joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b9210
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x101ec05c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100b9258
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.100a5ac0
add esp, 0xc
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017eae7
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x100b927f
shr eax, 8
test al, al
jne 0x100b927f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017eae7
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.100a5ac0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
mov eax, 2
call fcn.1017eae7
mov esp, ebp
pop ebp
ret

Function at 0x100b9410
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [edi + 0x154]
push ebx
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [ebp - 4]
mov ebx, eax
mov al, byte [ebp + 8]
push ecx
push edx
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], al
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x100b9455
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.100a5ac0
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ebx
mov ebx, str.SENT
call fcn.100b9310
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100ba1e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x128]
mov dword [ebp - 4], eax
jne 0x100ba32e
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea esi, [ebx + 0x1eb0]
mov dword [esi], edi
cmp edi, esi
jae 0x100ba216
mov byte [edi], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x100ba221
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x100ba22c
mov byte [eax], 0x1f
inc dword [esi]
movzx ecx, word [ebx + 0x1ca8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [ebp + 0xc], edx
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
mov eax, dword [esi]
cmp eax, esi
jae 0x100ba25e
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x100ba26b
mov dl, byte [ebp + 0xd]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x100ba275
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x100ba27f
mov byte [eax], ch
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x100ba28a
mov byte [eax], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x100ba295
mov byte [eax], 0xf0
inc dword [esi]
mov eax, dword [esi]
mov dword [ebx + 0x1eb4], eax
sub eax, edi
sub eax, 2
push eax
mov dword [esi], edi
mov esi, dword [ebp - 4]
lea eax, [ebx + 0x1cb2]
push 0x3e
call fcn.100b9780
mov esi, dword [sym.imp.WS2_32.dll_send]
add esp, 8
push 0
push 3
push edi
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x154]
push edx
call esi
test eax, eax
jns 0x100ba2eb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.100a5ac0
add esp, 0xc
lea ecx, [ebx + 0x1cb3]
push 4
push ecx
call fcn.100ba090
mov edx, dword [edi + 0x154]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push edx
call esi
pop edi
pop esi
test eax, eax
jns 0x100ba32e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.100a5ac0
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100bad60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101ec05c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ebx
mov ebx, dword [esi + 0x158]
push edi
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x100badb2
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.100a8170
add esp, 8
cmp edi, 0xffffffff
jne 0x100bade7
mov edx, dword [ebp - 0x1c]
push str.Error_accept__ing_server_connect
push edx
call fcn.100a5ac0
add esp, 8
pop edi
mov eax, 0x1e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017eae7
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1c]
push str.Connection_accepted_from_server_n
push ebx
call fcn.100a5a40
push 1
push edi
mov dword [esi + 0x158], edi
call fcn.100c90a0
mov dword [esi + 0x168], 1
mov eax, dword [ebx + 0x1b0]
add esp, 0x10
test eax, eax
je 0x100bae56
mov ecx, dword [ebx + 0x1b4]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x100bae56
push edi
push esi
call fcn.100a8170
add esp, 8
pop edi
mov dword [esi + 0x158], 0xffffffff
mov eax, 0x2a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017eae7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1017eae7
mov esp, ebp
pop ebp
ret
Function at 0x100be670
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
mov ebx, dword [edi]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x100be6a4
push str.Couldnt_set_desired_mode
push ebx
call fcn.100a5ac0
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x100be6bb
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.100a5a40
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x100be6d2
push edi
call fcn.100be600
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x100be6e6
push edi
call fcn.100bb920
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x100be6f8
mov eax, edi
call fcn.100be650
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x100be706
mov eax, edi
call fcn.100be660
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x100c5630
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101ec05c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x100c5695
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x100c5695
lea edx, [ebp - 0x108]
push edx
call dword [0x101e800c]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017eae7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1017eae7
mov esp, ebp
pop ebp
ret

Function at 0x100c56b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100c5630

Function at 0x100c9290
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x100c92ab
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.100a5640
push edx
push eax
call fcn.100a5670
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x100c92f8
mov eax, dword [ebx + 0x148]
mov ecx, dword [ebx + 0x144]
push eax
push ecx
call fcn.100a5640
push edx
push eax
call fcn.100a5670
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
mov eax, ecx
cmp esi, ecx
jge 0x100c92fa
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100cb640
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x100cb674
push 0x2e
push esi
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
test eax, eax
je 0x100cb672
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x100cdb90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100cdbbb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x100cdc02
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x100cdc05
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x100cdc66
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x100cdc30
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x100cdc9f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x101914b7
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x101914b8
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x100cdc70
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ce940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.1017f100
mov eax, dword [0x101ec05c]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x100ce987
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.1017eae7
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call sub.MSVCR100.dll__stat64i32
add esp, 8
test eax, eax
js 0x100ce970
mov eax, 8
call fcn.1017f100
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.100ce7b0
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x100ce970
push 0x101887a4
push esi
call sub.MSVCR100.dll_fopen
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x100cea61
jmp 0x100ce9e4
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x100ce9f2
mov esi, ebx
cmp ebx, 0x400
jl 0x100ce9f7
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call sub.MSVCR100.dll_fread
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x100cea45
fild dword [esp + 0x44]
mov eax, 8
call fcn.1017f100
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.100ce7b0
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x100ce9e0
sub ebx, esi
test ebx, ebx
jg 0x100ce9e0
mov ecx, dword [esp + 0x40]
push ecx
call sub.MSVCR100.dll_fclose
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.100de2b0
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1017eae7
mov esp, ebp
pop ebp
ret

Function at 0x100cea80
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
xor esi, esi
call fcn.1000dbd0
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x100cead6
push str.RANDFILE
call sub.MSVCR100.dll_getenv
mov esi, eax
add esp, 4
test esi, esi
je 0x100cead6
cmp byte [esi], 0
je 0x100cead6
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100ceab0
sub eax, edx
inc eax
cmp eax, edi
jae 0x100cead6
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.100de360
add esp, 0xc
cmp eax, edi
jb 0x100ceb46
pop edi
xor eax, eax
pop esi
ret
call fcn.1000dbd0
test eax, eax
jne 0x100ceaee
push str.HOME
call sub.MSVCR100.dll_getenv
add esp, 4
mov esi, eax
test esi, esi
jne 0x100ceaf9
mov esi, 0x10191504
jmp 0x100ceafe
cmp byte [esi], 0
je 0x100ceb3f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100ceb03
sub eax, edx
add eax, 6
cmp eax, edi
jae 0x100ceb3f
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.100de360
push edi
push 0x10188ce8
push esi
call fcn.100de3a0
push edi
push str..rnd
push esi
call fcn.100de3a0
add esp, 0x24
pop edi
mov eax, esi
pop esi
ret
mov esi, dword [esp + 0xc]
mov byte [esi], 0
pop edi
mov eax, esi
pop esi
ret
Function at 0x100d2850
Capabilities:
Query environment variable

Disassembly:
push str.OPENSSL_CONF
call sub.MSVCR100.dll_getenv
add esp, 4
test eax, eax
je 0x100d286b
push eax
call fcn.100de470
add esp, 4
ret
call fcn.100e7aa0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100d2873
push esi
push edi
sub eax, edx
push 0x21b
lea edi, [eax + 0xd]
push str..cryptoconfconf_mod.c
push edi
call fcn.100d38e0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100d289d
pop edi
pop esi
ret
push edi
call fcn.100e7aa0
push eax
push esi
call fcn.100de360
push edi
push 0x10188ce8
push esi
call fcn.100de3a0
push edi
push str.openssl.cnf
push esi
call fcn.100de3a0
add esp, 0x24
pop edi
mov eax, esi
pop esi
ret
Function at 0x100d8c90
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
dec ecx
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
dec ecx
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x100d8cc2
jmp dword [edx*4 + 0x100d8dec]
mov edi, 0xa
cmp ebx, edi
jle case.0x100d8cc2.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
inc edi
cmp edi, dword [esp + 0x20]
jl 0x100d8cd3
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x100da550
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x100db050
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x100db0b0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x100e1a20
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.1017f100
mov eax, dword [0x101ec05c]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x100e1aa7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x100e1aa7
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call sub.MSVCR100.dll__vsnprintf
add esp, 0x10
test eax, eax
jns 0x100e1a7d
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1017eae7
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call sub.MSVCR100.dll__vsnprintf
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x100e1b35
call fcn.100e18e0
test eax, eax
jle 0x100e1b35
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
mov esi, eax
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1017eae7
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.1017eae7
add esp, 0x108
ret

Function at 0x100e1b90
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x100e1bb2
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x100e1ba6
pop esi
movzx eax, cl
pop edi
ret

Function at 0x100e51f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x100e5234
mov al, byte [edx]
test al, al
je 0x100e5234
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x100e5207
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x100fad30
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x100fad55
push 0x149
push str..cryptoengineeng_list.c
push 0x43
push 0x6a
push 0x26
call fcn.100d08d0
add esp, 0x14
xor eax, eax
pop ebx
ret
push esi
push 0x14c
push str..cryptoengineeng_list.c
push 0x1e
push 9
call fcn.100e1bc0
mov eax, dword [0x101f6cbc]
add esp, 0x10
mov esi, eax
test eax, eax
je 0x100fadd7
mov ecx, dword [esi]
mov eax, ebx
jmp 0x100fad80
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100fada0
test dl, dl
je 0x100fad9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100fada0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100fad80
xor eax, eax
jmp 0x100fada5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100fadb2
mov esi, dword [esi + 0x6c]
test esi, esi
jne 0x100fad77
jmp 0x100fadd7
test byte [esi + 0x54], 4
je 0x100fadd4
call fcn.100f9eb0
mov ecx, eax
test ecx, ecx
jne 0x100fadc7
xor esi, esi
jmp 0x100fadd7
push esi
call fcn.100facb0
add esp, 4
mov esi, ecx
jmp 0x100fadd7
inc dword [esi + 0x58]
push 0x163
push str..cryptoengineeng_list.c
push 0x1e
push 0xa
call fcn.100e1bc0
add esp, 0x10
test esi, esi
je 0x100fadf6
mov eax, esi
pop esi
pop ebx
ret
mov ecx, str.dynamic
mov eax, ebx
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100fae20
test dl, dl
je 0x100fae1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100fae20
add eax, 2
add ecx, 2
test dl, dl
jne 0x100fae00
xor eax, eax
jmp 0x100fae25
sbb eax, eax
sbb eax, 0xffffffff
push edi
test eax, eax
je 0x100faed1
push str.OPENSSL_ENGINES
call sub.MSVCR100.dll_getenv
mov edi, eax
add esp, 4
test edi, edi
jne 0x100fae46
mov edi, str._usr_local_ssl_lib_engines
push str.dynamic
call fcn.100fad30
mov esi, eax
add esp, 4
test esi, esi
je 0x100faed1
push 0
push ebx
push 0x101a7ab4
push esi
call fcn.1010e060
add esp, 0x10
test eax, eax
je 0x100faed1
push 0
push 0x10194464
push str.DIR_LOAD
push esi
call fcn.1010e060
add esp, 0x10
test eax, eax
je 0x100faed1
push 0
push edi
push str.DIR_ADD
push esi
call fcn.1010e060
add esp, 0x10
test eax, eax
je 0x100faed1
push 0
push 0x101da6ac
push str.LIST_ADD
push esi
call fcn.1010e060
add esp, 0x10
test eax, eax
je 0x100faed1
push 0
push 0
push str.LOAD
push esi
call fcn.1010e060
add esp, 0x10
test eax, eax
je 0x100faed1
pop edi
mov eax, esi
pop esi
pop ebx
ret
push esi
call fcn.100f9fa0
push 0x185
push str..cryptoengineeng_list.c
push 0x74
push 0x6a
push 0x26
call fcn.100d08d0
push ebx
push 0x101a7a9c
push 2
call fcn.100d0bc0
add esp, 0x24
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10104a30
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret