joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403203
pop dword [ebp - 0x30]
mov eax, 0x403203
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x49b349e5
add dword [ebp - 0x40], 0x49efb66
mov dword [ebp - 0x3c], 0xddbee3ec
add dword [ebp - 0x3c], 0x54746859
mov dword [ebp - 0x38], 0x2890806c
sub dword [ebp - 0x38], 0xdc443c3e
mov dword [ebp - 0x34], 0x1f041777
sub dword [ebp - 0x34], 0x1f041777
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x4e9dc70c
sub dword [ebp - 0x40], 0xda2b5db6
mov dword [ebp - 0x3c], 0x917aec5a
sub dword [ebp - 0x3c], 0x500e8ae5
mov dword [ebp - 0x38], 0x437eb350
add dword [ebp - 0x38], 0x1ff0b91c
mov dword [ebp - 0x34], 0x5cd143f4
sub dword [ebp - 0x34], 0x5cd143f4
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x8d1cb636
add eax, 0x7323ca9e
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x341c1
push 0
call eax
mov ecx, 0x3e10
mov esi, eax
mov edx, 0x577c5266
sub edx, 0x573b4266
add edx, dword [ebp - 0x30]
mov ebx, 0xe190e8bc
add ebx, 0xabb4483f
xor dword [ebp - 0x14], esi
mov edi, dword [edx]
sub dword [ebp - 0x1c], 0x1b4c4002
add edi, ebx
mov dword [ebp - 0x24], 0x8ea82025
mov dword [esi], edi
add esi, 0x38a71bdf
sub esi, 0x38a71bdb
add edx, 0x5d4b6ca3
add edx, 0xa2b49361
loop 0x403315
add eax, 0x59206f25
sub eax, 0x591f8412
mov ebx, eax
add eax, 0xa2532fd4
add eax, 0x5dacd031
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x71d68106
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x1505
movzx ecx, word [esi]
test ecx, ecx
jne 0x71d68138
mov eax, dword [ebp + 0x10]
movzx ecx, dl
mov edx, ecx
and ecx, 0x1f
shr edx, 5
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp + 0x14]
inc edx
shl edx, cl
pop esi
mov dword [eax], edx
pop ebp
ret 0x10
lea eax, [ecx - 0x61]
cmp eax, 0x19
ja 0x71d68146
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add esi, 2
jmp 0x71d68112
Function at 0xf04330
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf0433a
pushal
call 0xf04340
pop ebp
sub ebp, 0x10
sub ebp, 0xb04330
jmp 0xf04356
mov eax, 0xb04330
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0x1d2341dd
xor byte [eax], dl
inc eax
dec ecx
jne 0xf0436d
jmp 0xf04380
push esi
adc byte [esi + 0x54], dl
loope 0xf04363
fstp st(5)
pop esp
sbb al, 0x25
fstp st(5)
fstp st(6)
adc byte [ebp - 0x25], ah
fstp st(5)
frstor dword [edi - 0xb]
fstp st(5)
invalid
Function at 0x44c8b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x30000]
push edi
jmp 0x44c8ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44c8d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c8c0
mov eax, 1
add ebx, ebx
jne 0x44c8e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44c8d8
jne 0x44c8f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44c8d8
xor ecx, ecx
sub eax, 3
jb 0x44c908
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44c97a
mov ebp, eax
add ebx, ebx
jne 0x44c913
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x44c920
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44c944
inc ecx
add ebx, ebx
jne 0x44c930
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44c925
jne 0x44c941
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44c925
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44c964
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44c955
jmp 0x44c8c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44c964
add edi, ecx
jmp 0x44c8c6
pop esi
mov edi, esi
mov ecx, 0xc2d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44c982
cmp byte [edi], 0xa
jne 0x44c982
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44c987
lea edi, [esi + 0x48000]
mov eax, dword [edi]
or eax, eax
je 0x44c9ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4c1b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4c2b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44c9b4
mov ecx, edi
jns 0x44c9e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4c2c0]
or eax, eax
je 0x44c9f9
mov dword [ebx], eax
add ebx, 4
jmp 0x44c9d1
call dword [esi + 0x4c2bc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x44ca30
cmp al, 0xef
ja 0x44ca23
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x44ca05
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x44ca12
mov ebp, dword [esi + 0x4c2c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44ca64
sub esp, 0xffffff80
jmp 0x419aa7
Function at 0x1006dec
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc18
mov eax, dword [0x1011360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x400
xor esi, esi
lea eax, [ebp - 0xc04]
push eax
push esi
mov dword [ebp - 0xc10], esi
mov dword [ebp - 0xc18], esi
mov dword [ebp - 0xc14], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
mov dword [ebp - 0xc08], eax
jbe 0x1006fbd
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc04]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 0xc08], eax
jbe 0x1006fbd
push ebx
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x1006fbc
push ebx
push dword [ebp - 0xc08]
lea eax, [ebp - 0xc04]
push esi
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1006fb4
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc0c]
push eax
push 0x1001e7c
push ebx
mov dword [ebp - 0xc0c], esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0xc0c]
cmp eax, esi
je 0x1006f7c
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push edi
push 0x1001e5c
push ecx
push eax
mov edi, 0x1001e24
push edi
mov esi, 0x200
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.0100b6a0
add esp, 0x18
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc10]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0xc0c]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push 0x1001e00
push ecx
push eax
push edi
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.0100b6a0
add esp, 0x18
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0xc0c]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push 0x1001de0
push ecx
push eax
push edi
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.0100b6a0
add esp, 0x18
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
xor esi, esi
pop edi
cmp dword [ebp - 0xc18], esi
je 0x1006fb4
cmp dword [ebp - 0xc10], esi
je 0x1006fb4
cmp dword [ebp - 0xc14], esi
je 0x1006fb4
push dword [ebp - 0xc14]
push dword [ebp - 0xc10]
push dword [ebp - 0xc18]
push 0x1001da8
call dword [sym.imp.msvcrt.dll_wprintf]
add esp, 0x10
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100b502
leave
ret
Function at 0x10081fa
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x30
push ebx
xor ebx, ebx
cmp eax, ebx
mov ecx, 0xffff
je 0x1008216
cmp eax, 1
jne 0x1008218
mov eax, ecx
cmp eax, ecx
je 0x1008228
cmp eax, 2
je 0x1008228
xor al, al
jmp 0x10082ba
push edi
push 8
pop ecx
mov dword [ebp - 0x28], eax
xor eax, eax
push ebx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
push 0x30
lea eax, [ebp - 0x30]
push eax
push 0x1f
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jge 0x1008257
xor al, al
jmp 0x10082b9
mov edi, dword [sym.imp.msvcrt.dll_wprintf]
push 0x1004324
call edi
pop ecx
push esi
mov eax, dword [ebx + 0x10111e8]
mov ecx, eax
shr ecx, 0x1d
mov ecx, dword [ebp + ecx*4 - 0x20]
and ecx, eax
test ecx, 0x1fffffff
je 0x10082a3
lea esi, [ebx + 0x10111f0]
push 0x1001aa0
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10082a3
push dword [esi]
push 0x100431c
call edi
pop ecx
pop ecx
add ebx, 0xc
cmp ebx, 0x174
jb 0x1008266
push 0x1001f34
call edi
pop ecx
mov al, 1
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x100bb90
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x100bba3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100bb9f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x100bbd0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100bc0f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x100bc05
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x100bc11
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x100bbf5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100e171
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x100e1a0
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0100b60b
add esp, 0x14
jmp 0x100e27c
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100e27c
test al, 0x40
jne 0x100e27c
test al, 2
je 0x100e1c2
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100e27c
or eax, 1
test ax, 0x10c
mov dword [esi + 0xc], eax
je 0x100e182
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
cmp eax, ebx
mov dword [esi + 4], eax
je 0x100e26c
cmp eax, 0xffffffff
je 0x100e26c
test byte [esi + 0xc], 0x82
jne 0x100e242
push esi
call edi
cmp eax, 0xffffffff
pop ecx
je 0x100e22d
push esi
call edi
cmp eax, 0xfffffffe
pop ecx
je 0x100e22d
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100e232
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100e242
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100e25f
mov eax, dword [esi + 0xc]
test al, 8
je 0x100e25f
test ax, 0x400
jne 0x100e25f
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x100e27f
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100fa47
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x100fa76
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0100b60b
add esp, 0x14
jmp 0x100fb5e
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100fb5e
test al, 0x40
jne 0x100fb5e
test al, 2
je 0x100fa98
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100fb5e
or eax, 1
test ax, 0x10c
mov dword [esi + 0xc], eax
je 0x100fa58
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
cmp eax, ebx
mov dword [esi + 4], eax
je 0x100fb4e
cmp eax, 1
je 0x100fb4e
cmp eax, 0xffffffff
je 0x100fb4e
test byte [esi + 0xc], 0x82
jne 0x100fb21
push esi
call edi
cmp eax, 0xffffffff
pop ecx
je 0x100fb0c
push esi
call edi
cmp eax, 0xfffffffe
pop ecx
je 0x100fb0c
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100fb11
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100fb21
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100fb3e
mov eax, dword [esi + 0xc]
test al, 8
je 0x100fb3e
test ax, 0x400
jne 0x100fb3e
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add dword [esi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x100fb63
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov eax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10005250
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.1006c120
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret

Function at 0x10006320
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.1006d450
mov eax, dword [0x100adb80]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x10006385
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10006385
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.1006e2cb
add eax, 0x40
push eax
call fcn.1006e103
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1006bd1f
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.1006e03c
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10006414
call fcn.100061e0
test eax, eax
jle 0x10006414
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1006bd1f
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1006bd1f
add esp, 0x108
ret
Function at 0x10045660
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x10045743
push esi
mov esi, dword [esp + 0x14]
inc esi
lea ebx, [ebx]
movzx edx, byte [esi - 1]
cmp edi, 3
jl 0x100456dd
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], dl
jmp 0x1004572e
shl edx, 0x10
cmp edi, 2
jne 0x100456ed
movzx eax, byte [esi]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
cmp edi, 1
jne 0x1004571a
lea edx, [edi + 0x3c]
jmp 0x10045727
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub edi, 3
add ecx, 4
add ebp, 4
add esi, 3
test edi, edi
jg 0x10045680
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret

Function at 0x1005b920
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x1005b939
mov esi, edi
mov edi, eax
jmp 0x1005b93b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x1005b94b
mov eax, ebx
jmp 0x1005b955
push eax
push ebx
call fcn.100088e0
add esp, 8
test eax, eax
jne 0x1005b95d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x1005b979
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x1005b964
cmp eax, dword [esi + 4]
jge 0x1005b990
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x1005b980
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x1005b9b1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x1005b9ae
dec eax
test eax, eax
jg 0x1005b9a0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10061ea0
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0x400
mov dword [0x100b1b2c], 0
mov dword [0x100b1b20], 1
push 0x10061e70
call fcn.10071eb5
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push 0x10
call esi
mov dword [0x100b1b20], 0
push 1
call esi
mov ecx, dword [0x100b1b2c]
mov eax, dword [0x100b1b2c]
shr ecx, 3
xor eax, ecx
mov ecx, dword [0x100b1b28]
shr eax, 3
xor ecx, eax
xor dword [0x100b1b2c], ecx
and dword [0x100b1b2c], 7
mov eax, dword [0x100b1b2c]
mov dword [0x100b1b28], eax
mov eax, dword [0x100b1b24]
mov ecx, dword [0x100b1b2c]
add eax, eax
add eax, eax
add eax, eax
xor ecx, eax
mov dword [0x100b1b24], ecx
mov eax, dword [0x100b1b24]
pop esi
ret
call 0x10061ea0
call 0x10061ea0
call 0x10061ea0
call 0x10061ea0
call 0x10061ea0
call 0x10061ea0
call 0x10061ea0
call 0x10061ea0
call 0x10061ea0
call 0x10061ea0
jmp 0x10061ea0

Function at 0x10063240
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
test eax, eax
je 0x10063315
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10063315
push esi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10063284
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100632a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100632dd
cmp dword [ebp + 8], 0
jne 0x100632dd
push ebx
mov ecx, edi
call fcn.100627a0
test eax, eax
je 0x100632dd
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push ebx
push dword [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100632ed
mov ecx, edi
call fcn.10062250
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], ebx
je 0x10063309
mov ecx, edi
call fcn.10062250
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100633e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movdqu xmm0, xmmword [0x100832f0]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
movdqu xmmword [ebp - 0x14], xmm0
test ebx, ebx
je 0x1006345c
mov eax, dword [ebp + 8]
dec ebx
push esi
shr ebx, 4
lea esi, [edx + 8]
push edi
inc ebx
jmp 0x10063410
movdqu xmm0, xmmword [eax]
lea edi, [esi - 8]
push edi
push eax
push ecx
movdqu xmmword [ebp - 0x24], xmm0
call fcn.10063bf0
mov eax, dword [ebp - 0x14]
lea esi, [esi + 0x10]
xor dword [edi], eax
add esp, 0xc
mov eax, dword [ebp - 0x10]
xor dword [esi - 0x14], eax
mov eax, dword [ebp - 0xc]
xor dword [esi - 0x10], eax
mov eax, dword [ebp - 8]
xor dword [esi - 0xc], eax
mov eax, dword [ebp + 8]
movdqu xmm0, xmmword [ebp - 0x24]
mov ecx, dword [ebp - 4]
add eax, 0x10
mov dword [ebp + 8], eax
movdqu xmmword [ebp - 0x14], xmm0
dec ebx
jne 0x10063410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10063470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100adb80]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [0x100832f0]
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov dword [ebp - 0x18], ecx
movdqu xmmword [ebp - 0x14], xmm0
test edi, edi
je 0x100634e3
push esi
mov esi, dword [ebp + 8]
dec edi
shr edi, 4
add esi, 8
inc edi
mov eax, dword [esi - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [esi - 4]
xor dword [ebp - 0x10], eax
mov eax, dword [esi]
xor dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
xor dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push eax
push ecx
call fcn.10064670
movdqu xmm0, xmmword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
lea esi, [esi + 0x10]
add esp, 0xc
lea ebx, [ebx + 0x10]
movdqu xmmword [ebx - 0x10], xmm0
dec edi
jne 0x100634a7
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1006bd1f
mov esp, ebp
pop ebp
ret 8