joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100013f2
Capabilities:
Set socket configuration

Disassembly:
jmp 0x10084fd0
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x10085010
push 0xcc
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
ret

Function at 0x10001569
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
jmp 0x10081a60
mov eax, 8
call fcn.101704b0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push 0x1048
push 0x1017c760
push esi
call sub.MSVCR120.dll_memcpy
mov ecx, dword [esp + 0x2c]
mov eax, 0x48
mov edi, dword [esp + 0x30]
add esp, 0xc
cmp ecx, eax
cmovg ecx, eax
mov eax, edi
xor ebp, ebp
lea ebx, [ecx + edi]
mov edi, edi
movzx edx, byte [eax]
inc eax
cmp eax, ebx
cmovae eax, edi
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, ebx
cmovae eax, edi
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, ebx
cmovae eax, edi
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, ebx
cmovae eax, edi
xor dword [esi + ebp*4], edx
inc ebp
cmp ebp, 0x12
jl 0x10081aa0
mov dword [esp + 0x10], 0
xor edi, edi
mov dword [esp + 0x14], 0
mov edi, edi
lea eax, [esp + 0x10]
push esi
push eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [esi + edi*4], eax
mov eax, dword [esp + 0x14]
mov dword [esi + edi*4 + 4], eax
add edi, 2
cmp edi, 0x12
jl 0x10081af0
xor edi, edi
lea eax, [esp + 0x10]
push esi
push eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [esi + edi*4 + 0x48], eax
mov eax, dword [esp + 0x14]
mov dword [esi + edi*4 + 0x4c], eax
add edi, 2
cmp edi, 0x400
jl 0x10081b17
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1000168b
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x10084e00
cmp dword [esp + 8], 0
je 0x10084e18
push 0x174
push str.crypto_bio_b_sock.c
push 0x8c
jmp 0x10084e94
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov eax, dword [esp + 0x10]
push dword [eax]
call fcn.10002a9f
add esp, 4
push eax
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x10084e7e
push 0x169
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x10
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x16a
push str.crypto_bio_b_sock.c
push 0x84
push 0x8d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
xor eax, eax
ret
cmp dword [esp + 8], 0x1c
jbe 0x10084ea6
push 0x16e
push str.crypto_bio_b_sock.c
push 0x85
push 0x8d
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
ret
mov eax, 1
ret
Function at 0x100016c2
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x10084ee0
cmp dword [0x101f28a8], 0
jne 0x10084f51
push 0x190
push 0
push 0x101f28b0
mov dword [0x101f28a8], 1
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x101f28b0
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10084f51
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x90
push str.crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x91
push str.crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x28
or eax, 0xffffffff
ret
mov eax, 1
ret

Function at 0x10001820
Capabilities:
Encode data using base64

Disassembly:
jmp 0x100f9490
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x100f957c
push edi
mov edi, dword [esp + 0x14]
inc edi
lea ebx, [ebx]
movzx edx, byte [edi - 1]
cmp esi, 3
jl 0x100f950e
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and ecx, 0x3f
and edx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
jmp 0x100f955f
shl edx, 0x10
cmp esi, 2
jne 0x100f951e
movzx ecx, byte [edi]
shl ecx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x100f954b
lea ecx, [esi + 0x3c]
jmp 0x100f9558
shr edx, 6
and edx, 0x3f
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
sub esi, 3
add eax, 4
add ebx, 4
add edi, 3
test esi, esi
jg 0x100f94b0
pop edi
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
ret
mov byte [eax], bl
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x1000187a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1010c190
mov eax, 4
call fcn.101704b0
push ebp
mov ebp, dword [esp + 0x14]
cmp ebp, 0x10
ja 0x1010c1a9
xor eax, eax
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x20]
mov eax, 0x10
push esi
mov esi, dword [esp + 0x14]
push edi
push dword [esp + 0x2c]
mov edi, ebp
push ebx
push dword [esp + 0x2c]
and edi, 0xf
cmove edi, eax
sub ebp, edi
push ebp
push dword [esp + 0x2c]
mov dword [esp + 0x34], ebp
push esi
call sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
add dword [esp + 0x34], ebp
add esp, 0x18
add esi, ebp
xor ecx, ecx
test edi, edi
je 0x1010c26e
cmp edi, 0x20
jb 0x1010c255
lea eax, [edi - 1]
lea edx, [ebx - 1]
add eax, esi
add edx, edi
cmp ebx, eax
ja 0x1010c205
cmp edx, esi
jae 0x1010c255
mov eax, edi
mov edx, edi
and eax, 0x1f
mov ebp, esi
sub edx, eax
sub ebp, ebx
mov dword [esp + 0x10], ebp
mov eax, ebx
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x10]
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [ebx + eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
movdqu xmm1, xmmword [esi + ecx + 0x10]
add ecx, 0x20
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
cmp ecx, edx
jb 0x1010c220
mov ebx, dword [esp + 0x28]
cmp ecx, edi
jae 0x1010c26e
mov edx, edi
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edx
jne 0x1010c262
push dword [esp + 0x24]
push ebx
push ebx
call dword [esp + 0x38]
mov eax, dword [esp + 0x28]
push edi
lea esi, [eax - 0x10]
push esi
push eax
call sub.MSVCR120.dll_memcpy
movdqu xmm0, xmmword [ebx]
add esp, 0x18
lea eax, [edi + ebp]
movdqu xmmword [esi], xmm0
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret
Function at 0x10002036
Capabilities:
Query environment variable

Disassembly:
jmp 0x100b8250
mov eax, 8
call fcn.101704b0
cmp dword [0x101f2b10], 0
jne 0x100b837b
push ebx
push edi
push str.OPENSSL_ia32cap
mov dword [0x101f2b10], 1
call dword [sym.imp.MSVCR120.dll_getenv]
mov edi, eax
add esp, 4
test edi, edi
je 0x100b834d
xor ebx, ebx
lea eax, [esp + 8]
cmp byte [edi], 0x7e
push esi
sete bl
push eax
push str._I64i
lea esi, [ebx + edi]
push esi
call dword [sym.imp.MSVCR120.dll_sscanf]
add esp, 0xc
test eax, eax
jne 0x100b82c7
push eax
push eax
push esi
call dword [sym.imp.MSVCR120.dll_strtoul]
add esp, 0xc
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x100b82ea
push 0x101f5d10
call fcn.100676c0
mov esi, dword [esp + 0x10]
add esp, 4
mov ecx, dword [esp + 0x10]
not esi
not ecx
and eax, esi
and edx, ecx
jmp 0x100b82fc
cmp byte [edi], 0x3a
jne 0x100b8304
push 0x101f5d10
call fcn.100676c0
add esp, 4
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
push 0x3a
push edi
mov dword [0x101f5d18], 0
call dword [sym.imp.MSVCR120.dll_strchr]
add esp, 8
pop esi
test eax, eax
je 0x100b8362
inc eax
xor ebx, ebx
push 0
push 0
cmp byte [eax], 0x7e
sete bl
add eax, ebx
push eax
call dword [sym.imp.MSVCR120.dll_strtoul]
add esp, 0xc
test ebx, ebx
je 0x100b8346
not eax
and dword [0x101f5d18], eax
jmp 0x100b8362
mov dword [0x101f5d18], eax
jmp 0x100b8362
push 0x101f5d10
call fcn.100676c0
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 8]
or eax, 0x400
mov dword [0x101f5d10], eax
mov eax, dword [esp + 0xc]
pop edi
mov dword [0x101f5d14], eax
pop ebx
add esp, 8
ret

Function at 0x100022b1
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10138eb0
cmp dword [esp + 0x18], 0
je 0x10138ec4
mov dword [esp + 0x18], sym.libcrypto_1_1.dll_SEED_encrypt
jmp sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
mov dword [esp + 0x18], sym.libcrypto_1_1.dll_SEED_decrypt
jmp sym.libcrypto_1_1.dll_CRYPTO_cbc128_decrypt
Function at 0x10002306
Capabilities:
Write file on windows

Disassembly:
jmp 0x1012b350
mov eax, 0x42c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x43c]
lea eax, [esp + 0x10]
push eax
push edi
xor esi, esi
xor ebp, ebp
call dword [sym.imp.MSVCR120.dll__stat32]
add esp, 8
cmp eax, 0xffffffff
je 0x1012b3af
test dword [esp + 0x16], 0x2000
je 0x1012b3af
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
push 0x101bbcb4
push edi
call fcn.10004101
add esp, 8
mov dword [esp + 0xc], eax
test eax, eax
je 0x1012b44a
push ebx
push 0x180
push edi
call dword [sym.imp.MSVCR120.dll__chmod]
mov ebx, 0x400
add esp, 8
mov ecx, ebx
cmp ebx, 0x400
lea eax, [esp + 0x38]
mov edi, ebx
cmovg edi, ecx
sub ebx, 0x400
push edi
push eax
call sym.libcrypto_1_1.dll_RAND_bytes
push dword [esp + 0x18]
test eax, eax
mov eax, 1
push edi
push eax
cmovle ebp, eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x18
test eax, eax
jle 0x1012b42b
add esi, eax
test ebx, ebx
jle 0x1012b42d
mov ecx, 0x400
jmp 0x1012b3e0
xor esi, esi
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_fclose]
lea eax, [esp + 0x3c]
push 0x400
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
add esp, 0xc
pop ebx
mov ecx, dword [esp + 0x434]
or eax, 0xffffffff
test ebp, ebp
pop edi
cmovne esi, eax
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
Function at 0x100023ec
Capabilities:
Read file on windows

Disassembly:
jmp 0x1012b160
mov eax, 0x42c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x428], eax
mov eax, dword [esp + 0x430]
push edi
xor edi, edi
mov dword [esp + 4], edi
test eax, eax
jne 0x1012b1a0
pop edi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
push esi
mov esi, dword [esp + 0x43c]
test esi, esi
jne 0x1012b1c5
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
push ebp
push 0x10189a04
push eax
call fcn.10004101
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x1012b2cf
lea eax, [esp + 0x10]
mov dword [esp + 0x30], edi
xorps xmm0, xmm0
push eax
push ebp
movdqu xmmword [esp + 0x18], xmm0
movdqu xmmword [esp + 0x28], xmm0
call dword [sym.imp.MSVCR120.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll__fstat32]
add esp, 8
test eax, eax
js 0x1012b2c5
mov eax, 8
call fcn.101704b0
xorps xmm0, xmm0
lea eax, [esp + 0x18]
movsd qword [esp], xmm0
push 0x24
push eax
call sym.libcrypto_1_1.dll_RAND_add
add esp, 0x10
test dword [esp + 0x16], 0x2000
je 0x1012b254
mov eax, 0x800
cmp esi, 0xffffffff
push 0
push ebp
cmove esi, eax
call dword [sym.imp.MSVCR120.dll_setbuf]
add esp, 8
push ebx
mov edi, 0x400
test esi, esi
jle 0x1012b263
cmp esi, edi
cmovl edi, esi
push ebp
push edi
lea eax, [esp + 0x40]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x1012b2ae
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.101704b0
lea eax, [esp + 0x40]
movsd qword [esp], xmm0
push ebx
push eax
call sym.libcrypto_1_1.dll_RAND_add
add dword [esp + 0x20], ebx
add esp, 0x10
test esi, esi
jle 0x1012b255
sub esi, edi
test esi, esi
jg 0x1012b255
lea eax, [esp + 0x38]
push 0x400
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov edi, dword [esp + 0x18]
add esp, 8
pop ebx
push ebp
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0x434]
mov eax, edi
pop ebp
pop esi
pop edi
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
Function at 0x100025e5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1010aef0
mov eax, 0x5c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x64]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x74]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], ecx
cmp dword [esp + 0x70], ecx
jbe 0x1010b080
lea eax, [esp + 0x3c]
sub eax, ebx
push ebp
push esi
mov dword [esp + 0x28], eax
mov esi, ebx
lea eax, [esp + 0x45]
sub esi, eax
lea eax, [ebx + 2]
lea edx, [eax - 1]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], edx
movdqu xmm0, xmmword [ebx]
mov eax, ecx
mov ebp, 7
and eax, 7
mov edx, 1
sub ebp, eax
mov eax, ecx
mov ecx, dword [esp + 0x70]
shr eax, 3
mov dword [esp + 0x24], eax
push edi
push ebx
mov al, byte [eax + ecx]
mov ecx, ebp
shl edx, cl
and al, dl
mov dword [esp + 0x48], ebp
neg al
push ebx
sbb al, al
and al, 0x80
mov byte [esp + 0x1f], al
movdqu xmmword [esp + 0x50], xmm0
call dword [esp + 0x44]
add esp, 0xc
cmp dword [esp + 0x88], 0
je 0x1010afc3
movzx edx, byte [ebx]
movzx eax, byte [esp + 0x13]
xor edx, eax
mov byte [esp + 0x54], dl
jmp 0x1010afcf
mov al, byte [esp + 0x13]
mov dl, byte [ebx]
mov byte [esp + 0x54], al
xor dl, al
mov dword [esp + 0x18], edx
xor ebp, ebp
mov edx, dword [esp + 0x28]
lea esp, [esp]
lea edi, [esp + 0x45]
add edi, ebp
add esi, edi
mov ah, byte [edi]
movzx ecx, byte [esi + edx]
mov al, ah
mov bl, byte [edi + 1]
add cl, cl
shr al, 7
add ah, ah
or cl, al
mov al, bl
shr al, 7
add bl, bl
mov byte [esi], cl
or al, ah
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov byte [ecx + ebp], al
mov cl, byte [edi + 2]
mov al, cl
add cl, cl
shr al, 7
or al, bl
mov ebx, dword [esp + 0x30]
mov byte [ebx + ebp], al
mov al, byte [edi + 3]
shr al, 7
or al, cl
mov byte [ebx + ebp + 1], al
add ebp, 4
cmp ebp, 0x10
jl 0x1010afe0
mov cl, byte [esp + 0x14]
mov al, 1
mov edx, dword [esp + 0x18]
and cl, 7
mov ebx, dword [esp + 0x2c]
and dl, 0x80
mov edi, dword [esp + 0x3c]
shr dl, cl
mov ecx, dword [esp + 0x40]
shl al, cl
mov ecx, dword [esp + 0x24]
not al
and al, byte [ecx + ebx]
or dl, al
mov byte [ecx + ebx], dl
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x34]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, dword [esp + 0x78]
jb 0x1010af60
pop esi
pop ebp
mov ecx, dword [esp + 0x60]
pop edi
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x5c
ret
Function at 0x10002793
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1010c8b0
mov eax, 4
call fcn.101704b0
push ebx
mov ebx, dword [esp + 0x14]
cmp ebx, 0x10
jae 0x1010c8c9
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
push dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
mov esi, ebx
push ebp
push dword [esp + 0x2c]
and esi, 0xf
sub ebx, esi
push ebx
push eax
push edi
mov dword [esp + 0x38], ebx
call sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
add esp, 0x18
test esi, esi
jne 0x1010c903
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
add dword [esp + 0x1c], ebx
add edi, ebx
xor ecx, ecx
test esi, esi
je 0x1010c99e
cmp esi, 0x20
jb 0x1010c985
lea eax, [esi - 1]
lea edx, [ebp - 1]
add eax, edi
add edx, esi
cmp ebp, eax
ja 0x1010c92a
cmp edx, edi
jae 0x1010c985
mov eax, esi
mov edx, esi
and eax, 0x1f
mov ebx, edi
sub edx, eax
sub ebx, ebp
mov dword [esp + 0x10], ebx
mov eax, ebp
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
jmp 0x1010c950
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
movdqu xmm1, xmmword [edi + ecx + 0x10]
add ecx, 0x20
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
cmp ecx, edx
jb 0x1010c950
mov ebp, dword [esp + 0x28]
cmp ecx, esi
jae 0x1010c99e
mov edx, esi
lea eax, [ecx + ebp]
sub edi, ebp
sub edx, ecx
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edx
jne 0x1010c992
push dword [esp + 0x24]
push ebp
push ebp
call dword [esp + 0x38]
mov eax, dword [esp + 0x28]
add esp, 0xc
movdqu xmm0, xmmword [ebp]
pop edi
movdqu xmmword [esi + eax - 0x10], xmm0
lea eax, [esi + ebx]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100027a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x100daed0
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x7c]
test eax, eax
jne 0x100daee6
mov dword [esp + 4], ecx
jmp fcn.10002b7b
mov dword [esp + 4], ecx
jmp eax
Function at 0x10002914
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1010b9b0
mov eax, 8
call fcn.101704b0
mov edx, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [edx]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
test edi, edi
je 0x1010b9fd
mov ecx, dword [esp + 0x30]
test esi, esi
je 0x1010b9fd
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
mov dword [esp + 0x10], esi
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x1010b9e0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0xc]
bswap ecx
mov dword [esp + 0x24], ecx
cmp esi, 0x10
jb 0x1010ba98
mov edi, esi
shr edi, 4
add ecx, edi
mov dword [esp + 0x24], ecx
cmp ecx, edi
jae 0x1010ba2a
sub edi, ecx
xor ecx, ecx
mov dword [esp + 0x24], ecx
push eax
push dword [esp + 0x2c]
push edi
push ebx
push ebp
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
mov edx, dword [esp + 0x2c]
mov eax, ecx
bswap eax
mov dword [edx + 0xc], eax
test ecx, ecx
jne 0x1010ba7a
mov esi, dword [esp + 0x2c]
mov edx, 0xc
mov ecx, 1
lea ebx, [ebx]
movzx eax, byte [edx + esi - 1]
dec edx
add ecx, eax
mov byte [edx + esi], cl
shr ecx, 8
test edx, edx
jne 0x1010ba60
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
shl edi, 4
sub esi, edi
add ebx, edi
add ebp, edi
mov dword [esp + 0x10], esi
cmp esi, 0x10
jae 0x1010ba13
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x34]
test esi, esi
je 0x1010bafe
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
push eax
push dword [esp + 0x2c]
push 1
push ecx
push ecx
movdqu xmmword [ecx], xmm0
call dword [esp + 0x4c]
mov eax, dword [esp + 0x38]
add esp, 0x14
mov edx, dword [esp + 0x2c]
inc eax
bswap eax
mov dword [edx + 0xc], eax
jne 0x1010bad0
push edx
call fcn.1010bbc0
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
lea ecx, [ecx]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
dec esi
jne 0x1010bae0
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov dword [edx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10002bcb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x100be0a0
mov eax, 0x98
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa0]
push edi
mov edi, dword [esp + 0xa8]
mov al, byte [ecx]
mov byte [edi], al
movsx eax, al
test eax, eax
je 0x100be28d
cmp eax, 0x80
jae 0x100be28d
push ebx
movzx ebx, byte [eax + 0x1018a888]
mov al, byte [ecx + 1]
mov byte [edi + 1], al
movsx eax, al
shl ebx, 2
test eax, eax
je 0x100be274
cmp eax, 0x80
jae 0x100be274
mov edx, dword [esp + 0xa4]
push esi
movzx esi, byte [eax + 0x1018a888]
shl esi, 6
xor eax, eax
lea esp, [esp]
mov cl, byte [edx]
lea edx, [edx + 1]
test cl, cl
je 0x100be13a
add cl, cl
mov byte [esp + eax + 0x94], cl
inc eax
cmp eax, 8
jb 0x100be120
jmp 0x100be14d
cmp eax, 8
jae 0x100be14d
mov byte [esp + eax + 0x94], 0
inc eax
cmp eax, 8
jb 0x100be13f
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x98]
push eax
call sym.libcrypto_1_1.dll_DES_set_key_unchecked
push esi
push ebx
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.1001cb80
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xac]
mov eax, ecx
mov byte [esp + 0xac], cl
shr eax, 8
add esp, 0x18
mov byte [esp + 0x95], al
mov esi, 2
mov eax, ecx
mov byte [esp + 0x9c], 0
shr eax, 0x10
mov ebx, 1
shr ecx, 0x18
mov byte [esp + 0x96], al
mov byte [esp + 0x97], cl
mov ecx, dword [esp + 0x10]
mov eax, ecx
shr eax, 8
mov byte [esp + 0x99], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x98], cl
shr ecx, 0x18
mov byte [esp + 0x9a], al
mov al, 0x80
mov byte [esp + 0x9b], cl
xor cl, cl
test byte [edx], al
movzx ecx, cl
cmovne ecx, ebx
shr al, 1
jne 0x100be1f9
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x100be201
or cl, bl
shr al, 1
jne 0x100be208
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x100be210
or cl, bl
shr al, 1
jne 0x100be217
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x100be21f
or cl, bl
shr al, 1
jne 0x100be226
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x100be22e
or cl, bl
shr al, 1
jne 0x100be235
inc edx
mov al, 0x80
add cl, cl
test byte [edx], al
je 0x100be23d
or cl, bl
shr al, 1
jne 0x100be244
inc edx
mov al, 0x80
movzx ecx, cl
mov cl, byte [ecx + 0x1018a908]
mov byte [edi + esi], cl
inc esi
cmp esi, 0xd
jb 0x100be1e8
pop esi
pop ebx
mov byte [edi + 0xd], 0
mov eax, edi
pop edi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.101704a0
add esp, 0x98
ret
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.101704a0
add esp, 0x98
ret
mov ecx, dword [esp + 0x98]
xor eax, eax
pop edi
xor ecx, esp
call fcn.101704a0
add esp, 0x98
ret
Function at 0x10002d5b
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
jmp 0x1012ae90
jmp sym.libcrypto_1_1.dll_RAND_poll

Function at 0x10002d83
Capabilities:
Query environment variable

Disassembly:
jmp 0x100b8d70
push str.CTLOG_FILE
call dword [sym.imp.MSVCR120.dll_getenv]
test eax, eax
mov ecx, str.C:Program_Files__x86_Common_FilesSSL_ct_log_list.cnf
cmovne ecx, eax
push ecx
push dword [esp + 0xc]
call sym.libcrypto_1_1.dll_CTLOG_STORE_load_file
add esp, 0xc
ret
Function at 0x100030e4
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x10135a80
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x10135b43
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x10135aa1
cmp al, 0x6b
jne 0x10135b43
inc ecx
cmp al, 0x6b
jne 0x10135b08
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x10135ac2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x10135ac2
cmp dl, 0xbb
jne 0x10135ae8
inc eax
cmp eax, esi
jl 0x10135ab0
sub esi, eax
test eax, eax
jne 0x10135b0b
push 0x50
push str.crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x48
push str.crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x10135b31
push 0x58
push str.crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x3d
push str.crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret