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + esi*8 - 0x234], eax
test eax, eax
je 0x5c2422
inc esi
cmp esi, 3
jl 0x5c23e0
mov eax, dword [ebp - 0x234]
mov dword [0x7c14b4], eax
mov eax, dword [ebp - 0x22c]
mov dword [0x7c14bc], eax
mov eax, dword [ebp - 0x224]
mov dword [fcn.005c1cb0], eax
jmp 0x5c2429
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x7cd4c8], 1
mov ecx, dword [ebp - 4]
movzx eax, bx
xor ecx, ebp
pop edi
pop esi
pop ebx
mov eax, dword [eax*8 + 0x7c14b4]
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x5c4270
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], 0
mov ebx, ecx
mov dword [ebp - 8], ebx
push edi
test esi, esi
je 0x5c438d
mov edi, dword [ebp + 8]
cmp edi, 2
jle 0x5c42f9
nop word [eax + eax]
movzx eax, byte [esi]
mov edx, 4
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
nop word [eax + eax]
mov ecx, eax
dec edx
and ecx, 0x3f
shr eax, 6
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edx - 4], cl
test edx, edx
jg 0x5c42c0
push 4
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.005c2790
add esp, 4
test eax, eax
jne 0x5c4380
sub edi, 3
add esi, 3
cmp edi, 2
jg 0x5c42a0
test edi, edi
jle 0x5c438d
xor ecx, ecx
mov ebx, edi
mov edx, edi
movzx eax, byte [esi]
lea esi, [esi + 1]
shl ecx, 8
or ecx, eax
sub ebx, 1
jne 0x5c4307
cmp edi, 3
jge 0x5c432e
mov eax, 3
sub eax, edx
lea edx, [ebx + 3]
shl ecx, 8
sub eax, 1
jne 0x5c4326
inc edx
test edx, edx
jle 0x5c434a
mov eax, ecx
dec edx
and eax, 0x3f
shr ecx, 6
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edx - 4], al
test edx, edx
jg 0x5c4333
mov eax, 3
cmp edi, eax
jge 0x5c435d
mov byte [ebp + eax - 4], 0x3d
dec eax
cmp eax, edi
jg 0x5c4353
mov esi, dword [ebp - 8]
lea edx, [ebp - 4]
push 4
mov ecx, esi
call fcn.005c2790
add esp, 4
test eax, eax
je 0x5c438d
mov eax, dword [esi + 0x1616c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x1616c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c67b0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x30c
lea eax, [ebp - 0x318]
mov ebx, ecx
push 0
push eax
mov edi, edx
mov dword [ebp - 0x33c], ebx
call fcn.006d4310
mov esi, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebx + 0x16174], 0
mov dword [ebp - 0x330], 0
test esi, esi
js 0x5c6815
mov ecx, esi
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x32c], 0
jmp 0x5c683e
mov eax, 0xbce4217d
imul esi
neg esi
sar edx, 0x12
mov eax, esi
mov ecx, edx
mov esi, 0xf4240
shr ecx, 0x1f
add ecx, edx
cdq
idiv esi
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x32c], edx
test ecx, ecx
js 0x5c69fa
mov edx, dword [ebp + 8]
mov eax, edx
mov ebx, edx
and eax, 1
and ebx, 2
mov dword [ebp - 0x324], eax
and edx, 4
mov dword [ebp - 0x328], ebx
mov dword [ebp + 8], edx
lea esi, [edi + 1]
test eax, eax
je 0x5c687c
mov dword [ebp - 0x314], edi
mov dword [ebp - 0x318], 1
test eax, eax
mov dword [ebp - 0x31c], 0
lea ecx, [ebp - 0x318]
cmove ecx, dword [ebp - 0x31c]
mov dword [ebp - 0x334], ecx
test ebx, ebx
je 0x5c68af
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], 1
test ebx, ebx
mov dword [ebp - 0x31c], 0
lea eax, [ebp - 0x214]
cmove eax, dword [ebp - 0x31c]
mov dword [ebp - 0x338], eax
test edx, edx
je 0x5c68e2
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
test edx, edx
mov dword [ebp - 0x31c], 0
lea ebx, [ebp - 0x110]
cmove ebx, dword [ebp - 0x31c]
cmp dword [ebp - 0x320], 0
jne 0x5c6919
lea edx, [ebp - 0x330]
push edx
push ebx
push eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
jmp 0x5c694c
lea edx, [ebp - 0x344]
mov dword [ebp - 0x344], 1
push edx
push ebx
push eax
push ecx
push esi
mov dword [ebp - 0x340], 0
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jne 0x5c694c
cmp byte [0x7cc63e], al
jne 0x5c69c0
sub dword [ebp - 0x320], 1
js 0x5c6969
mov eax, dword [ebp - 0x324]
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 0x328]
jmp 0x5c6865
test esi, esi
jle 0x5c69d3
xor esi, esi
cmp dword [ebp - 0x324], esi
je 0x5c698e
push dword [ebp - 0x334]
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
mov ecx, 1
cmovne esi, ecx
cmp dword [ebp - 0x328], 0
je 0x5c69ab
push dword [ebp - 0x338]
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x5c69ab
or esi, 2
cmp dword [ebp + 8], 0
je 0x5c69c0
push ebx
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x5c69c0
or esi, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
jns 0x5c69c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 0x33c]
mov dword [ecx + 0x16174], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x5d1280
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
test esi, esi
jne 0x5d12bf
lea esi, [ebx + 2]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax*4 + 1]
call fcn.005c7540
mov esi, eax
test esi, esi
jne 0x5d12bf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], esi
mov byte [esi], 0
test edi, edi
jne 0x5d12d2
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 2
jle 0x5d1334
lea ecx, [ebx - 3]
mov eax, 0xaaaaaaab
mul ecx
mov ebx, edx
shr ebx, 1
inc ebx
lea eax, [ebx*4]
sub eax, ebx
neg eax
add dword [ebp + 0xc], eax
movzx eax, byte [edi]
mov edx, 4
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 2]
shl eax, 8
or eax, ecx
nop
mov ecx, eax
dec edx
and ecx, 0x3f
shr eax, 6
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + esi], cl
test edx, edx
jg 0x5d1310
add esi, 4
add edi, 3
sub ebx, 1
jne 0x5d12f4
mov ebx, dword [ebp + 0xc]
mov byte [esi], 0
test ebx, ebx
jle 0x5d139f
xor ecx, ecx
mov dword [ebp - 4], ebx
mov edx, ebx
movzx eax, byte [edi]
lea edi, [edi + 1]
shl ecx, 8
or ecx, eax
sub ebx, 1
jne 0x5d1342
mov ebx, dword [ebp + 0xc]
cmp ebx, 3
jge 0x5d136e
mov eax, 3
sub eax, edx
mov edx, 3
shl ecx, 8
sub eax, 1
jne 0x5d1366
inc edx
test edx, edx
jle 0x5d1389
mov eax, ecx
dec edx
and eax, 0x3f
shr ecx, 6
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + esi], al
test edx, edx
jg 0x5d1373
mov ecx, 3
cmp ebx, ecx
jge 0x5d139b
mov byte [ecx + esi], 0x3d
dec ecx
cmp ecx, ebx
jg 0x5d1392
mov byte [esi + 4], 0
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d6e40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x5d6e4b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.005d6e60
Function at 0x5d8a40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x4c
push 0
lea eax, [esi + 0x10]
push eax
call fcn.006d4310
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret

Function at 0x5da6e0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call fcn.006d4310
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov eax, 1
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
pop esi
pop ebp
ret

Function at 0x5daa30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call fcn.006d4310
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
pop ebp
ret