joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006a646
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1006a6cc
cmp dword [ebp + 8], 0
je 0x1006a6cc
test edi, edi
jne 0x1006a673
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
lea eax, [ebx + ebx]
mov esi, 0x1f80000
cmp eax, 0x3f00000
lea eax, [ecx + edi*2]
cmovb esi, ebx
push esi
push 2
push eax
call fcn.101b9a49
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1006a6a9
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1006a677
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1006a6c8
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1004badf
add esp, 0xc
mov eax, esi
jmp 0x1006a66c
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x102962f8
mov ecx, 0x1025dfb8
cmovbe eax, ecx
push eax
call fcn.1004b95a
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.1004b6c3
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x1029ead4
push eax
call fcn.101abedd
int3

Function at 0x1006a729
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1006a7b1
cmp dword [ebp + 8], 0
je 0x1006a7b1
test edi, edi
jne 0x1006a756
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.101b9a49
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1006a78e
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1006a75a
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1006a7ad
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1004badf
add esp, 0xc
mov eax, esi
jmp 0x1006a74f
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x102962f8
mov ecx, 0x1025dfb8
cmovbe eax, ecx
push eax
call fcn.1004b966
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.1004b6c3
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x1029ead4
push eax
call fcn.101abedd
int3
Function at 0x1006a806
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1006a88e
cmp dword [ebp + 8], 0
je 0x1006a88e
test edi, edi
jne 0x1006a833
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.101b9a49
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1006a86b
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1006a837
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1006a88a
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1004badf
add esp, 0xc
mov eax, esi
jmp 0x1006a82c
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x102962f8
mov ecx, 0x1025dfb8
cmovbe eax, ecx
push eax
call fcn.1006af3d
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.1004b6c3
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x1029ead4
push eax
call fcn.101abedd
int3

Function at 0x1006a8cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1006a954
cmp dword [ebp + 8], 0
je 0x1006a954
test edi, edi
jne 0x1006a8f9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.101b9a49
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1006a931
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1006a8fd
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1006a950
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1004badf
add esp, 0xc
mov eax, esi
jmp 0x1006a8f2
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x102962f8
mov ecx, 0x1025dfb8
cmovbe eax, ecx
push eax
call fcn.1004b96c
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.1004b6c3
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x1029ead4
push eax
call fcn.101abedd
int3
Function at 0x1006a992
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1006aa18
cmp dword [ebp + 8], 0
je 0x1006aa18
test edi, edi
jne 0x1006a9bf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
lea eax, [ebx + ebx]
mov esi, 0x1f80000
cmp eax, 0x3f00000
lea eax, [ecx + edi*2]
cmovb esi, ebx
push esi
push 2
push eax
call fcn.101b9a49
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1006a9f5
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1006a9c3
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1006aa14
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1004badf
add esp, 0xc
mov eax, esi
jmp 0x1006a9b8
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x102962f8
mov ecx, 0x1025dfb8
cmovbe eax, ecx
push eax
call fcn.1004b960
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.1004b6c3
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x1029ead4
push eax
call fcn.101abedd
int3

Function at 0x1006aa56
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1006aade
cmp dword [ebp + 8], 0
je 0x1006aade
test edi, edi
jne 0x1006aa83
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0x7e0000
shl eax, 3
cmp eax, 0x3f00000
lea eax, [ecx + edi*8]
cmovb esi, ebx
push esi
push 8
push eax
call fcn.101b9a49
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1006aabb
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1006aa87
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1006aada
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1004badf
add esp, 0xc
mov eax, esi
jmp 0x1006aa7c
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x102962f8
mov ecx, 0x1025dfb8
cmovbe eax, ecx
push eax
call fcn.1004b97e
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.1004b6c3
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x1029ead4
push eax
call fcn.101abedd
int3
Function at 0x1006ab3f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1006abc7
cmp dword [ebp + 8], 0
je 0x1006abc7
test edi, edi
jne 0x1006ab6c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.101b9a49
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1006aba4
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1006ab70
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1006abc3
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1004badf
add esp, 0xc
mov eax, esi
jmp 0x1006ab65
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x102962f8
mov ecx, 0x1025dfb8
cmovbe eax, ecx
push eax
call fcn.1004b984
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.1004b6c3
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x1029ead4
push eax
call fcn.101abedd
int3

Function at 0x1006ac35
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1006acbd
cmp dword [ebp + 8], 0
je 0x1006acbd
test edi, edi
jne 0x1006ac62
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0x7e0000
shl eax, 3
cmp eax, 0x3f00000
lea eax, [ecx + edi*8]
cmovb esi, ebx
push esi
push 8
push eax
call fcn.101b9a49
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1006ac9a
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1006ac66
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1006acb9
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1004badf
add esp, 0xc
mov eax, esi
jmp 0x1006ac5b
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x102962f8
mov ecx, 0x1025dfb8
cmovbe eax, ecx
push eax
call fcn.1004b972
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.1004b6c3
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x1029ead4
push eax
call fcn.101abedd
int3
Function at 0x1006acfb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1006ad83
cmp dword [ebp + 8], 0
je 0x1006ad83
test edi, edi
jne 0x1006ad28
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0x7e0000
shl eax, 3
cmp eax, 0x3f00000
lea eax, [ecx + edi*8]
cmovb esi, ebx
push esi
push 8
push eax
call fcn.101b9a49
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1006ad60
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1006ad2c
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1006ad7f
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1004badf
add esp, 0xc
mov eax, esi
jmp 0x1006ad21
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x102962f8
mov ecx, 0x1025dfb8
cmovbe eax, ecx
push eax
call fcn.1004b978
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.1004b6c3
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x1029ead4
push eax
call fcn.101abedd
int3

Function at 0x1007c460
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x1007c453
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
sub ebp, edi
nop word [eax + eax]
inc byte [eax]
lea edi, [edi + 1]
movzx esi, byte [eax]
movzx ecx, byte [esi + eax + 2]
add byte [eax + 1], cl
movzx ecx, byte [eax + 1]
mov dl, byte [esi + eax + 2]
movzx ecx, byte [ecx + eax + 2]
mov byte [esi + eax + 2], cl
movzx ecx, byte [eax + 1]
mov byte [ecx + eax + 2], dl
movzx ecx, byte [eax + 1]
movzx edx, byte [ecx + eax + 2]
movzx ecx, byte [eax]
movzx ecx, byte [ecx + eax + 2]
add edx, ecx
movzx ecx, dl
movzx ecx, byte [ecx + eax + 2]
xor cl, byte [edi + ebp - 1]
mov byte [edi - 1], cl
sub ebx, 1
jne 0x1007c400
pop edi
pop esi
pop ebp
pop ebx
ret
add dword [esp + 4], 0xc1
jmp 0x1007c3e0
Function at 0x1008a6e0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, 0x40
call fcn.101aa130
mov eax, dword [0x102a1e64]
xor eax, esp
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x48], 0x1d
push esi
mov esi, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x58]
je 0x1008a71c
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.101a966e
add esp, 0x40
ret
test esi, esi
je 0x1008a82b
cmp dword [esp + 0x54], 0x30
jne 0x1008a82b
push 0x30
push edi
push esi
call fcn.1008a600
add esp, 0xc
test eax, eax
jle 0x1008a82b
movaps xmm0, xmmword [str.6666666666666666O]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.1008a600
add esp, 0xc
test eax, eax
je 0x1008a82b
lea eax, [esp + 0x30]
push esi
push eax
call fcn.1008a460
add esp, 8
test eax, eax
je 0x1008a82b
push 0x4c
lea eax, [esi + 0x14]
push 0
push eax
call fcn.101ab280
push 0x30
push edi
push esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
call fcn.1008a600
add esp, 0x18
test eax, eax
jle 0x1008a82b
movaps xmm0, xmmword [0x101f6680]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.1008a600
add esp, 0xc
test eax, eax
je 0x1008a82b
push 0x14
lea eax, [esp + 0x34]
push eax
push esi
call fcn.1008a600
add esp, 0xc
test eax, eax
je 0x1008a82b
lea eax, [esp + 0x30]
push 0x14
push eax
call fcn.10001320
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.101a966e
add esp, 0x40
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.101a966e
add esp, 0x40
ret

Function at 0x1008d3d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101aa130
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x1008d450
mov cl, byte [edi]
test cl, cl
je 0x1008d450
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x1008d400
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x1008d4d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101aa130
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x1008d553
mov cl, byte [edi]
test cl, cl
je 0x1008d553
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x1008d500
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x100908f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 4]
dec edx
xor eax, ecx
mov dword [esp + 0x10], edx
and eax, edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x10090a06
push edi
cmp esi, 4
jb 0x100909e1
mov ecx, dword [ebp]
lea edi, [esi - 1]
mov edx, dword [ebx]
lea ebp, [esi - 1]
lea ebp, [ecx + ebp*4]
cmp edx, ebp
lea edi, [edx + edi*4]
mov ebp, dword [esp + 0x18]
ja 0x10090984
cmp edi, ecx
jae 0x100909e1
cmp edx, ebx
ja 0x1009098c
cmp edi, ebx
jae 0x100909e1
cmp edx, ebp
ja 0x10090994
cmp edi, ebp
jae 0x100909e1
lea edi, [esi - 1]
lea edi, [ecx + edi*4]
cmp ecx, ebx
ja 0x100909a2
cmp edi, ebx
jae 0x100909e1
cmp ecx, ebp
ja 0x100909aa
cmp edi, ebp
jae 0x100909e1
mov edi, esi
and edi, 0xfffffffc
nop
movups xmm3, xmmword [edx + eax*4]
movups xmm2, xmmword [ecx + eax*4]
movaps xmm1, xmm3
xorps xmm1, xmm2
andps xmm1, xmm4
movaps xmm0, xmm1
xorps xmm1, xmm3
xorps xmm0, xmm2
movups xmmword [ecx + eax*4], xmm0
movups xmmword [edx + eax*4], xmm1
add eax, 4
cmp eax, edi
jl 0x100909b0
mov dword [esp + 0x18], eax
cmp eax, esi
jge 0x10090a05
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x14]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x20]
jl 0x100909e1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100af460
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.101aa130
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x100af678
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x100af652
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x100af4a4
mov esi, dword [esp + 0x30]
jmp 0x100af656
mov ecx, dword [esp + 0x28]
push ecx
call fcn.100aeba0
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x100af490
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x100b8cd0
Capabilities:
Initialize winsock library

Disassembly:
cmp dword [0x102a2f78], 0
jne 0x100b8d69
push 0x190
push 0
push 0x102a2f80
mov dword [0x102a2f78], 1
call fcn.101ab280
add esp, 0xc
push 0x102a2f80
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100b8d69
call fcn.10086800
push str.BIO_sock_init
push 0x94
push str.crypto_bio_bio_sock.c
call fcn.10086900
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.100869b0
call fcn.10086800
push str.BIO_sock_init
push 0x96
push str.crypto_bio_bio_sock.c
call fcn.10086900
push 0
push 0x7a
push 0x20
call fcn.100869b0
add esp, 0x24
or eax, 0xffffffff
ret
mov eax, 1
ret

Function at 0x100b8d70
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x100b8dc5
call fcn.10086800
push str.BIO_socket_ioctl
push 0xd1
push str.crypto_bio_bio_sock.c
call fcn.10086900
add esp, 0xc
push str.calling_ioctlsocket__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.100869b0
add esp, 0xc
xor eax, eax
test esi, esi
pop esi
sete al
ret

Function at 0x100b8dd0
Capabilities:
Get socket status

Disassembly:
mov eax, 0x110
call fcn.101aa130
mov eax, dword [0x102a1e64]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
mov ebp, dword [esp + 0x11c]
push edi
mov edi, dword [esp + 0x11c]
cmp edi, 0x3f
ja 0x100b8ebd
push esi
mov esi, dword [esp + 0x128]
mov eax, esi
or eax, dword [esp + 0x12c]
jne 0x100b8e31
pop esi
pop edi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.101a966e
add esp, 0x110
ret
push 0
call fcn.101bacd0
add esp, 4
cmp dword [esp + 0x12c], edx
jg 0x100b8e64
jl 0x100b8e4a
cmp esi, eax
jae 0x100b8e64
pop esi
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.101a966e
add esp, 0x110
ret
sub esi, eax
mov dword [esp + 0x18], edi
xor ecx, ecx
mov dword [esp + 0x14], 1
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
test ebp, ebp
mov dword [esp + 0x10], esi
push 0
lea eax, [esp + 0x1c]
cmovne eax, ecx
test ebp, ebp
push eax
lea eax, [esp + 0x20]
cmove eax, ecx
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.101a966e
add esp, 0x110
ret
mov ecx, dword [esp + 0x114]
or eax, 0xffffffff
pop edi
pop ebp
xor ecx, esp
call fcn.101a966e
add esp, 0x110
ret