joyce8/EMBER2024-capa huggingface dataset:
Function at 0x566f60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push dword [0x753208]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], 0x10
call sub.WS2_32.dll___WSAFDIsSet
mov ebx, dword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jne 0x566f9f
mov dword [ebp - 0x38], 1
jmp 0x56701a
xor edi, edi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x638
push dword [0x753200]
push dword [0x753208]
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x567001
push dword [ebp - 0x14]
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [ebp - 0x16]
mov dword [ebp - 0x40], eax
call dword [sym.imp.WS2_32.dll_ntohs]
push dword [ebp + 0x10]
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x40]
push dword [ebp + 0xc]
push esi
push dword [0x753200]
push 1
push eax
call fcn.0058c080
inc edi
add esp, 0x18
cmp edi, 0x32
jl 0x566fa1
jmp 0x567013
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0x7e
mov dword [ebp - 0x38], 0x67
je 0x56701a
mov dword [ebp - 0x38], 0
push dword [ebp - 0x44]
mov dword [ebp - 0x40], 0x1c
push dword [0x75320c]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x56703a
mov eax, 1
jmp 0x56709c
xor edi, edi
nop dword [eax]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x638
push dword [0x753200]
push dword [0x75320c]
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x5670ba
push dword [ebp - 0x32]
call dword [sym.imp.WS2_32.dll_ntohs]
push dword [ebp + 0x10]
movups xmm0, xmmword [ebp - 0x2c]
mov word [ebp - 8], ax
lea eax, [ebp - 0x18]
push dword [ebp + 0xc]
movups xmmword [ebp - 0x18], xmm0
push esi
push dword [0x753200]
push 2
push eax
call fcn.0058c080
inc edi
add esp, 0x18
cmp edi, 0x32
jl 0x567040
xor eax, eax
cmp dword [ebp - 0x38], 0x67
pop edi
pop esi
pop ebx
je 0x5670cc
cmp eax, 0x67
je 0x5670cc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0x7e
jne 0x56709a
mov eax, 0x67
jmp 0x56709c
mov ecx, dword [ebp - 4]
mov eax, 0x67
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x5670e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [0x753204]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 0x10]
push esi
push edi
mov byte [ecx], al
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov edi, dword [0x753204]
mov esi, dword [ebp + 0x18]
push esi
push ebx
lea eax, [edi + 4]
mov byte [edi + 1], dl
push eax
mov word [edi + 2], 0
call sub.VCRUNTIME140.dll_memcpy
lea eax, [esi + 4]
movzx ebx, ax
push ebx
push edi
mov dword [ebp - 0x1c], ebx
call fcn.00566a30
mov edi, dword [0x753204]
add esp, 0x14
movzx ecx, ax
mov eax, ecx
shr eax, 8
mov byte [edi + 2], al
mov eax, dword [ebp + 0xc]
mov byte [edi + 3], cl
cmp eax, 1
jne 0x5671b3
mov ebx, dword [ebp - 0x18]
mov eax, 2
mov esi, dword [0x753208]
mov word [ebp - 0x14], ax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
movzx eax, word [ebx + 4]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.WS2_32.dll_sendto]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x5671e4
mov eax, dword [0x75320c]
cmp eax, 0xffffffff
je 0x5671e4
push ebx
mov ebx, dword [ebp - 0x18]
push edi
push ebx
push eax
call fcn.00566900
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
call fcn.0054cc20
push 0
push 0x3e8
mov esi, edx
mov ebx, eax
push esi
push ebx
call fcn.0066b190
push 0
push 0xea60
push esi
push ebx
mov edi, eax
call fcn.0066b190
push 0
push 0x3c
mov esi, edx
mov dword [ebp - 0x1c], eax
push esi
push eax
call fcn.0066b190
mov edx, dword [ebp - 0x1c]
push dword [ebp + 0xc]
imul ecx, edi, 0x3e8
sub ebx, ecx
mov ecx, edx
shl ecx, 4
push ebx
sub ecx, edx
mov ebx, eax
shl ecx, 2
mov eax, edx
sub edi, ecx
mov ecx, ebx
shl ecx, 4
push edi
sub ecx, ebx
shl ecx, 2
sub eax, ecx
push eax
push 0
push 0x5a0
push esi
push edx
call fcn.0066b190
lea eax, [eax + eax*2]
shl eax, 3
sub ebx, eax
push ebx
push str._TitanSDK___02d:_02d:_02d._03d__udp__sendto_failed:_invalid_ip_stack_d_n
call fcn.00551730
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x567280
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 2
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [0x753208]
mov word [ebp - 0x14], ax
push dword [esi]
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
movzx eax, word [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x10]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x567360
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x20]
shl al, 2
or al, byte [ebp + 0x14]
push edi
mov edi, dword [0x753204]
shl al, 4
or al, byte [ebp + 0x18]
push esi
mov byte [edi], al
lea eax, [edi + 1]
push ecx
push eax
mov dword [ebp - 0x1c], ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx eax, si
cmp byte [ebp + 0x10], 2
mov dword [ebp - 0x20], eax
jne 0x5673de
add eax, 3
mov word [edi + esi + 1], 0x4d5a
movzx ebx, ax
push ebx
push edi
call fcn.00566a30
mov edi, dword [0x753204]
add esp, 8
movzx ecx, ax
mov eax, ecx
shr eax, 8
mov byte [edi + esi + 1], al
jmp 0x567414
push esi
push dword [ebp - 0x1c]
call fcn.0058bc60
mov ecx, dword [ebp - 0x20]
mov edx, eax
mov edi, dword [0x753204]
add ecx, 5
movzx ebx, cx
add esp, 8
mov ecx, edx
shr ecx, 0x18
mov byte [edi + esi + 1], cl
mov ecx, edx
shr ecx, 0x10
shr eax, 8
mov byte [edi + esi + 3], al
mov byte [edi + esi + 4], dl
mov eax, dword [ebp + 0xc]
mov byte [edi + esi + 2], cl
cmp eax, 1
jne 0x567476
mov esi, dword [0x753208]
mov eax, 2
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x18]
push dword [eax]
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 4]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push eax
push 0
movzx eax, bx
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_sendto]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x5674aa
mov ecx, dword [0x75320c]
cmp ecx, 0xffffffff
je 0x5674aa
movzx eax, bx
push eax
push edi
push dword [ebp - 0x18]
push ecx
call fcn.00566900
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
call fcn.0054cc20
push 0
push 0x3e8
mov esi, edx
mov ebx, eax
push esi
push ebx
call fcn.0066b190
push 0
push 0xea60
push esi
push ebx
mov edi, eax
call fcn.0066b190
push 0
push 0x3c
mov esi, edx
mov dword [ebp - 0x20], eax
push esi
push eax
call fcn.0066b190
mov edx, dword [ebp - 0x20]
push dword [ebp + 0xc]
imul ecx, edi, 0x3e8
mov dword [ebp - 0x1c], eax
sub ebx, ecx
mov ecx, edx
shl ecx, 4
push ebx
sub ecx, edx
mov ebx, eax
shl ecx, 2
mov eax, edx
sub edi, ecx
mov ecx, ebx
shl ecx, 4
push edi
sub ecx, ebx
shl ecx, 2
sub eax, ecx
push eax
push 0
push 0x5a0
push esi
push edx
call fcn.0066b190
lea eax, [eax + eax*2]
shl eax, 3
sub ebx, eax
push ebx
push str._TitanSDK___02d:_02d:_02d._03d__udp__sendto_failed:_invalid_ip_stack_d_n
call fcn.00551730
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret

Function at 0x5682f0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005683f0
Function at 0x5683b0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005683f0

Function at 0x5683d0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
xor ecx, ecx
test eax, eax
setle cl
mov eax, ecx
pop ebp
ret

Function at 0x5683f0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
imul eax, dword [esi], 0xcc9e2d51
imul ecx, dword [esi + 4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
rol eax, 0xd
add eax, 0xfaddaf14
lea edx, [eax + eax*4]
imul eax, dword [esi + 8], 0xcc9e2d51
xor ecx, edx
rol ecx, 0xd
add ecx, 0xfaddaf14
rol eax, 0xf
imul eax, eax, 0x1b873593
lea ecx, [ecx + ecx*4]
xor ecx, eax
imul eax, dword [esi + 0xc], 0xcc9e2d51
rol ecx, 0xd
pop esi
rol eax, 0xf
lea ecx, [ecx + ecx*4]
imul eax, eax, 0x1b873593
add ecx, 0xe6546b64
xor ecx, eax
rol ecx, 0xd
lea ecx, [ecx + ecx*4]
add ecx, 0xe6546b64
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret

Function at 0x5685f0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x56862e
push dword [ebp + 0xc]
push eax
call fcn.0047b9e0
add esp, 8
test eax, eax
je 0x56862e
cmp dword [eax + 0xc], 4
jne 0x56862e
mov eax, dword [eax + 0x10]
test eax, eax
je 0x56862e
push dword [ebp + 0x10]
push eax
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
xor ecx, ecx
test eax, eax
setle cl
mov eax, ecx
pop ebp
ret
mov eax, 1
pop ebp
ret
Function at 0x56e130
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
cmp ebx, 2
jbe 0x56e1bc
lea edx, [ebx - 3]
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp + 0xc], eax
nop
movzx eax, byte [esi]
sub ebx, 3
shr eax, 2
movzx eax, byte [eax + edi]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + edi]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + edi]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + edi]
mov byte [ecx + 3], al
add ecx, 4
sub dword [ebp + 0xc], 1
jne 0x56e160
test ebx, ebx
je 0x56e221
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + edi]
mov byte [ecx], al
lea eax, [ecx + 2]
movzx edx, byte [esi]
and edx, 3
mov dword [ebp + 0xc], eax
cmp ebx, 1
mov ebx, dword [ebp + 0x14]
jne 0x56e1f5
shl edx, 4
mov al, byte [edx + edi]
mov byte [ecx + 1], al
mov eax, dword [ebp + 0xc]
mov ecx, eax
test ebx, ebx
je 0x56e221
mov dl, 0x3d
jmp 0x56e214
movzx eax, byte [esi + 1]
shr eax, 4
shl edx, 4
or eax, edx
mov al, byte [eax + edi]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
and eax, 0xf
mov dl, byte [edi + eax*4]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
lea ecx, [eax + 1]
test ebx, ebx
je 0x56e221
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
sub ecx, dword [eax + 4]
mov dword [eax], ecx
pop ebp
ret
Function at 0x56e3e0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
lea ecx, [edx - 2]
cmp ecx, 0xa
ja case.default.0x56e3f5
mov al, byte [ebp + 0xc]
jmp dword [ecx*4 + 0x56e570]
mov al, byte [ebp + 0xc]
cmp al, 0x40
jne 0x56e40a
mov eax, 4
pop ebp
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x56e419
cmp cl, 0x7a
jbe 0x56e469
cmp al, 0x30
jl 0x56e421
cmp al, 0x39
jle 0x56e469
cmp al, 0x2d
je 0x56e469
cmp al, 0x5f
je 0x56e469
cmp al, 0x2e
je 0x56e469
cmp al, 0x21
je 0x56e469
cmp al, 0x7e
je 0x56e469
cmp al, 0x2a
je 0x56e469
cmp al, 0x27
je 0x56e469
cmp al, 0x28
je 0x56e469
cmp al, 0x29
je 0x56e469
cmp al, 0x25
je 0x56e469
cmp al, 0x3b
je 0x56e469
cmp al, 0x3a
je 0x56e469
cmp al, 0x26
je 0x56e469
cmp al, 0x3d
je 0x56e469
cmp al, 0x2b
je 0x56e469
cmp al, 0x24
je 0x56e469
cmp al, 0x2c
jne case.default.0x56e3f5
mov eax, 3
pop ebp
ret
mov al, byte [ebp + 0xc]
cmp al, 0x5b
jne 0x56e47e
mov eax, 5
pop ebp
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x56e48d
cmp cl, 0x7a
jbe 0x56e4ca
cmp al, 0x30
jl 0x56e495
cmp al, 0x39
jle 0x56e4ca
cmp al, 0x2e
je 0x56e4ca
cmp al, 0x2d
jne case.default.0x56e3f5
mov eax, 6
pop ebp
ret
mov al, byte [ebp + 0xc]
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x56e4ba
cmp cl, 0x7a
jbe 0x56e4ca
cmp al, 0x30
jl 0x56e4c2
cmp al, 0x39
jle 0x56e4ca
cmp al, 0x2e
je 0x56e4ca
cmp al, 0x2d
jne case.0x56e3f5.8
mov eax, 6
pop ebp
ret
cmp al, 0x3a
jne case.default.0x56e3f5
mov eax, 0xb
pop ebp
ret
mov al, byte [ebp + 0xc]
cmp al, 0x5d
je 0x56e51f
cmp al, 0x30
jl 0x56e4ef
cmp al, 0x39
jle 0x56e514
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x56e4fe
cmp cl, 0x66
jbe 0x56e514
cmp al, 0x3a
je 0x56e514
cmp al, 0x2e
je 0x56e514
cmp edx, 7
jne case.default.0x56e3f5
cmp al, 0x25
jne case.default.0x56e3f5
lea eax, [edx + 2]
pop ebp
ret
mov eax, 7
pop ebp
ret
cmp al, 0x5d
jne case.0x56e3f5.9
mov eax, 8
pop ebp
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x56e535
cmp cl, 0x7a
jbe 0x56e551
cmp al, 0x30
jl 0x56e53d
cmp al, 0x39
jle 0x56e551
cmp al, 0x25
je 0x56e551
cmp al, 0x2e
je 0x56e551
cmp al, 0x2d
je 0x56e551
cmp al, 0x5f
je 0x56e551
cmp al, 0x7e
jne case.default.0x56e3f5
mov eax, 0xa
pop ebp
ret
mov al, byte [ebp + 0xc]
sub al, 0x30
cmp al, 9
mov eax, 0xc
jbe 0x56e56b
mov eax, 1
pop ebp
ret
Function at 0x571550
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 0xc]
push esi
cmp bl, 0x20
je case.default.0x571594
cmp bl, 0xd
je case.default.0x571594
cmp bl, 0xa
je case.default.0x571594
cmp bl, 9
je case.default.0x571594
cmp bl, 0xc
je case.default.0x571594
mov esi, dword [ebp + 8]
lea eax, [esi - 0x14]
cmp eax, 0xb
ja case.default.0x571594
jmp dword [eax*4 + 0x57177c]
cmp bl, 0x2f
je 0x57160f
cmp bl, 0x2a
je 0x57160f
or bl, 0x20
sub bl, 0x61
cmp bl, 0x19
ja case.default.0x571594
pop esi
mov eax, 0x15
pop ebx
pop ebp
ret
mov al, bl
or al, 0x20
sub al, 0x61
cmp al, 0x19
jbe 0x57176d
cmp bl, 0x3a
jne case.default.0x571594
pop esi
mov eax, 0x16
pop ebx
pop ebp
ret
cmp bl, 0x2f
jne case.default.0x571594
pop esi
mov eax, 0x17
pop ebx
pop ebp
ret
cmp bl, 0x2f
jne case.default.0x571594
pop esi
mov eax, 0x18
pop ebx
pop ebp
ret
cmp bl, 0x40
je case.default.0x571594
cmp bl, 0x2f
jne 0x571618
pop esi
mov eax, 0x1b
pop ebx
pop ebp
ret
cmp bl, 0x3f
je 0x5716dd
cmp bl, 0x40
jne 0x57162f
pop esi
mov eax, 0x1a
pop ebx
pop ebp
ret
mov al, bl
or al, 0x20
cmp al, 0x61
jb 0x57163b
cmp al, 0x7a
jbe 0x5716a8
cmp bl, 0x30
jl 0x571645
cmp bl, 0x39
jle 0x5716a8
cmp bl, 0x2d
je 0x5716a8
cmp bl, 0x5f
je 0x5716a8
cmp bl, 0x2e
je 0x5716a8
cmp bl, 0x21
je 0x5716a8
cmp bl, 0x7e
je 0x5716a8
cmp bl, 0x2a
je 0x5716a8
cmp bl, 0x27
je 0x5716a8
cmp bl, 0x28
je 0x5716a8
cmp bl, 0x29
je 0x5716a8
cmp bl, 0x25
je 0x5716a8
cmp bl, 0x3b
je 0x5716a8
cmp bl, 0x3a
je 0x5716a8
cmp bl, 0x26
je 0x5716a8
cmp bl, 0x3d
je 0x5716a8
cmp bl, 0x2b
je 0x5716a8
cmp bl, 0x24
je 0x5716a8
cmp bl, 0x2c
je 0x5716a8
cmp bl, 0x5b
je 0x5716a8
cmp bl, 0x5d
jne case.default.0x571594
pop esi
mov eax, 0x19
pop ebx
pop ebp
ret
movzx edx, bl
mov eax, 1
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + 0x692cc0], al
jne 0x57176d
cmp bl, 0x23
je 0x571713
cmp bl, 0x3f
jne case.default.0x571594
pop esi
mov eax, 0x1c
pop ebx
pop ebp
ret
movzx edx, bl
mov eax, 1
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + 0x692cc0], al
jne 0x57170a
cmp bl, 0x23
je 0x571713
cmp bl, 0x3f
jne case.default.0x571594
pop esi
mov eax, 0x1d
pop ebx
pop ebp
ret
pop esi
mov eax, 0x1e
pop ebx
pop ebp
ret
movzx edx, bl
mov eax, 1
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + 0x692cc0], al
jne 0x571740
cmp bl, 0x23
je 0x57176d
cmp bl, 0x3f
jne case.default.0x571594
pop esi
mov eax, 0x1f
pop ebx
pop ebp
ret
movzx edx, bl
mov eax, 1
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + 0x692cc0], al
jne 0x57176d
cmp bl, 0x23
je 0x57176d
cmp bl, 0x3f
jne case.default.0x571594
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x58b0c0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x753770]
test eax, eax
je 0x58b148
push esi
mov esi, dword [0x753668]
cmp esi, 0x753668
je 0x58b147
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
mov edi, dword [esi]
mov ecx, edi
test eax, eax
je 0x58b114
push eax
push 1
push dword [esi + 0xc]
push dword [esi + 8]
call ebx
push 0x6f16a4
push dword [0x753770]
call fcn.0054fa70
push dword [0x753770]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, dword [esi]
add esp, 0x1c
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov dword [eax], ecx
push dword [esi + 8]
call fcn.00556740
push esi
mov dword [esi + 8], 0
call fcn.00556740
add esp, 8
mov esi, edi
cmp edi, 0x753668
je 0x58b145
mov eax, dword [0x753770]
jmp 0x58b0e0
pop edi
pop ebx
pop esi
ret

Function at 0x592df0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00592990
Function at 0x59bcc0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
xor esi, esi
call fcn.005d53e0
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x59bd18
push str.RANDFILE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov esi, eax
add esp, 4
test esi, esi
je 0x59bd18
cmp byte [esi], 0
je 0x59bd18
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x59bcf0
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, edi
jae 0x59bd18
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.005bf470
add esp, 0xc
cmp eax, edi
jb 0x59bd88
pop edi
xor eax, eax
pop esi
ret
call fcn.005d53e0
test eax, eax
jne 0x59bd30
push str.HOME
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, eax
test esi, esi
jne 0x59bd3b
mov esi, 0x697818
jmp 0x59bd40
cmp byte [esi], 0
je 0x59bd81
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x59bd45
sub ecx, edx
lea eax, [ecx + 6]
cmp eax, edi
jae 0x59bd81
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.005bf470
push edi
push 0x6f0eb4
push esi
call fcn.005bf410
push edi
push str..rnd
push esi
call fcn.005bf410
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
mov esi, dword [esp + 0xc]
mov byte [esi], 0
pop edi
mov eax, esi
pop esi
ret
Function at 0x59bd90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0066af60
mov eax, dword [0x74b738]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x44], ebx
test edi, edi
je 0x59beda
lea eax, [esp + 0x48]
push eax
push edi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32
add esp, 8
test eax, eax
js 0x59beda
lea eax, [ebx + 8]
call fcn.0066af60
xorps xmm0, xmm0
lea eax, [esp + 0x50]
movsd qword [esp], xmm0
push 0x30
push eax
call fcn.0059f0a0
mov esi, dword [ebp + 0xc]
add esp, 0x10
test esi, esi
je 0x59beda
push 0x6f15a8
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x59bec3
test dword [esp + 0x4e], 0x2000
je 0x59be42
push ebx
push 4
mov ecx, 0x800
cmp esi, 0xffffffff
push ebx
push eax
cmove esi, ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_setvbuf
mov eax, dword [esp + 0x50]
add esp, 0x10
mov edi, 0x400
test esi, esi
jle 0x59be50
cmp esi, edi
cmovl edi, esi
push eax
push edi
lea eax, [esp + 0x80]
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x59bea4
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.0066af60
lea eax, [esp + 0x80]
movsd qword [esp], xmm0
push edi
push eax
call fcn.0059f0a0
add dword [esp + 0x54], ebx
add esp, 0x10
mov eax, dword [esp + 0x40]
test esi, esi
jle 0x59be42
sub esi, edi
test esi, esi
jg 0x59be42
push dword [esp + 0x40]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
lea eax, [esp + 0x7c]
push 0x400
push eax
call fcn.00401360
mov ebx, dword [esp + 0x50]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x47c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x5a3730
Capabilities:
Query environment variable

Disassembly:
mov eax, 4
call fcn.0066af60
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor edi, edi
push ebx
call fcn.005e8ad0
mov esi, dword [esp + 0x1c]
mov ebp, eax
add esp, 4
mov dword [esp + 0x10], ebp
test ebp, ebp
je 0x5a38cc
test esi, esi
jne 0x5a37eb
push str.OPENSSL_CONF
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x5a3783
push eax
call fcn.005bf380
add esp, 4
mov edi, eax
jmp 0x5a37e1
call fcn.005e9470
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a3790
sub eax, edx
push 0x21f
push str..cryptoconfconf_mod.c
lea esi, [eax + 0xd]
push esi
call fcn.005ae120
mov edi, eax
add esp, 0xc
test edi, edi
je 0x5a38d3
push esi
call fcn.005e9470
push eax
push edi
call fcn.005bf470
push esi
push 0x6f0eb4
push edi
call fcn.005bf410
push esi
push str.openssl.cnf
push edi
call fcn.005bf410
add esp, 0x24
test edi, edi
je 0x5a38d3
jmp 0x5a37ed
mov edi, esi
push 0
push edi
push ebp
call fcn.005e89e0
add esp, 0xc
test eax, eax
jg 0x5a3825
test byte [esp + 0x20], 0x10
je 0x5a38cc
call fcn.0059e690
and eax, 0xfff
cmp eax, 0x72
jne 0x5a38cc
call fcn.0059d960
jmp 0x5a38c7
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
test eax, eax
je 0x5a3846
push eax
push 0
push ebp
call fcn.005e8970
add esp, 0xc
test eax, eax
jne 0x5a3861
test bl, 0x20
je 0x5a385a
push str.openssl_conf
push 0
push ebp
call fcn.005e8970
add esp, 0xc
test eax, eax
jne 0x5a3861
call fcn.0059d960
jmp 0x5a38c7
push eax
push ebp
call fcn.005e8910
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x5a3879
xor ebx, ebx
mov ebp, dword [esp + 0x10]
jmp 0x5a38cc
push ebp
xor esi, esi
call fcn.0059b780
add esp, 4
test eax, eax
jle 0x5a38c3
push esi
push ebp
call fcn.0059b910
push ebx
push dword [eax + 8]
push dword [eax + 4]
push dword [esp + 0x24]
call fcn.005a3df0
mov ebx, eax
add esp, 0x18
test ebx, ebx
jg 0x5a38af
test byte [esp + 0x20], 1
je 0x5a3873
push ebp
inc esi
call fcn.0059b780
add esp, 4
cmp esi, eax
jge 0x5a38c3
mov ebx, dword [esp + 0x20]
jmp 0x5a3888
mov ebp, dword [esp + 0x10]
mov ebx, 1
cmp dword [esp + 0x18], 0
jne 0x5a38dc
push edi
call fcn.005adf40
add esp, 4
push ebp
call fcn.005e8830
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret