joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100286d0
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0x9e3779b9
mov dword [ebp - 0x10], 0
jmp 0x10028707
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x10
jge 0x1002878a
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx + edx]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 8]
shr ecx, 5
mov edx, 4
shl edx, 0
mov esi, dword [ebp + 0x10]
add ecx, dword [esi + edx]
xor eax, ecx
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 0x10]
add eax, dword [edx + ecx]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
xor eax, ecx
mov edx, dword [ebp - 4]
shr edx, 5
mov ecx, 4
imul ecx, ecx, 3
mov esi, dword [ebp + 0x10]
add edx, dword [esi + ecx]
xor eax, edx
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0x100286fe
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100287a0
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x9e3779b9
mov ecx, dword [ebp - 0x14]
shl ecx, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
jmp 0x100287e0
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x10
jge 0x1002886b
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 0x10]
add eax, dword [edx + ecx]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
xor eax, ecx
mov edx, dword [ebp - 4]
shr edx, 5
mov ecx, 4
imul ecx, ecx, 3
mov esi, dword [ebp + 0x10]
add edx, dword [esi + ecx]
xor eax, edx
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx + edx]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 8]
shr ecx, 5
mov edx, 4
shl edx, 0
mov esi, dword [ebp + 0x10]
add ecx, dword [esi + edx]
xor eax, ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
jmp 0x100287d7
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10028910
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x10032dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov byte [ebp - 2], 0
jmp 0x10032de3
mov al, byte [ebp - 2]
add al, 1
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
cmp ecx, 4
jge 0x10032e49
mov byte [ebp - 1], 0
jmp 0x10032dfb
mov dl, byte [ebp - 1]
add dl, 1
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
cmp eax, 4
jge 0x10032e47
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp + 8]
shl edx, 2
movzx esi, byte [ebp - 2]
shl esi, 2
lea edx, [esi + edx*4]
movzx esi, byte [ebp - 1]
add esi, dword [ebp + 0x10]
movzx edx, byte [esi + edx]
movzx eax, byte [eax + ecx]
xor eax, edx
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp - 2]
mov esi, dword [ebp + 0xc]
lea edx, [esi + edx*4]
mov byte [edx + ecx], al
jmp 0x10032df2
jmp 0x10032ddb
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10032e50
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 2], 0
jmp 0x10032e62
mov al, byte [ebp - 2]
add al, 1
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
cmp ecx, 4
jge 0x10032eb0
mov byte [ebp - 1], 0
jmp 0x10032e7a
mov dl, byte [ebp - 1]
add dl, 1
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
cmp eax, 4
jge 0x10032eae
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 2]
movzx edx, byte [eax + ecx]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*4]
movzx ecx, byte [ebp - 2]
mov dl, byte [edx + 0x100d9e58]
mov byte [eax + ecx], dl
jmp 0x10032e71
jmp 0x10032e5a
mov esp, ebp
pop ebp
ret

Function at 0x10033e20
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 2], 0
jmp 0x10033e32
mov al, byte [ebp - 2]
add al, 1
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
cmp ecx, 4
jge 0x10033e80
mov byte [ebp - 1], 0
jmp 0x10033e4a
mov dl, byte [ebp - 1]
add dl, 1
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
cmp eax, 4
jge 0x10033e7e
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 2]
movzx edx, byte [eax + ecx]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*4]
movzx ecx, byte [ebp - 2]
mov dl, byte [edx + 0x100d9f58]
mov byte [eax + ecx], dl
jmp 0x10033e41
jmp 0x10033e2a
mov esp, ebp
pop ebp
ret

Function at 0x10034200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x10034212
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 0x10
jge 0x1003423f
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], dl
jmp 0x1003420a
mov esp, ebp
pop ebp
ret
Function at 0x10034de0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x100e70dc]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x100e7b2c]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.1007c05e
add esp, 4
mov edi, 0x100
nop word [eax + eax]
mov esi, dword [0x100ec878]
xor dl, dl
test esi, esi
jle 0x10034e78
nop dword [eax]
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x10034e73
mov eax, dword [esi*4 + 0x100eb930]
test eax, eax
je 0x10034e73
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x10034e50
dec edi
test edi, edi
jle 0x10034e81
test dl, dl
jne 0x10034e40
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1007bf25
mov esp, ebp
pop ebp
ret
Function at 0x100363e0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bd18f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x100e70dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push eax
mov byte [esi], 0
call fcn.100035a0
mov byte [ebp - 4], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
push 0x13
push 0x100da37c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.10035a20
mov byte [ebp - 4], 5
cmp dword [esi + 0x14], 0x10
jb 0x1003649f
mov ecx, dword [esi]
jmp 0x100364a1
mov ecx, esi
cmp dword [eax + 0x14], 0x10
jb 0x100364a9
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x100364ca
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.10003a90
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x100364f8
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.10003a90
mov dword [ebp + 0x1c], 0xf
mov eax, esi
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1003a2c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bd938
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x100e70dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x138], eax
call fcn.1003a230
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 0
push eax
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x13c], 0xf
mov dword [ebp - 0x140], 0
mov byte [ebp - 0x150], 0
call fcn.100035a0
mov eax, dword [ebp - 0x140]
lea ecx, [ebp - 0x12c]
cmp dword [ebp - 0x13c], 0x10
mov edx, 0x100
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x150]
cmovae eax, dword [ebp - 0x150]
mov dword [ebp - 0x130], eax
xor eax, eax
nop word [eax + eax]
mov byte [ecx], al
lea ecx, [ecx + 1]
inc eax
cmp ax, dx
jl 0x1003a370
xor dl, dl
mov word [ebp - 0x2c], 0
xor ebx, ebx
lea esi, [ebp - 0x12c]
mov edi, 0x100
mov eax, dword [ebp - 0x130]
lea esi, [esi + 1]
mov cl, byte [esi - 1]
movzx edx, dl
mov al, byte [edx + eax]
add al, bl
add al, cl
movzx ebx, al
movzx eax, byte [ebp + ebx - 0x12c]
mov byte [esi - 1], al
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x134]
mov byte [ebp + ebx - 0x12c], cl
sub edi, 1
jne 0x1003a390
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
jle 0x1003a42a
movzx edx, byte [ebp - 0x2c]
movzx ebx, byte [ebp - 0x2b]
nop dword [eax + eax]
inc dl
movzx edx, dl
mov cl, byte [ebp + edx - 0x12c]
add bl, cl
movzx ebx, bl
movzx eax, byte [ebp + ebx - 0x12c]
mov byte [ebp + edx - 0x12c], al
mov byte [ebp + ebx - 0x12c], cl
movzx eax, cl
add al, byte [ebp + edx - 0x12c]
mov ecx, dword [ebp - 0x138]
movzx eax, al
movzx eax, byte [ebp + eax - 0x12c]
xor byte [esi + ecx], al
inc esi
cmp esi, edi
jl 0x1003a3e0
mov eax, dword [ebp - 0x13c]
cmp eax, 0x10
jb 0x1003a448
inc eax
lea ecx, [ebp - 0x150]
push eax
push dword [ebp - 0x150]
call fcn.10003a90
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1003a45d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10003a90
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007bf25
mov esp, ebp
pop ebp
ret 8
Function at 0x1003a480
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 8], esi
test esi, esi
je 0x1003a5df
lea ecx, [esi*8]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esi*8]
lea eax, [ecx + ecx*2]
add eax, eax
sub edx, eax
sub edx, 2
je 0x1003a4c9
sub edx, 2
jne 0x1003a4cc
add ecx, 2
jmp 0x1003a4cc
add ecx, 3
mov eax, dword [ebp + 0xc]
inc ecx
cmp dword [eax], ecx
jge 0x1003a4e1
pop esi
mov dword [eax], ecx
mov eax, 0xfffffff0
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x55555556
imul esi
push edi
mov edi, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
xor eax, eax
test ecx, ecx
jle 0x1003a576
dec ecx
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 4], eax
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], al
movzx eax, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x1003a512
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, esi
jge 0x1003a5d1
movzx edx, byte [ebx]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, esi
jge 0x1003a58b
movzx ecx, byte [ebx + 1]
jmp 0x1003a58d
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], al
cmp dword [ebp - 0xc], esi
jge 0x1003a5c6
and ecx, 0xf
mov al, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], al
jmp 0x1003a5ca
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov ecx, dword [ebp + 0xc]
mov eax, edi
sub eax, dword [ebp + 8]
mov dword [ecx], eax
mov byte [edi], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c6ab
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x100bda52
call fcn.1007c6a8
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1003c7c8
cmp byte [ebx + 0x3e], 0
je 0x1003c7c8
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.1007c648
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x1003c6f7
xor al, al
jmp 0x1003c7ca
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.10016c10
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x1003c727
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.1007c648
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x1003c75c
sub eax, 1
je 0x1003c760
dec eax
sub eax, 1
je 0x1003c7b6
xor bl, bl
jmp 0x1003c7b8
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x1003c770
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x1003c798
cmp eax, 0x10
jae 0x1003c77f
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.100a1653
add esp, 0x10
cmp esi, eax
jne 0x1003c758
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x1003c7b6
test esi, esi
jne 0x1003c71b
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.1000f080
jmp 0x1003c715
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10003b20
mov al, bl
jmp 0x1003c7ca
mov al, 1
call fcn.1007c663
ret
Function at 0x1003cccf
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x100bdaa7
call fcn.1007c6a8
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x1003ccf4
xor eax, eax
jmp 0x1003ce6d
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1003cd20
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x1003cd20
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x1003ce6d
cmp dword [esi + 0x4c], 0
je 0x1003ce6a
mov ecx, esi
call fcn.1003c8f8
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x1003cd53
push dword [esi + 0x4c]
push edi
call fcn.1003c281
pop ecx
pop ecx
test al, al
je 0x1003ce6a
movzx ebx, di
jmp 0x1003ce6a
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.10016c10
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x1003cd8b
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.1007c648
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x1003ce5e
cmp eax, 1
jg 0x1003ce39
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x1003cdd4
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x1003ce01
cmp eax, 0x10
jae 0x1003cde3
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.100a1653
add esp, 0x10
cmp edi, eax
jne 0x1003ce34
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x1003ce04
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x1003ce2e
test edi, edi
jne 0x1003cd7f
cmp dword [ebp - 0x18], 0x20
jae 0x1003ce58
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.1000f080
jmp 0x1003cd79
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x1003ce58
cmp eax, 3
jne 0x1003ce5e
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.1003c281
pop ecx
pop ecx
test al, al
je 0x1003ce58
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10003b20
mov ax, bx
call fcn.1007c663
ret 4
Function at 0x100450b4
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1004511b
push esi
call fcn.10045397
pop ecx
test al, al
jne 0x1004511b
push ebx
push edi
lea eax, [ebp + 8]
push eax
push esi
call fcn.10045336
pop ecx
mov esi, eax
mov ebx, 0x1505
pop ecx
mov ecx, dword [ebp + 8]
xor eax, eax
and dword [ebp + 8], 0
add ecx, esi
mov edi, ecx
sub edi, esi
cmp esi, ecx
cmova edi, eax
test edi, edi
je 0x10045114
mov al, byte [esi]
push eax
call fcn.10050609
imul ebx, ebx, 0x21
pop ecx
movsx ecx, al
mov eax, dword [ebp + 8]
xor ebx, ecx
inc esi
inc eax
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x100450f7
pop edi
movzx eax, bl
pop ebx
jmp 0x1004511d
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10045e31
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10045e52
cmp dword [esi + 0x8c], 0
je 0x10045e52
push 2
push 3
push esi
call fcn.10050ad9
add esp, 0xc
push dword [ebp + 0xc]
call fcn.10050ef3
pop ecx
test esi, esi
je 0x10045e72
cmp dword [esi + 0x8c], 0
je 0x10045e72
push 3
push esi
call fcn.10050b14
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x1004e063
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x608], edi
je 0x1004e0a2
push 1
push esi
call fcn.10041abc
push dword [esi + 0x59c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [esi + 0x608]
push 0
push esi
mov edi, eax
call fcn.10041abc
add esp, 0x24
jmp 0x1004e0d8
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x1004e0d8
push dword [esi + 0x598]
imul eax, eax, 3
push 1
push 2
add eax, 0x100c2edc
push eax
call fcn.100a1653
push dword [esi + 0x598]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.100a1653
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x1004e4a8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100e70dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebx + eax*4 + 0x1a8]
push eax
push ebx
mov dword [ebp - 0x88], ecx
call fcn.1004e95c
pop ecx
pop ecx
push 0
push dword [ebp + 0x14]
push edi
push esi
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov eax, dword [ebp - 0x88]
and dword [eax], 0
cmp esi, 0xffffffff
jne 0x1004e553
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x1004e51d
mov eax, dword [ebp - 0x88]
xor esi, esi
mov dword [eax], 0x51
jmp 0x1004e553
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.10070bb6
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.1004e0de
mov eax, dword [ebx]
add esp, 0x18
mov dword [eax + 0xcac], edi
mov eax, dword [ebp - 0x88]
mov dword [eax], 0x37
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bf25
mov esp, ebp
pop ebp
ret