joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10143e30
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10185536
call fcn.10070d74
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.101439d0
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10143f0b
mov dword [ebp - 8], 0
jmp 0x10143e9c
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10143f0b
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10070446
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10143f09
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.10070446
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.10144c10
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10070446
jmp 0x10143e93
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10070446
mov esp, ebp
pop ebp
ret

Function at 0x10144fc0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10185536
call fcn.10070d74
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1014507c
mov dword [ebp - 8], 0
jmp 0x10145003
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x1014505e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10070446
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1014505c
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.10070446
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10070446
jmp 0x10144ffa
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x1018273c]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.10070446
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10070446
mov esp, ebp
pop ebp
ret
Function at 0x101457b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101855fa
call fcn.10070d74
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10145818
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x10145818
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x10145818
xor eax, eax
jmp 0x10145859
mov dword [ebp - 8], 1
jmp 0x1014582a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x10145854
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x10145852
xor eax, eax
jmp 0x10145859
jmp 0x10145821
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10070446
mov esp, ebp
pop ebp
ret
Function at 0x100153f0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x10015475
mov ecx, dword [ebp + 8]
test al, 0x40
je 0x1001542c
push 0x16
push 0x10131640
call fcn.10010a30
mov eax, 0x40
mov esp, ebp
pop ebp
ret 4
test al, 8
je 0x10015447
push 0xf
push 0x10131658
call fcn.10010a30
mov eax, 8
mov esp, ebp
pop ebp
ret 4
test al, 0x20
je 0x10015460
push 0x10131668
call fcn.10010880
mov eax, 0x20
mov esp, ebp
pop ebp
ret 4
push 0x10131678
call fcn.10010880
mov eax, 0x41
mov esp, ebp
pop ebp
ret 4
test al, 1
je 0x10015493
mov ecx, dword [ebp + 8]
push 0x1d
push 0x10131688
call fcn.10010a30
mov eax, 1
mov esp, ebp
pop ebp
ret 4
test al, 2
je 0x100154b1
mov ecx, dword [ebp + 8]
push 0x20
push 0x101316a8
call fcn.10010a30
mov eax, 2
mov esp, ebp
pop ebp
ret 4
test al, 4
je 0x100154cd
mov ecx, dword [ebp + 8]
push 0x101316cc
call fcn.10010880
mov eax, 4
mov esp, ebp
pop ebp
ret 4
test al, 8
je 0x100154e9
mov ecx, dword [ebp + 8]
push str.MODEM
call fcn.10010880
mov eax, 0x10
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1001a2e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10109b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1013d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1001a40e
cmp byte [ebx + 0x3d], 0
je 0x1001a40e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x1001a339
xor al, al
jmp 0x1001a410
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10018a30
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1001a39f
sub eax, 1
je 0x1001a3a3
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x1001a3f6
xor bl, bl
jmp 0x1001a3f8
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x1001a3d8
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.100ebe72
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x1001a39b
cmp byte [ebx + 0x3d], 0
je 0x1001a3f6
test esi, esi
jne 0x1001a361
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10010980
jmp 0x1001a35e
mov bl, 1
cmp ecx, 0x10
jb 0x1001a40a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.1000ea80
mov al, bl
jmp 0x1001a410
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ae9aa
mov esp, ebp
pop ebp
ret
Function at 0x1001a7d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10109886
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1013d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100ae9bb
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100ada72
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001ae00
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x1013d070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [ebp - 0x128], ebx
inc edx
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [ebp + esi*4 - 0x104], ecx
inc esi
cmp esi, 0x10
jb 0x1001ae21
cmp esi, 0x40
jae 0x1001aea3
mov ebx, 0x40
lea eax, [ebp + esi*4 - 0x10c]
sub ebx, esi
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax - 0x38]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebx, 1
jne 0x1001ae63
mov ebx, dword [ebp - 0x128]
mov eax, dword [ebx + 8]
xor ecx, ecx
mov edx, dword [ebx + 0x20]
mov edi, eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x108], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x118], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x110], eax
mov eax, dword [ebx + 0x24]
mov ebx, dword [ebp - 0x11c]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], ecx
jmp 0x1001af06
mov edx, dword [ebp - 0x114]
mov esi, ebx
mov eax, ebx
rol eax, 7
ror esi, 0xb
xor esi, eax
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, edx
xor eax, dword [ebp - 0x110]
and eax, ebx
xor eax, edx
mov edx, edi
add esi, eax
ror edx, 0xd
add esi, dword [ecx + 0x1012b688]
mov eax, edi
add esi, dword [ebp + ecx - 0x104]
add esi, dword [ebp - 0x120]
rol eax, 0xa
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x108]
mov ecx, eax
and eax, edi
or ecx, edi
and ecx, dword [ebp - 0x10c]
or ecx, eax
mov eax, dword [ebp - 0x114]
add edx, ecx
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x114], eax
add ecx, 4
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], ebx
mov ebx, dword [ebp - 0x118]
mov dword [ebp - 0x118], eax
add ebx, esi
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x108], edi
lea edi, [edx + esi]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x124], ecx
cmp ecx, 0x100
jb 0x1001af00
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 4]
add eax, edi
mov dword [ebp - 0x11c], ebx
xor ecx, ebp
mov ebx, dword [ebp - 0x128]
pop edi
pop esi
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x108]
add dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x10c]
add dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x118]
add dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x11c]
add dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x110]
add dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x114]
add dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x120]
add dword [ebx + 0x24], eax
pop ebx
call fcn.100ae9aa
mov esp, ebp
pop ebp
ret
Function at 0x1001b2f0
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
push edi
lea esi, [ebx + 0x80]
cmp edi, 0x40
ja 0x1001b326
push edx
push ebx
call fcn.100e58b0
mov eax, 0x40
sub eax, edi
push eax
lea eax, [ebx + edi]
push 0
push eax
call fcn.100e5e30
add esp, 0x18
jmp 0x1001b389
mov dword [esi], 0
mov ecx, esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
call fcn.1001b240
add esp, 4
mov edx, ebx
mov ecx, esi
call fcn.1001b030
xorps xmm0, xmm0
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm0
movaps xmm2, xmmword [0x10137640]
lea edi, [ebx + 0x10]
mov eax, edi
mov ecx, 2
nop word [eax + eax]
lea eax, [eax + 0x20]
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x30]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
sub ecx, 1
jne 0x1001b3a0
mov dword [esi], ecx
mov edx, ebx
mov dword [esi + 4], ecx
mov ecx, esi
push 0x40
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
call fcn.1001b240
movups xmm0, xmmword [esi + 8]
add esp, 4
mov eax, 2
movaps xmm1, xmmword [0x10137650]
movups xmmword [ebx + 0x60], xmm0
movups xmm0, xmmword [esi + 0x18]
movups xmmword [ebx + 0x70], xmm0
nop dword [eax]
lea edi, [edi + 0x20]
movups xmm0, xmmword [edi - 0x30]
pxor xmm0, xmm1
movups xmmword [edi - 0x30], xmm0
movups xmm0, xmmword [edi - 0x20]
pxor xmm0, xmm1
movups xmmword [edi - 0x20], xmm0
sub eax, 1
jne 0x1001b430
mov dword [esi], eax
mov edx, ebx
mov dword [esi + 4], eax
mov ecx, esi
push 0x40
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
call fcn.1001b240
movups xmm0, xmmword [esi + 8]
add esp, 4
movups xmmword [ebx + 0x40], xmm0
movups xmm0, xmmword [esi + 0x18]
pop edi
pop esi
movups xmmword [ebx + 0x50], xmm0
pop ebx
pop ebp
ret
Function at 0x1001b520
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x9c
mov eax, dword [0x1013d070]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
push dword [ebp + 8]
xorps xmm0, xmm0
mov byte [esp + 0x74], 0
mov esi, ecx
movq qword [esp + 0x85], xmm0
lea ecx, [esp + 0xc]
mov dword [esp + 0x8d], 0
movups xmmword [esp + 0x75], xmm0
mov word [esp + 0x91], 0
mov byte [esp + 0x93], 0
movlpd qword [esp + 0xc], xmm0
mov dword [esp + 0x14], 0x6a09e667
mov dword [esp + 0x18], 0xbb67ae85
mov dword [esp + 0x1c], 0x3c6ef372
mov dword [esp + 0x20], 0xa54ff53a
mov dword [esp + 0x24], 0x510e527f
mov dword [esp + 0x28], 0x9b05688c
mov dword [esp + 0x2c], 0x1f83d9ab
mov dword [esp + 0x30], 0x5be0cd19
call fcn.1001b240
add esp, 4
lea edx, [esp + 0x70]
lea ecx, [esp + 8]
call fcn.1001b030
movups xmm0, xmmword [esp + 0x70]
mov ecx, dword [esp + 0x9c]
movups xmmword [esi], xmm0
movups xmm0, xmmword [esp + 0x80]
movups xmmword [esi + 0x10], xmm0
pop esi
xor ecx, esp
call fcn.100ae9aa
mov esp, ebp
pop ebp
ret
Function at 0x1001b6c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10109cd9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1013d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0
mov edi, 0x20
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x14], 0xf
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x1001b71f
mov eax, dword [ebx]
jmp 0x1001b721
mov eax, ebx
mov byte [eax], 0
mov dword [ebp - 4], 0
xor esi, esi
mov dword [ebp - 0x20], 1
mov al, byte [edx]
dec edi
mov byte [ebp + esi - 0x14], al
inc edx
mov ch, byte [ebp - 0x12]
inc esi
mov ah, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], ah
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x1001b7ca
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ah
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, ah
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
xor esi, esi
nop word [eax + eax]
cmp dword [0x10140fb4], 0x10
mov eax, 0x10140fa0
movzx ecx, byte [ebp + esi - 0x18]
cmovae eax, dword [0x10140fa0]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
push 1
call fcn.10010980
inc esi
cmp esi, 4
jl 0x1001b790
mov edx, dword [ebp - 0x1c]
xor esi, esi
mov ah, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
test edi, edi
jne 0x1001b734
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x1001b8a0
mov edi, 3
cmp esi, edi
jge 0x1001b810
mov ecx, edi
mov eax, 0x30303030
sub ecx, esi
lea edi, [ebp - 0x14]
mov edx, ecx
add edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ch, byte [ebp - 0x12]
mov edi, 3
mov ah, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ah
shr al, 4
and ah, 0xf
shl cl, 4
add cl, al
shl ah, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add ah, al
mov byte [ebp - 0x15], ch
mov byte [ebp - 0x16], ah
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x1001b883
xor edi, edi
mov esi, eax
nop dword [eax]
cmp dword [0x10140fb4], 0x10
mov eax, 0x10140fa0
movzx ecx, byte [ebp + edi - 0x18]
cmovae eax, dword [0x10140fa0]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
push 1
call fcn.10010980
inc edi
cmp edi, esi
jl 0x1001b850
mov esi, dword [ebp - 0x1c]
mov edi, 3
cmp esi, 3
jge 0x1001b8a0
sub edi, esi
nop word [eax + eax]
push 0x3d
push 1
mov ecx, ebx
call fcn.10010980
sub edi, 1
jne 0x1001b890
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e180
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a0d0
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x1013d070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push str.ntdll.dll
mov dword [ebp - 0x13c], esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x134]
push ecx
lea ecx, [ebp - 0x138]
push ecx
call eax
mov eax, dword [ebp - 0x138]
cmp eax, 6
jne 0x1001e212
cmp dword [ebp - 0x134], 3
jne 0x1001e230
push 0x15
push str.Microsoft_Windows_8.1
mov ecx, esi
call fcn.1000e850
jmp 0x1001e281
cmp eax, 0xa
jne 0x1001e230
cmp dword [ebp - 0x134], 0
jne 0x1001e230
push 0x14
push str.Microsoft_Windows_10
mov ecx, esi
call fcn.1000e850
jmp 0x1001e281
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1001e281
mov eax, dword [ebp - 0x12c]
sub eax, 4
je 0x1001e36b
sub eax, 1
je 0x1001e2f4
sub eax, 1
je 0x1001e29d
push 0x10131e54
mov ecx, esi
call fcn.10018830
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100ae9aa
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x128]
sub eax, 0
je 0x1001e2de
sub eax, 1
je 0x1001e2c8
sub eax, 1
jne 0x1001e281
cmp byte [ebp - 0x16], 1
mov ecx, esi
jne 0x1001e2c1
push str.Microsoft_Windows_8
jmp 0x1001e27c
push str.Microsoft_Windows_Server_2012
jmp 0x1001e27c
cmp byte [ebp - 0x16], 1
mov ecx, esi
jne 0x1001e2d7
push str.Microsoft_Windows_7
jmp 0x1001e27c
push str.Microsoft_Windows_Server_2008_R2
jmp 0x1001e27c
cmp byte [ebp - 0x16], 1
mov ecx, esi
jne 0x1001e2ed
push str.Microsoft_Windows_Vista
jmp 0x1001e27c
push str.Microsoft_Windows_Server_2008
jmp 0x1001e27c
mov eax, dword [ebp - 0x128]
sub eax, 0
je 0x1001e361
sub eax, 1
je 0x1001e357
sub eax, 1
jne 0x1001e281
cmp byte [ebp - 0x16], 1
jne 0x1001e327
cmp word [ebp - 0x164], 9
jne 0x1001e327
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x1001e27a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1001e33d
push str.Microsoft_Windows_Server_2003
jmp 0x1001e27a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1001e281
push str.Microsoft_Windows_Server_2003_R2
jmp 0x1001e27a
push str.Microsoft_Windows_XP
jmp 0x1001e27a
push str.Microsoft_Windows_2000
jmp 0x1001e27a
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x1001e397
cmp eax, 0xa
je 0x1001e38d
cmp eax, 0x5a
jne 0x1001e281
push str.Microsoft_Windows_Me
jmp 0x1001e27a
push str.Microsoft_Windows_98
jmp 0x1001e27a
mov eax, dword [ebp - 0x120]
cmp eax, 2
jne 0x1001e3ac
push str.Microsoft_Windows_NT_4.0
jmp 0x1001e27a
cmp eax, 1
jne 0x1001e281
push str.Microsoft_Windows_95
jmp 0x1001e27a
Function at 0x10022590
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a5a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1013d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 0x80]
mov dword [esi + 0xc0], eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
push 0x1000
mov dword [ebp - 4], 0
call fcn.100af191
push 0x1000
mov dword [esi + 0x144], eax
call fcn.100af191
push 0x1000
mov dword [esi + 0x148], eax
call fcn.100af191
push 0x1000
mov dword [esi + 0x14c], eax
call fcn.100af191
mov dword [esi + 0x150], eax
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10022660
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a5fd
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x1013d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x260], esi
mov dword [esi + 0x10], 0
jb 0x100226ca
mov eax, dword [esi]
jmp 0x100226cc
mov eax, esi
mov byte [eax], 0
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 0
push eax
push 2
mov dword [ebp - 0x258], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10022778
push 0x9b
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x10022772
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10022772
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0xc4]
call fcn.1000e780
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
cmp esi, eax
je 0x10022754
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.1000e950
mov ecx, dword [ebp - 0xb0]
cmp ecx, 0x10
jb 0x10022772
inc ecx
push ecx
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
call fcn.1000ea80
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ae9aa
mov esp, ebp
pop ebp
ret