joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a450
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.10086e00
push ebx
push ebp
mov ebp, dword [esp + 0x48]
xor ebx, ebx
dec ebp
push esi
cmp ebp, 0x29
push edi
mov dword [esp + 0x10], ebx
jl 0x1002a5ec
mov eax, dword [esp + 0x4c]
mov edi, ebp
sub edi, eax
jns 0x1002a486
mov dword [esp + 0x10], 1
xor edi, edi
mov esi, dword [esp + 0x48]
add ebp, 0xffffffec
sub esi, edi
push 0x7a
push str..crypto_rsa_rsa_oaep.c
push ebp
lea eax, [esi + 0x14]
mov dword [esp + 0x5c], eax
call sym.LIBEAY32.dll_CRYPTO_malloc
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1002a4cc
push 0x7d
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov ecx, dword [esp + 0x50]
push ebp
push ecx
lea edx, [esp + 0x1c]
push 0x14
push edx
call fcn.1002a620
add esp, 0x10
cmp edi, 0x14
mov eax, edi
jge 0x1002a4fb
mov cl, byte [esi + eax]
mov dl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x14
jl 0x1002a4e8
lea edx, [esp + 0x14]
push 0x14
push edx
push ebp
push ebx
call fcn.1002a620
add esp, 0x10
test ebp, ebp
jle 0x1002a527
mov esi, dword [esp + 0x50]
mov eax, ebx
sub esi, ebx
mov edi, ebp
mov cl, byte [esi + eax]
mov dl, byte [eax]
xor dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x1002a51a
push 0
call sym.LIBEAY32.dll_EVP_sha1
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x30]
push 0
push edx
push eax
push ecx
call sym.LIBEAY32.dll_EVP_Digest
add esp, 0x18
mov ecx, 5
lea edi, [esp + 0x28]
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x1002a5ec
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1002a5ec
mov eax, 0x14
cmp ebp, eax
jle 0x1002a57d
cmp byte [eax + ebx], 0
jne 0x1002a57d
inc eax
cmp eax, ebp
jl 0x1002a572
cmp byte [eax + ebx], 1
jne 0x1002a5ec
mov ecx, eax
inc eax
cmp ecx, ebp
jge 0x1002a5ec
mov ecx, dword [esp + 0x44]
sub ebp, eax
cmp ecx, ebp
jge 0x1002a5c2
push 0x9b
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
or ebp, 0xffffffff
push ebx
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x40]
mov ecx, ebp
mov edx, ecx
lea esi, [eax + ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
test ebx, ebx
je 0x1002a611
push ebx
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x10033e80
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push esi
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10033f12
push 0x68
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call sym.LIBEAY32.dll_ERR_put_error
push 0x10093874
push esi
push 0x10093870
push edi
push str.fopen_
push 5
call sym.LIBEAY32.dll_ERR_add_error_data
add esp, 0x2c
call dword [sym.imp.MSVCRT.dll__errno]
cmp dword [eax], 2
jne 0x10033ef7
push 0x6b
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x6d
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x100b93b4
call sym.LIBEAY32.dll_BIO_new
mov esi, eax
add esp, 4
test esi, esi
jne 0x10033f29
pop edi
pop esi
pop ebx
ret
push ebx
push 1
push 0x6a
push esi
call sym.LIBEAY32.dll_BIO_ctrl
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x10037030
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov eax, 0x10
call fcn.10086e00
push ebx
push ebp
push esi
xor edx, edx
push edi
mov edi, dword [esp + 0x24]
mov ebx, 1
xor esi, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
movsx ecx, byte [edi]
mov ebp, dword [esp + 0x28]
inc edi
cmp ecx, 0x30
jl 0x1003708c
cmp ecx, 0x39
jg 0x1003708c
mov eax, dword [esp + esi*4 + 0x10]
mov edx, 1
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2 - 0x30]
cmp eax, 0xff
mov dword [esp + esi*4 + 0x10], eax
jbe 0x1003705b
xor esi, esi
jmp 0x100370d1
cmp ecx, 0x2e
jne 0x100370a3
test edx, edx
je 0x10037144
cmp esi, 3
je 0x10037088
inc esi
xor edx, edx
jmp 0x1003705b
test ecx, ecx
jne 0x10037088
cmp esi, 3
jne 0x10037088
test edx, edx
je 0x10037088
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x14]
mov al, byte [esp + 0x18]
mov byte [ebp], cl
mov cl, byte [esp + 0x1c]
mov byte [ebp + 1], dl
mov byte [ebp + 2], al
mov byte [ebp + 3], cl
mov esi, 1
mov eax, dword [0x100c4300]
test eax, eax
jne 0x1003715e
mov ecx, 0x64
xor eax, eax
mov edi, 0x100c4170
push 0x100c4170
rep stosd dword es:[edi], eax
push 0x101
mov dword [0x100c4300], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x1003715e
call sub.WSOCK32.dll_WSAGetLastError
push 0x1d0
push str..crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.LIBEAY32.dll_ERR_put_error
push 0x1d1
push str..crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x28
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x72
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x100371f6
test esi, esi
jg 0x10037214
push 0x80
push str..crypto_bio_b_sock.c
push 0x16
push 9
call sym.LIBEAY32.dll_CRYPTO_lock
mov edx, dword [esp + 0x34]
add esp, 0x10
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x100371a4
push 0x85
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x100371dc
cmp word [eax + 8], 2
je 0x100371c5
push 0x8c
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x100371dc
xor ecx, ecx
mov edx, dword [eax + 0xc]
inc ecx
cmp ecx, 4
mov edx, dword [edx]
mov dl, byte [ecx + edx - 1]
mov byte [ecx + ebp - 1], dl
jl 0x100371c7
xor ebx, ebx
push 0x95
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call sym.LIBEAY32.dll_CRYPTO_lock
add esp, 0x10
test ebx, ebx
je 0x10037214
mov eax, dword [esp + 0x24]
push eax
push 0x100938d8
push 2
call sym.LIBEAY32.dll_ERR_add_error_data
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x10037440
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x100c4300]
test eax, eax
jne 0x100374ab
push edi
mov ecx, 0x64
xor eax, eax
mov edi, 0x100c4170
push 0x100c4170
push 0x101
rep stosd dword es:[edi], eax
mov dword [0x100c4300], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
pop edi
je 0x100374ab
call sub.WSOCK32.dll_WSAGetLastError
push 0x1d0
push str..crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.LIBEAY32.dll_ERR_put_error
push 0x1d1
push str..crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x28
or eax, 0xffffffff
ret
mov eax, 1
ret
Function at 0x10039890
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x100398f1
mov al, byte [edi]
test al, al
je 0x100398f1
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x100398a9
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x1003a460
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x434
call fcn.10086e00
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
mov dword [esp + 0x10], 0
jne 0x1003a48b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.MSVCRT.dll__stat]
push 0
push 0
lea ecx, [esp + 0x2c]
push 0x24
push ecx
mov edi, eax
call sym.LIBEAY32.dll_RAND_add
add esp, 0x18
test edi, edi
jge 0x1003a4b9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x1003a4c9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10093e34
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x1003a569
jmp 0x1003a4ea
mov eax, dword [esp + 0x14]
test ebx, ebx
jle 0x1003a4f8
cmp ebx, 0x400
mov esi, ebx
jl 0x1003a4fd
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x48]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
mov dword [esp + 0x18], edi
jle 0x1003a54c
fild dword [esp + 0x18]
mov eax, 8
call fcn.10086e00
fstp qword [esp]
lea eax, [esp + 0x48]
push esi
push eax
call sym.LIBEAY32.dll_RAND_add
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, edi
test ebx, ebx
mov dword [esp + 0x10], ecx
jle 0x1003a4e6
sub ebx, esi
test ebx, ebx
jg 0x1003a4e6
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
lea edx, [esp + 0x44]
push 0x400
push edx
call sym.LIBEAY32.dll_OPENSSL_cleanse
add esp, 0xc
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003a580
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x42c
call fcn.10086e00
push ebx
push esi
mov esi, dword [esp + 0x438]
lea eax, [esp + 0x10]
push edi
xor edi, edi
push eax
push esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.MSVCRT.dll__stat]
push 0x10093e38
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 0x10
cmp ebx, edi
je 0x1003a666
push ebp
push 0x180
push esi
call dword [sym.imp.MSVCRT.dll__chmod]
mov ebp, dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 8
mov edi, 0x400
cmp edi, 0x400
mov esi, 0x400
jg 0x1003a5ed
mov esi, edi
lea ecx, [esp + 0x3c]
push esi
push ecx
sub edi, 0x400
call sym.LIBEAY32.dll_RAND_bytes
add esp, 8
test eax, eax
jg 0x1003a60d
mov dword [esp + 0x14], 1
push ebx
push esi
lea edx, [esp + 0x44]
push 1
push edx
call ebp
add esp, 0x10
test eax, eax
jle 0x1003a62f
mov ecx, dword [esp + 0x10]
add ecx, eax
test edi, edi
mov dword [esp + 0x10], ecx
jg 0x1003a5de
jmp 0x1003a637
mov dword [esp + 0x10], 0
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
lea eax, [esp + 0x40]
push 0x400
push eax
call sym.LIBEAY32.dll_OPENSSL_cleanse
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
pop ebp
je 0x1003a666
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x42c
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x42c
ret
Function at 0x1003a680
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push esi
push edi
xor esi, esi
call sym.LIBEAY32.dll_i2d_X509_PKEY
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.MSVCRT.dll_getenv]
test eax, eax
jne 0x1003a6d7
push str.RANDFILE
call ebp
mov esi, eax
add esp, 4
test esi, esi
je 0x1003a6d7
cmp byte [esi], 0
je 0x1003a6d7
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, ebx
jae 0x1003a6d7
push ebx
push esi
mov esi, dword [esp + 0x1c]
push esi
call sym.LIBEAY32.dll_BUF_strlcpy
add esp, 0xc
cmp eax, ebx
jb 0x1003a743
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
call sym.LIBEAY32.dll_i2d_X509_PKEY
test eax, eax
jne 0x1003a6ec
push str.HOME
call ebp
add esp, 4
mov esi, eax
test esi, esi
jne 0x1003a6f7
mov esi, 0x10093e44
jmp 0x1003a6fc
cmp byte [esi], 0
je 0x1003a73c
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 5
cmp ecx, ebx
jae 0x1003a73c
push ebx
push esi
mov esi, dword [esp + 0x1c]
push esi
call sym.LIBEAY32.dll_BUF_strlcpy
push ebx
push 0x100929d8
push esi
call sym.LIBEAY32.dll_BUF_strlcat
push ebx
push str..rnd
push esi
call sym.LIBEAY32.dll_BUF_strlcat
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esp + 0x14]
mov byte [esi], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1003b240
Capabilities:
Capture screenshot

Disassembly:
mov eax, 0x40
call fcn.10086e00
push ebx
push ebp
push esi
push edi
call sym.LIBEAY32.dll_RAND_poll
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 8
push edi
mov dword [esp + 0x18], ebx
call esi
mov ebp, eax
push 0xa
push edi
mov dword [esp + 0x20], ebp
call esi
push 0x10
push ebp
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push ebx
mov dword [esp + 0x24], esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x38]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectA]
mov esi, dword [esp + 0x48]
push 0x2ca
and esi, 0xffff
push str..crypto_rand_rand_win.c
imul esi, dword [esp + 0x48]
imul esi, dword [esp + 0x4c]
push esi
call sym.LIBEAY32.dll_CRYPTO_malloc
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x1003b362
mov ecx, dword [esp + 0x14]
xor ebx, ebx
lea eax, [ecx - 0x10]
test eax, eax
mov dword [esp + 0x14], eax
jle 0x1003b355
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push 0xcc0020
push ebx
push 0
push edi
push 0x10
push edx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x1c]
push ebp
push esi
push ecx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
call sym.LIBEAY32.dll_EVP_sha1
push eax
lea edx, [esp + 0x2c]
push 0
push edx
push esi
push ebp
call sym.LIBEAY32.dll_EVP_Digest
push 0
push 0
lea eax, [esp + 0x44]
push 0x14
push eax
call sym.LIBEAY32.dll_RAND_add
mov eax, dword [esp + 0x3c]
add ebx, 0x10
add esp, 0x28
cmp ebx, eax
jl 0x1003b2f5
push ebp
call sym.LIBEAY32.dll_CRYPTO_free
mov ebx, dword [esp + 0x14]
add esp, 4
mov ecx, dword [esp + 0x20]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call esi
push edi
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x1003ee50
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x1003ef2c
push ebx
push esi
mov esi, dword [esp + 0x18]
xor edx, edx
cmp edi, 3
jl 0x1003eec3
mov dh, byte [esi]
xor eax, eax
mov dl, byte [esi + 1]
mov al, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x1003ef18
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x1003eed4
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x1003ef04
mov ebx, 0x3d
jmp 0x1003ef12
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x1003ee6a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
Function at 0x10046010
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.10086e00
push ebx
push ebp
push esi
lea eax, [esp + 0x2c]
push edi
push eax
mov ebx, 1
call sym.LIBEAY32.dll_HMAC_CTX_init
mov esi, dword [esp + 0xb0]
mov ecx, dword [esp + 0xc8]
mov ebp, dword [esp + 0xc4]
add esp, 4
test esi, esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebp
jne 0x1004605a
mov dword [esp + 0xb0], esi
jmp 0x10046078
mov eax, dword [esp + 0xb0]
or ecx, 0xffffffff
cmp eax, ecx
jne 0x10046078
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xb0], ecx
test ebp, ebp
je 0x1004619c
jmp 0x1004608d
mov esi, dword [esp + 0xac]
mov ebp, dword [esp + 0x18]
cmp ebp, 0x14
jle 0x10046097
mov ebp, 0x14
mov edx, ebx
mov eax, ebx
mov ecx, ebx
push 0
shr edx, 0x18
shr eax, 0x10
shr ecx, 8
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], al
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], bl
call sym.LIBEAY32.dll_EVP_sha1
mov edx, dword [esp + 0xb4]
push eax
push edx
lea eax, [esp + 0x3c]
push esi
push eax
call sym.LIBEAY32.dll_HMAC_Init_ex
mov ecx, dword [esp + 0xcc]
mov edx, dword [esp + 0xc8]
push ecx
lea eax, [esp + 0x48]
push edx
push eax
call sym.LIBEAY32.dll_HMAC_Update
lea ecx, [esp + 0x30]
push 4
lea edx, [esp + 0x54]
push ecx
push edx
call sym.LIBEAY32.dll_HMAC_Update
lea eax, [esp + 0x48]
push 0
lea ecx, [esp + 0x60]
push eax
push ecx
call sym.LIBEAY32.dll_HMAC_Final
mov edi, dword [esp + 0x4c]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x54]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0xf4]
mov ecx, edx
add esp, 0x38
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jle 0x1004617f
lea edi, [eax - 1]
mov edx, dword [esp + 0xb0]
lea eax, [esp + 0x1c]
push 0
push eax
mov eax, dword [esp + 0xb4]
lea ecx, [esp + 0x24]
push 0x14
push ecx
push edx
push eax
call sym.LIBEAY32.dll_EVP_sha1
push eax
call sym.LIBEAY32.dll_HMAC
add esp, 0x1c
test ebp, ebp
jle 0x1004617c
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
sub ecx, eax
mov esi, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x10046173
dec edi
jne 0x10046137
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
sub eax, ebp
inc ebx
add edx, ebp
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x14], edx
jne 0x10046082
lea eax, [esp + 0x30]
push eax
call sym.LIBEAY32.dll_HMAC_CTX_cleanup
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret
Function at 0x1006b270
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.10086e00
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
test ebx, ebx
jne 0x1006b28e
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x1006b314
mov esi, dword [esp + 0x20]
test esi, esi
je 0x1006b2e5
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call sym.LIBEAY32.dll_lh_retrieve
add esp, 8
test eax, eax
je 0x1006b2c5
mov eax, dword [eax + 8]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
mov edi, 0x1009fa0c
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x1006b2e5
push ebx
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
jne 0x1006b31e
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebx
call sym.LIBEAY32.dll_lh_retrieve
add esp, 8
test eax, eax
je 0x1006b285
mov eax, dword [eax + 8]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push ebx
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1006d0e0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push str.OPENSSL_CONF
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x1006d100
push eax
call sym.LIBEAY32.dll_BUF_strdup
add esp, 4
pop edi
pop esi
ret
call sym.LIBEAY32.dll_X509_get_default_cert_area
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x230
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xb
push str..cryptoconfconf_mod.c
lea edi, [ecx + 1]
push edi
call sym.LIBEAY32.dll_CRYPTO_malloc
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1006d132
pop edi
pop esi
ret
push edi
call sym.LIBEAY32.dll_X509_get_default_cert_area
push eax
push esi
call sym.LIBEAY32.dll_BUF_strlcpy
push edi
push 0x100929d8
push esi
call sym.LIBEAY32.dll_BUF_strlcat
push edi
push str.openssl.cnf
push esi
call sym.LIBEAY32.dll_BUF_strlcat
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret

Function at 0x1006d270
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x100c5ea4]
test eax, eax
jne 0x1006d2dc
call sym.LIBEAY32.dll_OPENSSL_load_builtin_modules
call sym.LIBEAY32.dll_ENGINE_load_builtin_engines
call sym.LIBEAY32.dll_ERR_clear_error
push 0x10
push 0
push 0
call sym.LIBEAY32.dll_CONF_modules_load_file
add esp, 0xc
test eax, eax
jg 0x1006d2dc
push esi
call sym.LIBEAY32.dll_ERR_load_crypto_strings
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push 0
add eax, 0x40
push eax
call sym.LIBEAY32.dll_BIO_new_fp
mov esi, eax
add esp, 8
test esi, esi
je 0x1006d2d3
push str.Auto_configuration_failed_n
push esi
call sym.LIBEAY32.dll_BIO_printf
push esi
call sym.LIBEAY32.dll_ERR_print_errors
push esi
call sym.LIBEAY32.dll_BIO_free
add esp, 0x10
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
ret
Function at 0x401790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4017a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4017e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4017e0
lea ebx, [ebx]
cmp esi, eax
jae 0x4017e4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4017d0
cmp esi, eax
jb 0x4017ea
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret