joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101ab4b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.101ebae0
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x101ab6c8
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x101ab6a2
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x101ab4f4
mov esi, dword [esp + 0x30]
jmp 0x101ab6a6
mov ecx, dword [esp + 0x28]
push ecx
call fcn.101aabf0
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x101ab4e0
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x101afb30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.101ebae0
mov edx, dword [esp + 0x18]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
or ecx, 0xffffffff
push ebp
mov ebp, dword [esp + 0x34]
cmp ebp, 1
push esi
mov esi, dword [edx]
setne al
add eax, ebx
mov dword [esp + 0x1c], esi
cmp eax, esi
jbe 0x101afb69
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
cmp ebp, 1
je 0x101afc34
mov ecx, dword [esp + 0x2c]
dec ecx
add ecx, esi
cmp dword [esp + 0x40], 0
mov dword [esp + 0x10], ecx
mov cl, byte [ecx]
mov byte [esp + 0xf], cl
movzx ebp, cl
je 0x101afba0
sub esi, ebp
mov eax, 1
sub esi, ebx
dec esi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ecx, [eax + ebp]
mov ebx, esi
sub ebx, ecx
mov eax, esi
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, pe_nt_image_headers32
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
push edi
cmovb eax, esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x101afc17
mov esi, dword [esp + 0x14]
mov edx, ebp
shr edx, 0x1f
mov dword [esp + 0x1c], edx
mov ecx, ebp
lea esi, [esi - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x13]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [esi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jb 0x101afbd7
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
not ebx
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x3c]
movzx ecx, bl
mov ebx, dword [esp + 0x40]
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edx], esi
pop edi
push dword [esp + 0x44]
push ecx
push ebx
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push edx
call fcn.101af810
add esp, 0x24
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x101bb590
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.101ebae0
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
push ebp
movups xmm0, xmmword [eax]
mov ebp, dword [esp + 0x4c]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x4c]
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edi
movups xmmword [esp + 0x1c], xmm0
test ebp, ebp
je 0x101bb649
push 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x38]
push eax
push dword [ecx]
call fcn.10032d90
add esp, 0x14
neg eax
sbb eax, eax
inc dword [esp + 0x1c]
inc eax
or esi, eax
mov dword [esp + 0x10], esi
mov esi, ebp
sub esi, ebx
cmp esi, 0x10
jbe 0x101bb613
mov esi, 0x10
jmp 0x101bb617
test esi, esi
je 0x101bb63a
lea edx, [edi + ebx]
mov edi, dword [esp + 0x50]
sub edi, dword [esp + 0x14]
xor eax, eax
mov cl, byte [edi + edx]
lea edx, [edx + 1]
xor cl, byte [esp + eax + 0x2c]
inc eax
mov byte [edx - 1], cl
cmp eax, esi
jb 0x101bb624
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add ebx, 0x10
mov ecx, dword [esp + 0x18]
cmp ebx, ebp
jb 0x101bb5d1
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
xor ecx, esp
call fcn.101ebfaa
add esp, 0x30
ret
Function at 0x101bb670
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4c
call fcn.101ebae0
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebp
mov ebp, dword [esp + 0x5c]
push esi
mov esi, dword [esp + 0x64]
push edi
mov edi, dword [esp + 0x5c]
mov eax, dword [edi + 0x198]
and eax, 0xfffffffb
mov dword [edi + 0x198], eax
test al, 0x20
jne 0x101bb6af
test al, 0x10
jne 0x101bb85a
test esi, esi
je 0x101bb85a
movups xmm0, xmmword [edi + 0x7c]
push ebx
push esi
push dword [esp + 0x68]
movups xmmword [esp + 0x40], xmm0
push ebp
psrldq xmm0, 0xc
movd eax, xmm0
shr eax, 0x18
or al, 0x80
mov byte [esp + 0x53], al
lea eax, [esp + 0x44]
push eax
push edi
call fcn.101bb590
mov dword [esp + 0x28], eax
lea ebx, [edi + 0x98]
mov eax, dword [edi + 0x14]
mov ecx, 8
mul ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x5c], xmm0
mov dword [esp + 0x2c], eax
mov eax, esi
mov dword [esp + 0x30], edx
mul ecx
mov dword [esp + 0x34], eax
lea eax, [edi + 0x5c]
push eax
push ebx
mov dword [esp + 0x40], edx
call fcn.101c7b90
mov ecx, dword [edi + 8]
add esp, 0x1c
test ecx, ecx
je 0x101bb741
mov eax, dword [edi + 0x14]
add eax, 0xf
and eax, 0xfffffff0
push eax
push ecx
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.101c7a30
add esp, 0x10
mov eax, esi
and eax, 0xfffffff0
jbe 0x101bb758
push eax
push ebp
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.101c7a30
add esp, 0x10
mov eax, esi
and eax, 0xf
je 0x101bb794
push eax
and esi, 0xfffffff0
lea eax, [esp + 0x2c]
add esi, ebp
xorps xmm0, xmm0
push esi
push eax
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x34], xmm0
call fcn.101eccd0
push 0x10
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x5c]
push eax
push ebx
call fcn.101c7a30
add esp, 0x1c
push 0x10
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.101c7a30
add esp, 0x10
lea eax, [esp + 0x49]
lea edx, [edi + 0x8d]
mov esi, 2
pop ebx
nop dword [eax]
movzx ecx, byte [edx - 1]
lea eax, [eax + 6]
xor byte [eax - 7], cl
lea edx, [edx + 6]
movzx ecx, byte [edx - 6]
xor byte [eax - 6], cl
movzx ecx, byte [edx - 5]
xor byte [eax - 5], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub esi, 1
jne 0x101bb7c0
and byte [esp + 0x53], 0x7f
lea eax, [esp + 0x44]
push 0x10
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [edi + 0x6c]
push eax
push dword [edi]
call fcn.10032d90
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp dword [esp + 0x10], ecx
setne cl
and eax, ecx
mov ecx, dword [edi + 0x198]
and ecx, 0xfffffffb
lea edx, [eax*4]
or edx, ecx
or edx, 0x10
mov dword [edi + 0x198], edx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x4c
ret
mov ecx, dword [esp + 0x54]
xor eax, eax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.101ebfaa
add esp, 0x4c
ret
Function at 0x101bb870
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x50
call fcn.101ebae0
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x5c]
push ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 0xc], eax
push ebp
mov ebp, dword [esp + 0x68]
mov eax, dword [ebx + 0x198]
and eax, 0xfffffffb
mov dword [ebx + 0x198], eax
push edi
mov edi, dword [esp + 0x64]
mov dword [esp + 0x10], edi
test al, 0x20
jne 0x101bb8bb
test al, 8
jne 0x101bba5a
test ebp, ebp
je 0x101bba5a
mov eax, dword [ebx + 0x14]
mov ecx, 8
mul ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x38], xmm0
push esi
mov dword [esp + 0x1c], eax
lea esi, [ebx + 0x98]
mov dword [esp + 0x20], edx
mov eax, ebp
mul ecx
mov dword [esp + 0x24], eax
lea eax, [ebx + 0x5c]
push eax
push esi
mov dword [esp + 0x30], edx
call fcn.101c7b90
mov ecx, dword [ebx + 8]
add esp, 8
test ecx, ecx
je 0x101bb91d
mov eax, dword [ebx + 0x14]
add eax, 0xf
and eax, 0xfffffff0
push eax
push ecx
lea eax, [esp + 0x44]
push eax
push esi
call fcn.101c7a30
add esp, 0x10
mov eax, ebp
and eax, 0xfffffff0
jbe 0x101bb934
push eax
push edi
lea eax, [esp + 0x44]
push eax
push esi
call fcn.101c7a30
add esp, 0x10
mov eax, ebp
and eax, 0xf
je 0x101bb96b
push eax
mov eax, ebp
xorps xmm0, xmm0
and eax, 0xfffffff0
add eax, edi
push eax
lea eax, [esp + 0x54]
push eax
movups xmmword [esp + 0x58], xmm0
call fcn.101eccd0
push 0x10
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x50]
push eax
push esi
call fcn.101c7a30
add esp, 0x1c
push 0x10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x44]
push eax
push esi
call fcn.101c7a30
add esp, 0x10
lea eax, [esp + 0x3d]
lea edx, [ebx + 0x8d]
mov esi, 2
nop
movzx ecx, byte [edx - 1]
lea eax, [eax + 6]
xor byte [eax - 7], cl
lea edx, [edx + 6]
movzx ecx, byte [edx - 6]
xor byte [eax - 6], cl
movzx ecx, byte [edx - 5]
xor byte [eax - 5], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub esi, 1
jne 0x101bb990
and byte [esp + 0x4b], 0x7f
lea eax, [esp + 0x3c]
push 0x10
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10
push eax
lea esi, [ebx + 0x6c]
push esi
push dword [ebx]
call fcn.10032d90
movups xmm0, xmmword [esi]
push ebp
push dword [esp + 0x2c]
movups xmmword [esp + 0x48], xmm0
mov edi, eax
lea eax, [esp + 0x48]
push dword [esp + 0x34]
psrldq xmm0, 0xc
movd ecx, xmm0
push eax
push ebx
shr ecx, 0x18
or cl, 0x80
mov byte [esp + 0x63], cl
call fcn.101bb590
add esp, 0x28
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
test edi, edi
pop esi
setne cl
and eax, ecx
mov ecx, dword [ebx + 0x198]
and ecx, 0xfffffffb
pop edi
pop ebp
lea edx, [eax*4]
or edx, ecx
or edx, 8
mov dword [ebx + 0x198], edx
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x50
ret
mov ecx, dword [esp + 0x58]
xor eax, eax
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.101ebfaa
add esp, 0x50
ret
Function at 0x101bbbc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
cmp dword [ebx + 0x84], 0xffffffff
je 0x101bbc94
push dword [ebx]
call fcn.10017170
mov esi, eax
add esp, 4
test esi, esi
js 0x101bbc94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x101bbbf1
mov dword [eax], esi
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x101bbc8b
mov ecx, dword [ebx + 0x84]
push edi
cmp ecx, esi
jne 0x101bbc2a
test esi, esi
jle 0x101bbc69
mov edx, ebp
lea ecx, [ebx + 4]
mov edi, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub edi, 1
jne 0x101bbc14
jmp 0x101bbc69
mov eax, esi
mov byte [ecx + ebx + 0x64], 0x80
sub eax, ecx
cmp eax, 1
jle 0x101bbc4a
dec eax
push eax
lea eax, [ebx + 0x65]
add eax, ecx
push 0
push eax
call fcn.101eec70
add esp, 0xc
test esi, esi
jle 0x101bbc69
mov edx, ebp
lea ecx, [ebx + 0x24]
mov edi, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub edi, 1
jne 0x101bbc55
push esi
push ebp
push ebp
push dword [ebx]
call fcn.10017a20
add esp, 0x10
pop edi
test eax, eax
jg 0x101bbc8b
push esi
push ebp
call fcn.1003f070
add esp, 8
xor eax, eax
pop ebp
pop esi
pop ebx
ret
pop ebp
pop esi
mov eax, 1
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret
Function at 0x101c73d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.101ebae0
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x30]
test eax, eax
je 0x101c74e1
movups xmm0, xmmword [edi + 0x10]
mov ebx, dword [esp + 0x50]
lea esi, [edi + 0x10]
dec eax
mov dword [esp + 0x10], ebx
movups xmmword [esp + 0x2c], xmm0
and byte [esp + 0x38], 0x7f
lea ecx, [esp + 0x2c]
push 1
mov dword [edi + 0x30], eax
push ecx
psrldq xmm0, 8
movd eax, xmm0
push 0
push 0
and al, 0x7f
mov byte [esp + 0x44], al
mov eax, dword [edi + 0x20]
push 0
push eax
mov dword [esp + 0x30], eax
call fcn.100322b0
add esp, 0x18
test eax, eax
je 0x101c74e1
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push dword [esp + 0x18]
push eax
push ebp
push dword [esp + 0x28]
call fcn.10032d90
add esp, 0x14
test eax, eax
je 0x101c74e1
push ebx
push ebp
lea eax, [esp + 0x24]
push eax
push edi
call fcn.101c78e0
add esp, 0x10
test eax, eax
je 0x101c74e1
lea eax, [esi + 0xf]
xor edx, edx
lea ecx, [esp + 0x1c]
cmp ecx, eax
ja 0x101c74b3
lea eax, [esp + 0x2b]
cmp eax, esi
jb 0x101c74b3
mov eax, ecx
sub esi, eax
lea ecx, [esp + 0x1c]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor byte [ecx], al
cmp edx, 0x10
jl 0x101c74a0
jmp 0x101c74c3
movups xmm1, xmmword [esp + 0x1c]
movups xmm0, xmmword [esi]
xorps xmm1, xmm0
movups xmmword [esp + 0x1c], xmm1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
or ecx, dword [esp + 0x24]
or eax, dword [esp + 0x28]
or ecx, eax
je 0x101c74f6
push ebx
push ebp
call fcn.1003f070
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x30
ret
mov ecx, dword [esp + 0x3c]
mov eax, ebx
mov dword [edi + 0x2c], 0
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101ebfaa
add esp, 0x30
ret

Function at 0x101cdfd0
Capabilities:
Get session user name

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push dword [esp + 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x101ce00f
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x101ce8b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
mov ebx, dword [esp + 0x114]
cmp byte [ebx], 0x7e
je 0x101ce8f1
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x10c
ret
inc ebx
push 0x2f
push ebx
call fcn.101eee80
add esp, 8
test eax, eax
je 0x101ce905
cmp eax, ebx
ja 0x101ce8d1
push esi
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x101ce910
push ebp
push 0x104
lea eax, [esp + 0x14]
sub esi, ecx
push 0
push eax
call fcn.101eec70
add esp, 0xc
lea eax, [esp + 0x10]
push 1
push 0x28
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x101cea07
lea ecx, [esp + 0x10]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101ce950
sub ecx, edx
lea eax, [ecx + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x101cea07
lea ecx, [esp + 0x10]
mov edx, ebp
mov eax, ecx
sub edx, eax
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x101ce980
push edi
mov edi, ebp
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x101ce993
sub edi, ecx
lea eax, [edi + 1]
add eax, esi
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x101ce9d8
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x10c
ret
test edi, edi
je 0x101ce9e7
push edi
push ebp
push eax
call fcn.101eccd0
add esp, 0xc
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea eax, [esi + 1]
mov esi, dword [esp + 0x14]
push eax
push ebx
lea eax, [esi + edi]
push eax
call fcn.101eccd0
add esp, 0x10
mov eax, esi
jmp 0x101ce9bf
mov ecx, dword [esp + 0x114]
xor eax, eax
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.101ebfaa
add esp, 0x10c
ret
Function at 0x101d6240
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x404
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
push esi
mov esi, dword [esp + 0x410]
push edi
cmp dword [esi], 0xffffffff
mov ebx, dword [esi + 0x24]
jne 0x101d6275
mov dword [ebx + 0x43c], 0
jmp 0x101d636a
push dword [esi + 0x1c]
call fcn.101d47f0
add esp, 4
mov edi, eax
cmp dword [esi + 0x10], 0
jne 0x101d62c3
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x101d641f
test edi, edi
je 0x101d641f
push 0x10
push ecx
call fcn.101d40c0
add esp, 8
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x404
ret
test edi, edi
je 0x101d641f
push dword [esi + 0x1c]
call fcn.101d47a0
add esp, 4
cmp dword [esi + 0x14], 0
jne 0x101d6357
cmp dword [esi + 4], 0
je 0x101d62f0
push 0
push edi
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x101d62fd
push edi
push eax
push dword [esi]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
add esp, 0xc
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp dword [esi + 0x2c], 0
mov dword [esi + 8], eax
mov dword [esi + 0x10], 0
je 0x101d6333
push str.Enabling_POLLOUT_for_socket
push str.ssh_socket_unbuffered_write
push 3
call fcn.101ceb90
push 0x10
push dword [esi + 0x2c]
call fcn.101d40c0
add esp, 0x14
push edi
push str.wrote__zd
push str.ssh_socket_unbuffered_write
push 4
test edi, edi
jns 0x101d63f8
mov dword [esi + 0x14], 1
call fcn.101ceb90
add esp, 0x10
push esi
mov dword [ebx + 0x43c], 0
call fcn.101d61e0
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x101d639f
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x101d639f
push dword [eax]
push dword [esi + 8]
push 2
call ecx
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x404
ret
push 0x400
lea eax, [esp + 0x10]
push 0
push eax
call fcn.101eec70
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0x400
lea ecx, [esp + 0x1c]
push ecx
push dword [eax]
call fcn.101cea30
push eax
push str.Writing_packet:_error_on_socket__or_connection_closed_:__s
push str.ssh_socket_nonblocking_flush
push 2
push ebx
call fcn.101c91a0
add esp, 0x2c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x404
ret
call fcn.101ceb90
push edi
push dword [esi + 0x1c]
call fcn.101d4f30
mov eax, dword [esi + 0x24]
add esp, 0x18
mov ecx, dword [eax + 0x5d8]
test ecx, ecx
je 0x101d641f
mov eax, edi
cdq
add dword [ecx + 8], eax
adc dword [ecx + 0xc], edx
push dword [esi + 0x1c]
call fcn.101d47f0
add esp, 4
cmp dword [esi + 0x2c], 0
je 0x101d646f
test eax, eax
je 0x101d646f
push str.did_not_send_all_the_data__queuing_pollout_event
push str.ssh_socket_nonblocking_flush
push 4
call fcn.101ceb90
push 0x10
push dword [esi + 0x2c]
call fcn.101d40c0
add esp, 0x14
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.101ebfaa
add esp, 0x404
ret
mov ecx, dword [esp + 0x40c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101ebfaa
add esp, 0x404
ret
Function at 0x101e0a60
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0xc]
dec eax
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
movd xmm0, eax
mov dword [esp + 0xc], eax
lea ecx, [ebp + 0xfc]
push edi
mov edi, dword [esp + 0x24]
lea eax, [esi + 0xfc]
pshufd xmm4, xmm0, 0
cmp ebp, eax
ja 0x101e0a9b
cmp ecx, esi
jae 0x101e0acd
lea edx, [edi + 0xfc]
cmp ebp, edx
ja 0x101e0aa9
cmp ecx, edi
jae 0x101e0acd
lea eax, [ebx + 0xfc]
cmp ebp, eax
ja 0x101e0ab7
cmp ecx, ebx
jae 0x101e0acd
lea ecx, [esi + 0xfc]
cmp ebx, ecx
ja 0x101e0ac5
cmp eax, esi
jae 0x101e0acd
cmp ebx, edx
ja 0x101e0b0b
cmp eax, edi
jb 0x101e0b0b
sub edi, ebx
mov dword [esp + 0x28], 0x40
sub ebx, esi
sub ebp, esi
nop dword [eax + eax]
mov edx, dword [esi]
lea ecx, [ebx + esi]
mov eax, dword [ecx + edi]
lea esi, [esi + 4]
xor edx, eax
and edx, dword [esp + 0x10]
xor eax, edx
mov dword [ecx], eax
mov eax, dword [esi - 4]
xor eax, edx
sub dword [esp + 0x28], 1
mov dword [esi + ebp - 4], eax
jne 0x101e0ae0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
sub esi, edi
sub ebx, edi
sub ebp, edi
mov eax, 0x10
nop word [eax + eax]
lea edi, [edi + 0x10]
movups xmm3, xmmword [esi + edi - 0x10]
movups xmm1, xmmword [edi - 0x10]
movaps xmm2, xmm3
xorps xmm2, xmm1
andps xmm2, xmm4
movaps xmm0, xmm2
xorps xmm2, xmm3
xorps xmm0, xmm1
movups xmmword [ebx + edi - 0x10], xmm0
movups xmmword [edi + ebp - 0x10], xmm2
sub eax, 1
jne 0x101e0b20
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x101e0b60
Capabilities:
Encrypt data using curve25519

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x102ab2c0]
xor eax, esp
mov dword [esp + 0x1a0], eax
mov eax, dword [esp + 0x1ac]
mov edx, 2
mov ecx, dword [esp + 0x1b0]
push esi
mov esi, dword [esp + 0x1ac]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movups xmmword [esp + 0x194], xmm1
and al, 0xf8
psrldq xmm1, 0xf
movups xmmword [esp + 0x184], xmm0
mov byte [esp + 0x184], al
movd eax, xmm1
and al, 0x3f
or al, 0x40
add ecx, 8
mov byte [esp + 0x1a3], al
lea eax, [esp + 0x14]
nop
movd xmm1, dword [ecx - 8]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
lea ecx, [ecx + 0x10]
punpcklwd xmm1, xmm0
lea eax, [eax + 0x40]
movups xmmword [eax - 0x50], xmm1
movd xmm1, dword [ecx - 0x14]
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movd xmm1, dword [ecx - 0x10]
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movd xmm1, dword [ecx - 0xc]
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
sub edx, 1
jne 0x101e0bd0
lea eax, [esp + 0x184]
push eax
lea eax, [esp + 8]
push eax
call fcn.101e0f40
lea eax, [esp + 0x8c]
push eax
push eax
call fcn.101e1780
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x11c]
push eax
call fcn.101e1460
lea eax, [esp + 0x120]
push eax
call fcn.101e0df0
add esp, 0x20
xor eax, eax
nop
mov cl, byte [esp + eax*4 + 0x104]
mov byte [esi + eax], cl
inc eax
cmp eax, 0x20
jb 0x101e0c70
mov ecx, dword [esp + 0x1a4]
xor eax, eax
pop esi
xor ecx, esp
call fcn.101ebfaa
add esp, 0x1a4
ret