joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003130
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xcc
call fcn.100781a0
mov ecx, dword [esp + 0xd0]
push ebx
push ebp
push esi
lea esi, [ecx + 0x14]
lea eax, [ecx + 0x54]
push edi
lea edi, [esp + 0x5c]
mov ecx, dword [esi + 0x3c]
xor ebp, ebp
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x9c]
sub ecx, eax
sub edi, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
sub esi, eax
mov ebx, dword [esp + 0xe4]
mov edx, dword [eax]
xor ecx, ecx
mov dword [edi + eax - 0x40], edx
mov cl, byte [ebx + ebp]
mov ebx, dword [esp + 0x14]
xor edx, ecx
mov dword [edi + eax], ecx
mov dword [ebx + eax], edx
mov edx, dword [esp + 0x10]
xor ecx, edx
add eax, 4
mov edx, dword [ecx*4 + str._.C]
mov ecx, dword [esi + eax - 4]
xor ecx, edx
inc ebp
mov dword [esi + eax - 4], ecx
cmp ebp, 0x10
mov dword [esp + 0x10], ecx
jl 0x1000316d
xor ecx, ecx
xor esi, esi
lea eax, [esp + 0x20]
mov edx, 6
mov ecx, dword [ecx*4 + str._.C]
mov edi, dword [eax - 4]
xor edi, ecx
mov ecx, edi
mov dword [eax - 4], edi
mov ebp, dword [eax]
add eax, 0x20
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [eax - 0x20], ebp
mov ebx, dword [eax - 0x1c]
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov dword [eax - 0x1c], ebx
mov edi, dword [eax - 0x18]
mov ecx, dword [ecx*4 + str._.C]
xor edi, ecx
mov ecx, edi
mov dword [eax - 0x18], edi
mov ebp, dword [eax - 0x14]
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [eax - 0x14], ebp
mov ebx, dword [eax - 0x10]
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov dword [eax - 0x10], ebx
mov edi, dword [eax - 0xc]
mov ecx, dword [ecx*4 + str._.C]
xor edi, ecx
mov ecx, edi
mov dword [eax - 0xc], edi
mov ebp, dword [eax - 8]
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
dec edx
mov dword [eax - 8], ebp
mov ecx, ebp
jne 0x100031bc
add ecx, esi
and ecx, 0xff
inc esi
cmp esi, 0x12
jl 0x100031b3
mov edi, dword [esp + 0x18]
mov ecx, 0x10
lea esi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret

Function at 0x10003790
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret
Function at 0x1000af60
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x10011250
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xdc
call fcn.100781a0
mov eax, dword [esp + 0xe8]
test eax, eax
jbe 0x100113ed
push ebx
push ebp
mov ebp, dword [esp + 0xe8]
push esi
mov esi, dword [esp + 0xf0]
push edi
lea edi, [ebp + 0xc]
add eax, 7
add ebp, 0x14
shr eax, 3
mov dword [esp + 0x18], eax
xor ebx, ebx
xor eax, eax
mov bl, byte [esi]
mov ah, byte [esi + 1]
inc esi
or ebx, eax
inc esi
xor ecx, ecx
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov dl, byte [esi + 1]
shl ecx, 0x10
or ebx, ecx
inc esi
shl edx, 0x18
mov al, byte [esi + 1]
or ebx, edx
inc esi
xor ecx, ecx
inc esi
xor edx, edx
push edi
mov dword [esp + 0x20], ebx
mov ch, byte [esi]
mov dl, byte [esi + 1]
or eax, ecx
inc esi
shl edx, 0x10
or eax, edx
inc esi
xor ecx, ecx
mov dl, byte [edi]
mov cl, byte [esi]
and dl, 0xdf
shl ecx, 0x18
or eax, ecx
or dl, 0x40
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov al, byte [ebp]
and al, 0xbf
mov dword [esp + 0x28], ebx
or al, 0x20
inc esi
mov byte [edi], dl
mov byte [ebp], al
call sym.LIBEAY32.dll_des_set_odd_parity
lea ecx, [esp + 0x30]
push ecx
push edi
call sym.LIBEAY32.dll_des_set_key_unchecked
lea edx, [esp + 0x38]
push 1
lea eax, [esp + 0x34]
push edx
push eax
call sym.LIBEAY32.dll_des_encrypt1
push ebp
call sym.LIBEAY32.dll_des_set_odd_parity
lea ecx, [esp + 0x48]
push ecx
push ebp
call sym.LIBEAY32.dll_des_set_key_unchecked
lea edx, [esp + 0x50]
push 1
lea eax, [esp + 0x44]
push edx
push eax
call sym.LIBEAY32.dll_des_encrypt1
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x44], edx
mov eax, edx
mov edx, dword [esp + 0x40]
add esp, 0x30
xor ecx, ebx
xor eax, edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
xor ebx, edx
mov edx, dword [esp + 0x28]
xor eax, edx
mov edx, ebx
mov dword [esp + 0x10], eax
mov eax, edi
shr edx, 8
mov byte [eax], bl
inc eax
mov byte [eax], dl
mov edx, ebx
inc eax
shr edx, 0x10
mov byte [eax], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax], bl
inc eax
mov ebx, edx
mov byte [eax], dl
inc eax
shr ebx, 8
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 0x10
shr edx, 0x18
mov byte [eax], bl
mov byte [eax + 1], dl
mov eax, ebp
mov edx, ecx
shr edx, 8
mov byte [eax], cl
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov edx, ecx
shr edx, 8
mov byte [eax], cl
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
mov byte [eax], dl
mov byte [eax + 1], cl
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
jne 0x1001128b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
Function at 0x100114c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x40
call fcn.100781a0
mov edx, dword [esp + 0x50]
push ebx
xor eax, eax
push esi
test edx, edx
push edi
je 0x100114e4
mov ebx, dword [esp + 0x50]
mov eax, 1
mov dword [ebx], edx
jmp 0x100114f0
mov ebx, dword [esp + 0x50]
mov ecx, dword [ebx]
mov dword [esp + 0x5c], ecx
mov edx, ecx
mov esi, dword [esp + 0x54]
test esi, esi
je 0x10011580
mov eax, dword [edx + 0x34]
push ebp
mov ebp, dword [esp + 0x5c]
cmp eax, ebp
jge 0x1001153a
lea edi, [ebx + 4]
push edx
push edi
call sym.LIBEAY32.dll_EVP_DigestInit
push ebp
push esi
push edi
call sym.LIBEAY32.dll_EVP_DigestUpdate
lea esi, [ebx + 0x1cc]
lea edx, [ebx + 0x1d0]
push esi
push edx
push edi
call sym.LIBEAY32.dll_EVP_DigestFinal
mov edx, dword [esp + 0x80]
add esp, 0x20
jmp 0x10011558
mov ecx, ebp
lea edi, [ebx + 0x1d0]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x1cc]
mov dword [esi], ebp
mov esi, dword [esi]
pop ebp
cmp esi, 0x40
je 0x10011584
mov ecx, 0x40
lea edi, [esi + ebx + 0x1d0]
sub ecx, esi
xor eax, eax
mov esi, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x10011584
test eax, eax
je 0x100115f2
xor eax, eax
mov cl, byte [ebx + eax + 0x1d0]
xor cl, 0x36
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jl 0x10011586
lea esi, [ebx + 0x9c]
push edx
push esi
call sym.LIBEAY32.dll_EVP_DigestInit
mov edi, dword [esp + 0x64]
lea eax, [esp + 0x14]
mov edx, dword [edi + 0x34]
push edx
push eax
push esi
call sym.LIBEAY32.dll_EVP_DigestUpdate
add esp, 0x14
xor eax, eax
mov cl, byte [ebx + eax + 0x1d0]
xor cl, 0x5c
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jl 0x100115bf
lea esi, [ebx + 0x134]
push edi
push esi
call sym.LIBEAY32.dll_EVP_DigestInit
mov edx, dword [edi + 0x34]
lea eax, [esp + 0x14]
push edx
push eax
push esi
call sym.LIBEAY32.dll_EVP_DigestUpdate
add esp, 0x14
lea esi, [ebx + 0x9c]
lea edi, [ebx + 4]
mov ecx, 0x26
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
add esp, 0x40
ret
Function at 0x10017e50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
xor ecx, ecx
xor esi, esi
xor ebp, ebp
push edi
mov byte [eax + 7], cl
mov byte [eax + 6], cl
mov byte [eax + 5], cl
mov byte [eax + 4], cl
mov byte [eax + 3], cl
mov byte [eax + 2], cl
mov byte [eax + 1], cl
mov byte [eax], cl
sub edx, eax
mov ebx, esi
lea edi, [ecx + eax]
xor ebx, ebp
mov ebp, esi
mov esi, ecx
mov bl, byte [ebx + 0x100985c8]
and esi, 7
xor bl, byte [edx + edi]
mov byte [edi], bl
xor ebx, ebx
mov bl, byte [esi + eax]
inc ecx
cmp ecx, 8
mov esi, ebx
jl 0x10017e7b
xor edx, edx
mov dl, byte [eax]
mov ebp, edx
xor edx, edx
mov dl, byte [ecx + eax]
xor ecx, ecx
mov esi, edx
mov edx, dword [esp + 0x18]
sub edx, eax
mov ebx, esi
lea edi, [ecx + eax]
xor ebx, ebp
mov ebp, esi
mov esi, ecx
mov bl, byte [ebx + 0x100985c8]
and esi, 7
xor bl, byte [edx + edi]
mov byte [edi], bl
xor ebx, ebx
mov bl, byte [esi + eax]
inc ecx
cmp ecx, 8
mov esi, ebx
jl 0x10017eb6
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100190e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
cmp esi, 0x80
mov byte [eax], 0
jle 0x100190fc
mov esi, 0x80
mov ecx, dword [esp + 0x20]
test ecx, ecx
jle 0x1001910c
cmp ecx, 0x400
jle 0x10019111
mov ecx, 0x400
test esi, esi
jle 0x10019128
mov edi, dword [esp + 0x1c]
mov edx, eax
sub edi, eax
mov ebp, esi
mov bl, byte [edi + edx]
mov byte [edx], bl
inc edx
dec ebp
jne 0x1001911f
xor edx, edx
cmp esi, 0x80
mov dl, byte [eax + esi - 1]
jge 0x1001915a
mov edi, eax
sub edi, esi
mov bl, byte [edi + esi]
add ebx, edx
xor edx, edx
and ebx, 0xff
inc esi
cmp esi, 0x80
mov dl, byte [ebx + 0x100986cc]
mov byte [esi + eax - 1], dl
jl 0x1001913a
lea esi, [ecx + 7]
mov edx, 0x80
neg ecx
sar esi, 3
and ecx, 7
mov edi, 0xff
sub edx, esi
sar edi, cl
xor ecx, ecx
mov cl, byte [edx + eax]
and edi, ecx
xor ecx, ecx
mov cl, byte [edi + 0x100986cc]
mov edi, edx
mov byte [edx + eax], cl
dec edx
test edi, edi
je 0x100191aa
lea edi, [edx + eax]
lea ebp, [edx + 1]
xor edx, edx
mov dl, byte [edi + esi]
xor edx, ecx
xor ecx, ecx
dec ebp
dec edi
mov cl, byte [edx + 0x100986cc]
mov byte [edi + 1], cl
test ebp, ebp
ja 0x10019192
lea esi, [eax + 0xfc]
mov ecx, 0x7f
xor edx, edx
xor ebx, ebx
mov dl, byte [ecx + eax - 1]
mov bh, byte [ecx + eax]
and edx, 0xffff
sub esi, 4
or edx, ebx
sub ecx, 2
mov dword [esi + 4], edx
jns 0x100191b5
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1001a4a0
Capabilities:
Encrypt data using rc6

Disassembly:
mov eax, 0x108
call fcn.100781a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
cmp esi, 0x10
push edi
je 0x1001a4d6
cmp esi, 0xc
je 0x1001a4d6
cmp esi, 8
je 0x1001a4d6
mov dword [esp + 0x128], 0x10
mov esi, dword [esp + 0x128]
mov ebx, dword [esp + 0x120]
mov eax, dword [esp + 0x11c]
xor ebp, ebp
xor edx, edx
lea edi, [ebx - 8]
mov dword [eax], esi
test edi, edi
jl 0x1001a68b
mov eax, dword [esp + 0x124]
add edi, 8
shr edi, 3
lea esi, [esp + 0x18]
lea edx, [edi*8]
xor ecx, ecx
xor ebx, ebx
mov cl, byte [eax]
mov bh, byte [eax + 1]
inc eax
or ecx, ebx
inc eax
xor ebx, ebx
add esi, 4
mov bl, byte [eax]
add esi, 4
shl ebx, 0x10
or ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
shl ebx, 0x18
or ecx, ebx
inc eax
mov dword [esi - 8], ecx
xor ecx, ecx
mov cl, byte [eax]
inc ebp
inc eax
xor ebx, ebx
mov bh, byte [eax]
or ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
shl ebx, 0x10
or ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
shl ebx, 0x18
or ecx, ebx
inc eax
mov dword [esi - 4], ecx
inc ebp
dec edi
jne 0x1001a50d
mov ebx, dword [esp + 0x120]
mov esi, dword [esp + 0x128]
mov ecx, ebx
sub ecx, edx
je 0x1001a5dc
mov ecx, ebx
xor esi, esi
and ecx, 7
xor edx, edx
add eax, ecx
dec ecx
cmp ecx, 7
ja case.default.0x1001a584
jmp dword [ecx*4 + 0x1001a698]
dec eax
xor edx, edx
mov dl, byte [eax]
mov esi, edx
shl esi, 0x18
dec eax
xor ecx, ecx
mov cl, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
xor edx, edx
mov dh, byte [eax]
or esi, edx
dec eax
xor ecx, ecx
mov cl, byte [eax]
or esi, ecx
dec eax
xor edx, edx
mov dl, byte [eax]
shl edx, 0x18
dec eax
xor ecx, ecx
mov cl, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
xor ecx, ecx
mov ch, byte [eax]
or edx, ecx
xor ecx, ecx
mov cl, byte [eax - 1]
or edx, ecx
mov dword [esp + ebp*4 + 0x18], edx
mov dword [esp + ebp*4 + 0x1c], esi
mov esi, dword [esp + 0x128]
lea eax, [ebx + 3]
lea ebp, [esi + esi + 2]
cdq
and edx, 3
add eax, edx
mov ecx, eax
mov eax, dword [esp + 0x11c]
sar ecx, 2
cmp ebp, 1
mov dword [esp + 0x14], ecx
mov dword [eax + 4], 0xb7e15163
jle 0x1001a61d
add eax, 8
lea edx, [ebp - 1]
mov esi, dword [eax - 4]
add eax, 4
sub esi, 0x61c88647
dec edx
mov dword [eax - 4], esi
jne 0x1001a60b
cmp ebp, ecx
mov eax, ebp
jg 0x1001a625
mov eax, ecx
lea ecx, [eax + eax*2]
xor eax, eax
xor esi, esi
xor ebx, ebx
xor edi, edi
test ecx, ecx
jle 0x1001a680
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x11c]
mov ecx, dword [edx + esi*4 + 4]
add ecx, ebx
add ecx, edi
rol ecx, 3
mov dword [edx + esi*4 + 4], ecx
mov edx, dword [esp + eax*4 + 0x18]
mov edi, ecx
add edx, ebx
add edx, edi
inc esi
lea ecx, [ebx + edi]
rol edx, cl
cmp esi, ebp
mov dword [esp + eax*4 + 0x18], edx
mov ebx, edx
jl 0x1001a66a
xor esi, esi
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
jl 0x1001a675
xor eax, eax
mov ecx, dword [esp + 0x10]
dec ecx
mov dword [esp + 0x10], ecx
jne 0x1001a638
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
jmp 0x1001a56d
Function at 0x1001ca00
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 8
call fcn.100781a0
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov ecx, 0x412
mov esi, 0x1007a9f0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x48
jle 0x1001ca2d
mov ecx, 0x48
mov edi, dword [esp + 0x20]
push ebp
mov eax, edi
mov ebp, ebx
lea esi, [ecx + edi]
mov dword [esp + 0x1c], 0x12
xor ecx, ecx
mov cl, byte [eax]
inc eax
cmp eax, esi
jb 0x1001ca4c
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x1001ca5c
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x1001ca6c
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x1001ca7c
mov eax, edi
mov edx, dword [ebp]
add ebp, 4
xor edx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp - 4], edx
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x1001ca41
xor eax, eax
mov esi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edi, 9
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call sym.LIBEAY32.dll_BF_encrypt
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x1001caa4
lea esi, [ebx + 0x48]
mov edi, 0x200
lea eax, [esp + 0xc]
push ebx
push eax
call sym.LIBEAY32.dll_BF_encrypt
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x1001cacd
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x1002ac50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.100781a0
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
lea esi, [eax - 1]
push edi
mov edi, dword [esp + 0x38]
lea ecx, [esi - 0x29]
cmp edi, ecx
jle 0x1002ac8f
push 0x2c
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp esi, 0x29
jge 0x1002acb3
push 0x32
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea eax, [esi - 0x14]
push 0x36
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x1c], eax
call sym.LIBEAY32.dll_CRYPTO_malloc
add esp, 0xc
mov dword [esp + 0x30], eax
test eax, eax
jne 0x1002acf1
push 0x39
push str..crypto_rsa_rsa_oaep.c
push 0x21
push 0x79
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ebx, dword [esp + 0x2c]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov byte [ebx], 0
lea ebp, [ebx + 1]
add ebx, 0x15
push ebx
push edx
push eax
call sym.LIBEAY32.dll_SHA1
mov ecx, esi
xor eax, eax
sub ecx, edi
lea edi, [ebx + 0x14]
sub ecx, 0x29
push 0x14
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x4c]
mov eax, ebx
sub eax, ecx
mov edx, ecx
add eax, esi
mov esi, dword [esp + 0x48]
shr ecx, 2
lea edi, [eax - 0x14]
mov byte [eax - 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sym.LIBEAY32.dll_RAND_bytes
add esp, 0x14
test eax, eax
jg 0x1002ad64
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
push 0x14
push ebp
push edi
push esi
call fcn.1002afa0
add esp, 0x10
test edi, edi
jle 0x1002ad90
mov eax, ebx
sub esi, ebx
mov ecx, edi
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x1002ad83
mov esi, dword [esp + 0x30]
push edi
push ebx
lea eax, [esp + 0x1c]
push 0x14
push eax
call fcn.1002afa0
lea eax, [esp + 0x24]
add esp, 0x10
sub eax, ebp
mov ecx, 0x14
mov dl, byte [eax + ebp]
mov bl, byte [ebp]
xor bl, dl
mov byte [ebp], bl
inc ebp
dec ecx
jne 0x1002adac
push esi
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x1002ade0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.100781a0
push ebx
push ebp
mov ebp, dword [esp + 0x48]
xor ebx, ebx
dec ebp
push esi
cmp ebp, 0x29
push edi
mov dword [esp + 0x10], ebx
jl 0x1002af6e
mov eax, dword [esp + 0x4c]
mov edi, ebp
sub edi, eax
jns 0x1002ae16
mov dword [esp + 0x10], 1
xor edi, edi
mov esi, dword [esp + 0x48]
add ebp, 0xffffffec
push 0x79
sub esi, edi
push str..crypto_rsa_rsa_oaep.c
push ebp
add esi, 0x14
call sym.LIBEAY32.dll_CRYPTO_malloc
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1002ae58
push 0x7c
push str..crypto_rsa_rsa_oaep.c
push 0x21
push 0x79
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push ebp
push esi
lea eax, [esp + 0x1c]
push 0x14
push eax
call fcn.1002afa0
add esp, 0x10
cmp edi, 0x14
mov eax, edi
jge 0x1002ae8b
mov edx, dword [esp + 0x48]
mov ecx, eax
sub ecx, edi
mov cl, byte [ecx + edx]
mov dl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x14
jl 0x1002ae70
lea edx, [esp + 0x14]
push 0x14
push edx
push ebp
push ebx
call fcn.1002afa0
add esp, 0x10
test ebp, ebp
jle 0x1002aeb3
mov eax, ebx
sub esi, ebx
mov edi, ebp
mov cl, byte [esi + eax]
mov dl, byte [eax]
xor dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x1002aea6
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x28]
push edx
push eax
push ecx
call sym.LIBEAY32.dll_SHA1
add esp, 0xc
mov ecx, 5
lea edi, [esp + 0x28]
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x1002af6e
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1002af6e
mov eax, 0x14
cmp ebp, eax
jle 0x1002aeff
cmp byte [eax + ebx], 0
jne 0x1002aeff
inc eax
cmp eax, ebp
jl 0x1002aef4
cmp byte [eax + ebx], 1
jne 0x1002af6e
mov ecx, eax
inc eax
cmp ecx, ebp
jge 0x1002af6e
mov ecx, dword [esp + 0x44]
sub ebp, eax
cmp ecx, ebp
jge 0x1002af44
push 0x9a
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
or ebp, 0xffffffff
push ebx
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x40]
mov ecx, ebp
mov edx, ecx
lea esi, [eax + ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0xa7
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
test ebx, ebx
je 0x1002af93
push ebx
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x10032db0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov eax, 0x14
call fcn.100781a0
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], 1
xor edi, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
lea edx, [esp + 0x14]
movsx ecx, byte [ebp]
inc ebp
cmp ecx, 0x30
jl 0x10032e0e
cmp ecx, 0x39
jg 0x10032e0e
mov eax, dword [edx]
mov esi, 1
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2 - 0x30]
cmp eax, 0xff
mov dword [edx], eax
ja 0x10032ed4
jmp 0x10032de2
mov ebx, dword [esp + 0x2c]
cmp ecx, 0x2e
jne 0x10032e2c
test esi, esi
je 0x10032ed4
cmp edi, 3
je 0x10032e3d
inc edi
add edx, 4
xor esi, esi
jmp 0x10032de2
cmp edi, 3
jne 0x10032ed0
test esi, esi
je 0x10032ed0
mov cl, byte [esp + 0x14]
mov dl, byte [esp + 0x18]
mov al, byte [esp + 0x1c]
mov byte [ebx], cl
mov cl, byte [esp + 0x20]
mov byte [ebx + 1], dl
mov byte [ebx + 2], al
mov byte [ebx + 3], cl
mov esi, 1
mov eax, dword [0x100a1168]
test eax, eax
jne 0x10032eee
mov ecx, 0x64
xor eax, eax
mov edi, 0x100a0fd8
push 0x100a0fd8
rep stosd dword es:[edi], eax
push 0x101
mov dword [0x100a1168], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10032eee
call sub.WSOCK32.dll_WSAGetLastError
push 0x1cb
push str..crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.LIBEAY32.dll_ERR_put_error
push 0x1cc
push str..crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x28
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor esi, esi
jmp 0x10032e5d
push 0x70
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10032f8f
test esi, esi
jg 0x10032fad
push 0x7e
push str..crypto_bio_b_sock.c
push 0x15
push 9
call sym.LIBEAY32.dll_CRYPTO_lock
mov edx, dword [esp + 0x38]
add esp, 0x10
push edx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x10032f33
push 0x83
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10032f71
cmp word [esi + 8], 2
je 0x10032f54
push 0x8a
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10032f71
xor ecx, ecx
mov eax, dword [esi + 0xc]
inc ecx
cmp ecx, 4
mov edx, dword [eax]
mov al, byte [edx + ecx - 1]
mov byte [ecx + ebx - 1], al
jl 0x10032f56
mov dword [esp + 0x10], 0
push 0x93
push str..crypto_bio_b_sock.c
push 0x15
push 0xa
call sym.LIBEAY32.dll_CRYPTO_lock
mov eax, dword [esp + 0x20]
add esp, 0x10
test eax, eax
je 0x10032fad
mov ecx, dword [esp + 0x28]
push ecx
push str.host
push 2
call sym.LIBEAY32.dll_ERR_add_error_data
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x10033380
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x100a1168]
test eax, eax
jne 0x100333eb
push edi
mov ecx, 0x64
xor eax, eax
mov edi, 0x100a0fd8
push 0x100a0fd8
push 0x101
rep stosd dword es:[edi], eax
mov dword [0x100a1168], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
pop edi
je 0x100333eb
call sub.WSOCK32.dll_WSAGetLastError
push 0x1cb
push str..crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.LIBEAY32.dll_ERR_put_error
push 0x1cc
push str..crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x28
or eax, 0xffffffff
ret
mov eax, 1
ret
Function at 0x100357f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x10035851
mov al, byte [edi]
test al, al
je 0x10035851
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x10035809
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret