joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011a330
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
cmp ecx, 0x40
jb 0x1011a4ab
mov eax, dword [ebp + 8]
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x1011a4ab
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x1011a4ab
lea esi, [edx + 0x18]
cmp ecx, esi
jb 0x1011a4ab
add edx, eax
cmp dword [edx], 0x4550
jne 0x1011a4ab
lea eax, [esi + 0xe0]
cmp ecx, eax
jb 0x1011a4ab
push ebx
mov ebx, 0x20b
mov eax, 0xf0
cmp word [edx + 0x18], bx
push edi
mov edi, 0xe0
cmovne eax, edi
add eax, esi
pop edi
pop ebx
cmp ecx, eax
jb 0x1011a4ab
movzx ecx, word [edx + 4]
test cx, cx
je 0x1011a4a6
mov eax, 0x1d3
cmp cx, ax
je 0x1011a4a6
mov eax, 0x8664
cmp cx, ax
je 0x1011a4a6
mov eax, 0x1c0
cmp cx, ax
je 0x1011a4a6
mov eax, 0x1c4
cmp cx, ax
je 0x1011a4a6
mov eax, 0xaa64
cmp cx, ax
je 0x1011a4a6
mov eax, 0xebc
cmp cx, ax
je 0x1011a4a6
mov eax, 0x14c
cmp cx, ax
je 0x1011a4a6
mov eax, 0x200
cmp cx, ax
je 0x1011a4a6
mov eax, 0x9041
cmp cx, ax
je 0x1011a4a6
mov eax, 0x266
cmp cx, ax
je 0x1011a4a6
mov eax, 0x366
cmp cx, ax
je 0x1011a4a6
mov eax, 0x466
cmp cx, ax
je 0x1011a4a6
mov eax, 0x1f0
cmp cx, ax
je 0x1011a4a6
mov eax, 0x1f1
cmp cx, ax
je 0x1011a4a6
mov eax, 0x166
cmp cx, ax
je 0x1011a4a6
mov eax, 0x1a2
cmp cx, ax
je 0x1011a4a6
mov eax, 0x1a3
cmp cx, ax
je 0x1011a4a6
mov eax, 0x1a6
cmp cx, ax
je 0x1011a4a6
mov eax, 0x1a8
cmp cx, ax
je 0x1011a4a6
mov eax, 0x1c2
cmp cx, ax
je 0x1011a4a6
mov eax, 0x169
cmp cx, ax
jne 0x1011a4ab
mov eax, edx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1011a4b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 8]
mov dword [ebp - 0x10], ecx
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
mov eax, dword [edi + 8]
xor edx, edx
mov dword [ebp - 8], edx
movzx eax, word [eax + 6]
mov dword [ebp - 0x14], eax
cmp ax, 0x60
mov dword [ebp - 0xc], edx
movzx eax, ax
jb 0x1011a4f6
mov eax, 0x60
cmp edx, eax
jge 0x1011a593
mov eax, dword [edi + 4]
cmp eax, 0x28
jb 0x1011a5e4
mov edx, dword [edi]
cmp ecx, edx
jb 0x1011a5e4
add eax, 0xffffffd8
add eax, edx
cmp ecx, eax
ja 0x1011a5e4
mov edx, dword [ecx + 0xc]
mov eax, edx
cmp dword [ebp - 4], edx
cmovbe eax, dword [ebp - 4]
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], eax
jb 0x1011a561
ja 0x1011a53d
cmp dword [ebp + 0xc], edx
jb 0x1011a561
cmp ebx, edx
ja 0x1011a561
mov eax, dword [ebp - 0x10]
mov ebx, edx
mov esi, dword [ecx + 0x14]
mov edi, dword [eax + 0x3c]
mov eax, dword [ecx + 0x10]
mov dword [ebp - 8], eax
cmp edi, 0x200
jae 0x1011a570
test edi, edi
jne 0x1011a575
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
add ecx, 0x28
mov eax, dword [ebp - 0x14]
inc edx
jmp 0x1011a4e5
mov edi, 0x200
xor edx, edx
mov eax, esi
div edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x1011a561
mov eax, dword [ebp - 0x14]
sub esi, edx
mov edx, dword [ebp - 0xc]
add ecx, 0x28
inc edx
jmp 0x1011a4e5
cmp dword [ebp + 0x10], 0
ja 0x1011a5ac
jb 0x1011a5a3
mov eax, dword [ebp - 4]
cmp dword [ebp + 0xc], eax
jae 0x1011a5ac
mov edx, dword [edi + 4]
xor ebx, ebx
xor esi, esi
jmp 0x1011a5af
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub ecx, ebx
sbb eax, 0
test eax, eax
ja 0x1011a5e4
jb 0x1011a5c4
cmp ecx, edx
jae 0x1011a5e4
xor edx, edx
sub esi, ebx
sbb edx, edx
add esi, dword [ebp + 0xc]
adc edx, dword [ebp + 0x10]
test edx, edx
jg 0x1011a5e4
jl 0x1011a5db
cmp esi, dword [edi + 4]
jae 0x1011a5e4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10121cb0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
lea ecx, [eax + 8]
mov dword [ebp - 8], ecx
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ecx + ebx]
mov ecx, 3
mov dword [ebp + 8], eax
div ecx
mov eax, dword [ebp + 0x14]
mov esi, edx
sub ecx, esi
neg esi
sbb esi, esi
and esi, ecx
mov ecx, dword [ebp - 4]
mov dword [eax], esi
mov eax, 0xaaaaaaab
lea ecx, [ecx*4 + 3]
mul ecx
lea eax, [ebx + 9]
shr edx, 1
add edx, esi
add eax, edx
push eax
call fcn.100eeff0
mov esi, eax
add esp, 4
mov dword [ebp + 0x14], esi
test esi, esi
je 0x10121d34
push dword [ebp + 8]
call fcn.100eeff0
mov ebx, eax
add esp, 4
mov dword [ebp + 0xc], ebx
test ebx, ebx
jne 0x10121d3d
push esi
call fcn.100eef80
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], 0
test eax, eax
jle 0x10121d5a
push eax
push 0x41
push ebx
mov dword [ebp + 8], eax
call fcn.1024a9c0
add esp, 0xc
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push dword [ebp - 8]
add eax, ebx
push eax
call fcn.1024ad90
mov edx, ebx
add esp, 0xc
mov ebx, dword [ebp + 8]
mov eax, edx
add ebx, dword [ebp - 4]
add esi, 8
add eax, ebx
mov dword [ebp + 0x10], eax
cmp ebx, 3
jl 0x10121de7
movzx eax, byte [edx]
sub ebx, 3
shr eax, 2
movzx eax, byte [eax + edi + 8]
mov byte [esi], al
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
or ecx, eax
movzx eax, byte [ecx + edi + 8]
mov byte [esi + 1], al
movzx ecx, byte [edx + 1]
movzx eax, byte [edx + 2]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
movzx eax, byte [ecx + edi + 8]
mov byte [esi + 2], al
movzx eax, byte [edx + 2]
add edx, 3
and eax, 0x3f
movzx eax, byte [eax + edi + 8]
mov byte [esi + 3], al
add esi, 4
cmp ebx, 3
jge 0x10121d85
mov eax, dword [ebp + 0x10]
sub eax, edx
mov dword [ebp + 0x10], eax
je 0x10121e3b
movzx eax, byte [edx]
shr eax, 2
mov al, byte [eax + edi + 8]
mov byte [esi], al
movzx ecx, byte [edx]
and ecx, 3
cmp dword [ebp + 0x10], 1
jne 0x10121e13
add ecx, ecx
mov al, byte [edi + ecx*8 + 8]
mov cl, 0x3d
mov byte [esi + 1], al
jmp 0x10121e31
movzx eax, byte [edx + 1]
shr eax, 4
shl ecx, 4
or eax, ecx
mov al, byte [eax + edi + 8]
mov byte [esi + 1], al
movzx eax, byte [edx + 1]
and eax, 0xf
mov cl, byte [edi + eax*4 + 8]
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
push dword [ebp + 0xc]
call fcn.100eef80
mov eax, dword [ebp + 0x14]
add esp, 4
sub esi, eax
sub esi, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10137c10
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.101789e0
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.1024c8f0
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x10137cc9
call fcn.10122600
push str.BIO_new_file
push 0x43
push str.crypto_bio_bss_file.c
call fcn.10122700
add esp, 0xc
push esi
push dword [esp + 0x14]
push str.calling_fopen__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
call fcn.101227b0
add esp, 0x14
call fcn.1025bd67
cmp dword [eax], 2
je 0x10137c99
call fcn.1025bd67
cmp dword [eax], 6
je 0x10137c99
mov esi, 0x80002
mov edi, 0x4d
jmp 0x10137ca1
mov esi, 0x80
lea edi, [esi - 0x35]
call fcn.10122600
push str.BIO_new_file
push edi
push str.crypto_bio_bss_file.c
call fcn.10122700
push 0
push esi
push 0x20
call fcn.101227b0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x10296e24
call fcn.1012d5a0
mov esi, eax
add esp, 4
test esi, esi
jne 0x10137ceb
push edi
call fcn.1025c3e1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.1012ce80
push edi
push ebx
push 0x6a
push esi
call fcn.1012ceb0
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x10147d20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x10147d62
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
add edi, esi
add ebx, esi
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x10147d41
pop edi
pop ebx
pop esi
ret
Function at 0x10149270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x104ee91c], 0
push esi
mov esi, dword [ebp + 8]
jne 0x1014937d
mov eax, 1
lock xadd dword [0x104ee920], eax
inc eax
cmp eax, 1
jne 0x1014936c
test esi, esi
jne 0x10149361
push ebx
push edi
push str.advapi32.dll
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x10149341
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1029a1e4
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10149341
push str.CryptGenRandom
push esi
call edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10149341
push 0x1029a20c
push esi
call edi
mov edi, eax
test edi, edi
je 0x10149341
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp + 8]
push eax
call ebx
test eax, eax
je 0x10149341
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 8]
call dword [ebp - 8]
push 0
push dword [ebp + 8]
mov esi, eax
call edi
test esi, esi
je 0x10149341
mov eax, dword [ebp - 4]
movzx esi, al
shl esi, 8
movzx eax, ah
or esi, eax
movzx eax, byte [ebp - 2]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 1]
shl esi, 8
or esi, eax
jmp 0x10149355
push 0
call fcn.10259fad
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
test esi, esi
mov eax, 1
pop edi
cmove esi, eax
pop ebx
mov dword [0x104ee91c], esi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_SwitchToThread]
call esi
cmp dword [0x104ee91c], 0
je 0x10149372
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10149390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add ecx, 0xdeadbeef
push ebx
mov ebx, dword [ebp + 8]
add ecx, edx
push esi
mov esi, ecx
mov dword [ebp + 0x10], esi
push edi
mov edi, ecx
cmp edx, 0xc
jbe switch.0x1014949c
add edx, 0xfffffff3
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 4], eax
nop dword [eax + eax]
movzx esi, byte [ebx + 7]
movzx eax, byte [ebx + 6]
movzx edx, byte [ebx + 0xb]
shl esi, 8
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 4]
add edi, eax
shl esi, 8
movzx eax, byte [ebx + 0xa]
add edi, esi
movzx esi, byte [ebx + 8]
add edx, eax
movzx eax, byte [ebx + 9]
add esi, ecx
shl edx, 8
add edx, eax
shl edx, 8
add esi, edx
mov edx, dword [ebp + 8]
mov ebx, esi
rol ebx, 4
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx]
shl ecx, 8
add ecx, eax
sub ecx, esi
add esi, edi
add ecx, dword [ebp + 0x10]
xor ebx, ecx
sub edi, ebx
mov eax, ebx
add ebx, esi
rol eax, 6
xor eax, edi
sub esi, eax
mov edx, eax
rol edx, 8
add eax, ebx
xor edx, esi
sub ebx, edx
mov esi, edx
rol esi, 0x10
add edx, eax
xor esi, ebx
mov ebx, dword [ebp + 8]
mov edi, esi
sub eax, esi
ror edi, 0xd
add esi, edx
xor edi, eax
mov dword [ebp + 0x10], esi
sub edx, edi
mov ecx, edi
rol ecx, 4
add ebx, 0xc
xor ecx, edx
mov dword [ebp + 8], ebx
mov edx, dword [ebp + 0xc]
add edi, esi
sub edx, 0xc
sub dword [ebp - 4], 1
mov dword [ebp + 0xc], edx
jne 0x101493d0
cmp edx, 0xc
ja 0x10149508
jmp dword [edx*4 + 0x10149558]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add ecx, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add ecx, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add ecx, eax
movzx eax, byte [ebx + 8]
add ecx, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add esi, eax
movzx eax, byte [ebx]
add esi, eax
mov dword [ebp + 0x10], esi
xor ecx, edi
mov eax, edi
rol eax, 0xe
sub ecx, eax
mov eax, ecx
mov esi, ecx
xor esi, dword [ebp + 0x10]
rol eax, 0xb
sub esi, eax
xor edi, esi
mov eax, esi
ror eax, 7
sub edi, eax
mov eax, edi
xor ecx, edi
rol eax, 0x10
sub ecx, eax
mov eax, ecx
mov edx, ecx
rol eax, 4
xor edx, esi
sub edx, eax
mov eax, edx
xor edi, edx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor ecx, edi
ror eax, 8
sub ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1016a970
Capabilities:
Get common file path

Disassembly:
mov eax, 0x230
call fcn.10249b80
mov eax, dword [0x10390724]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x104eec30], 0
mov dword [esp], 0x10292ca8
mov dword [esp + 4], 0x1016a360
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x1016a720
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x1016a310
jne 0x1016aacb
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1016aac1
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.1025a6ab
push 0x1029e9f8
lea eax, [esp + 0x38]
push 0x10c
push eax
call fcn.1025b952
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x40]
add esp, 0x18
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x1016aa3f
push 0x10292ca8
push edi
call ebx
test eax, eax
jne 0x1016aa86
push edi
call ebp
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.1025a6ab
push str.wship6
lea eax, [esp + 0x38]
push 0x10c
push eax
call fcn.1025b952
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call esi
mov edi, eax
test edi, edi
je 0x1016aabd
push 0x10292ca8
push edi
call ebx
test eax, eax
je 0x1016aaba
xor esi, esi
push dword [esp + esi*8 + 0x10]
push edi
call ebx
mov dword [esp + esi*8 + 0x14], eax
test eax, eax
je 0x1016aaba
inc esi
cmp esi, 3
jl 0x1016aa88
mov eax, dword [esp + 0x14]
mov dword [0x1038f994], eax
mov eax, dword [esp + 0x1c]
mov dword [0x1038f99c], eax
mov eax, dword [esp + 0x24]
mov dword [0x1038f9a4], eax
jmp 0x1016aabd
push edi
call ebp
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x104eec30], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
mov eax, dword [eax*8 + 0x1038f994]
call fcn.10249797
add esp, 0x230
ret 4
Function at 0x1016ab00
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x820
call fcn.10249b80
mov eax, dword [0x10390724]
xor eax, esp
mov dword [esp + 0x81c], eax
push ebx
mov ebx, dword [esp + 0x83c]
lea eax, [esp + 0x18]
push ebp
push esi
mov esi, dword [esp + 0x830]
push edi
push 0x401
push 0
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0
call fcn.1024a9c0
push 0x401
lea eax, [esp + 0x438]
push 0
push eax
call fcn.1024a9c0
push 0x400
push esi
lea eax, [esp + 0x44]
push 0x401
push eax
mov dword [esp + 0x3c], eax
lea ebp, [esp + 0x450]
call fcn.1025a0f3
add esp, 0x28
push esi
mov edi, ebx
mov dword [ebx], 0
mov byte [ebp], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x1016accf
cmp word [ebx + 8], 2
jne 0x1016abf2
cmp word [ebx + 0xa], 4
jne 0x1016abf2
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x1016abf2
nop word [eax + eax]
push dword [eax]
push dword [esp + 0x844]
push dword [esp + 0x844]
push dword [esp + 0x844]
call fcn.1016ad30
mov dword [edi], eax
test eax, eax
je 0x1016acc8
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x1016abc0
push 0x400
push dword [ebx]
push 0x401
push ebp
call fcn.1025a0f3
mov ebx, dword [esp + 0x28]
xor esi, esi
add esp, 0x10
cmp dword [ebx], esi
jne 0x1016ac80
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1016ac16
sub ecx, edx
je case.0x1016acdf.11003
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1016ac50
test dl, dl
je 0x1016ac4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1016ac50
add eax, 2
add ecx, 2
test dl, dl
jne 0x1016ac30
xor eax, eax
jmp 0x1016ac55
sbb eax, eax
or eax, 1
test eax, eax
je case.0x1016acdf.11003
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x10
je case.0x1016acdf.11003
mov esi, dword [esp + 0x1c]
mov eax, edi
mov dword [esp + 0x14], ebp
mov ebp, eax
jmp 0x1016ab82
cmp dword [esp + 0x844], esi
je 0x1016acf9
mov ecx, ebp
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1016ac90
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call fcn.1025a359
mov edi, eax
add esp, 8
test edi, edi
je 0x1016acb8
push ebp
push ebx
push edi
call fcn.1025a6ab
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
cmp dword [eax + 0x14], esi
jne 0x1016acf9
mov esi, 8
jmp 0x1016acf9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x1016acdf.11001
jmp dword [eax*4 + 0x1016ad18]
mov esi, 0x2afa
jmp 0x1016acf9
mov esi, 0x2afb
jmp 0x1016acf9
mov esi, 0x2af9
mov ecx, dword [esp + 0x82c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10249797
add esp, 0x820
ret 0x18
Function at 0x10268d78
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10268bee

Function at 0x10269dfd
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10269d7f

Function at 0x1026d49a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1026cfed
Function at 0x6def96
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
and dl, 0x11
mov dword [esp + edx*2 - 0x621a], esi
shl byte [esp + eax - 0x310e], 0x65
or edx, eax
not word [esp + eax*2 - 0x6220]
mov dword [esp + eax*2 - 0x6220], ebx
mov ebx, ecx
mov dword [esp + eax*8 - 0x18890], 0xee2cf383
mov edx, ebx
mov byte [esp + eax*2 - 0x6222], al
shl edx, 2
sal al, 0x64
and word [esp + eax*2 - 0x623e], ax
mov eax, ebp
jno 0x712683
adc eax, edx
shr word [esp], 0xca
push 0x4fb5acbc
js 0xaee941
mov dword [ebp - 4], eax
setae byte [esp + 4]
test ebx, ebx
call fcn.00b2ece1
mov edx, 0xdc2c5ea1
lea ecx, [edx*2 - 0x53668fc7]

Function at 0x6defeb
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
cmp esi, ecx
lea esp, [esp + 8]
ja fcn.00735567
mov ebp, 0xcd830892
mov eax, esp
movsx ecx, bp
shr ecx, 0x54
lea ecx, [ecx + 0x78]
btc ebp, ebp
lea ebp, [esi - 0x80]
jae 0x7cdd82
and ebp, 0xfffffffc
jmp 0x821478
sub ebp, ecx
call fcn.0073a636

Function at 0x6f5b0b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc edi
mov dword [esp + 8], 0xcc14d08f
jmp 0x70c5c8
mov dword [esp], 0xf5adb6ab
neg edi
mov dword [esp + 0xc], 0xae352029
inc dword [esp + 0xb]
not edi
push 0x40bbda8b
jg 0x7de24b
dec edi
shl word [esp + 6], 0xa
rol dword [esp + 4], 0x6e
bswap edi
jne 0x77bf29

Function at 0x7052a8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, dword [esp + ecx - 0x7f25cc2f]
lea ecx, [edi + edi*8 + 0x6d9bd504]
push edi
lea ebp, [ecx + ecx*2 - 0x11e64bdd]
mov edi, dword [esp + edi - 0x33cc2573]
call fcn.006fd05e
rcr bh, 0x22

Function at 0x70693b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jno 0xb1b63d
neg dl
not dl
sar dword [esp], 0x63
jnp 0xb17f91
shl byte [esp], 0xa2
xor bl, dl
shl word [esp], 0xe
not word [esp + 1]
lea edx, [esp + edx + 4]
mov word [edx], bp
jp 0x7b8188
and word [esp + 0xd], 0x9d28
jns 0x6ffcea
mov edx, 0x780b500b
or edx, edx
mov ebp, edx
movzx edx, byte [esi + ebp - 0x780b500b]
lea esi, [esi + ebp - 0x780b500a]
lea esp, [esp + 0x14]
jns fcn.006f3e17
mov eax, 0x4b98f494
xor eax, eax
movzx ecx, al
add ax, word [edi + eax*2]
shl cx, 0x82
inc cl
lea ecx, [ecx + ecx*2 + 0x320ca4b6]
mov cl, byte [ecx + edi - 0x320ca4b7]
ja 0x6dc3ce
ror dl, 1
neg word [esp + 2]
inc dl
jmp 0x6f2242
xor bl, al
not byte [esp + 0xe]
jmp 0x7e9bda
jmp 0x75b383
ror cl, 1
xor bl, cl
mov dword [esp], 0x47ba54aa
shr dword [esp + 0xf], 6
lea ecx, [esp + ecx + 0x14]
mov dword [ecx], ebp
setae byte [esp + 0xd]
jne 0x6f3cbe
not dword [esp]
call fcn.00b7bdc8
lea eax, [esp + eax + 0x10]
push 0x8910eeb9
push 0x23057e17
mov byte [eax], dl
lea esp, [esp + 0x18]
jmp fcn.00735567
mov cl, byte [edi + ecx - 0x6a29c914]
add byte [esp + 2], 0x10
adc edi, 2
or dl, cl
jmp 0xb2c964
not dl
call fcn.00843c3e
Function at 0x71e099
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xdc22619c
push 0x44b50bbc
inc ebp
xor esi, esp
dec word [esp + 1]
jne 0x72cf84
mov ecx, 0xcaae44be
movzx edx, cl
mov edx, dword [ebp + edx*2 - 0x17c]
shr ecx, cl
mov cl, byte [ebp + ecx + 1]
adc ebp, 6
push 0x872282b0
push 0x9a9e65b4
push 0x12b283d
mov byte ss:[edx], cl
jmp 0xb67487
inc ecx
and esi, 0xff
dec eax
sar dword [esp + 7], 0xa5
call int.0084735a
lea esp, [esp + 0xc]
jmp fcn.007683bb

Function at 0x74eeaf
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
je 0x7fbe0f
add dword [ebx - 0x7b9dbeeb], edx
fisubr dword [edx]
mov eax, 0xfa12900
mov edx, dword [eax + edi - 0xfa12900]
and eax, 0x14195013
mov eax, dword [edi + eax*2 - 0x801fffc]
mov ebp, dword [edi + 8]
jp 0xb4ab06
push 0x668004ba
push 0xf9159e8a
lea esp, [esp + 0x18]
je 0x7fbe16
mov eax, 0x51a39a29
sar ax, 0x89
xor ax, ax
mov eax, dword [ebp + ebx*4]
push eax
jp 0x6defe5
jecxz 0x74ee86
mov byte [esi + 0x4464c389], al
or ah, dl
pop esi
push eax
dec edi
add eax, 0xea361a3a
dec eax
inc esi
sbb dword [ebx - 0x4c], edx
xchg esp, eax
enter 0xffffffffffffc614, 0xffffffffffffffc8
mov bh, 0xfd
or ch, byte [edx]
outsb dx, byte [esi]
mov dl, 0xb8
mov dh, 0x39
mov esp, dword [ebp - 0xa]
ljmp 0xe08c
mov dword [edi + 4], eax
call fcn.00820665
push 0xe725cc04
call fcn.0073963d
dec ebx
jne 0x74eec3
push 0x89962596
mov eax, 0xb807dd9b
pop eax
mov eax, dword [eax + ebp + 0x7669da6a]
push 0xb73842a7
not dword [esp]
lea esp, [esp + 4]
call eax
push 0x6f81e8ae
mov ebp, dword [ebp - 4]
pop ebx
mov edi, 0xca232ab1
mov dword [ebp + ebx - 0x6f81e8ae], eax
lea ebx, [ebx - 0x4453a0d2]
bswap ebx
pop ebx
not edi
call fcn.0077d5db
add cl, byte [ebx + 0x44]
push cs
imul ecx, dword [ecx + 0x65], 0xd2ada3b9
cwde
out dx, eax
iretd
push 0x9e24882b
adc edi, 4
div ebp
mov dword [edi], edx
jmp 0x7ca4c5

Function at 0x767c61
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp + ebx*4]
jmp 0x814688
mov dword [esp], 0xa7154ca5
mov dword [esp + 4], 0x940ce3bb
dec ebp
push 0x46125430
lea esp, [esp + 0x10]
jne 0xb50bfc
mov edi, 0x7a923abe
jmp 0x81078a
push 0xa1978135
jmp 0x8107ac
push edi
mov edi, dword [esp + edi - 0x7a923aba]
lea esp, [esp + 8]
push 0xca8d24a7
push 0x628ac606
push 0x829e120a
not edx
call fcn.006e392e
lea esp, [esp + 4]
jne 0x6e6126
call fcn.00b2c96b
push 0x779c9f3d
mov dword [esp], eax
dec ebx
jmp 0x7a5ca0
mov edi, 0x2017edb9
or edi, edi
imul edi, edi
movzx edi, byte [eax]
xor edi, edx
push 0xe89838c
ror dword [esp], 0xc2
and edi, 0xff
jmp fcn.00af6003

Function at 0x76d2e8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jp 0x733635
mov eax, 0x5baf6334
rdtsc
push 0x9e0fa48d
shr word [esp], 0xc9
sar byte [esp + 2], 0x67
sbb edi, 8
call fcn.00757167
mov edx, 0x5132e8a0
mov edx, dword [ebp + edx - 0x5132e8a0]
mov esi, 0xda0fcb9f
xor esi, 0x1b1e3829
mov si, word [edx]
call fcn.00ae2653