joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10057ac0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x34
mov eax, dword [0x10240114]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov edi, dword [esp + 0x4c]
push 6
push 1
push 2
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x10057cb2
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [esp + 0x24], xmm0
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x1c], eax
xor eax, eax
push 4
mov word [esp + 0x1e], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push esi
mov dword [edi + 4], 0xffffffff
mov dword [edi], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x10057ca0
push 0x10
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x10057ca0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x10057ca0
cmp dword [esp + 8], 0x10
jl 0x10057ca0
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x10057ca0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x10057ca0
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10057ca0
push 1
push esi
call fcn.10057e70
add esp, 8
test eax, eax
js 0x10057ca0
push 0
push 0x2710
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
push 1
push eax
mov dword [esp + 0x24], 1
call fcn.10054080
add esp, 0x10
push 0
push 0
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x10057ca0
lea eax, [esp + 8]
mov dword [esp + 8], 0x10
push eax
lea eax, [esp + 0x1c]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x10057ca0
cmp dword [esp + 8], 0x10
jl 0x10057ca0
lea eax, [esp + 8]
mov dword [esp + 8], 0x10
push eax
lea eax, [esp + 0x2c]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x10057ca0
cmp dword [esp + 8], 0x10
jl 0x10057ca0
mov ax, word [esp + 0x18]
cmp ax, word [esp + 0x28]
jne 0x10057ca0
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x2c]
jne 0x10057ca0
mov ax, word [esp + 0x1a]
cmp ax, word [esp + 0x2a]
jne 0x10057ca0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100645b9
add esp, 0x34
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi]
call esi
push dword [edi + 4]
call esi
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.100645b9
add esp, 0x34
ret
Function at 0x10057d70
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call fcn.1008f5ea
mov ecx, eax
add esp, 0x18
xor eax, eax
test ecx, ecx
je 0x10057d96
cmp ecx, 0xffffffff
cmovne eax, ecx
ret
Function at 0x100615c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x10240064]
mov esi, eax
add esp, 4
test esi, esi
jne 0x100615eb
pop esi
pop ebp
add esp, 0xc
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x1006163a
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [edi]
push ebx
push dword [esp + 0x2c]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov ebx, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x28], ebx
jmp 0x10061642
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x30]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x100616b3
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x10061670
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x100616e5
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x101bf6f6
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x101bf6f7
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x100616c0
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x100616f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.1002c610
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x10240064]
mov esi, eax
add esp, 8
test esi, esi
je 0x10061872
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x10061772
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x100617e3
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x100617a0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x10061815
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x101bf6f6
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x101bf6f7
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x100617f0
push dword [esp + 0x30]
call fcn.1002c610
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x10061840
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x10240068]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret

Function at 0x10067b49
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10096db7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10096c36

Function at 0x1009da2e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1009d6ee
Function at 0x100d00a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.100657e0
mov eax, dword [0x10240114]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa0]
push ebx
push edi
mov edi, dword [esp + 0xac]
xor ebx, ebx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
sub ecx, edi
mov dword [esp + 0x10], ecx
cmp edx, edi
jb 0x100d0260
cmp edi, 0x40
ja 0x100d0260
lea eax, [esp + 0x1c]
neg eax
lea ecx, [esp + 0x1c]
and eax, 0x3f
add ecx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0xc], ecx
cmp edx, eax
jbe 0x100d0119
mov ebx, edx
sub ebx, edi
sub ebx, 0x100
push ebp
push esi
push edi
xor esi, esi
mov dword [esp + 0x20], 0
push esi
push ecx
call fcn.1007d020
mov eax, dword [esp + 0xbc]
add esp, 0xc
xor ebp, ebp
cmp ebx, dword [eax + 0xc]
jae 0x100d01dc
mov ecx, ebx
sub ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
nop dword [eax + eax]
mov edi, dword [esp + 0xb0]
mov eax, ebx
xor eax, dword [esp + 0x18]
lea edx, [eax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov eax, dword [esp + 0xb0]
neg edx
xor ecx, dword [eax + 8]
mov eax, ebx
xor eax, dword [edi + 8]
or ecx, eax
mov eax, edx
or eax, dword [esp + 0x1c]
xor ecx, ebx
shr ecx, 0x1f
and edx, ebp
neg ecx
or esi, edx
mov edx, dword [esp + 0x14]
and ecx, eax
mov eax, dword [edi + 0x14]
mov edi, dword [esp + 0xb4]
mov dword [esp + 0x1c], ecx
mov al, byte [eax + ebx]
inc ebx
and al, cl
or byte [edx + ebp], al
inc ebp
mov ecx, ebp
mov eax, ebp
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
mov eax, dword [esp + 0xb0]
xor ecx, ebp
shr ecx, 0x1f
neg ecx
and ebp, ecx
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ebx, dword [eax + 0xc]
jb 0x100d0150
jmp 0x100d01e0
mov edx, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
je 0x100d0242
mov eax, esi
and eax, 0xffffffdf
mov bl, byte [eax + edx]
mov eax, esi
or eax, 0x20
mov dl, byte [eax + edx]
mov eax, esi
and eax, 0x20
inc esi
dec eax
shr eax, 0x1f
neg al
movzx eax, al
mov dword [esp + 0x10], eax
not eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
and cl, dl
mov edx, dword [esp + 0x14]
and al, bl
or al, cl
mov ecx, dword [esp + 0x20]
mov byte [ecx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc ebp
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp ebp, edi
jb 0x100d01e6
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.100645b9
add esp, 0x98
ret
mov ecx, dword [esp + 0x9c]
xor eax, eax
pop edi
pop ebx
xor ecx, esp
call fcn.100645b9
add esp, 0x98
ret
Function at 0x100d11c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.100657e0
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x20]
push edi
mov eax, dword [ebx + 4]
inc esi
mov edi, dword [esp + 0x1c]
mov eax, dword [eax + 0x64]
mov ecx, dword [edi + 8]
test byte [eax + 0x30], 1
je 0x100d1246
mov edx, dword [esp + 0x20]
lea eax, [esi + edx]
cmp eax, ecx
ja 0x100d124a
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebp
push dword [ebx + 0x3cc]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x2c], al
mov dword [esp + 0x20], ebp
call fcn.1002f160
push eax
call fcn.100a3650
mov edx, dword [edi + 8]
add esp, 8
test eax, 0x200000
je 0x100d1253
sub edx, ebp
mov eax, 1
pop ebp
dec edx
mov dword [edi + 8], edx
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp esi, ecx
jbe 0x100d1202
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
lea ecx, [esi + ebp]
mov ebx, edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor esi, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100d12d0
mov eax, ebp
mov ebp, dword [edi + 0x14]
mov edi, dword [esp + 0x1c]
dec ebp
shr eax, 0x1f
add ebp, edx
mov dword [esp + 0x10], eax
nop
mov edx, dword [esp + 0x10]
lea ebp, [ebp - 1]
mov ecx, edi
mov eax, esi
sub ecx, esi
shr eax, 0x1f
shr ecx, 0x1f
inc esi
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x28]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
cmp esi, dword [esp + 0x14]
jb 0x100d1290
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
not ebx
lea eax, [ebp + 1]
movzx ecx, bl
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub dword [edi + 8], eax
mov dword [esp + 0x28], ecx
not ecx
pop ebp
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebx
add esp, 8
ret
Function at 0x100f5f20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100657e0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x100f5fa0
mov cl, byte [edi]
test cl, cl
je 0x100f5fa0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x100f5f50
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x100f6040
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100657e0
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x100f60c3
mov al, byte [ebx]
test al, al
je 0x100f60c3
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.1011a6d0
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or esi, eax
mov al, byte [ebx]
xor esi, edi
mov dword [esp + 0x10], esi
test al, al
jne 0x100f6067
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x1010b800
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.100657e0
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [eax + 0x60]
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, dword [ebp + 0x70]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], ebp
test ecx, ecx
je 0x1010b869
test ebx, ebx
je 0x1010b849
lea edx, [ebp + 0x30]
add edx, ecx
cmp ecx, 0x40
jae 0x1010b849
mov al, byte [edx]
inc ecx
xor al, byte [esi]
inc edx
mov byte [edi], al
inc esi
inc edi
sub ebx, 1
jne 0x1010b835
mov dword [ebp + 0x70], ecx
test ebx, ebx
je 0x1010b924
cmp ecx, 0x40
jne 0x1010b869
mov dword [ebp + 0x70], 0
add dword [ebp + 0x20], 1
jne 0x1010b869
inc dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov eax, ebx
and eax, 0x3f
sub ebx, eax
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [esp + 0x24], eax
cmp ebx, 0x40
jb 0x1010b8d7
push dword [esp + 0x24]
mov ecx, ebx
xor ebp, ebp
shr ecx, 6
lea eax, [ecx + edx]
cmp eax, ecx
cmovae ebp, eax
neg edx
cmp eax, ecx
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x14]
cmovae edx, ecx
shl edx, 6
push ebp
push edx
push esi
push edi
mov dword [esp + 0x28], edx
call fcn.10151aa0
mov eax, dword [esp + 0x28]
add esp, 0x14
sub ebx, eax
add esi, eax
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x20], eax
test eax, eax
jne 0x1010b8d0
inc dword [ebp + 0x24]
mov edx, eax
cmp ebx, 0x40
jae 0x1010b883
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x1010b924
push 0x40
lea eax, [ebp + 0x30]
push 0
push eax
call fcn.1007d020
lea eax, [ebp + 0x20]
push eax
push ebp
lea eax, [ebp + 0x30]
push 0x40
push eax
push eax
call fcn.10151aa0
add esp, 0x20
xor edx, edx
test ebx, ebx
je 0x1010b921
sub esi, edi
nop dword [eax + eax]
mov al, byte [edx + ebp + 0x30]
lea ecx, [edx + edi]
xor al, byte [esi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x1010b910
mov dword [ebp + 0x70], ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x1010ce70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x1010ce97
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x1010ce86
pop edi
movzx eax, dl
pop esi
ret
Function at 0x10115760
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x20
call fcn.100657e0
push esi
mov esi, dword [esp + 0x34]
mov eax, esi
sub eax, 0
je 0x101157a5
sub eax, 2
je 0x101157a5
sub eax, 0x15
je 0x101157a5
push 0x297
push str.....crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call fcn.100edac0
add esp, 0x14
xor eax, eax
pop esi
add esp, 0x20
ret
call fcn.1011a5b0
cmp eax, 1
jne 0x1011579e
mov eax, dword [esp + 0x38]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x2c]
xorps xmm0, xmm0
push ebp
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
test ebx, ebx
je 0x101157ef
test esi, esi
jne 0x101157ef
or ecx, 0x400
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x3c], 1
jne 0x101157fd
or ecx, 1
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x48]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x40]
push ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x1011584f
cmp esi, 8
je 0x10115894
mov ecx, dword [esp + 0x10]
test ecx, 0x400
je 0x1011585c
push ebp
lea eax, [esp + 0x14]
and ecx, 0xfffffbff
push eax
push dword [esp + 0x40]
or ecx, 4
mov edi, esi
push ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x10115818
mov eax, 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
push 0x2da
push str.....crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call fcn.100edac0
test edi, edi
cmovne esi, edi
push esi
call fcn.10115ca0
push eax
push 1
call fcn.100ed090
add esp, 0x20
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
push 0x2cb
push str.....crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call fcn.100edac0
add esp, 0x14
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
Function at 0x1011d7c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp dword [ebx + 0x84], 0xffffffff
jne 0x1011d7d2
xor eax, eax
pop ebx
ret
push ebp
push esi
push dword [ebx]
call fcn.100f71b0
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test ebp, ebp
je 0x1011d886
mov ecx, dword [ebx + 0x84]
push edi
cmp ecx, esi
jne 0x1011d826
test esi, esi
jle 0x1011d864
mov edx, ebp
lea ecx, [ebx + 4]
mov edi, esi
nop dword [eax + eax]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub edi, 1
jne 0x1011d810
jmp 0x1011d864
sub eax, ecx
mov byte [ecx + ebx + 0x64], 0x80
cmp eax, 1
jle 0x1011d844
dec eax
push eax
lea eax, [ebx + 0x65]
add eax, ecx
push 0
push eax
call fcn.1007d020
add esp, 0xc
test esi, esi
jle 0x1011d864
mov edx, ebp
lea ecx, [ebx + 0x24]
mov edi, esi
nop
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub edi, 1
jne 0x1011d850
push esi
push ebp
push ebp
push dword [ebx]
call fcn.100f7830
add esp, 0x10
pop edi
test eax, eax
jne 0x1011d886
push esi
push ebp
call fcn.100fbc80
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x1012e6f0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.100657e0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
call fcn.100eb6d0
mov ebx, eax
push ebx
push esi
call fcn.100eb5b0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x1012e76f
push 0xf0000040
push 1
xor edi, edi
lea eax, [esp + 0x18]
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1012e753
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.100eb620
push esi
call fcn.100eb770
add esp, 0x10
test eax, eax
jne 0x1012e7e9
push 1
push esi
call fcn.100eb6d0
mov ebx, eax
push ebx
push esi
call fcn.100eb5b0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x1012e7e0
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1012e7c4
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.100eb620
push esi
call fcn.100eb770
add esp, 0x10
test eax, eax
jne 0x1012e7e9
push esi
call fcn.100eb770
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x101389f0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x10138a08
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x10138a0d
mov ebx, 0x10200318
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x10138ae5
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
cmp esi, 3
jb 0x10138a79
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 2], cl
mov cl, byte [eax + ebx]
lea eax, [edx + 3]
jmp 0x10138ac5
shl eax, 0x10
cmp esi, 2
jne 0x10138a89
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x10138aac
mov al, 0x3d
jmp 0x10138ab5
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov ecx, dword [esp + 0x18]
mov byte [ecx + 2], al
mov cl, 0x3d
mov eax, dword [esp + 0x14]
add eax, 3
sub esi, 3
mov byte [eax], cl
add ebp, 4
lea edx, [eax + 1]
add edi, 3
test esi, esi
jg 0x10138a23
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret