joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4787e8
Capabilities:
Hash data using sha1

Disassembly:
push 4
mov eax, 0xab7f7e
call fcn.00ab476b
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
mov byte [ecx], al
mov dword [ebp - 4], eax
push 0xac738c
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
call fcn.0047a8a7
mov eax, esi
call fcn.00ab4739
ret
Function at 0x4b3baf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dh, byte [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ebx
test dh, 1
je 0x4b3bf1
mov al, byte [ebp + 8]
test esi, esi
je 0x4b3bef
mov edi, esi
mov dh, al
mov dl, dh
add dl, dl
mov al, dl
xor al, 0x1b
test dh, dh
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
mov dh, cl
sub edi, 1
jne 0x4b3bcd
mov byte [ebp - 1], dh
mov al, cl
mov dh, byte [ebp + 0xc]
xor bl, al
shr dh, 1
inc esi
mov byte [ebp + 0xc], dh
cmp esi, 8
jl 0x4b3bbd
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x4b3cdd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov eax, ecx
xor edx, edx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [eax]
mov dword [ebp - 4], edx
xor esi, esi
test eax, eax
jle 0x4b3d16
mov ebx, dword [ebp + 0xc]
add ebx, edx
mov edx, dword [ebp - 8]
mov ecx, dword [edi]
mov al, byte [ebx]
lea ebx, [ebx + 4]
xor byte [ecx + esi], al
inc esi
mov eax, dword [edx]
cmp esi, eax
jl 0x4b3d02
mov edx, dword [ebp - 4]
inc edx
add edi, 4
mov dword [ebp - 4], edx
cmp edx, 4
jl 0x4b3cf4
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4b3f31
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x4b3f5a
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
sub esi, ecx
sub edi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x4b3f4a
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x4b3f5e
Capabilities:
Encode data using base64

Disassembly:
push 0x64
mov eax, 0xab852a
call fcn.00ab479e
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x54]
xor ebx, ebx
mov dword [ebp - 0x70], edi
push 0x41
push ebx
push eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x6c], ebx
call fcn.00a91e70
add esp, 0xc
mov ecx, ebx
lea eax, [ecx + 0x41]
mov byte [ebp + ecx - 0x54], al
inc ecx
cmp ecx, 0x1a
jl 0x4b3f89
mov ecx, ebx
lea eax, [ecx + 0x61]
mov byte [ebp + ecx - 0x3a], al
inc ecx
cmp ecx, 0x1a
jl 0x4b3f98
mov ecx, ebx
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xa
jl 0x4b3fa7
mov dword [edi], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0xf
mov word [ebp - 0x16], 0x2f2b
mov byte [edi], bl
mov eax, dword [ebp + 0x10]
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6c], 1
test eax, eax
je 0x4b410a
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
inc ecx
mov byte [ebp + edi - 0x58], al
inc edi
mov dl, byte [ebp - 0x57]
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x56]
mov cl, byte [ebp - 0x58]
mov byte [ebp - 0x5f], ch
mov byte [ebp - 0x5d], dl
mov byte [ebp - 0x5e], cl
cmp edi, esi
jne 0x4b4065
mov esi, dword [ebp - 0x64]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x5c], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x5b], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x5a], cl
mov byte [ebp - 0x59], ch
movzx eax, byte [ebp + edi - 0x5c]
mov ecx, esi
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.0047a86c
inc edi
cmp edi, 4
jl 0x4b403f
mov dl, byte [ebp - 0x5d]
mov edi, ebx
mov cl, byte [ebp - 0x5e]
mov ch, byte [ebp - 0x5f]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4b3fe2
mov dword [ebp - 0x68], edi
test edi, edi
je 0x4b410a
mov eax, edi
cmp edi, esi
jge 0x4b409b
cmp eax, esi
jae 0x4b4115
mov byte [ebp + eax - 0x58], bl
inc eax
cmp eax, esi
jl 0x4b4083
mov ch, byte [ebp - 0x56]
mov dl, byte [ebp - 0x57]
