joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401aea
cmp dword [ebp - 0x118], 0
je 0x401aea
jmp 0x401b4c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401b4c
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4350b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4350d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4350cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401980
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401aea
mov esp, ebp
pop ebp
ret

Function at 0x414b40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b58
mov eax, 1
add ebx, ebx
jne 0x414b7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b70
jne 0x414b8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b70
xor ecx, ecx
sub eax, 3
jb 0x414ba0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c12
mov ebp, eax
add ebx, ebx
jne 0x414bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bdc
inc ecx
add ebx, ebx
jne 0x414bc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bbd
jne 0x414bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bbd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bed
jmp 0x414b5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bfc
add edi, ecx
jmp 0x414b5e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c1a
cmp byte [edi], 0
jne 0x414c1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c1f
lea edi, [esi + 0x12000]
Function at 0xe14a50
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe14a5a
pushal
call 0xe14a60
pop ebp
sub ebp, 0x10
sub ebp, 0xa14a50
jmp 0xe14a76
mov eax, 0xa14a50
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b6
mov edx, 0x3da66967
xor byte [eax], dl
inc eax
dec ecx
jne 0xe14a8d
jmp 0xe14aa0
in al, dx
stosb byte es:[edi], al
in al, dx
out dx, al
pop ebx
out 0xa6, al
lahf
stosb byte es:[di], al
fbld tbyte [eax + 0x67]
fisttp qword [bx + 0x67]
nop
test dword [edi + ebp*4 - 0x14], esp
out 0x6b, al
mov byte fs:[0x3ea], al
inc ebx
wait
out dx, al
arpl word [ebx - 0x16], ax
add eax, dword [ebx - 0x65]
out dx, al
arpl word [ebx + 0xf], ax
inc edi
jl 0xe14b1e
xorps xmm1, xmmword [bx + si - 0x19]
dec bx
inc ebx
invalid
in al, dx
jmp 0xe14b64
scasb al, byte es:[edi]
push esp
mov ch, 0xe4
invalid
Function at 0xde4ef5
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
call dword [0xde138c]
push eax
call dword [0xdff01c]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0xde4f86
cmp dword [ebp - 4], ebx
jle 0xde4f7d
push esi
push edi
mov edi, dword [0xdff054]
mov eax, dword [ebp - 0xc]
lea esi, [eax + ebx*4]
push dword [esi]
push 0xde4fa4
call edi
test eax, eax
je 0xde66e9
push dword [esi]
push 0xde4f9c
call edi
test eax, eax
je 0xde66e9
push dword [esi]
push 0xde4f94
call edi
test eax, eax
je 0xde66d3
push dword [esi]
push 0xde4f8c
call edi
test eax, eax
je 0xde66d3
inc ebx
cmp ebx, dword [ebp - 4]
jl 0xde4f2b
pop edi
pop esi
push dword [ebp - 0xc]
call dword [0xde1388]
pop ebx
leave
ret
mov eax, dword [ebp - 8]
mov byte [eax + 0x3e6], 1
mov byte [eax + 0x3e7], 0
jmp 0xde4f75
mov eax, dword [ebp - 8]
mov byte [eax + 0x3e4], 0
jmp 0xde4f75

Function at 0xdec95d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4a8
mov eax, dword [0xdff0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xe
pop ecx
mov esi, 0xdecae0
lea edi, [ebp - 0x3c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ebx, 0x206
push ebx
mov word [ebp - 0x244], ax
xor esi, esi
lea eax, [ebp - 0x242]
push esi
push eax
call fcn.00de4bd8
xor eax, eax
mov dword [ebp - 0x464], esi
lea edi, [ebp - 0x460]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x4a4]
push esi
push eax
call fcn.00de4bd8
add esp, 0x18
lea eax, [ebp - 0x244]
push eax
push esi
push esi
push 0x25
push esi
mov dword [ebp - 0x4a8], 0x44
call dword [0xdff020]
test eax, eax
jl 0xdecacf
xor eax, eax
push ebx
mov word [ebp - 0x44c], ax
lea eax, [ebp - 0x44a]
push esi
push eax
call fcn.00de4bd8
add esp, 0xc
lea eax, [ebp - 0x244]
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x454]
push eax
push 0x104
lea eax, [ebp - 0x44c]
push eax
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
push 0x2400
mov dword [ebp - 0x450], 0xde4244
call dword [0xde1380]
test eax, eax
je 0xdecacf
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x244]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x44c]
push eax
push esi
call dword [0xde137c]
test eax, eax
jne 0xdeca95
mov eax, dword [0xdff0c0]
cmp eax, 0xdff0c0
je 0xdecacf
test byte [eax + 0x1c], 1
je 0xdecacf
push 0xde4108
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00deaf26
jmp 0xdecacf
mov eax, dword [0xdff0c0]
cmp eax, 0xdff0c0
je 0xdecab9
test byte [eax + 0x1c], 4
je 0xdecab9
push 0xde4108
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00deaf26
push dword [ebp - 0x460]
mov esi, dword [fcn.00de1374]
call esi
push dword [ebp - 0x464]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00de19b3
leave
ret
Function at 0xdefd10
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
xor ecx, ecx
cmp eax, ecx
je 0xdefd23
cmp word [eax], cx
jne 0xdefd25
xor eax, eax
push esi
push 1
push ecx
push eax
push dword [ebp + 0xc]
push ecx
push dword [ebp + 8]
call dword [0xdff024]
push 0xffffffffffffffff
push 0xffffffffffffffff
mov esi, eax
call dword [fcn.00de1458]
push eax
call dword [0xde13fc]
push 0x20
pop eax
cmp eax, esi
sbb eax, eax
neg eax
pop esi
pop ebp
ret 0xc

Function at 0xdf0016
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push 4
push esi
push esi
mov dword [ebp - 4], esi
call dword [0xdff010]
mov ebx, eax
cmp ebx, esi
je 0xdf0071
push edi
push 4
push dword [ebp + 8]
push ebx
call dword [0xdff008]
mov edi, eax
cmp edi, esi
mov esi, dword [0xdff00c]
je 0xdf006d
lea eax, [ebp - 0x20]
push eax
push edi
call dword [section..data]
test eax, eax
je 0xdf006a
cmp dword [ebp - 0x1c], 4
jne 0xdf006a
mov dword [ebp - 4], 1
push edi
call esi
push ebx
call esi
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
Function at 0x4013e3
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x408028]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [0x408458]
test eax, eax
jne 0x401451
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 0x70]
or eax, 0xffffffff
dec ecx
je 0x40143c
dec ecx
jne 0x40144c
mov eax, dword [ebp - 0x7c]
sub eax, 4
je 0x401437
dec eax
je 0x401433
push 0x23
jmp 0x401439
push 0x32
jmp 0x401439
push 0x28
pop eax
jmp 0x40144c
xor eax, eax
cmp dword [ebp - 0x78], 0xa
sete al
dec eax
and eax, 0xfffffffd
add eax, 0x62
mov dword [0x408458], eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00403303
add ebp, 0x98
leave
ret
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10013a33
pop dword [ebp - 0x2c]
mov eax, 0x10013a33
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6be76008
add dword [ebp - 0x3c], 0xe26ae543
mov dword [ebp - 0x38], 0xcb842399
sub dword [ebp - 0x38], 0x9950d754
mov dword [ebp - 0x34], 0x4b00b003
add dword [ebp - 0x34], 0x14b942b
mov dword [ebp - 0x30], 0x9667b9a9
add dword [ebp - 0x30], 0x69984657
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x6faad36a
add eax, 0xa056ed16
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xca5f671e
add dword [ebp - 0x3c], 0xaa130238
mov dword [ebp - 0x38], 0x2d34f340
add dword [ebp - 0x38], 0x14376e35
mov dword [ebp - 0x34], 0xdef7c454
sub dword [ebp - 0x34], 0x7b8857e8
mov dword [ebp - 0x30], 0x251d8a92
sub dword [ebp - 0x30], 0x251d8a92
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x87367d4e
sub eax, 0x7734bd4e
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3862d
push 0
call eax
mov ecx, 0xa5cbb11d
sub ecx, 0xa5cb6537
xor edx, edx
add edx, eax
mov ebx, 0x813988e6
sub ebx, 0x713720e6
add ebx, dword [ebp - 0x2c]
mov edi, 0xc1624410
sub edi, 0x91bc0073
xor dword [ebp - 0x28], eax
mov esi, dword [ebx]
add dword [ebp - 0xc], ecx
sub esi, edi
xor dword [ebp - 0x24], 0x8f23d5d5
mov dword [edx], esi
mov dword [ebp - 0x24], 0x617bad3a
add edx, 0xa3b799dc
sub edx, 0xa3b799d8
add ebx, 0xf9c4c28a
add ebx, 0x63b3d7a
loop 0x10013b52
add eax, 0x1226b
xor ebx, ebx
add ebx, eax
add eax, 0x77e12565
add eax, 0x881edaa0
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
Function at 0x2a8563d9
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x2a94cb48
call fcn.2a84b884
mov edi, ecx
or ebx, 0xffffffff
cmp dword [edi + 4], ebx
jne 0x2a856519
push ebx
lea esi, [edi + 0xc]
push 0x2a953f5c
mov ecx, esi
call fcn.2a885359
mov eax, dword [edi]
mov ecx, edi
push 0
push ebx
call dword [eax + 0x10]
push eax
lea ecx, [ebp - 0x54]
call fcn.2a84b832
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
mov ecx, esi
call fcn.2a8b7054
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.2a84bcc3
lea ecx, [ebp - 0x4c]
call fcn.2a84bcc3
push esi
lea ecx, [ebp - 0x3c]
call fcn.2a852b59
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.2a8b7a5a
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.2a8b8395
mov esi, eax
mov dword [ebp - 0x18], vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
pop ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [edi + 8]
mov byte [ebp - 4], 3
cmp dword [ecx], 0
jne 0x2a8564dd
lea ecx, [ebp - 0x3c]
call fcn.2a8b7a5a
push 0
push 0x40110000
push 3
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [edi + 4], eax
cmp eax, ebx
jne 0x2a8564dd
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x2a856571
cmp eax, 0xe7
jne 0x2a85655b
lea ecx, [ebp - 0x3c]
call fcn.2a8b7a5a
push 0x4e20
push eax
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
je 0x2a85651f
mov eax, dword [edi + 8]
cmp dword [eax], 0
je 0x2a856479
cmp dword [edi + 4], ebx
je 0x2a8564fa
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_SetNamedPipeHandleState]
mov byte [ebp - 4], 2
test esi, esi
je 0x2a856509
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.2a84bcc3
lea ecx, [ebp - 0x34]
call fcn.2a84bcc3
call fcn.2a84ba86
ret
push 0
push ebx
push str.Problem_Opening_channel__all_pipe_instances_are_busy
lea ecx, [ebp - 0x54]
call fcn.2a84b832
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
mov dword [ebp - 0x70], vtable.RSException.0
push eax
lea ecx, [ebp - 0x6c]
call fcn.2a852b59
mov dword [ebp - 0x70], vtable.CMessageException.0
push 0x2a9a2740
lea eax, [ebp - 0x70]
push eax
call sub.MSVCR120.dll__CxxThrowException
push 0
push ebx
push str.Problem_Opening_channel
lea ecx, [ebp - 0x54]
call fcn.2a84b832
mov byte [ebp - 4], 4
jmp 0x2a856533
lea ecx, [ebp - 0x70]
call fcn.2a8561e0
push 0x2a9a26e8
jmp 0x2a856552
Function at 0x2a8682a3
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x2a94df7f
call fcn.2a84b884
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], ebx
mov byte [eax], bl
mov eax, dword [0x2a9b611c]
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ecx
test cl, al
jne 0x2a868300
or eax, ecx
mov dword [0x2a9b611c], eax
lea eax, [ebp - 0xf]
mov dword [ebp - 4], ecx
push eax
push 0x2a953e58
mov ecx, 0x2a9b6104
call fcn.2a885359
push 0x2a952881
call fcn.2a885359
pop ecx
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x10]
mov edi, ebx
test eax, eax
je 0x2a868461
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x2a8683a8
mov esi, dword [ebp + 8]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x2a9b6118], 0x10
mov ecx, 0x2a9b6104
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x2a9b6104]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
push 1
call fcn.2a885359
inc edi
cmp edi, 4
jl 0x2a86836e
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x2a868310
mov dword [ebp + 0x10], edi
test edi, edi
je 0x2a868461
mov eax, edi
cmp edi, esi
jge 0x2a8683de
cmp eax, esi
jae 0x2a86846a
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x2a8683c6
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x2a86844c
mov esi, dword [ebp + 8]
mov edi, eax
cmp dword [0x2a9b6118], 0x10
mov ecx, 0x2a9b6104
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x2a9b6104]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
push 1
call fcn.2a885359
inc ebx
cmp ebx, edi
jl 0x2a86841b
mov edi, dword [ebp + 0x10]
push 3
pop esi
cmp edi, esi
jge 0x2a868461
sub esi, edi
mov ecx, dword [ebp + 8]
push 0x3d
push 1
call fcn.2a885359
dec esi
jne 0x2a868452
mov eax, dword [ebp + 8]
call fcn.2a84ba86
ret
call fcn.2a885359
int3
Function at 0x2a86fcc9
Capabilities:
Encode data using base64

Disassembly:
push 8
mov eax, 0x2a94f10c
call fcn.2a84b884
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
cmp dword [edi + 0x14], 0x10
jb 0x2a86fcea
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
jmp 0x2a86fced
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
mov dword [ebp + 0xc], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ecx
mov byte [esi], cl
push ecx
mov eax, ebx
mov dword [ebp - 4], ecx
shl eax, 2
push 3
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x14], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a885359
cmp dword [esi + 0x14], 0x10
jb 0x2a86fd2c
mov ecx, dword [esi]
jmp 0x2a86fd2e
mov ecx, esi
xor edx, edx
test ebx, ebx
jle 0x2a86fdd6
mov esi, dword [ebp - 0x10]
movzx eax, byte [edx + esi]
shr eax, 2
mov al, byte [eax + 0x2a9555d0]
mov byte [ecx], al
mov bl, byte [edx + esi]
and bl, 3
shl bl, 4
inc edx
cmp edx, dword [ebp + 0xc]
jge 0x2a86fd61
mov al, byte [edx + esi]
shr al, 4
or bl, al
movzx eax, bl
mov al, byte [eax + 0x2a9555d0]
mov byte [ecx + 1], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jge 0x2a86fda7
cmp dword [edi + 0x14], 0x10
jb 0x2a86fd7e
mov ebx, dword [edi]
jmp 0x2a86fd80
mov ebx, edi
mov bl, byte [ebx + edx]
and bl, 0xf
shl bl, 2
inc edx
cmp edx, eax
jge 0x2a86fd96
mov al, byte [edx + esi]
shr al, 6
or bl, al
movzx eax, bl
mov al, byte [eax + 0x2a9555d0]
mov byte [ecx + 2], al
mov eax, dword [ebp + 0xc]
jmp 0x2a86fdab
mov byte [ecx + 2], 0x3d
add ecx, 3
cmp edx, eax
jge 0x2a86fdc6
movzx eax, byte [edx + esi]
and eax, 0x3f
mov al, byte [eax + 0x2a9555d0]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
jmp 0x2a86fdc9
mov byte [ecx], 0x3d
inc ecx
inc edx
cmp edx, eax
jl 0x2a86fd3b
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
jb 0x2a86fde0
mov eax, dword [esi]
jmp 0x2a86fde2
mov eax, esi
sub ecx, eax
push 0
push ecx
mov ecx, esi
call fcn.2a885359
mov eax, esi
call fcn.2a84ba86
ret

Function at 0x2a872e7d
Capabilities:
Get hostname

Disassembly:
push 0x450
mov eax, 0x2a94f732
call fcn.2a8b882c
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x40f]
xor ebx, ebx
push 0x3ff
push ebx
push eax
mov dword [ebp - 0x45c], ebx
mov byte [ebp - 0x410], bl
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x400
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x2a872f1a
push 0x93
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
call fcn.2a885359
lea eax, [ebp - 0x44c]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x458]
call fcn.2a868470
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a867c62
push 0x2a9a5284
lea eax, [ebp - 0x434]
push eax
call sub.MSVCR120.dll__CxxThrowException
lea eax, [ebp - 0x44d]
mov ecx, esi
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.2a885359
mov eax, esi
call fcn.2a8b880e
ret
Function at 0x2a879c31
Capabilities:
Get socket status

Disassembly:
push 0x198
mov eax, 0x2a9505d8
call fcn.2a8b882c
mov eax, dword [ecx + 0x10004]
xor esi, esi
mov dword [ebp - 0x1a4], 0x1e
mov dword [ebp - 0x1a0], esi
mov dword [ebp - 0x18c], esi
cmp eax, 0xffffffff
je 0x2a879cf8
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x188], eax
push ecx
inc eax
mov dword [ebp - 0x18c], 1
lea ecx, [ebp - 0x18c]
push esi
cmp dword [ebp + 8], esi
jne 0x2a879c8f
push esi
push ecx
jmp 0x2a879c91
push ecx
push esi
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
je 0x2a879cee
push 0x77
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x194], esi
mov dword [ebp - 0x190], esi
call fcn.2a885359
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x194]
call fcn.2a868470
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.2a867c62
mov dword [ebp - 0x58], vtable.Exceptions::SocketException.0
lea eax, [ebp - 0x58]
push 0x2a9a76f0
push eax
call sub.MSVCR120.dll__CxxThrowException
mov al, 1
call fcn.2a8b880e
ret 4
push 0x92
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x19c], esi
mov dword [ebp - 0x198], esi
call fcn.2a885359
lea eax, [ebp - 0x88]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x19c]
call fcn.2a868470
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.2a867c62
mov dword [ebp - 0x34], vtable.Exceptions::SocketException.0
lea eax, [ebp - 0x34]
push 0x2a9a76f0
jmp 0x2a879ce8
Function at 0x2a885359
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x2a885368
pop dword [ebp - 4]
mov eax, 0x76b1de3c
sub eax, 0x4c298ad4
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xf69491f8
add dword [ebp - 0x14], 0x57bdb353
mov dword [ebp - 0x10], 0xfcbdf5a6
add dword [ebp - 0x10], 0x3575569f
mov dword [ebp - 0xc], 0x48a885a0
add dword [ebp - 0xc], 0x3a3be8e
mov dword [ebp - 8], 0xfb302573
sub dword [ebp - 8], 0xfb302573
lea eax, [ebp - 0x14]
push eax
mov eax, 0xe33adc14
add eax, 0x475a5548
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x3e2fcc3f
sub dword [ebp - 0x14], 0xc9bd62e9
mov dword [ebp - 0x10], 0x6b52384e
sub dword [ebp - 0x10], 0x29e5d6d9
mov dword [ebp - 0xc], 0x8eca4462
sub dword [ebp - 0xc], 0x2b5ad7f6
mov dword [ebp - 8], 0xf2feca3a
sub dword [ebp - 8], 0xf2feca3a
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x4a2d0
push 0
call eax
mov ecx, 0x7f106e2e
add ecx, 0x80efe17c
xor ebx, ebx
add ebx, eax
mov esi, 0xef467aaf
add esi, 0x3b570f51
add esi, dword [ebp - 4]
mov edi, 0xba368f9c
sub edi, 0x93b13f13
mov edx, dword [esi]
xor edx, edi
mov dword [ebx], edx
add ebx, 0x1f5b17c
sub ebx, 0x1f5b178
add esi, 0x9d795865
sub esi, 0x9d795861
loop 0x2a885487
add eax, 0x1317b
mov ebx, eax
add eax, 0xb1f9bd6
sub eax, 0xb1f9bd1
mov ecx, 0x2ff52839
sub ecx, 0x5752839
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x2a8d1640
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.2a885359
push 0x62
push esi
mov edi, eax
mov ebx, 1
call sub.MSVCR120.dll_strchr
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x2a8d16f7
push 0x4a
push str.crypto_bio_bss_file.c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 1
push 2
call fcn.2a8bdb20
push 0x2a958ffc
push esi
push 0x2a974894
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.2a8bd340
add esp, 0x2c
call sub.MSVCR120.dll__errno
cmp dword [eax], 2
je 0x2a8d16d9
call sub.MSVCR120.dll__errno
cmp dword [eax], 6
je 0x2a8d16d9
push 0x53
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.2a8bdb20
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x51
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.2a8bdb20
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x2a974844
call fcn.2a8bbc20
mov esi, eax
add esp, 4
test esi, esi
jne 0x2a8d1719
push edi
call sub.MSVCR120.dll_fclose
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.2a8bb820
push edi
push ebx
push 0x6a
push esi
call fcn.2a8bb850
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x432b5f
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
push edi
mov edi, dword [esp + 0x14]
shr edi, 2
mov ecx, edi
dec edi
test ecx, ecx
je 0x432b90
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ecx, ebx
mov ebx, dword [esi]
add eax, ebx
mov edx, ebx
xor edx, ecx
mov ecx, edi
dec edi
mov dword [esi], edx
add esi, 4
test ecx, ecx
jne 0x432b7a
pop edi
pop esi
pop ebx
ret

Function at 0x432c29
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
imul ecx, ecx, 0x28
mov ecx, dword [ecx + eax + 0x24]
test ecx, 0x20000000
je 0x432c62
test ecx, 0x40000000
je 0x432c5b
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xe0
add eax, 0x40
jmp 0x432c73
mov eax, 0x10
jmp 0x432c73
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xfe
add eax, 4
test ecx, 0x4000000
je 0x432c80
add eax, 0x200
ret