joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002840
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10063f6c]
push esi
push 0
push 1
push 2
mov dword [esp + 0x28], eax
mov esi, ecx
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
jne 0x100028b7
call sub.WSOCK32.dll_WSAGetLastError
xor ecx, ecx
lea esp, [esp]
cmp dword [ecx*8 + 0x10062020], eax
je 0x100028ae
inc ecx
cmp ecx, 0x96
jl 0x10002870
mov ecx, dword [str.Unknown_winsocket_error]
push ecx
push str.SSLBridge::Init:_Unable_to_get_a_socket._socket_failed:__s
call fcn.100011b0
push eax
call fcn.100012d0
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
call fcn.10016b4b
add esp, 0x1c
ret 8
mov ecx, dword [ecx*8 + 0x10062024]
jmp 0x10002888
push 4
lea ecx, [esp + 0xc]
push ecx
push 8
push 0xffff
push eax
mov dword [esp + 0x1c], 1
call sub.WSOCK32.dll_setsockopt
test eax, eax
jne 0x1000289c
lea edx, [esp + 4]
push edx
mov dword [esp + 8], eax
mov eax, dword [esi + 0x10]
push 0x8004667e
push eax
call sub.WSOCK32.dll_ioctlsocket
test eax, eax
je 0x100028fb
mov ecx, dword [esi + 0x10]
push ecx
call sub.WSOCK32.dll_closesocket
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp ecx, 0x10
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov word [esp + 0xc], 2
jb 0x10002925
mov eax, dword [eax + 4]
jmp 0x10002928
add eax, 4
push eax
call fcn.10002790
add esp, 4
test eax, eax
mov dword [esp + 0x10], eax
je 0x1000289c
mov eax, dword [esp + 0x28]
push eax
call sub.WSOCK32.dll_htons
mov edx, dword [esi + 0x10]
push 0x10
lea ecx, [esp + 0x10]
push ecx
push edx
mov word [esp + 0x1a], ax
call sub.WSOCK32.dll_connect
test eax, eax
jne 0x1000289c
mov ecx, esi
call fcn.10002700
mov ecx, dword [esp + 0x1c]
test al, al
setne al
pop esi
call fcn.10016b4b
add esp, 0x1c
ret 8

Function at 0x10002dc0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x10002c20
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x1c]
test eax, eax
pop esi
jne 0x10002e0e
push str.SSLBridge::StartListeningThread:_Failed_to_start_listening_thread.
call fcn.100011b0
push eax
call fcn.100012d0
add esp, 8
xor al, al
pop ecx
ret
mov al, 1
pop ecx
ret
Function at 0x10002e20
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x10063f6c]
push esi
push 0
push 1
push 2
mov dword [esp + 0x24], eax
mov esi, ecx
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x10002e95
call sub.WSOCK32.dll_WSAGetLastError
xor ecx, ecx
lea esp, [esp]
cmp dword [ecx*8 + 0x10062020], eax
je 0x10002e8c
inc ecx
cmp ecx, 0x96
jl 0x10002e50
mov ecx, dword [str.Unknown_winsocket_error]
push ecx
push str.SSLBridge::Init:_Unable_to_get_a_socket._socket_failed:__s
call fcn.100011b0
push eax
call fcn.100012d0
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
call fcn.10016b4b
add esp, 0x18
ret
mov ecx, dword [ecx*8 + 0x10062024]
jmp 0x10002e68
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WSOCK32.dll_htons
mov edx, dword [esi + 4]
push 0x10
lea ecx, [esp + 0xc]
push ecx
push edx
mov word [esp + 0x16], ax
call sub.WSOCK32.dll_bind
test eax, eax
je 0x10002ee3
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.10002260
add esp, 4
push eax
push str.SSLBridge::Init:_Failed_to_bind_socket:__s
jmp 0x10002e6e
mov edx, dword [esi + 4]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x10], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
je 0x10002f1b
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.10002260
add esp, 4
push eax
push str.SSLBridge::Init:_Failed_to_get_socket_name:__s
jmp 0x10002e6e
mov eax, dword [esp + 0xa]
push eax
call sub.WSOCK32.dll_ntohs
mov edx, dword [esi + 4]
movzx ecx, ax
push 0x32
push edx
mov dword [esi + 8], ecx
call sub.WSOCK32.dll_listen
test eax, eax
je 0x10002f53
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.10002260
add esp, 4
push eax
push str.SSLBridge::Init:_Failed_to_start_listening:__s
jmp 0x10002e6e
mov ecx, esi
call fcn.10002dc0
mov ecx, dword [esp + 0x18]
test al, al
setne al
pop esi
call fcn.10016b4b
add esp, 0x18
ret

Function at 0x10005040
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x100050a1
mov al, byte [edi]
test al, al
je 0x100050a1
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x10005059
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x100072b0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push esi
push edi
call dword [sym.imp.MSVCR71.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10007342
push 0x68
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.10003a30
push 0x1004ba04
push esi
push 0x1004ba00
push edi
push str.fopen_
push 5
call fcn.10004200
add esp, 0x2c
call dword [sym.imp.MSVCR71.dll__errno]
cmp dword [eax], 2
jne 0x10007327
push 0x6b
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.10003a30
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x6d
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.10003a30
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x100627e4
call fcn.10006b20
mov esi, eax
add esp, 4
test esi, esi
jne 0x10007359
pop edi
pop esi
pop ebx
ret
push ebx
push 1
push 0x6a
push esi
call fcn.10006f80
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x10020240
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x40
call fcn.10016d60
push ebx
mov ebx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x5c]
xor eax, eax
test esi, esi
push edi
je 0x10020265
mov eax, 1
mov dword [ebx], esi
jmp 0x1002026d
mov ecx, dword [ebx]
mov dword [esp + 0x60], ecx
mov esi, ecx
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x100203a2
mov edi, dword [esi + 0x40]
cmp edi, 0x40
jbe 0x10020295
push str.j___sizeof_ctx__key
push 0x52
push str..cryptohmachmac.c
call fcn.10004740
add esp, 0xc
mov ebp, dword [esp + 0x5c]
cmp edi, ebp
jge 0x100202cb
mov edx, dword [esp + 0x64]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.1001e820
mov eax, dword [esp + 0x64]
push ebp
push eax
push edi
call fcn.1001e950
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.1001e960
add esp, 0x24
jmp 0x10020300
cmp ebp, 0x40
jbe 0x100202e4
push str.len___sizeof_ctx__key
push 0x5c
push str..cryptohmachmac.c
call fcn.10004740
add esp, 0xc
mov esi, dword [esp + 0x58]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x40
je 0x10020322
mov ecx, 0x40
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0x60]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x40
jl 0x10020328
mov ebp, dword [esp + 0x64]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.1001e820
mov edx, dword [esi + 0x40]
lea eax, [esp + 0x1c]
push edx
push eax
push edi
call fcn.1001e950
add esp, 0x18
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x40
jl 0x1002035c
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.1001e820
mov edx, dword [esi + 0x40]
lea eax, [esp + 0x1c]
push edx
push eax
push edi
call fcn.1001e950
add esp, 0x18
lea ecx, [ebx + 0x14]
add ebx, 4
push ecx
push ebx
call fcn.1001e9e0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test eax, eax
je 0x1002038a
jmp 0x10020326
Function at 0x10031220
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xcc
call fcn.10016d60
mov ecx, dword [esp + 0xd0]
push ebx
push ebp
push esi
lea esi, [ecx + 0x14]
lea eax, [ecx + 0x54]
push edi
lea edi, [esp + 0x5c]
mov ecx, dword [esi + 0x3c]
xor ebp, ebp
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x9c]
sub ecx, eax
sub edi, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
sub esi, eax
mov ebx, dword [esp + 0xe4]
mov edx, dword [eax]
xor ecx, ecx
mov dword [edi + eax - 0x40], edx
mov cl, byte [ebx + ebp]
mov ebx, dword [esp + 0x14]
xor edx, ecx
mov dword [edi + eax], ecx
mov dword [ebx + eax], edx
mov edx, dword [esp + 0x10]
xor ecx, edx
add eax, 4
mov edx, dword [ecx*4 + str._.C]
mov ecx, dword [esi + eax - 4]
xor ecx, edx
inc ebp
mov dword [esi + eax - 4], ecx
cmp ebp, 0x10
mov dword [esp + 0x10], ecx
jl 0x1003125d
xor ecx, ecx
xor edx, edx
xor eax, eax
mov ecx, dword [ecx*4 + str._.C]
mov edi, dword [esp + eax*4 + 0x1c]
mov esi, dword [esp + eax*4 + 0x20]
xor edi, ecx
mov ecx, edi
mov ebp, dword [esp + eax*4 + 0x24]
mov ebx, dword [esp + eax*4 + 0x28]
mov dword [esp + eax*4 + 0x1c], edi
mov ecx, dword [ecx*4 + str._.C]
mov edi, dword [esp + eax*4 + 0x2c]
xor esi, ecx
mov ecx, esi
mov dword [esp + eax*4 + 0x20], esi
mov esi, dword [esp + eax*4 + 0x30]
add eax, 8
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [esp + eax*4 + 4], ebp
mov ebp, dword [esp + eax*4 + 0x14]
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov dword [esp + eax*4 + 8], ebx
mov ebx, dword [esp + eax*4 + 0x18]
mov ecx, dword [ecx*4 + str._.C]
xor edi, ecx
mov ecx, edi
mov dword [esp + eax*4 + 0xc], edi
mov ecx, dword [ecx*4 + str._.C]
xor esi, ecx
mov ecx, esi
mov dword [esp + eax*4 + 0x10], esi
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [esp + eax*4 + 0x14], ebp
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
cmp eax, 0x30
mov dword [esp + eax*4 + 0x18], ebx
mov ecx, ebx
jl 0x100312a5
add ecx, edx
and ecx, 0xff
inc edx
cmp edx, 0x12
jl 0x100312a3
mov edi, dword [esp + 0x18]
mov ecx, 0x10
lea esi, [esp + 0x1c]
lea edx, [esp + 0x1c]
push 0xc0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.10007860
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
Function at 0x10033a60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
cmp esi, 0x80
mov byte [edx], 0
jle 0x10033a7c
mov esi, 0x80
mov ecx, dword [esp + 0x20]
test ecx, ecx
jle 0x10033a8c
cmp ecx, 0x400
jle 0x10033a91
mov ecx, 0x400
test esi, esi
jle 0x10033aa8
mov edi, dword [esp + 0x1c]
mov eax, edx
sub edi, edx
mov ebp, esi
mov bl, byte [edi + eax]
mov byte [eax], bl
inc eax
dec ebp
jne 0x10033a9f
xor eax, eax
cmp esi, 0x80
mov al, byte [edx + esi - 1]
jge 0x10033ada
mov edi, edx
sub edi, esi
mov bl, byte [edi + esi]
add ebx, eax
xor eax, eax
and ebx, 0xff
inc esi
cmp esi, 0x80
mov al, byte [ebx + 0x1006d660]
mov byte [esi + edx - 1], al
jl 0x10033aba
lea edi, [ecx + 7]
mov esi, 0x80
sar edi, 3
neg ecx
sub esi, edi
and ecx, 7
mov ebp, 0xff
xor eax, eax
mov al, byte [esi + edx]
lea ebx, [esi + edx]
sar ebp, cl
and ebp, eax
xor eax, eax
test esi, esi
mov al, byte [ebp + 0x1006d660]
mov byte [ebx], al
je 0x10033b23
mov ebp, ebx
dec ebp
xor ecx, ecx
mov cl, byte [edi + ebp]
xor ecx, eax
xor eax, eax
dec esi
mov al, byte [ecx + 0x1006d660]
mov byte [ebp], al
jne 0x10033b0d
lea esi, [edx + 0xfc]
mov eax, 0x7f
xor ecx, ecx
xor ebx, ebx
mov cl, byte [eax + edx - 1]
mov bh, byte [eax + edx]
and ecx, 0xffff
sub esi, 4
or ecx, ebx
sub eax, 2
mov dword [esi + 4], ecx
jns 0x10033b2e
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1003d630
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.10016d60
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
lea esi, [eax - 1]
push edi
mov edi, dword [esp + 0x38]
lea ecx, [esi - 0x29]
cmp edi, ecx
jle 0x1003d66f
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.10003a30
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp esi, 0x29
jge 0x1003d693
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.10003a30
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea eax, [esi - 0x14]
push 0x37
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x1c], eax
call fcn.10005140
add esp, 0xc
mov dword [esp + 0x30], eax
test eax, eax
jne 0x1003d6d1
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.10003a30
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ebx, dword [esp + 0x2c]
push 0
mov byte [ebx], 0
lea ebp, [ebx + 1]
add ebx, 0x15
call fcn.1001ba00
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push 0
push ebx
push edx
push eax
call fcn.1001eb50
mov ecx, esi
xor eax, eax
sub ecx, edi
lea edi, [ebx + 0x14]
sub ecx, 0x29
push 0x14
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x58]
mov eax, ebx
sub eax, ecx
mov edx, ecx
add eax, esi
mov esi, dword [esp + 0x54]
shr ecx, 2
lea edi, [eax - 0x14]
mov byte [eax - 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1001b800
add esp, 0x20
test eax, eax
jg 0x1003d74e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
push 0x14
push ebp
push edi
push esi
call fcn.1003d990
add esp, 0x10
test edi, edi
jle 0x1003d77a
mov eax, ebx
sub esi, ebx
mov ecx, edi
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x1003d76d
mov esi, dword [esp + 0x30]
push edi
push ebx
lea eax, [esp + 0x1c]
push 0x14
push eax
call fcn.1003d990
lea eax, [esp + 0x24]
add esp, 0x10
sub eax, ebp
mov ecx, 0x14
mov dl, byte [eax + ebp]
mov bl, byte [ebp]
xor bl, dl
mov byte [ebp], bl
inc ebp
dec ecx
jne 0x1003d796
push esi
call fcn.100053c0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x1003d7c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.10016d60
push ebx
push ebp
mov ebp, dword [esp + 0x48]
xor ebx, ebx
dec ebp
push esi
cmp ebp, 0x29
push edi
mov dword [esp + 0x10], ebx
jl 0x1003d95c
mov eax, dword [esp + 0x4c]
mov edi, ebp
sub edi, eax
jns 0x1003d7f6
mov dword [esp + 0x10], 1
xor edi, edi
mov esi, dword [esp + 0x48]
add ebp, 0xffffffec
sub esi, edi
push 0x7a
push str..crypto_rsa_rsa_oaep.c
push ebp
lea eax, [esi + 0x14]
mov dword [esp + 0x5c], eax
call fcn.10005140
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1003d83c
push 0x7d
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.10003a30
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov ecx, dword [esp + 0x50]
push ebp
push ecx
lea edx, [esp + 0x1c]
push 0x14
push edx
call fcn.1003d990
add esp, 0x10
cmp edi, 0x14
mov eax, edi
jge 0x1003d86b
mov cl, byte [esi + eax]
mov dl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x14
jl 0x1003d858
lea edx, [esp + 0x14]
push 0x14
push edx
push ebp
push ebx
call fcn.1003d990
add esp, 0x10
test ebp, ebp
jle 0x1003d897
mov esi, dword [esp + 0x50]
mov eax, ebx
sub esi, ebx
mov edi, ebp
mov cl, byte [esi + eax]
mov dl, byte [eax]
xor dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x1003d88a
push 0
call fcn.1001ba00
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x30]
push 0
push edx
push eax
push ecx
call fcn.1001eb50
add esp, 0x18
mov ecx, 5
lea edi, [esp + 0x28]
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x1003d95c
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1003d95c
mov eax, 0x14
cmp ebp, eax
jle 0x1003d8ed
cmp byte [eax + ebx], 0
jne 0x1003d8ed
inc eax
cmp eax, ebp
jl 0x1003d8e2
cmp byte [eax + ebx], 1
jne 0x1003d95c
mov ecx, eax
inc eax
cmp ecx, ebp
jge 0x1003d95c
mov ecx, dword [esp + 0x44]
sub ebp, eax
cmp ecx, ebp
jge 0x1003d932
push 0x9b
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call fcn.10003a30
add esp, 0x14
or ebp, 0xffffffff
push ebx
call fcn.100053c0
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x40]
mov ecx, ebp
mov edx, ecx
lea esi, [eax + ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100053c0
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.10003a30
add esp, 0x14
test ebx, ebx
je 0x1003d981
push ebx
call fcn.100053c0
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x10048fc0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.10016d60
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
test ebx, ebx
jne 0x10048fde
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10049064
mov esi, dword [esp + 0x20]
test esi, esi
je 0x10049035
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call fcn.10004f00
add esp, 8
test eax, eax
je 0x10049015
mov eax, dword [eax + 8]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
mov edi, 0x100605fc
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x10049035
push ebx
call dword [sym.imp.MSVCR71.dll_getenv]
add esp, 4
test eax, eax
jne 0x1004906e
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebx
call fcn.10004f00
add esp, 8
test eax, eax
je 0x10048fd5
mov eax, dword [eax + 8]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push ebx
call dword [sym.imp.MSVCR71.dll_getenv]
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1001e34
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x10011e0
call fcn.01002c88
mov edi, 0x94
mov eax, edi
call fcn.01002df0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x10010a8]
mov ecx, dword [esi + 0x10]
mov dword [0x10062b8], ecx
mov eax, dword [esi + 4]
mov dword [0x10062c4], eax
mov edx, dword [esi + 8]
mov dword [0x10062c8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10062bc], esi
cmp ecx, 2
je 0x1001e94
or esi, 0x8000
mov dword [0x10062bc], esi
shl eax, 8
add eax, edx
mov dword [0x10062c0], eax
cmp word [0x1000000], 0x5a4d
jne 0x1001ed0
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1001ed0
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1001ee9
cmp ecx, 0x20b
je 0x1001ed6
and dword [ebp - 0x1c], 0
jmp 0x1001efd
cmp dword [eax + 0x84], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1001ef7
cmp dword [eax + 0x74], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.01002c2a
pop ecx
test eax, eax
jne 0x1001f2a
cmp dword [0x10062a8], 1
jne 0x1001f17
call fcn.01002406
push 0x1c
call fcn.01002219
push 0xff
call fcn.01002078
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01002a5a
test eax, eax
jge 0x1001f3f
push 0x1b
call fcn.01001e05
pop ecx
call dword [0x10010ac]
mov dword [0x1006854], eax
call fcn.0100292d
mov dword [0x10062a0], eax
call fcn.01002884
test eax, eax
jge 0x1001f65
push 8
call fcn.01001e05
pop ecx
call fcn.0100262a
test eax, eax
jge 0x1001f76
push 9
call fcn.01001e05
pop ecx
call fcn.010020d2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1001f89
push eax
call fcn.01001e05
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [fcn.010010b0]
call fcn.010025bc
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1001fab
movzx eax, word [ebp - 0x40]
jmp 0x1001fae
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.01001c3d
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1001fcf
push esi
call fcn.010021b2
call fcn.010021ea
jmp 0x1002001
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call fcn.01002cc3
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0xb1e0bc3
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x18706074
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219