joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c483c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dh, byte [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ebx
test dh, 1
je 0x4c487e
mov al, byte [ebp + 8]
test esi, esi
je 0x4c487c
mov edi, esi
mov dh, al
mov dl, dh
add dl, dl
mov al, dl
xor al, 0x1b
test dh, dh
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
mov dh, cl
sub edi, 1
jne 0x4c485a
mov byte [ebp - 1], dh
mov al, cl
mov dh, byte [ebp + 0xc]
xor bl, al
shr dh, 1
inc esi
mov byte [ebp + 0xc], dh
cmp esi, 8
jl 0x4c484a
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x4c496a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov eax, ecx
xor edx, edx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [eax]
mov dword [ebp - 4], edx
xor esi, esi
test eax, eax
jle 0x4c49a3
mov ebx, dword [ebp + 0xc]
add ebx, edx
mov edx, dword [ebp - 8]
mov ecx, dword [edi]
mov al, byte [ebx]
lea ebx, [ebx + 4]
xor byte [ecx + esi], al
inc esi
mov eax, dword [edx]
cmp esi, eax
jl 0x4c498f
mov edx, dword [ebp - 4]
inc edx
add edi, 4
mov dword [ebp - 4], edx
cmp edx, 4
jl 0x4c4981
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4c4bbe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x4c4be7
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
sub esi, ecx
sub edi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x4c4bd7
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x4c4beb
Capabilities:
Encode data using base64

Disassembly:
push 0x64
mov eax, 0xaca4bc
call fcn.00ac672e
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x54]
xor ebx, ebx
mov dword [ebp - 0x70], edi
push 0x41
push ebx
push eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x6c], ebx
call fcn.00aa3e00
add esp, 0xc
mov ecx, ebx
lea eax, [ecx + 0x41]
mov byte [ebp + ecx - 0x54], al
inc ecx
cmp ecx, 0x1a
jl 0x4c4c16
mov ecx, ebx
lea eax, [ecx + 0x61]
mov byte [ebp + ecx - 0x3a], al
inc ecx
cmp ecx, 0x1a
jl 0x4c4c25
mov ecx, ebx
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xa
jl 0x4c4c34
mov dword [edi], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0xf
mov word [ebp - 0x16], 0x2f2b
mov byte [edi], bl
mov eax, dword [ebp + 0x10]
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6c], 1
test eax, eax
je 0x4c4d97
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
inc ecx
mov byte [ebp + edi - 0x58], al
inc edi
mov dl, byte [ebp - 0x57]
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x56]
mov cl, byte [ebp - 0x58]
mov byte [ebp - 0x5f], ch
mov byte [ebp - 0x5d], dl
mov byte [ebp - 0x5e], cl
cmp edi, esi
jne 0x4c4cf2
mov esi, dword [ebp - 0x64]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x5c], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x5b], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x5a], cl
mov byte [ebp - 0x59], ch
movzx eax, byte [ebp + edi - 0x5c]
mov ecx, esi
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.0048495c
inc edi
cmp edi, 4
jl 0x4c4ccc
mov dl, byte [ebp - 0x5d]
mov edi, ebx
mov cl, byte [ebp - 0x5e]
mov ch, byte [ebp - 0x5f]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4c4c6f
mov dword [ebp - 0x68], edi
test edi, edi
je 0x4c4d97
mov eax, edi
cmp edi, esi
jge 0x4c4d28
cmp eax, esi
jae 0x4c4da2
mov byte [ebp + eax - 0x58], bl
inc eax
cmp eax, esi
jl 0x4c4d10
mov ch, byte [ebp - 0x56]
mov dl, byte [ebp - 0x57]
mov cl, byte [ebp - 0x58]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x5c], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x5b], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x59], ch
lea eax, [edi + 1]
mov byte [ebp - 0x5a], dl
mov dword [ebp - 0x58], eax
test eax, eax
jle 0x4c4d82
mov esi, dword [ebp - 0x64]
mov edi, eax
movzx eax, byte [ebp + ebx - 0x5c]
mov ecx, esi
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.0048495c
inc ebx
cmp ebx, edi
jl 0x4c4d65
mov edi, dword [ebp - 0x68]
push 3
pop esi
cmp edi, esi
jge 0x4c4d97
sub esi, edi
mov ecx, dword [ebp - 0x64]
push 0x3d
call fcn.0048495c
sub esi, 1
jne 0x4c4d88
mov eax, dword [ebp - 0x64]
call fcn.00ac66dd
ret 0xc
call fcn.00aa1ad9
int3
Function at 0x4c4da8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0xb0a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea esi, [ebx + 0x64]
mov dword [ebp - 0x44], ecx
push esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], eax
call fcn.00aa18e7
push esi
push 0
push eax
mov dword [ebp - 0x40], eax
call fcn.00aa3e00
push ebx
push edi
push dword [ebp - 0x40]
call fcn.00aa3880
add esp, 0x1c
mov eax, ebx
test ebx, ebx
je 0x4c4dfe
mov byte [edi], 0
inc edi
sub eax, 1
jne 0x4c4df5
xor eax, eax
mov dword [ebp - 0x16], 0x36433442
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x38]
mov word [ebp - 0xe], 0x4441
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x12], 0x42304134
push eax
lea eax, [ebx + 0xf]
mov dword [ebp - 0x23], 0x45384545
mov ebx, dword [ebp - 0x40]
and eax, 0xfffffff0
push eax
push ebx
mov dword [ebp - 0xb], 0x323945
mov word [ebp - 0x25], 0x3441
mov word [ebp - 0x28], 0x4642
mov dword [ebp - 0x1c], 0x37454234
mov word [ebp - 0x1e], 0x3339
mov byte [ebp - 0x1f], 0x46
mov byte [ebp - 0x26], 0x45
mov word [ebp - 0x18], 0x3241
mov byte [ebp - 0xc], 0x31
call fcn.004c4521
mov edi, eax
mov ecx, ebx
test esi, esi
je 0x4c4e8d
mov byte [ecx], 0
inc ecx
sub esi, 1
jne 0x4c4e84
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x48]
push edi
push esi
call fcn.004c4beb
push ebx
call fcn.00aa17b1
push edi
call fcn.00aa17b1
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00aa17a3
leave
ret 0x10
Function at 0x53f60b
Capabilities:
Get disk information via ioctl

Disassembly:
push 0x74
mov eax, 0xaca946
call fcn.00ac672e
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x44], al
mov dword [ebp - 4], eax
call dword [edi + 0xb4]
cdq
mov bl, 0x41
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x4c], edx
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x64], eax
xor edx, edx
mov ecx, eax
and ecx, 0x1f
shr eax, 5
inc edx
shl edx, cl
test dword [ebp + eax*4 - 0x2c], edx
je 0x53f79b
mov esi, dword [edi + 0xb8]
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x28], eax
push 0xada658
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00484997
push dword [ebp - 0x60]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
push 1
push 0
call fcn.0053fe32
push eax
lea ecx, [ebp - 0x80]
call fcn.00484691
mov byte [ebp - 4], 2
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x6c], 0x10
cmovae eax, dword [ebp - 0x80]
push eax
call esi
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.00481f0c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00481f0c
cmp esi, 3
jne 0x53f79b
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x28]
push str.._
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00484997
push dword [ebp - 0x60]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0048495c
push 0xada180
lea ecx, [ebp - 0x28]
call fcn.00484642
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [edi + 0xc0]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
push edx
push edx
push esi
push edx
push esi
push edx
push ecx
call eax
mov dword [ebp - 0x68], eax
cmp eax, 0xffffffff
je 0x53f78f
mov ecx, dword [edi + 0xb0]
lea edx, [ebp - 0x4c]
push 0
push edx
push 0xc
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push 0x2d1080
push eax
call ecx
push dword [ebp - 0x68]
or esi, 0xffffffff
test eax, eax
cmovne esi, dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x53f78f
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
push esi
call fcn.0053d62b
test eax, eax
jne 0x53f78f
sub esp, 0x18
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x44]
push eax
call fcn.00484a6c
mov ecx, edi
call fcn.00532d5e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00481f0c
mov eax, dword [ebp - 0x64]
inc bl
inc eax
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x64], eax
cmp bl, 0x5a
jle 0x53f645
lea ecx, [ebp - 0x44]
call fcn.00481f0c
call fcn.00ac66dd
ret
Function at 0x54058e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov edi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], eax
sar eax, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
cmp edx, eax
jge 0x5405f8
lea esi, [edi + edi]
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.00540541
imul ecx, dword [ebp - 8], 0x18
movzx edi, al
xor edi, 1
inc edi
add edi, esi
imul eax, edi, 0x18
add ecx, ebx
add eax, ebx
push eax
call fcn.004ee514
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], edi
cmp edi, eax
jl 0x5405bc
mov ecx, dword [ebp - 0x18]
mov esi, edi
cmp edi, eax
jne 0x540619
test cl, 1
jne 0x540619
imul eax, ecx, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, ebx
add ecx, ebx
push eax
call fcn.004ee514
mov esi, dword [ebp - 4]
cmp dword [ebp - 0xc], esi
jge 0x54064c
push dword [ebp - 0x10]
lea edi, [esi - 1]
sar edi, 1
imul eax, edi, 0x18
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.00540541
test al, al
je 0x54064c
push dword [ebp - 4]
imul ecx, esi, 0x18
add ecx, ebx
call fcn.004ee514
mov esi, edi
cmp dword [ebp - 0xc], edi
jl 0x54061e
push dword [ebp - 0x10]
imul ecx, esi, 0x18
add ecx, ebx
call fcn.004ee514
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x55c120
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0xacaac1
call fcn.00ac672e
mov esi, ecx
push 8
call fcn.00aa1964
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push ecx
push 0x55c18c
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.00aa7563
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x55c171
mov eax, esi
call fcn.00ac66dd
ret 8
push 6
mov dword [edi], ebx
call fcn.00aa3196
int3

Function at 0x55c285
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x9fb030
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0xacaac1
call fcn.00ac672e
mov esi, ecx
push 8
call fcn.00aa1964
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov dword [ecx], eax
mov dword [ecx + 4], 0x9fae97
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push ecx
push 0x9fb08c
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.00aa7563
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x9fb082
mov eax, esi
call fcn.00ac66dd
ret 8
push 6
mov dword [edi], ebx
call fcn.00aa3196
int3
Function at 0xa58880
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0xb0a008]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0xa58938
mov eax, dword [esp]
cmp al, 2
jne 0xa58932
shr eax, 8
cmp al, 2
jne 0xa58932
call fcn.00a6b1b0
test eax, eax
jne 0xa5893d
mov ecx, str.iphlpapi.dll
call fcn.00a589a0
mov dword [0xb0f13c], eax
test eax, eax
je 0xa588f8
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0xb0cec8]
test eax, eax
cmovne ecx, eax
mov dword [0xb0cec8], ecx
xor edx, edx
push 3
push ecx
push 0
lea ecx, [edx + 6]
call fcn.00a6b3d0
add esp, 0xc
test al, al
setne byte [0xb0f250]
push 0xb0f248
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00aa17a3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00aa17a3
mov esp, ebp
pop ebp
ret
Function at 0xa589a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push str.kernel32
mov esi, ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0xa589c4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0xada980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0xada990
push esi
mov dword [ebp - 8], ebx
call fcn.00ab3014
add esp, 8
test eax, eax
je 0xa58a0c
test ebx, ebx
je 0xa589fc
push 8
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0xa58a35
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xa58a35
push 0x800
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0xa58af8
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xa58a51
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0xb0a97c]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0xa58aee
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0xa58aee
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xa58a90
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xa58ab0
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0xa58ac5
mov eax, dword [ebp - 8]
test eax, eax
je 0xa58ae5
push 8
push 0
push ebx
call eax
jmp 0xa58aec
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0xb0a984]
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xa59140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
call fcn.00a5a780
mov edx, edi
mov dword [ebp - 0x14], eax
call fcn.00a5a760
mov edx, dword [ebp + 8]
mov cl, 1
mov byte [ebp - 1], cl
mov dword [edx], 0
test eax, eax
je 0xa5926a
cmp byte [eax + 0x3c], 0
je 0xa5926a
mov esi, dword [edi + 0x8d8]
test esi, esi
je 0xa5926a
mov eax, dword [edi + 0x78]
test eax, eax
je 0xa5919c
test byte [eax + 4], 0x10
je 0xa5919c
add eax, 0x78
jmp 0xa591a2
lea eax, [edi + 0x8dc]
mov edi, dword [edi + 0x4a4]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
test edi, edi
je 0xa59269
nop dword [eax]
cmp dword [esi + 0xc], 0
je 0xa5925a
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi]
mov eax, dword [ecx + 8]
mov ecx, dword [eax + 8]
call fcn.00a696d0
test eax, eax
je 0xa5925a
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 4]
mov edi, dword [ecx + 0xc]
cmp byte [edi + 0x1c9], 0
jne 0xa591f6
test edx, edx
je 0xa59209
jmp 0xa59257
test edx, edx
je 0xa59257
mov ecx, dword [edi + 0x64]
call fcn.00a696d0
test eax, eax
je 0xa59257
mov ecx, dword [ebp - 0xc]
cmp byte [edi + 0x1ca], 0
mov eax, dword [esi + 0x1c]
jne 0xa5921c
cmp eax, 0xffffffff
je 0xa59229
jmp 0xa59257
cmp eax, 0xffffffff
je 0xa59257
cmp dword [edi + 0x444], eax
jne 0xa59257
mov eax, dword [ecx + 8]
mov eax, dword [eax + 0x10]
cmp eax, dword [esi + 0x18]
jne 0xa59257
mov ecx, dword [edi + 0x1e0]
mov edx, dword [esi + 8]
mov ecx, dword [ecx]
call fcn.00a696d0
test eax, eax
je 0xa59257
mov ecx, dword [ebp - 0x14]
lea edx, [esi + 0x20]
call fcn.00a58bd0
test al, al
jne 0xa59272
mov edi, dword [ebp - 8]
inc ebx
add esi, 0x60
cmp ebx, edi
jb 0xa591c0
mov cl, byte [ebp - 1]
pop ebx
pop edi
mov al, cl
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
pop ebx
pop edi
inc dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
xor cl, cl
mov al, cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xa5def0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.004538c0
push eax
push edx
push esi
call fcn.00ac1de0
add esp, 0xc
pop esi
pop ebp
ret

Function at 0xa5f900
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + edx]
mov edx, 0x1505
cmp esi, edi
jae 0xa5f928
mov cl, byte [esi]
call fcn.00a69660
movsx ecx, al
inc esi
mov eax, edx
shl eax, 5
add edx, eax
xor edx, ecx
cmp esi, edi
jb 0xa5f910
pop edi
movzx eax, dl
pop esi
ret

Function at 0xa67bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp byte [esi + 0x6d0], 0
je 0xa67c50
cmp dword [esi + 0x1a4], 0
je 0xa67c10
push ebx
call fcn.00a5dad0
mov dl, 1
mov bl, al
call fcn.00a5dab0
push dword [esi + 0x154]
mov eax, dword [esi + 0x1a4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
call eax
add esp, 0x14
mov dl, bl
mov ecx, esi
pop ebx
pop edi
pop esi
pop ebp
jmp fcn.00a5dab0
mov eax, edi
sub eax, 0
je 0xa67c21
sub eax, 1
je 0xa67c21
sub eax, 1
jne 0xa67c50
push dword [esi + 0x150]
lea eax, [edi*2 + 0xad7dc4]
push 1
add eax, edi
push 2
push eax
call fcn.00ab294a
push dword [esi + 0x150]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00ab294a
add esp, 0x20
pop edi
pop esi
pop ebp
ret

Function at 0xa698a0
Capabilities:
Generate random numbers via winapi

Disassembly:
push esi
push edi
mov esi, edx
mov edi, ecx
push esi
push 0
push edi
call fcn.00aa3e00
add esp, 0xc
push 2
push esi
push edi
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
neg eax
pop edi
sbb eax, eax
and eax, 2
pop esi
ret
Function at 0xa6e660
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push 0
push dword [ebp + 8]
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 4
mov dword [ebp + 0xc], esi
call fcn.00aa3e00
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa6e731
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0xa6e713
push 0
push edi
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0xa6e713
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp - 4]
call edi
test eax, eax
je 0xa6e713
cmp esi, dword [ebp - 0xc]
jb 0xa6e713
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0xa6e721
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0xa6e731
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xa6e9d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [eax], 0
mov edi, edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
test esi, esi
jne 0xa6e9fe
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0xa6e9f5
sub esi, ecx
cmp esi, 0x3fffffff
ja 0xa6eb22
lea ecx, [esi + 2]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx*4 + 1]
push eax
call dword [0xb0a97c]
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
test ecx, ecx
je 0xa6eb22
push ebx
cmp esi, 3
jb 0xa6eaac
mov eax, 0xaaaaaaab
mul esi
mov ebx, edx
shr ebx, 1
movzx eax, byte [edi]
sub esi, 3
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx edx, byte [edi]
movzx eax, byte [edi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx edx, byte [edi + 1]
movzx eax, byte [edi + 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movzx eax, byte [edi + 2]
add edi, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
sub ebx, 1
jne 0xa6ea45
test esi, esi
je 0xa6eb09
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx edx, byte [edi]
and edx, 3
shl edx, 4
cmp esi, 1
jne 0xa6eadd
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov word [ecx + 2], 0x3d3d
jmp 0xa6eb06
movzx eax, byte [edi + 1]
shr eax, 4
or eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [edi + 1]
and eax, 0xf
movzx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov byte [ecx], 0
sub ecx, eax
pop ebx
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebp
ret
pop edi
mov eax, 0x1b
pop esi
pop ebp
ret
Function at 0xa72780
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
mov dword [ebp - 4], ecx
test edi, edi
je 0xa7279d
cmp dword [edi], 0
jne 0xa727af
test esi, esi
je 0xa727a6
cmp dword [esi], 0
jne 0xa727af
test ebx, ebx
je 0xa727f7
cmp dword [ebx], 0
je 0xa727f7
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.00a9b550
add esp, 8
test ebx, ebx
je 0xa727c9
cmp dword [ebx], 0
jne 0xa727cb
xor ebx, ebx
test esi, esi
je 0xa727d4
cmp dword [esi], 0
jne 0xa727d6
xor esi, esi
test edi, edi
je 0xa727df
cmp dword [edi], 0
jne 0xa727e1
xor edi, edi
push eax
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00a72730
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret