joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cdc80
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x1010f9cc
push ecx
call fcn.100c3d30
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.100cce20
test eax, eax
jne 0x100cdcb0
mov eax, esi
jmp fcn.100cd2b0
ret
Function at 0x100ce0c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x10139d20]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
mov ebx, dword [ebp]
push esi
mov esi, dword [ebp + 0x3d0]
push edi
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
lea edi, [esi + 0x15c]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x100ce14f
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.1007a170
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x100ce18a
push str.Received_too_short_packet
push ebx
call fcn.100c3dc0
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100773e8
add esp, 0x88
ret
mov eax, edi
call fcn.100ccfa0
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x100ce1a3
jmp dword [eax*4 + 0x100ce290]
cmp edx, 4
jle case.0x100ce1a3.4
mov eax, edi
call fcn.100ccfb0
movzx ecx, word [esi + 0x40]
add ecx, 1
cmp cx, ax
jne case.0x100ce1a3.4
add edx, 0xfffffffc
push edx
mov edx, dword [edi]
add edx, 4
push edx
push 1
push ebp
call fcn.100c40a0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x100ce1f8
mov ecx, 5
mov eax, esi
call fcn.100ce040
mov eax, edi
jmp 0x100ce171
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x38], eax
mov ecx, dword [ebx + 0x38]
adc dword [ebx + 0x3c], edx
mov eax, dword [ebx + 0x3c]
push eax
push ecx
push ebx
call fcn.100dac80
jmp 0x100ce264
mov eax, edi
call fcn.100ccfb0
movzx edx, ax
mov eax, dword [edi]
add eax, 4
push eax
push 0x1010f9cc
push ebx
mov dword [esi + 8], edx
call fcn.100c3d30
jmp 0x100ce264
mov ecx, dword [edi]
add edx, 0xfffffffe
push edx
add ecx, 2
push ecx
push esi
call fcn.100cd050
add esp, 0xc
test eax, eax
je case.0x100ce1a3.4
jmp 0x100ce171
push str.Internal_error:_Unexpected_packet
push 0x1010e26c
push ebx
call fcn.100c3dc0
add esp, 0xc
push ebp
call fcn.100dad40
add esp, 4
test eax, eax
je 0x100ce16f
mov ecx, 5
mov eax, esi
call fcn.100ce040
mov eax, 0x2a
jmp 0x100ce171
Function at 0x100cfe00
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x10139d20]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100cfe35
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.100c3dc0
add esp, 0xc
jmp 0x100cfe6c
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ax, word [esp]
cmp al, 2
jne 0x100cfe5e
test ah, ah
jne 0x100cfe5e
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.100773e8
add esp, 0x194
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.100c3dc0
add esp, 8
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.100773e8
add esp, 0x194
ret

Function at 0x100d0000
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x130]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x100d0044
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.100c3dc0
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.100cfef0
add esp, 4
pop esi
pop ecx
ret
Function at 0x100d1690
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x10139d20]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esi + 0x134]
push ebp
push edi
mov edi, dword [esi]
push 1
push 0
push edi
or ebp, 0xffffffff
mov dword [esp + 0x18], 0x10
call fcn.100c4200
add esp, 0xc
test eax, eax
jl 0x100d16f9
mov ecx, 0x3e8
cmp eax, ecx
jge 0x100d16d0
mov ecx, eax
push ecx
push 0xffffffffffffffff
push ebx
call fcn.100d9700
add esp, 0xc
cmp eax, 0xffffffff
je 0x100d1794
test eax, eax
jne 0x100d171e
push 1
push eax
push edi
call fcn.100c4200
add esp, 0xc
test eax, eax
jge 0x100d16c5
push str.Timeout_while_waiting_for_server_connect
push edi
call fcn.100c3dc0
add esp, 8
pop edi
pop ebp
mov eax, 0x1c
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100773e8
add esp, 0x18
ret
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x100d174e
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebp, eax
push ebx
push esi
call fcn.100c4a10
add esp, 8
cmp ebp, 0xffffffff
jne 0x100d1764
push str.Error_accept__ing_server_connect
jmp 0x100d1799
push str.Connection_accepted_from_server_n
push edi
call fcn.100c3d30
push 1
push ebp
mov dword [esi + 0x134], ebp
call fcn.100dd2c0
add esp, 0x10
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100773e8
add esp, 0x18
ret
push str.Error_while_waiting_for_server_connect
push edi
call fcn.100c3dc0
mov ecx, dword [esp + 0x28]
add esp, 8
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x1e
call fcn.100773e8
add esp, 0x18
ret
Function at 0x100d2790
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x100d27c8
push str.Couldnt_set_desired_mode
push ebx
call fcn.100c3dc0
add esp, 8
pop esi
pop ebp
mov eax, 0x11
pop ebx
ret
cmp ecx, 0xc8
je 0x100d27df
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.100c3d30
add esp, 0xc
cmp ebp, 0x13
jne 0x100d27f1
mov eax, edi
call fcn.100d2350
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x100d2805
push edi
call fcn.100d23a0
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x100d2817
mov eax, edi
call fcn.100d24c0
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x100d2825
mov eax, edi
call fcn.100d24d0
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x100d9700
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
cmp ebx, 0xffffffff
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
jne 0x100d9744
cmp ebp, ebx
jne 0x100d9744
mov eax, dword [esp + 0x334]
push eax
call fcn.100d96d0
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x100d975f
mov esi, edi
call fcn.100c8b10
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
cmp ebx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
je 0x100d9793
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
cmp ebp, 0xffffffff
mov dword [esp + 0x228], eax
je 0x100d97da
test ecx, ecx
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
jbe 0x100d97c2
cmp dword [esp + eax*4 + 0x24], ebp
je 0x100d97c2
add eax, 1
cmp eax, ecx
jb 0x100d97b5
cmp eax, ecx
jne 0x100d97d4
cmp ecx, 0x40
jae 0x100d97d4
mov dword [esp + eax*4 + 0x24], ebp
add dword [esp + 0x20], 1
cmp ebp, edx
jbe 0x100d97da
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea ecx, [esp + 0x18]
lea ebp, [edx + 1]
sub ebx, 1
and ebx, ecx
lea ecx, [ecx]
xor eax, eax
cmp edi, eax
jle 0x100d9821
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov edx, esi
sub edx, eax
imul edx, edx, 0x3e8
mov dword [esp + 0x1c], edx
jmp 0x100d982b
jne 0x100d982b
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x130]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x100d9895
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x100d985e
cmp eax, 0x2714
jne 0x100d9899
test edi, edi
jle 0x100d97f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.100c8b10
push edx
push eax
call fcn.100c8b40
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x100d97f0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x100d98a7
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x100d98b6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x100d98ed
lea edx, [esp + 0x124]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100d98db
mov esi, 1
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100d98ed
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x100d9920
lea ecx, [esp + 0x228]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100d990e
or esi, 2
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100d9920
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x100db470
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x100db47f
jmp dword [ecx*4 + 0x100db4d4]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret

Function at 0x100db660
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x10139d20]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.10091111
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x100db6c5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x100db6c5
lea edx, [esp]
push edx
call dword [0x1013b3b4]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100773e8
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.100773e8
add esp, 0x108
ret
jmp 0x100db660

Function at 0x100db6e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x10139d20]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.10091111
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x100db6c5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x100db6c5
lea edx, [esp]
push edx
call dword [0x1013b3b4]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100773e8
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.100773e8
add esp, 0x108
ret
jmp 0x100db660

Function at 0x100dd600
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a4]
test esi, esi
jne 0x100dd619
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.100c8b10
push edx
push eax
call fcn.100c8b40
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x100dd666
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x120]
push eax
push ecx
call fcn.100c8b10
push edx
push eax
call fcn.100c8b40
mov ecx, dword [edi + 0x19c]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x100dd668
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x100ddfc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x1013b3a8]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100ddfe5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x100de02c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x100de030
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
test ebp, ebp
mov dword [esp + 0x10], 0
jbe 0x100de090
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
add ebx, 1
call edx
add esp, 0x18
sub ebp, 1
jne 0x100de053
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x10]
pop ebp
pop ebx
jae 0x100de0d3
jmp 0x100de0a0
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x10114ca4
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x10114ca5
push eax
call ecx
mov eax, dword [esp + 0x20]
add eax, 1
add esp, 0x18
cmp eax, dword [esi + 0x10]
mov dword [esp + 8], eax
jb 0x100de0a0
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x100de150
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x100dea50
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x100dea82
push 0x2e
push esi
call fcn.1007d680
add esp, 8
test eax, eax
je 0x100dea80
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x10105973
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x10105980
mov dword [esp], edx
popal
lea ebp, reloc.KERNEL32.dll_RtlUnwind
jmp 0x101059ac

Function at 0x10105e29
Capabilities:
Encrypt data using aes

Disassembly:
mov di, word [esp]
lea esp, [esp + 0x3c]
xor ecx, dword [ebx]
jmp 0x10105e12
and edx, ebp
xor ecx, edx
rcl edi, cl
mov dx, word [esp]
jmp 0x10105dd4
xor ecx, dword [eax]
jmp 0x10106016
lea edi, [eax + 0x10]
jmp 0x10105dfc
lea edi, [eax*4]
mov di, 0x5a6c
jmp 0x10105df0
add edi, 4
mov edx, dword [edi]
pop edi
jmp 0x10105f1c
mov dh, bh
push edi
mov edi, eax
jmp 0x10105e36
cmp ebx, 0x100d3030
jmp 0x10105e8f
sub esp, 0x16
lea esp, [esp + 2]
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x4c]
jmp 0x10105e53
push 0xa
xchg bl, ah
xchg edi, eax
mov ebp, 0x1477f252
jmp 0x10105ea1
jne 0x100c65a7
mov di, 0xc77d
mov bl, 0xe4
mov bx, word [esp]
jmp 0x10105e79
lea edi, [ecx*4]
jmp 0x10105ec5
not edx
mov edx, dword [eax + 0xc]
sub esp, 0x18
xor edx, ecx
jmp 0x10105e69
pop eax
lea edi, [edx + edi]
pop edi
mov si, word [esp]
jmp 0x10105ed4
lea ebx, [esp - 0x67]
pushal
jmp 0x10105efa
mov ecx, dword [eax + 8]
xor ecx, edx
mov dl, byte [esp]
mov dword [eax + 0x18], ecx
jmp 0x10105eb9
lea esp, [esp + 0x20]
pop esi
mov bl, 0xa2
mov bl, 0xf1
mov ebx, dword [esp]
jmp 0x10105f71
xor edx, ecx
bt cx, cx
mov dword [eax + 0x14], edx
jmp 0x10105eed
mov bh, 0x7b
pop ebp
pop ebx
ret
add ebx, 4
pushal
xchg word [esp + 0xf], dx
mov dword [edi], ecx
jmp 0x10105e4c

Function at 0x101063ba
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp]
lea esp, [esp + 2]
jmp 0x101061b9
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_RtlUnwind]
stc
jmp 0x101061cf
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_RtlUnwind]
mov ebx, 0xaf1248dd
movzx ebx, byte [esi + 2]
jmp 0x101061a3
and ebx, ecx
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_RtlUnwind]
neg bx
adc ebx, ebx
jmp 0x10106210
sub esp, 0x14
stc
lea esp, [esp + 0x13]
lea esp, [esp + 1]
jmp 0x1010621f
movzx ebx, byte [esi + 5]
and edx, ecx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_RtlUnwind]
jmp 0x101061fa
and edx, ecx
xor edi, dword [edx*4 + reloc.KERNEL32.dll_RtlUnwind]
shr dx, cl
not dl
jmp 0x10106233
mov edx, dword [esi + 4]
stc
jmp 0x101063da
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_RtlUnwind]
bsf di, sp
call fcn.10106293
and edx, ecx
jmp 0x10106371
mov edx, dword [esi + 8]
push dx
lea esp, [esp + 2]
jmp 0x10106389
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_RtlUnwind]
mov edx, 0xef28940b
mov dx, 0x2087
bswap edx
jmp 0x1010635b
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_RtlUnwind]
lea edi, [eax + edx]
mov edi, edx
jmp 0x101063ae
lea edi, [ebp - 0x34]
pushal
mov edi, edx
call 0x101063ba
pushfd
shr edi, 0x18
jmp 0x101063c3
add byte [ecx + eax*8 + 0x4eb18ef], bl
out dx, eax
mul cl
and byte [ebx - 0x7699e414], al
add al, 0x24
sub esp, 0x1b
mov word [esp], ax
call fcn.1010643b
jge 0x101063b8
ja 0x101063e5
loope 0x10106431
lcall 0x3e89, 0x7e17e4f5
mov dword [esi], edi
lea edi, [eax - 0x12]
mov di, bp
bswap edi
jmp 0x10106300
pop ss
invalid
sub byte [edi - 0x432aba3b], ch
dec edi
invalid
Function at 0x1010643b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_RtlUnwind]
jmp 0x1010640f
and edi, ecx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_RtlUnwind]
and ebx, ecx
jmp 0x101063e9
movzx ebx, byte [esi + 0xa]
stc
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_RtlUnwind]
pushal
jmp 0x10106422
mov word [esp + 0xb], bx
push dword [esp + 0xe]
jmp 0x1010645e
lea esp, [esp + 3]
mov edi, dword [edi*4 + reloc.KERNEL32.dll_RtlUnwind]
jmp 0x10106402
and ebx, ecx
call 0x10106448
movzx ebx, byte [ecx]
pop ecx
jmp 0x10106667
add edi, 0x99e621be
dec di
mov edi, edx
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x101064a2
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
dec di
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_RtlUnwind]
jmp 0x101064b8
xor edi, dword [edx*4 + reloc.KERNEL32.dll_RtlUnwind]
not edx
rcl dl, cl
bswap edx
jmp 0x101064eb
and edx, ecx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_RtlUnwind]
and edx, ecx
jmp 0x1010662b

Function at 0x1010656e
Capabilities:
Encrypt data using aes

Disassembly:
push dx
lea esp, [esp + 2]
jmp 0x101065dd
rcl dx, cl
shr bx, 2
jmp 0x101060a1
bswap edx
jmp 0x101060dd
push edi
jmp 0x101060f3
movzx ebx, byte [esi + 0x11]
mov dx, 0xbf5a
bswap edx
setl dl
lea edx, [eax*4]
jmp 0x101060c7
mov edi, ebx
lea edi, [edi*4]
lea edi, reloc.KERNEL32.dll_RtlUnwind
mov ebx, dword [edi]
jmp 0x1010613a
not edi
jmp 0x1010615a
pop edi
not edx
add esi, 0x10
mov edx, dword [esi]
jmp 0x10106124
mov edi, edx
call fcn.10106144
jmp 0x101065af
dec dword [ebp - 4]
jmp 0x10106599
mov dword [esi + 0xc], edi
jmp 0x101065f3
sub esp, 0x14
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_RtlUnwind]
jmp 0x10106570
jne 0x100c6ca3
je 0x100c6c61

Function at 0x101c577e
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.101b8106
mov eax, dword [eax]
jmp 0x101c566e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x101c55de
mov eax, dword [eax + 8]
push eax
jmp 0x101b8101
pushal
pop word [esp + 0x16]
pushal
lea esp, [esp + 0x5e]
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x101c55f4
mov word [esp], bp
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 8], esi
pushal
jmp 0x101c56a2
Function at 0x730f40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1bc000]
mov dword [edi + 0x23fe90], 0x3a2b1208
push edi
or ebp, 0xffffffff
jmp 0x730f6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x730f71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x730f60
mov eax, 1
add ebx, ebx
jne 0x730f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x730f94
jne 0x730fb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x730fb3
dec eax
add ebx, ebx
jne 0x730fa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x730f78
add ebx, ebx
jne 0x730faf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x731005
xor ecx, ecx
sub eax, 3
jb 0x730fcb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x73103a
sar eax, 1
mov ebp, eax
jmp 0x730fd6
add ebx, ebx
jne 0x730fd6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x730fa4
inc ecx
add ebx, ebx
jne 0x730fe4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x730fa4
add ebx, ebx
jne 0x730ff1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x730fe6
jne 0x731002
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x730fe6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x731024
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x731016
jmp 0x730f66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x731024
add edi, ecx
jmp 0x730f66
pop esi
mov edi, esi
mov ecx, 0xe017
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x731042
cmp byte [edi], 0x28
jne 0x731042
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x731047
lea edi, [esi + 0x31f000]
mov eax, dword [edi]
or eax, eax
je 0x7310bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x34dfc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x34e1cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x731074
mov ecx, edi
jns 0x7310a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x34e1d4]
or eax, eax
je 0x7310b9
mov dword [ebx], eax
add ebx, 4
jmp 0x731091
call dword [esi + 0x34e1d0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7310f0
cmp al, 0xef
ja 0x7310e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7310c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x7310d2
mov ebp, dword [esi + 0x34e1d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x731124
sub esp, 0xffffff80
jmp 0x4a423c