joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9260
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.007081d0
mov eax, dword [ebp + 8]
push eax
call fcn.004b4cb0
add esp, 4
test eax, eax
je 0x4a9286
mov dword [ebp - 0xc], 0x10
jmp 0x4a928d
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
push ecx
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.0052ecc0
add esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
jne 0x4a92b9
xor eax, eax
jmp 0x4a9315
mov edx, dword [ebp + 8]
push edx
call fcn.004b4cb0
add esp, 4
test eax, eax
je 0x4a9312
push str.HARNESS_OSSL_PREFIX
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a9312
mov eax, dword [ebp - 4]
push eax
call fcn.005c45b0
push eax
call fcn.00521370
add esp, 4
push eax
call fcn.00521600
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x4f
mov edx, dword [ebp - 4]
push edx
call fcn.005208c0
add esp, 0x10
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4ae9e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.007081d0
push 0x9a
push str.appslib_apps_ui.c
mov eax, dword [ebp + 8]
push eax
call fcn.005135a0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4aea3e
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.Could_not_allocate__d_bytes_for__s_n
mov eax, dword [0x7d10f0]
push eax
call fcn.00513860
add esp, 0x10
mov ecx, dword [0x7d10f0]
push ecx
call fcn.005283a0
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b1820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.007081d0
mov eax, dword [ebp + 0xc]
lea ecx, [eax + eax + 1]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jb 0x4b1853
cmp dword [ebp - 0xc], 0
jl 0x4b1853
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
je 0x4b1878
mov edx, dword [ebp + 0xc]
push edx
call fcn.004a56e0
push eax
push str._s:__zu_byte_buffer_too_large_to_hexencode_n
mov eax, dword [0x7d10f0]
push eax
call fcn.00513860
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push str.TLSA_hex_data_buffer
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004a7dd0
add esp, 8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
jbe 0x4b18f5
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
sar eax, 4
and eax, 0xf
mov ecx, dword [ebp - 4]
mov edx, dword [str.0123456789abcdef]
mov al, byte [edx + eax]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
and eax, 0xf
mov ecx, dword [ebp - 4]
mov edx, dword [str.0123456789abcdef]
mov al, byte [edx + eax]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x4b1892
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x52e320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.007081d0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x52e396
cmp dword [ebp + 0xc], 0
je 0x52e396
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
and edx, 0
je 0x52e36d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x52e38a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x52e396
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x589890
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.007081d0
push esi
push edi
mov eax, 4
shl eax, 1
mov esi, dword [eax + 0x7d3c90]
xor edi, edi
mov ecx, 4
imul edx, ecx, 3
xor ecx, ecx
mov eax, dword [edx + 0x7d3c90]
mov edx, ecx
mov cl, 0x20
call fcn.00708cb0
or esi, eax
or edi, edx
push edi
push esi
mov edx, 4
imul eax, edx, 0
mov esi, dword [eax + 0x7d3c90]
xor edi, edi
mov ecx, 4
shl ecx, 0
xor edx, edx
mov eax, dword [ecx + 0x7d3c90]
mov cl, 0x20
call fcn.00708cb0
or esi, eax
or edi, edx
push edi
push esi
push str.CPUINFO:_OPENSSL_ia32cap0x_llx:0x_llx
push 0x80
push 0x7d2410
call fcn.005138a0
add esp, 0x1c
push 0x76a81c
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x589961
mov edx, dword [ebp - 4]
push edx
push str._env:_s
push 0x7d2410
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, 0x80
sub ecx, eax
push ecx
push 0x7d2410
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 0x7d2410
push eax
call fcn.005138a0
add esp, 0x10
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [eax + 0x7d24a0]
test ecx, ecx
je 0x58998b
push 0x200
push 0x716e04
push 0x7d24a0
call fcn.0052dc30
add esp, 0xc
push 0x200
push str.os_specific
push 0x7d24a0
call fcn.0052dc30
add esp, 0xc
xor edx, edx
jne 0x589961
mov dword [0x7d2490], 0x7d24a0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5a81b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.007081d0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 4], ecx
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
je 0x5a81f3
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
jmp 0x5a822d
mov ecx, dword [ebp - 4]
push ecx
call fcn.005a9380
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0044aff0
add esp, 4
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 8], eax
push 0xf
mov edx, dword [ebp + 8]
push edx
call fcn.00520860
add esp, 8
cmp dword [ebp - 8], 0
jg 0x5a826b
mov eax, dword [ebp - 8]
push eax
call fcn.005a8b40
add esp, 4
test eax, eax
je 0x5a826b
push 0xa
mov ecx, dword [ebp + 8]
push ecx
call fcn.00521910
add esp, 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x5a8be0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c
call fcn.007081d0
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
jg 0x5a8c0d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
jle 0x5a8d54
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jge 0x5a8c47
push str.getsockopt
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
jmp 0x5a8c6f
mov eax, dword [ebp - 8]
cdq
mov ecx, 0x3e8
idiv ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 8]
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], edx
lea ecx, [ebp - 0x1c]
push ecx
call fcn.005a8e80
add esp, 4
push 8
mov edx, dword [ebp - 4]
add edx, 0x28
push edx
lea eax, [ebp - 0x14]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x18]
jge 0x5a8cb1
mov edx, 0xf4240
sub edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0x5a8cba
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jge 0x5a8cd2
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 1
jmp 0x5a8cdb
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x30], 0
jne 0x5a8ced
mov edx, dword [ebp - 4]
cmp dword [edx + 0x34], 0
je 0x5a8d0e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
cmp ecx, dword [ebp - 0x14]
jg 0x5a8d0e
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
cmp eax, dword [ebp - 0x14]
jne 0x5a8d54
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x34]
cmp edx, dword [ebp - 0x10]
jl 0x5a8d54
imul ecx, dword [ebp - 0x14], 0x3e8
mov eax, dword [ebp - 0x10]
cdq
mov esi, 0x3e8
idiv esi
add ecx, eax
mov dword [ebp - 8], ecx
push 4
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x5a8d54
push str.setsockopt
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5a8e00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.007081d0
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
jg 0x5a8e29
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
jle 0x5a8e75
mov ecx, dword [ebp - 4]
imul ecx, dword [ecx + 0x30], 0x3e8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x34]
cdq
mov esi, 0x3e8
idiv esi
add ecx, eax
mov dword [ebp - 8], ecx
push 4
lea eax, [ebp - 8]
push eax
push 0x1006
push 0xffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x5a8e75
push str.setsockopt
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5aaa50
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.007081d0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 0x18]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5aab29
mov eax, dword [ebp - 4]
movsx ecx, word [eax + 8]
cmp ecx, 2
jne 0x5aab08
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0xa]
cmp eax, 4
jne 0x5aab08
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc], edx
jmp 0x5aaac5
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0
je 0x5aab08
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
movzx edx, word [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005aa910
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x5aaafb
mov eax, 8
jmp 0x5aab6e
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
add edx, 0x1c
mov dword [ebp - 8], edx
jmp 0x5aaabc
push 0x400
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
push 0x401
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x10
xor eax, eax
jmp 0x5aab6e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0x2af9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
ja case.default.0x5aab46
mov ecx, dword [ebp - 0x10]
jmp dword [ecx*4 + 0x5aab74]
mov eax, 0x2af9
jmp 0x5aab6e
mov eax, 0x2afa
jmp 0x5aab6e
mov eax, 0x2afb
jmp 0x5aab6e
mov eax, 0x2af9
jmp 0x5aab6e
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5ab1c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.007081d0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5ab1de
jmp 0x5ab2ae
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x1c
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
call fcn.0044aff0
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5ab275
call fcn.00516cf0
push str.BIO_sock_info
push 0x172
push str.crypto_bio_bio_sock.c
call fcn.00516d40
add esp, 0xc
push str.calling_getsockname__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00516d90
add esp, 0xc
call fcn.00516cf0
push str.BIO_sock_info
push 0x174
push str.crypto_bio_bio_sock.c
call fcn.00516d40
add esp, 0xc
push 0
push 0x84
push 0x20
call fcn.00516d90
add esp, 0xc
xor eax, eax
jmp 0x5ab2e4
cmp dword [ebp - 8], 0x1c
jbe 0x5ab2ac
call fcn.00516cf0
push str.BIO_sock_info
push 0x178
push str.crypto_bio_bio_sock.c
call fcn.00516d40
add esp, 0xc
push 0
push 0x85
push 0x20
call fcn.00516d90
add esp, 0xc
xor eax, eax
jmp 0x5ab2e4
jmp 0x5ab2df
call fcn.00516cf0
push str.BIO_sock_info
push 0x17e
push str.crypto_bio_bio_sock.c
call fcn.00516d40
add esp, 0xc
push 0
push 0x8c
push 0x20
call fcn.00516d90
add esp, 0xc
xor eax, eax
jmp 0x5ab2e4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x5ab2f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7d26c8], 0
jne 0x5ab393
mov dword [0x7d26c8], 1
push 0x190
push 0
push 0x7d26d0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x7d26d0
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x5ab393
call fcn.00516cf0
push str.BIO_sock_init
push 0x94
push str.crypto_bio_bio_sock.c
call fcn.00516d40
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00516d90
add esp, 0xc
call fcn.00516cf0
push str.BIO_sock_init
push 0x96
push str.crypto_bio_bio_sock.c
call fcn.00516d40
add esp, 0xc
push 0
push 0x7a
push 0x20
call fcn.00516d90
add esp, 0xc
or eax, 0xffffffff
jmp 0x5ab398
mov eax, 1
pop ebp
ret

Function at 0x5ab3a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.007081d0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x5ab3fa
call fcn.00516cf0
push str.BIO_socket_ioctl
push 0xd1
push str.crypto_bio_bio_sock.c
call fcn.00516d40
add esp, 0xc
push str.calling_ioctlsocket__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00516d90
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5ab470
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124
call fcn.007081d0
mov eax, dword [0x7d0e44]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jl 0x5ab493
cmp dword [ebp + 8], 0x40
jl 0x5ab49b
or eax, 0xffffffff
jmp 0x5ab5de
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0x14]
jne 0x5ab4ad
mov eax, 1
jmp 0x5ab5de
push 0
call fcn.00490290
add esp, 4
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], edx
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x118]
jg 0x5ab4e2
jl 0x5ab4db
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x11c]
jae 0x5ab4e2
xor eax, eax
jmp 0x5ab5de
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
jmp 0x5ab507
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x108]
jae 0x5ab52b
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp + edx*4 - 0x104]
cmp eax, dword [ebp + 8]
jne 0x5ab529
jmp 0x5ab52b
jmp 0x5ab4f8
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x108]
jne 0x5ab561
cmp dword [ebp - 0x108], 0x40
jae 0x5ab561
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp + 8]
mov dword [ebp + edx*4 - 0x104], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
xor edx, edx
jne 0x5ab4ec
mov dword [ebp - 0x120], 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x11c]
mov dword [ebp - 0x124], eax
cmp dword [ebp + 0xc], 0
je 0x5ab590
mov dword [ebp - 0x110], 0
jmp 0x5ab59c
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x110], ecx
cmp dword [ebp + 0xc], 0
je 0x5ab5b0
lea edx, [ebp - 0x108]
mov dword [ebp - 0x114], edx
jmp 0x5ab5ba
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x124]
push eax
push 0
mov ecx, dword [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp + 8]
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.007081b5
mov esp, ebp
pop ebp
ret
Function at 0x5ab830
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.007081d0
mov dword [ebp - 8], 1
cmp dword [ebp + 8], 0xffffffff
jne 0x5ab87b
call fcn.00516cf0
push str.BIO_connect
push 0x54
push str.crypto_bio_bio_sock2.c
call fcn.00516d40
add esp, 0xc
push 0
push 0x87
push 0x20
call fcn.00516d90
add esp, 0xc
xor eax, eax
jmp 0x5aba47
mov eax, dword [ebp + 0x10]
and eax, 8
je 0x5ab88c
mov dword [ebp - 4], 1
jmp 0x5ab893
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005ab410
add esp, 8
test eax, eax
jne 0x5ab8ae
xor eax, eax
jmp 0x5aba47
mov eax, dword [ebp + 0x10]
and eax, 4
je 0x5ab931
push 4
lea ecx, [ebp - 8]
push ecx
push 8
push 0xffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x5ab931
call fcn.00516cf0
push str.BIO_connect
push 0x5e
push str.crypto_bio_bio_sock2.c
call fcn.00516d40
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00516d90
add esp, 0xc
call fcn.00516cf0
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.00516d40
add esp, 0xc
push 0
push 0x89
push 0x20
call fcn.00516d90
add esp, 0xc
xor eax, eax
jmp 0x5aba47
mov eax, dword [ebp + 0x10]
and eax, 0x10
je 0x5ab9b1
push 4
lea ecx, [ebp - 8]
push ecx
push 1
push 6
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x5ab9b1
call fcn.00516cf0
push str.BIO_connect
push 0x68
push str.crypto_bio_bio_sock2.c
call fcn.00516d40
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00516d90
add esp, 0xc
call fcn.00516cf0
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.00516d40
add esp, 0xc
push 0
push 0x8a
push 0x20
call fcn.00516d90
add esp, 0xc
xor eax, eax
jmp 0x5aba47
mov eax, dword [ebp + 0xc]
push eax
call fcn.005a9380
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0044aff0
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x5aba42
push 0xffffffffffffffff
call fcn.005ac280
add esp, 4
test eax, eax
jne 0x5aba3e
call fcn.00516cf0
push str.BIO_connect
push 0x72
push str.crypto_bio_bio_sock2.c
call fcn.00516d40
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00516d90
add esp, 0xc
call fcn.00516cf0
push str.BIO_connect
push 0x74
push str.crypto_bio_bio_sock2.c
call fcn.00516d40
add esp, 0xc
push 0
push 0x67
push 0x20
call fcn.00516d90
add esp, 0xc
xor eax, eax
jmp 0x5aba47
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5abe70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.007081d0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov ecx, dword [ebp + 8]
push ecx
call fcn.00520860
add esp, 8
cmp dword [ebp - 4], 0
jg 0x5abed8
mov edx, dword [ebp - 4]
push edx
call fcn.005ac280
add esp, 4
test eax, eax
je 0x5abed8
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00521910
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5b0720
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.007081d0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 5
je 0x5b075c
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005b1160
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x5b075c
mov eax, dword [ebp - 4]
jmp 0x5b07b3
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov eax, dword [ebp + 8]
push eax
call fcn.00520860
add esp, 8
cmp dword [ebp - 4], 0
jg 0x5b07b0
mov ecx, dword [ebp - 4]
push ecx
call fcn.005ac280
add esp, 4
test eax, eax
je 0x5b07b0
push 0xa
mov edx, dword [ebp + 8]
push edx
call fcn.00521910
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5c5fd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x43c
call fcn.007081d0
mov eax, dword [0x7d0e44]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x43c], 0xffffffff
mov dword [ebp - 0x438], 0
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
jl 0x5c605b
movzx edx, word [ebp - 0x42e]
and edx, 0x8000
jne 0x5c605b
call fcn.00516cf0
push str.RAND_write_file
push 0xbe
push str.crypto_rand_randfile.c
call fcn.00516d40
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str.Filename_s
push 0x7a
push 0x24
call fcn.00516d90
add esp, 0x10
or eax, 0xffffffff
jmp 0x5c613b
push 0x400
lea ecx, [ebp - 0x404]
push ecx
call fcn.0057d5d0
add esp, 8
cmp eax, 1
je 0x5c607c
or eax, 0xffffffff
jmp 0x5c613b
cmp dword [ebp - 0x438], 0
jne 0x5c609c
push 0x732ac8
mov edx, dword [ebp + 8]
push edx
call fcn.005f3970
add esp, 8
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jne 0x5c60db
call fcn.00516cf0
push str.RAND_write_file
push 0xf0
push str.crypto_rand_randfile.c
call fcn.00516d40
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str.Filename_s
push 0x79
push 0x24
call fcn.00516d90
add esp, 0x10
or eax, 0xffffffff
jmp 0x5c613b
push 0x180
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chmod]
add esp, 8
mov edx, dword [ebp - 0x438]
push edx
push 0x400
push 1
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov dword [ebp - 0x43c], eax
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push 0x400
lea edx, [ebp - 0x404]
push edx
call fcn.00401320
add esp, 8
mov eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.007081b5
mov esp, ebp
pop ebp
ret