joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002193c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x1c
pop eax
call fcn.1005ead0
mov eax, dword [0x100a4120]
xor eax, dword [ebp + 4]
push edi
mov edi, dword [ebp + 0xc]
dec edi
mov dword [ebp - 4], eax
lea eax, [edi - 0x29]
cmp dword [ebp + 0x14], eax
jle 0x10021967
push 0
push 0
push 0x6e
jmp 0x10021995
cmp edi, 0x29
jge 0x10021974
push 0
push 0
push 0x78
jmp 0x10021995
push 0x37
lea eax, [edi - 0x14]
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [ebp + 0xc], eax
call sym.LIBEAY32.dll_CRYPTO_malloc
add esp, 0xc
test eax, eax
mov dword [ebp - 8], eax
jne 0x100219a8
push eax
push eax
push 0x41
push 0x79
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
jmp 0x10021a65
mov eax, dword [ebp + 8]
and byte [eax], 0
push ebx
push esi
push 0
lea ebx, [eax + 1]
lea esi, [eax + 0x15]
call sym.LIBEAY32.dll_EVP_sha1
push eax
push 0
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call sym.LIBEAY32.dll_EVP_Digest
mov eax, edi
sub eax, dword [ebp + 0x14]
sub eax, 0x29
push eax
lea eax, [esi + 0x14]
push 0
push eax
call sub.MSVCR70.dll_memset
push dword [ebp + 0x14]
mov eax, esi
sub eax, dword [ebp + 0x14]
push dword [ebp + 0x10]
add eax, edi
mov byte [eax - 0x15], 1
add eax, 0xffffffec
push eax
call sub.MSVCR70.dll_memcpy
push 0x14
push ebx
call sym.LIBEAY32.dll_RAND_bytes
add esp, 0x38
test eax, eax
jg 0x10021a0d
xor eax, eax
jmp 0x10021a63
mov edi, dword [ebp - 8]
push 0x14
push ebx
push dword [ebp + 0xc]
push edi
call fcn.1002191d
add esp, 0x10
cmp dword [ebp + 0xc], 0
jle 0x10021a35
mov ecx, dword [ebp + 0xc]
mov eax, esi
sub edi, esi
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x10021a2c
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push esi
push 0x14
pop esi
push esi
push eax
call fcn.1002191d
lea eax, [ebp - 0x1c]
add esp, 0x10
sub eax, ebx
mov cl, byte [eax + ebx]
xor byte [ebx], cl
inc ebx
dec esi
jne 0x10021a4e
push dword [ebp - 8]
call sym.LIBEAY32.dll_CRYPTO_free
xor eax, eax
pop ecx
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
call fcn.1005eb3e
leave
ret
Function at 0x10021a73
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x34
pop eax
call fcn.1005ead0
mov eax, dword [0x100a4120]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
dec edi
cmp edi, 0x29
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ebx
jl 0x10021bbf
mov eax, edi
sub eax, dword [ebp + 0x14]
mov dword [ebp + 0x18], eax
jns 0x10021ab4
mov dword [ebp - 0xc], 1
mov dword [ebp + 0x18], ebx
mov eax, ebx
mov esi, dword [ebp + 0x10]
push 0x7a
sub esi, eax
lea eax, [esi + 0x14]
add edi, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push edi
mov dword [ebp - 8], eax
call sym.LIBEAY32.dll_CRYPTO_malloc
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x10021aed
push eax
push eax
push 0x41
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10021bdc
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x20]
push 0x14
push eax
call fcn.1002191d
mov eax, dword [ebp + 0x18]
add esp, 0x10
jmp 0x10021b0c
mov cl, byte [esi + eax]
xor byte [ebp + eax - 0x20], cl
inc eax
cmp eax, 0x14
jl 0x10021b04
push 0x14
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
call fcn.1002191d
add esp, 0x10
test edi, edi
jle 0x10021b37
mov esi, dword [ebp - 8]
mov eax, ebx
sub esi, ebx
mov ecx, edi
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x10021b2e
push 0
call sym.LIBEAY32.dll_EVP_sha1
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call sym.LIBEAY32.dll_EVP_Digest
push 0x14
lea eax, [ebp - 0x34]
push eax
push ebx
call sub.MSVCR70.dll_memcmp
add esp, 0x24
test eax, eax
jne 0x10021bbf
cmp dword [ebp - 0xc], eax
jne 0x10021bbf
push 0x14
pop eax
cmp edi, eax
jle 0x10021b7a
cmp byte [eax + ebx], 0
jne 0x10021b7a
inc eax
cmp eax, edi
jl 0x10021b6f
cmp byte [eax + ebx], 1
jne 0x10021bbf
mov ecx, eax
inc eax
cmp ecx, edi
jge 0x10021bbf
sub edi, eax
cmp dword [ebp + 0xc], edi
jge 0x10021ba5
push 0
push 0
push 0x6d
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
or edi, 0xffffffff
jmp 0x10021bb4
push edi
add eax, ebx
push eax
push dword [ebp + 8]
call sub.MSVCR70.dll_memcpy
add esp, 0xc
push ebx
call sym.LIBEAY32.dll_CRYPTO_free
pop ecx
mov eax, edi
jmp 0x10021bdf
push 0
push 0
push 0x79
push 0x7a
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
test ebx, ebx
je 0x10021bdc
push ebx
call sym.LIBEAY32.dll_CRYPTO_free
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.1005eb3e
leave
ret
Function at 0x100221dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x24
pop eax
call fcn.1005ead0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
push edi
mov edi, dword [ebp + 0x18]
xor ecx, ecx
cmp edi, 0xffffffff
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
jne 0x10022279
mov edi, eax
push ebx
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x10]
call sym.LIBEAY32.dll_BN_num_bits
mov ebx, eax
dec ebx
and ebx, 7
push esi
mov dword [ebp - 0xc], ebx
call sym.LIBEAY32.dll_RSA_size
pop ecx
mov esi, eax
test ebx, ebx
mov ebx, dword [ebp + 0xc]
pop ecx
mov dword [ebp - 0x10], esi
jne 0x10022236
and byte [ebx], 0
inc ebx
dec esi
mov dword [ebp - 0x10], esi
cmp edi, 0xfffffffe
jne 0x10022298
mov edi, esi
sub edi, dword [ebp - 4]
dec edi
dec edi
test edi, edi
jle 0x100222cb
push 0xd5
push str..crypto_rsa_rsa_pss.c
push edi
call sym.LIBEAY32.dll_CRYPTO_malloc
add esp, 0xc
test eax, eax
mov dword [ebp - 8], eax
jne 0x100222ba
push eax
push eax
push 0x41
push 0x7d
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10022393
cmp edi, 0xfffffffe
je 0x10022204
jge 0x10022204
push ecx
push ecx
push 0x88
push 0x7d
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x100223a4
mov eax, dword [ebp - 4]
lea eax, [eax + edi + 2]
cmp esi, eax
jge 0x10022242
push 0
push 0
push 0x6e
push 0x7d
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x100223a2
push edi
push eax
call sym.LIBEAY32.dll_RAND_bytes
test eax, eax
pop ecx
pop ecx
je 0x10022393
sub esi, dword [ebp - 4]
lea eax, [esi + ebx - 1]
mov dword [ebp + 0x18], eax
lea eax, [ebp - 0x24]
push eax
call sym.LIBEAY32.dll_EVP_MD_CTX_init
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push eax
call sym.LIBEAY32.dll_EVP_DigestInit_ex
push 8
lea eax, [ebp - 0x24]
push 0x1007842c
push eax
call sym.LIBEAY32.dll_EVP_DigestUpdate
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push eax
call sym.LIBEAY32.dll_EVP_DigestUpdate
add esp, 0x28
test edi, edi
je 0x10022322
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x24]
push eax
call sym.LIBEAY32.dll_EVP_DigestUpdate
add esp, 0xc
push 0
push dword [ebp + 0x18]
lea eax, [ebp - 0x24]
push eax
call sym.LIBEAY32.dll_EVP_DigestFinal
lea eax, [ebp - 0x24]
push eax
call sym.LIBEAY32.dll_EVP_MD_CTX_cleanup
push dword [ebp + 0x14]
lea eax, [esi - 1]
push dword [ebp - 4]
push dword [ebp + 0x18]
push eax
push ebx
call sym.LIBEAY32.dll_PKCS1_MGF1
sub esi, edi
xor edx, edx
inc edx
lea eax, [esi + ebx - 2]
xor byte [eax], dl
add esp, 0x24
inc eax
test edi, edi
jle 0x10022373
xor esi, esi
test edi, edi
jle 0x10022373
mov ecx, dword [ebp - 8]
mov cl, byte [esi + ecx]
xor byte [eax], cl
inc eax
inc esi
cmp esi, edi
jl 0x10022365
cmp dword [ebp - 0xc], 0
je 0x10022388
push 8
pop ecx
sub ecx, dword [ebp - 0xc]
mov eax, 0xff
sar eax, cl
and byte [ebx], al
mov eax, dword [ebp - 0x10]
mov byte [eax + ebx - 1], 0xbc
mov dword [ebp - 0x14], edx
cmp dword [ebp - 8], 0
je 0x100223a2
push dword [ebp - 8]
call sym.LIBEAY32.dll_CRYPTO_free
pop ecx
pop esi
pop ebx
mov eax, dword [ebp - 0x14]
pop edi
leave
ret
Function at 0x1002241e
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x14], edx
push esi
push edi
jne 0x10022490
mov eax, dword [esp + 0x14]
mov cl, byte [eax]
cmp cl, 0x6a
je 0x1002243a
cmp cl, 0x6b
jne 0x10022490
inc eax
xor edi, edi
cmp cl, 0x6b
jne 0x1002246c
lea esi, [edx - 3]
xor ecx, ecx
cmp esi, edi
jle 0x1002245d
mov dl, byte [eax]
inc eax
cmp dl, 0xba
je 0x1002245d
cmp dl, 0xbb
jne 0x10022463
inc ecx
cmp ecx, esi
jl 0x1002244b
sub esi, ecx
cmp ecx, edi
jne 0x1002246f
push edi
push edi
push 0x8a
jmp 0x10022499
lea esi, [edx - 2]
cmp byte [esi + eax], 0xcc
je 0x1002247e
push edi
push edi
push 0x8b
jmp 0x10022499
push esi
push eax
push dword [esp + 0x14]
call sub.MSVCR70.dll_memcpy
add esp, 0xc
mov eax, esi
jmp 0x100224ab
xor edi, edi
push edi
push edi
push 0x89
push 0x80
push 4
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
ret
Function at 0x100261c7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx + 0xc], eax
je 0x10026202
cmp dword [ebp + 0xc], eax
je 0x10026202
test byte [ecx + 0x15], 0x80
push dword [ecx + 0x20]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
je 0x100261f2
call dword [0x1009a03c]
jmp 0x100261f8
call dword [sym.imp.MSVCR70.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x10026202
mov eax, dword [ebp + 0x10]
pop ebp
ret

Function at 0x100264bd
Capabilities:
Check if file exists

Disassembly:
push ebx
push edi
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.MSVCR70.dll_fopen]
mov ebx, eax
xor edi, edi
cmp ebx, edi
pop ecx
pop ecx
jne 0x10026530
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call sym.LIBEAY32.dll_ERR_put_error
push 0x10078be4
push dword [esp + 0x28]
push 0x10078be0
push dword [esp + 0x2c]
push str.fopen_
push 5
call sym.LIBEAY32.dll_ERR_add_error_data
add esp, 0x2c
call dword [sym.imp.MSVCR70.dll__errno]
cmp dword [eax], 2
push edi
push edi
jne 0x1002651e
push 0x80
jmp 0x10026520
push 2
push 0x6d
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
jmp 0x10026562
push esi
push 0x1009a5e8
call sym.LIBEAY32.dll_BIO_new
mov esi, eax
cmp esi, edi
pop ecx
push ebx
jne 0x1002654e
call dword [sym.imp.MSVCR70.dll_fclose]
pop ecx
xor eax, eax
jmp 0x10026561
and byte [esi + 0x15], 0x7f
push 1
push 0x6a
push esi
call sym.LIBEAY32.dll_BIO_ctrl
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x100266e9
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call sub.WSOCK32.dll_WSASetLastError
mov esi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call sub.WSOCK32.dll_send
and dword [esi + 0x14], 0xfffffff0
mov edi, eax
test edi, edi
jg 0x10026721
push edi
call sym.LIBEAY32.dll_BIO_sock_should_retry
test eax, eax
pop ecx
je 0x10026721
or dword [esi + 0x14], 0xa
mov eax, edi
pop edi
pop esi
ret
Function at 0x10026c5d
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0x20]
cmp dword [esi], 6
je 0x10026c74
call fcn.10026741
test eax, eax
jle 0x10026ca8
push 0
call sub.WSOCK32.dll_WSASetLastError
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x1c]
call sub.WSOCK32.dll_send
and dword [edi + 0x14], 0xfffffff0
mov esi, eax
test esi, esi
jg 0x10026ca6
push esi
call sym.LIBEAY32.dll_BIO_sock_should_retry
test eax, eax
pop ecx
je 0x10026ca6
or dword [edi + 0x14], 0xa
mov eax, esi
pop edi
pop esi
ret

Function at 0x100288c8
Capabilities:
Initialize winsock library

Disassembly:
push edi
xor edi, edi
cmp dword [0x100a4a48], edi
jne 0x10028928
push esi
push 0x190
push edi
mov esi, 0x100a48a8
push esi
mov dword [0x100a4a48], 1
call sub.MSVCR70.dll_memset
add esp, 0xc
push esi
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
pop esi
je 0x10028928
call sub.WSOCK32.dll_WSAGetLastError
push edi
push edi
push eax
push 9
push 2
call sym.LIBEAY32.dll_ERR_put_error
push edi
push edi
push 0x7a
push 0x70
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x28
or eax, 0xffffffff
pop edi
ret
xor eax, eax
inc eax
pop edi
ret

Function at 0x10028b0c
Capabilities:
Set socket configuration

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 1
push 6
push dword [esp + 0x14]
call sub.WSOCK32.dll_setsockopt
neg eax
sbb eax, eax
inc eax
ret

Function at 0x10028b4a
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push dword [esp + 0x10]
xor ebx, ebx
mov edx, edi
inc ebx
call fcn.1002897a
mov esi, eax
test esi, esi
pop ecx
jge 0x10028b7d
push 0
push 0
push 0x6c
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10028c06
call sym.LIBEAY32.dll_BIO_sock_init
cmp eax, 1
je 0x10028b8e
xor eax, eax
jmp 0x10028c21
test esi, esi
jg 0x10028c1e
push 0x83
mov esi, str..crypto_bio_b_sock.c
push esi
push 0x16
push 9
call sym.LIBEAY32.dll_CRYPTO_lock
add esp, 0x10
push dword [esp + 0x10]
call sub.WSOCK32.dll_gethostbyname
xor edx, edx
cmp eax, edx
jne 0x10028bce
push edx
push edx
push 0x66
push 0x6a
push 0x20
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
jmp 0x10028bf0
cmp word [eax + 8], 2
je 0x10028bdb
push edx
push edx
push 0x6b
jmp 0x10028bc0
xor ecx, ecx
mov ebx, dword [eax + 0xc]
mov ebx, dword [ebx]
mov bl, byte [ecx + ebx]
mov byte [ecx + edi], bl
inc ecx
cmp ecx, 4
jl 0x10028bdd
xor ebx, ebx
push 0x98
push esi
push 0x16
push 0xa
call sym.LIBEAY32.dll_CRYPTO_lock
add esp, 0x10
test ebx, ebx
je 0x10028c1e
push dword [esp + 0x10]
push 0x10078c18
push 2
call sym.LIBEAY32.dll_ERR_add_error_data
add esp, 0xc
jmp 0x10028b87
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x1002a730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test esi, esi
je 0x1002a78c
mov al, byte [esi]
test al, al
je 0x1002a78c
mov dword [ebp + 8], 0x100
push ebx
movsx eax, al
or eax, dword [ebp + 8]
add dword [ebp + 8], 0x100
mov edx, eax
shr edx, 2
xor edx, eax
and edx, 0xf
push 0x20
pop ecx
sub ecx, edx
mov ebx, edi
shr ebx, cl
mov ecx, edx
shl edi, cl
mov ecx, eax
imul ecx, eax
or ebx, edi
xor ebx, ecx
inc esi
mov al, byte [esi]
test al, al
mov edi, ebx
jne 0x1002a74c
mov eax, edi
shr eax, 0x10
xor eax, edi
pop ebx
jmp 0x1002a78e
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x1002b31d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x430
call fcn.1005ead0
mov eax, dword [0x100a4120]
xor eax, dword [ebp + 4]
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0
mov dword [ebp - 4], eax
jne 0x1002b346
xor eax, eax
jmp 0x1002b419
push ebx
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCR70.dll__stat]
fldz
pop ecx
pop ecx
push 8
mov esi, eax
pop eax
call fcn.1005ead0
fstp qword [esp]
lea eax, [ebp - 0x30]
push 0x24
push eax
call sym.LIBEAY32.dll_RAND_add
add esp, 0x10
test esi, esi
jge 0x1002b37f
xor eax, eax
jmp 0x1002b417
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1002b378
push 0x100791d4
push dword [ebp + 8]
call dword [sym.imp.MSVCR70.dll_fopen]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x1002b414
test ebx, ebx
push edi
mov edi, 0x400
jle 0x1002b3ad
cmp ebx, edi
mov esi, ebx
jl 0x1002b3af
mov esi, edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x430]
push esi
push 1
push eax
call dword [sym.imp.MSVCR70.dll_fread]
add esp, 0x10
test eax, eax
mov dword [ebp + 8], eax
jle 0x1002b3fa
fild dword [ebp + 8]
push 8
pop eax
call fcn.1005ead0
fstp qword [esp]
lea eax, [ebp - 0x430]
push esi
push eax
call sym.LIBEAY32.dll_RAND_add
mov eax, dword [ebp + 8]
add dword [ebp - 8], eax
add esp, 0x10
test ebx, ebx
jle 0x1002b3ad
sub ebx, esi
test ebx, ebx
jg 0x1002b3a7
push dword [ebp - 0xc]
call dword [sym.imp.MSVCR70.dll_fclose]
lea eax, [ebp - 0x430]
push edi
push eax
call sym.LIBEAY32.dll_OPENSSL_cleanse
add esp, 0xc
pop edi
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.1005eb3e
leave
ret

Function at 0x1002b426
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x434
call fcn.1005ead0
mov eax, dword [0x100a4120]
xor eax, dword [ebp + 4]
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCR70.dll__stat]
push 0x100791d8
push dword [ebp + 8]
call dword [sym.imp.MSVCR70.dll_fopen]
add esp, 0x10
test eax, eax
mov dword [ebp - 0x10], eax
je 0x1002b4fb
push ebx
push esi
push edi
push 0x180
push dword [ebp + 8]
call dword [sym.imp.MSVCR70.dll__chmod]
pop ecx
mov esi, 0x400
pop ecx
mov ebx, esi
cmp ebx, esi
mov edi, esi
jg 0x1002b491
mov edi, ebx
lea eax, [ebp - 0x434]
push edi
push eax
sub ebx, esi
call sym.LIBEAY32.dll_RAND_bytes
test eax, eax
pop ecx
pop ecx
jg 0x1002b4ad
mov dword [ebp - 0xc], 1
push dword [ebp - 0x10]
lea eax, [ebp - 0x434]
push edi
push 1
push eax
call dword [sym.imp.MSVCR70.dll_fwrite]
add esp, 0x10
test eax, eax
jle 0x1002b4d0
add dword [ebp - 8], eax
test ebx, ebx
jg 0x1002b489
jmp 0x1002b4d4
and dword [ebp - 8], 0
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR70.dll_fclose]
lea eax, [ebp - 0x434]
push esi
push eax
call sym.LIBEAY32.dll_OPENSSL_cleanse
add esp, 0xc
cmp dword [ebp - 0xc], 0
pop edi
pop esi
pop ebx
je 0x1002b4fb
or eax, 0xffffffff
jmp 0x1002b4fe
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.1005eb3e
leave
ret
Function at 0x1002b50b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
call sym.LIBEAY32.dll_i2d_X509_PKEY
test eax, eax
mov edi, dword [sym.imp.MSVCR70.dll_getenv]
jne 0x1002b559
push str.RANDFILE
call edi
mov esi, eax
test esi, esi
pop ecx
je 0x1002b559
cmp byte [esi], 0
je 0x1002b559
push esi
call sub.MSVCR70.dll_strlen
inc eax
cmp eax, dword [ebp + 0xc]
pop ecx
jae 0x1002b559
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call sym.LIBEAY32.dll_BUF_strlcpy
add esp, 0xc
cmp eax, dword [ebp + 0xc]
jb 0x1002b5c9
xor eax, eax
jmp 0x1002b5cc
call sym.LIBEAY32.dll_i2d_X509_PKEY
test eax, eax
jne 0x1002b56c
push str.HOME
call edi
pop ecx
mov esi, eax
test esi, esi
jne 0x1002b575
mov esi, 0x100791e4
cmp byte [esi], 0
push ebx
je 0x1002b5c2
push esi
call sub.MSVCR70.dll_strlen
mov edi, str..rnd
push edi
mov ebx, eax
call sub.MSVCR70.dll_strlen
lea eax, [ebx + eax + 2]
mov ebx, dword [ebp + 0xc]
cmp eax, ebx
pop ecx
pop ecx
jae 0x1002b5c2
push ebx
push esi
push dword [ebp + 8]
call sym.LIBEAY32.dll_BUF_strlcpy
push ebx
push 0x10078958
push dword [ebp + 8]
call sym.LIBEAY32.dll_BUF_strlcat
push ebx
push edi
push dword [ebp + 8]
call sym.LIBEAY32.dll_BUF_strlcat
add esp, 0x24
jmp 0x1002b5c8
mov eax, dword [ebp + 8]
and byte [eax], 0
pop ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret
Function at 0x1002bfe0
Capabilities:
Capture screenshot

Disassembly:
call sym.LIBEAY32.dll_RAND_poll
jmp fcn.1002b714

Function at 0x1002e317
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 4
pop eax
call fcn.1005ead0
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x1002e3f1
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x3f
pop edi
cmp ebx, 3
jl 0x1002e38e
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, edi
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, edi
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
mov eax, edx
shr eax, 6
and eax, edi
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, edi
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
jmp 0x1002e3dc
movzx edx, byte [esi]
shl edx, 0x10
cmp ebx, 2
jne 0x1002e3a0
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, edi
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, edi
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp ebx, 1
jne 0x1002e3ca
push 0x3d
pop edx
jmp 0x1002e3d6
shr edx, 6
and edx, edi
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
add dword [ebp - 4], 4
sub ebx, 3
inc ecx
add esi, 3
test ebx, ebx
jg 0x1002e33d
pop edi
pop esi
and byte [ecx], 0
mov eax, dword [ebp - 4]
pop ebx
leave
ret
Function at 0x1003311d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xd8
call fcn.1005ead0
mov eax, dword [0x100a4120]
xor eax, dword [ebp + 4]
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd8]
push edi
xor ebx, ebx
push eax
inc ebx
call sym.LIBEAY32.dll_HMAC_CTX_init
mov eax, dword [ebp + 0x20]
mov edi, dword [ebp + 0x1c]
xor esi, esi
cmp dword [ebp + 8], esi
pop ecx
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x1c], edi
jne 0x10033160
mov dword [ebp + 0xc], esi
jmp 0x10033172
cmp dword [ebp + 0xc], 0xffffffff
jne 0x10033172
push dword [ebp + 8]
call sub.MSVCR70.dll_strlen
pop ecx
mov dword [ebp + 0xc], eax
cmp edi, esi
je 0x10033257
push 0x14
pop edi
cmp dword [ebp + 0x1c], edi
jg 0x10033185
mov edi, dword [ebp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, ebx
shr eax, 8
push esi
mov byte [ebp - 6], al
mov byte [ebp - 5], bl
call sym.LIBEAY32.dll_EVP_sha1
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push dword [ebp + 8]
push eax
call sym.LIBEAY32.dll_HMAC_Init_ex
push dword [ebp + 0x14]
lea eax, [ebp - 0xd8]
push dword [ebp + 0x10]
push eax
call sym.LIBEAY32.dll_HMAC_Update
push 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xd8]
push eax
call sym.LIBEAY32.dll_HMAC_Update
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xd8]
push eax
call sym.LIBEAY32.dll_HMAC_Final
push edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x20]
call sub.MSVCR70.dll_memcpy
mov eax, dword [ebp + 0x18]
add esp, 0x44
cmp eax, 1
jle 0x10033247
dec eax
mov dword [ebp - 0xc], eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0x14
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.LIBEAY32.dll_EVP_sha1
push eax
call sym.LIBEAY32.dll_HMAC
add esp, 0x1c
cmp edi, esi
jle 0x10033242
mov eax, dword [ebp + 0x20]
lea esi, [ebp - 0x20]
sub esi, eax
mov ecx, edi
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x10033237
xor esi, esi
dec dword [ebp - 0xc]
jne 0x1003320a
sub dword [ebp + 0x1c], edi
add dword [ebp + 0x20], edi
inc ebx
cmp dword [ebp + 0x1c], esi
jne 0x1003317a
lea eax, [ebp - 0xd8]
push eax
call sym.LIBEAY32.dll_HMAC_CTX_cleanup
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.1005eb3e
leave
ret