joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x1002f76a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x1002f6fd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1002f6c3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1002f833
call 0x1002f70f
pop edx
lea ecx, [edx + 0x171]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1002f7ca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.libcrypto_1_1.dll_BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1002f77b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1002f833
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.libcrypto_1_1.dll_BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1002f82e
jmp 0x1002f833
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1002ff00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1002ff00
mov eax, 0x28
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x24], eax
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
movzx eax, byte [edx]
shl eax, 0x10
or ebx, eax
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
shl ecx, 0x18
or ecx, eax
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
or edx, ecx
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov edi, dword [esp + 0x50]
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov esi, dword [edi]
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
mov byte [esp + 0x2f], bl
mov byte [esp + 0x33], dl
test eax, eax
je 0x100300c5
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea ebx, [ebx]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x10030055
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x36], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
add esp, 8
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
inc ebp
mov al, byte [esp + esi + 0x2c]
xor al, byte [edi]
inc esi
mov byte [ecx + edi], al
mov eax, dword [esp + 0x44]
inc edi
and esi, 7
test eax, eax
jne 0x1002fff0
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x100300ac
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov byte [ebp + 2], bl
mov eax, edx
shr eax, 0x18
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.101aa6fb
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101aa6fb
add esp, 0x28
ret
Function at 0x10030b50
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x428
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x424], eax
push ebx
mov ebx, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x440]
push edi
mov edi, dword [esp + 0x440]
call sym.libcrypto_1_1.dll_BIO_sock_init
cmp eax, 1
je 0x10030ba4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.101aa6fb
add esp, 0x428
ret
push 0x400
lea eax, [esp + 0x31]
push 0
push eax
mov byte [esp + 0x38], 0
call fcn.101aad60
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x43c], ecx
mov eax, 0xa
xorps xmm0, xmm0
cmovne ecx, eax
cmp word [ebx], 2
mov byte [esp + 0xc], 0
movq qword [esp + 0xd], xmm0
movq qword [esp + 0x15], xmm0
movq qword [esp + 0x1d], xmm0
mov dword [esp + 0x25], 0
mov word [esp + 0x29], 0
mov byte [esp + 0x2b], 0
mov eax, 0x10
je 0x10030c0c
mov eax, 0x1c
push ebp
push ecx
push 0x20
lea ecx, [esp + 0x18]
push ecx
push 0x401
lea ecx, [esp + 0x40]
push ecx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov ebp, eax
test ebp, ebp
je 0x10030c7d
push 0xd7
push str...crypto_bio_b_addr.c
push 2
push 0x86
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
push 0
push 0x400
push 0x1027a2c0
push 0x400
push ebp
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x1027a2c0
push 1
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 8
xor eax, eax
jmp 0x10030d6a
cmp byte [esp + 0x10], 0
jne 0x10030cbe
movzx eax, word [ebx]
cmp eax, 2
jne 0x10030c92
movzx eax, word [ebx + 2]
jmp 0x10030c9f
cmp eax, 0x17
jne 0x10030c9d
movzx eax, word [ebx + 2]
jmp 0x10030c9f
xor eax, eax
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
push 0x101e5664
lea eax, [esp + 0x18]
push 0x20
push eax
call sym.libcrypto_1_1.dll_BIO_snprintf
add esp, 0x10
test edi, edi
je 0x10030cdb
push 0xe9
lea eax, [esp + 0x34]
push str...crypto_bio_b_addr.c
push eax
call sym.libcrypto_1_1.dll_CRYPTO_strdup
add esp, 0xc
mov dword [edi], eax
test esi, esi
je 0x10030cf8
push 0xeb
lea eax, [esp + 0x14]
push str...crypto_bio_b_addr.c
push eax
call sym.libcrypto_1_1.dll_CRYPTO_strdup
add esp, 0xc
mov dword [esi], eax
test edi, edi
je 0x10030d01
cmp dword [edi], 0
je 0x10030d0a
test esi, esi
je 0x10030d65
cmp dword [esi], 0
jne 0x10030d65
test edi, edi
je 0x10030d28
push 0xfa
push str...crypto_bio_b_addr.c
push dword [edi]
call sym.libcrypto_1_1.dll_CRYPTO_free
add esp, 0xc
mov dword [edi], 0
test esi, esi
je 0x10030d46
push 0xfe
push str...crypto_bio_b_addr.c
push dword [esi]
call sym.libcrypto_1_1.dll_CRYPTO_free
add esp, 0xc
mov dword [esi], 0
push 0x101
push str...crypto_bio_b_addr.c
push 0x41
push 0x86
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
jmp 0x10030d6a
mov eax, 1
mov ecx, dword [esp + 0x434]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101aa6fb
add esp, 0x428
ret
Function at 0x1003a490
Capabilities:
Set socket configuration

Disassembly:
mov eax, 0x24
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [esp + 0x2c]
push edi
mov edi, dword [ebx + 0x24]
mov dword [esp + 0xc], 0
cmp dword [edi + 0x28], 0
jg 0x1003a4c6
cmp dword [edi + 0x2c], 0
jle 0x1003a606
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0x1006
push 0xffff
push dword [ebx + 0x20]
mov dword [esp + 0x20], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jns 0x1003a4fe
push str.getsockopt
call fcn.101ac7c6
add esp, 4
jmp 0x1003a527
mov ecx, dword [esp + 8]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [edi + 0x30], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
mov dword [edi + 0x34], ecx
push ebp
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push 0
add esi, 0x2ac18000
push 0x989680
adc eax, 0xfe624e21
push eax
push esi
call fcn.101ac860
mov ebp, eax
imul eax, eax, 0x989680
mov ecx, dword [edi + 0x28]
sub esi, eax
mov eax, 0x66666667
imul esi
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [edi + 0x2c]
cmp edx, esi
jge 0x1003a596
mov eax, 0xf4240
sub eax, esi
add edx, eax
dec ecx
jmp 0x1003a598
sub edx, esi
cmp ecx, ebp
jge 0x1003a5a3
xor ecx, ecx
lea edx, [ecx + 1]
jmp 0x1003a5a5
sub ecx, ebp
mov eax, dword [edi + 0x30]
pop esi
pop ebp
test eax, eax
jne 0x1003a5b3
cmp dword [edi + 0x34], eax
je 0x1003a5be
cmp eax, ecx
jg 0x1003a5be
jne 0x1003a606
cmp dword [edi + 0x34], edx
jl 0x1003a606
mov eax, 0x10624dd3
imul ecx, ecx, 0x3e8
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
push 4
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x1006
push 0xffff
push dword [ebx + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1003a606
push str.setsockopt
call fcn.101ac7c6
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop ebx
xor ecx, esp
call fcn.101aa6fb
add esp, 0x24
ret

Function at 0x1003a700
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0x24]
cmp dword [esi + 0x28], 0
jg 0x1003a715
cmp dword [esi + 0x2c], 0
jle 0x1003a761
mov eax, 0x10624dd3
imul dword [esi + 0x34]
mov eax, dword [esi + 0x30]
imul eax, eax, 0x3e8
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push 4
add ecx, eax
lea eax, [esp + 0x10]
push eax
push 0x1006
push 0xffff
push dword [edi + 0x20]
mov dword [esp + 0x20], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1003a761
push str.setsockopt
call fcn.101ac7c6
add esp, 4
pop edi
pop esi
ret
Function at 0x10045e10
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x74
push 0
push esi
call fcn.101aad60
mov ecx, dword [esp + 0x18]
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov eax, dword [ecx]
xor eax, 0x6a09e667
mov dword [esi], eax
mov eax, dword [ecx + 4]
xor eax, 0xbb67ae85
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
xor eax, 0x3c6ef372
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
xor eax, 0xa54ff53a
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
xor eax, 0x510e527f
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
xor eax, 0x9b05688c
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
xor eax, 0x1f83d9ab
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
add esp, 0xc
xor eax, 0x5be0cd19
mov dword [esi + 0x1c], eax
pop esi
ret
Function at 0x1004a8c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x24
call fcn.101aa6d0
push ebx
push esi
mov esi, dword [esp + 0x40]
push edi
push dword [esp + 0x38]
mov edi, dword [esp + 0x40]
push dword [esp + 0x38]
mov ecx, esi
mov ebx, 1
shl ebx, cl
call fcn.100060af
add esp, 8
test eax, eax
jne 0x1004a8f9
pop edi
pop esi
pop ebx
add esp, 0x24
ret
push ebp
cmp esi, 3
jg 0x1004a95c
xor ebp, ebp
cmp dword [esp + 0x3c], ebp
jle 0x1004aaae
jmp 0x1004a910
xor esi, esi
xor eax, eax
test ebx, ebx
jle 0x1004a93d
mov ecx, eax
xor ecx, dword [esp + 0x44]
inc eax
lea edx, [ecx - 1]
shr edx, 0x1f
not ecx
shr ecx, 0x1f
and edx, ecx
neg edx
and edx, 1
neg edx
and edx, dword [edi + eax*4 - 4]
or esi, edx
cmp eax, ebx
jl 0x1004a918
mov eax, dword [esp + 0x38]
inc ebp
mov eax, dword [eax]
mov dword [eax + ebp*4 - 4], esi
lea eax, [ebx*4]
add edi, eax
cmp ebp, dword [esp + 0x3c]
jl 0x1004a910
jmp 0x1004aaae
mov ebp, dword [esp + 0x44]
lea ecx, [esi - 2]
mov esi, 1
shl esi, cl
mov edx, ebp
sar edx, cl
mov dword [esp + 0x2c], esi
lea eax, [esi - 1]
and ebp, eax
mov eax, edx
not eax
shr eax, 0x1f
lea ecx, [edx - 1]
shr ecx, 0x1f
and ecx, eax
neg ecx
and ecx, 1
neg ecx
mov dword [esp + 0x28], ecx
mov eax, edx
xor eax, 1
mov dword [esp + 0x18], ebp
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
neg ecx
and ecx, 1
neg ecx
mov eax, edx
xor eax, 2
mov dword [esp + 0x24], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
xor edx, 3
neg ecx
lea eax, [edx - 1]
shr eax, 0x1f
not edx
shr edx, 0x1f
and eax, edx
neg eax
and eax, 1
neg eax
and ecx, 1
mov dword [esp + 0x1c], eax
xor eax, eax
neg ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], eax
cmp dword [esp + 0x3c], eax
jle 0x1004aaae
shl ebx, 2
mov dword [esp + 0x30], ebx
xor edx, edx
xor ebx, ebx
mov dword [esp + 0x48], edx
test esi, esi
jle 0x1004aa91
lea eax, [esi + esi*2]
lea ecx, [edi + esi*8]
lea eax, [edi + eax*4]
lea ebp, [edi + esi*4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x40], eax
mov eax, dword [eax]
mov ecx, dword [ecx]
and ecx, dword [esp + 0x20]
and eax, dword [esp + 0x1c]
mov edx, dword [ebp]
and edx, dword [esp + 0x24]
or ecx, eax
mov eax, dword [edi + ebx*4]
and eax, dword [esp + 0x28]
or edx, ecx
mov esi, ebx
xor esi, dword [esp + 0x18]
or eax, edx
mov edx, dword [esp + 0x48]
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
and ecx, esi
mov esi, dword [esp + 0x2c]
neg ecx
and ecx, 1
neg ecx
and ecx, eax
mov eax, dword [esp + 0x40]
or edx, ecx
mov ecx, dword [esp + 0x10]
inc ebx
add eax, 4
add ecx, 4
mov dword [esp + 0x48], edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x10], ecx
lea ebp, [ebp + 4]
cmp ebx, esi
jl 0x1004aa25
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
add edi, dword [esp + 0x30]
mov ecx, dword [ecx]
inc eax
mov dword [ecx + eax*4 - 4], edx
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x3c]
jl 0x1004aa01
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
pop ebp
mov dword [eax + 4], edi
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x24
ret
Function at 0x1004fb60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.101aa6d0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [ebp + 4]
mov eax, dword [ebp + 8]
xor ebx, ebx
xor ecx, ecx
dec esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
test eax, eax
jle 0x1004fbd8
mov ebp, dword [ebp]
push edi
push dword [ebp]
mov eax, ebx
xor eax, esi
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
call sym.libcrypto_1_1.dll_BN_num_bits_word
mov ecx, dword [esp + 0x20]
or dword [esp + 0x20], edi
not ecx
mov edx, edi
not edx
and ecx, edx
and ecx, 0x20
add ecx, dword [esp + 0x14]
and eax, edi
add ecx, eax
inc ebx
add esp, 4
mov dword [esp + 0x10], ecx
lea ebp, [ebp + 4]
cmp ebx, dword [esp + 0x14]
jl 0x1004fb90
pop edi
not esi
lea eax, [esi - 1]
not esi
shr eax, 0x1f
shr esi, 0x1f
and eax, esi
pop esi
dec eax
pop ebp
and eax, ecx
pop ebx
add esp, 8
ret
Function at 0x1005e110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1005e110
mov eax, 0x28
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x24], eax
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
movzx eax, byte [edx]
shl eax, 0x10
or ebx, eax
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
shl ecx, 0x18
or ecx, eax
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
or edx, ecx
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov edi, dword [esp + 0x50]
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov esi, dword [edi]
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
mov byte [esp + 0x2f], bl
mov byte [esp + 0x33], dl
test eax, eax
je 0x1005e2d5
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea ebx, [ebx]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x1005e265
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call sym.libcrypto_1_1.dll_CAST_encrypt
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x36], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
add esp, 8
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
inc ebp
mov al, byte [esp + esi + 0x2c]
xor al, byte [edi]
inc esi
mov byte [ecx + edi], al
mov eax, dword [esp + 0x44]
inc edi
and esi, 7
test eax, eax
jne 0x1005e200
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x1005e2bc
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov byte [ebp + 2], bl
mov eax, edx
shr eax, 0x18
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.101aa6fb
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101aa6fb
add esp, 0x28
ret
Function at 0x1006fd80
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x1006fdf5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1006fdf5
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.101ae6fe
add esp, 0x10
lea ecx, [ebp - 0x208]
push 0
push ecx
test eax, eax
mov ecx, 0x200
cmovs eax, ecx
push eax
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1006ff42
mov ebx, dword [ebp + 8]
mov ecx, ebx
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006fe00
sub ecx, edx
lea edi, [ecx + 1]
lea eax, [edi + edi]
call fcn.101ad870
mov esi, esp
test esi, esi
jne 0x1006fe24
mov esi, str.no_stack_
jmp 0x1006feb3
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1006fe53
xor ecx, ecx
test edi, edi
je 0x1006fe53
lea esp, [esp]
mov eax, dword [ebp + 8]
inc ecx
movsx ax, byte [ecx + eax - 1]
mov word [esi + ecx*2 - 2], ax
cmp ecx, edi
jb 0x1006fe40
xor ecx, ecx
test edi, edi
je 0x1006feb3
lea ebx, [ecx + 0x53]
lea esp, [esp]
cmp word [esi + ecx*2], 0x25
jne case.0x1006fe82.43
lea edx, [ecx + 1]
lea edx, [esi + edx*2]
lea ecx, [ecx]
movzx eax, word [edx]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x1006fe82.43
movzx eax, byte [eax + 0x1006ff74]
jmp dword [eax*4 + 0x1006ff5c]
inc ecx
add edx, 2
jmp 0x1006fe70
mov word [esi + ecx*2 + 2], bx
jmp case.0x1006fe82.43
mov eax, 0x73
jmp 0x1006fea9
mov eax, 0x43
jmp 0x1006fea9
mov eax, 0x63
mov word [esi + ecx*2 + 2], ax
inc ecx
cmp ecx, edi
jb 0x1006fe60
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.101ae7c3
xor eax, eax
add esp, 0x10
mov word [ebp - 6], ax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1006ff2c
call sym.libcrypto_1_1.dll_OPENSSL_isservice
test eax, eax
jle 0x1006ff2c
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1006ff42
push 0
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1006ff42
push 0x10
push str.OpenSSL:_FATAL
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101aa6fb
mov esp, ebp
pop ebp
ret
Function at 0x100778c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x1007799b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x10077936
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call sym.libcrypto_1_1.dll_DES_encrypt1
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10077904
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10077a54
call 0x10077948
pop edx
lea ecx, [edx + 0x138]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x100779f3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call sym.libcrypto_1_1.dll_DES_encrypt1
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100779ac
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10077a54
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call sym.libcrypto_1_1.dll_DES_encrypt1
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x10077a4f
jmp 0x10077a54
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret