joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003aee
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x1006b170
push ebp
mov ebp, dword [esp + 0x10]
push ebp
push dword [esp + 0x10]
push dword [esp + 0x10]
call sym.libcrypto_1_1.dll_AES_set_encrypt_key
add esp, 0xc
test eax, eax
js 0x1006b379
mov eax, dword [ebp + 0xf0]
push ebx
push esi
push edi
lea edi, [eax*4]
xor ebx, ebx
test edi, edi
jle 0x1006b1f6
lea esi, [ebp + 8]
lea esi, [esi + edi*4]
lea eax, [ebp + 8]
nop dword [eax]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x1006b1b0
mov eax, dword [ebp + 0xf0]
mov edi, 1
cmp eax, edi
jle 0x1006b374
lea esi, [ebp + 4]
movzx eax, byte [esi + 0xd]
lea esi, [esi + 0x10]
mov edx, dword [esi - 4]
inc edi
movzx ecx, byte [eax*4 + 0x101ccd30]
mov eax, edx
shr eax, 0x18
mov ecx, dword [ecx*4 + 0x101ce130]
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101cd930]
movzx eax, byte [esi - 2]
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101cdd30]
movzx eax, dl
mov edx, dword [esi]
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101ce530]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi - 4], ecx
movzx ecx, byte [eax*4 + 0x101ccd30]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x101cdd30]
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101ce130]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101cd930]
movzx eax, dl
mov edx, dword [esi + 4]
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101ce530]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi], ecx
movzx ecx, byte [eax*4 + 0x101ccd30]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x101cdd30]
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101ce130]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101cd930]
movzx eax, dl
mov edx, dword [esi + 8]
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101ce530]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi + 4], ecx
movzx ecx, byte [eax*4 + 0x101ccd30]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x101cdd30]
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101ce130]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101cd930]
movzx eax, dl
movzx eax, byte [eax*4 + 0x101ccd30]
xor ecx, dword [eax*4 + 0x101ce530]
mov dword [esi + 8], ecx
cmp edi, dword [ebp + 0xf0]
jl 0x1006b206
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10003bbb
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
jmp 0x1008a090
mov eax, 8
call fcn.10001f96
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push 0x1048
push 0x101d4fa8
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [esp + 0x30]
mov edi, 0x48
add esp, 0xc
mov eax, ebx
cmp dword [esp + 0x20], edi
cmovle edi, dword [esp + 0x20]
add edi, ebx
xor ebp, ebp
nop dword [eax]
movzx edx, byte [eax]
inc eax
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
xor dword [esi + ebp*4], edx
inc ebp
cmp ebp, 0x12
jl 0x1008a0d0
mov dword [esp + 0x10], 0
xor edi, edi
mov dword [esp + 0x14], 0
nop
lea eax, [esp + 0x10]
push esi
push eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [esi + edi*4], eax
mov eax, dword [esp + 0x14]
mov dword [esi + edi*4 + 4], eax
add edi, 2
cmp edi, 0x12
jl 0x1008a120
xor edi, edi
lea eax, [esp + 0x10]
push esi
push eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [esi + edi*4 + 0x48], eax
mov eax, dword [esp + 0x14]
mov dword [esi + edi*4 + 0x4c], eax
add edi, 2
cmp edi, 0x400
jl 0x1008a147
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10003c6a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10139d50
mov eax, 0x34
call fcn.10001f96
mov eax, dword [0x1025e3d4]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x54]
lea ebp, [esi + 0x10]
mov dl, byte [esi]
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x2c]
mov byte [esp + 0xf], dl
