joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046c41
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x10]
mov ebx, dword [eax]
mov eax, dword [esp + 0xc]
add eax, 0xfffffffd
push edi
cmp eax, 4
ja case.0x10046c3a.4
jmp dword [eax*4 + 0x10046e68]
lea eax, [esi + 0x15c]
call fcn.10046940
movzx ecx, ax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, ecx
je 0x10046c73
push eax
push ecx
push 0x10103c30
push ebx
call fcn.10037b70
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov word [esi + 0x40], cx
lea edi, [esi + 0x160]
mov eax, 4
mov ecx, edi
mov dword [esi + 0x18], 0
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov ecx, dword [esi + 0x148]
mov eax, dword [edi]
push ecx
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0xc8]
push edx
push 0
push 4
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jl 0x10046dd9
mov eax, dword [esi + 0x154]
xor ecx, ecx
add eax, 4
cmp dword [esi + 0x14c], eax
setl cl
add esi, 0x38
push esi
lea ecx, [ecx + ecx + 1]
mov dword [esi - 0x38], ecx
call fcn.1000f3da
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor edx, edx
lea edi, [esi + 0x160]
lea eax, [edx + 4]
mov ecx, edi
mov word [esi + 0x40], dx
mov dword [esi + 0x18], edx
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov eax, dword [esi + 0x148]
mov edx, dword [edi]
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0xc8]
push ecx
push 0
push 4
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x10046d5e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esi + 0x10]
push eax
push ecx
call fcn.1003c090
push eax
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0x14
pop edi
pop esi
mov eax, 0x37
pop ebx
ret
mov dword [esi], 1
add esi, 0x38
push esi
call fcn.1000f3da
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
movzx edx, word [esi + 0x40]
inc dword [esi + 0x18]
mov eax, dword [esi + 0x18]
push eax
inc edx
and edx, 0xffff
push edx
push 0x10103bfc
push ebx
call fcn.10037b70
mov eax, dword [esi + 0x18]
add esp, 0x10
cmp eax, dword [esi + 0x20]
jle 0x10046db2
pop edi
mov dword [esi + 8], 0xffffff9d
mov dword [esi], 3
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [esi + 0x148]
mov eax, dword [esi + 0x160]
push ecx
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0xc8]
push edx
push 0
push 4
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x10046e43
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esi + 0x10]
push eax
push edx
call fcn.1003c090
push eax
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0x14
pop edi
pop esi
mov eax, 0x37
pop ebx
ret
lea edi, [esi + 0x160]
mov eax, 5
mov ecx, edi
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov eax, dword [esi + 0x148]
mov edx, dword [edi]
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0xc8]
push ecx
push 0
push 4
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [esi], 3
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x10103be4
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0xc
pop edi
pop esi
mov eax, 0x47
pop ebx
ret
Function at 0x10046cef
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x10]
mov ebx, dword [eax]
mov eax, dword [esp + 0xc]
add eax, 0xfffffffd
push edi
cmp eax, 4
ja case.0x10046c3a.4
jmp dword [eax*4 + 0x10046e68]
lea eax, [esi + 0x15c]
call fcn.10046940
movzx ecx, ax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, ecx
je 0x10046c73
push eax
push ecx
push 0x10103c30
push ebx
call fcn.10037b70
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov word [esi + 0x40], cx
lea edi, [esi + 0x160]
mov eax, 4
mov ecx, edi
mov dword [esi + 0x18], 0
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov ecx, dword [esi + 0x148]
mov eax, dword [edi]
push ecx
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0xc8]
push edx
push 0
push 4
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jl 0x10046dd9
mov eax, dword [esi + 0x154]
xor ecx, ecx
add eax, 4
cmp dword [esi + 0x14c], eax
setl cl
add esi, 0x38
push esi
lea ecx, [ecx + ecx + 1]
mov dword [esi - 0x38], ecx
call fcn.1000f3da
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor edx, edx
lea edi, [esi + 0x160]
lea eax, [edx + 4]
mov ecx, edi
mov word [esi + 0x40], dx
mov dword [esi + 0x18], edx
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov eax, dword [esi + 0x148]
mov edx, dword [edi]
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0xc8]
push ecx
push 0
push 4
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x10046d5e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esi + 0x10]
push eax
push ecx
call fcn.1003c090
push eax
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0x14
pop edi
pop esi
mov eax, 0x37
pop ebx
ret
mov dword [esi], 1
add esi, 0x38
push esi
call fcn.1000f3da
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
movzx edx, word [esi + 0x40]
inc dword [esi + 0x18]
mov eax, dword [esi + 0x18]
push eax
inc edx
and edx, 0xffff
push edx
push 0x10103bfc
push ebx
call fcn.10037b70
mov eax, dword [esi + 0x18]
add esp, 0x10
cmp eax, dword [esi + 0x20]
jle 0x10046db2
pop edi
mov dword [esi + 8], 0xffffff9d
mov dword [esi], 3
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [esi + 0x148]
mov eax, dword [esi + 0x160]
push ecx
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0xc8]
push edx
push 0
push 4
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x10046e43
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esi + 0x10]
push eax
push edx
call fcn.1003c090
push eax
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0x14
pop edi
pop esi
mov eax, 0x37
pop ebx
ret
lea edi, [esi + 0x160]
mov eax, 5
mov ecx, edi
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov eax, dword [esi + 0x148]
mov edx, dword [edi]
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0xc8]
push ecx
push 0
push 4
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [esi], 3
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x10103be4
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0xc
pop edi
pop esi
mov eax, 0x47
pop ebx
ret
Function at 0x10046d76
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x10]
mov ebx, dword [eax]
mov eax, dword [esp + 0xc]
add eax, 0xfffffffd
push edi
cmp eax, 4
ja case.0x10046c3a.4
jmp dword [eax*4 + 0x10046e68]
lea eax, [esi + 0x15c]
call fcn.10046940
movzx ecx, ax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, ecx
je 0x10046c73
push eax
push ecx
push 0x10103c30
push ebx
call fcn.10037b70
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov word [esi + 0x40], cx
lea edi, [esi + 0x160]
mov eax, 4
mov ecx, edi
mov dword [esi + 0x18], 0
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov ecx, dword [esi + 0x148]
mov eax, dword [edi]
push ecx
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0xc8]
push edx
push 0
push 4
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jl 0x10046dd9
mov eax, dword [esi + 0x154]
xor ecx, ecx
add eax, 4
cmp dword [esi + 0x14c], eax
setl cl
add esi, 0x38
push esi
lea ecx, [ecx + ecx + 1]
mov dword [esi - 0x38], ecx
call fcn.1000f3da
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor edx, edx
lea edi, [esi + 0x160]
lea eax, [edx + 4]
mov ecx, edi
mov word [esi + 0x40], dx
mov dword [esi + 0x18], edx
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov eax, dword [esi + 0x148]
mov edx, dword [edi]
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0xc8]
push ecx
push 0
push 4
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x10046d5e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esi + 0x10]
push eax
push ecx
call fcn.1003c090
push eax
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0x14
pop edi
pop esi
mov eax, 0x37
pop ebx
ret
mov dword [esi], 1
add esi, 0x38
push esi
call fcn.1000f3da
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
movzx edx, word [esi + 0x40]
inc dword [esi + 0x18]
mov eax, dword [esi + 0x18]
push eax
inc edx
and edx, 0xffff
push edx
push 0x10103bfc
push ebx
call fcn.10037b70
mov eax, dword [esi + 0x18]
add esp, 0x10
cmp eax, dword [esi + 0x20]
jle 0x10046db2
pop edi
mov dword [esi + 8], 0xffffff9d
mov dword [esi], 3
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [esi + 0x148]
mov eax, dword [esi + 0x160]
push ecx
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0xc8]
push edx
push 0
push 4
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x10046e43
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esi + 0x10]
push eax
push edx
call fcn.1003c090
push eax
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0x14
pop edi
pop esi
mov eax, 0x37
pop ebx
ret
lea edi, [esi + 0x160]
mov eax, 5
mov ecx, edi
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov eax, dword [esi + 0x148]
mov edx, dword [edi]
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0xc8]
push ecx
push 0
push 4
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [esi], 3
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x10103be4
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0xc
pop edi
pop esi
mov eax, 0x47
pop ebx
ret
Function at 0x10048eb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x130]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x10048ef4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x10104448
push esi
call fcn.10037c00
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push 0x10104440
mov eax, ebx
call fcn.10048db0
add esp, 4
pop esi
pop ecx
ret
Function at 0x1004b5c0
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x1004b5f6
push str.Couldnt_set_desired_mode
push ebx
call fcn.10037c00
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x1004b60d
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.10037b70
add esp, 0xc
cmp ebp, 0x13
jne 0x1004b61f
mov eax, edi
call fcn.1004b180
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x1004b633
push edi
call fcn.1004b1d0
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x1004b645
mov eax, edi
call fcn.1004b2f0
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x1004b653
mov eax, edi
call fcn.1004b300
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x10052490
Capabilities:
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
cmp ebx, 0xffffffff
jne 0x100524d4
cmp ebp, ebx
jne 0x100524d4
mov eax, dword [esp + 0x334]
push eax
call fcn.10052460
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x100524ef
mov esi, edi
call fcn.1003e800
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
cmp ebx, 0xffffffff
je 0x10052523
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
mov dword [esp + 0x228], eax
cmp ebp, 0xffffffff
je 0x10052567
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
test ecx, ecx
jbe 0x10052550
cmp dword [esp + eax*4 + 0x24], ebp
je 0x10052550
inc eax
cmp eax, ecx
jb 0x10052545
cmp eax, ecx
jne 0x10052561
cmp ecx, 0x40
jae 0x10052561
mov dword [esp + eax*4 + 0x24], ebp
inc dword [esp + 0x20]
cmp ebp, edx
jbe 0x10052567
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea ecx, [esp + 0x18]
lea ebp, [edx + 1]
dec ebx
and ebx, ecx
xor eax, eax
cmp edi, eax
jle 0x100525a9
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov edx, esi
sub edx, eax
imul edx, edx, 0x3e8
mov dword [esp + 0x1c], edx
jmp 0x100525b3
jne 0x100525b3
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x130]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x1005261d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x100525e6
cmp eax, 0x2714
jne 0x10052621
test edi, edi
jle 0x10052578
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.1003e800
push edx
push eax
call fcn.1003e830
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x10052578
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x1005262f
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x1005263e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x10052675
lea edx, [esp + 0x124]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10052663
mov esi, 1
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10052675
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x100526a8
lea ecx, [esp + 0x228]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10052696
or esi, 2
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100526a8
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x10053530
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.10024bee
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x10053595
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x10053595
lea edx, [esp]
push edx
call dword [0x10144504]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1000efa1
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.1000efa1
add esp, 0x108
ret
jmp 0x10053530

Function at 0x100535b0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.10024bee
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x10053595
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x10053595
lea edx, [esp]
push edx
call dword [0x10144504]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1000efa1
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.1000efa1
add esp, 0x108
ret
jmp 0x10053530
Function at 0x10056a90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x101444f8]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10056ab5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x10056afc
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x10056b00
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x10056b5e
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x10056b23
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x10056ba1
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x10106d0e
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x10106d0f
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x10056b70
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x10056c70
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x10056ca2
push 0x2e
push esi
call fcn.10011bb0
add esp, 8
test eax, eax
je 0x10056ca0
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x10059e30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100fb843
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x10143328]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x1014df54
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x1014df54
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x1013cc96
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.10059200
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x10071970
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.100230e0
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x9c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb0]
push edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x10], edi
sub edi, esi
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], edi
cmp dword [esp + 0xb8], esi
jae 0x100719d4
push str.orig_len___md_size
push 0x113
push str.._ssl_s3_cbc.c
call fcn.10082060
add esp, 0xc
cmp esi, 0x40
jbe 0x100719f0
push str.md_size___EVP_MAX_MD_SIZE
push 0x114
push str.._ssl_s3_cbc.c
call fcn.10082060
add esp, 0xc
mov eax, dword [esp + 0xb8]
lea ebp, [esp + 0x24]
neg ebp
and ebp, 0x3f
lea edx, [esi + 0x100]
lea ebp, [esp + ebp + 0x24]
cmp eax, edx
jbe 0x10071a18
mov ebx, eax
sub ebx, esi
sub ebx, 0x100
mov eax, esi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebx
add eax, edi
xor edx, edx
div esi
push esi
push 0
push ebp
mov edi, edx
mov dword [esp + 0x28], edi
call fcn.10015360
add esp, 0xc
xor ecx, ecx
cmp ebx, dword [esp + 0xb8]
jae 0x10071ab5
mov eax, dword [esp + 0xb0]
mov eax, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xb8]
mov edi, ebx
sub edi, edx
sub edx, dword [esp + 0x14]
sub eax, ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
jmp 0x10071a78
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov bl, byte [ebx]
mov eax, edi
not eax
sar eax, 0x1f
add edx, edi
not al
and al, bl
not edx
sar edx, 0x1f
and al, dl
or byte [ecx + ebp], al
mov edx, 1
add dword [esp + 0x18], edx
add ecx, edx
mov eax, ecx
sub eax, esi
sar eax, 0x1f
and ecx, eax
add edi, edx
sub dword [esp + 0x10], edx
jne 0x10071a74
mov edi, dword [esp + 0x1c]
xor eax, eax
test esi, esi
jbe 0x10071ae1
jmp 0x10071ac0
mov ecx, edi
xor ecx, 0x20
mov dl, byte [ecx + ebp]
mov cl, byte [edi + ebp]
mov edx, dword [esp + 0x20]
mov byte [edx + eax], cl
inc edi
mov ecx, edi
sub ecx, esi
sar ecx, 0x1f
inc eax
and edi, ecx
cmp eax, esi
jb 0x10071ac0
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000efa1
add esp, 0x98
ret

Function at 0x10081220
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.10015360
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x10081f40
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.100230e0
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x10081fa5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10081fa5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.10018e3d
add eax, 0x40
push eax
call fcn.100e52b0
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1000efa1
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.100e5147
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10082034
call fcn.10081e00
test eax, eax
jle 0x10082034
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1000efa1
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1000efa1
add esp, 0x108
ret

Function at 0x10082090
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x100820b4
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x100820a6
pop esi
movzx eax, cl
pop edi
ret

Function at 0x100824a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x100824e7
mov al, byte [edx]
test al, al
je 0x100824e7
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x100824b7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret