joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003481
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1000cf80
cmp dword [esp + 0x18], 0
je 0x1000cf94
mov dword [esp + 0x18], sym.libcrypto_1_1.dll_AES_encrypt
jmp sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
mov dword [esp + 0x18], sym.libcrypto_1_1.dll_AES_decrypt
jmp sym.libcrypto_1_1.dll_CRYPTO_cbc128_decrypt

Function at 0x10003486
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x10158580
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.101aad60
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret

Function at 0x100034b3
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x1013d400
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.101aad60
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x10003508
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10113180
mov eax, 0x10
call fcn.101aa6d0
mov ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x3c]
mov edi, dword [edi]
test edi, edi
je 0x101131bd
test esi, esi
je 0x101131bd
mov al, byte [edi + ecx]
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebx
inc ebp
dec esi
and edi, 0xf
jne 0x101131a8
mov edx, dword [esp + 0x34]
cmp esi, 0x10
jb 0x10113252
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x10], eax
xor edi, edi
mov eax, esi
shr eax, 4
mov dword [esp + 0x14], edi
mov edi, ebx
mov dword [esp + 0x2c], eax
shl eax, 4
add ebx, eax
sub edi, ecx
add ebp, eax
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x38]
lea esp, [esp]
push dword [esp + 0x30]
push ebp
push edx
call dword [esp + 0x4c]
mov eax, dword [esp + 0x40]
push eax
call fcn.101134c0
add esp, 0x10
mov eax, ebp
mov edx, 4
mov edi, edi
mov ecx, dword [ebx + eax]
xor ecx, dword [eax]
lea eax, [eax + 4]
mov dword [edi + eax - 4], ecx
dec edx
jne 0x10113220
mov edx, dword [esp + 0x34]
sub esi, 0x10
add edi, 0x10
add ebx, 0x10
dec dword [esp + 0x2c]
jne 0x10113200
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x38]
test esi, esi
je 0x1011328f
push dword [esp + 0x30]
push ecx
push edx
call dword [esp + 0x4c]
mov eax, dword [esp + 0x40]
push eax
call fcn.101134c0
mov eax, dword [esp + 0x48]
add esp, 0x10
lea ecx, [edi + eax]
sub ebp, eax
sub ebx, eax
add edi, esi
lea ebx, [ebx]
mov al, byte [ecx + ebp]
xor al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + ebx - 1], al
dec esi
jne 0x10113280
mov eax, dword [esp + 0x3c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1000373d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1010f110
push esi
mov esi, dword [esp + 8]
xor edx, edx
test esi, esi
je 0x1010f156
mov al, byte [esi]
test al, al
je 0x1010f156
push edi
mov edi, pe_nt_image_headers32
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol edx, cl
lea esi, [esi + 1]
add edi, 0x100
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x1010f127
mov eax, edx
shr eax, 0x10
pop edi
xor eax, edx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10003a85
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1002e8b0
push 0
push 0x10275dec
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_init_local
add esp, 8
test eax, eax
je 0x1002e8e3
push 0
push 0x10275df0
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_init_local
add esp, 8
test eax, eax
jne 0x1002e8e6
push 0x10275dec
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_cleanup_local
add esp, 4
xor eax, eax
ret
mov eax, 1
ret
Function at 0x10003b3e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1004c1b0
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [ebx + 4]
push edi
cmp eax, dword [ecx + 4]
jge 0x1004c1c7
mov edi, ecx
jmp 0x1004c1cb
mov edi, ebx
mov ebx, ecx
push dword [edi + 4]
mov ebp, dword [esp + 0x14]
push ebp
call fcn.100060af
add esp, 8
test eax, eax
jne 0x1004c1e3
pop edi
pop ebp
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x1004c208
push esi
jmp 0x1004c1f0
mov ecx, dword [ebx]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
xor esi, dword [edx + eax*4]
mov ecx, dword [ebp]
inc eax
mov dword [ecx + eax*4 - 4], esi
cmp eax, dword [ebx + 4]
jl 0x1004c1f0
pop esi
cmp eax, dword [edi + 4]
jge 0x1004c221
lea ecx, [ecx]
mov ecx, dword [edi]
mov edx, dword [ebp]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [edi + 4]
jl 0x1004c210
mov eax, dword [edi + 4]
push ebp
mov dword [ebp + 4], eax
call fcn.10002167
add esp, 4
mov eax, 1
pop edi
pop ebp
pop ebx
ret
Function at 0x10003d1e
Capabilities:
Hash data with md5

Disassembly:
jmp 0x1010f660
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.101aad60
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret

Function at 0x10003d23
Capabilities:
Hash data with md5

Disassembly:
jmp 0x10110bc0
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.101aad60
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x1000492b
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x101513f0
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.101aad60
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x1000493f
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x1015bbb0
mov eax, dword [esp + 4]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret
Function at 0x100049f3
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x1000dec0
push ebp
mov ebp, dword [esp + 0x10]
push ebp
push dword [esp + 0x10]
push dword [esp + 0x10]
call sym.libcrypto_1_1.dll_AES_set_encrypt_key
add esp, 0xc
test eax, eax
js 0x1000e0ac
push ebx
push esi
push edi
mov edi, dword [ebp + 0xf0]
shl edi, 2
xor ebx, ebx
test edi, edi
jle 0x1000df3c
lea esi, [ebp + 8]
lea eax, [ebp + 8]
lea esi, [esi + edi*4]
lea esp, [esp]
mov ecx, dword [esi - 8]
mov edx, dword [eax - 8]
mov dword [eax - 8], ecx
mov ecx, dword [esi - 4]
mov dword [esi - 8], edx
mov edx, dword [eax - 4]
mov dword [eax - 4], ecx
mov ecx, dword [esi]
mov dword [esi - 4], edx
mov edx, dword [eax]
mov dword [eax], ecx
mov ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [eax + 4]
mov dword [eax + 4], ecx
add ebx, 4
sub edi, 4
mov dword [esi + 4], edx
lea eax, [eax + 0x10]
lea esi, [esi - 0x10]
cmp ebx, edi
jl 0x1000df00
mov edi, 1
cmp dword [ebp + 0xf0], edi
jle 0x1000e0a7
lea esi, [ebp + 2]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
shr eax, 0x18
inc edi
movzx ecx, byte [eax*4 + 0x101dc088]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x101dcc88]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd488]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd888]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd088]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x101dc088]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x101dcc88]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd488]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd088]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd888]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x101dc088]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x101dcc88]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd488]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd088]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd888]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x101dc088]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x101dcc88]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd488]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd088]
movzx eax, dl
movzx eax, byte [eax*4 + 0x101dc088]
xor ecx, dword [eax*4 + 0x101dd888]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebp + 0xf0]
jl 0x1000df50
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10004c87
Capabilities:
Encode data using xor

Disassembly:
jmp 0x101140e0
mov eax, 4
call fcn.101aa6d0
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 0x164]
mov edx, dword [edi + 0x160]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x38]
or eax, dword [edi + 0x3c]
je 0x1011410f
mov eax, 0xfffffffe
pop edi
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [edi + 0x30]
adc ecx, dword [edi + 0x34]
cmp ecx, 0x20000000
ja 0x101141c0
jb 0x10114134
test eax, eax
jne 0x101141c0
push ebx
mov ebx, dword [edi + 0x16c]
push ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
test ebx, ebx
je 0x10114176
lea ebx, [ebx]
test esi, esi
je 0x10114165
mov al, byte [ebp]
xor byte [ebx + edi + 0x40], al
inc ebx
inc ebp
dec esi
and ebx, 0xf
jne 0x10114150
jmp 0x10114169
test ebx, ebx
jne 0x101141b2
lea eax, [edi + 0x60]
push eax
lea eax, [edi + 0x40]
push eax
call edx
add esp, 8
mov eax, esi
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x1011419a
push eax
push ebp
lea eax, [edi + 0x60]
push eax
lea eax, [edi + 0x40]
push eax
call dword [esp + 0x28]
add ebp, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x101141b2
xor ecx, ecx
mov ebx, esi
test esi, esi
je 0x101141b2
mov al, byte [ecx + ebp]
xor byte [edi + ecx + 0x40], al
inc ecx
cmp ecx, esi
jb 0x101141a6
pop ebp
mov dword [edi + 0x16c], ebx
pop ebx
pop esi
xor eax, eax
pop edi
pop ecx
ret
pop esi
or eax, 0xffffffff
pop edi
pop ecx
ret
Function at 0x1000503d
Capabilities:
Connect socket
Set socket configuration

Disassembly:
jmp 0x10033940
mov eax, 4
call fcn.101aa6d0
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x1003397c
push 0x52
push str...crypto_bio_b_sock2.c
push 0x87
push 0x8a
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call sym.libcrypto_1_1.dll_BIO_socket_nbio
add esp, 8
test eax, eax
jne 0x1003399b
pop ebx
pop edi
pop ecx
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x100339e4
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x100339e4
push 0x5c
push str...crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x5d
push str...crypto_bio_b_sock2.c
push 0x89
jmp 0x10033a71
test bl, 0x10
je 0x10033a20
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x10033a20
push 0x65
push str...crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x66
push str...crypto_bio_b_sock2.c
push 0x8a
jmp 0x10033a71
mov esi, dword [esp + 0x18]
push esi
call fcn.100012ee
add esp, 4
push eax
push esi
call fcn.1000211c
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10033a87
push eax
call sym.libcrypto_1_1.dll_BIO_sock_should_retry
add esp, 4
test eax, eax
jne 0x10033a80
push 0x6e
push str...crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x6f
push str...crypto_bio_b_sock2.c
push 0x67
push 0x8a
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x100051c3
Capabilities:
Check if file exists

Disassembly:
jmp 0x1003b5c0
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.100038cd
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.101ab970
add esp, 0x10
test eax, eax
mov ecx, 0x11
cmove ebx, ecx
test edi, edi
jne 0x1003b677
push 0x45
push str...crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x101e6828
push esi
push 0x101e682c
push dword [esp + 0x30]
push str.fopen_
push 5
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x2c
call fcn.101ad4d3
cmp dword [eax], 2
je 0x1003b659
call fcn.101ad4d3
cmp dword [eax], 6
je 0x1003b659
push 0x4e
push str...crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x4c
push str...crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x101e67bc
call sym.libcrypto_1_1.dll_BIO_new
mov esi, eax
add esp, 4
test esi, esi
jne 0x1003b699
push edi
call fcn.101ac934
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x8000
push esi
call sym.libcrypto_1_1.dll_BIO_clear_flags
push edi
push ebx
push 0x6a
push esi
call sym.libcrypto_1_1.dll_BIO_ctrl
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x10005353
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1015bba0
jmp sym.libcrypto_1_1.dll_SHA512_Final

Function at 0x10005506
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1016cc50
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0xc]
mov edi, eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
ret
Function at 0x10005aec
Capabilities:
Resolve dns

Disassembly:
jmp 0x10030710
mov eax, 0x20
call fcn.101aa6d0
push ebx
push esi
mov esi, dword [esp + 0x38]
xor ebx, ebx
mov eax, esi
sub eax, ebx
je 0x10030758
sub eax, 2
je 0x10030758
sub eax, 0x15
je 0x10030758
push 0x293
push str...crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
call sym.libcrypto_1_1.dll_BIO_sock_init
cmp eax, 1
jne 0x10030750
mov eax, dword [esp + 0x3c]
xorps xmm0, xmm0
movq qword [esp + 0x10], xmm0
push ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
push edi
xor edi, edi
movq qword [esp + 0x10], xmm0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
movq qword [esp + 0x20], xmm0
movq qword [esp + 0x28], xmm0
mov dword [esp + 0x14], esi
test esi, esi
jne 0x100307a6
or eax, 0x400
mov dword [esp + 0x10], eax
cmp dword [esp + 0x3c], 1
jne 0x100307b4
or eax, 1
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x4c]
push ebp
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x1003080a
cmp esi, 8
je 0x10030851
mov eax, dword [esp + 0x10]
test eax, 0x400
je 0x10030819
and eax, 0xfffffbff
or eax, 4
push ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
mov edi, esi
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x100307d2
pop edi
pop ebp
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2d4
push str...crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
test edi, edi
cmovne esi, edi
push esi
call fcn.10002171
push eax
push 1
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
mov eax, ebx
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x20
ret
push 0x2c5
push str...crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
mov eax, ebx
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x10005e75
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x10148fd0
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x10149093
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x10148ff1
cmp al, 0x6b
jne 0x10149093
inc ecx
cmp al, 0x6b
jne 0x10149058
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x10149012
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x10149012
cmp dl, 0xbb
jne 0x10149038
inc eax
cmp eax, esi
jl 0x10149000
sub esi, eax
test eax, eax
jne 0x1014905b
push 0x50
push str...crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x48
push str...crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x10149081
push 0x59
push str...crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.101aa710
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x3d
push str...crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x10005f56
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
jmp 0x1013ac00
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, 0x80
cmp eax, edi
cmovg eax, edi
mov byte [ebx], 0
test ebp, ebp
jg 0x1013ac28
mov ebp, 0x400
jmp 0x1013ac32
mov ecx, 0x400
cmp ebp, ecx
cmovg ebp, ecx
test eax, eax
jle 0x1013ac51
sub dword [esp + 0x1c], ebx
mov edx, ebx
mov ebx, dword [esp + 0x1c]
mov esi, eax
mov cl, byte [ebx + edx]
mov byte [edx], cl
lea edx, [edx + 1]
dec esi
jne 0x1013ac42
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx + eax - 1]
cmp eax, 0x80
jge 0x1013ac80
mov esi, ebx
sub esi, eax
movzx ecx, byte [esi + eax]
add ecx, edx
and ecx, 0xff
inc eax
movzx edx, byte [ecx + 0x10234258]
mov byte [eax + ebx - 1], dl
cmp eax, 0x80
jl 0x1013ac61
lea eax, [ebp + 7]
sar eax, 3
sub edi, eax
neg ebp
and ebp, 7
lea esi, [edi + ebx]
mov ecx, ebp
mov edx, 0xff
sar edx, cl
mov dword [esp + 0x14], eax
movzx eax, byte [esi]
and edx, eax
movzx ecx, byte [edx + 0x10234258]
mov byte [esi], cl
test edi, edi
je 0x1013acc9
mov edx, dword [esp + 0x14]
movzx eax, byte [esi + edx - 1]
lea esi, [esi - 1]
xor eax, ecx
movzx ecx, byte [eax + 0x10234258]
mov byte [esi], cl
dec edi
jne 0x1013acb3
lea esi, [ebx + 0xfc]
lea edx, [ebx + 0x7e]
mov edi, 0x40
jmp 0x1013ace0
movzx ecx, byte [edx + 1]
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
and ecx, 0xffff
mov dword [esi], ecx
lea esi, [esi - 4]
lea edx, [edx - 2]
dec edi
jne 0x1013ace0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10006302
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x1015c790
mov eax, dword [esp + 4]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret

Function at 0x100064c4
Capabilities:
Set socket configuration

Disassembly:
jmp 0x10033670
push esi
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x100336a8
push 0xc3
push str...crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
mov eax, esi
pop esi
ret