joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d720
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100f7910
mov eax, 0x34
call fcn.100011c0
mov eax, dword [0x102293a4]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov dword [esp], ecx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
mov esi, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x44]
cmp eax, 0x10
ja 0x100f7960
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1000b910
add esp, 0x34
ret
push ebx
mov ebx, eax
mov dword [esp + 0x14], 0x10
and ebx, 0xf
lfence
cmove ebx, dword [esp + 0x14]
sub eax, ebx
mov dword [esp + 0x1c], eax
add eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x100f79a3
push ecx
push ebp
push edx
push eax
push esi
push edi
call sym.libcrypto_1_1.dll_CRYPTO_cbc128_decrypt
add edi, dword [esp + 0x2c]
add esp, 0x18
add esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x34]
push eax
push edi
call dword [section..00cfg]
call dword [esp + 0x1c]
movups xmm0, xmmword [esp + 0x3c]
push ebx
lea eax, [edi + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
movups xmmword [esp + 0x38], xmm0
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x38]
add esp, 0x18
push dword [esp + 0x18]
push eax
push eax
call dword [section..00cfg]
call dword [esp + 0x1c]
lea ecx, [esp + 0x3b]
add esp, 0xc
xor eax, eax
lea edx, [ebp + 0xf]
cmp ebp, ecx
ja 0x100f7a00
lea ecx, [esp + 0x20]
cmp edx, ecx
jae 0x100f7a34
lea ecx, [esi + 0xf]
cmp ebp, ecx
ja 0x100f7a0b
cmp edx, esi
jae 0x100f7a34
lea ecx, [edi + 0xf]
cmp ebp, ecx
lea ecx, [esi + 0xf]
ja 0x100f7a19
cmp edx, edi
jae 0x100f7a34
lea edx, [esp + 0x2f]
cmp esi, edx
ja 0x100f7a29
lea edx, [esp + 0x20]
cmp ecx, edx
jae 0x100f7a34
lea edx, [edi + 0xf]
cmp esi, edx
ja 0x100f7a4c
cmp ecx, edi
jb 0x100f7a4c
mov cl, byte [esp + eax + 0x20]
xor cl, byte [eax + ebp]
mov dl, byte [edi + eax]
mov byte [esi + eax], cl
mov byte [eax + ebp], dl
inc eax
cmp eax, 0x10
jb 0x100f7a34
jmp 0x100f7a68
movups xmm1, xmmword [ebp]
mov eax, 0x10
movups xmm0, xmmword [esp + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [edi]
movups xmmword [esi], xmm1
movups xmmword [ebp], xmm0
add ebx, 0x10
cmp eax, ebx
jae 0x100f7a8a
lea ecx, [esp + 0x20]
sub edi, ecx
sub esi, ecx
lea edx, [esp + 0x20]
add edx, eax
inc eax
mov cl, byte [edi + edx]
xor cl, byte [edx]
mov byte [esi + edx], cl
cmp eax, ebx
jb 0x100f7a77
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
add eax, ebx
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1000b910
add esp, 0x34
ret
Function at 0x1000f060
Capabilities:
Check if file exists

Disassembly:
jmp 0x10051da0
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.1000e720
push 0x62
push esi
mov edi, eax
mov ebx, 1
call sub.VCRUNTIME140.dll_strchr
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x10051e47
push 0x45
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x101a3404
push esi
push 0x101a3408
push dword [esp + 0x30]
push str.fopen_
push 5
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x2c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 2
je 0x10051e24
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 6
je 0x10051e24
lea eax, [edi + 2]
lea ecx, [edi + 0x4e]
jmp 0x10051e2e
mov eax, 0x80
mov ecx, 0x4c
push ecx
push str.crypto_bio_bss_file.c
push eax
push 0x6d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x101a339c
call sym.libcrypto_1_1.dll_BIO_new
mov esi, eax
add esp, 4
test esi, esi
jne 0x10051e6a
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x8000
push esi
call sym.libcrypto_1_1.dll_BIO_clear_flags
push edi
push ebx
push 0x6a
push esi
call sym.libcrypto_1_1.dll_BIO_ctrl
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x1000f720
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100f2c10
mov eax, 4
call fcn.100011c0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x100f2c90
mov cl, byte [edi]
test cl, cl
je 0x100f2c90
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x100f2c40
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x1000f920
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x101496a0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0xc]
mov edi, eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
ret
Function at 0x1000fa50
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x10065740
mov eax, 4
call fcn.100011c0
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push ebp
xor edi, edi
call sym.libcrypto_1_1.dll_BN_CTX_start
push ebp
call sym.libcrypto_1_1.dll_BN_CTX_get
mov esi, eax
add esp, 8
test esi, esi
je 0x1006592f
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + 4]
add eax, eax
push eax
push esi
call fcn.100093b0
add esp, 8
test eax, eax
je 0x1006592e
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x10065908
mov ebp, ecx
mov eax, dword [ebx]
mov edx, dword [eax + ebp*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + ebp*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + ebp*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + ebp*8], edx
sub ebp, 1
jns 0x10065798
mov eax, dword [ebx + 4]
mov ebp, dword [esp + 0x24]
add eax, eax
push esi
mov dword [esi + 4], eax
call fcn.10011b20
push dword [esp + 0x24]
push esi
push dword [esp + 0x24]
call sym.libcrypto_1_1.dll_BN_GF2m_mod_arr
add esp, 0x10
mov ecx, 1
test eax, eax
cmovne edi, ecx
pop ebx
push ebp
call sym.libcrypto_1_1.dll_BN_CTX_end
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x1000fab0
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x10137440
mov eax, dword [esp + 4]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x1000fd40
Capabilities:
Hash data with md5

Disassembly:
jmp 0x100f3200
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x10]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret

Function at 0x1000fdb0
Capabilities:
Generate random numbers via winapi

Disassembly:
jmp 0x1011e430
push ebx
push edi
mov edi, dword [esp + 0xc]
push 1
push edi
call fcn.10009330
mov ebx, eax
push ebx
push edi
call fcn.10010da0
add esp, 0x10
test eax, eax
je 0x1011e483
push esi
push 2
push ebx
push eax
xor esi, esi
push esi
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
cmove esi, ebx
lea eax, [esi*8]
push eax
push esi
push edi
call fcn.100139c0
push edi
call fcn.1000da80
add esp, 0x10
pop esi
test eax, eax
je 0x1011e483
pop edi
lfence
pop ebx
ret
push edi
lfence
call fcn.1000da80
add esp, 4
pop edi
pop ebx
ret
Function at 0x10011000
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100f7510
mov eax, 0xc
call fcn.100011c0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x38]
mov edi, dword [edi]
mov dword [esp + 0x18], edi
test edi, edi
je 0x100f7559
mov ecx, dword [esp + 0x34]
nop dword [eax]
test esi, esi
je 0x100f7559
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x18], edi
jne 0x100f7540
mov ecx, dword [esp + 0x30]
movzx edx, byte [ecx + 0xc]
movzx eax, byte [ecx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xf]
shl edx, 8
or edx, eax
mov dword [esp + 0x10], edx
cmp esi, 0x10
jb 0x100f762f
mov edi, ecx
nop dword [eax + eax]
mov ecx, esi
shr ecx, 4
push edi
push dword [esp + 0x30]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x1c], edx
xor edx, edx
push dword [esp + 0x1c]
cmp eax, ecx
mov ecx, dword [esp + 0x48]
push ebx
cmovae edx, eax
push ebp
mov dword [esp + 0x24], edx
call dword [section..00cfg]
call dword [esp + 0x50]
mov edx, dword [esp + 0x24]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x100f760d
mov edx, 0xc
mov eax, 1
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x100f75f7
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x100f7590
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], edx
test esi, esi
je 0x100f76a7
mov eax, dword [esp + 0x34]
xorps xmm0, xmm0
push ecx
push dword [esp + 0x30]
mov ecx, dword [esp + 0x44]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [section..00cfg]
call dword [esp + 0x50]
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov edx, dword [esp + 0x30]
inc ecx
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
test ecx, ecx
jne 0x100f7688
push edx
call fcn.100f7780
add esp, 4
mov eax, dword [esp + 0x34]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x100f7695
mov eax, dword [esp + 0x38]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x100111b0
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x10048a20
cmp dword [0x10229548], 0
jne 0x10048a91
push 0x190
push 0
push 0x10229550
mov dword [0x10229548], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x10229550
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10048a91
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x87
push str.crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x88
push str.crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
or eax, 0xffffffff
ret
mov eax, 1
ret

Function at 0x10011220
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10087170
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x10087197
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x10087186
pop edi
movzx eax, dl
pop esi
ret
Function at 0x10011570
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x101204a0
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x14]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
ret

Function at 0x10011830
Capabilities:
Set socket configuration

Disassembly:
jmp 0x10048ac0
push esi
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x10048af8
push 0xc3
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
mov eax, esi
pop esi
ret

Function at 0x10011950
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10066b10
mov eax, 8
call fcn.100011c0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
je 0x10066c57
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 4]
lea edx, [eax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
xor eax, ecx
dec edx
and eax, edx
mov dword [esp + 0xc], edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
mov edx, dword [esp + 0x20]
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
test edx, edx
jle 0x10066c57
push esi
push edi
cmp edx, 4
jb 0x10066c2d
mov esi, dword [ebp]
lea ecx, [edx - 1]
mov edi, dword [ebx]
lea ebp, [edx - 1]
lea ebp, [esi + ebp*4]
cmp edi, ebp
lea ecx, [edi + ecx*4]
mov ebp, dword [esp + 0x20]
ja 0x10066bba
cmp ecx, esi
jae 0x10066c2d
cmp edi, ebx
ja 0x10066bc2
cmp ecx, ebx
jae 0x10066c2d
cmp edi, ebp
ja 0x10066bca
cmp ecx, ebp
jae 0x10066c2d
lea ecx, [edx - 1]
lea ecx, [esi + ecx*4]
cmp esi, ebx
ja 0x10066bd8
cmp ecx, ebx
jae 0x10066c2d
cmp esi, ebp
ja 0x10066be0
cmp ecx, ebp
jae 0x10066c2d
mov ecx, edx
and ecx, reloc.WS2_32.dll_closesocket
jns 0x10066bef
dec ecx
or ecx, 0xfffffffc
inc ecx
mov dword [esp + 0x10], edx
sub dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
nop dword [eax + eax]
movups xmm3, xmmword [edi + eax*4]
movups xmm2, xmmword [esi + eax*4]
movaps xmm1, xmm3
pxor xmm1, xmm2
pand xmm1, xmm4
movaps xmm0, xmm1
pxor xmm1, xmm3
pxor xmm0, xmm2
movups xmmword [esi + eax*4], xmm0
movups xmmword [edi + eax*4], xmm1
add eax, 4
cmp eax, ecx
jl 0x10066c00
cmp eax, edx
jge 0x10066c55
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x14]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x28]
jl 0x10066c31
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10011be0
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x101337f0
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x14]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
ret
Function at 0x10012f20
Capabilities:
Hash data with md5

Disassembly:
jmp 0x100f3ea0
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x10]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x10013270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x100406e0
jmp sym.libcrypto_1_1.dll_ASN1_STRING_free
Function at 0x100508e0
Capabilities:
Set socket configuration

Disassembly:
mov eax, 0x30
call fcn.100011c0
mov eax, dword [0x102293a4]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push ebx
mov dword [esp + 0x1c], eax
mov ebx, dword [eax + 0x24]
mov dword [esp + 0x18], ebx
cmp dword [ebx + 0x28], 0
jg 0x10050915
cmp dword [ebx + 0x2c], 0
jle 0x10050ab3
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 4
push ecx
lea ecx, [esp + 8]
push ecx
push 0x1006
push 0xffff
push dword [eax + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jns 0x1005094e
push str.getsockopt
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
jmp 0x10050977
mov ecx, dword [esp + 4]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebx + 0x30], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [ebx + 0x34], eax
push ebp
push esi
push edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ebx, dword [esp + 0x14]
mov edx, 0xe57a42bd
mov ecx, dword [esp + 0x18]
add ebx, 0x2ac18000
mov eax, ebx
mov dword [esp + 0x20], ebx
adc ecx, 0xfe624e21
mov ebp, 0xd6bf94d5
mul edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov esi, edx
mov eax, ebx
mul ebp
mov edi, eax
mov ebp, edx
mov eax, ecx
mov ecx, 0xe57a42bd
mul ecx
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 0x10]
mov edx, 0xd6bf94d5
mul edx
add ecx, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x10], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [esp + 0x20]
adc ebp, 0
mov dword [esp + 0x14], edi
xor eax, eax
add ebx, ebp
mov ebp, dword [esp + 0x10]
adc eax, eax
add ebp, ebx
adc edx, eax
shrd ebp, edx, 0x17
imul eax, ebp, 0x989680
sub ecx, eax
mov eax, 0x66666667
imul ecx
mov eax, dword [esi + 0x2c]
mov edi, eax
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esi + 0x28]
sub edi, ecx
cmp eax, ecx
jge 0x10050a3f
add edi, 0xf4240
dec edx
cmp edx, ebp
jge 0x10050a4a
xor edx, edx
lea edi, [edx + 1]
jmp 0x10050a4c
sub edx, ebp
mov ecx, dword [esi + 0x30]
test ecx, ecx
jne 0x10050a58
cmp dword [esi + 0x34], ecx
je 0x10050a63
cmp ecx, edx
jg 0x10050a63
jne 0x10050ab0
cmp dword [esi + 0x34], edi
jl 0x10050ab0
imul ecx, edx, 0x3e8
mov eax, 0x10624dd3
imul edi
push 4
sar edx, 6
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
push 0x1006
push 0xffff
push dword [eax + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10050ab0
push str.setsockopt
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
pop ebx
xor ecx, esp
call fcn.1000b910
add esp, 0x30
ret
Function at 0x100622e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.100011c0
push ebx
push esi
mov esi, dword [esp + 0x48]
mov ebx, 1
push edi
push dword [esp + 0x40]
mov edi, dword [esp + 0x48]
mov ecx, esi
push dword [esp + 0x40]
shl ebx, cl
call fcn.100093b0
add esp, 8
test eax, eax
jne 0x10062319
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
push ebp
cmp esi, 3
jg 0x10062382
xor ebp, ebp
cmp dword [esp + 0x44], ebp
jle 0x100624d8
nop dword [eax + eax]
xor esi, esi
xor eax, eax
test ebx, ebx
jle 0x10062364
nop dword [eax + eax]
mov ecx, eax
xor ecx, dword [esp + 0x4c]
lea edx, [ecx - 1]
not ecx
shr edx, 0x1f
shr ecx, 0x1f
and edx, ecx
neg edx
and edx, 1
neg edx
and edx, dword [edi + eax*4]
inc eax
or esi, edx
cmp eax, ebx
jl 0x10062340
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
mov dword [eax + ebp*4], esi
lea eax, [ebx*4]
inc ebp
add edi, eax
cmp ebp, dword [esp + 0x44]
jl 0x10062330
jmp 0x100624d8
mov ebp, dword [esp + 0x4c]
lea ecx, [esi - 2]
mov esi, 1
mov edx, ebp
shl esi, cl
sar edx, cl
mov dword [esp + 0x34], esi
lea eax, [esi - 1]
and ebp, eax
lea ecx, [edx - 1]
shr ecx, 0x1f
mov eax, edx
not eax
mov dword [esp + 0x20], ebp
shr eax, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 1
and ecx, 1
neg ecx
mov dword [esp + 0x30], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 2
and ecx, 1
xor edx, 3
neg ecx
mov dword [esp + 0x2c], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [edx - 1]
shr eax, 0x1f
not edx
shr edx, 0x1f
neg ecx
and eax, edx
and ecx, 1
neg eax
neg ecx
and eax, 1
mov dword [esp + 0x28], ecx
neg eax
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x44], eax
jle 0x100624d8
shl ebx, 2
mov dword [esp + 0x38], ebx
xor edx, edx
xor ebx, ebx
mov dword [esp + 0x10], edx
test esi, esi
jle 0x100624bc
lea eax, [esi + esi*2]
lea ecx, [edi + esi*8]
lea eax, [edi + eax*4]
mov dword [esp + 0x18], ecx
lea ebp, [edi + esi*4]
mov dword [esp + 0x14], eax
nop dword [eax + eax]
mov eax, dword [eax]
lea ebp, [ebp + 4]
mov ecx, dword [ecx]
mov esi, ebx
and ecx, dword [esp + 0x28]
and eax, dword [esp + 0x24]
xor esi, dword [esp + 0x20]
or ecx, eax
mov edx, dword [ebp - 4]
and edx, dword [esp + 0x2c]
mov eax, dword [edi + ebx*4]
or edx, ecx
and eax, dword [esp + 0x30]
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
or eax, edx
mov edx, dword [esp + 0x10]
and ecx, esi
mov esi, dword [esp + 0x34]
neg ecx
and ecx, 1
inc ebx
neg ecx
and ecx, eax
mov eax, dword [esp + 0x14]
or edx, ecx
add eax, 4
mov ecx, dword [esp + 0x18]
add ecx, 4
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
cmp ebx, esi
jl 0x10062450
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
add edi, dword [esp + 0x38]
mov ecx, dword [ecx]
mov dword [ecx + eax*4], edx
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x44]
jl 0x10062427
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
pop ebp
mov dword [eax + 4], edi
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x2c
ret