joyce8/EMBER2024-capa huggingface dataset:
Function at 0x604890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006d13f0
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov esi, dword [esi]
test esi, esi
je 0x6048cf
mov edx, dword [ebp + 0x18]
test edi, edi
je 0x6048cf
mov al, byte [esi + edx]
dec edi
xor al, byte [ecx]
inc esi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp + 0x10], ecx
and esi, 0xf
jne 0x6048b8
cmp edi, 0x10
jb 0x60494d
mov edx, dword [ebp + 0x18]
mov eax, ebx
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, ecx
sub eax, edx
mov dword [ebp - 4], eax
mov eax, edi
shr eax, 4
mov dword [ebp - 8], eax
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp + 0x10], ecx
jmp 0x604903
mov edx, dword [ebp + 0x18]
push dword [ebp + 0x14]
push edx
push edx
call dword [ebp + 0x20]
add esp, 0xc
cmp esi, 0x10
jae 0x604938
mov eax, dword [ebp + 0x18]
mov edx, 0xf
sub edx, esi
add eax, esi
mov esi, dword [ebp - 4]
shr edx, 2
inc edx
mov ecx, dword [esi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x604926
add dword [ebp - 4], 0x10
sub edi, 0x10
add ebx, 0x10
xor esi, esi
sub dword [ebp - 8], 1
jne 0x604900
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x604982
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
push eax
push eax
call dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 0x10]
sub ebx, eax
sub edx, eax
lea ecx, [esi + eax]
add esi, edi
nop
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x604970
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x604dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006d13f0
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x160]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x164]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x38]
or eax, dword [edi + 0x3c]
je 0x604e05
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov eax, esi
add eax, dword [edi + 0x30]
adc ecx, dword [edi + 0x34]
cmp ecx, 0x20000000
ja 0x604ef1
jb 0x604e29
test eax, eax
jne 0x604ef1
mov dword [edi + 0x34], ecx
lea edx, [edi + 0x40]
mov ecx, dword [edi + 0x16c]
mov dword [edi + 0x30], eax
mov dword [ebp - 8], ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x604e93
test esi, esi
je 0x604e6d
mov al, byte [ebx]
lea edx, [edi + 0x40]
xor byte [edx + ecx], al
inc ebx
inc ecx
mov dword [ebp - 4], edx
dec esi
and ecx, 0xf
mov dword [ebp - 8], ecx
jne 0x604e43
lea eax, [edi + 0x60]
push eax
push edx
call dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add esp, 8
jmp 0x604e96
mov dword [ebp - 4], edx
test ecx, ecx
jne 0x604e84
lea eax, [edi + 0x60]
push eax
push edx
call dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add esp, 8
jmp 0x604e96
pop ebx
pop esi
mov dword [edi + 0x16c], ecx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], edx
mov eax, esi
lea ecx, [edi + 0x60]
and eax, 0xfffffff0
mov dword [ebp - 0xc], eax
je 0x604eb3
push eax
push ebx
push ecx
push edx
call dword [ebp - 0x10]
add ebx, dword [ebp - 0xc]
add esp, 0x10
sub esi, dword [ebp - 0xc]
test esi, esi
je 0x604edf
xor ecx, ecx
mov edx, esi
test esi, esi
je 0x604ee2
mov edi, dword [ebp - 4]
mov al, byte [ecx + ebx]
xor byte [edi + ecx], al
inc ecx
cmp ecx, esi
jb 0x604ec2
mov edi, dword [ebp + 8]
xor eax, eax
pop ebx
pop esi
mov dword [edi + 0x16c], edx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
pop ebx
pop esi
mov dword [edi + 0x16c], edx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x605cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.006d13f0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x160]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], eax
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp edi, 0xc
jne 0x605d45
mov eax, dword [ebp + 0xc]
mov edi, 1
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x605e53
mov dword [esi + 0x40], 0
lea eax, [esi + 0x60]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [ebp - 0x14], edi
mov dword [esi + 0x4c], 0
mov dword [ebp - 8], eax
push ebx
lea ebx, [esi + 0x40]
mov dword [ebp - 0xc], ebx
cmp edi, 0x10
jb 0x605dee
mov eax, edi
lea ecx, [esi + 0x41]
mov esi, dword [ebp + 0xc]
shr eax, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov eax, ecx
lea edx, [esi + 1]
mov ebx, 4
nop word [eax + eax]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub ebx, 1
jne 0x605da0
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push ebx
call dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
add esp, 8
add esi, 0x10
sub edi, 0x10
sub dword [ebp + 0x10], 1
jne 0x605d90
mov dword [ebp + 0x10], esi
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
jmp 0x605df1
mov edx, dword [ebp + 0xc]
test edi, edi
je 0x605e16
xor ecx, ecx
test edi, edi
je 0x605e0b
nop dword [eax + eax]
mov al, byte [ecx + edx]
xor byte [ebx + ecx], al
inc ecx
cmp ecx, edi
jb 0x605e00
lea eax, [esi + 0x60]
push eax
push ebx
call dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0x4c], eax
lea eax, [esi + 0x60]
push eax
bswap ecx
xor dword [esi + 0x48], ecx
push ebx
call dword [ebp - 4]
mov eax, dword [ebx]
add esp, 8
mov edi, dword [esi + 0x4c]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x4c]
bswap edi
mov dword [esi + 0xc], eax
pop ebx
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x606630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x34
call fcn.006d13f0
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
lea ecx, [esi + 0x10]
mov bl, byte [esi]
mov edx, dword [esi + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], eax
test bl, 0x40
jne 0x606682
push eax
push ecx
push esi
call edx
add esp, 0xc
movzx eax, bl
mov edx, 0xf
and eax, 7
xor ecx, ecx
sub edx, eax
mov byte [esi], al
mov dword [ebp - 0x34], edx
cmp edx, 0xf
jae 0x6066b3
nop dword [eax + eax]
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x6066a0
movzx eax, byte [esi + 0xf]
mov ebx, dword [ebp + 0x14]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x6066d7
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
push edi
mov edi, ebx
shr edi, 4
test edi, edi
je 0x606710
lea eax, [esi + 0x10]
push eax
push esi
push dword [ebp - 0x20]
push edi
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call dword [ebp - 0x2c]
shl edi, 4
add esp, 0x18
add dword [ebp - 0x1c], edi
add dword [ebp - 0x24], edi
sub ebx, edi
je 0x60676c
shr edi, 4
push edi
push esi
call fcn.00606e50
add esp, 8
test ebx, ebx
je 0x60676c
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [ebp - 0x28]
add esp, 0xc
xor edx, edx
test ebx, ebx
je 0x60675b
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
sub dword [ebp - 0x1c], eax
sub edi, eax
lea eax, [esi + 0x10]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
nop dword [eax]
lea eax, [ebp - 0x14]
add eax, edx
mov cl, byte [esi + eax]
xor cl, byte [eax]
mov byte [edi + eax], cl
mov eax, dword [ebp - 0x2c]
xor byte [eax + edx], cl
inc edx
cmp edx, ebx
jb 0x606740
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x20]
lea eax, [esi + 0x10]
push ebx
push eax
push eax
call dword [ebp - 0x28]
add esp, 0xc
jmp 0x60676f
mov ebx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jae 0x606791
mov ecx, 0x10
lea edi, [edx + esi]
sub ecx, edx
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
call dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
xor dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
xor dword [esi + 0x1c], eax
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi], al
xor ecx, ebp
pop esi
xor eax, eax
pop ebx
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x608390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.006d13f0
mov edx, dword [ebp + 0x10]
xor ecx, ecx
test edx, edx
je 0x6084a5
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
cmp edx, 0x40
jb 0x608483
lea eax, [edx - 1]
add eax, ebx
cmp esi, eax
ja 0x6083d5
lea eax, [esi - 1]
add eax, edx
cmp eax, ebx
jae 0x608483
lea eax, [edx - 1]
add eax, edi
cmp esi, eax
ja 0x6083eb
lea eax, [esi - 1]
add eax, edx
cmp eax, edi
jae 0x608483
mov eax, edx
mov edx, edi
sub edx, ebx
and eax, 0xffffffc0
mov dword [ebp - 4], edx
mov edx, esi
sub edx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edx
mov eax, ebx
mov ebx, dword [ebp - 4]
mov edx, edi
sub edx, esi
mov dword [ebp - 0xc], edx
lea edx, [edi + 0x30]
mov edi, dword [ebp - 8]
mov dword [ebp - 0x10], edx
lea edx, [esi + 0x10]
nop dword [eax]
movups xmm0, xmmword [eax]
mov esi, dword [ebp - 0xc]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ebx + eax - 0x40]
lea edx, [edx + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x30]
movups xmmword [edi + eax - 0x40], xmm1
movups xmm1, xmmword [esi + edx - 0x40]
mov esi, dword [ebp - 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
movups xmmword [edx - 0x40], xmm1
movups xmm1, xmmword [esi + ecx - 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
movups xmmword [edx - 0x30], xmm1
movups xmm1, xmmword [esi + ecx]
mov esi, dword [ebp + 0x14]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp ecx, dword [ebp - 0x14]
jb 0x608420
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp ecx, edx
jae 0x6084a2
sub edi, ebx
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
sub edx, 1
jne 0x608490
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6085b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.006d13f0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x14]
cmp esi, ebx
jbe 0x60865b
mov ecx, dword [edi + 0x18]
cmp esi, ecx
jb 0x60860b
mov eax, esi
sub eax, ecx
add eax, 4
and eax, 0xfffffffc
add eax, ecx
push 0x71
mov dword [edi + 0x18], eax
push str.....cryptomodesocb128.c
shl eax, 4
push eax
push dword [edi + 0x40]
call fcn.005e9260
add esp, 0x10
test eax, eax
jne 0x608608
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x40], eax
cmp ebx, esi
jae 0x608658
mov ecx, ebx
mov eax, esi
shl ecx, 4
mov esi, edi
sub eax, ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x40]
add eax, ecx
mov bl, byte [eax]
lea edi, [eax + 0x10]
push edi
shr bl, 7
push 1
neg bl
push eax
and bl, 0x87
call fcn.006082f0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor byte [edi + 0xf], bl
add ecx, 0x10
sub dword [ebp - 8], 1
mov dword [ebp - 4], ecx
jne 0x608620
mov esi, dword [ebp + 0xc]
mov ebx, esi
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], ebx
shl esi, 4
add esi, dword [edi + 0x40]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x609380
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
add ebx, esi
push edi
mov edi, dword [ebp + 8]
movzx eax, cl
add edi, esi
and eax, 1
test esi, esi
je 0x6093be
movzx edx, byte [ebx - 1]
lea ebx, [ebx - 1]
movzx ecx, cl
lea edi, [edi - 1]
xor edx, ecx
mov cl, byte [ebp + 0x14]
add eax, edx
mov byte [edi], al
shr eax, 8
sub esi, 1
jne 0x6093a0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x617b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
sub ecx, 4
jb 0x617b27
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x617b2e
add edx, 4
add esi, 4
sub ecx, 4
jae 0x617b16
xor edi, edi
cmp ecx, 0xfffffffc
je 0x617b69
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x617b69
cmp ecx, 0xfffffffd
je 0x617b69
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x617b69
cmp ecx, 0xfffffffe
je 0x617b69
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x617b69
cmp ecx, 0xffffffff
je 0x617b69
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle case.0x617bdd.2
mov edi, dword [ebp + 0xc]
xor ecx, ecx
test ebx, ebx
jle 0x617b8e
mov esi, dword [ebp + 8]
mov edx, edi
sub esi, edi
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x617b8e
inc ecx
inc edx
cmp ecx, ebx
jl 0x617b81
lea edx, [ebx - 1]
mov ebx, dword [ebp + 8]
test edx, edx
js 0x617bb1
mov esi, ebx
lea eax, [edx + edi]
sub esi, edi
nop
cmp byte [eax + esi], 0
jne 0x617bb1
cmp byte [eax], 0xff
jne 0x617bb1
dec eax
sub edx, 1
jns 0x617ba0
cmp ecx, edx
jl case.0x617bdd.2
jle 0x617bc3
pop edi
pop esi
lea eax, [ecx*8]
pop ebx
pop ebp
ret
mov dh, byte [ecx + ebx]
mov bl, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x617bdd.2
movzx eax, byte [eax + 0x617c50]
jmp dword [eax*4 + 0x617c30]
mov eax, 7
jmp 0x617c13
mov eax, 6
jmp 0x617c13
mov eax, 5
jmp 0x617c13
mov eax, 4
jmp 0x617c13
mov eax, 3
jmp 0x617c13
mov eax, 2
jmp 0x617c13
mov eax, 1
test dl, dh
jne case.0x617bdd.2
and bl, dl
cmp bl, dl
jne case.0x617bdd.2
pop edi
pop esi
lea eax, [eax + ecx*8]
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x618a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor edx, edx
test esi, esi
je 0x618ad0
mov al, byte [esi]
test al, al
je 0x618ad0
push edi
mov edi, 0x100
nop dword [eax]
movsx eax, al
lea esi, [esi + 1]
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol edx, cl
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x618aa0
mov eax, edx
shr eax, 0x10
pop edi
xor eax, edx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x618b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
je 0x618bca
mov al, byte [edi]
test al, al
je 0x618bca
push ebx
mov ebx, 0x100
nop word [eax + eax]
movsx eax, al
push eax
call fcn.0060a880
or eax, ebx
lea edi, [edi + 1]
mov ecx, eax
add esp, 4
shr ecx, 2
add ebx, 0x100
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol esi, cl
xor esi, eax
mov al, byte [edi]
test al, al
jne 0x618b90
mov eax, esi
pop ebx
shr eax, 0x10
pop edi
xor eax, esi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x61b810
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
call fcn.0060fed0
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.006d2640
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x61b8b6
push 0x45
push str.....crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.005e34c0
push 0x72ffa0
push esi
push 0x72ffa4
push dword [ebp + 8]
push str.fopen_
push 5
call fcn.005e2af0
add esp, 0x2c
call fcn.006e7083
cmp dword [eax], 2
je 0x61b892
call fcn.006e7083
cmp dword [eax], 6
je 0x61b892
lea eax, [edi + 2]
lea ecx, [edi + 0x4e]
jmp 0x61b89c
mov eax, 0x80
mov ecx, 0x4c
push ecx
push str.....crypto_bio_bss_file.c
push eax
push 0x6d
push 0x20
call fcn.005e34c0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x72ff44
call fcn.005e73e0
mov esi, eax
add esp, 4
test esi, esi
jne 0x61b8d9
push edi
call fcn.006e4d89
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push esi
call fcn.005e6d80
push edi
push ebx
push 0x6a
push esi
call fcn.005e6db0
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x61e180
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x61e1bf
push 0xc3
push str.....crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.005e34c0
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
pop ebp
ret
Function at 0x61e370
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20
call fcn.006d13f0
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov eax, esi
sub eax, ebx
je 0x61e3ba
sub eax, 2
je 0x61e3ba
sub eax, 0x15
je 0x61e3ba
push 0x293
push str.....crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call fcn.005e34c0
add esp, 0x14
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0061e100
cmp eax, 1
jne 0x61e3b2
mov eax, dword [ebp + 0x18]
xor ecx, ecx
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x20], ecx
xor edi, edi
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
test esi, esi
jne 0x61e3f2
or ecx, 0x400
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 1
jne 0x61e3fe
or ecx, 1
mov dword [ebp - 0x20], ecx
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x61e44e
cmp esi, 8
je 0x61e493
mov ecx, dword [ebp - 0x20]
test ecx, 0x400
je 0x61e45c
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20]
and ecx, 0xfffffbff
push eax
push dword [ebp + 0xc]
or ecx, 4
mov edi, esi
push dword [ebp + 8]
mov dword [ebp - 0x20], ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x61e417
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2d4
push str.....crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call fcn.005e34c0
test edi, edi
cmovne esi, edi
push esi
call fcn.0061e8a0
push eax
push 1
call fcn.005e2af0
add esp, 0x20
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2c5
push str.....crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call fcn.005e34c0
add esp, 0x14
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61e6a0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x42c
call fcn.006d13f0
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
call fcn.0061e100
cmp eax, 1
jne 0x61e780
push 0x401
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.006d4310
mov edx, dword [ebp + 0xc]
add esp, 0xc
neg edx
mov eax, 0x10
mov ecx, 0x1c
xorps xmm0, xmm0
sbb edx, edx
and edx, 0xa
cmp word [ebx], 2
push edx
push 0x20
cmove ecx, eax
lea eax, [ebp - 0x24]
push eax
push 0x401
lea eax, [ebp - 0x428]
push eax
push ecx
push ebx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov dword [ebp - 0x42c], eax
test eax, eax
je 0x61e793
push 0xd7
push str.....crypto_bio_b_addr.c
push 2
push 0x86
push 0x20
call fcn.005e34c0
add esp, 0x14
push 0
push 0x400
push 0x7cd500
push 0x400
push dword [ebp - 0x42c]
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x7cd500
push 1
call fcn.005e2af0
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x24], 0
jne 0x61e7d2
movzx eax, word [ebx]
cmp eax, 2
jne 0x61e7a7
movzx eax, word [ebx + 2]
jmp 0x61e7b4
cmp eax, 0x17
jne 0x61e7b2
movzx eax, word [ebx + 2]
jmp 0x61e7b4
xor eax, eax
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
push 0x793c48
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.005ead00
add esp, 0x10
test edi, edi
je 0x61e7f1
push 0xe9
lea eax, [ebp - 0x428]
push str.....crypto_bio_b_addr.c
push eax
call fcn.00618180
add esp, 0xc
mov dword [edi], eax
test esi, esi
je 0x61e80d
push 0xeb
lea eax, [ebp - 0x24]
push str.....crypto_bio_b_addr.c
push eax
call fcn.00618180
add esp, 0xc
mov dword [esi], eax
test edi, edi
je 0x61e816
cmp dword [edi], 0
je 0x61e81f
test esi, esi
je 0x61e889
cmp dword [esi], 0
jne 0x61e889
test edi, edi
je 0x61e83d
push 0xfa
push str.....crypto_bio_b_addr.c
push dword [edi]
call fcn.005e9230
add esp, 0xc
mov dword [edi], 0
test esi, esi
je 0x61e85b
push 0xfe
push str.....crypto_bio_b_addr.c
push dword [esi]
call fcn.005e9230
add esp, 0xc
mov dword [esi], 0
push 0x101
push str.....crypto_bio_b_addr.c
push 0x41
push 0x86
push 0x20
call fcn.005e34c0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006d0856
mov esp, ebp
pop ebp
ret