joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100066b0
Capabilities:
Resolve dns

Disassembly:
jmp 0x10045540
mov eax, 0x20
call fcn.100011c0
push esi
mov esi, dword [esp + 0x34]
mov eax, esi
sub eax, 0
je 0x10045585
sub eax, 2
je 0x10045585
sub eax, 0x15
je 0x10045585
push 0x297
push str.crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop esi
add esp, 0x20
ret
call sym.libcrypto_1_1.dll_BIO_sock_init
cmp eax, 1
jne 0x1004557e
mov eax, dword [esp + 0x38]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x2c]
xorps xmm0, xmm0
push ebp
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
test ebx, ebx
je 0x100455cf
test esi, esi
jne 0x100455cf
or ecx, 0x400
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x3c], 1
jne 0x100455dd
or ecx, 1
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x48]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x40]
push ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x1004562f
cmp esi, 8
je 0x10045674
mov ecx, dword [esp + 0x10]
test ecx, 0x400
je 0x1004563c
push ebp
lea eax, [esp + 0x14]
and ecx, 0xfffffbff
push eax
push dword [esp + 0x40]
or ecx, 4
mov edi, esi
push ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x100455f8
mov eax, 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
push 0x2da
push str.crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
test edi, edi
cmovne esi, edi
push esi
call fcn.100053f0
push eax
push 1
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
push 0x2cb
push str.crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
Function at 0x10006a40
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100f8370
mov eax, 8
call fcn.100011c0
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x100f8391
mov eax, 0xfffffffe
pop ebp
add esp, 8
ret
push esi
mov esi, dword [esp + 0x1c]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x100f845b
jb 0x100f83b6
test eax, eax
jne 0x100f845b
push ebx
mov ebx, dword [esp + 0x1c]
push edi
mov edi, dword [ebp + 0x16c]
mov dword [ebp + 0x34], ecx
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x30], eax
test edi, edi
je 0x100f8405
nop
test esi, esi
je 0x100f83ea
mov al, byte [ebx]
lea ecx, [ebp + 0x40]
xor byte [ecx + edi], al
inc ebx
inc edi
mov dword [esp + 0x10], ecx
dec esi
and edi, 0xf
jne 0x100f83d0
jmp 0x100f83f2
mov dword [esp + 0x10], ecx
test edi, edi
jne 0x100f844b
lea eax, [ebp + 0x60]
push eax
push ecx
call fcn.100fa310
mov ecx, dword [esp + 0x18]
add esp, 8
jmp 0x100f8409
mov dword [esp + 0x10], ecx
mov eax, esi
lea edx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x100f842e
push eax
push ebx
push edx
push ecx
lfence
call fcn.100fa050
add ebx, dword [esp + 0x24]
add esp, 0x10
sub esi, dword [esp + 0x14]
test esi, esi
je 0x100f844b
xor ecx, ecx
mov edi, esi
test esi, esi
je 0x100f844b
mov edx, dword [esp + 0x10]
nop
mov al, byte [ecx + ebx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, esi
jb 0x100f8440
mov dword [ebp + 0x16c], edi
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
pop esi
or eax, 0xffffffff
pop ebp
add esp, 8
ret
Function at 0x10006ea0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x10048930
mov eax, 4
call fcn.100011c0
cmp dword [esp + 0xc], 0
je 0x10048952
push 0x16b
push str.crypto_bio_b_sock.c
push 0x8c
jmp 0x100489cc
lea eax, [esp]
mov dword [esp], 0x1c
push eax
mov eax, dword [esp + 0x14]
push dword [eax]
call fcn.10012f80
add esp, 4
push eax
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x100489b7
push 0x160
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x10
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x161
push str.crypto_bio_b_sock.c
push 0x84
push 0x8d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
xor eax, eax
pop ecx
ret
cmp dword [esp], 0x1c
jbe 0x100489df
push 0x165
push str.crypto_bio_b_sock.c
push 0x85
push 0x8d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x10006ff0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100f5f30
mov eax, 0x34
call fcn.100011c0
mov eax, dword [0x102293a4]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x54]
lea ecx, [esi + 0x10]
mov bl, byte [esi]
mov ebp, dword [esi + 0x28]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x20], esi
mov byte [esp + 0xf], bl
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], eax
test bl, 0x40
jne 0x100f5f94
push eax
push ecx
push esi
mov ecx, ebp
call dword [section..00cfg]
call ebp
add esp, 0xc
movzx eax, bl
mov edx, 0xf
and eax, 7
xor ecx, ecx
sub edx, eax
mov byte [esi], al
mov dword [esp + 0x28], edx
cmp edx, 0xf
jae 0x100f5fc3
nop
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x100f5fb0
movzx eax, byte [esi + 0xf]
mov ebx, dword [esp + 0x50]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x100f5fea
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1000b910
add esp, 0x34
ret
push edi
mov edi, ebx
shr edi, 4
test edi, edi
je 0x100f6037
mov ecx, dword [esp + 0x20]
lea eax, [esi + 0x10]
push eax
push esi
push dword [esp + 0x20]
push edi
push dword [esp + 0x2c]
push dword [esp + 0x28]
call dword [section..00cfg]
call dword [esp + 0x38]
shl edi, 4
add esp, 0x18
add dword [esp + 0x14], edi
add dword [esp + 0x1c], edi
sub ebx, edi
je 0x100f60a9
shr edi, 4
push edi
push esi
call fcn.100f6a60
add esp, 8
test ebx, ebx
je 0x100f60a9
push dword [esp + 0x18]
lea eax, [esp + 0x34]
mov ecx, ebp
push eax
push esi
call dword [section..00cfg]
call ebp
add esp, 0xc
xor edx, edx
test ebx, ebx
je 0x100f6090
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x30]
sub dword [esp + 0x14], eax
sub edi, eax
lea eax, [esi + 0x10]
mov esi, dword [esp + 0x14]
mov ebp, eax
nop
lea eax, [esp + 0x30]
add eax, edx
mov cl, byte [esi + eax]
xor cl, byte [eax]
mov byte [edi + eax], cl
lea eax, [edx + ebp]
xor byte [eax], cl
inc edx
cmp edx, ebx
jb 0x100f6070
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
lea eax, [esi + 0x10]
push ebx
push eax
push eax
mov ecx, ebp
call dword [section..00cfg]
call ebp
add esp, 0xc
jmp 0x100f60ad
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
cmp edx, 0x10
jae 0x100f60d0
mov ecx, 0x10
lea edi, [edx + esi]
sub ecx, edx
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x34]
mov ecx, ebp
push eax
push esi
call dword [section..00cfg]
call ebp
mov eax, dword [esp + 0x3c]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [esp + 0x34]
xor dword [esi + 0x14], eax
mov eax, dword [esp + 0x38]
xor dword [esi + 0x18], eax
mov eax, dword [esp + 0x3c]
xor dword [esi + 0x1c], eax
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x40]
pop edi
mov byte [esi], al
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000b910
add esp, 0x34
ret
Function at 0x10007a90
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x101372c0
mov eax, 0xdc
call fcn.100011c0
mov eax, dword [0x102293a4]
xor eax, esp
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0xe8]
xorps xmm0, xmm0
mov ecx, dword [esp + 0xe0]
test eax, eax
push esi
push dword [esp + 0xe8]
mov esi, 0x1022c720
mov dword [esp + 8], 0xc1059ed8
cmovne esi, eax
mov dword [esp + 0xc], 0xcbbb9d5d
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x367cd507
push eax
mov dword [esp + 0x1c], 0x629a292a
mov dword [esp + 0x20], 0x3070dd17
mov dword [esp + 0x24], 0x9159015a
mov dword [esp + 0x28], 0xf70e5939
mov dword [esp + 0x2c], 0x152fecd8
mov dword [esp + 0x30], 0xffc00b31
mov dword [esp + 0x34], 0x67332667
mov dword [esp + 0x38], 0x68581511
mov dword [esp + 0x3c], 0x8eb44a87
mov dword [esp + 0x40], 0x64f98fa7
mov dword [esp + 0x44], 0xdb0c2e0d
mov dword [esp + 0x48], 0xbefa4fa4
mov dword [esp + 0x4c], 0x47b5481d
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0x30
call sym.libcrypto_1_1.dll_SHA512_Update
lea eax, [esp + 0x10]
push eax
push esi
call sym.libcrypto_1_1.dll_SHA512_Final
lea eax, [esp + 0x18]
push 0xd8
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xf8]
add esp, 0x1c
mov eax, esi
pop esi
xor ecx, esp
call fcn.1000b910
add esp, 0xdc
ret
Function at 0x10008e00
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x10135c10
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
ret
Function at 0x10008fb0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100f9d80
mov eax, 0x14
call fcn.100011c0
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
mov edi, dword [esp + 0x24]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x168], 0
cmp ebx, 0xc
jne 0x100f9ded
mov eax, dword [esp + 0x28]
mov ebx, 1
movq xmm0, qword [eax]
movq qword [edi], xmm0
mov eax, dword [eax + 8]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x1000000
jmp 0x100f9f28
mov dword [edi + 0x40], 0
lea esi, [edi + 0x40]
mov dword [esi + 4], 0
lea edx, [edi + 0x60]
mov dword [edi + 0x48], 0
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x4c], 0
mov dword [esp + 0x14], edx
push ebp
mov ebp, dword [esp + 0x2c]
cmp ebx, 0x10
jb 0x100f9e8f
mov eax, ebx
lea ecx, [edi + 0x41]
shr eax, 4
mov edi, esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
mov eax, ecx
lea edx, [ebp + 1]
mov esi, 4
nop dword [eax]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub esi, 1
jne 0x100f9e40
push dword [esp + 0x18]
push edi
call fcn.100fa310
mov ecx, dword [esp + 0x24]
add esp, 8
add ebp, 0x10
sub ebx, 0x10
sub dword [esp + 0x10], 1
jne 0x100f9e33
mov edi, dword [esp + 0x28]
lea esi, [edi + 0x40]
lea edx, [edi + 0x60]
test ebx, ebx
je 0x100f9eb5
xor ecx, ecx
test ebx, ebx
je 0x100f9eab
nop dword [eax]
mov al, byte [ecx + ebp]
xor byte [esi + ecx], al
inc ecx
cmp ecx, ebx
jb 0x100f9ea0
push edx
push esi
call fcn.100fa310
add esp, 8
mov edx, dword [esp + 0x20]
xor ebx, ebx
shld ebx, edx, 3
xor byte [edi + 0x4b], bl
mov eax, ebx
shl edx, 3
xor byte [edi + 0x4f], dl
mov ecx, edx
shrd ecx, eax, 0x18
xor byte [edi + 0x4c], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
xor byte [edi + 0x4d], cl
shrd eax, ebx, 8
xor byte [edi + 0x4e], al
lea eax, [edi + 0x60]
push eax
push esi
call fcn.100fa310
movzx ebx, byte [edi + 0x4c]
add esp, 8
movzx eax, byte [edi + 0x4d]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 0x4f]
shl ebx, 8
or ebx, eax
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [edi + 0x48]
mov dword [edi + 8], eax
mov eax, dword [edi + 0x4c]
mov dword [edi + 0xc], eax
pop ebp
mov dword [edi + 0x40], 0
lea eax, [edi + 0x20]
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
push dword [edi + 0x174]
mov esi, dword [edi + 0x170]
mov ecx, esi
push eax
push edi
call dword [section..00cfg]
call esi
inc ebx
add esp, 0xc
mov eax, ebx
mov byte [edi + 0xf], bl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [edi + 0xe], al
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x100099d0
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x10137530
mov eax, 0xdc
call fcn.100011c0
mov eax, dword [0x102293a4]
xor eax, esp
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0xe8]
xorps xmm0, xmm0
mov ecx, dword [esp + 0xe0]
test eax, eax
push esi
push dword [esp + 0xe8]
mov esi, 0x1022c750
mov dword [esp + 8], 0xf3bcc908
cmovne esi, eax
mov dword [esp + 0xc], 0x6a09e667
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x84caa73b
push eax
mov dword [esp + 0x1c], 0xbb67ae85
mov dword [esp + 0x20], 0xfe94f82b
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0x5f1d36f1
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0xade682d1
mov dword [esp + 0x34], 0x510e527f
mov dword [esp + 0x38], 0x2b3e6c1f
mov dword [esp + 0x3c], 0x9b05688c
mov dword [esp + 0x40], 0xfb41bd6b
mov dword [esp + 0x44], 0x1f83d9ab
mov dword [esp + 0x48], 0x137e2179
mov dword [esp + 0x4c], 0x5be0cd19
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0x40
call sym.libcrypto_1_1.dll_SHA512_Update
lea eax, [esp + 0x10]
push eax
push esi
call sym.libcrypto_1_1.dll_SHA512_Final
lea eax, [esp + 0x18]
push 0xd8
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xf8]
add esp, 0x1c
mov eax, esi
pop esi
xor ecx, esp
call fcn.1000b910
add esp, 0xdc
ret
Function at 0x10009c00
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x10135700
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov eax, 1
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
pop esi
ret
Function at 0x1000a270
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x101355f0
mov eax, 0x74
call fcn.100011c0
mov eax, dword [0x102293a4]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x80]
test eax, eax
push esi
mov esi, dword [esp + 0x7c]
push edi
mov edi, 0x1022c6d8
push 0x4c
cmovne edi, eax
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [esp + 0x90]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xc1059ed8
push esi
push eax
mov dword [esp + 0x24], 0x367cd507
mov dword [esp + 0x28], 0x3070dd17
mov dword [esp + 0x2c], 0xf70e5939
mov dword [esp + 0x30], 0xffc00b31
mov dword [esp + 0x34], 0x68581511
mov dword [esp + 0x38], 0x64f98fa7
mov dword [esp + 0x3c], 0xbefa4fa4
mov dword [esp + 0x8c], 0x1c
call sym.libcrypto_1_1.dll_SHA256_Update
lea eax, [esp + 0x20]
push eax
push edi
call sym.libcrypto_1_1.dll_SHA256_Final
lea eax, [esp + 0x28]
push 0x70
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xa0]
add esp, 0x28
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.1000b910
add esp, 0x74
ret
Function at 0x1000ae60
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x1012ed60
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x1012ee23
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x1012ed81
cmp al, 0x6b
jne 0x1012ee23
inc ecx
cmp al, 0x6b
jne 0x1012ede8
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x1012eda2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x1012eda2
cmp dl, 0xbb
jne 0x1012edc8
inc eax
cmp eax, esi
jl 0x1012ed90
sub esi, eax
test eax, eax
jne 0x1012edeb
push 0x50
push str.crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x48
push str.crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x1012ee11
push 0x59
push str.crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x3d
push str.crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x1000b210
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100f2ff0
mov eax, 4
call fcn.100011c0
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x100f3073
mov al, byte [ebx]
test al, al
je 0x100f3073
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.100105b0
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or esi, eax
mov al, byte [ebx]
xor esi, edi
mov dword [esp + 0x10], esi
test al, al
jne 0x100f3017
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x1000b550
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
jmp 0x1011f620
mov eax, 4
call fcn.100011c0
mov eax, dword [esp + 0x14]
mov ecx, 0x400
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, 0x80
mov byte [ebx], 0
mov edx, edi
mov ebp, ecx
cmp dword [esp + 0x1c], edx
cmovle edx, dword [esp + 0x1c]
test eax, eax
cmovg ebp, eax
cmp ebp, ecx
cmovg ebp, ecx
mov dword [esp + 0x10], ebp
test edx, edx
jle 0x1011f682
mov ebp, dword [esp + 0x20]
mov ecx, ebx
sub ebp, ebx
mov esi, edx
nop dword [eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub esi, 1
jne 0x1011f670
mov ebp, dword [esp + 0x10]
movzx esi, byte [edx + ebx - 1]
cmp edx, edi
jge 0x1011f6ac
mov ecx, ebx
nop dword [eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
add eax, esi
movzx eax, al
mov al, byte [eax + 0x101f0fc8]
mov byte [edx + ebx], al
inc edx
movzx esi, al
cmp edx, edi
jl 0x1011f690
mov ecx, dword [esp + 0x10]
add ebp, 7
sar ebp, 3
neg ecx
sub edi, ebp
and ecx, 7
movzx eax, byte [edi + ebx]
lea esi, [edi + ebx]
mov edx, 0xff
sar edx, cl
and edx, eax
mov al, byte [edx + 0x101f0fc8]
movzx ecx, al
mov byte [esi], al
test edi, edi
je 0x1011f6fa
nop dword [eax]
movzx eax, byte [esi + ebp - 1]
lea esi, [esi - 1]
xor eax, ecx
mov al, byte [eax + 0x101f0fc8]
movzx ecx, al
mov byte [esi], al
sub edi, 1
jne 0x1011f6e0
lea esi, [ebx + 0xfc]
mov edi, 0x40
lea edx, [ebx + 0x7e]
nop dword [eax + eax]
movzx ecx, byte [edx + 1]
lea esi, [esi - 4]
movzx eax, byte [edx]
lea edx, [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [esi + 4], ecx
sub edi, 1
jne 0x1011f710
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1000b8b0
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x10137fa0
mov eax, dword [esp + 4]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x1000c030
Capabilities:
Resolve dns

Disassembly:
jmp 0x100456f0
mov eax, 0x20
call fcn.100011c0
push esi
mov esi, dword [esp + 0x34]
mov eax, esi
sub eax, 0
je 0x10045735
sub eax, 2
je 0x10045735
sub eax, 0x15
je 0x10045735
push 0x297
push str.crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop esi
add esp, 0x20
ret
call sym.libcrypto_1_1.dll_BIO_sock_init
cmp eax, 1
jne 0x1004572e
mov eax, dword [esp + 0x38]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x2c]
xorps xmm0, xmm0
push ebp
push edi
xor edi, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], ecx
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x10045783
test esi, esi
jne 0x10045783
or ecx, 0x400
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x3c], 1
jne 0x10045791
or ecx, 1
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x40]
push ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x100457e5
nop dword [eax]
cmp esi, 8
je 0x1004582a
mov eax, dword [esp + 0x10]
test eax, 0x400
je 0x100457f2
and eax, 0xfffffbff
mov edi, esi
or eax, 4
push ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
push ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x100457b0
mov eax, 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
push 0x2da
push str.crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
test edi, edi
cmovne esi, edi
push esi
call fcn.100053f0
push eax
push 1
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
push 0x2cb
push str.crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
Function at 0x1000cbe0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
jmp 0x10048da0
mov eax, 4
call fcn.100011c0
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x10048ddc
push 0x52
push str.crypto_bio_b_sock2.c
push 0x87
push 0x8a
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call sym.libcrypto_1_1.dll_BIO_socket_nbio
add esp, 8
test eax, eax
je 0x10048e47
test bl, 4
je 0x10048e4d
push 4
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10048e4d
push 0x5c
push str.crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x5d
push str.crypto_bio_b_sock2.c
push 0x89
push 0x8a
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test bl, 0x10
je 0x10048e8d
push 4
lea eax, [esp + 0xc]
push eax
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10048e8d
push 0x65
push str.crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x66
push str.crypto_bio_b_sock2.c
push 0x8a
jmp 0x10048e38
push dword [esp + 0x14]
call fcn.10007d50
add esp, 4
push eax
push dword [esp + 0x18]
call fcn.1000bff0
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10048ee5
push eax
call sym.libcrypto_1_1.dll_BIO_sock_should_retry
add esp, 4
test eax, eax
jne 0x10048e47
push 0x6e
push str.crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x6f
push str.crypto_bio_b_sock2.c
push 0x67
jmp 0x10048e38
pop ebx
mov eax, 1
pop edi
pop ecx
ret