joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007fa40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 0xc]
push edi
mov eax, dword [esi]
mov edi, edx
mov dword [ebp - 0x20], ecx
cmp eax, 0x40
jne 0x1007fa87
mov edx, 0x2745
lea ecx, [ebp - 0x14]
call fcn.100353b0
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, ecx
mov ecx, dword [ebp - 0x20]
test eax, eax
jne 0x1007fb4b
test ecx, ecx
je 0x1007faf2
test ebx, ebx
je 0x1007faf2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
push eax
push eax
push 0
push edi
call dword [sym.imp.MSWSOCK.dll_GetAcceptExSockaddrs]
mov edi, dword [ebp - 8]
cmp edi, dword [ebx]
jbe 0x1007fae1
mov edx, 0x2726
lea ecx, [ebp - 0x24]
call fcn.100353b0
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
jmp 0x1007faf2
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.101ec960
add esp, 0xc
mov dword [ebx], edi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
cmp eax, 0xffffffff
jne 0x1007fb28
mov edx, 0x2719
lea ecx, [ebp - 0x2c]
call fcn.100353b0
pop edi
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [ebp - 0x10]
push ecx
push 0x700b
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov ecx, esi
setne dl
call fcn.10034890
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret
Function at 0x10083c40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x10083c4b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x10083d07
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
sub edi, 1
jne 0x10083c60
pop edi
test esi, esi
je 0x10083d2a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
sub esi, 1
jne 0x10083d10
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x100844a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 0xc], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x100844fc
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100844e4
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 8]
call fcn.101ec960
add dword [edi + 0x1c], esi
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
xor edx, edx
xor ecx, ebp
div dword [ebp - 0xc]
pop edi
pop esi
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret
Function at 0x10084540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x10084585
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10084580
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x100845b2
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x10084596
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.101ec960
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x100845d0
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x100845bd
cmp byte [esi + 8], 0
je 0x100845bd
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret
Function at 0x100850d0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x100852bf
cmp dword [edi + 0x18], 0
je 0x100852bf
push esi
mov esi, dword [edi + 0x7c]
test esi, esi
je 0x10085130
mov eax, dword [esi]
test eax, eax
je 0x10085105
push eax
call fcn.101f0951
add esp, 4
cmp dword [esi + 0x40], 0
mov dword [esi], 0
je 0x10085119
lea ecx, [esi + 4]
call fcn.10083ea0
push esi
mov dword [esi + 0x40], 0
call fcn.101f0951
add esp, 4
mov dword [edi + 0x7c], 0
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.10084e60
add esp, 8
test eax, eax
je 0x10085155
pop esi
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push 0x84
call fcn.101f2716
mov esi, eax
add esp, 4
test esi, esi
je 0x10085197
push 0x4000
call fcn.101f2716
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x100851a3
push esi
call fcn.101f0951
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x100851fe
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.10083f80
test eax, eax
jne 0x100851fe
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x10085221
mov al, byte [edi + 0x39]
jmp 0x10085224
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x100852a0
mov al, byte [ebx]
test al, al
je 0x100852a0
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x1024ddb8]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1024ddb8]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x10085253
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10085eb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022f5f2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1029912c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x10], ecx
push 0x244
call fcn.101d507c
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
push 0x244
push 0
push esi
call fcn.101ee530
add esp, 0xc
mov dword [esi], 0
lea edi, [esi + 0x140]
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x134], 0xffffffff
mov dword [esi + 0x138], 0
push edi
push 0x104
mov dword [esi + 0x13c], 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10085f48
sub ecx, edx
mov al, byte [ecx + esi + 0x13f]
cmp al, 0x5c
je 0x10085f74
cmp al, 0x2f
je 0x10085f74
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10085f61
mov ax, word [0x1026847c]
mov word [edi], ax
push 0x20
call fcn.101d507c
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [eax + 0x14], ecx
mov ecx, eax
mov word [eax], 0x100
mov byte [eax + 0x10], 0
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.10084850
mov dword [esi], eax
test eax, eax
jne 0x10086011
mov eax, dword [esi + 0x138]
mov dword [0x102a8ba4], 0x200
test eax, eax
je 0x10085fc8
push eax
call fcn.101d5a20
add esp, 4
mov eax, dword [esi + 0x13c]
mov dword [esi + 0x138], 0
test eax, eax
je 0x10085fe5
push eax
call fcn.101d5a20
add esp, 4
push 0x244
push esi
mov dword [esi + 0x13c], 0
call fcn.101d50ac
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 8
mov dword [0x102a8ba4], 0
call fcn.101d507c
add esp, 4
mov dword [eax], 1
mov dword [eax + 4], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10086640
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 8], ebx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x10086729
mov ecx, dword [esi + 0x3c]
mov eax, ecx
test ecx, ecx
je 0x10086688
cmp dword [esi + 0x40], ebx
jae 0x10086688
push ecx
call fcn.101d5a20
add esp, 4
mov dword [esi + 0x3c], 0
xor eax, eax
test eax, eax
jne 0x1008669e
lea eax, [ebx + ebx]
push eax
call fcn.101d5a17
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call fcn.101ec960
xor edx, edx
add esp, 0xc
mov dword [ebp - 0xc], edx
test ebx, ebx
je 0x10086726
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x1024f580]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
mov ebx, dword [ebp - 8]
shr edx, 8
xor edx, dword [eax*4 + 0x1024f580]
mov dword [esi + 0x38], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp - 0xc], edx
cmp edx, ebx
jb 0x100866b2
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10086769
mov edx, dword [esi + 0x24]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x10086744
mov dword [esi + 0x14], 0x30000
jmp 0x1008679c
push ebx
add ecx, edx
push edi
push ecx
call fcn.101ec960
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x10086795
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x14], 0x1000000
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret 8
Function at 0x10086890
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
mov edi, ecx
lea eax, [ebp - 0x270]
push 0
mov dword [ebp - 0x46c], edi
mov esi, edx
push eax
mov dword [ebp - 0x46c], edi
call fcn.101ee530
add esp, 0xc
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x470], ebx
test ebx, ebx
je 0x100869e9
push 0x104
lea eax, [ebp - 0x270]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
test eax, eax
jne 0x10086907
push ebx
jmp 0x100869e3
push 0x104
lea eax, [ebp - 0x16c]
push 0
push eax
call fcn.101ee530
add esp, 0xc
lea eax, [ebp - 0x464]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x100869c9
cmp byte [ebp - 0x464], 0
je 0x100869c9
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea esi, [ebp - 0x464]
push 0x1026d1d0
push esi
call ebx
test eax, eax
je 0x100869c1
push 0x1026d1d4
push esi
call ebx
test eax, eax
je 0x100869c1
movzx eax, byte [esi]
mov byte [ebp - 0x468], al
movzx eax, byte [esi + 1]
mov byte [ebp - 0x467], al
lea eax, [ebp - 0x68]
push 0x64
push eax
lea eax, [ebp - 0x468]
mov byte [ebp - 0x466], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x100869dd
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.101fd657
add esp, 0xc
test eax, eax
je 0x10086a1b
add esi, 4
cmp byte [esi], 0
jne 0x10086950
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x470]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], 0
push 0
mov dword [edi + 0x14], 0xf
push 0x1024c6da
mov byte [edi], 0
mov ecx, edi
call fcn.100025c0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x270]
add eax, dword [ebp - 0x46c]
push eax
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x470]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x16c]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [edi], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10086a70
sub ecx, edx
lea eax, [ebp - 0x16c]
push ecx
push eax
jmp 0x10086a01
Function at 0x1008a150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x40c], 0
push esi
push edi
lea edi, [ebp - 0x404]
test edx, edx
je 0x1008a2a5
push 0x1026d60c
push edx
call fcn.101fe1d9
mov esi, eax
add esp, 8
test esi, esi
je 0x1008a2a5
push ebx
push 2
push 0
push esi
call fcn.101f8de7
add esp, 0xc
test eax, eax
jne 0x1008a286
push esi
call fcn.101fe10c
push esi
mov ebx, eax
call fcn.101fe558
lea eax, [ebx - 1]
add esp, 8
cmp eax, 0x3fffff
ja 0x1008a286
cmp ebx, 0x400
jle 0x1008a1f3
mov ecx, ebx
call fcn.100d1c50
mov edi, eax
test edi, edi
je 0x1008a286
mov dword [ebp - 0x40c], 1
push esi
push ebx
push 1
push edi
call fcn.101f9043
add esp, 0x10
cmp eax, ebx
je 0x1008a20b
mov ebx, 0xfffffffc
jmp 0x1008a256
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp eax, 5
je 0x1008a21b
cmp eax, 0xf
jne 0x1008a239
cmp edx, 1
jne 0x1008a239
push dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp - 0x408]
push eax
push edx
push ebx
mov edx, edi
call fcn.10089f10
add esp, 0x14
jmp 0x1008a254
push dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp - 0x408]
push 0
push 0
push eax
push edx
push ebx
mov edx, edi
call fcn.10089680
add esp, 0x1c
mov ebx, eax
push esi
call fcn.101f7b2b
add esp, 4
cmp dword [ebp - 0x40c], 0
je 0x1008a273
test edi, edi
je 0x1008a273
mov ecx, edi
call fcn.100d1c70
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
push esi
call fcn.101f7b2b
add esp, 4
mov eax, 0xfffffffc
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffc
pop edi
xor ecx, ebp
pop esi
call fcn.101d506b
mov esp, ebp
pop ebp
ret
Function at 0x1008e520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x10], edx
xor esi, esi
mov dword [ebp - 0xc], ebx
test edi, edi
jle 0x1008e616
cmp edi, 8
jb 0x1008e5f7
mov eax, edi
and eax, reloc.WS2_32.dll_getsockopt
jns 0x1008e557
dec eax
or eax, 0xfffffff8
inc eax
mov ecx, edi
xorps xmm4, xmm4
mov edi, ebx
sub ecx, eax
sub edi, edx
mov eax, edx
mov dword [ebp - 4], edi
xorps xmm3, xmm3
lea edi, [ebx + 4]
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 8]
nop dword [eax]
movd xmm2, dword [ebx + eax]
lea eax, [eax + 8]
movd xmm1, dword [eax - 8]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [eax - 4]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [edx + esi]
add esi, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp esi, ecx
jl 0x1008e580
mov ebx, dword [ebp - 0xc]
por xmm3, xmm4
mov edx, dword [ebp - 0x10]
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
cmp esi, edi
jge 0x1008e616
sub ebx, edx
lea ecx, [esi + edx]
sub edi, esi
movzx esi, byte [ecx + ebx]
lea ecx, [ecx + 1]
movzx edx, byte [ecx - 1]
xor esi, edx
or eax, esi
sub edi, 1
jne 0x1008e602
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a32a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
mov dword [ebp - 4], esi
push edi
mov edi, ecx
test ebx, ebx
je 0x100a32bd
mov dword [ebx], 0
test edi, edi
je 0x100a33f4
test esi, esi
je 0x100a33f4
push 0x100
lea eax, [edi + 0x144]
push 0
push eax
mov dword [ebp + 8], eax
call fcn.101ee530
add esp, 0xc
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x100a32f0
sub esi, ecx
cmp esi, 0xfd
jg 0x100a33e8
push 0xfd
push dword [ebp - 4]
lea eax, [edi + 0x144]
push eax
call fcn.101f7990
lea eax, [esi + edi]
lea ecx, [eax + 0x144]
mov dword [ebp - 0x10], eax
mov eax, 0x100
mov dword [ebp - 8], ecx
sub eax, esi
push eax
push 0x1026f954
push ecx
call fcn.101f7990
add esp, 0x18
lea eax, [edi + 0x144]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [edi + 0x140], eax
cmp eax, 0xffffffff
je 0x100a33e8
nop dword [eax + eax]
test byte [edi], 0x10
je 0x100a3387
push edi
push dword [edi + 0x140]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100a3360
mov ecx, edi
call fcn.100a3520
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x2c]
mov ecx, eax
mov dword [ebp - 0xc], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a3392
sub ecx, edx
lea eax, [esi + 2]
add eax, ecx
cmp eax, 0x100
jg 0x100a33e8
mov edi, dword [ebp + 8]
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
push edi
call fcn.101f7990
mov eax, dword [ebp - 8]
mov byte [eax], 0x5c
mov eax, 0xff
sub eax, esi
push eax
mov eax, dword [ebp - 0x10]
push dword [ebp - 0xc]
add eax, 0x145
push eax
call fcn.101f7990
add esp, 0x18
test ebx, ebx
je 0x100a33df
mov dword [ebx], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffff0c
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffff53
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100a3610
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100a3670
test ecx, ecx
je 0x100a3670
push 0x20
lea esi, [edi + 0x28]
push esi
push ecx
call fcn.100d1820
add esp, 0xc
test eax, eax
jne 0x100a3675
mov al, byte [edi + 0x47]
lea ecx, [edi + 8]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x47], al
test ecx, ecx
je 0x100a3666
test esi, esi
je 0x100a3666
cmp byte [esi + 0x1f], 0
jl 0x100a3666
push 0x102509d8
mov edx, esi
call fcn.100d4fd0
add esp, 4
pop edi
pop esi
pop ecx
pop ebp
ret
mov eax, 0xffffff56
pop edi
pop esi
pop ecx
pop ebp
ret
mov eax, 0xffffff53
pop edi
pop esi
pop ecx
pop ebp
ret
Function at 0x100aca40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
lea eax, [edi + 4]
je 0x100aca77
mov edx, dword [esi + 0x5d0]
mov ebx, dword [esi + 0x5cc]
lea ecx, [edx + 1]
mov dword [esi + 0x5d0], ecx
cmp edx, ecx
jbe 0x100aca99
lea ecx, [ebx + 1]
mov dword [esi + 0x5cc], ecx
jmp 0x100aca99
mov edx, dword [esi + 0x5d8]
mov ebx, dword [esi + 0x5d4]
lea ecx, [edx + 1]
mov dword [esi + 0x5d8], ecx
cmp edx, ecx
jbe 0x100aca99
lea ecx, [ebx + 1]
mov dword [esi + 0x5d4], ecx
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
mov byte [eax], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, ebx
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, edx
mov byte [eax + 3], bl
shr ecx, 0x18
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 5], cl
mov ecx, edx
mov byte [eax + 7], dl
mov edx, 8
shr ecx, 8
mov byte [eax + 6], cl
movzx ecx, byte [esi]
mov byte [edi], cl
movzx ecx, byte [esi + 1]
mov byte [edi + 1], cl
movzx ecx, byte [esi + 2]
mov byte [edi + 2], cl
movzx ecx, byte [esi + 3]
sub esi, edi
mov byte [edi + 3], cl
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x100acaf2
pop edi
pop esi
pop ebx
pop ebp
ret