mov cl, byte [ebp - 0x58]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x5c], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x5b], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x59], ch
lea eax, [edi + 1]
mov byte [ebp - 0x5a], dl
mov dword [ebp - 0x58], eax
test eax, eax
jle 0x4b40f5
mov esi, dword [ebp - 0x64]
mov edi, eax
movzx eax, byte [ebp + ebx - 0x5c]
mov ecx, esi
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.0047a86c
inc ebx
cmp ebx, edi
jl 0x4b40d8
mov edi, dword [ebp - 0x68]
push 3
pop esi
cmp edi, esi
jge 0x4b410a
sub esi, edi
mov ecx, dword [ebp - 0x64]
push 0x3d
call fcn.0047a86c
sub esi, 1
jne 0x4b40fb
mov eax, dword [ebp - 0x64]
call fcn.00ab474d
ret 0xc
call fcn.00a8fb49
int3
Function at 0x4b411b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0xaf8008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea esi, [ebx + 0x64]
mov dword [ebp - 0x44], ecx
push esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], eax
call fcn.00a8f957
push esi
push 0
push eax
mov dword [ebp - 0x40], eax
call fcn.00a91e70
push ebx
push edi
push dword [ebp - 0x40]
call fcn.00a918f0
add esp, 0x1c
mov eax, ebx
test ebx, ebx
je 0x4b4171
mov byte [edi], 0
inc edi
sub eax, 1
jne 0x4b4168
xor eax, eax
mov dword [ebp - 0x16], 0x36433442
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x38]
mov word [ebp - 0xe], 0x4441
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x12], 0x42304134
push eax
lea eax, [ebx + 0xf]
mov dword [ebp - 0x23], 0x45384545
mov ebx, dword [ebp - 0x40]
and eax, 0xfffffff0
push eax
push ebx
mov dword [ebp - 0xb], 0x323945
mov word [ebp - 0x25], 0x3441
mov word [ebp - 0x28], 0x4642
mov dword [ebp - 0x1c], 0x37454234
mov word [ebp - 0x1e], 0x3339
mov byte [ebp - 0x1f], 0x46
mov byte [ebp - 0x26], 0x45
mov word [ebp - 0x18], 0x3241
mov byte [ebp - 0xc], 0x31
call fcn.004b3894
mov edi, eax
mov ecx, ebx
test esi, esi
je 0x4b4200
mov byte [ecx], 0
inc ecx
sub esi, 1
jne 0x4b41f7
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x48]
push edi
push esi
call fcn.004b3f5e
push ebx
call fcn.00a8f821
push edi
call fcn.00a8f821
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a8f813
leave
ret 0x10
Function at 0x530b8b
Capabilities:
Get disk information via ioctl

Disassembly:
push 0x74
mov eax, 0xab89b4
call fcn.00ab479e
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x44], al
mov dword [ebp - 4], eax
call dword [edi + 0xb4]
cdq
mov bl, 0x41
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x4c], edx
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x64], eax
xor edx, edx
mov ecx, eax
and ecx, 0x1f
shr eax, 5
inc edx
shl edx, cl
test dword [ebp + eax*4 - 0x2c], edx
je 0x530d1b
mov esi, dword [edi + 0xb8]
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x28], eax
push 0xac864c
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0047a8a7
push dword [ebp - 0x60]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
push 1
push 0
call fcn.005313b2
push eax
lea ecx, [ebp - 0x80]
call fcn.0047a5a1
mov byte [ebp - 4], 2
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x6c], 0x10
cmovae eax, dword [ebp - 0x80]
push eax
call esi
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.00477e14
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00477e14
cmp esi, 3
jne 0x530d1b
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x28]
push str.._
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0047a8a7
push dword [ebp - 0x60]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0047a86c
push 0xac8180
lea ecx, [ebp - 0x28]
call fcn.0047a552
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [edi + 0xc0]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
push edx
push edx
push esi
push edx
push esi
push edx
push ecx
call eax
mov dword [ebp - 0x68], eax
cmp eax, 0xffffffff
je 0x530d0f
mov ecx, dword [edi + 0xb0]