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
push edi
test dl, 0x40
jne 0x10139db1
push eax
push ebp
push esi
call ecx
mov dl, byte [esp + 0x1f]
add esp, 0xc
movzx eax, dl
xor ecx, ecx
and eax, 7
mov edx, 0xf
sub edx, eax
mov byte [esi], al
mov dword [esp + 0x2c], edx
mov edi, ebp
cmp edx, 0xf
jae 0x10139de3
nop dword [eax]
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x10139dd0
movzx eax, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x10139e07
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100032f1
add esp, 0x34
ret
mov ebp, ebx
shr ebp, 4
test ebp, ebp
je 0x10139e48
push edi
push esi
push dword [esp + 0x24]
push ebp
push dword [esp + 0x24]
push dword [esp + 0x2c]
call dword [esp + 0x3c]
shl ebp, 4
add esp, 0x18
add dword [esp + 0x18], ebp
add dword [esp + 0x14], ebp
sub ebx, ebp
je 0x10139ead
shr ebp, 4
push ebp
push esi
call fcn.1013a8c0
mov ebp, dword [esp + 0x20]
add esp, 8
jmp 0x10139e5a
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, ebx
test eax, eax
je 0x10139ead
push dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
push esi
call dword [esp + 0x2c]
add esp, 0xc
test ebx, ebx
je 0x10139e98
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x30]
mov eax, ecx
sub ebp, eax
sub edx, eax
nop dword [eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edi, [edi + 1]
mov byte [edx + ecx - 1], al
xor byte [edi - 1], al
sub ebx, 1
jne 0x10139e80
mov ebx, dword [esp + 0x1c]
lea eax, [esi + 0x10]
mov ebp, dword [esp + 0x20]
push ebx
push eax
push eax
call ebp
add esp, 0xc
jmp 0x10139eb5
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x10
jae 0x10139ed4
mov eax, 0x10
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
lea eax, [esp + 0x34]
push eax
push esi
call ebp
mov eax, dword [esp + 0x3c]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [esp + 0x34]
xor dword [esi + 0x14], eax
mov eax, dword [esp + 0x38]
xor dword [esi + 0x18], eax
mov eax, dword [esp + 0x3c]
xor dword [esi + 0x1c], eax
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x40]
pop edi
mov byte [esi], al
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100032f1
add esp, 0x34
ret
Function at 0x10003cab
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100a7360
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ecx, dword [edx + 4]
mov ebp, edx
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
cmovge ebp, edi
cmovge edi, edx
push dword [edi + 4]
push ebx
call fcn.100057c2
add esp, 8
test eax, eax
jne 0x100a7391
pop edi
pop ebp
pop ebx
ret
xor eax, eax
cmp dword [ebp + 4], eax
jle 0x100a73b7
push esi
nop dword [eax]
mov ecx, dword [ebp]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
mov ecx, dword [ebx]
xor esi, dword [edx + eax*4]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, dword [ebp + 4]
jl 0x100a73a0
pop esi
mov ecx, dword [edi + 4]
cmp eax, ecx
jge 0x100a73d2
nop
mov ecx, dword [edi]
mov edx, dword [ebx]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
mov ecx, dword [edi + 4]
cmp eax, ecx
jl 0x100a73c0
push ebx
mov dword [ebx + 4], ecx
call fcn.100037a1
add esp, 4
mov eax, 1
pop edi
pop ebp
pop ebx
ret

Function at 0x10003efe
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x101745e0
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov eax, 1
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
pop esi
ret
Function at 0x100040fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1013f2d0
mov eax, 0x10
call fcn.10001f96
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x2c]
mov esi, dword [esi]
test esi, esi
je 0x1013f30d
mov ecx, dword [esp + 0x34]
test edi, edi
je 0x1013f30d
mov al, byte [esi + ecx]
dec edi
xor al, byte [ebp]
inc esi
mov byte [ebx], al
inc ebp
inc ebx
and esi, 0xf
jne 0x1013f2f8
mov edx, dword [esp + 0x3c]
cmp edi, 0x10
jb 0x1013f3a5
mov ecx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x10], eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, edi
shr eax, 4
mov dword [esp + 0x2c], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x14]
jmp 0x1013f354
mov ecx, dword [esp + 0x34]
push dword [esp + 0x30]
push ecx
push ecx
call edx
add esp, 0xc
cmp esi, 0x10
jae 0x1013f387
mov eax, dword [esp + 0x34]
mov edx, 0xf
sub edx, esi
add eax, esi
shr edx, 2
inc edx
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x1013f375
mov edx, dword [esp + 0x3c]
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x2c], 1
jne 0x1013f350
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
test edi, edi
je 0x1013f3d7
push dword [esp + 0x30]
mov eax, dword [esp + 0x38]
push eax
push eax
call edx
mov eax, dword [esp + 0x40]
add esp, 0xc
sub ebp, eax
sub ebx, eax
lea ecx, [esi + eax]
add esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x1013f3c5
mov eax, dword [esp + 0x38]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100041f1
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100a9d40
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
cmp ebp, ebx
je 0x100a9e6b
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + 4]
lea edx, [eax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
xor eax, ecx
dec edx
and eax, edx
mov dword [esp + 0x14], edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
mov ecx, dword [esp + 0x18]
test ecx, ecx
jle 0x100a9e6b
push esi
push edi
cmp ecx, 4
jb 0x100a9e45
mov edx, dword [ebp]
lea edi, [ecx - 1]
mov esi, dword [ebx]
lea ebp, [ecx - 1]
lea ebp, [edx + ebp*4]
cmp esi, ebp
lea edi, [esi + edi*4]
mov ebp, dword [esp + 0x18]
ja 0x100a9de0
cmp edi, edx
jae 0x100a9e45
cmp esi, ebx
ja 0x100a9de8
cmp edi, ebx
jae 0x100a9e45
cmp esi, ebp
ja 0x100a9df0
cmp edi, ebp
jae 0x100a9e45
lea edi, [ecx - 1]
lea edi, [edx + edi*4]
cmp edx, ebx
ja 0x100a9dfe
cmp edi, ebx
jae 0x100a9e45
cmp edx, ebp
ja 0x100a9e06
cmp edi, ebp
jae 0x100a9e45
mov edi, ecx
and edi, 0xfffffffc
nop dword [eax + eax]
movups xmm3, xmmword [esi + eax*4]
movups xmm2, xmmword [edx + eax*4]
movaps xmm1, xmm3
pxor xmm1, xmm2
pand xmm1, xmm4
movaps xmm0, xmm1
pxor xmm1, xmm3
pxor xmm0, xmm2
movups xmmword [edx + eax*4], xmm0
movups xmmword [esi + eax*4], xmm1
add eax, 4
cmp eax, edi
jl 0x100a9e10
mov dword [esp + 0x18], eax
cmp eax, ecx
jge 0x100a9e69
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x1c]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x20]
jl 0x100a9e45
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1000429b
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x101457f0
add dword [esp + 4], 0xc
jmp sym.libcrypto_1_1.dll_X509V3_add1_i2d

Function at 0x100042aa
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x100a8c20
mov eax, 4
call fcn.10001f96
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push ebp
xor edi, edi
call sym.libcrypto_1_1.dll_BN_CTX_start
push ebp
call sym.libcrypto_1_1.dll_BN_CTX_get
mov esi, eax
add esp, 8
test esi, esi
je 0x100a8e0f
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + 4]
add eax, eax
push eax
push esi
call fcn.100057c2
add esp, 8
test eax, eax
je 0x100a8e0e
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x100a8de8
mov ebp, ecx
mov eax, dword [ebx]
mov edx, dword [eax + ebp*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + ebp*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + ebp*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + ebp*8], edx
sub ebp, 1
jns 0x100a8c78
mov eax, dword [ebx + 4]
mov ebp, dword [esp + 0x24]
add eax, eax
push esi
mov dword [esi + 4], eax
call fcn.100037a1
push dword [esp + 0x24]
push esi
push dword [esp + 0x24]
call sym.libcrypto_1_1.dll_BN_GF2m_mod_arr
add esp, 0x10
mov ecx, 1
test eax, eax
cmovne edi, ecx
pop ebx
push ebp
call sym.libcrypto_1_1.dll_BN_CTX_end
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x10004507
Capabilities:
Query environment variable

Disassembly:
jmp 0x100c75a0
mov eax, 8
call fcn.10001f96
cmp dword [0x1025e828], 0
jne 0x100c76e9
push ebx
push ebp
push esi
push edi
push 0x30
push 0x1025e7c8
push str.OPENSSL_ia32cap
mov dword [0x1025e828], 1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x100c76c2
movzx esi, word [0x1025e7c8]
xor eax, eax
cmp esi, 0x7e
mov ebp, 2
cmove eax, ebp
add eax, 0x1025e7c8
push eax
call fcn.100c7e10
add esp, 4
mov edi, eax
mov ebx, edx
cmp esi, 0x7e
jne 0x100c7636
push 0x102629b0
mov esi, edi
call fcn.10065680
not edi
not ebx
and esi, 0x1000000
add esp, 4
and edi, eax
and ebx, edx
or esi, 0
je 0x100c7651
and ebx, 0xedfff7fd
jmp 0x100c7651
cmp word [0x1025e7c8], 0x3a
jne 0x100c7651
push 0x102629b0
call fcn.10065680
add esp, 4
mov edi, eax
mov ebx, edx
movzx eax, word [0x1025e7c8]
mov ecx, 0x1025e7c8
test ax, ax
je 0x100c7672
add ecx, ebp
cmp ax, 0x3a
je 0x100c7688
movzx eax, word [ecx]
test ax, ax
jne 0x100c7662
mov dword [0x102629b8], 0
mov dword [0x102629bc], 0
jmp 0x100c76d3
movzx esi, word [ecx]
xor eax, eax
cmp esi, 0x7e
cmove eax, ebp
add eax, ecx
push eax
call fcn.100c7e10
add esp, 4
cmp esi, 0x7e
jne 0x100c76b5
not eax
not edx
and dword [0x102629b8], eax
and dword [0x102629bc], edx
jmp 0x100c76d3
mov dword [0x102629b8], eax
mov dword [0x102629bc], edx
jmp 0x100c76d3
push 0x102629b0
call fcn.10065680
add esp, 4
mov edi, eax
mov ebx, edx
or edi, 0x400
mov dword [0x102629b4], ebx
mov dword [0x102629b0], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x100047a0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x101379c0
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x10137a19
mov al, byte [edi]
test al, al
je 0x10137a19
push ebx
mov ebx, 0x100
nop dword [eax + eax]
movsx eax, al
push eax
call fcn.100016e5
or eax, ebx
lea edi, [edi + 1]
mov ecx, eax
add esp, 4
shr ecx, 2
add ebx, 0x100
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol esi, cl
xor esi, eax
mov al, byte [edi]
test al, al
jne 0x101379e0
mov eax, esi
pop ebx
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x100048bd
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x10162e30
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x14]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
ret
Function at 0x10004a43
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1008dc10
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x1008dc50
push 0xc3
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
ret
Function at 0x10004bc4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1013b6b0
mov eax, 0x34
call fcn.10001f96
mov eax, dword [0x1025e3d4]
xor eax, esp
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
push ebp
mov ebp, dword [esp + 0x4c]
push esi
mov esi, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x44]
cmp ecx, 0x10
ja 0x1013b704
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100032f1
add esp, 0x34
ret
push ebx
mov ebx, ecx
mov eax, 0x10
and ebx, 0xf
cmove ebx, eax
mov eax, 0xfffffff0
sub eax, ebx
add ecx, eax
mov dword [esp + 0x18], ecx
je 0x1013b73e
push dword [esp + 0x10]
push ebp
push edx
push ecx
push esi
push edi
call sym.libcrypto_1_1.dll_CRYPTO_cbc128_decrypt
add edi, dword [esp + 0x30]
add esp, 0x18
add esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x34]
push eax
push edi
call dword [esp + 0x1c]
movups xmm0, xmmword [esp + 0x3c]
push ebx
lea eax, [edi + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
movups xmmword [esp + 0x38], xmm0
call sub.VCRUNTIME140.dll_memcpy
push dword [esp + 0x2c]
lea eax, [esp + 0x3c]
push eax
push eax
call dword [esp + 0x34]
lea ecx, [esp + 0x53]
add esp, 0x24
xor eax, eax
lea edx, [ebp + 0xf]
cmp ebp, ecx
ja 0x1013b788
lea ecx, [esp + 0x20]
cmp edx, ecx
jae 0x1013b7c0
lea ecx, [esi + 0xf]
cmp ebp, ecx
ja 0x1013b793
cmp edx, esi
jae 0x1013b7c0
lea ecx, [edi + 0xf]
cmp ebp, ecx
lea ecx, [esi + 0xf]
ja 0x1013b7a1
cmp edx, edi
jae 0x1013b7c0
lea edx, [esp + 0x2f]
cmp esi, edx
ja 0x1013b7b1
lea edx, [esp + 0x20]
cmp ecx, edx
jae 0x1013b7c0
lea edx, [edi + 0xf]
cmp esi, edx
ja 0x1013b7d8
cmp ecx, edi
jb 0x1013b7d8
nop dword [eax]
mov cl, byte [esp + eax + 0x20]
xor cl, byte [eax + ebp]
mov dl, byte [edi + eax]
mov byte [esi + eax], cl
mov byte [eax + ebp], dl
inc eax
cmp eax, 0x10
jb 0x1013b7c0
jmp 0x1013b7f4
movups xmm1, xmmword [ebp]
mov eax, 0x10
movups xmm0, xmmword [esp + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [edi]
movups xmmword [esi], xmm1
movups xmmword [ebp], xmm0
add ebx, 0x10
cmp eax, ebx
jae 0x1013b816
lea ecx, [esp + 0x20]
sub edi, ecx
sub esi, ecx
lea edx, [esp + 0x20]
add edx, eax
inc eax
mov cl, byte [edi + edx]
xor cl, byte [edx]
mov byte [esi + edx], cl
cmp eax, ebx
jb 0x1013b803
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x1c]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
add eax, 0x10
call fcn.100032f1
add esp, 0x34
ret
Function at 0x10004d0e
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x10174f00
mov eax, 0xdc
call fcn.10001f96
mov eax, dword [0x1025e3d4]
xor eax, esp
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0xe8]
xorps xmm0, xmm0
mov ecx, dword [esp + 0xe0]
test eax, eax
push esi
push dword [esp + 0xe8]
mov esi, 0x102618a8
mov dword [esp + 8], 0xf3bcc908
cmovne esi, eax
mov dword [esp + 0xc], 0x6a09e667
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x84caa73b
push eax
mov dword [esp + 0x1c], 0xbb67ae85
mov dword [esp + 0x20], 0xfe94f82b
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0x5f1d36f1
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0xade682d1
mov dword [esp + 0x34], 0x510e527f
mov dword [esp + 0x38], 0x2b3e6c1f
mov dword [esp + 0x3c], 0x9b05688c
mov dword [esp + 0x40], 0xfb41bd6b
mov dword [esp + 0x44], 0x1f83d9ab
mov dword [esp + 0x48], 0x137e2179
mov dword [esp + 0x4c], 0x5be0cd19
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0x40
call sym.libcrypto_1_1.dll_SHA512_Update
lea eax, [esp + 0x10]
push eax
push esi
call sym.libcrypto_1_1.dll_SHA512_Final
lea eax, [esp + 0x18]
push 0xd8
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xf8]
add esp, 0x1c
mov eax, esi
pop esi
xor ecx, esp
call fcn.100032f1
add esp, 0xdc
ret
Function at 0x1000507e
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x10174c90
mov eax, 0xdc
call fcn.10001f96
mov eax, dword [0x1025e3d4]
xor eax, esp
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0xe8]
xorps xmm0, xmm0
mov ecx, dword [esp + 0xe0]
test eax, eax
push esi
push dword [esp + 0xe8]
mov esi, 0x10261878
mov dword [esp + 8], 0xc1059ed8
cmovne esi, eax
mov dword [esp + 0xc], 0xcbbb9d5d
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x367cd507
push eax
mov dword [esp + 0x1c], 0x629a292a
mov dword [esp + 0x20], 0x3070dd17
mov dword [esp + 0x24], 0x9159015a
mov dword [esp + 0x28], 0xf70e5939
mov dword [esp + 0x2c], 0x152fecd8
mov dword [esp + 0x30], 0xffc00b31
mov dword [esp + 0x34], 0x67332667
mov dword [esp + 0x38], 0x68581511
mov dword [esp + 0x3c], 0x8eb44a87
mov dword [esp + 0x40], 0x64f98fa7
mov dword [esp + 0x44], 0xdb0c2e0d
mov dword [esp + 0x48], 0xbefa4fa4
mov dword [esp + 0x4c], 0x47b5481d
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0x30
call sym.libcrypto_1_1.dll_SHA512_Update
lea eax, [esp + 0x10]
push eax
push esi
call sym.libcrypto_1_1.dll_SHA512_Final
lea eax, [esp + 0x18]
push 0xd8
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xf8]
add esp, 0x1c
mov eax, esi
pop esi
xor ecx, esp
call fcn.100032f1
add esp, 0xdc
ret