joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a740
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [esp + ebp*2]
add edx, ecx
mov dword [esi + ebp*2], edx
inc eax
cmp eax, ebx
jl 0x40a6e7
mov ecx, dword [ebp + 8]
rol bl, cl
push ebp
cmp dword [edi + 0x5b], ebx
jnp 0x40a6f7
pop ebp
ret
add bh, bh
adc eax, 0x4c40c020
add al, 8
or byte [ecx], al
cmp eax, 2
jne 0x340a88d
mov al, byte [0x41080c]
or al, 0xc
or byte [ecx], al
test al, al
je 0x40a785
mov esi, edi
push 0xa100e9c1
je 0x40a7de
inc eax
jbe 0x40a6f2
dec eax
add dword [esi + 0xe], edi
xor ecx, ecx
and eax, dword [edx + ecx*4]
mov bl, 0x4d
call edi
iretd
add byte [ebx], dh
rol byte [0x8a088b16], cl
lodsb al, byte [esi]
push ecx
add al, ah
add al, 0x3d
sal dword [ebp + 0x36], 0x8a
inc esi
add dword [esi - 0x7c], eax
sal byte [ebp - 0x35], 0x8b
aas
scasb al, byte es:[edi]
or byte [ecx], al
mov eax, dword [0x314107ee]
cmp eax, 3
jb 0x40a996
je 0x40a911
cmp eax, 4
jne 0x40a822
cmp ecx, 2
jae 0x40a7e5
mov eax, 0x28
jmp 0x40a8cd
or eax, 0x6c08e0
jmp 0x40a805
xor dword [edx], ecx
mov eax, 0x2a
jmp 0x1640a916
mov eax, 0x2c
jmp 0x96a216
cmp eax, 5
add dword [ebp - 0x22], edx
add byte [eax + 0x41], bh
add byte [ebp - 0x7ae18a40], al
leave
jne 0x40a83e
sal dword [edx], cl
add byte [eax], al
add cl, ch
fcomp dword [ecx]
add byte [ebx], dh
rol byte [ebx - 0x6af0fe07], 0xc0
cmp ecx, 1
setne al
xor eax, eax
add byte [eax], al
popal
rol byte [ebx - 0x1051fe07], 0xc0
and ebx, 0x3d
jmp 0x96a916
add byte [eax], al
add byte [eax + edi*8 - 0x5f800eff], ah
or al, 8
inc ecx
add byte [edx], dl
or al, 8
push edi
std
test al, al
je 0x40a8db
sub al, 0x3d
push 0x13240c1
je 0x40a86a
add dword [ecx + eax*8 + 0x40], esi
inc eax
add byte [ebx + 0x1b7ed3f6], al
xor ecx, ecx
push 1
mov cl, byte [esi]
push ecx
dec edi
add esp, 8
jmp 0x40a8cf
loopne 0x40a8d0
xchg edx, eax
push 0xffffffffffffffcc
pushal
mov cl, byte [esi - 0x3fd0b9ff]
jne 0x40a8a6
or byte [eax], al
or byte [ecx], al
cmp eax, 0xa
jae 0x40a8f5
mov cl, byte [esi]
xor eax, eax
inc eax
leave
inc ebx
setge al
lea eax, [eax + eax + 0xa]
jmp fcn.0040a925
adc eax, edi
pop edx
jae 0x40a962
mov cl, byte [esi]
jl 0x40a88a
pop esp
stc
inc ecx
setge al
ror byte [ebp - 0x1484ffbc], 0xc
mov eax, 0x19000001
adc eax, 0x57c018
test dword [esi - 0x77], ebp
push es
jne 0x40a970
pop esi
hlt
nop
lahf
nop
push ebp
nop
rcl dword [eax - 0x606f6f70]
lahf
Function at 0x1000137f
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
jmp 0x10030150
mov eax, 8
call fcn.101aa6d0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push 0x1048
push 0x101e42a8
push esi
call fcn.101aa710
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov eax, 0x48
add esp, 0xc
cmp ecx, eax
cmovg ecx, eax
mov eax, edi
lea ebx, [ecx + edi]
xor ebp, ebp
mov edi, edi
movzx edx, byte [eax]
inc eax
cmp eax, ebx
cmovae eax, edi
shl edx, 8
movzx ecx, byte [eax]
or edx, ecx
inc eax
cmp eax, ebx
cmovae eax, edi
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, ebx
cmovae eax, edi
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, ebx
cmovae eax, edi
xor dword [esi + ebp*4], edx
inc ebp
cmp ebp, 0x12
jl 0x10030190
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor edi, edi
mov edi, edi
lea eax, [esp + 0x10]
push esi
push eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x18]
mov dword [esi + edi*4], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + edi*4 + 4], eax
add edi, 2
add esp, 8
cmp edi, 0x12
jl 0x100301e0
xor edi, edi
lea eax, [esp + 0x10]
push esi
push eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x18]
mov dword [esi + edi*4 + 0x48], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + edi*4 + 0x4c], eax
add edi, 2
add esp, 8
cmp edi, 0x400
jl 0x10030207
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x100014ce
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x100334f0
cmp dword [esp + 8], 0
je 0x10033508
push 0x16b
push str...crypto_bio_b_sock.c
push 0x8c
jmp 0x10033584
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 0x1c
push dword [eax]
call fcn.10002b67
add esp, 4
push eax
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x1003356e
push 0x160
push str...crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x10
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x161
push str...crypto_bio_b_sock.c
push 0x84
push 0x8d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
xor eax, eax
ret
cmp dword [esp + 8], 0x1c
jbe 0x10033596
push 0x165
push str...crypto_bio_b_sock.c
push 0x85
push 0x8d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
ret
mov eax, 1
ret

Function at 0x1000150a
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x100335d0
cmp dword [0x10275e08], 0
jne 0x10033641
push 0x190
push 0
push 0x10275e10
mov dword [0x10275e08], 1
call fcn.101aad60
add esp, 0xc
push 0x10275e10
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10033641
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x87
push str...crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x88
push str...crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
or eax, 0xffffffff
ret
mov eax, 1
ret
Function at 0x100016e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x101139f0
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0x10
ja 0x101139fe
xor eax, eax
pop edi
ret
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push dword [esp + 0x28]
mov esi, dword [esp + 0x18]
mov ebx, edi
push ebp
push dword [esp + 0x28]
mov eax, 0x10
and ebx, 0xf
cmove ebx, eax
sub edi, ebx
push edi
push dword [esp + 0x28]
push esi
call sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
add dword [esp + 0x30], edi
add esp, 0x18
add esi, edi
test ebx, ebx
je 0x10113a4b
mov ecx, ebp
sub esi, ebp
mov edx, ebx
nop
mov al, byte [esi + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x10113a40
push dword [esp + 0x20]
push ebp
push ebp
call dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push ebx
lea esi, [eax - 0x10]
push esi
push eax
call fcn.101aa710
movq xmm0, qword [ebp]
add esp, 0x18
movq qword [esi], xmm0
movq xmm0, qword [ebp + 8]
movq qword [esi + 8], xmm0
pop esi
pop ebp
lea eax, [ebx + edi]
pop ebx
pop edi
ret
Function at 0x10001faa
Capabilities:
Query environment variable

Disassembly:
jmp 0x1006fa30
mov eax, 8
call fcn.101aa6d0
cmp dword [0x10276068], 0
jne 0x1006fb7d
push ebx
push ebp
push edi
push 0x30
push 0x10276070
push str.OPENSSL_ia32cap
mov dword [0x10276068], 1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x1006fb57
xor ebx, ebx
cmp word [0x10276070], 0x7e
sete bl
lea eax, [ebx*2 + 0x10276070]
push eax
call fcn.100700b0
add esp, 4
mov edi, eax
mov ebp, edx
test ebx, ebx
je 0x1006fac5
push esi
push 0x1027ac70
mov esi, edi
mov dword [esp + 0x18], ebp
call fcn.101a4700
add esp, 4
not edi
not ebp
and esi, 0x1000000
and edi, eax
and ebp, edx
or esi, 0
pop esi
je 0x1006fae0
and ebp, 0xedfff7fd
jmp 0x1006fae0
cmp word [0x10276070], 0x3a
jne 0x1006fae0
push 0x1027ac70
call fcn.101a4700
add esp, 4
mov edi, eax
mov ebp, edx
mov ax, word [0x10276070]
mov ecx, 0x10276070
movzx edx, ax
test ax, ax
je 0x1006fb05
cmp dx, 0x3a
je 0x1006fb1b
movzx edx, word [ecx + 2]
add ecx, 2
test dx, dx
jne 0x1006faf3
mov dword [0x1027ac78], 0
mov dword [0x1027ac7c], 0
jmp 0x1006fb68
xor ebx, ebx
cmp word [ecx + 2], 0x7e
sete bl
lea eax, [ebx + 1]
lea eax, [ecx + eax*2]
push eax
call fcn.100700b0
add esp, 4
test ebx, ebx
je 0x1006fb4a
not eax
and dword [0x1027ac78], eax
not edx
and dword [0x1027ac7c], edx
jmp 0x1006fb68
mov dword [0x1027ac78], eax
mov dword [0x1027ac7c], edx
jmp 0x1006fb68
push 0x1027ac70
call fcn.101a4700
add esp, 4
mov edi, eax
mov ebp, edx
or edi, 0x400
mov dword [0x1027ac70], edi
pop edi
mov dword [0x1027ac74], ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100022a7
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x1004d920
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push ebp
xor edi, edi
call sym.libcrypto_1_1.dll_BN_CTX_start
push ebp
call sym.libcrypto_1_1.dll_BN_CTX_get
mov esi, eax
add esp, 8
test esi, esi
je 0x1004dafe
push ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 4]
add eax, eax
push eax
push esi
call fcn.100060af
add esp, 8
test eax, eax
je 0x1004dafd
mov ebp, dword [ebx + 4]
dec ebp
js 0x1004dad0
mov eax, dword [ebx]
mov edx, dword [eax + ebp*4]
mov ecx, edx
shr ecx, 1
and ecx, 0x8000
mov eax, edx
and eax, 0x20000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x40000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x80000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x100000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x200000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x400000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x800000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x1000000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x2000000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x4000000
or ecx, eax
shr ecx, 1
mov eax, edx
and eax, 0x8000000
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
mov eax, dword [esi]
and edx, reloc.WS2_32.dll_accept
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + ebp*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + ebp*4]
mov edx, ecx
and edx, 0x8000
add edx, edx
mov eax, ecx
and eax, 0x4000
or edx, eax
add edx, edx
mov eax, ecx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
add edx, edx
mov eax, ecx
and eax, 0x800
or edx, eax
add edx, edx
mov eax, ecx
and eax, 0x400
or edx, eax
add edx, edx
mov eax, ecx
and eax, 0x200
or edx, eax
add edx, edx
mov eax, ecx
and eax, 0x100
or edx, eax
add edx, edx
mov eax, ecx
and eax, 0x80
or edx, eax
add edx, edx
mov eax, ecx
and eax, 0x40
or edx, eax
add edx, edx
mov eax, ecx
and eax, 0x20
or edx, eax
add edx, edx
mov eax, ecx
and eax, 0x10
or edx, eax
add edx, edx
mov eax, ecx
and eax, 8
or edx, eax
add edx, edx
mov eax, ecx
and eax, 4
or edx, eax
add edx, edx
mov eax, ecx
and eax, 2
or edx, eax
mov eax, dword [esi]
add edx, edx
and ecx, 1
or edx, ecx
dec ebp
mov dword [eax + ebp*8 + 8], edx
jns 0x1004d968
mov eax, dword [ebx + 4]
add eax, eax
push esi
mov dword [esi + 4], eax
call fcn.10002167
push dword [esp + 0x20]
push esi
push dword [esp + 0x20]
call sym.libcrypto_1_1.dll_BN_GF2m_mod_arr
mov ebp, dword [esp + 0x30]
add esp, 0x10
mov ecx, 1
test eax, eax
cmovne edi, ecx
pop ebx
push ebp
call sym.libcrypto_1_1.dll_BN_CTX_end
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x100022de
Capabilities:
Write file on windows

Disassembly:
jmp 0x10139fe0
mov eax, 0x434
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x430], eax
push esi
mov esi, dword [esp + 0x43c]
lea eax, [esp + 4]
push eax
push esi
call fcn.101ada28
add esp, 8
test eax, eax
js 0x1013a05a
test dword [esp + 0xa], 0x8000
jne 0x1013a05a
push 0xb7
push str...crypto_rand_randfile.c
push 0x7a
push 0x70
push 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
push esi
push str.Filename
push 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.101aa6fb
add esp, 0x434
ret
lea eax, [esp + 0x34]
push 0x400
push eax
call sym.libcrypto_1_1.dll_RAND_priv_bytes
add esp, 8
cmp eax, 1
jne 0x1013a041
push edi
push 0x102341f0
push esi
call fcn.100038cd
mov edi, eax
add esp, 8
test edi, edi
jne 0x1013a0c5
push 0xe9
push str...crypto_rand_randfile.c
push 0x79
push 0x70
push 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
push esi
push str.Filename
push 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.101aa6fb
add esp, 0x434
ret
push 0x180
push esi
call fcn.101b08be
push edi
push 0x400
lea eax, [esp + 0x48]
push 1
push eax
call fcn.101aaf47
push edi
mov esi, eax
call fcn.101ac934
lea eax, [esp + 0x54]
push 0x400
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0x45c]
add esp, 0x24
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.101aa6fb
add esp, 0x434
ret
Function at 0x1000261c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x10112960
mov eax, 0x5c
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x64]
push ebx
mov ebx, dword [esp + 0x74]
xor ecx, ecx
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], ecx
cmp dword [esp + 0x70], ecx
jbe 0x10112af4
lea eax, [esp + 0x3c]
sub eax, ebx
push ebp
push esi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x45]
mov esi, ebx
sub esi, eax
lea eax, [ebx + 2]
mov dword [esp + 0x1c], esi
lea edx, [eax - 1]
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], edx
movq xmm0, qword [ebx]
mov eax, ecx
and eax, 7
mov ebp, 7
sub ebp, eax
mov eax, ecx
mov ecx, dword [esp + 0x70]
shr eax, 3
mov dword [esp + 0x24], eax
mov al, byte [eax + ecx]
mov ecx, ebp
mov edx, 1
shl edx, cl
push edi
movq qword [esp + 0x48], xmm0
movq xmm0, qword [ebx + 8]
and al, dl
neg al
sbb al, al
and al, 0x80
push ebx
push ebx
mov dword [esp + 0x4c], ebp
mov byte [esp + 0x1f], al
movq qword [esp + 0x58], xmm0
call dword [esp + 0x44]
add esp, 0xc
cmp dword [esp + 0x88], 0
je 0x10112a3e
movzx edx, byte [ebx]
movzx eax, byte [esp + 0x13]
xor edx, eax
mov byte [esp + 0x54], dl
jmp 0x10112a4a
mov al, byte [esp + 0x13]
mov dl, byte [ebx]
mov byte [esp + 0x54], al
xor dl, al
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x28]
xor ebp, ebp
lea edi, [esp + 0x45]
add edi, ebp
add esi, edi
mov ah, byte [edi]
movzx ecx, byte [esi + edx]
mov bl, byte [edi + 1]
add cl, cl
mov al, ah
shr al, 7
or cl, al
mov al, bl
shr al, 7
mov byte [esi], cl
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
add ah, ah
or al, ah
mov byte [ecx + ebp], al
mov cl, byte [edi + 2]
mov al, cl
shr al, 7
add bl, bl
or al, bl
mov ebx, dword [esp + 0x30]
add cl, cl
mov byte [ebx + ebp], al
mov al, byte [edi + 3]
shr al, 7
or al, cl
mov byte [ebx + ebp + 1], al
add ebp, 4
cmp ebp, 0x10
jl 0x10112a54
mov cl, byte [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
and cl, 7
and dl, 0x80
shr dl, cl
mov ecx, dword [esp + 0x40]
mov al, 1
shl al, cl
mov ecx, dword [esp + 0x24]
not al
and al, byte [ecx + edi]
or dl, al
mov byte [ecx + edi], dl
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x3c]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, dword [esp + 0x78]
jb 0x101129d0
pop esi
pop ebp
mov ecx, dword [esp + 0x60]
pop edi
pop ebx
xor ecx, esp
call fcn.101aa6fb
add esp, 0x5c
ret
Function at 0x10002806
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10114030
push esi
mov esi, dword [esp + 0x10]
cmp esi, 0x10
jae 0x1011403e
xor eax, eax
pop esi
ret
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push edi
push dword [esp + 0x28]
mov edi, dword [esp + 0x18]
push ebp
push dword [esp + 0x28]
mov ebx, esi
and ebx, 0xf
sub esi, ebx
push esi
push dword [esp + 0x28]
push edi
call sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
add esp, 0x18
test ebx, ebx
jne 0x10114072
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
ret
add dword [esp + 0x18], esi
add edi, esi
test ebx, ebx
je 0x1011408d
mov ecx, ebp
sub edi, ebp
mov edx, ebx
mov al, byte [edi + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x10114082
push dword [esp + 0x20]
push ebp
push ebp
call dword [esp + 0x34]
movq xmm0, qword [ebp]
mov eax, dword [esp + 0x24]
add esp, 0xc
movq qword [ebx + eax - 0x10], xmm0
movq xmm0, qword [ebp + 8]
pop edi
movq qword [ebx + eax - 8], xmm0
pop ebp
lea eax, [ebx + esi]
pop ebx
pop esi
ret
Function at 0x100029b4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x101132f0
mov eax, 8
call fcn.101aa6d0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x1011333d
mov edx, dword [esp + 0x30]
test esi, esi
je 0x1011333d
mov al, byte [edi + edx]
xor al, byte [ebp]
dec esi
mov byte [ebx], al
inc edi
inc ebx
inc ebp
and edi, 0xf
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
jne 0x10113320
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
mov ecx, dword [eax + 0xc]
bswap ecx
mov dword [esp + 0x24], ecx
cmp esi, 0x10
jb 0x101133d0
mov edi, esi
shr edi, 4
add ecx, edi
mov dword [esp + 0x24], ecx
cmp ecx, edi
jae 0x1011336a
sub edi, ecx
xor ecx, ecx
mov dword [esp + 0x24], ecx
push eax
push dword [esp + 0x2c]
push edi
push ebx
push ebp
call edx
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x40]
mov eax, ecx
bswap eax
add esp, 0x14
mov dword [edx + 0xc], eax
test ecx, ecx
jne 0x101133b2
mov esi, dword [esp + 0x2c]
mov edx, 0xc
mov ecx, 1
movzx eax, byte [edx + esi - 1]
dec edx
add ecx, eax
mov byte [edx + esi], cl
shr ecx, 8
test edx, edx
jne 0x10113398
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
shl edi, 4
sub esi, edi
add ebx, edi
add ebp, edi
mov dword [esp + 0x10], esi
cmp esi, 0x10
jae 0x10113353
mov edi, dword [esp + 0x14]
test esi, esi
je 0x10113427
mov ecx, dword [esp + 0x30]
push eax
push dword [esp + 0x2c]
xorps xmm0, xmm0
push 1
push ecx
movq qword [ecx], xmm0
push ecx
movq qword [ecx + 8], xmm0
call edx
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x40]
add esp, 0x14
inc eax
bswap eax
mov dword [edx + 0xc], eax
jne 0x1011340b
push edx
call fcn.101134f0
add esp, 4
mov edx, dword [esp + 0x30]
sub ebp, edx
lea ecx, [edi + edx]
sub ebx, edx
add edi, esi
mov al, byte [ecx + ebp]
xor al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebx + ecx - 1], al
dec esi
jne 0x10113418
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10002cb1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10078e80
mov eax, 0x98
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa0]
push edi
mov edi, dword [esp + 0xa8]
mov al, byte [ecx]
mov byte [edi], al
movsx eax, al
test eax, eax
je 0x1007906e
cmp eax, 0x80
jae 0x1007906e
push ebx
movzx ebx, byte [eax + 0x101f3ee8]
mov al, byte [ecx + 1]
mov byte [edi + 1], al
movsx eax, al
shl ebx, 2
test eax, eax
je 0x10079055
cmp eax, 0x80
jae 0x10079055
mov edx, dword [esp + 0xa4]
push esi
movzx esi, byte [eax + 0x101f3ee8]
shl esi, 6
xor eax, eax
lea esp, [esp]
mov cl, byte [edx]
lea edx, [edx + 1]
test cl, cl
je 0x10078f1a
add cl, cl
mov byte [esp + eax + 0x94], cl
inc eax
cmp eax, 8
jb 0x10078f00
jmp 0x10078f2d
cmp eax, 8
jae 0x10078f2d
mov byte [esp + eax + 0x94], 0
inc eax
cmp eax, 8
jb 0x10078f1f
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x98]
push eax
call sym.libcrypto_1_1.dll_DES_set_key_unchecked
push esi
push ebx
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10075940
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 8
mov byte [esp + 0xad], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0xac], cl
shr ecx, 0x18
mov byte [esp + 0xae], al
mov byte [esp + 0xaf], cl
mov ecx, dword [esp + 0x28]
mov eax, ecx
shr eax, 8
mov byte [esp + 0xb1], al
mov eax, ecx
shr eax, 0x10
add esp, 0x18
mov byte [esp + 0x98], cl
shr ecx, 0x18
mov byte [esp + 0x9a], al
mov byte [esp + 0x9b], cl
mov al, 0x80
mov byte [esp + 0x9c], 0
mov esi, 2
lea edx, [esp + 0x94]
mov ebx, 1
xor cl, cl
test byte [edx], al
movzx ecx, cl
cmovne ecx, ebx
shr al, 1
jne 0x10078fd9
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x10078fe1
or cl, bl
shr al, 1
jne 0x10078fe8
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x10078ff0
or cl, bl
shr al, 1
jne 0x10078ff7
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x10078fff
or cl, bl
shr al, 1
jne 0x10079006
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x1007900e
or cl, bl
shr al, 1
jne 0x10079015
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x1007901d
or cl, bl
shr al, 1
jne 0x10079024
inc edx
mov al, 0x80
movzx ecx, cl
inc esi
mov cl, byte [ecx + 0x101f3f68]
mov byte [edi + esi - 1], cl
cmp esi, 0xd
jb 0x10078fc8
pop esi
pop ebx
mov byte [edi + 0xd], 0
mov eax, edi
pop edi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.101aa6fb
add esp, 0x98
ret
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.101aa6fb
add esp, 0x98
ret
mov ecx, dword [esp + 0x98]
pop edi
xor ecx, esp
xor eax, eax
call fcn.101aa6fb
add esp, 0x98
ret
Function at 0x1000340e
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x10158060
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.101aad60
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret
Function at 0x10003436
Capabilities:
Set socket configuration

Disassembly:
jmp 0x10033af0
mov eax, 8
call fcn.101aa6d0
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 1
mov dword [esp + 8], 4
cmp esi, 0xffffffff
jne 0x10033b39
push 0xd5
push str...crypto_bio_b_sock2.c
push 0x87
push 0x8b
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop esi
add esp, 8
ret
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0x1008
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10033ce9
cmp dword [esp + 8], 4
jne 0x10033ce9
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push esi
call sym.libcrypto_1_1.dll_BIO_socket_nbio
add esp, 8
test eax, eax
jne 0x10033b88
pop ebx
pop esi
add esp, 8
ret
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x10033bd7
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push esi
call edi
test eax, eax
je 0x10033bd7
push 0xe7
push str...crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0xe8
push str...crypto_bio_b_sock2.c
push 0x89
jmp 0x10033cc5
test bl, 0x10
je 0x10033c1c
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push esi
call edi
test eax, eax
je 0x10033c1c
push 0xf0
push str...crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0xf1
push str...crypto_bio_b_sock2.c
push 0x8a
jmp 0x10033cc5
push dword [esp + 0x1c]
call sym.libcrypto_1_1.dll_BIO_ADDR_family
add esp, 4
cmp eax, 0x17
jne 0x10033c75
mov eax, ebx
shr eax, 1
and eax, 1
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0x1b
push 0x29
push esi
call edi
test eax, eax
je 0x10033c75
push 0xff
push str...crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push pe_nt_image_headers32
push str...crypto_bio_b_sock2.c
push 0x88
jmp 0x10033cc5
push ebx
push dword [esp + 0x20]
push esi
call sym.libcrypto_1_1.dll_BIO_bind
add esp, 0xc
test eax, eax
je 0x10033cd4
cmp dword [esp + 0x18], 2
je 0x10033cdd
push closesocket
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x10033cdd
push 0x10a
push str...crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 7
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x10b
push str...crypto_bio_b_sock2.c
push 0x77
push 0x8b
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 8
ret
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 8
ret
push 0xdc
push str...crypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xf
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0xdd
push str...crypto_bio_b_sock2.c
push 0x86
push 0x8b
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
xor eax, eax
pop esi
add esp, 8
ret