lea edx, [ebp - 0x4c]
push 0
push edx
push 0xc
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push 0x2d1080
push eax
call ecx
push dword [ebp - 0x68]
or esi, 0xffffffff
test eax, eax
cmovne esi, dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x530d0f
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
push esi
call fcn.0052d7dd
test eax, eax
jne 0x530d0f
sub esp, 0x18
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x44]
push eax
call fcn.0047a97c
mov ecx, edi
call fcn.00525253
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00477e14
mov eax, dword [ebp - 0x64]
inc bl
inc eax
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x64], eax
cmp bl, 0x5a
jle 0x530bc5
lea ecx, [ebp - 0x44]
call fcn.00477e14
call fcn.00ab474d
ret
Function at 0x531b0e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov edi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], eax
sar eax, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
cmp edx, eax
jge 0x531b78
lea esi, [edi + edi]
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.00531ac1
imul ecx, dword [ebp - 8], 0x18
movzx edi, al
xor edi, 1
inc edi
add edi, esi
imul eax, edi, 0x18
add ecx, ebx
add eax, ebx
push eax
call fcn.004df4a4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], edi
cmp edi, eax
jl 0x531b3c
mov ecx, dword [ebp - 0x18]
mov esi, edi
cmp edi, eax
jne 0x531b99
test cl, 1
jne 0x531b99
imul eax, ecx, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, ebx
add ecx, ebx
push eax
call fcn.004df4a4
mov esi, dword [ebp - 4]
cmp dword [ebp - 0xc], esi
jge 0x531bcc
push dword [ebp - 0x10]
lea edi, [esi - 1]
sar edi, 1
imul eax, edi, 0x18
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.00531ac1
test al, al
je 0x531bcc
push dword [ebp - 4]
imul ecx, esi, 0x18
add ecx, ebx
call fcn.004df4a4
mov esi, edi
cmp dword [ebp - 0xc], edi
jl 0x531b9e
push dword [ebp - 0x10]
imul ecx, esi, 0x18
add ecx, ebx
call fcn.004df4a4
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x551fb1
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0xab8b2f
call fcn.00ab479e
mov esi, ecx
push 8
call fcn.00a8f9d4
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push ecx
push 0x55201d
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.00a955d3
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x552002
mov eax, esi
call fcn.00ab474d
ret 8
push 6
mov dword [edi], ebx
call fcn.00a91206
int3

Function at 0x552116
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x9f420f
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0xab8b2f
call fcn.00ab479e
mov esi, ecx
push 8
call fcn.00a8f9d4
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov dword [ecx], eax
mov dword [ecx + 4], 0x9f4076
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push ecx
push 0x9f426b
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.00a955d3
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x9f4261
mov eax, esi
call fcn.00ab474d
ret 8
push 6
mov dword [edi], ebx
call fcn.00a91206
int3
Function at 0xa468f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0xaf8008]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0xa469a8
mov eax, dword [esp]
cmp al, 2
jne 0xa469a2
shr eax, 8
cmp al, 2
jne 0xa469a2
call fcn.00a59220
test eax, eax
jne 0xa469ad
mov ecx, str.iphlpapi.dll
call fcn.00a46a10
mov dword [0xafd13c], eax
test eax, eax
je 0xa46968
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0xafaec8]
test eax, eax
cmovne ecx, eax
mov dword [0xafaec8], ecx
xor edx, edx
push 3
push ecx
push 0
lea ecx, [edx + 6]
call fcn.00a59440
add esp, 0xc
test al, al
setne byte [0xafd250]
push 0xafd248
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00a8f813
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00a8f813
mov esp, ebp
pop ebp
ret
Function at 0xa46a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push str.kernel32
mov esi, ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0xa46a34
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0xac8974
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0xac8984
push esi
mov dword [ebp - 8], ebx
call fcn.00aa1084
add esp, 8
test eax, eax
je 0xa46a7c
test ebx, ebx
je 0xa46a6c
push 8
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0xa46aa5
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xa46aa5
push 0x800
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0xa46b68
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xa46ac1
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0xaf897c]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0xa46b5e
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0xa46b5e
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xa46b00
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xa46b20
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0xa46b35
mov eax, dword [ebp - 8]
test eax, eax
je 0xa46b55
push 8
push 0
push ebx
call eax
jmp 0xa46b5c
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0xaf8984]
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xa471b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
call fcn.00a487f0
mov edx, edi
mov dword [ebp - 0x14], eax
call fcn.00a487d0
mov edx, dword [ebp + 8]
mov cl, 1
mov byte [ebp - 1], cl
mov dword [edx], 0
test eax, eax
je 0xa472da
cmp byte [eax + 0x3c], 0
je 0xa472da
mov esi, dword [edi + 0x8d8]
test esi, esi
je 0xa472da
mov eax, dword [edi + 0x78]
test eax, eax
je 0xa4720c
test byte [eax + 4], 0x10
je 0xa4720c
add eax, 0x78
jmp 0xa47212
lea eax, [edi + 0x8dc]
mov edi, dword [edi + 0x4a4]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
test edi, edi
je 0xa472d9
nop dword [eax]
cmp dword [esi + 0xc], 0
je 0xa472ca
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi]
mov eax, dword [ecx + 8]
mov ecx, dword [eax + 8]
call fcn.00a57740
test eax, eax
je 0xa472ca
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 4]
mov edi, dword [ecx + 0xc]
cmp byte [edi + 0x1c9], 0
jne 0xa47266
test edx, edx
je 0xa47279
jmp 0xa472c7
test edx, edx
je 0xa472c7
mov ecx, dword [edi + 0x64]
call fcn.00a57740
test eax, eax
je 0xa472c7
mov ecx, dword [ebp - 0xc]
cmp byte [edi + 0x1ca], 0
mov eax, dword [esi + 0x1c]
jne 0xa4728c
cmp eax, 0xffffffff
je 0xa47299
jmp 0xa472c7
cmp eax, 0xffffffff
je 0xa472c7
cmp dword [edi + 0x444], eax
jne 0xa472c7
mov eax, dword [ecx + 8]
mov eax, dword [eax + 0x10]
cmp eax, dword [esi + 0x18]
jne 0xa472c7
mov ecx, dword [edi + 0x1e0]
mov edx, dword [esi + 8]
mov ecx, dword [ecx]
call fcn.00a57740
test eax, eax
je 0xa472c7
mov ecx, dword [ebp - 0x14]
lea edx, [esi + 0x20]
call fcn.00a46c40
test al, al
jne 0xa472e2
mov edi, dword [ebp - 8]
inc ebx
add esi, 0x60
cmp ebx, edi
jb 0xa47230
mov cl, byte [ebp - 1]
pop ebx
pop edi
mov al, cl
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
pop ebx
pop edi
inc dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
xor cl, cl
mov al, cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xa4bf60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.00451a70
push eax
push edx
push esi
call fcn.00aafe50
add esp, 0xc
pop esi
pop ebp
ret

Function at 0xa4d970
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + edx]
mov edx, 0x1505
cmp esi, edi
jae 0xa4d998
mov cl, byte [esi]
call fcn.00a576d0
movsx ecx, al
inc esi
mov eax, edx
shl eax, 5
add edx, eax
xor edx, ecx
cmp esi, edi
jb 0xa4d980
pop edi
movzx eax, dl
pop esi
ret

Function at 0xa55c30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp byte [esi + 0x6d0], 0
je 0xa55cc0
cmp dword [esi + 0x1a4], 0
je 0xa55c80
push ebx
call fcn.00a4bb40
mov dl, 1
mov bl, al
call fcn.00a4bb20
push dword [esi + 0x154]
mov eax, dword [esi + 0x1a4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
call eax
add esp, 0x14
mov dl, bl
mov ecx, esi
pop ebx
pop edi
pop esi
pop ebp
jmp fcn.00a4bb20
mov eax, edi
sub eax, 0
je 0xa55c91
sub eax, 1
je 0xa55c91
sub eax, 1
jne 0xa55cc0
push dword [esi + 0x150]
lea eax, [edi*2 + 0xac5dc4]
push 1
add eax, edi
push 2
push eax
call fcn.00aa09ba
push dword [esi + 0x150]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00aa09ba
add esp, 0x20
pop edi
pop esi
pop ebp
ret

Function at 0xa57910
Capabilities:
Generate random numbers via winapi

Disassembly:
push esi
push edi
mov esi, edx
mov edi, ecx
push esi
push 0
push edi
call fcn.00a91e70
add esp, 0xc
push 2
push esi
push edi
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
neg eax
pop edi
sbb eax, eax
and eax, 2
pop esi
ret
Function at 0xa5c6d0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push 0
push dword [ebp + 8]
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 4
mov dword [ebp + 0xc], esi
call fcn.00a91e70
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa5c7a1
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0xa5c783
push 0
push edi
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0xa5c783
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp - 4]
call edi
test eax, eax
je 0xa5c783
cmp esi, dword [ebp - 0xc]
jb 0xa5c783
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0xa5c791
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0xa5c7a1
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xa5ca40
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [eax], 0
mov edi, edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
test esi, esi
jne 0xa5ca6e
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0xa5ca65
sub esi, ecx
cmp esi, 0x3fffffff
ja 0xa5cb92
lea ecx, [esi + 2]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx*4 + 1]
push eax
call dword [0xaf897c]
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
test ecx, ecx
je 0xa5cb92
push ebx
cmp esi, 3
jb 0xa5cb1c
mov eax, 0xaaaaaaab
mul esi
mov ebx, edx
shr ebx, 1
movzx eax, byte [edi]
sub esi, 3
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx edx, byte [edi]
movzx eax, byte [edi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx edx, byte [edi + 1]
movzx eax, byte [edi + 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movzx eax, byte [edi + 2]
add edi, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
sub ebx, 1
jne 0xa5cab5
test esi, esi
je 0xa5cb79
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx edx, byte [edi]
and edx, 3
shl edx, 4
cmp esi, 1
jne 0xa5cb4d
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov word [ecx + 2], 0x3d3d
jmp 0xa5cb76
movzx eax, byte [edi + 1]
shr eax, 4
or eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [edi + 1]
and eax, 0xf
movzx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov byte [ecx], 0
sub ecx, eax
pop ebx
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebp
ret
pop edi
mov eax, 0x1b
pop esi
pop ebp
ret
Function at 0xa607f0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
mov dword [ebp - 4], ecx
test edi, edi
je 0xa6080d
cmp dword [edi], 0
jne 0xa6081f
test esi, esi
je 0xa60816
cmp dword [esi], 0
jne 0xa6081f
test ebx, ebx
je 0xa60867
cmp dword [ebx], 0
je 0xa60867
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.00a895c0
add esp, 8
test ebx, ebx
je 0xa60839
cmp dword [ebx], 0
jne 0xa6083b
xor ebx, ebx
test esi, esi
je 0xa60844
cmp dword [esi], 0
jne 0xa60846
xor esi, esi
test edi, edi
je 0xa6084f
cmp dword [edi], 0
jne 0xa60851
xor edi, edi
push eax
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00a607a0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret