joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100050dd
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x10174350
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x14]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
ret

Function at 0x10005245
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1013c040
mov eax, 8
call fcn.10001f96
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp + 0x160]
mov edx, dword [ebp + 0x164]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
mov dword [esp + 8], edx
je 0x1013c075
mov eax, 0xfffffffe
pop ebp
add esp, 8
ret
push esi
mov esi, dword [esp + 0x1c]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x1013c146
jb 0x1013c09a
test eax, eax
jne 0x1013c146
push ebx
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 0x16c]
mov dword [ebp + 0x30], eax
mov dword [esp + 0x18], ecx
push edi
mov edi, dword [esp + 0x20]
test ecx, ecx
je 0x1013c0eb
test esi, esi
je 0x1013c136
mov al, byte [edi]
dec esi
xor byte [ecx + ebp + 0x40], al
inc edi
inc ecx
and ecx, 0xf
mov dword [esp + 0x1c], ecx
jne 0x1013c0b4
lea eax, [ebp + 0x60]
push eax
lea ebx, [ebp + 0x40]
push ebx
call dword [esp + 0x18]
mov eax, dword [esp + 0x24]
add esp, 8
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
jmp 0x1013c0ee
lea ebx, [ebp + 0x40]
mov eax, esi
lea ecx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x1013c10d
push eax
push edi
push ecx
push ebx
call edx
add edi, dword [esp + 0x24]
add esp, 0x10
sub esi, dword [esp + 0x14]
test esi, esi
je 0x1013c132
mov ecx, esi
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x1013c113
pop edi
pop ebx
pop esi
mov dword [ebp + 0x16c], ecx
xor eax, eax
pop ebp
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop ebx
pop esi
mov dword [ebp + 0x16c], ecx
xor eax, eax
pop ebp
add esp, 8
ret
pop esi
or eax, 0xffffffff
pop ebp
add esp, 8
ret
Function at 0x100052d1
Capabilities:
Resolve dns

Disassembly:
jmp 0x1008a5f0
mov eax, 0x20
call fcn.10001f96
push ebx
push esi
mov esi, dword [esp + 0x38]
xor ebx, ebx
mov eax, esi
sub eax, ebx
je 0x1008a638
sub eax, 2
je 0x1008a638
sub eax, 0x15
je 0x1008a638
push 0x297
push str.crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
call sym.libcrypto_1_1.dll_BIO_sock_init
cmp eax, 1
jne 0x1008a630
mov eax, dword [esp + 0x3c]
xor ecx, ecx
push ebp
push edi
xorps xmm0, xmm0
mov dword [esp + 0x10], ecx
xor edi, edi
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
test esi, esi
jne 0x1008a679
or ecx, 0x400
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x3c], 1
jne 0x1008a687
or ecx, 1
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x48]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x1008a6df
cmp esi, 8
je 0x1008a726
mov ecx, dword [esp + 0x10]
test ecx, 0x400
je 0x1008a6ee
push ebp
lea eax, [esp + 0x14]
and ecx, 0xfffffbff
push eax
push dword [esp + 0x40]
or ecx, 4
mov edi, esi
push dword [esp + 0x40]
mov dword [esp + 0x20], ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x1008a6a5
mov ebx, 1
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2da
push str.crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
test edi, edi
cmovne esi, edi
push esi
call fcn.10001230
push eax
push 1
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2cb
push str.crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
Function at 0x10005c9f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1013b990
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x10], esi
cmp esi, 0x10
ja 0x1013b9a2
xor eax, eax
pop esi
ret
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, esi
push edi
push dword [esp + 0x28]
mov edi, dword [esp + 0x18]
and ebx, 0xf
push ebp
push dword [esp + 0x28]
mov eax, 0x10
cmove ebx, eax
sub esi, ebx
push esi
push dword [esp + 0x28]
push edi
call sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
add dword [esp + 0x30], esi
add esp, 0x18
add edi, esi
test ebx, ebx
je 0x1013b9f1
mov ecx, ebp
sub edi, ebp
mov edx, ebx
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x1013b9e3
push dword [esp + 0x20]
push ebp
push ebp
call dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push ebx
lea esi, [eax - 0x10]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [ebp]
mov eax, dword [esp + 0x34]
add esp, 0x18
movups xmmword [esi], xmm0
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x10005ee3
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x10174660
mov eax, 0x74
call fcn.10001f96
mov eax, dword [0x1025e3d4]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x80]
test eax, eax
push esi
mov esi, dword [esp + 0x7c]
push edi
mov edi, 0x10261848
push 0x4c
cmovne edi, eax
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [esp + 0x90]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x6a09e667
push esi
push eax
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0x3c6ef372
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0x510e527f
mov dword [esp + 0x34], 0x9b05688c
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
mov dword [esp + 0x8c], 0x20
call sym.libcrypto_1_1.dll_SHA256_Update
lea eax, [esp + 0x20]
push eax
push edi
call sym.libcrypto_1_1.dll_SHA256_Final
lea eax, [esp + 0x28]
push 0x70
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xa0]
add esp, 0x28
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100032f1
add esp, 0x74
ret
Function at 0x10005fc9
Capabilities:
Connect socket
Set socket configuration

Disassembly:
jmp 0x1008de90
mov eax, 4
call fcn.10001f96
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x1008decc
push 0x52
push str.crypto_bio_b_sock2.c
push 0x87
push 0x8a
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
push esi
and eax, 1
push eax
push edi
call sym.libcrypto_1_1.dll_BIO_socket_nbio
add esp, 8
test eax, eax
je 0x1008df3a
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x1008df41
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x1008df41
push 0x5c
push str.crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x5d
push str.crypto_bio_b_sock2.c
push 0x89
push 0x8a
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test bl, 0x10
je 0x1008df7d
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x1008df7d
push 0x65
push str.crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x66
push str.crypto_bio_b_sock2.c
push 0x8a
jmp 0x1008df2b
mov esi, dword [esp + 0x18]
push esi
call fcn.100054bb
add esp, 4
push eax
push esi
call fcn.1000335a
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1008dfd3
push eax
call sym.libcrypto_1_1.dll_BIO_sock_should_retry
add esp, 4
test eax, eax
jne 0x1008df3a
push 0x6e
push str.crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x6f
push str.crypto_bio_b_sock2.c
push 0x67
jmp 0x1008df2b
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret

Function at 0x1000606e
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x101744d0
mov eax, 0x74
call fcn.10001f96
mov eax, dword [0x1025e3d4]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x80]
test eax, eax
push esi
mov esi, dword [esp + 0x7c]
push edi
mov edi, 0x1026182c
push 0x4c
cmovne edi, eax
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [esp + 0x90]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xc1059ed8
push esi
push eax
mov dword [esp + 0x24], 0x367cd507
mov dword [esp + 0x28], 0x3070dd17
mov dword [esp + 0x2c], 0xf70e5939
mov dword [esp + 0x30], 0xffc00b31
mov dword [esp + 0x34], 0x68581511
mov dword [esp + 0x38], 0x64f98fa7
mov dword [esp + 0x3c], 0xbefa4fa4
mov dword [esp + 0x8c], 0x1c
call sym.libcrypto_1_1.dll_SHA256_Update
lea eax, [esp + 0x20]
push eax
push edi
call sym.libcrypto_1_1.dll_SHA256_Final
lea eax, [esp + 0x28]
push 0x70
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xa0]
add esp, 0x28
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100032f1
add esp, 0x74
ret
Function at 0x10006172
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1008dbc0
push esi
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x1008dbf8
push 0xc3
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
mov eax, esi
pop esi
ret

Function at 0x100061bd
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1008db20
cmp dword [0x1025e568], 0
jne 0x1008db91
push 0x190
push 0
push 0x1025e570
mov dword [0x1025e568], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1025e570
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1008db91
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x87
push str.crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x88
push str.crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
or eax, 0xffffffff
ret
mov eax, 1
ret

Function at 0x1000622b
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x10174af0
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
ret
Function at 0x1000643d
Capabilities:
Write file on windows

Disassembly:
jmp 0x10161ad0
mov eax, 0x434
call fcn.10001f96
mov eax, dword [0x1025e3d4]
xor eax, esp
mov dword [esp + 0x430], eax
push esi
mov esi, dword [esp + 0x43c]
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
js 0x10161b4b
test dword [esp + 0xa], 0x8000
jne 0x10161b4b
push 0xb7
push str.crypto_rand_randfile.c
push 0x7a
push 0x70
push 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
push esi
push str.Filename
push 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.100032f1
add esp, 0x434
ret
lea eax, [esp + 0x34]
push 0x400
push eax
call sym.libcrypto_1_1.dll_RAND_priv_bytes
add esp, 8
cmp eax, 1
jne 0x10161b32
push edi
push 0x10224d0c
push esi
call fcn.1000558d
mov edi, eax
add esp, 8
test edi, edi
jne 0x10161bb6
push 0xe9
push str.crypto_rand_randfile.c
push 0x79
push 0x70
push 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
push esi
push str.Filename
push 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.100032f1
add esp, 0x434
ret
push 0x180
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chmod]
push edi
push 0x400
lea eax, [esp + 0x48]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea eax, [esp + 0x54]
push 0x400
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0x45c]
add esp, 0x24
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.100032f1
add esp, 0x434
ret

Function at 0x10006451
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x1008da40
cmp dword [esp + 8], 0
je 0x1008da58
push 0x16b
push str.crypto_bio_b_sock.c
push 0x8c
jmp 0x1008dad4
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov eax, dword [esp + 0x10]
push dword [eax]
call fcn.10002117
add esp, 4
push eax
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x1008dabe
push 0x160
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x10
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x161
push str.crypto_bio_b_sock.c
push 0x84
push 0x8d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
xor eax, eax
ret
cmp dword [esp + 8], 0x1c
jbe 0x1008dae6
push 0x165
push str.crypto_bio_b_sock.c
push 0x85
push 0x8d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
ret
mov eax, 1
ret
Function at 0x10006456
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1013bf90
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x10], esi
cmp esi, 0x10
jae 0x1013bfa2
xor eax, eax
pop esi
ret
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x20]
push edi
push dword [esp + 0x28]
mov edi, esi
push ebp
push dword [esp + 0x28]
and edi, 0xf
sub esi, edi
push esi
push dword [esp + 0x28]
push ebx
call sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
add esp, 0x18
test edi, edi
jne 0x1013bfd6
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
ret
add ebx, esi
test edi, edi
je 0x1013bfee
mov ecx, ebp
sub ebx, ebp
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x1013bfe0
push dword [esp + 0x20]
push ebp
push ebp
call dword [esp + 0x34]
movups xmm0, xmmword [ebp]
mov eax, dword [esp + 0x28]
add esp, 0xc
mov ecx, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
movups xmmword [eax + ecx - 0x10], xmm0
pop esi
ret

Function at 0x100064f6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x101ba980
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.101ba5f8
push eax
push esi
push dword [ebp + 8]
call fcn.101ba5ad
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.101ba5f8
push eax
push esi
push dword [ebp + 8]
call fcn.101ba5ad
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.101ba5f8
push eax
push esi
push dword [ebp + 8]
call fcn.101ba5ad
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.101ba5e8
dec eax
or esi, dword [ebx + 0x7c9d8892]
invalid
Function at 0x1000659b
Capabilities:
Resolve dns

Disassembly:
jmp 0x1008a7b0
mov eax, 0x20
call fcn.10001f96
push ebx
push esi
mov esi, dword [esp + 0x38]
xor ebx, ebx
mov eax, esi
sub eax, ebx
je 0x1008a7f8
sub eax, 2
je 0x1008a7f8
sub eax, 0x15
je 0x1008a7f8
push 0x297
push str.crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
call sym.libcrypto_1_1.dll_BIO_sock_init
cmp eax, 1
jne 0x1008a7f0
mov eax, dword [esp + 0x3c]
xor ecx, ecx
push ebp
push edi
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
xor edi, edi
mov dword [esp + 0x10], ecx
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
test esi, esi
jne 0x1008a83d
or ecx, 0x400
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x3c], 1
jne 0x1008a84b
or ecx, 1
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x1008a8a8
nop dword [eax]
cmp esi, 8
je 0x1008a8ef
mov eax, dword [esp + 0x10]
test eax, 0x400
je 0x1008a8b7
and eax, 0xfffffbff
mov edi, esi
or eax, 4
push ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x1008a870
mov ebx, 1
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2da
push str.crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
test edi, edi
cmovne esi, edi
push esi
call fcn.10001230
push eax
push 1
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2cb
push str.crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret

Function at 0x1000674e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10137660
push esi
mov esi, dword [esp + 8]
xor edx, edx
test esi, esi
je 0x101376a6
mov al, byte [esi]
test al, al
je 0x101376a6
push edi
mov edi, 0x100
movsx eax, al
lea esi, [esi + 1]
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol edx, cl
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x10137677
mov eax, edx
shr eax, 0x10
pop edi
xor eax, edx
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x10006820
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x10186990
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0xc]
mov edi, eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
ret
Function at 0x1000687a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10172d30
cmp dword [esp + 0x18], 0
je 0x10172d44
mov dword [esp + 0x18], sym.libcrypto_1_1.dll_SEED_encrypt
jmp sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
mov dword [esp + 0x18], sym.libcrypto_1_1.dll_SEED_decrypt
jmp sym.libcrypto_1_1.dll_CRYPTO_cbc128_decrypt

Function at 0x10006bb3
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
jmp 0x10162690
mov eax, dword [esp + 0x10]
mov ecx, 0x400
push ebx
mov ebx, 0x80
mov edx, ebx
cmp dword [esp + 0xc], edx
push ebp
cmovle edx, dword [esp + 0x10]
mov ebp, ecx
test eax, eax
push esi
mov esi, dword [esp + 0x10]
cmovg ebp, eax
cmp ebp, ecx
push edi
cmovg ebp, ecx
mov byte [esi], 0
mov dword [esp + 0x14], ebp
test edx, edx
jle 0x101626e4
mov ebp, dword [esp + 0x1c]
mov ecx, esi
sub ebp, esi
mov edi, edx
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edi, 1
jne 0x101626d2
mov ebp, dword [esp + 0x14]
movzx edi, byte [edx + esi - 1]
cmp edx, ebx
jge 0x1016270c
mov ecx, esi
nop
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
add eax, edi
movzx eax, al
mov al, byte [eax + 0x10224d78]
mov byte [edx + esi], al
inc edx
movzx edi, al
cmp edx, ebx
jl 0x101626f0
mov ecx, dword [esp + 0x14]
add ebp, 7
sar ebp, 3
neg ecx
sub ebx, ebp
and ecx, 7
movzx eax, byte [ebx + esi]
lea edi, [ebx + esi]
mov edx, 0xff
sar edx, cl
and edx, eax
mov al, byte [edx + 0x10224d78]
movzx ecx, al
mov byte [edi], al
test ebx, ebx
je 0x1016275a
nop dword [eax]
movzx eax, byte [edi + ebp - 1]
lea edi, [edi - 1]
xor eax, ecx
mov al, byte [eax + 0x10224d78]
movzx ecx, al
mov byte [edi], al
sub ebx, 1
jne 0x10162740
lea edi, [esi + 0xfc]
mov edx, 0x7f
nop word [eax + eax]
movzx ecx, byte [edx + esi]
lea edi, [edi - 4]
movzx eax, byte [edx + esi - 1]
shl ecx, 8
or ecx, eax
sub edx, 2
mov dword [edi + 4], ecx
jns 0x10162770
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10006c2b
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x10145920
add dword [esp + 4], 0x10
jmp sym.libcrypto_1_1.dll_X509V3_add1_i2d
Function at 0x10006d61
Capabilities:
Hash data with md5

Disassembly:
jmp 0x10138830
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x10]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret