joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40443c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff90
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1070]
xor ecx, ecx
mov edx, 0x1058
call fcn.004016c0
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x1070]
mov ecx, 8
call fcn.00404238
mov ecx, 8
mov eax, 0x4071d0
lea edx, [ebp - 0x18]
mov bl, byte [eax]
xor byte [edx], bl
inc edx
inc eax
dec ecx
jne 0x404493
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x18]
mov ecx, 8
call fcn.004015e4
lea eax, [ebp - 0x1070]
call fcn.004043a4
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.004026c4
mov eax, dword [ebp + 8]
call fcn.00402634
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004015e4
mov eax, dword [ebp + 8]
call fcn.00402634
mov edx, eax
lea eax, [ebp - 0x1070]
mov ecx, dword [ebp - 8]
call fcn.004043bc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004023dc
test eax, eax
jle 0x404540
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004023dc
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov al, byte [edx + eax - 1]
cmp al, 9
jae 0x404540
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004023dc
mov edx, dword [ebp + 8]
mov edx, dword [edx]
movzx eax, byte [edx + eax - 1]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004023dc
mov edx, eax
pop eax
sub edx, eax
mov eax, dword [ebp + 8]
call fcn.004026c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4047f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x404978
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, 0x10
call fcn.004026c4
mov eax, dword [ebp - 0x10]
call fcn.004023dc
push eax
lea eax, [ebp - 0x10]
call fcn.00402634
mov ecx, 0x50
pop edx
call fcn.004016c0
mov eax, dword [0x41900c]
call fcn.004023dc
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.004023dc
cmp edi, eax
jle 0x404873
mov eax, dword [ebp - 0x10]
call fcn.004023dc
mov edx, eax
mov eax, 0x41900c
call fcn.004026c4
mov eax, dword [0x41900c]
call fcn.004023dc
push eax
lea eax, [ebp - 0x10]
call fcn.00402634
push eax
mov eax, 0x41900c
call fcn.00402634
pop edx
pop ecx
call fcn.004015e4
lea eax, [ebp - 0xc]
mov edx, dword [0x419008]
call fcn.0040230c
lea eax, [ebp - 0xc]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040263c
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x105
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004025dc
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea edx, [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 4
call fcn.004015e4
lea eax, [ebp - 0x10]
call fcn.00402634
mov dl, byte [ebp - 8]
mov byte [eax + 3], dl
lea eax, [ebp - 0x10]
call fcn.00402634
mov dl, byte [ebp - 7]
mov byte [eax + 6], dl
lea eax, [ebp - 0x10]
call fcn.00402634
mov dl, byte [ebp - 6]
mov byte [eax + 9], dl
lea eax, [ebp - 0x10]
call fcn.00402634
mov dl, byte [ebp - 5]
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x10]
call fcn.00402634
mov edx, ebx
mov ecx, 8
call fcn.004015e4
lea eax, [ebp - 0x10]
call fcn.00402634
add eax, 8
mov edx, esi
mov ecx, 8
call fcn.004015e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40497f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00402298
ret

Function at 0x404a9c
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x404aab
or edx, 0x200
test eax, 0x20000000
je 0x404adf
test eax, 0x40000000
je 0x404aca
test eax, 0x80000000
je 0x404ac5
or edx, 0x40
jmp 0x404b06
or edx, 0x20
jmp 0x404b06
test eax, 0x80000000
je 0x404ad9
or edx, 0x80
jmp 0x404b06
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x404af7
test eax, 0x80000000
je 0x404af2
or edx, 4
jmp 0x404b06
or edx, 2
jmp 0x404b06
test eax, 0x80000000
je 0x404b03
or edx, 8
jmp 0x404b06
or edx, 1
mov eax, edx
ret
Function at 0x404fa8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004025cc
xor eax, eax
push ebp
push 0x4050ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 4], 0
je 0x4050cf
mov esi, dword [ebp - 4]
mov ecx, esi
mov eax, ecx
cmp word [eax], 0x5a4d
jne 0x4050cf
cmp dword [eax + 0x3c], 0
je 0x4050cf
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x4550
jne 0x4050cf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x78]
test eax, eax
je 0x4050cf
lea eax, [esi + eax]
mov edx, dword [eax + 0x20]
lea edx, [esi + edx]
mov dword [ebp - 0x18], edx
mov edx, dword [eax + 0x24]
lea edx, [esi + edx]
mov dword [ebp - 0x1c], edx
mov edx, dword [eax + 0x1c]
lea edx, [esi + edx]
mov dword [ebp - 0x20], edx
mov edi, dword [eax + 0x18]
dec edi
test edi, edi
jl 0x4050cf
inc edi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*4]
add eax, esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + ebx*2]
mov edx, dword [ebp - 0xc]
sub edx, 1
jb 0x405083
je 0x405094
dec edx
je 0x4050a2
jmp 0x4050cf
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x14]
add eax, dword [edx + 0x34]
mov dword [ebp - 0x28], eax
jmp 0x4050ab
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4]
add eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
jmp 0x4050ab
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
call fcn.00402394
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 8]
call fcn.00402528
jne 0x4050cb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
jmp 0x4050cf
inc ebx
dec edi
jne 0x405062
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050f4
lea eax, [ebp - 0x2c]
call fcn.00402274
lea eax, [ebp - 8]
call fcn.00402274
ret
Function at 0x1002baf0
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xfd82adf7
out dx, al
or eax, 0x171dd5cb
in eax, 0xcd
stosd dword es:[edi], eax
push ebp
aad 0xee
dec ebp
adc ebp, esp
mov byte [0x15eed5ec], al
adc esp, ebp
aad 0x59
in eax, 0xbb
mov ebp, ss
invalid

Function at 0x1002c480
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xac
lodsb al, byte [esi]
lodsd eax, dword [esi]
in al, 0x6c
inc ebx
aad 0xc4
push eax
jge 0x1002c441
jl 0x1002c4d4
push eax
jge 0x1002c442
cmp dword [eax - 0x6f5ae203], ecx
imul edi, dword [edx - 3], 0xffffffad
xor sp, bp
int 0x59
xchg ecx, ebp
mov ecx, dword [esi]
mov dword [edx], edx
lodsd eax, dword [esi]
into
adc byte [edx], 0xd5
add eax, 0xcd8bfe4d
dec ebp
dec byte [ebx - 0x119c3133]
into
arpl si, bp
xchg edx, eax
ret 0xcd6b
or edx, ebp
cmp eax, 0xff01e48a
jge 0x1002c4a6
jg 0x1002c4aa
in eax, dx
cmc

Function at 0x1002cf00
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
nop
push edi
in eax, 0xad
pop ds
push edi
in eax, 0xad
jg 0x1002cf62
in eax, 0xad
fist word [edi - 0x1b]
mov byte [ecx], 0x46
add dword [ebx + 0x6624ad01], ebx
add dword [ebx - 0x1b], edi
lodsd eax, dword [esi]
and al, 0x86
add dword [edx + 0x1301bae5], edi
in eax, 0xb9
in eax, 0xfa
add dword [edx - 0x1b], ebx
add eax, 0x64645cca
mov eax, 0xd5e5e2fd
cli
sbb al, 0x50
fisub word [esi - 6]
invalid
in eax, 0xad
jmp 0x1002cfa6
in eax, 0x12
jge 0x1002cf43
or al, 0x6b
add edx, dword [edx]
xchg ecx, eax
lodsd eax, dword [esi]
xchg edx, eax
or eax, 0x3d7d0c7c
xor ebx, dword [ebp - 0x1b]
pop edx
or al, 0x7d
cmp eax, 0x5ae55d33
stosd dword es:[edi], eax
movsd dword es:[edi], dword [esi]
sbb eax, 0x6b5be50c
cmp ah, byte [esi - 0x647c521b]
or edi, dword [ebx]
leave
add eax, 0xcb65cdb6
lodsd eax, dword [esi]
lodsd eax, dword [esi]
dec ebx
pop ebp
in eax, 0xf0
and al, 0x43
in eax, 0x3f
and al, 0x43
in eax, 0xe
imul dword [ebp + 0x5cd46da]
dec ch
xor ebp, dword gs:[ebp - 0x1aa22c16]
test dword [ebx - 0x1b], ebx
mov edx, 0xadea4ae5
and al, 0xbd
in eax, 0x93
fcmovnbe st(0), st(3)
lodsb al, byte [esi]
or ebp, dword [eax]
aaa
in eax, 0xac
inc edx
test al, 0xa4
jge 0x1002cf6f
pop ebp
in eax, 0x85
pop ebx
in eax, 0xba
in eax, 0x4a
ljmp 0xdb93
sbb ebx, dword [ebx - 0x1b]
mov edx, 0x9723ad0e
in eax, 0xac
sub ch, byte [eax]
inc edx
and al, 0xa3
in eax, 0x81
xchg edi, eax
in eax, 0x7a
lodsd eax, dword [esi]
lodsd eax, dword [esi]
nop
xchg edi, eax
in eax, 0xad
sbb dword [ebp - 0x1b], 0xffffffae
and al, 0x42
lodsd eax, dword [esi]
mov ds, word [ebx]
lodsd eax, dword [esi]
int 0xd5
in al, 0xe6
push 0xad057ae5
movsb byte es:[edi], byte [esi]
aaa
in eax, 0x4a
bound ebp, qword [ebp + 0x7ae537a3]
add eax, 0xe59762ad
fisubr dword [ebp - 0x52087e53]
jp 0x1002d00c
lodsd eax, dword [esi]
xor byte [edi - 0x53], dl
lodsd eax, dword [esi]
adc ebx, dword [ebp - 0x1b]
pop edi
aaa
in eax, 0xea
adc eax, 0xe537cead
jp 0x1002d01f
lodsd eax, dword [esi]
wait
mov eax, 0x51ae55a
lodsd eax, dword [esi]
add esi, dword [edi]
in eax, 0xad
in eax, 0x1a
add eax, 0xe53703ad
lodsd eax, dword [esi]
cmp ebx, dword [ebp - 0x1b]
ret
Function at 0x1002dda0
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ebp - 0x3c]
mov byte [0xa3c48d82], al
sub byte [ebp + 0x1b], 0xa8
add eax, 0xb325121d
mov ebx, 0x1d3de36b
out dx, al
lgs esi, [ebx + 5]
jnp 0x1002de3c
aad 7
inc esi
nop
in eax, 0xd5
mov bl, 0xf4
pop eax
lodsd eax, dword [esi]
inc esi
cmp eax, 0x15d5e529
mov bl, 0x38
add dword [ebp - 0x4c4c7442], ebp
aad 0x8f
sbb eax, 0xaf1977f5
jg 0x1002de25
sbb al, 0x7b
in eax, 0x8f
sbb eax, 0xf81de57b
inc esi
popfd
invalid
sbb eax, 0x656b69ad
fiadd dword [0x5da54ad]
cmp eax, 0xbefb6e8b
mul dword [0xac8b6b4a]
jne 0x1002de73
int 0xcd
int 0xcd
pop ecx
or ecx, dword [esi]
jmp 0x5627fae2
mov bl, 0xe5
sbb eax, 0x3ccc46e1
in eax, 0xaa
mov ebp, 0x24d46d5
lodsd eax, dword [esi]
cmc
aad 0xa6
invalid

Function at 0x10034850
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x61853b7d
dec ebp
jge 0x1003488e
test dword [ecx + 0x4d], esp
lodsd eax, dword [esi]
lodsb al, byte [esi]
dec ebx
lcall 0xab46, 0x8f1535ba
adc ch, byte [ebp + 0x12e5122b]
in eax, 0x6a
in eax, 0x61
or eax, 0x2f896c13
lodsd eax, dword [esi]
in al, 0x3b
add eax, 0xbf5904f5
fcom qword [edi]
cli
lds esp, [ebx]
mov es, ebx
pop ebp
aad 0x4a
outsb dx, byte [esi]
xchg ebp, eax
lds esp, [0xb1e52224]
dec eax
lodsd eax, dword [esi]
add eax, 0xf759b3fb
xor byte [0x640e1915], cl
pop ecx
div dword [eax]
or eax, 0x640e1915
mov eax, 0x65f546e3
pushfd
out 0x53, eax
imul ebx, dword [ebx + 0x3c], 0xffffffb3
jl 0x10034851
mov edx, 0xd3e9adcd
mov dword [0x8b7d8263], eax
fucompi st(1)
invalid
retf

Function at 0x1003ace1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ax, ax
jmp 0x1005e577
inc ebx
jmp 0x100010d5
jne 0x10060976
jmp 0x1004efb8
test edx, edx
jmp 0x100020c2
add ebx, edi
jmp 0x1001b32d
mov edi, dword [ecx + 0x18]
jmp 0x1001b2b4
push dword [ecx + 0xc]
jmp 0x10054f2d
mov ebp, esp
jmp 0x1001e1f6
lea edx, [ecx + 0x30]
jmp 0x10025ea1
push esi
jmp 0x10026b8c
push edx
jmp 0x10057683
push ecx
jmp 0x10015606
pop edx
jmp 0x10002c36
jl 0x1001b311
jmp 0x1005ca4e
pop ecx
jmp 0x10045f15
mov ebx, edi
jmp 0x10026be0
stosb byte es:[edi], al
jmp 0x100020bc
push dword [ebx + 0x10]
add esp, 0xfffffef4
jmp 0x10062424
push dword fs:[0x30]
jmp 0x1001a735
push dword [edx]
jmp 0x10015817
cmp dword [ebp + 8], 0
jmp 0x10044596
add ebx, dword [ebx + 0x3c]
jmp 0x1002766f
lea ebx, [ebx + 0x78]
jmp 0x100584e6
call fcn.10061688
jmp 0x10062f71
mov ax, word [edx + ebx*2]
jmp 0x10046fab
mov ebx, dword [ebx]
jmp 0x100067d2
jne 0x100636a6
jmp 0x100109ba
pop ecx
jmp 0x10011eaf
jmp 0x1001b2b4
jmp 0x1001b2b4
push edi
jmp 0x10011fc4
push ebp
jmp 0x10011fb8
pop eax
jmp 0x10029ba9
je 0x10021c55
jmp 0x10046ed0
push dword [ecx + 0xc]
jmp 0x1002fb09
mov edi, dword [ebp + 8]
jmp 0x100356bb
cmp al, 0x40
jmp 0x1001647a
add al, 0x20
jmp 0x1001b311
mov edi, dword [ebp + 0xc]
jmp 0x10034024
lea edi, [ebp - 0x104]
jmp 0x1003702b
pop ecx
jmp 0x100636a6
push edi
jmp 0x10013ac8
jg 0x1001b311
jmp 0x1004bf8d
mov eax, dword [ebx + 8]
jmp 0x1002b7c6
cmp al, 0x5b
jmp 0x100576f0
jne 0x1002a89a
jmp 0x1003f943
xor ebx, ebx
jmp 0x1002a89a
push ebx
jmp 0x1001573e
xor eax, dword [ebp + 0xc]
jmp 0x1002c324
mov ecx, dword [ecx]
jmp 0x10052945
Function at 0x10045b70
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0xf5bd65e5
aam 0xdd
cmc
sbb eax, 0xe53df3e5
mov dword [0xe5e2e51b], eax
lodsd eax, dword [esi]
xor esi, dword [edi]
xor eax, 0xf51d54ad
lds edi, [0xf55d15f5]
cmc

Function at 0x10062e90
Capabilities:
Encode data using xor

Disassembly:
push cs
or dword [ebp - 0x4575a62b], ebp
sub dl, cl
aad 0xbb
sbb eax, 0x1d259180
and eax, 0x175d0f1d
lcall 0xd593, 0xe75b75e
jae 0x10062e42
test dword [eax], ecx
mov esi, 0x2baaa23a
fsubr qword [edx + esi + 0x75]
dec eax
xor dl, byte [edi - 0x3f]
jne 0x10062ea4
ficomp dword [ecx - 0x74]
dec edi
invalid
Function at 0x10067700
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
dec ecx
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
dec ecx
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x10067732
jmp dword [edx*4 + 0x1006785c]
mov edi, 0xa
cmp ebx, edi
jle case.0x10067732.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
inc edi
cmp edi, dword [esp + 0x20]
jl 0x10067743
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x10070120
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp ecx, dword [ebx + 4]
jge 0x10070139
mov esi, ebx
mov ebx, eax
jmp 0x1007013b
mov esi, eax
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x10]
cmp eax, dword [edi + 8]
jg 0x1007014b
mov eax, edi
jmp 0x10070155
push eax
push edi
call sym.crypto_ssl.dll_Wn_expand2
add esp, 8
test eax, eax
jne 0x1007015d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x10070179
mov edx, dword [esi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 4]
jl 0x10070164
cmp eax, dword [esi + 4]
jge 0x10070190
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x10070180
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
test eax, eax
jle 0x100701b1
mov ecx, dword [edi]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x100701ae
dec eax
test eax, eax
jg 0x100701a0
mov dword [edi + 4], eax
cmp dword [edi + 4], 0
jne 0x100701be
mov dword [edi + 0xc], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10076ec0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x10076f89
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x10076ee1
cmp al, 0x6b
jne 0x10076f89
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x10076f4a
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x10076f01
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x10076f01
cmp al, 0xbb
jne 0x10076f2a
inc ecx
cmp ecx, esi
jl 0x10076ef1
sub esi, ecx
test ecx, ecx
jne 0x10076f4d
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call sym.crypto_ssl.dll_URR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call sym.crypto_ssl.dll_URR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x10076f76
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call sym.crypto_ssl.dll_URR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.10102620
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call sym.crypto_ssl.dll_URR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x100821b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x100821c6
mov dword [esp + 4], ecx
jmp fcn.10085590
mov dword [esp + 4], ecx
jmp eax
Function at 0x10093840
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [ebx + 0x20]
cmp dword [esi], 6
je 0x10093857
call fcn.100931f0
test eax, eax
jle 0x100938a0
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push ebx
mov esi, eax
call sym.crypto_ssl.dll_UIO_clear_flags
add esp, 8
test esi, esi
jg 0x1009389e
push esi
call sym.crypto_ssl.dll_UIO_sock_should_retry
add esp, 4
test eax, eax
je 0x1009389e
push 0xa
push ebx
call sym.crypto_ssl.dll_UIO_set_flags
add esp, 8
mov eax, esi
pop esi
pop ebx
ret

Function at 0x10096020
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x1009605b
push 0x233
push str..crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call sym.crypto_ssl.dll_URR_put_error
add esp, 0x14
mov eax, esi
pop esi
ret

Function at 0x100963a0
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x100963e1
push 0x233
push str..crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call sym.crypto_ssl.dll_URR_put_error
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret
Function at 0x10098280
Capabilities:
Set socket configuration

Disassembly:
mov eax, 4
call fcn.101025a0
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 0x28], 0
jg 0x10098299
cmp dword [ecx + 0x2c], 0
jle 0x100982e6
mov eax, 0x10624dd3
imul dword [ecx + 0x34]
mov ecx, dword [ecx + 0x30]
sar edx, 6
imul ecx, ecx, 0x3e8
mov eax, edx
shr eax, 0x1f
add eax, edx
push 4
lea edx, [esp + 4]
push edx
add eax, ecx
push 0x1006
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1c]
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x100982e6
push str.setsockopt
call fcn.10106add
add esp, 4
pop ecx
ret

Function at 0x10098820
Capabilities:
Set socket configuration

Disassembly:
mov eax, 0x24
call fcn.101025a0
mov eax, dword [0x1017ec40]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
mov ebp, dword [esp + 0x2c]
push edi
mov edi, dword [ebp + 0x20]
mov dword [esp + 0xc], 0
cmp dword [edi + 0x28], 0
jg 0x10098856
cmp dword [edi + 0x2c], 0
jle 0x1009899c
mov edx, dword [ebp + 0x1c]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0x1006
push 0xffff
push edx
mov dword [esp + 0x20], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jns 0x1009888f
push str.getsockopt
call fcn.10106add
add esp, 4
jmp 0x100988b8
mov ecx, dword [esp + 8]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [edi + 0x30], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
mov dword [edi + 0x34], ecx
push ebx
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push 0
add esi, 0x2ac18000
push 0x989680
adc eax, 0xfe624e21
push eax
push esi
call fcn.10103380
mov ebx, eax
imul eax, eax, 0x989680
mov ecx, dword [edi + 0x28]
sub esi, eax
mov dword [esp + 0x1c], edx
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [edi + 0x2c]
cmp edx, eax
jge 0x1009892b
mov esi, 0xf4240
sub esi, eax
add edx, esi
dec ecx
jmp 0x1009892d
sub edx, eax
cmp ecx, ebx
jge 0x10098938
xor ecx, ecx
lea edx, [ecx + 1]
jmp 0x1009893a
sub ecx, ebx
mov eax, dword [edi + 0x30]
pop esi
pop ebx
test eax, eax
jne 0x10098948
cmp dword [edi + 0x34], eax
je 0x10098953
cmp eax, ecx
jg 0x10098953
jne 0x1009899c
cmp dword [edi + 0x34], edx
jl 0x1009899c
mov eax, 0x10624dd3
imul ecx, ecx, 0x3e8
imul edx
sar edx, 6
mov eax, edx
add ecx, edx
mov edx, dword [ebp + 0x1c]
shr eax, 0x1f
push 4
add eax, ecx
lea ecx, [esp + 0xc]
push ecx
push 0x1006
push 0xffff
push edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1009899c
push str.setsockopt
call fcn.10106add
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop ebp
xor ecx, esp
call fcn.10102ab4
add esp, 0x24
ret