joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c3340
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x101f1dd0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esi + 0x134]
push ebp
push edi
mov edi, dword [esi]
push 1
push 0
push edi
or ebp, 0xffffffff
mov dword [esp + 0x18], 0x10
call fcn.100b0e30
add esp, 0xc
test eax, eax
jl 0x100c33a9
mov ecx, 0x3e8
cmp eax, ecx
jge 0x100c3380
mov ecx, eax
push ecx
push 0xffffffffffffffff
push ebx
call fcn.100cb290
add esp, 0xc
cmp eax, 0xffffffff
je 0x100c3444
test eax, eax
jne 0x100c33ce
push 1
push eax
push edi
call fcn.100b0e30
add esp, 0xc
test eax, eax
jge 0x100c3375
push str.Timeout_while_waiting_for_server_connect
push edi
call fcn.100b09f0
add esp, 8
pop edi
pop ebp
mov eax, 0x1c
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10075e13
add esp, 0x18
ret
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x100c33fe
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebp, eax
push ebx
push esi
call fcn.100b1660
add esp, 8
cmp ebp, 0xffffffff
jne 0x100c3414
push str.Error_accept__ing_server_connect
jmp 0x100c3449
push str.Connection_accepted_from_server_n
push edi
call fcn.100b0960
push 1
push ebp
mov dword [esi + 0x134], ebp
call fcn.100ce350
add esp, 0x10
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10075e13
add esp, 0x18
ret
push str.Error_while_waiting_for_server_connect
push edi
call fcn.100b09f0
mov ecx, dword [esp + 0x28]
add esp, 8
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x1e
call fcn.10075e13
add esp, 0x18
ret
Function at 0x100c43f0
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x100c4426
push str.Couldnt_set_desired_mode
push ebx
call fcn.100b09f0
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x100c443d
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.100b0960
add esp, 0xc
cmp ebp, 0x13
jne 0x100c444f
mov eax, edi
call fcn.100c3fb0
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x100c4463
push edi
call fcn.100c4000
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x100c4475
mov eax, edi
call fcn.100c4120
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x100c4483
mov eax, edi
call fcn.100c4130
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x100cb290
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
cmp ebx, 0xffffffff
jne 0x100cb2d4
cmp ebp, ebx
jne 0x100cb2d4
mov eax, dword [esp + 0x334]
push eax
call fcn.100cb260
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x100cb2ef
mov esi, edi
call fcn.100b7610
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
cmp ebx, 0xffffffff
je 0x100cb323
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
mov dword [esp + 0x228], eax
cmp ebp, 0xffffffff
je 0x100cb367
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
test ecx, ecx
jbe 0x100cb350
cmp dword [esp + eax*4 + 0x24], ebp
je 0x100cb350
inc eax
cmp eax, ecx
jb 0x100cb345
cmp eax, ecx
jne 0x100cb361
cmp ecx, 0x40
jae 0x100cb361
mov dword [esp + eax*4 + 0x24], ebp
inc dword [esp + 0x20]
cmp ebp, edx
jbe 0x100cb367
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea ecx, [esp + 0x18]
lea ebp, [edx + 1]
dec ebx
and ebx, ecx
xor eax, eax
cmp edi, eax
jle 0x100cb3a9
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov edx, esi
sub edx, eax
imul edx, edx, 0x3e8
mov dword [esp + 0x1c], edx
jmp 0x100cb3b3
jne 0x100cb3b3
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x130]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x100cb41d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x100cb3e6
cmp eax, 0x2714
jne 0x100cb421
test edi, edi
jle 0x100cb378
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.100b7610
push edx
push eax
call fcn.100b7640
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x100cb378
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x100cb42f
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x100cb43e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x100cb475
lea edx, [esp + 0x124]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100cb463
mov esi, 1
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100cb475
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x100cb4a8
lea ecx, [esp + 0x228]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100cb496
or esi, 2
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100cb4a8
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x100cc330
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x101f1dd0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.100958dd
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x100cc395
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x100cc395
lea edx, [esp]
push edx
call dword [0x101f3734]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10075e13
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.10075e13
add esp, 0x108
ret
jmp 0x100cc330

Function at 0x100cc3b0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x101f1dd0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.100958dd
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x100cc395
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x100cc395
lea edx, [esp]
push edx
call dword [0x101f3734]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10075e13
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.10075e13
add esp, 0x108
ret
jmp 0x100cc330

Function at 0x100ce770
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a4]
test esi, esi
jne 0x100ce789
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.100b7610
push edx
push eax
call fcn.100b7640
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x100ce7d6
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x120]
push eax
push ecx
call fcn.100b7610
push edx
push eax
call fcn.100b7640
mov ecx, dword [edi + 0x19c]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x100ce7d8
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x100cf860
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x101f3728]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100cf885
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x100cf8cc
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x100cf8d0
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x100cf92e
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x100cf8f3
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x100cf971
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x101a3266
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x101a3267
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x100cf940
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x100cfa40
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x100cfa72
push 0x2e
push esi
call fcn.1007cb30
add esp, 8
test eax, eax
je 0x100cfa70
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x100e68f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
inc edx
cmp eax, 0x302
mov dword [esp + 0x18], edx
jge 0x100e691d
cmp eax, 0x100
je 0x100e691d
mov esi, dword [esp + 0x10]
cmp edx, dword [esi + 4]
jbe 0x100e6939
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 4]
add edx, ecx
cmp edx, eax
ja 0x100e6918
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub eax, ecx
mov dword [esi + 4], eax
test dword [edi + 0x100], 0x200
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push ebx
movzx ebx, byte [eax + ecx - 1]
push ebp
je 0x100e699a
cmp dword [edi + 0x88], 0
jne 0x100e699a
mov edx, dword [edi + 0x58]
mov ecx, 8
mov eax, 0x101a8d44
add edx, ecx
sub edx, eax
lea esp, [esp]
mov ebp, dword [edx + eax]
cmp ebp, dword [eax]
jne 0x100e698d
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x100e6970
test bl, 1
jne 0x100e698d
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov edx, dword [edi + 0x58]
test byte [edx], 8
je 0x100e699a
test ebx, ebx
jbe 0x100e699a
dec ebx
mov eax, dword [edi + 0x80]
mov ecx, dword [eax]
push ecx
call fcn.101021f0
add esp, 4
test eax, 0x200000
je 0x100e69c4
or edx, 0xffffffff
pop ebp
sub edx, ebx
add dword [esi + 4], edx
pop ebx
pop edi
mov eax, 1
pop esi
ret
mov edx, dword [esi + 4]
mov eax, edx
sub eax, ebx
sub eax, dword [esp + 0x20]
mov ecx, 0xff
not eax
lea edi, [edx - 1]
sar eax, 0x1f
cmp edi, ecx
jae 0x100e69e2
mov ecx, edi
test ecx, ecx
jbe 0x100e6a1d
mov edi, dword [esi + 0xc]
mov dword [esp + 0x20], ebx
lea edi, [edi + edx - 1]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x20]
movzx ebp, byte [edi]
not ecx
sar ecx, 0x1f
movzx ecx, cl
xor ebp, ebx
and ecx, ebp
not ecx
and eax, ecx
mov ecx, 1
sub dword [esp + 0x20], ecx
sub edi, ecx
sub dword [esp + 0x14], ecx
jne 0x100e69f5
mov ecx, eax
shr ecx, 4
and eax, ecx
mov ecx, eax
shr ecx, 2
and eax, ecx
lea ecx, [eax + eax]
and ecx, eax
shl ecx, 0x1e
sar ecx, 0x1f
lea eax, [ebx + 1]
and eax, ecx
sub edx, eax
shl eax, 8
or dword [esi], eax
pop ebp
mov eax, ecx
pop ebx
and eax, 1
not ecx
pop edi
mov dword [esi + 4], edx
or eax, ecx
pop esi
ret
Function at 0x100e6a60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.10076ab0
mov eax, dword [0x101f1dd0]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x9c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb0]
push edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x10], edi
sub edi, esi
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], edi
cmp dword [esp + 0xb8], esi
jae 0x100e6ac4
push str.orig_len___md_size
push 0x113
push str.._ssl_s3_cbc.c
call fcn.100f7180
add esp, 0xc
cmp esi, 0x40
jbe 0x100e6ae0
push str.md_size___EVP_MAX_MD_SIZE
push 0x114
push str.._ssl_s3_cbc.c
call fcn.100f7180
add esp, 0xc
mov eax, dword [esp + 0xb8]
lea ebp, [esp + 0x24]
neg ebp
and ebp, 0x3f
lea edx, [esi + 0x100]
lea ebp, [esp + ebp + 0x24]
cmp eax, edx
jbe 0x100e6b08
mov ebx, eax
sub ebx, esi
sub ebx, 0x100
mov eax, esi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebx
add eax, edi
xor edx, edx
div esi
push esi
push 0
push ebp
mov edi, edx
mov dword [esp + 0x28], edi
call fcn.10076580
add esp, 0xc
xor ecx, ecx
cmp ebx, dword [esp + 0xb8]
jae 0x100e6ba5
mov eax, dword [esp + 0xb0]
mov eax, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xb8]
mov edi, ebx
sub edi, edx
sub edx, dword [esp + 0x14]
sub eax, ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
jmp 0x100e6b68
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov bl, byte [ebx]
mov eax, edi
not eax
sar eax, 0x1f
add edx, edi
not al
and al, bl
not edx
sar edx, 0x1f
and al, dl
or byte [ecx + ebp], al
mov edx, 1
add dword [esp + 0x18], edx
add ecx, edx
mov eax, ecx
sub eax, esi
sar eax, 0x1f
and ecx, eax
add edi, edx
sub dword [esp + 0x10], edx
jne 0x100e6b64
mov edi, dword [esp + 0x1c]
xor eax, eax
test esi, esi
jbe 0x100e6bd1
jmp 0x100e6bb0
mov ecx, edi
xor ecx, 0x20
mov dl, byte [ecx + ebp]
mov cl, byte [edi + ebp]
mov edx, dword [esp + 0x20]
mov byte [edx + eax], cl
inc edi
mov ecx, edi
sub ecx, esi
sar ecx, 0x1f
inc eax
and edi, ecx
cmp eax, esi
jb 0x100e6bb0
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10075e13
add esp, 0x98
ret
Function at 0x100e7dc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10076ab0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x58]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebp, ebp
push ebp
xor esi, esi
call fcn.100dc100
add esp, 0xc
test eax, eax
je 0x100e7e18
lea ecx, [ecx]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
shl edx, 0xa
test eax, edx
je 0x100e7e00
inc esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
inc ebp
push ebp
call fcn.100dc100
add esp, 0xc
test eax, eax
jne 0x100e7df0
mov eax, dword [esp + 0x4c]
cdq
idiv esi
mov ebx, eax
cmp esi, 1
jne 0x100e7e2e
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x50]
mov ebp, dword [esp + 0x48]
push edi
push 0
push eax
call fcn.10076580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x60], 0
call fcn.100dc100
add esp, 0x18
test eax, eax
je 0x100e7f0f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
shl eax, 0xa
test ecx, eax
je 0x100e7eeb
mov esi, dword [esp + 0x14]
test esi, esi
je 0x100e7f1c
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push edi
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x6c]
push eax
and edx, 1
push ecx
mov ecx, dword [esp + 0x58]
add edx, ebx
push edx
mov edx, dword [esp + 0x64]
push ebp
call fcn.100e79c0
add esp, 0x30
test eax, eax
je 0x100e7f3a
add ebp, ebx
test edi, edi
jle 0x100e7eeb
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
sub ecx, eax
mov esi, edi
lea ecx, [ecx]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x100e7ee0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
inc eax
push edx
push eax
mov dword [esp + 0x54], eax
call fcn.100dc100
add esp, 0xc
test eax, eax
jne 0x100e7e63
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.100ef130
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x100e9f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.10076ab0
mov eax, dword [0x101f1dd0]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x100e9f67
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.10075e13
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.10153cc7
add esp, 8
test eax, eax
jl 0x100e9f50
mov eax, 8
call fcn.10076ab0
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.100e9d90
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x100e9f50
push 0x1017d604
push esi
call fcn.1007ce7f
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x100ea041
jmp 0x100e9fc4
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x100e9fd2
cmp ebx, 0x400
mov esi, ebx
jl 0x100e9fd7
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.1007d18c
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x100ea025
fild dword [esp + 0x44]
mov eax, 8
call fcn.10076ab0
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.100e9d90
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x100e9fc0
sub ebx, esi
test ebx, ebx
jg 0x100e9fc0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.1007672d
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.101545d0
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10075e13
mov esp, ebp
pop ebp
ret
Function at 0x100f7060
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.10076ab0
mov eax, dword [0x101f1dd0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x100f70c5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x100f70c5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.10083078
add eax, 0x40
push eax
call fcn.1009367f
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10075e13
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.101540aa
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x100f7154
call fcn.100f6f20
test eax, eax
jle 0x100f7154
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10075e13
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10075e13
add esp, 0x108
ret

Function at 0x100f71b0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x100f71d4
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x100f71c6
pop esi
movzx eax, cl
pop edi
ret

Function at 0x100f75c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x100f7607
mov al, byte [edx]
test al, al
je 0x100f7607
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x100f75d7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x100f7d80
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.100ea990
add esp, 8
test esi, esi
jg 0x100f7dde
je 0x100f7dbc
cmp esi, 0xffffffff
jne 0x100f7dde
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x100f7dd3
cmp eax, 0xb
je 0x100f7dd3
cmp eax, 0x2733
jne 0x100f7dde
push 0xa
push edi
call fcn.100ea9b0
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x10108660
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.10076ab0
mov eax, dword [0x101f1dd0]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x101086af
mov eax, 1
mov dword [esi], ebp
jmp 0x101086b1
mov ebp, dword [esi]
test ecx, ecx
je 0x10108794
push ebp
call fcn.10102230
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x101086e0
push str.j____int_sizeof_ctx__key_
push 0x68
push str..cryptohmachmac.c
call fcn.100f7180
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x10108737
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.100fb2a0
add esp, 0xc
test eax, eax
je 0x10108836
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.100fb450
add esp, 0xc
test eax, eax
je 0x10108836
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.100fb460
add esp, 0xc
test eax, eax
je 0x10108836
jmp 0x10108771
cmp edi, 0x80
jbe 0x10108753
push str.len_0__len__int_sizeof_ctx__key_
push 0x75
push str..cryptohmachmac.c
call fcn.100f7180
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.10078b70
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x1010879c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.10076580
add esp, 0xc
jmp 0x1010879c
test eax, eax
je 0x10108822
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x101087a0
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.100fb2a0
add esp, 0xc
test eax, eax
je 0x10108836
push ebp
call fcn.10102230
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.100fb450
add esp, 0x10
test eax, eax
je 0x10108836
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x101087e4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.100fb2a0
add esp, 0xc
test eax, eax
je 0x10108836
push ebp
call fcn.10102230
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.100fb450
add esp, 0x10
test eax, eax
je 0x10108836
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.100fb5f0
add esp, 8
test eax, eax
jne 0x1010883a
xor eax, eax
jmp 0x1010883f
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10075e13
add esp, 0x8c
ret