joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002400
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x100024e4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1000247f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.10001fa0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1000244d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x1000259d
call fcn.10002491
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x1000253c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100020d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100024f5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x1000259d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100020d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x10002598
jmp 0x1000259d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10015f00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10015f1e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x10015f60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10015f7e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x10015fc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10015fe2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x10016040
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10016062
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x100160c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x100160ea
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x10016150
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1001617a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x100161e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
add ecx, 0x10
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm0, xmmword [edx + ecx - 0x10]
jmp fcn.1001625e

Function at 0x100162d0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
add ecx, 0x10
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm0, xmmword [edx + ecx - 0x10]
jmp fcn.1001634e
Function at 0x10017b50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x10017dfc
test edx, edx
je 0x10017dfc
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x10017d10
cmp ecx, 0xc0
je 0x10017c30
cmp ecx, 0x80
jne 0x10017e04
nop
nop
nop
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.10017c16
aeskeygenassist xmm1, xmm0, 2
call fcn.10017c10
aeskeygenassist xmm1, xmm0, 4
call fcn.10017c10
aeskeygenassist xmm1, xmm0, 8
call fcn.10017c10
aeskeygenassist xmm1, xmm0, 0x10
call fcn.10017c10
aeskeygenassist xmm1, xmm0, 0x20
call fcn.10017c10
aeskeygenassist xmm1, xmm0, 0x40
call fcn.10017c10
aeskeygenassist xmm1, xmm0, 0x80
call fcn.10017c10
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.10017c10
aeskeygenassist xmm1, xmm0, 0x36
call fcn.10017c10
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.10017cb0
aeskeygenassist xmm1, xmm2, 2
call fcn.10017cf0
aeskeygenassist xmm1, xmm2, 4
call fcn.10017ca0
aeskeygenassist xmm1, xmm2, 8
call fcn.10017cf0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.10017ca0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.10017cf0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.10017ca0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.10017cf0
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.10017dc6
aeskeygenassist xmm1, xmm0, 1
call fcn.10017de0
aeskeygenassist xmm1, xmm2, 2
call fcn.10017dc0
aeskeygenassist xmm1, xmm0, 2
call fcn.10017de0
aeskeygenassist xmm1, xmm2, 4
call fcn.10017dc0
aeskeygenassist xmm1, xmm0, 4
call fcn.10017de0
aeskeygenassist xmm1, xmm2, 8
call fcn.10017dc0
aeskeygenassist xmm1, xmm0, 8
call fcn.10017de0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.10017dc0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.10017de0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.10017dc0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.10017de0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.10017dc0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x10017e30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.10017b50
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x10017e99
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x10017e66
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret
Function at 0x10018760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x100187e4
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x100187bc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x100187c4
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.100187e9

Function at 0x10020990
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test byte [eax + 0x208], 1
je 0x100209b0
push eax
call fcn.100637d0
add esp, 4
test eax, eax
jne 0x100209ce
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x1b8]
cmp eax, 0xffffffff
je 0x100209ac
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x100209ac
mov al, 1
pop ebp
ret

Function at 0x100211c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1020ed50]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x10021211
push 3
push 2
push eax
push 6
call fcn.10050210
add esp, 0x10
test al, al
je 0x10021205
mov dword [0x1020ed50], 2
mov esp, ebp
pop ebp
ret
mov dword [0x1020ed50], 1
jmp 0x10021216
cmp eax, 2
je 0x10021256
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1002123d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x10021256
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x10021490
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x102096e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x90], 2
je 0x100216a4
mov eax, dword [esi + 0x294]
push ebx
push edi
test al, 2
jne 0x10021699
test eax, 0x8000000
jne 0x10021699
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x188]
mov ebx, dword [esi]
push eax
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], 0x80
push eax
push edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x10021532
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.1004f600
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.10047450
add esp, 0x1c
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10155c5f
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x104]
mov dword [ebp - 0x188], 0x80
push 0
push eax
call fcn.10157450
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100215a6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.1004f600
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.10047450
add esp, 0x1c
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10155c5f
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x138]
push eax
lea edi, [esi + 0x10a]
lea eax, [ebp - 0x184]
push edi
push eax
call fcn.10021c80
add esp, 0xc
test al, al
jne 0x10021609
call fcn.10160d33
mov esi, dword [eax]
call fcn.10160d33
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.1004f600
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10047450
add esp, 0x1c
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10155c5f
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x28]
movups xmmword [esi + 0x5c], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [esi + 0x6c], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [esi + 0x7c], xmm0
mov dword [esi + 0x84], eax
mov ax, word [edi + 0x2c]
mov word [esi + 0x88], ax
lea eax, [esi + 0x16c]
push eax
lea eax, [esi + 0x13c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.10021c80
add esp, 0xc
test al, al
jne 0x10021699
call fcn.10160d33
mov esi, dword [eax]
call fcn.10160d33
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
push esi
call fcn.1004f600
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10047450
add esp, 0x1c
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10155c5f
mov esp, ebp
pop ebp
ret
push esi
call fcn.100210e0
add esp, 4
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10155c5f
mov esp, ebp
pop ebp
ret
Function at 0x100220c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x102096e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 4
mov eax, dword [esi + 0xa90]
shr eax, 0xb
and eax, 1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1002211e
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.10047530
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10155c5f
mov esp, ebp
pop ebp
ret
push dword [esi + 0xa50]
mov dword [ebp - 0x10], 1
call fcn.1005bc70
push dword [esi + 0xa54]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.1005bc70
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1002218e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.10047530
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10155c5f
mov esp, ebp
pop ebp
ret

Function at 0x100221a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x102096e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 4
mov dword [ebp - 0x88], 1
mov esi, dword [eax]
lea eax, [ebp - 0x88]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10022213
push 0x80
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.1004f600
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.10047530
add esp, 0x18
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10155c5f
mov esp, ebp
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.10047530
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.10155c5f
mov esp, ebp
pop ebp
ret

Function at 0x10023b20
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x10023b69
mov al, byte [esi]
push eax
call fcn.1004f3f0
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x10023b47
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0x10024560
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x100246f4
push edi
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x100246e0
push esi
nop dword [eax]
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x100245af
mov eax, 0x10
jmp 0x100245bd
cmp eax, 0x17
jne 0x10024671
mov eax, 0x1c
cmp dword [edi + 0x18], 0
mov dword [ebp - 4], eax
je 0x10024671
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x10024671
cmp ecx, eax
jb 0x10024671
push 0x20
call dword [0x10204008]
mov esi, eax
add esp, 4
test esi, esi
je 0x100246d5
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x10204008]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x100246c4
push dword [ebp - 4]
push dword [edi + 0x18]
push eax
call fcn.101576e0
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x1002465f
push eax
call dword [0x10204014]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x100246aa
mov eax, dword [ebp - 8]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x1002466e
mov dword [eax + 0x1c], esi
mov dword [ebp - 8], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x100245a0
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
pop esi
test eax, eax
je 0x1002468e
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x100246dc
push ebx
call fcn.10024520
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x1020400c]
push esi
call dword [0x1020400c]
add esp, 8
jmp 0x1002467f
push esi
mov edi, 8
call dword [0x1020400c]
add esp, 4
jmp 0x1002467f
mov edi, 8
jmp 0x1002467f
test ebx, ebx
jne 0x100246ec
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100254f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x10025523
push 0x2e
push edi
call fcn.101575b0
add esp, 8
test eax, eax
je 0x10025521
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x100268a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.10170fa0
add esp, 0x18
test eax, eax
je 0x100268c2
cmp eax, 0xffffffff
jne 0x100268c4
xor eax, eax
pop ebp
ret
Function at 0x1002b340
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x102096e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x88], 0x80
push ecx
mov eax, dword [edi + 0x1bc]
or esi, 0xffffffff
mov ebx, dword [edi]
push eax
mov dword [ebp - 0x8c], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1002b3b3
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x8c]
push edi
call fcn.100208b0
add esp, 8
cmp esi, 0xffffffff
jne 0x1002b3eb
push str.Error_accept__ing_server_connect
push ebx
call fcn.10047450
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10155c5f
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.10047530
and dword [edi + 0x294], 0xfffff7ff
push 1
push esi
mov dword [edi + 0x1bc], esi
call fcn.10042830
add esp, 0x10
mov byte [edi + 0x1c9], 1
cmp dword [ebx + 0x608], 0
je 0x1002b46a
push 1
push ebx
call fcn.1003fb50
mov eax, dword [ebx + 0x608]
push 1
push esi
push dword [ebx + 0x60c]
call eax
push 0
push ebx
mov esi, eax
call fcn.1003fb50
add esp, 0x1c
test esi, esi
je 0x1002b46a
push edi
call fcn.1002b9e0
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10155c5f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10155c5f
mov esp, ebp
pop ebp
ret

Function at 0x1002d980
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x1002d9af
push str.Couldnt_set_desired_mode
push edx
call fcn.10047450
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x1002d9c6
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.10047530
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x1002d9dd
push edi
call fcn.1002d6e0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x1002d9f1
push edi
call fcn.1002c730
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x1002da05
push edi
call fcn.1002d6c0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x1002da15
push edi
call fcn.1002d860
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret