joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101654e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a9e26
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 8]
mov dword [esi], vtable._ckEccPoint.0
mov dword [esi + 4], 4
call fcn.1006eda0
lea ecx, [esi + 0x1c]
mov dword [esp + 0x14], 0
call fcn.1006eda0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.1006eda0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x10165550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a9e26
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable._ckEccPoint.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 1
call fcn.1006eee0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x14], 0
call fcn.1006eee0
lea ecx, [esi + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.1006eee0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x1017ab20
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x43c]
mov edx, dword [eax + 0x440]
push esi
xor esi, esi
cmp dword [esp + 0x14], esi
jle 0x1017ab8c
push ebp
mov ebp, dword [esp + 0x14]
push edi
add cl, 1
movzx edi, cl
mov ecx, dword [eax + edi*4 + 0x3c]
add dl, cl
mov dword [esp + 0x18], ecx
movzx ecx, dl
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + ecx*4 + 0x3c]
mov dword [eax + edi*4 + 0x3c], ecx
add cl, dl
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x14]
movzx ecx, cl
mov dword [eax + edi*4 + 0x3c], edx
mov dl, byte [eax + ecx*4 + 0x3c]
xor byte [esi + ebp], dl
mov ecx, dword [esp + 0xc]
add esi, 1
cmp esi, dword [esp + 0x1c]
mov edx, edi
jl 0x1017ab40
pop edi
pop ebp
mov dword [eax + 0x440], edx
mov dword [eax + 0x43c], ecx
pop esi
pop ecx
ret 0xc
Function at 0x1017af40
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x1017af4f
xor al, al
pop edi
ret 8
push ebx
mov ebx, dword [esp + 0xc]
push esi
lea esi, [ebx + 0x14]
mov ecx, esi
call fcn.100f6330
cmp eax, 0x20
jne 0x1017af73
add ebx, 0x34
mov ecx, ebx
call fcn.100f6330
cmp eax, 0xc
jae 0x1017af7b
pop esi
pop ebx
xor al, al
pop edi
ret 8
mov ecx, esi
call fcn.1008bea0
mov ecx, ebx
mov esi, eax
call fcn.1008bea0
xor ecx, ecx
mov dword [edi], 0x61707865
mov dword [edi + 4], 0x3320646e
mov dword [edi + 8], 0x79622d32
mov dword [edi + 0xc], 0x6b206574
mov ch, byte [esi + 3]
movzx edx, byte [esi + 1]
mov cl, byte [esi + 2]
shl ecx, 8
or ecx, edx
shl ecx, 8
movzx edx, byte [esi]
or ecx, edx
mov dword [edi + 0x10], ecx
xor ecx, ecx
mov ch, byte [esi + 7]
movzx edx, byte [esi + 5]
mov cl, byte [esi + 6]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 4]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x14], ecx
xor ecx, ecx
mov ch, byte [esi + 0xb]
movzx edx, byte [esi + 9]
mov cl, byte [esi + 0xa]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 8]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x18], ecx
xor ecx, ecx
mov ch, byte [esi + 0xf]
movzx edx, byte [esi + 0xd]
mov cl, byte [esi + 0xe]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0xc]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x1c], ecx
xor ecx, ecx
mov ch, byte [esi + 0x13]
movzx edx, byte [esi + 0x11]
mov cl, byte [esi + 0x12]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x10]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x20], ecx
movzx edx, byte [esi + 0x15]
xor ecx, ecx
mov ch, byte [esi + 0x17]
mov cl, byte [esi + 0x16]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x14]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x24], ecx
movzx edx, byte [esi + 0x19]
xor ecx, ecx
mov ch, byte [esi + 0x1b]
mov cl, byte [esi + 0x1a]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x18]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x28], ecx
xor ecx, ecx
mov ch, byte [esi + 0x1f]
mov cl, byte [esi + 0x1e]
movzx edx, byte [esi + 0x1d]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x1c]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x2c], ecx
xor ecx, ecx
mov dword [edi + 0x30], 0
mov ch, byte [eax + 3]
movzx edx, byte [eax + 1]
pop esi
pop ebx
mov cl, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x34], ecx
movzx edx, byte [eax + 5]
xor ecx, ecx
mov ch, byte [eax + 7]
mov cl, byte [eax + 6]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
shl ecx, 8
or ecx, edx
mov dword [edi + 0x38], ecx
movzx edx, byte [eax + 9]
xor ecx, ecx
mov ch, byte [eax + 0xb]
mov cl, byte [eax + 0xa]
movzx eax, byte [eax + 8]
shl ecx, 8
or ecx, edx
shl ecx, 8
or ecx, eax
mov dword [edi + 0x3c], ecx
mov al, 1
pop edi
ret 8
Function at 0x1017bf40
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [esp + 8]
xor ecx, ecx
mov ch, byte [eax + 3]
movzx edx, byte [eax + 1]
push esi
mov esi, dword [esp + 8]
push edi
mov cl, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax]
shl ecx, 8
or ecx, edx
mov dword [esi + 0x454], ecx
xor ecx, ecx
mov ch, byte [eax + 7]
movzx edx, byte [eax + 5]
mov cl, byte [eax + 6]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
shl ecx, 8
or ecx, edx
mov dword [esi + 0x458], ecx
movzx edx, byte [eax + 9]
xor ecx, ecx
mov ch, byte [eax + 0xb]
mov cl, byte [eax + 0xa]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 8]
shl ecx, 8
or ecx, edx
mov dword [esi + 0x45c], ecx
movzx edx, byte [eax + 0xd]
xor ecx, ecx
mov ch, byte [eax + 0xf]
mov cl, byte [eax + 0xe]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 0xc]
shl ecx, 8
or ecx, edx
cmp dword [esp + 0x14], 0x100
mov dword [esi + 0x460], ecx
jne 0x1017bfdd
add eax, 0x10
mov ecx, str.expand_32_byte_k
jmp 0x1017bfe2
mov ecx, str.expand_16_byte_k
xor edx, edx
mov dh, byte [eax + 3]
movzx edi, byte [eax + 1]
mov dl, byte [eax + 2]
shl edx, 8
or edx, edi
movzx edi, byte [eax]
shl edx, 8
or edx, edi
mov dword [esi + 0x464], edx
xor edx, edx
mov dh, byte [eax + 7]
movzx edi, byte [eax + 5]
mov dl, byte [eax + 6]
shl edx, 8
or edx, edi
movzx edi, byte [eax + 4]
shl edx, 8
or edx, edi
mov dword [esi + 0x468], edx
xor edx, edx
mov dh, byte [eax + 0xb]
movzx edi, byte [eax + 9]
mov dl, byte [eax + 0xa]
shl edx, 8
or edx, edi
movzx edi, byte [eax + 8]
shl edx, 8
or edx, edi
mov dword [esi + 0x46c], edx
xor edx, edx
mov dh, byte [eax + 0xf]
movzx edi, byte [eax + 0xd]
mov dl, byte [eax + 0xe]
movzx eax, byte [eax + 0xc]
shl edx, 8
or edx, edi
shl edx, 8
or edx, eax
mov dword [esi + 0x470], edx
movsx edx, byte [ecx + 3]
movsx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movsx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
movsx eax, byte [ecx]
shl edx, 8
or edx, eax
mov dword [esi + 0x444], edx
movsx edx, byte [ecx + 7]
movsx eax, byte [ecx + 6]
shl edx, 8
or edx, eax
movsx eax, byte [ecx + 5]
shl edx, 8
or edx, eax
movsx eax, byte [ecx + 4]
shl edx, 8
or edx, eax
mov dword [esi + 0x448], edx
movsx edx, byte [ecx + 0xb]
movsx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movsx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movsx eax, byte [ecx + 8]
shl edx, 8
or edx, eax
mov dword [esi + 0x44c], edx
movsx edx, byte [ecx + 0xf]
movsx eax, byte [ecx + 0xe]
shl edx, 8
or edx, eax
movsx eax, byte [ecx + 0xd]
shl edx, 8
or edx, eax
shl edx, 8
movsx ecx, byte [ecx + 0xc]
or edx, ecx
pop edi
mov dword [esi + 0x450], edx
pop esi
ret 0x10
Function at 0x1017c8d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
cmp esi, 0x80
mov ebp, ecx
jbe 0x1017c8e7
pop esi
xor al, al
pop ebp
ret 0xc
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
push edi
jne 0x1017c8f6
mov ebx, 0x400
mov eax, dword [esp + 0x14]
push esi
push eax
lea edi, [ebp + 0x88]
push edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
cmp esi, 0x80
jae 0x1017c942
movzx eax, byte [esi + ebp + 0x87]
mov ecx, edi
lea ecx, [ecx]
movzx edx, byte [ecx]
add edx, eax
and edx, 0xff
mov al, byte [edx + 0x10235820]
mov byte [edi + esi], al
add esi, 1
add ecx, 1
cmp esi, 0x80
jb 0x1017c920
lea edx, [ebx + 7]
shr edx, 3
mov ecx, ebx
neg ecx
mov eax, 0x80
and ecx, 7
sub eax, edx
lea esi, [eax + ebp + 0x88]
mov edi, 0xff
sar edi, cl
movzx ecx, byte [esi]
and edi, ecx
test eax, eax
mov cl, byte [edi + 0x10235820]
mov byte [esi], cl
je 0x1017c991
movzx edi, byte [esi + edx - 1]
sub esi, 1
movzx ecx, cl
xor edi, ecx
mov cl, byte [edi + 0x10235820]
sub eax, 1
test eax, eax
mov byte [esi], cl
jne 0x1017c975
pop edi
mov ecx, 0x3f
lea eax, [ebp + 0x106]
pop ebx
mov edi, edi
movzx dx, byte [eax + 1]
movzx si, byte [eax]
shl dx, 8
add dx, si
mov word [eax], dx
mov edx, ecx
sub ecx, 1
sub eax, 2
test edx, edx
jne 0x1017c9a0
pop esi
mov al, 1
pop ebp
ret 0xc
Function at 0x1017d0f0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x1026bfa8
ret

Function at 0x1017d100
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x1026bff0
ret
Function at 0x10180210
Capabilities:
Encrypt data using twofish

Disassembly:
push ecx
mov edx, dword [edx]
mov dword [esp], edx
mov edx, dword [esp + 8]
sub edx, 2
push ebx
push edi
je 0x101802c5
sub edx, 1
je 0x1018027d
sub edx, 1
jne 0x10180370
movzx edi, byte [esp + 8]
mov dl, byte [ecx + eax*4 + 0x18]
xor dl, byte [edi + 0x10235ab8]
movzx edi, byte [esp + 0xa]
mov bl, byte [edi + 0x102359b8]
xor bl, byte [ecx + eax*4 + 0x1a]
movzx edi, byte [esp + 0xb]
mov byte [esp + 8], dl
movzx edx, byte [esp + 9]
mov dl, byte [edx + 0x102359b8]
xor dl, byte [ecx + eax*4 + 0x19]
mov byte [esp + 0xa], bl
mov bl, byte [edi + 0x10235ab8]
xor bl, byte [ecx + eax*4 + 0x1b]
mov byte [esp + 0xb], bl
jmp 0x10180281
mov dl, byte [esp + 9]
movzx edi, byte [esp + 8]
mov bl, byte [ecx + eax*4 + 0x10]
xor bl, byte [edi + 0x10235ab8]
movzx edx, dl
mov dl, byte [edx + 0x10235ab8]
xor dl, byte [ecx + eax*4 + 0x11]
mov byte [esp + 9], dl
movzx edx, byte [esp + 0xa]
mov dl, byte [edx + 0x102359b8]
xor dl, byte [ecx + eax*4 + 0x12]
mov byte [esp + 0xa], dl
movzx edx, byte [esp + 0xb]
mov dl, byte [edx + 0x102359b8]
xor dl, byte [ecx + eax*4 + 0x13]
jmp 0x101802cd
mov dl, byte [esp + 0xb]
mov bl, byte [esp + 8]
movzx edi, byte [ecx + eax*4 + 8]
movzx ebx, bl
movzx ebx, byte [ebx + 0x102359b8]
xor edi, ebx
movzx edi, byte [edi + 0x102359b8]
movzx ebx, byte [ecx + eax*4]
xor edi, ebx
movzx ebx, byte [edi + 0x10235ab8]
movzx edi, byte [esp + 9]
movzx edi, byte [edi + 0x10235ab8]
mov byte [esp + 8], bl
movzx ebx, byte [ecx + eax*4 + 9]
xor edi, ebx
movzx edi, byte [edi + 0x102359b8]
movzx ebx, byte [ecx + eax*4 + 1]
xor edi, ebx
movzx ebx, byte [edi + 0x102359b8]
movzx edi, byte [esp + 0xa]
movzx edi, byte [edi + 0x102359b8]
mov byte [esp + 9], bl
movzx ebx, byte [ecx + eax*4 + 0xa]
xor edi, ebx
movzx ebx, byte [ecx + eax*4 + 2]
movzx edi, byte [edi + 0x10235ab8]
movzx edx, dl
movzx edx, byte [edx + 0x10235ab8]
xor edi, ebx
mov bl, byte [edi + 0x10235ab8]
movzx edi, byte [ecx + eax*4 + 0xb]
movzx eax, byte [ecx + eax*4 + 3]
xor edx, edi
movzx edx, byte [edx + 0x10235ab8]
xor edx, eax
mov al, byte [edx + 0x102359b8]
jmp 0x10180378
mov al, byte [esp + 0xb]
mov bl, byte [esp + 0xa]
movzx ecx, al
mov eax, dword [ecx*4 + 0x102367b8]
movzx ecx, byte [esp + 9]
movzx edx, bl
xor eax, dword [edx*4 + 0x102363b8]
movzx edx, byte [esp + 8]
xor eax, dword [ecx*4 + 0x10235fb8]
pop edi
xor eax, dword [edx*4 + 0x10235bb8]
pop ebx
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 3], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
mov byte [esi + 2], dl
mov byte [esi + 1], cl
mov byte [esi], al
pop ecx
ret
Function at 0x101812d0
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x101812ee
pop edi
mov eax, 1
pop esi
ret 0xc
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x101813ee
push ebp
lea esp, [esp]
cmp ebx, 0x15b0
mov eax, ebx
jb 0x1018130f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jb 0x101813ae
mov edx, eax
shr edx, 4
nop
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub eax, 0x10
sub edx, 1
jne 0x10181320
test eax, eax
je 0x101813c1
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x101813b2
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x10181300
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret 0xc
Function at 0x101868d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
call fcn.1008bea0
lea ecx, [esi + 0x20]
mov edi, eax
call fcn.1008bea0
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea edx, [ecx + esi*4 + 4]
mov ecx, dword [ecx + esi*4]
xor ecx, dword [edi]
mov dword [esp + 0x10], edx
mov edx, dword [edx]
xor esi, esi
mov ebx, ecx
and ebx, 0xff0000
or ebx, 0x1000000
shr ebx, 0x10
mov ebx, dword [eax + ebx*4]
mov ebp, ecx
shr ebp, 0x18
add ebx, dword [eax + ebp*4]
mov ebp, ecx
and ebp, 0xff00
or ebp, 0x20000
shr ebp, 8
xor ebx, dword [eax + ebp*4]
mov ebp, ecx
and ebp, 0xff
or ebp, 0x300
add ebx, dword [eax + ebp*4]
add esi, 1
xor ebx, dword [edi + esi*4]
add esi, 1
xor edx, ebx
mov ebx, edx
and ebx, 0xff0000
or ebx, 0x1000000
shr ebx, 0x10
mov ebx, dword [eax + ebx*4]
mov ebp, edx
shr ebp, 0x18
add ebx, dword [eax + ebp*4]
mov ebp, edx
and ebp, 0xff00
or ebp, 0x20000
shr ebp, 8
xor ebx, dword [eax + ebp*4]
mov ebp, edx
and ebp, 0xff
or ebp, 0x300
add ebx, dword [eax + ebp*4]
xor ebx, dword [edi + esi*4]
xor ecx, ebx
cmp esi, 0xe
jbe 0x10186902
mov eax, dword [edi + 0x44]
mov esi, dword [esp + 0x1c]
xor eax, edx
mov edx, dword [esp + 0x18]
pop edi
mov dword [edx + esi*4], eax
mov eax, dword [esp + 0xc]
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
pop ecx
ret 8
Function at 0x101869c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor eax, eax
lea edi, [ebx + 4]
mov ecx, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call fcn.100f6330
cdq
and edx, 3
add eax, edx
mov esi, eax
sar esi, 2
lea ecx, [ebx + 0x20]
mov dword [esp + 0x14], esi
call fcn.100f6330
cdq
and edx, 3
add eax, edx
mov ebp, eax
sar ebp, 2
mov ecx, edi
mov dword [esp + 0x20], ebp
call fcn.1008bea0
lea ecx, [ebx + 0x20]
mov dword [esp + 0x18], eax
call fcn.1008bea0
xor edi, edi
test esi, esi
mov dword [esp + 0x24], eax
jle 0x10186a8c
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
movzx esi, byte [eax + ebp]
add eax, 1
cdq
idiv ebx
shl esi, 8
add edi, 1
movzx ecx, byte [edx + ebp]
lea eax, [edx + 1]
cdq
idiv ebx
or ecx, esi
shl ecx, 8
movzx esi, byte [edx + ebp]
lea eax, [edx + 1]
cdq
idiv ebx
or esi, ecx
shl esi, 8
movzx ecx, byte [edx + ebp]
lea eax, [edx + 1]
cdq
idiv ebx
mov eax, dword [esp + 0x18]
or ecx, esi
xor dword [eax + edi*4 - 4], ecx
cmp edi, dword [esp + 0x14]
mov dword [esp + 0x10], edx
jl 0x10186a30
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
xor edi, edi
test esi, esi
jle 0x10186aba
push 0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebx
call fcn.101868d0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [eax + edi*4], edx
mov dword [eax + edi*4 + 4], ecx
add edi, 2
cmp edi, esi
jl 0x10186a92
xor esi, esi
test ebp, ebp
jle 0x10186ae8
push 0
lea edx, [esp + 0x2c]
push edx
mov ecx, ebx
call fcn.101868d0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [eax + esi*4], ecx
mov dword [eax + esi*4 + 4], edx
add esi, 2
cmp esi, ebp
jl 0x10186ac0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x10188d20
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1026d48c]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
mov esi, ecx
lea ecx, [esi + 0x28]
call fcn.1008be90
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10188d9a
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x10188d58
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov dword [esi + 0x118], edx
jmp 0x10188d62
mov dword [esi + 0x118], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
lea ecx, [eax + 3]
push ecx
lea edx, [eax + 2]
push edx
lea ecx, [eax + 1]
push ecx
push eax
push str._b._b._b._b
lea edx, [esp + 0x18]
push 0x28
push edx
call fcn.1002b580
add esp, 0x1c
lea eax, [esp + 4]
push eax
lea ecx, [esi + 0xa0]
call fcn.10012ba0
jmp 0x10188da5
lea ecx, [esi + 0xa0]
call fcn.10010600
mov ecx, dword [esp + 0x2c]
mov byte [esi + 0x114], 0
pop esi
xor ecx, esp
call fcn.1018f87e
add esp, 0x2c
ret

Function at 0x10188e00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101ab37b
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x1026d48c]
xor eax, esp
mov dword [esp + 0x154], eax
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x164]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xb8]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xb0]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xb4]
mov dword [esp + 0xc], ecx
lea edi, [esi + 0xbc]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [edi], 0
call fcn.1002a630
mov eax, dword [esi + 0xa4]
push 0
push edi
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esi + 0x30]
mov dword [esp + 0x180], 0
call fcn.1008be90
push eax
call fcn.10110f30
add esp, 0x18
lea ecx, [esp + 0x2c]
mov byte [esi + 0xa8], al
mov byte [esi + 0x28], 0
mov dword [esp + 0x16c], 0xffffffff
call fcn.1002a650
mov ecx, dword [esp + 0x164]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.1018f87e
add esp, 0x164
ret

Function at 0x10189000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101ab3e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.10049000
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.HostnameResolveIpv6.0
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
call fcn.10010fb0
mov dword [esi + 0xa4], ebx
mov byte [esi + 0xa8], bl
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x10189090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1019ba98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.HostnameResolveIpv6.0
xor eax, eax
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xbc], eax
call fcn.10011070
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.10049020
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x1018a190
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a5598
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x3c]
push str.sspiNext
push ebx
lea ecx, [esp + 0x18]
call fcn.10061630
cmp dword [esi + 0xc], 0
mov dword [esp + 0x24], 0
jge 0x1018a20f
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
push str.No_SSPI_package_is_selected.
mov ecx, ebx
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.100616a0
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 0x14
mov edi, dword [esp + 0x30]
mov ecx, edi
call fcn.10017ff0
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push ebx
push ecx
push eax
mov byte [eax], 1
mov eax, dword [esp + 0x38]
push eax
mov byte [ecx], 0
mov ecx, dword [esi + 0xc]
push edi
push ecx
mov ecx, esi
call fcn.10189cd0
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x24], 0xffffffff
call fcn.100616a0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 0x14

Function at 0x1018b160
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x10199258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
je 0x1018b1c1
lea ecx, [esp + 0xc]
call fcn.100182e0
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.1018af10
test al, al
lea ecx, [esp + 0xc]
jne 0x1018b1d7
mov dword [esp + 0x30], 0xffffffff
call fcn.10018a90
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
call fcn.1008bea0
mov esi, eax
lea ecx, [esp + 0xc]
add esi, 2
call fcn.100f6330
mov ecx, dword [esp + 0x38]
sub eax, 2
push eax
push esi
push ecx
call fcn.1006fcd0
add esp, 0xc
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x30], 0xffffffff
call fcn.10018a90
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4

Function at 0x1018b6f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10199258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.100182e0
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x38], 0
call fcn.10072e00
add esp, 8
lea ecx, [esp + 0xc]
call fcn.100f6330
push eax
lea ecx, [esp + 0x10]
call fcn.1008bea0
push eax
mov ecx, esi
call fcn.1018b560
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x30], 0xffffffff
call fcn.10018a90
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x1018f87e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1026d48c]
jne 0x1018f888
repz ret
jmp fcn.10190232