joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f540
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x1002f559
mov esi, ebx
mov ebx, eax
jmp 0x1002f55b
mov esi, eax
mov edi, dword [esp + 0x10]
mov eax, dword [esi + 4]
cmp eax, dword [edi + 8]
jle 0x1002f571
push eax
push edi
call sym.LIBEAY32.dll_bn_expand2
add esp, 8
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x1002f59a
push ebp
jmp 0x1002f580
mov ecx, dword [ebx]
mov ebp, dword [ecx + eax*4]
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x1002f580
pop ebp
cmp eax, dword [esi + 4]
jge 0x1002f5b2
nop
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [esi + 4]
inc eax
cmp eax, ecx
jl 0x1002f5a0
mov esi, dword [esi + 4]
test esi, esi
mov dword [edi + 4], esi
jle 0x1002f5d8
mov eax, dword [edi]
lea eax, [eax + esi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x1002f5d8
mov edx, dword [edi + 4]
dec edx
mov ecx, edx
test ecx, ecx
mov dword [edi + 4], edx
jg 0x1002f5c2
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10034b00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.100a1060
push esi
mov esi, dword [esp + 0x24]
dec esi
push edi
mov edi, dword [esp + 0x30]
lea eax, [esi - 0x29]
cmp edi, eax
jle 0x10034b39
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
cmp esi, 0x29
jge 0x10034b5b
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
push 0x37
lea eax, [esi - 0x14]
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x14], eax
call sym.LIBEAY32.dll_CRYPTO_malloc
add esp, 0xc
test eax, eax
mov dword [esp + 0x28], eax
jne 0x10034b97
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov byte [ebp], 0
lea ebx, [ebp + 1]
push 0
add ebp, 0x15
call sym.LIBEAY32.dll_EVP_sha1
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push eax
push 0
push ebp
push ecx
push edx
call sym.LIBEAY32.dll_EVP_Digest
mov ecx, esi
sub ecx, edi
sub ecx, 0x29
mov edx, ecx
shr ecx, 2
xor eax, eax
lea edi, [ebp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x50]
mov eax, ebp
sub eax, ecx
add eax, esi
mov esi, dword [esp + 0x4c]
mov edx, ecx
shr ecx, 2
mov byte [eax - 0x15], 1
lea edi, [eax - 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0x14
push ebx
rep movsb byte es:[edi], byte [esi]
call sym.LIBEAY32.dll_RAND_bytes
add esp, 0x20
test eax, eax
jg 0x10034c17
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
call sym.LIBEAY32.dll_EVP_sha1
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x30]
push eax
push 0x14
push ebx
push esi
push edi
call sym.LIBEAY32.dll_PKCS1_MGF1
add esp, 0x14
test esi, esi
jle 0x10034c49
mov eax, ebp
sub edi, ebp
mov ecx, esi
lea esp, [esp]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x10034c40
call sym.LIBEAY32.dll_EVP_sha1
push eax
push esi
push ebp
lea eax, [esp + 0x20]
push 0x14
push eax
call sym.LIBEAY32.dll_PKCS1_MGF1
lea ecx, [esp + 0x28]
lea esi, [esp + 0x29]
lea ebp, [esp + 0x2a]
lea edi, [esp + 0x2b]
lea edx, [esp + 0x2c]
add esp, 0x14
sub ecx, ebx
sub esi, ebx
sub ebp, ebx
sub edi, ebx
mov eax, ebx
sub edx, ebx
mov dword [esp + 0x38], 4
mov bl, byte [ecx + eax]
xor byte [eax], bl
mov bl, byte [esi + eax]
xor byte [eax + 1], bl
mov bl, byte [eax + ebp]
xor byte [eax + 2], bl
mov bl, byte [edi + eax]
xor byte [eax + 3], bl
mov bl, byte [edx + eax]
xor byte [eax + 4], bl
mov ebx, dword [esp + 0x38]
add eax, 5
dec ebx
mov dword [esp + 0x38], ebx
jne 0x10034c88
mov ecx, dword [esp + 0x30]
push ecx
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret
Function at 0x10034cd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.100a1060
push ebx
push ebp
mov ebp, dword [esp + 0x48]
xor ebx, ebx
dec ebp
cmp ebp, 0x29
push esi
push edi
mov dword [esp + 0x10], ebx
jl 0x10034e7a
mov eax, dword [esp + 0x4c]
mov edi, ebp
sub edi, eax
jns 0x10034d06
mov dword [esp + 0x10], 1
xor edi, edi
mov esi, dword [esp + 0x48]
push 0x7a
sub esi, edi
lea eax, [esi + 0x14]
add ebp, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebp
mov dword [esp + 0x5c], eax
call sym.LIBEAY32.dll_CRYPTO_malloc
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x10034d4c
push 0x7d
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
call sym.LIBEAY32.dll_EVP_sha1
mov ecx, dword [esp + 0x50]
push eax
push ebp
push ecx
lea edx, [esp + 0x20]
push 0x14
push edx
call sym.LIBEAY32.dll_PKCS1_MGF1
add esp, 0x14
cmp edi, 0x14
mov eax, edi
jge 0x10034d83
mov edi, edi
mov dl, byte [esp + eax + 0x14]
mov cl, byte [esi + eax]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x14
jl 0x10034d70
call sym.LIBEAY32.dll_EVP_sha1
push eax
push 0x14
lea edx, [esp + 0x1c]
push edx
push ebp
push ebx
call sym.LIBEAY32.dll_PKCS1_MGF1
add esp, 0x14
test ebp, ebp
jle 0x10034db1
mov esi, dword [esp + 0x50]
mov eax, ebx
sub esi, ebx
mov edi, ebp
mov cl, byte [esi + eax]
xor byte [eax], cl
inc eax
dec edi
jne 0x10034da8
push 0
call sym.LIBEAY32.dll_EVP_sha1
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x60]
push 0
lea edx, [esp + 0x34]
push edx
push eax
push ecx
call sym.LIBEAY32.dll_EVP_Digest
add esp, 0x18
mov ecx, 5
lea edi, [esp + 0x28]
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x10034e7a
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10034e7a
mov eax, 0x14
cmp ebp, eax
jle 0x10034e0b
lea esp, [esp]
cmp byte [eax + ebx], 0
jne 0x10034e0b
inc eax
cmp eax, ebp
jl 0x10034e00
cmp byte [eax + ebx], 1
jne 0x10034e7a
mov ecx, eax
inc eax
cmp ecx, ebp
jge 0x10034e7a
mov ecx, dword [esp + 0x44]
sub ebp, eax
cmp ecx, ebp
jge 0x10034e50
push 0x9b
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
push ebx
or ebp, 0xffffffff
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x40]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
lea esi, [eax + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x2c
ret
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
test ebx, ebx
je 0x10034e9f
push ebx
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x10035900
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x14], edx
jne 0x100359b7
mov ecx, dword [esp + 0xc]
mov al, byte [ecx]
cmp al, 0x6a
je 0x10035920
cmp al, 0x6b
jne 0x100359b7
cmp al, 0x6b
push esi
lea esi, [ecx + 1]
jne 0x10035973
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x10035943
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x10035943
cmp cl, 0xbb
jne 0x10035950
inc edx
cmp edx, eax
jl 0x10035931
sub eax, edx
test edx, edx
jne 0x10035976
push 0x8a
jmp 0x10035955
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x1003599f
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push edi
mov edi, dword [esp + 0xc]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
ret
Function at 0x1003a0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x74]
test eax, eax
jne 0x1003a0f6
mov dword [esp + 4], ecx
jmp fcn.1003dcf0
mov dword [esp + 4], ecx
jmp eax
Function at 0x100416f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x100416fc
ret
mov dword [esp + 4], eax
jmp sym.LIBEAY32.dll_EC_GROUP_precompute_mult

Function at 0x100469e0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push ebx
call dword [sym.imp.MSVCR71.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x10046a72
push 0x7a
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call sym.LIBEAY32.dll_ERR_put_error
push 0x100b2b28
push esi
push 0x100b2b24
push ebx
push str.fopen_
push 5
call sym.LIBEAY32.dll_ERR_add_error_data
add esp, 0x2c
call dword [sym.imp.MSVCR71.dll__errno]
cmp dword [eax], 2
jne 0x10046a57
push 0x7d
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x7f
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x100e0880
call sym.LIBEAY32.dll_BIO_new
mov esi, eax
add esp, 4
test esi, esi
jne 0x10046a95
push edi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x8000
push esi
call sym.LIBEAY32.dll_BIO_clear_flags
push edi
push 1
push 0x6a
push esi
call sym.LIBEAY32.dll_BIO_ctrl
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x10046d80
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call sub.WSOCK32.dll_WSASetLastError
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call sub.WSOCK32.dll_send
push 0xf
push edi
mov esi, eax
call sym.LIBEAY32.dll_BIO_clear_flags
add esp, 8
test esi, esi
jg 0x10046ddb
je 0x10046dba
cmp esi, 0xffffffff
jne 0x10046ddb
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 4
je 0x10046dd0
cmp eax, 0xb
je 0x10046dd0
cmp eax, 0x2733
jne 0x10046ddb
push 0xa
push edi
call sym.LIBEAY32.dll_BIO_set_flags
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x10047450
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [ebx + 0x20]
cmp dword [esi], 6
je 0x10047467
call fcn.10046e10
test eax, eax
jle 0x100474ae
push 0
call sub.WSOCK32.dll_WSASetLastError
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 0x1c]
push 0
push eax
push ecx
push edx
call sub.WSOCK32.dll_send
push 0xf
push ebx
mov esi, eax
call sym.LIBEAY32.dll_BIO_clear_flags
add esp, 8
test esi, esi
jg 0x100474ac
push esi
call sym.LIBEAY32.dll_BIO_sock_should_retry
add esp, 4
test eax, eax
je 0x100474ac
push 0xa
push ebx
call sym.LIBEAY32.dll_BIO_set_flags
add esp, 8
mov eax, esi
pop esi
pop ebx
ret

Function at 0x10049960
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x100ed240]
test eax, eax
jne 0x100499cb
push edi
push 0x100ed0a0
xor eax, eax
mov ecx, 0x64
mov edi, 0x100ed0a0
push 0x101
mov dword [0x100ed240], 1
rep stosd dword es:[edi], eax
call sub.WSOCK32.dll_WSAStartup
test eax, eax
pop edi
je 0x100499cb
call sub.WSOCK32.dll_WSAGetLastError
push 0x1d0
push str..crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.LIBEAY32.dll_ERR_put_error
push 0x1d1
push str..crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x28
or eax, 0xffffffff
ret
mov eax, 1
ret

Function at 0x10049c30
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
push 1
push 6
push ecx
call sub.WSOCK32.dll_setsockopt
neg eax
sbb eax, eax
inc eax
ret
Function at 0x10049ca0
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov ebx, 1
call fcn.10049a40
mov esi, eax
test esi, esi
jge 0x10049cd8
push 0x75
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10049d8f
call sym.LIBEAY32.dll_BIO_sock_init
cmp eax, 1
jne 0x10049d9f
test esi, esi
jg 0x10049da6
push 0x83
push str..crypto_bio_b_sock.c
push 0x16
push 9
call sym.LIBEAY32.dll_CRYPTO_lock
add esp, 0x10
push ebp
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x10049d28
push 0x88
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10049d75
cmp word [eax + 8], 2
je 0x10049d49
push 0x8f
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10049d75
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov cl, byte [edx]
mov byte [edi], cl
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dl, byte [ecx + 1]
mov byte [edi + 1], dl
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov cl, byte [edx + 2]
mov byte [edi + 2], cl
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov cl, byte [eax + 3]
mov byte [edi + 3], cl
xor ebx, ebx
push 0x98
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call sym.LIBEAY32.dll_CRYPTO_lock
add esp, 0x10
test ebx, ebx
je 0x10049da6
push ebp
push 0x100b2b54
push 2
call sym.LIBEAY32.dll_ERR_add_error_data
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x1004b570
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [edi + 0x20]
push 0
call sub.WSOCK32.dll_WSASetLastError
mov eax, dword [ebx + 0x10]
mov edx, dword [edi + 0x1c]
mov ecx, dword [esp + 0x14]
test eax, eax
mov eax, dword [esp + 0x18]
je 0x1004b59f
push 0
push eax
push ecx
push edx
call sub.WSOCK32.dll_send
jmp 0x1004b5ac
push 0x10
push ebx
push 0
push eax
push ecx
push edx
call sub.WSOCK32.dll_sendto
push 0xf
push edi
mov esi, eax
call sym.LIBEAY32.dll_BIO_clear_flags
add esp, 8
test esi, esi
jg 0x1004b5dd
push esi
call sym.LIBEAY32.dll_BIO_sock_should_retry
add esp, 4
test eax, eax
je 0x1004b5dd
push 0xa
push edi
call sym.LIBEAY32.dll_BIO_set_flags
add esp, 8
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebx + 0x14], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x1004c2d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x1004c333
mov al, byte [edi]
test al, al
je 0x1004c333
push ebx
push ebp
mov ebx, 0x100
lea esp, [esp]
movsx eax, al
or eax, ebx
mov edx, eax
shr edx, 2
xor edx, eax
and edx, 0xf
mov ecx, 0x20
sub ecx, edx
mov ebp, esi
shr ebp, cl
mov ecx, edx
shl esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edi + 1]
or ebp, esi
xor ebp, ecx
add ebx, 0x100
inc edi
test al, al
mov esi, ebp
jne 0x1004c2f0
pop ebp
mov eax, esi
pop ebx
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x1004d1c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x434
call fcn.100a1060
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov dword [esp + 0x10], 0
je 0x1004d21e
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.MSVCR71.dll__stat]
add esp, 8
test eax, eax
jl 0x1004d21e
fld qword [0x100a28c8]
mov eax, 8
call fcn.100a1060
fstp qword [esp]
lea ecx, [esp + 0x24]
push 0x24
push ecx
call sym.LIBEAY32.dll_RAND_add
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
jne 0x1004d227
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100b3104
push esi
call dword [sym.imp.MSVCR71.dll_fopen]
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
je 0x1004d2c7
jmp 0x1004d248
mov eax, dword [esp + 0x14]
test ebx, ebx
jle 0x1004d256
cmp ebx, 0x400
mov esi, ebx
jl 0x1004d25b
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x48]
push 1
push edx
call dword [sym.imp.MSVCR71.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
mov dword [esp + 0x18], edi
jle 0x1004d2aa
fild dword [esp + 0x18]
mov eax, 8
call fcn.100a1060
lea eax, [esp + 0x48]
fstp qword [esp]
push esi
push eax
call sym.LIBEAY32.dll_RAND_add
mov ecx, dword [esp + 0x20]
add ecx, edi
add esp, 0x10
test ebx, ebx
mov dword [esp + 0x10], ecx
jle 0x1004d244
sub ebx, esi
test ebx, ebx
jg 0x1004d244
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.MSVCR71.dll_fclose]
lea edx, [esp + 0x44]
push 0x400
push edx
call sym.LIBEAY32.dll_OPENSSL_cleanse
add esp, 0xc
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004d2e0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x42c
call fcn.100a1060
push ebx
push esi
mov esi, dword [esp + 0x438]
push edi
lea eax, [esp + 0x14]
push eax
xor edi, edi
push esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.MSVCR71.dll__stat]
push 0x100b3108
push esi
call dword [sym.imp.MSVCR71.dll_fopen]
mov ebx, eax
add esp, 0x10
cmp ebx, edi
je 0x1004d3c8
push ebp
push 0x180
push esi
call dword [sym.imp.MSVCR71.dll__chmod]
mov ebp, dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 8
mov edi, 0x400
mov edi, edi
cmp edi, 0x400
mov esi, 0x400
jg 0x1004d34f
mov esi, edi
lea ecx, [esp + 0x3c]
push esi
push ecx
sub edi, 0x400
call sym.LIBEAY32.dll_RAND_bytes
add esp, 8
test eax, eax
jg 0x1004d36f
mov dword [esp + 0x14], 1
push ebx
push esi
lea edx, [esp + 0x44]
push 1
push edx
call ebp
add esp, 0x10
test eax, eax
jle 0x1004d391
mov ecx, dword [esp + 0x10]
add ecx, eax
test edi, edi
mov dword [esp + 0x10], ecx
jg 0x1004d340
jmp 0x1004d399
mov dword [esp + 0x10], 0
push ebx
call dword [sym.imp.MSVCR71.dll_fclose]
lea eax, [esp + 0x40]
push 0x400
push eax
call sym.LIBEAY32.dll_OPENSSL_cleanse
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
pop ebp
je 0x1004d3c8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x42c
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x42c
ret
Function at 0x1004d3e0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
xor esi, esi
call sym.LIBEAY32.dll_i2d_X509_PKEY
test eax, eax
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.MSVCR71.dll_getenv]
jne 0x1004d439
push str.RANDFILE
call ebx
mov esi, eax
add esp, 4
test esi, esi
je 0x1004d439
cmp byte [esi], 0
je 0x1004d439
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004d412
sub eax, edx
inc eax
cmp eax, edi
jae 0x1004d439
push edi
push esi
mov esi, dword [esp + 0x18]
push esi
call sym.LIBEAY32.dll_BUF_strlcpy
add esp, 0xc
cmp eax, edi
jb 0x1004d4a7
pop edi
pop esi
xor eax, eax
pop ebx
ret
call sym.LIBEAY32.dll_i2d_X509_PKEY
test eax, eax
jne 0x1004d44e
push str.HOME
call ebx
add esp, 4
mov esi, eax
test esi, esi
jne 0x1004d459
mov esi, 0x100b3114
jmp 0x1004d45e
cmp byte [esi], 0
je 0x1004d4a0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004d463
sub eax, edx
add eax, 6
cmp eax, edi
jae 0x1004d4a0
push edi
push esi
mov esi, dword [esp + 0x18]
push esi
call sym.LIBEAY32.dll_BUF_strlcpy
push edi
push 0x100aabe8
push esi
call sym.LIBEAY32.dll_BUF_strlcat
push edi
push str..rnd
push esi
call sym.LIBEAY32.dll_BUF_strlcat
add esp, 0x24
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov esi, dword [esp + 0x10]
mov byte [esi], 0
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x1004e2a0
Capabilities:
Capture screenshot

Disassembly:
call sym.LIBEAY32.dll_RAND_poll
jmp fcn.1004d8d0

Function at 0x10051750
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x1005182c
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x100517c6
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x10051819
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x100517d8
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x10051806
mov edx, 0x3d
jmp 0x10051813
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x10051770
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret