joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001f8b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1001c7f1
call fcn.1001c3b8
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1000219d
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x10001fdd
sub edx, ecx
sar edx, 1
inc edx
push ecx
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], edx
call fcn.10001357
test eax, eax
js 0x1000219d
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1000202e
mov ecx, esi
call fcn.10001387
test al, al
je 0x1000202e
mov eax, esi
call fcn.1001c519
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000203a
push esi
lea ecx, [ebp - 0x428]
call fcn.10019101
push 3
push esi
mov edx, edi
mov ecx, eax
call fcn.10019101
mov edi, eax
test edi, edi
je 0x10002197
push 0x60
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], esi
test esi, esi
jne 0x10002088
push 2
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], eax
test esi, esi
jne 0x10002088
call fcn.10001543
mov edi, eax
jmp 0x1000217c
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100020ab
call fcn.10001543
jmp 0x1000216f
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x100020a1
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x424], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x100020de
mov edi, 0x8007000e
jmp 0x10002171
mov byte [ebp - 4], 2
call fcn.10005d4e
cmp eax, 0x400
jbe 0x100020fc
push eax
lea ecx, [ebp - 0x418]
call fcn.10019101
jmp 0x10002108
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x1000212c
cmp dword [ebp - 0x418], 0
je 0x100020d4
mov ecx, dword [ebp - 0x418]
mov edx, edi
push edi
push dword [ebp - 0x420]
call fcn.10019101
pop ecx
pop ecx
mov ecx, eax
call fcn.100014e5
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
push dword [ebp + 0x14]
mov byte [eax + edi], bl
push dword [ebp - 0x418]
call fcn.10019101
mov edi, eax
test esi, esi
je 0x1000217c
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100021b7
lea ecx, [ebp - 0x418]
call fcn.100058b0
jmp 0x100021b7
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x100021b2
lea ecx, [ebp - 0x418]
call fcn.100058b0
mov edi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.10005668
mov eax, edi
lea esp, [ebp - 0x440]
call fcn.1001c309
ret 0x10
Function at 0x10019101
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10019110
pop dword [ebp - 0x50]
mov eax, 0x58b9b63c
add eax, 0xb747dad4
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x909b75d6
add dword [ebp - 0x60], 0xbdb6cf75
mov dword [ebp - 0x5c], 0x1098fc42
sub dword [ebp - 0x5c], 0xde65affd
mov dword [ebp - 0x58], 0x7207088f
add dword [ebp - 0x58], 0xda453b9f
mov dword [ebp - 0x54], 0xfc0a9f2
add dword [ebp - 0x54], 0xf03f560e
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x3e0a390b
add dword [ebp - 0x60], 0x3668304b
mov dword [ebp - 0x5c], 0x886bb9ed
sub dword [ebp - 0x5c], 0x46ff5878
mov dword [ebp - 0x58], 0xc1bc6007
add dword [ebp - 0x58], 0xa1b30c65
mov dword [ebp - 0x54], 0xec2308e3
add dword [ebp - 0x54], 0x13dcf71d
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x4136b
push 0
call eax
mov ecx, 0x5c13
mov edi, eax
mov ebx, 0x1002dc00
add ebx, dword [ebp - 0x50]
mov esi, 0xc1c408c8
add esi, 0x24bbecbd
mov edx, dword [ebx]
xor dword [ebp - 8], edi
add edx, esi
add dword [ebp - 0x40], 0xdfaca32e
mov dword [edi], edx
xor dword [ebp - 0x30], ecx
add edi, 4
add ebx, 0xdf63edf0
add ebx, 0x209c1214
loop 0x1001921c
add eax, 0x1631f
xor ebx, ebx
add ebx, eax
add eax, 0x3b082b98
sub eax, 0x3b082b93
mov ecx, 0x8068f9bf
sub ecx, 0x7068f9bf
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x47927275
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x1d410bd1
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001090
Capabilities:
Set socket configuration

Disassembly:
jmp 0x10048b10
mov eax, 4
call fcn.100011c0
mov eax, dword [esp + 0xc]
push esi
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0x8004667e
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x10048b5a
push 0xc3
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
pop ecx
ret
Function at 0x10001752
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
jno 0x10001768
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1000178d

Function at 0x10001900
Capabilities:
Enumerate pe sections

Disassembly:
adc cl, byte [ebx - 0x24ccefbb]
cmp eax, ebx
je 0x10001f0b
mov edi, dword [eax + 0x3c]
add edi, eax

Function at 0x10001910
Capabilities:
Enumerate pe sections

Disassembly:
cmp al, 3
clc
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
invalid
out dx, eax

Function at 0x10001a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl

Function at 0x10001a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
invalid

Function at 0x10001a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ebx
sub byte [edx + 0x50c0458d], dl
call fcn.10001722
push eax
push esi
push dword [ebp + 8]
jne 0x10001a6a

Function at 0x10001a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x10001a6a
call fcn.100016d7
add esp, 0x10
mov dword [ebp - 0x88], eax

Function at 0x10001a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10001712
mov bh, 0x12
add byte [edi], al
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax

Function at 0x10001a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
in eax, dx
salc

Function at 0x10001ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
pop ss

Function at 0x10001ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
invalid
inc ebp
pushfd

Function at 0x10001b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.100016d7
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
aam 0x88
pop ebp
aam 0x50

Function at 0x10001b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aam 0x88
pop ebp
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
invalid

Function at 0x10001ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl

Function at 0x10001bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ecx
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
invalid
inc ebp
invalid

Function at 0x10001d60
Capabilities:
Inspect section memory permissions

Disassembly:
mov word [eax + 0x60], gs
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x10001dc6
add eax, esi
Function at 0x10001d90
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10001dc6
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10001dab
and ecx, 0xfff
mov edx, esi
cmp edx, ebx
jne 0x10001f01
add dword [eax], eax
invalid
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10001d82
invalid
add eax, dword [eax + 4]
jmp 0x10001d6f
mov dword [ebp + 0xc], ebx
jmp 0x10001dd1
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10001de9
mov edx, dword [ebp - 0xb4]
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
clc
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
invalid
mov ch, 0x54

Function at 0x10001da0
Capabilities:
Inspect section memory permissions

Disassembly:
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10001db3

Function at 0x10001db0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10001dc6
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10001dab
and ecx, 0xfff
mov edx, esi
cmp edx, ebx
jne 0x10001f01
add dword [eax], eax
invalid
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10001d82
invalid
add eax, dword [eax + 4]
jmp 0x10001d6f
mov dword [ebp + 0xc], ebx
jmp 0x10001dd1
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10001de9
mov edx, dword [ebp - 0xb4]
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
clc
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
invalid
mov ch, 0x54

Function at 0x10001de0
Capabilities:
Inspect section memory permissions

Disassembly:
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10001e07
Function at 0x10001df0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10001dc6
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10001dab
and ecx, 0xfff
mov edx, esi
cmp edx, ebx
jne 0x10001f01
add dword [eax], eax
invalid
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10001d82
invalid
add eax, dword [eax + 4]
jmp 0x10001d6f
mov dword [ebp + 0xc], ebx
jmp 0x10001dd1
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10001de9
mov edx, dword [ebp - 0xb4]
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
clc
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
invalid
mov ch, 0x54

Function at 0x10001e00
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10001dc6
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10001dab
and ecx, 0xfff
mov edx, esi
cmp edx, ebx
jne 0x10001f01
add dword [eax], eax
invalid
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10001d82
invalid
add eax, dword [eax + 4]
jmp 0x10001d6f
mov dword [ebp + 0xc], ebx
jmp 0x10001dd1
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10001de9
mov edx, dword [ebp - 0xb4]
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
clc
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
invalid
mov ch, 0x54

Function at 0x10001e20
Capabilities:
Inspect section memory permissions

Disassembly:
cmp eax, dword [ebp - 0x44]
ja 0x10001e65
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
inc eax
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x10001dcb
mov dword [ebp + 8], esi
xor edi, edi
invalid

Function at 0x10001e30
Capabilities:
Inspect section memory permissions

Disassembly:
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
invalid
adc byte gs:[eax], al
add byte [eax], al

Function at 0x10001e40
Capabilities:
Inspect section memory permissions

Disassembly:
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
add al, 0x80
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4

Function at 0x10001e50
Capabilities:
Inspect section memory permissions

Disassembly:
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
add al, 0x80
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
Function at 0x10001e60
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10001e4c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10001e55
invalid
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10001e5f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10001e41

Function at 0x10001f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edx + 0x51fffffc], esi
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
cld
invalid
call dword [edi - 0x3a]
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
inc dword [esi - 0x3a]
test dword [edi + 0x40fffffc], esi

Function at 0x10002000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [eax - 0x3c35b], al
inc dword [eax]
invalid
movsd dword es:[edi], dword [esi]
invalid
cld
invalid
invalid

Function at 0x10002330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
out dx, eax
cli
invalid
inc dword [eax]
mov byte [ebp - 0x510], 0x5b
invalid
test ecx, esi
cli

Function at 0x10002410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
invalid
invalid

Function at 0x100025d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
invalid
invalid
sar ebp, 1

Function at 0x10002640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa

Function at 0x10002650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
invalid
invalid

Function at 0x10002680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte es:[ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
invalid

Function at 0x100038b0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cmp al, 0x60
mov ebp, esp
add ebp, 0x24
push esp
call fcn.10001712
salc
jecxz 0x100038c8
inc eax
or al, 0x8b
jo 0x100038e9
Function at 0x10003f20
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x10135780
mov eax, 0x74
call fcn.100011c0
mov eax, dword [0x102293a4]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x80]
test eax, eax
push esi
mov esi, dword [esp + 0x7c]
push edi
mov edi, 0x1022c6f4
push 0x4c
cmovne edi, eax
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [esp + 0x90]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x6a09e667
push esi
push eax
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0x3c6ef372
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0x510e527f
mov dword [esp + 0x34], 0x9b05688c
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
mov dword [esp + 0x8c], 0x20
call sym.libcrypto_1_1.dll_SHA256_Update
lea eax, [esp + 0x20]
push eax
push edi
call sym.libcrypto_1_1.dll_SHA256_Final
lea eax, [esp + 0x28]
push 0x70
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xa0]
add esp, 0x28
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.1000b910
add esp, 0x74
ret
Function at 0x10005160
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100672b0
mov eax, 0x10
call fcn.100011c0
mov eax, dword [esp + 0x14]
push esi
test byte [eax + 0x10], 4
mov ecx, dword [eax + 4]
lea esi, [ecx - 1]
je 0x10067359
mov ecx, dword [eax + 8]
xor edx, edx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 0x14], ecx
test ecx, ecx
jle 0x10067341
mov ecx, dword [eax]
push ebx
mov dword [esp + 0x14], ecx
push edi
push dword [ecx]
mov eax, ebp
xor eax, esi
lea ebx, [eax - 1]
not eax
shr ebx, 0x1f
shr eax, 0x1f
and ebx, eax
neg ebx
mov edi, ebx
or edi, dword [esp + 0x18]
call sym.libcrypto_1_1.dll_BN_num_bits_word
mov ecx, dword [esp + 0x1c]
mov edx, edi
not edx
mov dword [esp + 0x18], edi
and edx, 0x20
and eax, ebx
add edx, dword [esp + 0x14]
inc ebp
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
cmp ebp, dword [esp + 0x1c]
jl 0x100672f3
pop edi
pop ebx
not esi
pop ebp
lea eax, [esi - 1]
not esi
shr eax, 0x1f
shr esi, 0x1f
and eax, esi
dec eax
and eax, edx
pop esi
add esp, 0x10
ret
test ecx, ecx
jne 0x10067364
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, dword [eax]
push dword [eax + esi*4]
call sym.libcrypto_1_1.dll_BN_num_bits_word
add esp, 4
shl esi, 5
add eax, esi
pop esi
add esp, 0x10
ret

Function at 0x10005320
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
jmp 0x10044fe0
mov eax, 8
call fcn.100011c0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push 0x1048
push 0x101a0e98
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [esp + 0x30]
mov edi, 0x48
add esp, 0xc
mov eax, ebx
cmp dword [esp + 0x20], edi
cmovle edi, dword [esp + 0x20]
add edi, ebx
xor ebp, ebp
nop dword [eax]
movzx edx, byte [eax]
inc eax
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
xor dword [esi + ebp*4], edx
inc ebp
cmp ebp, 0x12
jl 0x10045020
mov dword [esp + 0x10], 0
xor edi, edi
mov dword [esp + 0x14], 0
nop
lea eax, [esp + 0x10]
push esi
push eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [esi + edi*4], eax
mov eax, dword [esp + 0x14]
mov dword [esi + edi*4 + 4], eax
add edi, 2
cmp edi, 0x12
jl 0x10045070
xor edi, edi
lea eax, [esp + 0x10]
push esi
push eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [esi + edi*4 + 0x48], eax
mov eax, dword [esp + 0x14]
mov dword [esi + edi*4 + 0x4c], eax
add edi, 2
cmp edi, 0x400
jl 0x10045097
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10005b80
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10077280
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x10077292
xor eax, eax
pop edi
ret
push ebp
push esi
push dword [edi]
call sym.libcrypto_1_1.dll_EVP_CIPHER_CTX_block_size
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test ebp, ebp
je 0x10077346
mov ecx, dword [edi + 0x84]
push ebx
cmp ecx, esi
jne 0x100772e6
test esi, esi
jle 0x10077324
mov edx, ebp
lea ecx, [edi + 4]
mov ebx, esi
nop dword [eax + eax]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x100772d0
jmp 0x10077324
sub eax, ecx
mov byte [ecx + edi + 0x64], 0x80
cmp eax, 1
jle 0x10077304
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
jle 0x10077324
mov edx, ebp
lea ecx, [edi + 0x24]
mov ebx, esi
nop
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x10077310
push esi
push ebp
push ebp
push dword [edi]
call sym.libcrypto_1_1.dll_EVP_Cipher
add esp, 0x10
pop ebx
test eax, eax
jne 0x10077346
push esi
push ebp
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
add esp, 8
xor eax, eax
pop esi
pop ebp
pop edi
ret
pop esi
pop ebp
mov eax, 1
pop edi
ret

Function at 0x10005f90
Capabilities:
Write file on windows

Disassembly:
jmp 0x1011eaa0
mov eax, 0x434
call fcn.100011c0
mov eax, dword [0x102293a4]
xor eax, esp
mov dword [esp + 0x430], eax
push esi
mov esi, dword [esp + 0x43c]
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
js 0x1011eb1e
test dword [esp + 0xa], 0x8000
jne 0x1011eb1e
push 0xb7
push str.crypto_rand_randfile.c
push 0x7a
push 0x70
push 0x24
lfence
call sym.libcrypto_1_1.dll_ERR_put_error
push esi
push str.Filename
push 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.1000b910
add esp, 0x434
ret
lea eax, [esp + 0x34]
push 0x400
push eax
call sym.libcrypto_1_1.dll_RAND_priv_bytes
add esp, 8
cmp eax, 1
jne 0x1011eb05
push edi
push 0x101f0f5c
push esi
call fcn.1000e720
mov edi, eax
add esp, 8
test edi, edi
jne 0x1011eb89
push 0xe9
push str.crypto_rand_randfile.c
push 0x79
push 0x70
push 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
push esi
push str.Filename
push 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.1000b910
add esp, 0x434
ret
push 0x180
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chmod]
push edi
push 0x400
lea eax, [esp + 0x48]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea eax, [esp + 0x54]
push 0x400
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0x45c]
add esp, 0x24
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1000b910
add esp, 0x434
ret