joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005c0c0
Capabilities:
Set socket configuration

Disassembly:
mov eax, 0x1c
call fcn.100bf140
mov eax, dword [0x10116cb0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov dword [esp + 0xc], 0
mov esi, dword [ebx + 0x20]
cmp dword [esi + 0x28], 0
jg 0x1005c0f6
cmp dword [esi + 0x2c], 0
jle 0x1005c1fc
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 4
push eax
lea eax, [esp + 0xc]
push eax
push 0x1006
push 0xffff
push dword [ebx + 0x1c]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jns 0x1005c12f
push str.getsockopt
call dword [sym.imp.MSVCR120.dll_perror]
add esp, 4
jmp 0x1005c158
mov ecx, dword [esp + 8]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esi + 0x30], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [esi + 0x34], eax
lea eax, [esp + 0x10]
push edi
push eax
call dword [sym.imp.MSVCR120.dll__ftime64]
movzx eax, word [esp + 0x20]
add esp, 4
mov edx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
imul edi, eax, 0x3e8
cmp edx, edi
jge 0x1005c188
mov eax, 0xf4240
sub eax, edi
add edx, eax
dec ecx
jmp 0x1005c18a
sub edx, edi
mov eax, dword [esp + 0x14]
cmp ecx, eax
jge 0x1005c199
xor ecx, ecx
lea edx, [ecx + 1]
jmp 0x1005c19b
sub ecx, eax
mov edi, dword [esi + 0x30]
test edi, edi
jne 0x1005c1a7
cmp dword [esi + 0x34], edi
je 0x1005c1b2
cmp edi, ecx
jg 0x1005c1b2
jne 0x1005c1fb
cmp dword [esi + 0x34], edx
jl 0x1005c1fb
mov eax, 0x10624dd3
imul ecx, ecx, 0x3e8
imul edx
push 4
sar edx, 6
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0x1006
push 0xffff
push dword [ebx + 0x1c]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1005c1fb
push str.setsockopt
call dword [sym.imp.MSVCR120.dll_perror]
add esp, 4
pop edi
mov ecx, dword [esp + 0x20]
pop esi
pop ebx
xor ecx, esp
call fcn.100bf100
add esp, 0x1c
ret

Function at 0x1005c230
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0x20]
cmp dword [esi + 0x28], 0
jg 0x1005c245
cmp dword [esi + 0x2c], 0
jle 0x1005c290
mov eax, 0x10624dd3
imul dword [esi + 0x34]
imul eax, dword [esi + 0x30], 0x3e8
push 4
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, eax
lea eax, [esp + 0x10]
push eax
push 0x1006
push 0xffff
push dword [edi + 0x1c]
mov dword [esp + 0x20], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1005c290
push str.setsockopt
call dword [sym.imp.MSVCR120.dll_perror]
add esp, 4
pop edi
pop esi
ret
Function at 0x1005dab0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
xor esi, esi
call sym.LIBEAY32.dll_i2d_X509_PKEY
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x1005db08
push str.RANDFILE
call dword [sym.imp.MSVCR120.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x1005db08
cmp byte [esi], 0
je 0x1005db08
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005dae0
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, edi
jae 0x1005db08
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call sym.LIBEAY32.dll_BUF_strlcpy
add esp, 0xc
cmp eax, edi
jb 0x1005db79
pop edi
xor eax, eax
pop esi
ret
call sym.LIBEAY32.dll_i2d_X509_PKEY
test eax, eax
jne 0x1005db21
push str.HOME
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
mov esi, eax
test esi, esi
jne 0x1005db2c
mov esi, 0x100d16a4
jmp 0x1005db31
cmp byte [esi], 0
je 0x1005db72
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005db36
sub ecx, edx
lea eax, [ecx + 6]
cmp eax, edi
jae 0x1005db72
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call sym.LIBEAY32.dll_BUF_strlcpy
push edi
push 0x100ca910
push esi
call sym.LIBEAY32.dll_BUF_strlcat
push edi
push str..rnd
push esi
call sym.LIBEAY32.dll_BUF_strlcat
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
mov esi, dword [esp + 0xc]
mov byte [esi], 0
pop edi
mov eax, esi
pop esi
ret

Function at 0x1005db80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.100bf140
mov eax, dword [0x10116cb0]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x40], ebx
test edi, edi
jne 0x1005dbc5
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.100bf100
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push edi
call dword [sym.imp.MSVCR120.dll__stat64i32]
add esp, 8
test eax, eax
js 0x1005dbae
mov eax, 8
call fcn.100bf140
xorps xmm0, xmm0
lea eax, [esp + 0x50]
movsd qword [esp], xmm0
push 0x30
push eax
call sym.LIBEAY32.dll_RAND_add
mov esi, dword [ebp + 0xc]
add esp, 0x10
test esi, esi
je 0x1005dbae
push 0x100d1688
push edi
call dword [sym.imp.MSVCR120.dll_fopen]
add esp, 8
mov dword [esp + 0x44], eax
test eax, eax
je 0x1005dca3
jmp 0x1005dc20
mov edi, 0x400
test esi, esi
jle 0x1005dc2e
cmp esi, edi
cmovl edi, esi
push eax
push edi
lea eax, [esp + 0x80]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x1005dc83
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.100bf140
lea eax, [esp + 0x80]
movsd qword [esp], xmm0
push edi
push eax
call sym.LIBEAY32.dll_RAND_add
add dword [esp + 0x50], ebx
add esp, 0x10
mov eax, dword [esp + 0x44]
test esi, esi
jle 0x1005dc20
sub esi, edi
test esi, esi
jg 0x1005dc20
push dword [esp + 0x44]
call dword [sym.imp.MSVCR120.dll_fclose]
lea eax, [esp + 0x7c]
push 0x400
push eax
call sym.LIBEAY32.dll_OPENSSL_cleanse
mov ebx, dword [esp + 0x4c]
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100bf100
mov esp, ebp
pop ebp
ret
Function at 0x1005dcc0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x438
call fcn.100bf140
mov eax, dword [0x10116cb0]
xor eax, esp
mov dword [esp + 0x434], eax
push ebx
mov ebx, dword [esp + 0x440]
lea eax, [esp + 8]
push ebp
push esi
push edi
push eax
xor esi, esi
xor edi, edi
push ebx
mov dword [esp + 0x18], esi
call dword [sym.imp.MSVCR120.dll__stat64i32]
push 0x180
push 0x8101
push ebx
call dword [sym.imp.MSVCR120.dll__open]
add esp, 0x14
cmp eax, 0xffffffff
je 0x1005dd25
push 0x100d168c
push eax
call dword [sym.imp.MSVCR120.dll__fdopen]
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x1005dd3e
push 0x100d168c
push ebx
call dword [sym.imp.MSVCR120.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x1005ddc3
push 0x180
push ebx
call dword [sym.imp.MSVCR120.dll__chmod]
mov ebx, 0x400
add esp, 8
mov ecx, ebx
cmp ebx, 0x400
lea eax, [esp + 0x44]
mov esi, ebx
cmovg esi, ecx
sub ebx, 0x400
push esi
push eax
call sym.LIBEAY32.dll_RAND_bytes
mov ecx, dword [esp + 0x18]
test eax, eax
push ebp
mov eax, 1
push esi
cmovle ecx, eax
push eax
lea eax, [esp + 0x58]
mov dword [esp + 0x24], ecx
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x18
test eax, eax
jle 0x1005dda4
add edi, eax
test ebx, ebx
jle 0x1005dda6
mov ecx, 0x400
jmp 0x1005dd54
xor edi, edi
push ebp
call dword [sym.imp.MSVCR120.dll_fclose]
lea eax, [esp + 0x48]
push 0x400
push eax
call sym.LIBEAY32.dll_OPENSSL_cleanse
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x444]
or eax, 0xffffffff
test esi, esi
cmovne edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100bf100
add esp, 0x438
ret
Function at 0x1005ec20
Capabilities:
Capture screenshot

Disassembly:
call sym.LIBEAY32.dll_RAND_poll
jmp fcn.1005ec30

Function at 0x1005ec30
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x74
call fcn.100bf140
mov eax, dword [0x10116cb0]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
call sym.LIBEAY32.dll_OPENSSL_isservice
test eax, eax
jg 0x1005eda2
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov edi, eax
push edi
mov dword [esp + 0x3c], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 8
push edi
mov dword [esp + 0x44], ebx
call esi
push 0xa
push edi
mov dword [esp + 0x4c], eax
call esi
push 0x10
push dword [esp + 0x48]
mov dword [esp + 0x48], eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push ebx
mov dword [esp + 0x50], esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x50]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectA]
movzx ebx, word [esp + 0x60]
imul ebx, dword [esp + 0x58]
push 0x2cf
push str..crypto_rand_rand_win.c
imul ebx, dword [esp + 0x64]
push ebx
call sym.LIBEAY32.dll_CRYPTO_malloc
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1005ed7d
mov eax, dword [esp + 0x40]
xor esi, esi
add eax, 0xfffffff0
test eax, eax
jle 0x1005ed74
lea ecx, [ecx]
push 0xcc0020
push esi
push 0
push dword [esp + 0x44]
push 0x10
push dword [esp + 0x58]
push 0
push 0
push dword [esp + 0x5c]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
push ebx
push dword [esp + 0x50]
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
call sym.LIBEAY32.dll_EVP_sha1
push eax
push 0
lea eax, [esp + 0x74]
push eax
push ebx
push edi
call sym.LIBEAY32.dll_EVP_Digest
add esp, 0x18
mov eax, 8
call fcn.100bf140
xorps xmm0, xmm0
lea eax, [esp + 0x70]
movsd qword [esp], xmm0
push 0x14
push eax
call sym.LIBEAY32.dll_RAND_add
mov eax, dword [esp + 0x50]
add esi, 0x10
add eax, 0xfffffff0
add esp, 0x10
cmp esi, eax
jl 0x1005ed00
push edi
call sym.LIBEAY32.dll_CRYPTO_free
add esp, 4
push dword [esp + 0x4c]
mov ebx, dword [esp + 0x40]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call esi
push dword [esp + 0x38]
call esi
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100bf100
mov esp, ebp
pop ebp
ret
Function at 0x10062b20
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x10062c0c
push edi
mov edi, dword [esp + 0x14]
inc edi
lea ebx, [ebx]
movzx edx, byte [edi - 1]
cmp esi, 3
jl 0x10062b9e
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and ecx, 0x3f
and edx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
jmp 0x10062bef
shl edx, 0x10
cmp esi, 2
jne 0x10062bae
movzx ecx, byte [edi]
shl ecx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x10062bdb
lea ecx, [esi + 0x3c]
jmp 0x10062be8
shr edx, 6
and edx, 0x3f
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
sub esi, 3
add eax, 4
add ebx, 4
add edi, 3
test esi, esi
jg 0x10062b40
pop edi
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
ret
mov byte [eax], bl
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x100685d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
call fcn.100bf140
mov eax, dword [0x10116cb0]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push ebx
mov dword [esp + 4], eax
xor ebx, ebx
mov eax, dword [esp + 0x7c]
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [eax], ebx
lea eax, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x8c]
push eax
call sym.LIBEAY32.dll_EVP_MD_CTX_init
lea eax, [esp + 0x24]
push ebp
push eax
call sym.LIBEAY32.dll_EVP_MD_CTX_copy_ex
add esp, 0xc
test eax, eax
je 0x100686d2
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
push eax
call sym.LIBEAY32.dll_EVP_DigestFinal_ex
add esp, 0xc
test eax, eax
je 0x100686d2
lea eax, [esp + 0x20]
push eax
call sym.LIBEAY32.dll_EVP_MD_CTX_cleanup
mov esi, dword [ebp]
add esp, 4
test byte [esi + 0xc], 4
je 0x100686f0
push edi
call sym.LIBEAY32.dll_EVP_PKEY_size
push ebx
push edi
mov dword [esp + 0x28], eax
call sym.LIBEAY32.dll_EVP_PKEY_CTX_new
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100686d2
push esi
call sym.LIBEAY32.dll_EVP_PKEY_sign_init
add esp, 4
test eax, eax
jle 0x100686d2
push dword [ebp]
push ebx
push 1
push pe_nt_image_headers32
push 0xffffffffffffffff
push esi
call sym.LIBEAY32.dll_EVP_PKEY_CTX_ctrl
add esp, 0x18
test eax, eax
jle 0x100686d2
push dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push esi
call sym.LIBEAY32.dll_EVP_PKEY_sign
add esp, 0x14
test eax, eax
jle 0x100686d2
mov ecx, dword [esp + 0x18]
mov ebx, 1
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
push esi
call sym.LIBEAY32.dll_EVP_PKEY_CTX_free
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.100bf100
add esp, 0x6c
ret
xor eax, eax
lea ecx, [esi + 0x2c]
mov edx, dword [ecx]
test edx, edx
je 0x10068708
cmp dword [edi], edx
je 0x10068732
inc eax
add ecx, 4
cmp eax, 4
jl 0x100686f5
push 0x7b
push str..cryptoevpp_sign.c
push 0x6e
push 0x6b
push 6
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.100bf100
add esp, 0x6c
ret
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x10068766
push 0x80
push str..cryptoevpp_sign.c
push 0x68
push 0x6b
push 6
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.100bf100
add esp, 0x6c
ret
push dword [edi + 0x14]
mov ecx, dword [esp + 0x1c]
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x44]
push dword [esp + 0x20]
push ecx
push dword [esi]
call eax
mov ecx, dword [esp + 0x90]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100bf100
add esp, 0x6c
ret
Function at 0x1009a410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
call 0xf9672c66
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
invalid
arpl sp, di

Function at 0x1009a4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1009a0b5
push eax
push esi
push dword [ebp + 8]
call fcn.1009a06a
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1009a0b5
push eax
push esi
push dword [ebp + 8]
call fcn.1009a06a
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1009a0a5
inc ebp
push es
ret

Function at 0x1009a540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a

Function at 0x1009a730
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1009a759
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1009a754
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1009a73e
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add byte [ebx + 0x34572bd6], cl
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1009a746
cmp edx, ebx
jne 0x1009a894
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1009a715
add eax, dword [eax + 4]
jmp 0x1009a702
mov dword [ebp + 0xc], ebx
jmp 0x1009a764
Function at 0x1009a7c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1009a77c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1009a79a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1009a7f8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
add byte [eax - 0x77], al
jge 0x1009a7d7
add byte [eax], al
add byte [eax - 0x77], al
jge 0x1009a7d7
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1009a7df
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1009a7e8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1009a7f2
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1009a7d4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1009a75e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1009a845
dec eax
je 0x1009a83c
sub eax, 3
je 0x1009a833
mov dword [ebp - 4], 0x40
jmp 0x1009a862
mov dword [ebp - 4], 4
jmp 0x1009a848
mov dword [ebp - 4], 0x20
jmp 0x1009a848
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1009a894
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1009a814
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1009a0a5
jb 0x1009a8c2
cmp dword [ebp + 0x6a1475ff], ebx
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x1009a8a0
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cld
invalid
Function at 0x100a5500
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.100bf140
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x100a551a
xor eax, eax
pop edi
add esp, 0xc
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x100a55bb
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x100a5588
lea eax, [esp + 0xc]
mov dword [esp + 0x10], edi
push eax
push dword [ebx + 8]
mov dword [esp + 0x14], esi
call sym.LIBEAY32.dll_lh_retrieve
add esp, 8
test eax, eax
jne 0x100a55a8
mov eax, 0x100ef1c4
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x100a5571
test cl, cl
je 0x100a556d
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x100a5571
add esi, 2
add eax, 2
test cl, cl
jne 0x100a5551
xor eax, eax
jmp 0x100a5576
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100a5588
push edi
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
test eax, eax
jne 0x100a55ab
lea eax, [esp + 0xc]
mov dword [esp + 0xc], str.default
push eax
push dword [ebx + 8]
mov dword [esp + 0x18], edi
call sym.LIBEAY32.dll_lh_retrieve
add esp, 8
test eax, eax
je 0x100a55b2
mov eax, dword [eax + 8]
pop esi
pop ebx
pop edi
add esp, 0xc
ret
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0xc
ret
push edi
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
pop ebx
pop edi
add esp, 0xc
ret

Function at 0x100a6630
Capabilities:
Query environment variable

Disassembly:
push str.OPENSSL_CONF
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
test eax, eax
je 0x100a664c
push eax
call sym.LIBEAY32.dll_BUF_strdup
add esp, 4
ret
call sym.LIBEAY32.dll_X509_get_default_cert_area
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100a6654
push esi
push edi
sub eax, edx
push 0x21b
push str..cryptoconfconf_mod.c
lea edi, [eax + 0xd]
push edi
call sym.LIBEAY32.dll_CRYPTO_malloc
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100a667e
pop edi
pop esi
ret
push edi
call sym.LIBEAY32.dll_X509_get_default_cert_area
push eax
push esi
call sym.LIBEAY32.dll_BUF_strlcpy
push edi
push 0x100ca910
push esi
call sym.LIBEAY32.dll_BUF_strlcat
push edi
push str.openssl.cnf
push esi
call sym.LIBEAY32.dll_BUF_strlcat
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
Function at 0x100aeae0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x100aeb05
push 0x149
push str..cryptoengineeng_list.c
push 0x43
push 0x6a
push 0x26
call sym.LIBEAY32.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop ebx
ret
push esi
push edi
push 0x14c
push str..cryptoengineeng_list.c
push 0x1e
push 9
call sym.LIBEAY32.dll_CRYPTO_lock
mov esi, dword [0x10118d9c]
add esp, 0x10
test esi, esi
je 0x100aeb88
mov ecx, dword [esi]
mov eax, ebx
jmp 0x100aeb30
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100aeb50
test dl, dl
je 0x100aeb4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100aeb50
add eax, 2
add ecx, 2
test dl, dl
jne 0x100aeb30
xor eax, eax
jmp 0x100aeb55
sbb eax, eax
or eax, 1
test eax, eax
je 0x100aeb62
mov esi, dword [esi + 0x6c]
test esi, esi
jne 0x100aeb27
jmp 0x100aeb88
test byte [esi + 0x54], 4
je 0x100aeb85
call sym.LIBEAY32.dll_ENGINE_new
mov edi, eax
test edi, edi
jne 0x100aeb77
xor esi, esi
jmp 0x100aeb88
push esi
push edi
call fcn.100aeee0
add esp, 8
mov esi, edi
jmp 0x100aeb88
inc dword [esi + 0x58]
push 0x163
push str..cryptoengineeng_list.c
push 0x1e
push 0xa
call sym.LIBEAY32.dll_CRYPTO_lock
add esp, 0x10
test esi, esi
jne 0x100aec77
mov ecx, str.dynamic
mov eax, ebx
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100aebd0
test dl, dl
je 0x100aebcc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100aebd0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100aebb0
xor eax, eax
jmp 0x100aebd5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100aec7d
push str.OPENSSL_ENGINES
call dword [sym.imp.MSVCR120.dll_getenv]
test eax, eax
mov edi, str.c:users_rbarbh1_appdatalocal_tempopenssl_tempwin32releasedllsharedopenssloutput_ssl_lib_engines
push str.dynamic
cmovne edi, eax
call sym.LIBEAY32.dll_ENGINE_by_id
mov esi, eax
add esp, 8
test esi, esi
je 0x100aec7d
push 0
push ebx
push 0x100f1318
push esi
call sym.LIBEAY32.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100aec7d
push 0
push 0x100c1a34
push str.DIR_LOAD
push esi
call sym.LIBEAY32.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100aec7d
push 0
push edi
push str.DIR_ADD
push esi
call sym.LIBEAY32.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100aec7d
push 0
push 0x100f1330
push str.LIST_ADD
push esi
call sym.LIBEAY32.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100aec7d
push 0
push 0
push str.LOAD
push esi
call sym.LIBEAY32.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100aec7d
pop edi
mov eax, esi
pop esi
pop ebx
ret
push esi
call sym.LIBEAY32.dll_ENGINE_free
push 0x185
push str..cryptoengineeng_list.c
push 0x74
push 0x6a
push 0x26
call sym.LIBEAY32.dll_ERR_put_error
push ebx
push 0x100f1348
push 2
call sym.LIBEAY32.dll_ERR_add_error_data
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
ret