joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010aa0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x18
movzx eax, word [eax]
mov dword [ebp - 0x10], edx
test ax, ax
je 0x10010bb4
xor edx, edx
jmp 0x10010b4c
cmp si, 0x80
ja 0x10010ba7
movzx esi, byte [esi + 0x1004f760]
mov ecx, esi
cmp cl, 0xff
je 0x10010ba7
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10010aff
mov ecx, esi
shl eax, 4
sar cl, 2
mov edi, ecx
mov ecx, dword [ebp - 0x10]
or eax, edi
mov byte [ecx + edx + 1], al
movzx eax, word [ebx + 6]
lea edi, [edx + 2]
cmp ax, 0x3d
je 0x10010bb6
cmp ax, 0x80
ja 0x10010c50
movzx eax, byte [eax + 0x1004f760]
cmp al, 0xff
je 0x10010c50
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x10010b39
shl esi, 6
or eax, esi
mov byte [edi + edx + 2], al
movzx eax, word [ebx + 8]
add ebx, 8
add edx, 3
test ax, ax
je 0x10010c68
cmp ax, 0x7f
ja 0x10010bc0
movzx esi, byte [eax + 0x1004f760]
mov eax, esi
cmp al, 0xff
je 0x10010bc0
movzx eax, word [ebx + 2]
cmp ax, 0x7f
ja 0x10010bc0
movzx eax, byte [eax + 0x1004f760]
cmp al, 0xff
je 0x10010bc0
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x10010b8f
mov ecx, eax
shl esi, 2
sar cl, 4
mov edi, ecx
or esi, edi
mov edi, dword [ebp - 0x10]
mov ecx, esi
mov byte [edi + edx], cl
movzx esi, word [ebx + 4]
lea edi, [edx + 1]
cmp si, 0x3d
jne 0x10010ac8
cmp word [ebx + 6], 0x3d
je 0x10010bb6
test byte [0x10047194], 4
jne 0x10010c30
xor edi, edi
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x10047194], 4
je 0x10010bb4
mov eax, ebx
shr eax, 0x10
je 0x10010c3a
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x1004a0a2
test edx, edx
jne 0x10010bfb
mov edx, 0xffffffff
mov eax, ebx
call sym._wine_dbgstr_wn.part.0_1
mov dword [esp + 0x10], eax
xor edi, edi
mov dword [esp + 0xc], str.invalid_base64:__s_n
mov dword [esp + 8], str.HTTP_DecodeBase64
mov dword [esp + 4], 0x10047194
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_4
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
add ebx, 4
mov eax, ebx
shr eax, 0x10
jne 0x10010bd0
movzx ebx, bx
mov dword [esp], 0x1004a095
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0_3
jmp 0x10010bfb
test byte [0x10047194], 4
je 0x10010bb4
add ebx, 6
jmp 0x10010bc9
mov edi, edx
jmp 0x10010bb6
Function at 0x1001f190
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [0x10047300]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x1001f200
test byte [0x100471a4], 8
jne 0x1001f1c8
lea esp, [ebp - 8]
lea eax, [ebx + 4]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0xc], 0x1004c297
mov dword [esp + 8], str.INTERNET_GetResponseBuffer
mov dword [esp + 4], 0x100471a4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
lea esp, [ebp - 8]
lea eax, [ebx + 4]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], 0x1004
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x1001f21d
mov dword [eax], 0
mov byte [eax + 4], 0
mov eax, dword [0x10047300]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x1001f240
mov ebx, esi
jmp 0x1001f1af
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x1001f1af
Function at 0x10020c10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
test byte [0x100471a4], 8
jne 0x10020c80
mov dword [esp], ebx
call dword [ebx]
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._WININET_Release
mov dword [esp], ebx
mov ebx, dword [sym.imp.ucrtbase.dll_free]
call ebx
mov eax, dword [0x10047300]
cmp eax, 0xffffffff
je 0x10020c72
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call ebx
mov eax, dword [0x10047300]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret 4
mov dword [esp + 0xc], 0x1004c297
mov dword [esp + 8], str.INTERNET_WorkerThreadFunc
mov dword [esp + 4], 0x100471a4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x10020c23
Function at 0x10025aa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x10047300]
mov ebx, dword [ebp + 0x10]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test byte [0x100471a4], 8
jne 0x10025b50
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10025b30
test ebx, ebx
je 0x10025b30
test esi, esi
je 0x10025bb0
lea ecx, [esi + 4]
mov edi, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp], ecx
mov dword [ebp - 0x10], ecx
call edi
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x10025b90
cmp dword [ebx], eax
mov ecx, dword [ebp - 0x10]
jb 0x10025b90
mov eax, dword [esi]
mov edx, dword [ebp + 8]
mov esi, 1
mov dword [edx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x10025bd0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
xor esi, esi
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], 0x1004c3b6
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.InternetGetLastResponseInfoA
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x100471a4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x10025acc
mov dword [ebx], eax
xor esi, esi
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x7a
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov esi, 1
mov dword [eax], 0
mov eax, esi
mov dword [ebx], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebx]
mov edx, dword [ebp + 0xc]
mov byte [edx + eax - 1], 0
mov dword [esp], edx
call edi
mov dword [ebx], eax
jmp 0x10025b1c
Function at 0x10025c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x10047300]
mov esi, dword [ebp + 0x10]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test byte [0x100471a4], 8
jne 0x10025d20
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10025d00
test esi, esi
je 0x10025d00
test ebx, ebx
je 0x10025ce0
lea ecx, [ebx + 4]
mov dword [esp + 0x14], 0
mov edi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ecx
mov dword [ebp - 0x10], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov edx, dword [ebp + 0xc]
sub esp, 0x18
dec eax
test edx, edx
je 0x10025d60
cmp dword [esi], eax
mov ecx, dword [ebp - 0x10]
jb 0x10025d60
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov ebx, 1
mov dword [edx], eax
mov eax, dword [esi]
test eax, eax
je 0x10025cf4
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov dword [esi], eax
sub esp, 0x18
jmp 0x10025cf4
mov eax, dword [ebp + 8]
mov ebx, 1
mov dword [eax], 0
mov dword [esi], 0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
xor ebx, ebx
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], 0x1004c3b6
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.InternetGetLastResponseInfoW
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x100471a4
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x10025c2c
mov dword [esi], eax
xor ebx, ebx
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x7a
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x1002ac60
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x10]
sub esp, 0x14
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
test eax, eax
je 0x1002ac97
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x8004667e
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_ioctlsocket]
sub esp, 0xc
mov dword [esi + 8], 0
mov edi, dword [esi]
mov esi, dword [sym.imp.ws2_32.dll_recv]
jmp 0x1002acbd
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x1002acf0
mov dword [esp + 0xc], 2
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 0x10
cmp eax, 0xffffffff
je 0x1002acb0
cmp eax, 1
sete al
lea esp, [ebp - 0xc]
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
sete al
lea esp, [ebp - 0xc]
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret
Function at 0x1002b550
Capabilities:
Inspect section memory permissions
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edx, dword [esi + 4]
test edx, edx
jne 0x1002b5a0
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x1002b57f
mov dword [esp], eax
call sym._server_release
mov dword [esp], ebx
call sym._server_addref
mov dword [esi + 0x28], ebx
xor edx, edx
mov eax, esi
call sym._netcon_secure_connect_setup
mov ebx, eax
test eax, eax
je 0x1002b595
cmp eax, 0x2f7d
je 0x1002b5d8
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov ebx, 0x2efd
test byte [0x100471b4], 2
je 0x1002b595
mov dword [esp + 0xc], str.already_connected_n
mov dword [esp + 8], str.NETCON_secure_connect
mov dword [esp + 4], 0x100471b4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_6
jmp 0x1002b595
mov eax, dword [0x10047310]
test eax, eax
je 0x1002b595
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_closesocket]
mov eax, dword [esi + 0x28]
mov ecx, 0x1f4
mov edx, esi
sub esp, 4
call sym._create_netconn_socket
mov ebx, eax
test eax, eax
jne 0x1002b595
lea esp, [ebp - 8]
mov eax, esi
mov edx, 1
pop ebx
pop esi
pop ebp
jmp sym._netcon_secure_connect_setup
Function at 0x1002b890
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov eax, 0x1005
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 1
lea edx, [ebp + 0x10]
mov dword [esp + 0x10], 4
adc eax, 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0xffff
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_setsockopt]
mov edx, eax
sub esp, 0x14
xor eax, eax
cmp edx, 0xffffffff
je 0x1002b8e0
leave
ret
test byte [0x100471b4], 4
jne 0x1002b8f8
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
leave
ret
mov dword [esp + 0xc], str.setsockopt_failed_n
mov dword [esp + 8], str.NETCON_set_timeout
mov dword [esp + 4], 0x100471b4
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_6
jmp 0x1002b8e9

Function at 0x1002bb60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x1002bba8
test byte [0x100471c4], 2
jne 0x1002bbf8
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov dword [esp + 4], 8
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadReadPtr]
sub esp, 8
test eax, eax
jne 0x1002bbdb
lea eax, [edi + 4]
mov dword [esp + 4], 0x824
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
sub esp, 8
test eax, eax
je 0x1002bc28
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov dword [esp + 0xc], str.dwReserved___0_n
mov dword [esp + 8], str.ReadUrlCacheEntryStream
mov dword [esp + 4], 0x100471c4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_7
jmp 0x1002bb88
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x1002bb95
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], 0
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov eax, dword [edi]
mov dword [ebp + 8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.kernel32.dll_ReadFile]
Function at 0x10032550
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
test eax, eax
je 0x100325e0
mov dword [esp], eax
mov ebx, eax
call dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp + 4], 0
lea edi, [eax + eax*2 + 1]
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x100325d6
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x100325f0
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
test eax, eax
je 0x10032658
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp + 4], 0
lea esi, [eax + eax + 2]
mov dword [esp + 8], esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x1003264a
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._memcpy
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
xor eax, eax
ret

Function at 0x10032670
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x80000000
push esi
push ebx
sub esp, 4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
test eax, eax
je 0x100326ee
mov dword [ebp - 0x10], 3
jmp 0x100326a0
inc dword [ebp - 0x10]
sar dword [ebp + 0x10], 1
je 0x100326eb
test byte [ebp + 0x10], 1
je 0x10032698
mov eax, dword [ebp - 0x10]
mov edx, 0x80000000
and eax, 0x1f
mov esi, dword [eax*4 + 0x10053260]
mov eax, edi
xor edi, edi
jmp 0x100326d6
mov ebx, eax
shr eax, 1
mov ecx, eax
and ebx, 1
shr edx, 1
xor ecx, 0xedb88320
test ebx, ebx
cmovne eax, ecx
test esi, edx
je 0x100326c0
lea ecx, [edx - 1]
xor edi, eax
test ecx, esi
jne 0x100326c0
inc dword [ebp - 0x10]
sar dword [ebp + 0x10], 1
jne 0x100326a0
mov ecx, dword [ebp + 8]
xor esi, esi
mov eax, 0x80000000
jmp 0x10032716
mov ebx, ecx
shr ecx, 1
mov edx, ecx
and ebx, 1
shr eax, 1
xor edx, 0xedb88320
test ebx, ebx
cmovne ecx, edx
test edi, eax
je 0x10032700
lea edx, [eax - 1]
xor esi, ecx
test edx, edi
jne 0x10032700
mov eax, dword [ebp + 0xc]
add esp, 4
pop ebx
xor eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x10032730
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x80000000
push esi
push ebx
sub esp, 4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
test eax, eax
je 0x100327ae
mov dword [ebp - 0x10], 3
jmp 0x10032760
inc dword [ebp - 0x10]
sar dword [ebp + 0x10], 1
je 0x100327ab
test byte [ebp + 0x10], 1
je 0x10032758
mov eax, dword [ebp - 0x10]
mov edx, 0x80000000
and eax, 0x1f
mov esi, dword [eax*4 + 0x10053260]
mov eax, edi
xor edi, edi
jmp 0x10032796
mov ebx, eax
shr eax, 1
mov ecx, eax
and ebx, 1
shr edx, 1
xor ecx, 0xedb88320
test ebx, ebx
cmovne eax, ecx
test esi, edx
je 0x10032780
lea ecx, [edx - 1]
xor edi, eax
test ecx, esi
jne 0x10032780
inc dword [ebp - 0x10]
sar dword [ebp + 0x10], 1
jne 0x10032760
mov ecx, dword [ebp + 8]
xor esi, esi
mov eax, 0x80000000
jmp 0x100327d6
mov ebx, ecx
shr ecx, 1
mov edx, ecx
and ebx, 1
shr eax, 1
xor edx, 0xedb88320
test ebx, ebx
cmovne ecx, edx
test edi, eax
je 0x100327c0
lea edx, [eax - 1]
xor esi, ecx
test edx, edi
jne 0x100327c0
mov eax, dword [ebp + 0xc]
add esp, 4
pop ebx
xor eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x100327f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x80000000
push esi
push ebx
sub esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x1003286b
mov dword [ebp - 0x10], 3
jmp 0x10032818
inc dword [ebp - 0x10]
sar dword [ebp + 8], 1
je 0x1003286b
test byte [ebp + 8], 1
je 0x10032810
mov eax, dword [ebp - 0x10]
mov edx, 0x80000000
and eax, 0x1f
mov esi, dword [eax*4 + 0x10053260]
mov eax, edi
xor edi, edi
jmp 0x10032856
mov ebx, eax
shr eax, 1
mov ecx, eax
and ebx, 1
shr edx, 1
xor ecx, 0xedb88320
test ebx, ebx
cmovne eax, ecx
test esi, edx
je 0x10032840
lea ecx, [edx - 1]
xor edi, eax
test ecx, esi
jne 0x10032840
inc dword [ebp - 0x10]
sar dword [ebp + 8], 1
jne 0x10032818
add esp, 4
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10032880
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x80000000
push esi
push ebx
sub esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x100328fb
mov dword [ebp - 0x10], 3
jmp 0x100328a8
inc dword [ebp - 0x10]
sar dword [ebp + 8], 1
je 0x100328fb
test byte [ebp + 8], 1
je 0x100328a0
mov eax, dword [ebp - 0x10]
mov edx, 0x80000000
and eax, 0x1f
mov esi, dword [eax*4 + 0x10053260]
mov eax, edi
xor edi, edi
jmp 0x100328e6
mov ebx, eax
shr eax, 1
mov ecx, eax
and ebx, 1
shr edx, 1
xor ecx, 0xedb88320
test ebx, ebx
cmovne eax, ecx
test esi, edx
je 0x100328d0
lea ecx, [edx - 1]
xor edi, eax
test ecx, esi
jne 0x100328d0
inc dword [ebp - 0x10]
sar dword [ebp + 8], 1
jne 0x100328a8
add esp, 4
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10033560
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x20
cmp word [eax], 0
mov dword [ebp - 0x10], ecx
je 0x10033720
mov esi, eax
lea esi, [esi]
add esi, 2
cmp word [esi], 0
jne 0x10033580
sub esi, edi
mov ecx, esi
sar ecx, 1
mov eax, dword [ebp - 0x10]
mov edx, 0xaaaaaaab
lea eax, [eax*4 + 8]
mul edx
shr edx, 1
lea eax, [ecx + edx + 2]
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x100336d4
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov edi, eax
mov dword [esp], eax
call sym._memcpy
mov edx, 0x20
mov ecx, dword [ebp - 0x10]
mov word [edi + esi], dx
lea esi, [edi + esi + 2]
mov dword [ebp - 0x1c], esi
test ecx, ecx
je 0x10033729
movsx eax, byte [ebx]
mov edx, eax
shl eax, 4
sar edx, 2
and eax, 0x30
and edx, 0x3f
movsx dx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi], dx
cmp ecx, 1
je 0x1003372e
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
add ecx, 8
jmp 0x1003367e
movzx edi, byte [ebx + 2]
add ebx, 3
mov eax, edi
and edi, 0x3f
shr eax, 6
and eax, 3
or edx, eax
sub dword [ebp - 0x10], 3
movsx ax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx - 4], ax
movsx ax, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx - 2], ax
je 0x100336cf
movsx eax, byte [ebx]
mov edx, dword [ebp - 0x18]
add ecx, 8
mov esi, eax
shl eax, 4
add edx, 5
sar esi, 2
and eax, 0x30
and esi, 0x3f
movsx si, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx - 8], si
cmp dword [ebp - 0x10], 1
je 0x100336e0
movsx edx, byte [ebx + 1]
mov esi, ecx
mov edi, edx
shl edx, 2
sar edi, 4
and edx, 0x3c
and edi, 0xf
or eax, edi
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx - 6], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
add eax, 4
cmp dword [ebp - 0x10], 2
mov dword [ebp - 0x14], eax
lea eax, [ecx - 2]
jne 0x10033620
mov ebx, eax
movsx ax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx - 4], ax
mov ecx, 0x3d
mov word [ebx], cx
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [ebp - 0x18]
add edx, edx
lea ecx, [ebx + ebx + 0xc]
lea ebx, [ecx + 2]
lea esi, [ecx + 4]
mov edi, dword [ebp - 0x1c]
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [edi + edx], ax
mov eax, 0x3d
add esi, edi
mov word [edi + ecx], ax
mov eax, 0x3d
mov word [edi + ebx], ax
xor eax, eax
mov word [esi], ax
jmp 0x100336d4
xor esi, esi
xor ecx, ecx
jmp 0x1003358f
mov esi, dword [ebp - 0x1c]
jmp 0x100336cf
mov esi, 8
mov ebx, 6
mov ecx, 4
mov edx, 2
jmp 0x100336ef
Function at 0x10033fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10034008
cmp byte [esi + ebx - 1], 0xa
je 0x10033fdc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10047404], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x10034480
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x10]
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov esi, dword [sym.imp.kernel32.dll_GetComputerNameExA]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
sub esp, 0xc
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xea
jne 0x10034501
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x10034501
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [ebp - 0x14], eax
mov dword [esp], ebx
call esi
mov edx, dword [ebp - 0x14]
sub esp, 0xc
test eax, eax
je 0x100344f8
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret