joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10047000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.10045488
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.100453e9
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x100473f0

Function at 0x10047500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x1004751e
test cl, bh
push es
add byte [eax], al
call fcn.1004543d
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x10047519
jmp 0x1004751e
jmp 0x10046e1a

Function at 0x1004d470
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x1004d502
push 0x7a
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call sym.LIBEAY32_smt.dll_ERR_put_error
push 0x100c5a6c
push esi
push 0x100c5a68
push ebx
push str.fopen_
push 5
call sym.LIBEAY32_smt.dll_ERR_add_error_data
add esp, 0x2c
call dword [sym.imp.MSVCRT.dll__errno]
cmp dword [eax], 2
jne 0x1004d4e7
push 0x7d
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call sym.LIBEAY32_smt.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x7f
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call sym.LIBEAY32_smt.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x100f38f0
call sym.LIBEAY32_smt.dll_BIO_new
mov esi, eax
add esp, 4
test esi, esi
jne 0x1004d525
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x8000
push esi
call sym.LIBEAY32_smt.dll_BIO_clear_flags
push edi
push 1
push 0x6a
push esi
call sym.LIBEAY32_smt.dll_BIO_ctrl
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x100509b0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov eax, 0x14
call fcn.100b1990
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], 1
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
lea edx, [esp + 0x14]
movsx eax, byte [edi]
mov ebp, dword [esp + 0x2c]
inc edi
cmp eax, 0x30
jl 0x10050a11
cmp eax, 0x39
jg 0x10050a11
mov ecx, dword [edx]
mov esi, 1
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*2 - 0x30]
cmp eax, 0xff
mov dword [edx], eax
ja 0x10050adc
jmp 0x100509e2
cmp eax, 0x2e
jne 0x10050a2f
test esi, esi
je 0x10050ae0
cmp ebx, 3
je 0x10050adc
inc ebx
add edx, 4
xor esi, esi
jmp 0x100509e2
test eax, eax
jne 0x10050adc
cmp ebx, 3
jne 0x10050adc
test esi, esi
je 0x10050adc
mov dl, byte [esp + 0x14]
mov al, byte [esp + 0x18]
mov cl, byte [esp + 0x1c]
mov byte [ebp], dl
mov dl, byte [esp + 0x20]
mov byte [ebp + 1], al
mov byte [ebp + 2], cl
mov byte [ebp + 3], dl
mov esi, 1
mov eax, dword [0x10100110]
test eax, eax
jne 0x10050afa
mov ecx, 0x64
xor eax, eax
mov edi, 0x100fff80
push 0x100fff80
rep stosd dword es:[edi], eax
push 0x101
mov dword [0x10100110], 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x10050afa
call sub.WS2_32.dll_WSAGetLastError
push 0x1d3
push str..crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.LIBEAY32_smt.dll_ERR_put_error
push 0x1d4
push str..crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.LIBEAY32_smt.dll_ERR_put_error
add esp, 0x28
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor esi, esi
jmp 0x10050a69
push 0x75
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call sym.LIBEAY32_smt.dll_ERR_put_error
add esp, 0x14
jmp 0x10050b9c
test esi, esi
jg 0x10050bba
push 0x83
push str..crypto_bio_b_sock.c
push 0x16
push 9
call sym.LIBEAY32_smt.dll_CRYPTO_lock
mov eax, dword [esp + 0x38]
add esp, 0x10
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x10050b40
push 0x88
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call sym.LIBEAY32_smt.dll_ERR_put_error
add esp, 0x14
jmp 0x10050b7e
cmp word [eax + 8], 2
je 0x10050b61
push 0x8f
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call sym.LIBEAY32_smt.dll_ERR_put_error
add esp, 0x14
jmp 0x10050b7e
xor ecx, ecx
mov edx, dword [eax + 0xc]
inc ecx
cmp ecx, 4
mov edx, dword [edx]
mov dl, byte [edx + ecx - 1]
mov byte [ecx + ebp - 1], dl
jl 0x10050b63
mov dword [esp + 0x10], 0
push 0x98
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call sym.LIBEAY32_smt.dll_CRYPTO_lock
mov eax, dword [esp + 0x20]
add esp, 0x10
test eax, eax
je 0x10050bba
mov eax, dword [esp + 0x28]
push eax
push 0x100c5ac8
push 2
call sym.LIBEAY32_smt.dll_ERR_add_error_data
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x10050ef0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x10100110]
test eax, eax
jne 0x10050f5b
push edi
mov ecx, 0x64
xor eax, eax
mov edi, 0x100fff80
push 0x100fff80
push 0x101
rep stosd dword es:[edi], eax
mov dword [0x10100110], 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
pop edi
je 0x10050f5b
call sub.WS2_32.dll_WSAGetLastError
push 0x1d3
push str..crypto_bio_b_sock.c
push eax
push 9
push 2
call sym.LIBEAY32_smt.dll_ERR_put_error
push 0x1d4
push str..crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call sym.LIBEAY32_smt.dll_ERR_put_error
add esp, 0x28
or eax, 0xffffffff
ret
mov eax, 1
ret

Function at 0x10050f90
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push eax
push ecx
push edx
call sub.WS2_32.dll_ioctlsocket
mov esi, eax
test esi, esi
jge 0x10050fc7
push 0x21b
push str..crypto_bio_b_sock.c
call sub.WS2_32.dll_WSAGetLastError
push eax
push 5
push 2
call sym.LIBEAY32_smt.dll_ERR_put_error
add esp, 0x14
mov eax, esi
pop esi
ret
Function at 0x10051550
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
lea ecx, [esp + 8]
push esi
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call sub.WS2_32.dll_ioctlsocket
mov esi, eax
test esi, esi
jge 0x1005158f
push 0x21b
push str..crypto_bio_b_sock.c
call sub.WS2_32.dll_WSAGetLastError
push eax
push 5
push 2
call sym.LIBEAY32_smt.dll_ERR_put_error
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret

Function at 0x10053b50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x10053bb1
mov al, byte [edi]
test al, al
je 0x10053bb1
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x10053b69
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x10054720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x430
call fcn.100b1990
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
mov dword [esp + 0xc], 0
jne 0x1005474b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.MSVCRT.dll__stat]
push 0
push 0
lea ecx, [esp + 0x28]
push 0x24
push ecx
mov edi, eax
call sym.LIBEAY32_smt.dll_RAND_add
add esp, 0x18
test edi, edi
jge 0x10054779
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x10054789
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100c6064
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x1005481e
jmp 0x100547a6
mov eax, dword [esp + 0x10]
test ebx, ebx
jle 0x100547b4
cmp ebx, 0x400
mov esi, ebx
jl 0x100547b9
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x44]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
mov dword [esp + 0x14], edi
jle 0x10054801
fild dword [esp + 0x14]
sub esp, 8
lea eax, [esp + 0x44]
fstp qword [esp]
push esi
push eax
call sym.LIBEAY32_smt.dll_RAND_add
mov ecx, dword [esp + 0x1c]
add esp, 0x10
add ecx, edi
test ebx, ebx
mov dword [esp + 0xc], ecx
jle 0x100547a2
sub ebx, esi
test ebx, ebx
jg 0x100547a2
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
lea edx, [esp + 0x40]
push 0x400
push edx
call sym.LIBEAY32_smt.dll_OPENSSL_cleanse
add esp, 0xc
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10054830
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x42c
call fcn.100b1990
push ebx
push esi
mov esi, dword [esp + 0x438]
lea eax, [esp + 0x10]
push edi
xor edi, edi
push eax
push esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.MSVCRT.dll__stat]
push 0x100c6068
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 0x10
cmp ebx, edi
je 0x10054916
push ebp
push 0x180
push esi
call dword [sym.imp.MSVCRT.dll__chmod]
mov ebp, dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 8
mov edi, 0x400
cmp edi, 0x400
mov esi, 0x400
jg 0x1005489d
mov esi, edi
lea ecx, [esp + 0x3c]
push esi
push ecx
sub edi, 0x400
call sym.LIBEAY32_smt.dll_RAND_bytes
add esp, 8
test eax, eax
jg 0x100548bd
mov dword [esp + 0x14], 1
push ebx
push esi
lea edx, [esp + 0x44]
push 1
push edx
call ebp
add esp, 0x10
test eax, eax
jle 0x100548df
mov ecx, dword [esp + 0x10]
add ecx, eax
test edi, edi
mov dword [esp + 0x10], ecx
jle 0x100548e7
jmp 0x1005488e
mov dword [esp + 0x10], 0
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
lea eax, [esp + 0x40]
push 0x400
push eax
call sym.LIBEAY32_smt.dll_OPENSSL_cleanse
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
pop ebp
je 0x10054916
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x42c
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x42c
ret
Function at 0x10054930
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push esi
push edi
xor esi, esi
call sym.LIBEAY32_smt.dll_i2d_X509_PKEY
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.MSVCRT.dll_getenv]
test eax, eax
jne 0x10054987
push str.RANDFILE
call ebp
mov esi, eax
add esp, 4
test esi, esi
je 0x10054987
cmp byte [esi], 0
je 0x10054987
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, ebx
jae 0x10054987
push ebx
push esi
mov esi, dword [esp + 0x1c]
push esi
call sym.LIBEAY32_smt.dll_BUF_strlcpy
add esp, 0xc
cmp eax, ebx
jb 0x100549f7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
call sym.LIBEAY32_smt.dll_i2d_X509_PKEY
test eax, eax
jne 0x1005499c
push str.HOME
call ebp
add esp, 4
mov esi, eax
test esi, esi
jne 0x100549ab
mov esi, 0x100c6074
mov eax, esi
test eax, eax
je 0x100549f0
cmp byte [esi], 0
je 0x100549f0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 5
cmp ecx, ebx
jae 0x100549f0
push ebx
push esi
mov esi, dword [esp + 0x1c]
push esi
call sym.LIBEAY32_smt.dll_BUF_strlcpy
push ebx
push 0x100bdb98
push esi
call sym.LIBEAY32_smt.dll_BUF_strlcat
push ebx
push str..rnd
push esi
call sym.LIBEAY32_smt.dll_BUF_strlcat
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esp + 0x14]
mov byte [esi], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100555e0
Capabilities:
Capture screenshot

Disassembly:
mov eax, 0x40
call fcn.100b1990
call sym.LIBEAY32_smt.dll_RAND_poll
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10055743
call fcn.10001d30
test eax, eax
je 0x10055743
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 8
push edi
mov dword [esp + 0x18], ebx
call esi
mov ebp, eax
push 0xa
push edi
mov dword [esp + 0x20], ebp
call esi
push 0x10
push ebp
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push ebx
mov dword [esp + 0x24], esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x38]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectA]
mov esi, dword [esp + 0x48]
push 0x2d5
and esi, 0xffff
push str..crypto_rand_rand_win.c
imul esi, dword [esp + 0x48]
imul esi, dword [esp + 0x4c]
push esi
call sym.LIBEAY32_smt.dll_CRYPTO_malloc
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x10055720
mov ecx, dword [esp + 0x14]
xor ebx, ebx
lea eax, [ecx - 0x10]
test eax, eax
mov dword [esp + 0x14], eax
jle 0x10055713
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push 0xcc0020
push ebx
push 0
push edi
push 0x10
push edx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x1c]
push ebp
push esi
push ecx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
call sym.LIBEAY32_smt.dll_EVP_sha1
push eax
lea edx, [esp + 0x2c]
push 0
push edx
push esi
push ebp
call sym.LIBEAY32_smt.dll_EVP_Digest
push 0
push 0
lea eax, [esp + 0x44]
push 0x14
push eax
call sym.LIBEAY32_smt.dll_RAND_add
mov eax, dword [esp + 0x3c]
add ebx, 0x10
add esp, 0x28
cmp ebx, eax
jl 0x100556b3
push ebp
call sym.LIBEAY32_smt.dll_CRYPTO_free
mov ebx, dword [esp + 0x14]
add esp, 4
mov ecx, dword [esp + 0x20]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call esi
push edi
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x10059510
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x100595f6
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x10059583
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x100595da
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x10059596
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x100595c6
mov ebx, 0x3d
jmp 0x100595d4
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x1005952a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x10061690
Capabilities:
Encode data using xor

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.100b1990
push ebx
push ebp
push esi
lea eax, [esp + 0x2c]
push edi
push eax
mov ebx, 1
call sym.LIBEAY32_smt.dll_HMAC_CTX_init
mov esi, dword [esp + 0xf0]
mov ecx, dword [esp + 0x108]
mov ebp, dword [esp + 0x104]
add esp, 4
test esi, esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebp
jne 0x100616da
mov dword [esp + 0xf0], esi
jmp 0x100616f8
mov eax, dword [esp + 0xf0]
or ecx, 0xffffffff
cmp eax, ecx
jne 0x100616f8
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xf0], ecx
test ebp, ebp
je 0x1006181c
jmp 0x1006170d
mov esi, dword [esp + 0xec]
mov ebp, dword [esp + 0x18]
cmp ebp, 0x14
jle 0x10061717
mov ebp, 0x14
mov edx, ebx
mov eax, ebx
mov ecx, ebx
push 0
shr edx, 0x18
shr eax, 0x10
shr ecx, 8
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], al
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], bl
call sym.LIBEAY32_smt.dll_EVP_sha1
mov edx, dword [esp + 0xf4]
push eax
push edx
lea eax, [esp + 0x3c]
push esi
push eax
call sym.LIBEAY32_smt.dll_HMAC_Init_ex
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x108]
push ecx
lea eax, [esp + 0x48]
push edx
push eax
call sym.LIBEAY32_smt.dll_HMAC_Update
lea ecx, [esp + 0x30]
push 4
lea edx, [esp + 0x54]
push ecx
push edx
call sym.LIBEAY32_smt.dll_HMAC_Update
lea eax, [esp + 0x48]
push 0
lea ecx, [esp + 0x60]
push eax
push ecx
call sym.LIBEAY32_smt.dll_HMAC_Final
mov edi, dword [esp + 0x4c]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x54]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x134]
mov ecx, edx
add esp, 0x38
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jle 0x100617ff
lea edi, [eax - 1]
mov edx, dword [esp + 0xf0]
lea eax, [esp + 0x1c]
push 0
push eax
mov eax, dword [esp + 0xf4]
lea ecx, [esp + 0x24]
push 0x14
push ecx
push edx
push eax
call sym.LIBEAY32_smt.dll_EVP_sha1
push eax
call sym.LIBEAY32_smt.dll_HMAC
add esp, 0x1c
test ebp, ebp
jle 0x100617fc
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
sub ecx, eax
mov esi, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x100617f3
dec edi
jne 0x100617b7
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
sub eax, ebp
inc ebx
add edx, ebp
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x14], edx
jne 0x10061702
lea eax, [esp + 0x30]
push eax
call sym.LIBEAY32_smt.dll_HMAC_CTX_cleanup
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd8
ret
Function at 0x1008eb40
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.100b1990
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push edi
test ebp, ebp
jne 0x1008eb5e
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x1008ec0c
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1008ebdd
mov ecx, dword [ebx + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], edi
call sym.LIBEAY32_smt.dll_lh_retrieve
add esp, 8
test eax, eax
je 0x1008eb99
mov eax, dword [eax + 8]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
mov esi, 0x100d4404
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1008ebc5
test cl, cl
je 0x1008ebc1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1008ebc5
add eax, 2
add esi, 2
test cl, cl
jne 0x1008eba1
xor eax, eax
jmp 0x1008ebca
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop esi
jne 0x1008ebdd
push ebp
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
jne 0x1008ec16
mov ecx, dword [ebx + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebp
call sym.LIBEAY32_smt.dll_lh_retrieve
add esp, 8
test eax, eax
je 0x1008eb55
mov eax, dword [eax + 8]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push ebp
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x100909c0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push str.OPENSSL_CONF
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x100909e0
push eax
call sym.LIBEAY32_smt.dll_BUF_strdup
add esp, 4
pop edi
pop esi
ret
call sym.LIBEAY32_smt.dll_X509_get_default_cert_area
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x230
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xb
push str..cryptoconfconf_mod.c
lea edi, [ecx + 1]
push edi
call sym.LIBEAY32_smt.dll_CRYPTO_malloc
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10090a12
pop edi
pop esi
ret
push edi
call sym.LIBEAY32_smt.dll_X509_get_default_cert_area
push eax
push esi
call sym.LIBEAY32_smt.dll_BUF_strlcpy
push edi
push 0x100bdb98
push esi
call sym.LIBEAY32_smt.dll_BUF_strlcat
push edi
push str.openssl.cnf
push esi
call sym.LIBEAY32_smt.dll_BUF_strlcat
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret

Function at 0x10090b50
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x10101cf0]
test eax, eax
jne 0x10090bbc
call sym.LIBEAY32_smt.dll_OPENSSL_load_builtin_modules
call sym.LIBEAY32_smt.dll_ENGINE_load_builtin_engines
call sym.LIBEAY32_smt.dll_ERR_clear_error
push 0x10
push 0
push 0
call sym.LIBEAY32_smt.dll_CONF_modules_load_file
add esp, 0xc
test eax, eax
jg 0x10090bbc
push esi
call sym.LIBEAY32_smt.dll_ERR_load_crypto_strings
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push 0
add eax, 0x40
push eax
call sym.LIBEAY32_smt.dll_BIO_new_fp
mov esi, eax
add esp, 8
test esi, esi
je 0x10090bb3
push str.Auto_configuration_failed_n
push esi
call sym.LIBEAY32_smt.dll_BIO_printf
push esi
call sym.LIBEAY32_smt.dll_ERR_print_errors
push esi
call sym.LIBEAY32_smt.dll_BIO_free
add esp, 0x10
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
ret