joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ff3e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x54c
call fcn.004d28e0
mov eax, dword [0x7c9564]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x48], 0
cmp dword [ebp + 0xc], 0
jne 0x4ff40b
xor eax, eax
jmp 0x4ff61a
push 0x7277f0
mov eax, dword [ebp + 8]
push eax
call fcn.00581910
add esp, 8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x4ff45b
call fcn.0052db80
push str.RAND_load_file
push 0x6a
push str.crypto_rand_randfile.c
call fcn.0052ddd0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str.Filename_s
push 0x79
push 0x24
call fcn.0052df00
add esp, 0x10
or eax, 0xffffffff
jmp 0x4ff61a
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x44]
push eax
call fcn.004d91ce
add esp, 4
push eax
call fcn.004cd918
add esp, 8
test eax, eax
jge 0x4ff4ba
call fcn.0052db80
push str.RAND_load_file
push 0x71
push str.crypto_rand_randfile.c
call fcn.0052ddd0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str.Filename_s
push 0x71
push 0x24
call fcn.0052df00
add esp, 0x10
mov edx, dword [ebp - 0x44]
push edx
call fcn.004d0a58
add esp, 4
or eax, 0xffffffff
jmp 0x4ff61a
cmp dword [ebp + 0xc], 0
jge 0x4ff4da
movzx eax, word [ebp - 0x3a]
and eax, 0x8000
je 0x4ff4d3
mov ecx, dword [ebp - 0x2c]
mov dword [ebp + 0xc], ecx
jmp 0x4ff4da
mov dword [ebp + 0xc], pe_nt_image_headers32
push 0
mov edx, dword [ebp - 0x44]
push edx
call fcn.00714d22
add esp, 8
cmp dword [ebp + 0xc], 0
jle 0x4ff517
cmp dword [ebp + 0xc], 0x500
jg 0x4ff502
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54c], eax
jmp 0x4ff50c
mov dword [ebp - 0x54c], 0x400
mov ecx, dword [ebp - 0x54c]
mov dword [ebp - 4], ecx
jmp 0x4ff51e
mov dword [ebp - 4], 0x500
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 4]
push eax
push 1
lea ecx, [ebp - 0x548]
push ecx
call fcn.004d1333
add esp, 0x10
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x44]
push edx
call fcn.004d2363
add esp, 4
test eax, eax
je 0x4ff568
call fcn.004d1ba9
cmp dword [eax], 4
jne 0x4ff568
mov eax, dword [ebp - 0x44]
push eax
call fcn.00714d17
add esp, 4
cmp dword [ebp - 8], 0
jne 0x4ff568
jmp 0x4ff4e8
cmp dword [ebp - 8], 0
jne 0x4ff570
jmp 0x4ff5b8
fild dword [ebp - 8]
mov eax, 8
call fcn.004d28e0
fstp qword [esp]
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x548]
push edx
call fcn.004fe0f0
add esp, 0x10
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 8]
mov dword [ebp - 0x48], eax
cmp dword [ebp + 0xc], 0
jle 0x4ff5b3
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0xc], 0
jg 0x4ff5b3
jmp 0x4ff5b8
jmp 0x4ff4e8
push 0x500
lea edx, [ebp - 0x548]
push edx
call fcn.005494a0
add esp, 8
mov eax, dword [ebp - 0x44]
push eax
call fcn.004d0a58
add esp, 4
call fcn.004fe1e0
test eax, eax
jne 0x4ff617
call fcn.0052db80
push str.RAND_load_file
push 0xae
push str.crypto_rand_randfile.c
call fcn.0052ddd0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str.Filename_s
push 0x76
push 0x24
call fcn.0052df00
add esp, 0x10
or eax, 0xffffffff
jmp 0x4ff61a
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004d0e4d
mov esp, ebp
pop ebp
ret
Function at 0x4ff7a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28
call fcn.004d28e0
mov eax, dword [0x7c9564]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], str.RANDFILE
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4ff83e
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], str.HOME
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4ff83e
mov dword [ebp - 0x14], str.USERPROFILE
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4ff83e
mov dword [ebp - 0x14], str.SYSTEMROOT
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ff8d1
mov eax, dword [ebp - 4]
shl eax, 1
call fcn.004d10a0
mov dword [ebp - 0x24], esp
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, dword [ebp - 4]
jae 0x4ff8d1
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x18]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4ff8d1
mov eax, dword [ebp - 0x1c]
call fcn.004d10a0
mov dword [ebp - 0x28], esp
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
push 0
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4ff8d1
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
je 0x4ff8e1
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
test edx, edx
jne 0x4ff8e8
xor eax, eax
jmp 0x4ff970
mov eax, dword [ebp - 8]
push eax
call fcn.004d0510
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
je 0x4ff91e
mov ecx, dword [ebp - 0x10]
add ecx, 1
cmp ecx, dword [ebp + 0xc]
jb 0x4ff90c
xor eax, eax
jmp 0x4ff970
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004d5be0
add esp, 8
jmp 0x4ff96d
push str..rnd
call fcn.004d0510
add esp, 4
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 2]
cmp edx, dword [ebp + 0xc]
jb 0x4ff93b
xor eax, eax
jmp 0x4ff970
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d5be0
add esp, 8
push 0x7bc77c
mov edx, dword [ebp + 8]
push edx
call fcn.004d5bf0
add esp, 8
push str..rnd
mov eax, dword [ebp + 8]
push eax
call fcn.004d5bf0
add esp, 8
mov eax, dword [ebp + 8]
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004d0e4d
mov esp, ebp
pop ebp
ret
Function at 0x5267a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.004d28e0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00581910
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
push 0x62
mov edx, dword [ebp + 0xc]
push edx
call fcn.004cd150
add esp, 8
test eax, eax
jne 0x5267e2
mov eax, dword [ebp - 4]
or eax, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jne 0x526891
call fcn.0052db80
push str.BIO_new_file
push 0x43
push str.crypto_bio_bss_file.c
call fcn.0052ddd0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.calling_fopen__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
call fcn.0052df00
add esp, 0x14
call fcn.004d1ba9
cmp dword [eax], 2
je 0x526837
call fcn.004d1ba9
cmp dword [eax], 6
jne 0x526863
call fcn.0052db80
push str.BIO_new_file
push 0x4b
push str.crypto_bio_bss_file.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x80
push 0x20
call fcn.0052df00
add esp, 0xc
jmp 0x52688d
call fcn.0052db80
push str.BIO_new_file
push 0x4d
push str.crypto_bio_bss_file.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x80002
push 0x20
call fcn.0052df00
add esp, 0xc
xor eax, eax
jmp 0x5268df
call fcn.00526950
push eax
call fcn.00501f30
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5268b8
mov eax, dword [ebp - 8]
push eax
call fcn.004d0a58
add esp, 4
xor eax, eax
jmp 0x5268df
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00502260
add esp, 8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x6a
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00502dc0
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x526b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.004d28e0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x526bb4
cmp dword [ebp + 0xc], 0
je 0x526bb4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
and edx, 0
je 0x526b8c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004d0971
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x526ba8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004d0971
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x526bb4
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x52d4e0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push 0x70
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004d1020
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], 0xc1059ed8
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0x367cd507
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x3070dd17
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xf70e5939
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xffc00b31
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x68581511
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0x64f98fa7
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0xbefa4fa4
mov eax, dword [ebp + 8]
mov dword [eax + 0x6c], 0x1c
mov eax, 1
pop ebp
ret

Function at 0x52d560
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0x70
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004d1020
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x6a09e667
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0xbb67ae85
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x3c6ef372
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xa54ff53a
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x510e527f
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x9b05688c
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0x1f83d9ab
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0x5be0cd19
mov eax, dword [ebp + 8]
mov dword [eax + 0x6c], 0x20
mov eax, 1
pop ebp
ret

Function at 0x53d4f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.004d28e0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.WSOCK32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov ecx, dword [ebp + 8]
push ecx
call fcn.00502260
add esp, 8
cmp dword [ebp - 4], 0
jg 0x53d558
mov edx, dword [ebp - 4]
push edx
call fcn.0053d710
add esp, 4
test eax, eax
je 0x53d558
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00502290
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x558340
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.004d28e0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 5
je 0x55837c
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00557dc0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x55837c
mov eax, dword [ebp - 4]
jmp 0x5583d3
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.WSOCK32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov eax, dword [ebp + 8]
push eax
call fcn.00502260
add esp, 8
cmp dword [ebp - 4], 0
jg 0x5583d0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0053d710
add esp, 4
test eax, eax
je 0x5583d0
push 0xa
mov edx, dword [ebp + 8]
push edx
call fcn.00502290
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x576750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x240
call fcn.004d28e0
mov eax, dword [0x7c9564]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x75ef90
mov dword [ebp - 0x1c], 0x576a00
mov dword [ebp - 0x18], str.getnameinfo
mov dword [ebp - 0x14], 0x5772c0
mov dword [ebp - 0x10], 0x75ef74
mov dword [ebp - 0xc], fcn.00576990
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
cmp dword [0x7cdf90], 0
je 0x5767bf
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x7cad68]
jmp 0x576979
push 0x104
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x5767da
jmp 0x5768cf
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.004de1ab
add esp, 0xc
push str.ws2_32
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.004edaa0
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x57684d
push 0x75ef90
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x57684d
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0
je 0x576855
jmp 0x5768cf
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.004de1ab
add esp, 0xc
push str.wship6
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.004edaa0
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x5768c8
push 0x75ef90
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x5768c8
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x24], 0
jmp 0x5768cf
cmp dword [ebp - 0x24], 0
je 0x576964
mov dword [ebp - 4], 0
jmp 0x5768eb
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0x75ef60]
jge 0x57692e
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*8 - 0x1c], eax
mov edx, dword [ebp - 4]
cmp dword [ebp + edx*8 - 0x1c], 0
jne 0x57692c
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x24], 0
jmp 0x57692e
jmp 0x5768e2
cmp dword [ebp - 0x24], 0
je 0x576964
mov dword [ebp - 4], 0
jmp 0x576946
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [0x75ef60]
jge 0x576964
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x1c]
mov dword [eax*8 + 0x7cad68], edx
jmp 0x57693d
mov dword [0x7cdf90], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x7cad68]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d0e4d
mov esp, ebp
pop ebp
ret 4
Function at 0x576e00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.004d28e0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x576e33
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x576e53
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x2e
jne 0x576e51
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x576e2a
cmp dword [ebp - 0xc], 3
je 0x576e5d
xor eax, eax
jmp 0x576e81
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x576e74
xor eax, eax
jmp 0x576e81
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x577100
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.004d28e0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5771cf
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x5771af
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x5771af
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x57716c
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x5771af
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
movzx eax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00576e90
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x5771a2
mov eax, 8
jmp 0x577215
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 0xc], ecx
jmp 0x577163
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0x401
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.004e569b
add esp, 0x10
xor eax, eax
jmp 0x577215
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x2af9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
ja case.default.0x5771ed
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x57721c]
mov eax, 0x2af9
jmp 0x577215
mov eax, 0x2afa
jmp 0x577215
mov eax, 0x2afb
jmp 0x577215
mov eax, 0x2af9
jmp 0x577215
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x57e960
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18
call fcn.004d28e0
mov dword [ebp - 8], 0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0057ef50
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0057f370
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x57ea0c
mov dword [ebp - 0x14], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x57e9e6
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x57e9da
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
shl eax, 3
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0057f420
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.0057eef0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x57ea1a
mov eax, dword [ebp - 8]
jmp 0x57eacc
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0057ef50
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0057f370
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x57eab5
mov dword [ebp - 0x18], 0
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x57ea8f
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x57ea83
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0x18]
shl ecx, 3
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0057f420
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.0057eef0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x57eac0
mov eax, dword [ebp - 8]
jmp 0x57eacc
mov edx, dword [ebp + 8]
push edx
call fcn.0057eef0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x582780
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7ce150], 0
jne 0x582823
mov dword [0x7ce150], 1
push 0x190
push 0
push 0x7cdfc0
call fcn.004d1020
add esp, 0xc
push 0x7cdfc0
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x582823
call fcn.0052db80
push str.BIO_sock_init
push 0x92
push str.crypto_bio_bio_sock.c
call fcn.0052ddd0
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 2
call fcn.0052df00
add esp, 0xc
call fcn.0052db80
push str.BIO_sock_init
push 0x94
push str.crypto_bio_bio_sock.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x7a
push 0x20
call fcn.0052df00
add esp, 0xc
or eax, 0xffffffff
jmp 0x582828
mov eax, 1
pop ebp
ret

Function at 0x582da0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124
call fcn.004d28e0
mov eax, dword [0x7c9564]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jl 0x582dc3
cmp dword [ebp + 8], 0x40
jl 0x582dcb
or eax, 0xffffffff
jmp 0x582ee6
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0x14]
jne 0x582ddd
mov eax, 1
jmp 0x582ee6
push 0
call fcn.00582f00
add esp, 4
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], edx
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x11c]
jg 0x582e12
jl 0x582e0b
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x120]
ja 0x582e12
xor eax, eax
jmp 0x582ee6
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x124], 0
jmp 0x582e37
mov eax, dword [ebp - 0x124]
add eax, 1
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp - 0x118]
jae 0x582e5b
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp + edx*4 - 0x114]
cmp eax, dword [ebp + 8]
jne 0x582e59
jmp 0x582e5b
jmp 0x582e28
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp - 0x118]
jne 0x582e91
cmp dword [ebp - 0x118], 0x40
jae 0x582e91
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp + 8]
mov dword [ebp + edx*4 - 0x114], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
xor edx, edx
jne 0x582e1c
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x120]
mov ecx, dword [ebp + 0x14]
sbb ecx, dword [ebp - 0x11c]
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
not eax
lea ecx, [ebp - 0x118]
and eax, ecx
push eax
mov edx, dword [ebp + 0xc]
neg edx
sbb edx, edx
lea eax, [ebp - 0x118]
and edx, eax
push edx
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call dword [sym.imp.WSOCK32.dll_select]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004d0e4d
mov esp, ebp
pop ebp
ret