joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56dfd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x8312b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x318]
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [edi + 0x13c]
lea esi, [edi + 0x148]
push 0
add eax, 4
push eax
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x130], 0
mov dword [edi + 0x134], eax
jne 0x56e05e
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.0070d1d0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [edi + 0x130], eax
mov edx, dword [edi + 0x134]
cmp edx, 4
jge 0x56e091
push str.Received_too_short_packet
push ebx
call fcn.00551f90
add esp, 8
mov dword [edi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret
push esi
call fcn.0056dbc0
movzx eax, ax
add esp, 4
mov dword [edi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x56e0ac
jmp dword [eax*4 + 0x56e1ec]
cmp edx, 4
jle case.0x56e0ac.4
push esi
call fcn.0056dba0
movzx ecx, word [edi + 0x144]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x56e0ac.4
lea eax, [edx - 4]
push eax
mov eax, dword [esi]
add eax, 4
push eax
push 1
push ebx
call fcn.00551ee0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x56e10f
push 5
push edi
call fcn.0056ea30
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.00560ea0
jmp 0x56e1b7
mov eax, dword [esi]
lea esi, [edx - 4]
add eax, 4
mov dword [ebp - 0x8c], eax
lea eax, [edi + 0x148]
push eax
call fcn.0056dba0
push esi
push dword [ebp - 0x8c]
movzx eax, ax
mov dword [edi + 8], eax
call fcn.0056eb60
add esp, 0xc
cmp eax, esi
jae case.0x56e0ac.4
push dword [ebp - 0x8c]
push str.TFTP_error:__s
push ebx
call fcn.00552050
jmp 0x56e1b7
lea eax, [edx - 2]
push eax
mov eax, dword [esi]
add eax, 2
push eax
push edi
call fcn.0056dd80
add esp, 0xc
test eax, eax
je case.0x56e0ac.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x751578
push ebx
call fcn.00551f90
add esp, 0xc
push ebx
call fcn.005611b0
add esp, 4
test eax, eax
je 0x56e07e
push 5
push edi
call fcn.0056ea30
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret
Function at 0x56ea30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x56ea40
jmp dword [edx*4 + 0x56ea94]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0056e4e0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0056e200
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0056ec90
push str.TFTP_finished
push 0x751578
push ecx
call fcn.00552050
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x751578
push ecx
call fcn.00551f90
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x575650
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x8312b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x84]
or esi, 0xffffffff
push ecx
mov ebx, dword [edi + 0xc]
mov eax, dword [ebx + 0x14c]
push eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x5756c4
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x8c]
push ebx
push edi
call fcn.005528e0
add esp, 0xc
cmp esi, 0xffffffff
jne 0x5756fd
push str.Error_accept__ing_server_connect
push edi
call fcn.00551f90
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server
push edi
call fcn.00552050
push 1
push esi
mov byte [ebx + 0x266], 0
mov dword [ebx + 0x14c], esi
call fcn.0057d9a0
add esp, 0x10
mov byte [ebx + 0x279], 1
cmp dword [edi + 0x1b8], 0
je 0x57577a
push 1
push edi
call fcn.00544050
mov eax, dword [edi + 0x1b8]
push 1
push esi
push dword [edi + 0x1bc]
call eax
push 0
push edi
mov esi, eax
call fcn.00544050
add esp, 0x1c
test esi, esi
je 0x57577a
push ebx
push edi
call fcn.00575bc0
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret

Function at 0x577be0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x577c12
push str.Couldnt_set_desired_mode
push esi
call fcn.00551f90
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x577c29
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.00552050
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x577c42
push ebx
push esi
call fcn.00577880
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x577c57
push esi
call fcn.00576890
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x577c6c
push esi
call fcn.00577860
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x577c7c
push esi
call fcn.00577ac0
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5839e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x583a13
push 0x2e
push edi
call fcn.0070cd00
add esp, 8
test eax, eax
je 0x583a11
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x585130
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x82d214]
mov edi, eax
add esp, 4
test edi, edi
jne 0x58515d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x5851a7
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x5851ad
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x58520b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x5851d0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x585237
mov eax, dword [esi + 4]
push 1
push 0x75a99c
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x75a99d
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x585210
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x585f80
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x585fbf
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret
Function at 0x587da0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.005a6040
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.0070cd00
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x587e59
call fcn.005a4a00
push str.BIO_new_file
push 0x43
push str.crypto_bio_bss_file.c
call fcn.005a4b00
add esp, 0xc
push esi
push dword [esp + 0x14]
push str.calling_fopen__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
call fcn.005a4bb0
add esp, 0x14
call fcn.00717f7f
cmp dword [eax], 2
je 0x587e29
call fcn.00717f7f
cmp dword [eax], 6
je 0x587e29
mov esi, 0x80002
mov edi, 0x4d
jmp 0x587e31
mov esi, 0x80
lea edi, [esi - 0x35]
call fcn.005a4a00
push str.BIO_new_file
push edi
push str.crypto_bio_bss_file.c
call fcn.005a4b00
push 0
push esi
push 0x20
call fcn.005a4bb0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x75ac04
call fcn.00588740
mov esi, eax
add esp, 4
test esi, esi
jne 0x587e7b
push edi
call fcn.007178b2
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.00587ff0
push edi
push ebx
push 0x6a
push esi
call fcn.00588020
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x5a0a20
Capabilities:
Terminate process

Disassembly:
mov eax, 8
call fcn.006f5e10
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
push ebx
xor edi, edi
call fcn.005865c0
add esp, 4
test eax, eax
jle 0x5a0bfa
push edi
push ebx
call fcn.005867f0
mov esi, eax
mov dword [esp + 0x18], 0
push 0x9c
push esi
xor ebp, ebp
call fcn.005f34f0
add esp, 0x10
test eax, eax
je 0x5a0a71
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
push 0x9d
push esi
call fcn.005f34f0
add esp, 8
test eax, eax
je 0x5a0a86
mov ebp, dword [eax + 4]
push esi
call fcn.005f35e0
add eax, 0xffffff6a
add esp, 4
cmp eax, 5
ja case.0x5a0a9d.153
jmp dword [eax*4 + 0x5a0c1c]
mov ebp, dword [esp + 0x28]
test ebp, ebp
je case.0x5a0a9d.153
cmp dword [ebp], 0
jne case.0x5a0a9d.153
push esi
call fcn.005f3510
push eax
call fcn.005e09f0
add esp, 8
mov dword [ebp], eax
jmp 0x5a0be4
mov ebp, dword [esp + 0x28]
test ebp, ebp
je case.0x5a0a9d.153
cmp dword [ebp], 0
jne case.0x5a0a9d.153
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call fcn.005f35f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x5a0c10
push esi
call fcn.005e09f0
push esi
mov dword [ebp], eax
call fcn.005e08c0
add esp, 8
cmp dword [ebp], 0
jmp 0x5a0be6
cmp dword [esp + 0x2c], 0
je case.0x5a0a9d.153
push esi
call fcn.005f35a0
add esp, 4
cmp eax, 0x9e
jne case.0x5a0a9d.153
push esi
call fcn.005f3550
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x5a0c10
test ebp, ebp
je 0x5a0b6a
push dword [ebp]
push dword [ebp + 8]
push ebx
call fcn.005e8c90
add esp, 0xc
test eax, eax
je 0x5a0c07
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5a0bab
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0058d650
add esp, 8
test eax, eax
js 0x5a0bab
push eax
push dword [esp + 0x18]
push ebx
call fcn.005e8b80
push 0xec
push str.cryptopkcs12p12_kiss.c
push dword [esp + 0x28]
mov esi, eax
call fcn.00587560
add esp, 0x18
test esi, esi
je 0x5a0c07
push ebx
push dword [esp + 0x30]
call fcn.00586650
add esp, 8
test eax, eax
je 0x5a0c07
mov ebx, dword [esp + 0x1c]
jmp case.0x5a0a9d.153
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.005f3530
add esp, 4
push eax
call fcn.005a0a20
add esp, 0x14
test eax, eax
je 0x5a0c10
push ebx
inc edi
call fcn.005865c0
add esp, 4
cmp edi, eax
jl 0x5a0a45
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push ebx
call fcn.0059b8f0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x5a6210
Capabilities:
Initialize winsock library

Disassembly:
cmp dword [0x83b318], 0
jne 0x5a62a9
push 0x190
push 0
push 0x83b320
mov dword [0x83b318], 1
call fcn.0070dcd0
add esp, 0xc
push 0x83b320
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x5a62a9
call fcn.005a4a00
push str.BIO_sock_init
push 0x92
push str.crypto_bio_bio_sock.c
call fcn.005a4b00
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.005a4bb0
call fcn.005a4a00
push str.BIO_sock_init
push 0x94
push str.crypto_bio_bio_sock.c
call fcn.005a4b00
push 0
push 0x7a
push 0x20
call fcn.005a4bb0
add esp, 0x24
or eax, 0xffffffff
ret
mov eax, 1
ret
Function at 0x5a62b0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x5a6305
call fcn.005a4a00
push str.BIO_socket_ioctl
push 0xcf
push str.crypto_bio_bio_sock.c
call fcn.005a4b00
add esp, 0xc
push str.calling_ioctlsocket__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.005a4bb0
add esp, 0xc
xor eax, eax
test esi, esi
pop esi
sete al
ret

Function at 0x5a6e50
Capabilities:
Get common file path

Disassembly:
mov eax, 0x230
call fcn.006f5e10
mov eax, dword [0x8312b0]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x83b4b8], 0
mov dword [esp], 0x760130
mov dword [esp + 4], 0x5a6840
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x5a6c00
mov dword [esp + 0x10], 0x760148
mov dword [esp + 0x14], 0x5a67f0
jne 0x5a6fab
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x5a6fa1
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.0071939f
push str.ws2_32
lea eax, [esp + 0x38]
push 0x10c
push eax
call fcn.007193f9
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x40]
add esp, 0x18
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x5a6f1f
push 0x760130
push edi
call ebx
test eax, eax
jne 0x5a6f66
push edi
call ebp
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.0071939f
push str.wship6
lea eax, [esp + 0x38]
push 0x10c
push eax
call fcn.007193f9
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call esi
mov edi, eax
test edi, edi
je 0x5a6f9d
push 0x760130
push edi
call ebx
test eax, eax
je 0x5a6f9a
xor esi, esi
push dword [esp + esi*8 + 0x10]
push edi
call ebx
mov dword [esp + esi*8 + 0x14], eax
test eax, eax
je 0x5a6f9a
inc esi
cmp esi, 3
jl 0x5a6f68
mov eax, dword [esp + 0x14]
mov dword [0x82d694], eax
mov eax, dword [esp + 0x1c]
mov dword [0x82d69c], eax
mov eax, dword [esp + 0x24]
mov dword [0x82d6a4], eax
jmp 0x5a6f9d
push edi
call ebp
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x83b4b8], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
mov eax, dword [eax*8 + 0x82d694]
call fcn.006f4f1e
add esp, 0x230
ret 4
Function at 0x5a6fe0
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x820
call fcn.006f5e10
mov eax, dword [0x8312b0]
xor eax, esp
mov dword [esp + 0x81c], eax
push ebx
mov ebx, dword [esp + 0x83c]
lea eax, [esp + 0x18]
push ebp
push esi
mov esi, dword [esp + 0x830]
push edi
push 0x401
push 0
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0
call fcn.0070dcd0
push 0x401
lea eax, [esp + 0x438]
push 0
push eax
call fcn.0070dcd0
push 0x400
push esi
lea eax, [esp + 0x44]
push 0x401
push eax
mov dword [esp + 0x3c], eax
lea ebp, [esp + 0x450]
call fcn.00723c7d
add esp, 0x28
push esi
mov edi, ebx
mov dword [ebx], 0
mov byte [ebp], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x5a71af
cmp word [ebx + 8], 2
jne 0x5a70d2
cmp word [ebx + 0xa], 4
jne 0x5a70d2
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x5a70d2
nop word [eax + eax]
push dword [eax]
push dword [esp + 0x844]
push dword [esp + 0x844]
push dword [esp + 0x844]
call fcn.005a7210
mov dword [edi], eax
test eax, eax
je 0x5a71a8
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x5a70a0
push 0x400
push dword [ebx]
push 0x401
push ebp
call fcn.00723c7d
mov ebx, dword [esp + 0x28]
xor esi, esi
add esp, 0x10
cmp dword [ebx], esi
jne 0x5a7160
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5a70f6
sub ecx, edx
je case.0x5a71bf.11003
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5a7130
test dl, dl
je 0x5a712c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5a7130
add eax, 2
add ecx, 2
test dl, dl
jne 0x5a7110
xor eax, eax
jmp 0x5a7135
sbb eax, eax
or eax, 1
test eax, eax
je case.0x5a71bf.11003
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x10
je case.0x5a71bf.11003
mov esi, dword [esp + 0x1c]
mov eax, edi
mov dword [esp + 0x14], ebp
mov ebp, eax
jmp 0x5a7062
cmp dword [esp + 0x844], esi
je 0x5a71d9
mov ecx, ebp
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5a7170
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call fcn.00715d16
mov edi, eax
add esp, 8
test edi, edi
je 0x5a7198
push ebp
push ebx
push edi
call fcn.0071939f
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
cmp dword [eax + 0x14], esi
jne 0x5a71d9
mov esi, 8
jmp 0x5a71d9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x5a71bf.11001
jmp dword [eax*4 + 0x5a71f8]
mov esi, 0x2afa
jmp 0x5a71d9
mov esi, 0x2afb
jmp 0x5a71d9
mov esi, 0x2af9
mov ecx, dword [esp + 0x82c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006f4f1e
add esp, 0x820
ret 0x18
Function at 0x5ba220
Capabilities:
Hash data using sha1

Disassembly:
mov eax, 0x40
call fcn.006f5e10
mov eax, dword [0x8312b0]
xor eax, esp
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x48], 0x1d
push esi
mov esi, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x58]
je 0x5ba25c
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.006f4f1e
add esp, 0x40
ret
test esi, esi
je 0x5ba36b
cmp dword [esp + 0x54], 0x30
jne 0x5ba36b
push 0x30
push edi
push esi
call fcn.005ba140
add esp, 0xc
test eax, eax
jle 0x5ba36b
movaps xmm0, xmmword [str.6666666666666666_t]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.005ba140
add esp, 0xc
test eax, eax
je 0x5ba36b
lea eax, [esp + 0x30]
push esi
push eax
call fcn.005b9fa0
add esp, 8
test eax, eax
je 0x5ba36b
push 0x4c
lea eax, [esi + 0x14]
push 0
push eax
call fcn.0070dcd0
push 0x30
push edi
push esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
call fcn.005ba140
add esp, 0x18
test eax, eax
jle 0x5ba36b
movaps xmm0, xmmword [0x776470]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.005ba140
add esp, 0xc
test eax, eax
je 0x5ba36b
push 0x14
lea eax, [esp + 0x34]
push eax
push esi
call fcn.005ba140
add esp, 0xc
test eax, eax
je 0x5ba36b
lea eax, [esp + 0x30]
push 0x14
push eax
call fcn.00401320
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.006f4f1e
add esp, 0x40
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.006f4f1e
add esp, 0x40
ret
Function at 0x5d92d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x5d9312
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
add edi, esi
add ebx, esi
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x5d92f1
pop edi
pop ebx
pop esi
ret
Function at 0x5ee3b0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.006f5e10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
call fcn.005ee010
mov ebx, eax
push ebx
push esi
call fcn.005edf20
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x5ee42f
push 0xf0000040
push 1
xor edi, edi
lea eax, [esp + 0x18]
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5ee413
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.005edfb0
push esi
call fcn.005ee0f0
add esp, 0x10
test eax, eax
jne 0x5ee4a9
push 1
push esi
call fcn.005ee010
mov ebx, eax
push ebx
push esi
call fcn.005edf20
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x5ee4a0
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5ee484
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.005edfb0
push esi
call fcn.005ee0f0
add esp, 0x10
test eax, eax
jne 0x5ee4a9
push esi
call fcn.005ee0f0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret