joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001984c
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edx, dword [ebp + 8]
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
xor ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
xor ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
xor ecx, eax
movzx eax, byte [edx + 4]
movzx esi, byte [edx + 5]
shl eax, 8
xor eax, esi
movzx esi, byte [edx + 6]
movzx edx, byte [edx + 7]
shl eax, 8
xor eax, esi
mov esi, dword [ebp + 0x14]
shl eax, 8
xor eax, edx
mov edx, esi
imul edx, edx, 0x9e3779b9
cmp dword [ebp + 0x18], 0
jne 0x100198f9
test esi, esi
jle 0x10019949
mov dword [ebp + 8], esi
mov esi, dword [ebp + 0x10]
mov edi, edx
shr edi, 0xb
and edi, 3
mov edi, dword [esi + edi*4]
add edi, edx
mov ebx, ecx
shr ebx, 5
add ebx, ecx
xor edi, ebx
mov ebx, ecx
shl ebx, 4
xor edi, ebx
sub eax, edi
add edx, 0x61c88647
mov edi, edx
and edi, 3
mov edi, dword [esi + edi*4]
mov ebx, eax
shr ebx, 5
add ebx, eax
add edi, edx
xor edi, ebx
mov ebx, eax
shl ebx, 4
xor edi, ebx
sub ecx, edi
dec dword [ebp + 8]
jne 0x100198b1
jmp 0x10019949
test esi, esi
jle 0x10019949
mov dword [ebp + 8], esi
mov esi, dword [ebp + 0x10]
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
mov ebx, edx
shr ebx, 0xb
and ebx, 3
mov ebx, dword [esi + ebx*4]
add ebx, edx
add edi, ecx
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
xor edi, ebx
add edx, 0x61c88647
mov ebx, edx
and ebx, 3
mov ebx, dword [esi + ebx*4]
add edi, eax
add ebx, edx
xor edi, ebx
sub ecx, edi
dec dword [ebp + 8]
jne 0x10019903
mov esi, dword [ebp + 0xc]
mov edx, ecx
shr edx, 0x18
mov byte [esi], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 3], cl
mov byte [esi + 1], dl
mov edx, ecx
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 5], cl
mov ecx, eax
shr edx, 8
shr ecx, 8
pop edi
mov byte [esi + 7], al
mov byte [esi + 2], dl
mov byte [esi + 6], cl
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10019988
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x34
pop eax
cdq
sar edi, 2
idiv edi
and dword [ebp + 0xc], 0
mov ebx, edi
shl ebx, 2
push ebx
mov dword [ebp - 0xc], edi
add eax, 6
mov dword [ebp - 8], eax
call fcn.1003e5a9
mov esi, eax
pop ecx
test esi, esi
jne 0x100199c4
or eax, 0xffffffff
jmp 0x10019afd
push ebx
push 0
push esi
call fcn.1003e4bd
and dword [ebp - 4], 0
add esp, 0xc
test edi, edi
jle 0x10019a0d
mov eax, dword [ebp + 8]
add eax, 2
movzx ecx, byte [eax - 2]
movzx edx, byte [eax - 1]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 1]
shl ecx, 8
xor ecx, edx
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
add eax, 4
cmp dword [ebp - 4], edi
mov dword [esi + edx*4], ecx
jl 0x100199de
lea ebx, [ebx + esi - 4]
mov edx, dword [ebx]
mov dword [ebp - 0x14], ebx
jmp 0x10019ab8
sub dword [ebp + 0xc], 0x61c88647
mov eax, dword [ebp + 0xc]
shr eax, 2
and eax, 3
mov dword [ebp - 0x10], eax
xor eax, eax
dec edi
test edi, edi
jle 0x10019a7b
mov ecx, dword [esi + eax*4 + 4]
mov edi, edx
shl edi, 4
mov ebx, ecx
shr ebx, 3
xor edi, ebx
shr edx, 5
mov ebx, ecx
xor ecx, dword [ebp + 0xc]
shl ebx, 2
xor edx, ebx
mov ebx, dword [ebp + 0x14]
add edi, edx
mov edx, eax
and edx, 3
xor edx, dword [ebp - 0x10]
mov edx, dword [ebx + edx*4]
xor edx, dword [ebp - 4]
add edx, ecx
mov ecx, dword [ebp - 0xc]
xor edi, edx
add dword [esi + eax*4], edi
mov edx, dword [esi + eax*4]
inc eax
dec ecx
cmp eax, ecx
mov dword [ebp - 4], edx
jl 0x10019a35
mov ecx, dword [esi]
mov edi, edx
shl edi, 4
mov ebx, ecx
shr ebx, 3
xor edi, ebx
shr edx, 5
mov ebx, ecx
xor ecx, dword [ebp + 0xc]
and eax, 3
xor eax, dword [ebp - 0x10]
shl ebx, 2
xor edx, ebx
add edi, edx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + eax*4]
xor eax, dword [ebp - 4]
add eax, ecx
xor edi, eax
mov eax, dword [ebp - 0x14]
add dword [eax], edi
mov edx, dword [eax]
dec dword [ebp - 8]
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 8], 0
mov dword [ebp - 4], edx
jg 0x10019a1b
xor edx, edx
test edi, edi
jle 0x10019af4
mov ecx, dword [ebp + 0x10]
add ecx, 2
lea eax, [esi + edx*4]
mov bl, byte [eax + 3]
mov byte [ecx - 2], bl
mov bl, byte [eax + 2]
mov byte [ecx - 1], bl
mov ebx, dword [eax]
shr ebx, 8
mov byte [ecx], bl
mov al, byte [eax]
mov byte [ecx + 1], al
inc edx
add ecx, 4
cmp edx, edi
jl 0x10019ad1
push esi
call fcn.1003e54d
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10019b02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x34
pop eax
cdq
sar edi, 2
idiv edi
mov dword [ebp - 0xc], edi
mov ebx, eax
add ebx, 6
imul ebx, ebx, 0x9e3779b9
mov eax, edi
shl eax, 2
push eax
mov dword [ebp - 4], ebx
call fcn.1003e5a9
mov esi, eax
pop ecx
test esi, esi
jne 0x10019b42
or eax, 0xffffffff
jmp 0x10019c71
mov eax, edi
shl eax, 2
push eax
push 0
push esi
call fcn.1003e4bd
and dword [ebp + 0xc], 0
add esp, 0xc
test edi, edi
jle 0x10019b90
mov eax, dword [ebp + 8]
add eax, 2
movzx ecx, byte [eax - 2]
movzx edx, byte [eax - 1]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 1]
shl ecx, 8
xor ecx, edx
mov edx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
add eax, 4
cmp dword [ebp + 0xc], edi
mov dword [esi + edx*4], ecx
jl 0x10019b61
mov ecx, dword [esi]
test ebx, ebx
je 0x10019c39
lea eax, [esi + edi*4 - 4]
mov dword [ebp - 8], eax
mov eax, ebx
shr eax, 2
and eax, 3
mov dword [ebp + 0xc], eax
lea eax, [edi - 1]
jmp 0x10019be8
mov edx, dword [esi + eax*4 - 4]
mov edi, edx
shl edi, 4
xor edi, ebx
shr edx, 5
mov ebx, ecx
xor ecx, dword [ebp - 4]
shl ebx, 2
xor edx, ebx
mov ebx, dword [ebp + 0x14]
add edi, edx
mov edx, eax
and edx, 3
xor edx, dword [ebp + 0xc]
mov edx, dword [ebx + edx*4]
xor edx, dword [esi + eax*4 - 4]
add edx, ecx
xor edi, edx
sub dword [esi + eax*4], edi
mov ecx, dword [esi + eax*4]
dec eax
mov ebx, ecx
shr ebx, 3
test eax, eax
jg 0x10019bb1
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov edi, edx
shl edi, 4
xor edi, ebx
mov ebx, ecx
shr edx, 5
shl ebx, 2
xor edx, ebx
mov ebx, dword [ebp - 4]
and eax, 3
xor eax, dword [ebp + 0xc]
add edi, edx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 8]
xor eax, dword [edx]
xor ecx, ebx
add eax, ecx
xor edi, eax
sub dword [esi], edi
mov ecx, dword [esi]
mov edi, dword [ebp - 0xc]
add ebx, 0x61c88647
mov dword [ebp - 4], ebx
jne 0x10019ba1
xor edx, edx
test edi, edi
jle 0x10019c68
mov ecx, dword [ebp + 0x10]
add ecx, 2
lea eax, [esi + edx*4]
mov bl, byte [eax + 3]
mov byte [ecx - 2], bl
mov bl, byte [eax + 2]
mov byte [ecx - 1], bl
mov ebx, dword [eax]
shr ebx, 8
mov byte [ecx], bl
mov al, byte [eax]
mov byte [ecx + 1], al
inc edx
add ecx, 4
cmp edx, edi
jl 0x10019c45
push esi
call fcn.1003e54d
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001da55
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
xor edi, edi
push 0x3c
lea eax, [ebp - 0x44]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x48], edi
call fcn.1003e4bd
mov eax, dword [esi]
mov dword [ebp - 4], eax
add esp, 0xc
and dword [ebp - 4], 0x3f
jbe 0x1001daa8
mov ecx, eax
and ecx, 0x3f
mov dword [ebp - 8], ecx
push ebx
movzx ebx, byte [esi + edi + 0xc]
mov ecx, edi
shr ecx, 2
lea edx, [ebp + ecx*4 - 0x48]
mov ecx, edi
and ecx, 3
shl ecx, 3
shl ebx, cl
xor dword [edx], ebx
inc edi
cmp edi, dword [ebp - 8]
jb 0x1001da87
pop ebx
mov ecx, eax
shr ecx, 2
and eax, 3
and ecx, 0xf
lea edx, [ebp + ecx*4 - 0x48]
lea ecx, [eax*8 + 7]
xor eax, eax
inc eax
shl eax, cl
xor dword [edx], eax
cmp dword [ebp - 4], 0x37
jbe 0x1001dae6
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.10011c0e
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.1003e4bd
add esp, 0xc
mov eax, dword [esi]
mov ecx, eax
shl ecx, 3
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 4]
shl ecx, 3
shr eax, 0x1d
or ecx, eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0xc], ecx
push eax
mov ecx, esi
call fcn.10011c0e
mov eax, dword [esi + 0x4c]
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 0x63], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 0x62], cl
mov cl, byte [esi + 0x4c]
shr eax, 8
mov byte [esi + 0x61], al
lea eax, [esi + 0x60]
mov byte [eax], cl
mov ecx, dword [esi + 0x50]
mov edx, ecx
shr edx, 0x18
mov byte [esi + 0x67], dl
mov edx, ecx
shr ecx, 8
shr edx, 0x10
mov byte [esi + 0x65], cl
mov cl, byte [esi + 0x50]
mov byte [esi + 0x66], dl
mov byte [esi + 0x64], cl
mov ecx, dword [esi + 0x54]
mov edx, ecx
shr edx, 0x18
mov byte [esi + 0x6b], dl
mov edx, ecx
shr ecx, 8
mov byte [esi + 0x69], cl
mov cl, byte [esi + 0x54]
shr edx, 0x10
mov byte [esi + 0x6a], dl
mov byte [esi + 0x68], cl
mov ecx, dword [esi + 0x58]
mov edx, ecx
shr edx, 0x18
mov byte [esi + 0x6f], dl
mov edx, ecx
shr ecx, 8
mov byte [esi + 0x6d], cl
mov cl, byte [esi + 0x58]
shr edx, 0x10
mov byte [esi + 0x6c], cl
mov ecx, dword [esi + 0x5c]
mov byte [esi + 0x6e], dl
mov edx, ecx
shr edx, 0x18
mov byte [esi + 0x73], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 8
mov byte [esi + 0x71], cl
mov cl, byte [esi + 0x5c]
pop edi
mov byte [esi + 0x72], dl
mov byte [esi + 0x70], cl
mov byte [esi + 0x74], 0
pop esi
leave
ret

Function at 0x1001dbae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 0x40], 0
push esi
push edi
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
mov esi, ecx
call fcn.1003e4bd
add esp, 0xc
xor ecx, ecx
lea eax, [esi + 0xe]
movzx edx, byte [eax + 1]
movzx edi, byte [eax]
shl edx, 8
xor edx, edi
movzx edi, byte [eax - 1]
shl edx, 8
xor edx, edi
movzx edi, byte [eax - 2]
shl edx, 8
xor edx, edi
mov dword [ebp + ecx*4 - 0x40], edx
inc ecx
add eax, 4
cmp ecx, 0x10
jl 0x1001dbd1
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.10011c0e
pop edi
pop esi
leave
ret
Function at 0x1001e7f6
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 0x64]
test esi, esi
jne 0x1001c7fb
mov esi, ebx
cmp byte [esi], 0
mov edx, esi
je 0x1001c849
push edi
mov al, byte [edx]
cmp al, 0x3d
jne 0x1001c83f
inc edx
cmp byte [edx], 0
je 0x1001c848
movzx eax, byte [edx]
push eax
call fcn.1001a9bd
pop ecx
test eax, eax
je 0x1001c839
lea edi, [edx + 1]
movzx eax, byte [edi]
push eax
call fcn.1001a9bd
pop ecx
test eax, eax
je 0x1001c839
push edx
call fcn.10006e48
pop ecx
mov edx, edi
jmp 0x1001c83f
mov byte [esi], 0x3d
mov al, byte [edx]
inc esi
mov byte [esi], al
inc esi
inc edx
cmp byte [edx], 0
jne 0x1001c803
pop edi
mov eax, dword [ebx + 0x64]
test eax, eax
jne 0x1001c852
mov eax, ebx
push 0
sub esi, eax
push esi
mov ecx, ebx
call fcn.10001d32
pop esi
pop ebx
ret
push esi
mov esi, dword [esp + 8]
push 0x10048514
mov ecx, esi
call fcn.1001c224
test eax, eax
jne 0x1001e80f
xor eax, eax
pop esi
ret
push 0x10048510
mov ecx, esi
call fcn.10002061
test eax, eax
je 0x1001e80b
push edi
push 2
push 0x3f
mov ecx, esi
call fcn.1001c06d
mov edi, eax
cmp edi, 0xffffffff
jne 0x1001e839
xor eax, eax
jmp 0x1001e8c3
push ebx
inc edi
push edi
mov ecx, esi
call fcn.10001fd4
mov bl, al
cmp bl, 0x61
jl 0x1001e84d
add bl, 0xe0
cmp bl, 0x51
je 0x1001e857
cmp bl, 0x42
jne 0x1001e8c0
inc edi
push edi
mov ecx, esi
call fcn.10001fd4
cmp al, 0x3f
jne 0x1001e8c0
inc edi
push edi
mov ecx, esi
call fcn.10001f8a
test eax, eax
jne 0x1001e8c2
mov eax, dword [esi + 0x68]
push 0
add eax, 0xfffffffe
push eax
mov ecx, esi
call fcn.10001d32
test eax, eax
jne 0x1001e8c2
cmp bl, 0x51
jne 0x1001e8b0
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x1001e893
mov eax, esi
push 0x5f
push eax
call fcn.1001a5ba
pop ecx
pop ecx
test eax, eax
je 0x1001e8a6
mov byte [eax], 0x20
jmp 0x1001e88a
pop ebx
pop edi
mov ecx, esi
pop esi
jmp 0x1001c7ee
cmp bl, 0x42
jne 0x1001e8c0
push 0
mov ecx, esi
call fcn.1001c251
jmp 0x1001e8c2
xor eax, eax
pop ebx
pop edi
pop esi
ret
Function at 0x1001e92d
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov ebx, ecx
setne al
lea esi, [ebx + 0x3f8]
push 0x1003f364
mov dword [ebp - 0xc], ebx
mov byte [esi], al
call fcn.10001141
cmp byte [esi], 0
mov dword [ebx + 0x29c], edi
je 0x1001ea6a
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp + 8]
push eax
push 1
push edi
mov dword [ebp + 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push ebx
mov edi, getpeername
push edi
call esi
cmp eax, 2
jne 0x1001e99f
lea eax, [ebp + 8]
push eax
push 1
push 0x100
push ebx
push edi
call esi
xor edi, edi
cmp eax, edi
jne 0x1001ea61
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push str.ProxyEnable
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x1001ea61
cmp dword [ebp - 8], edi
je 0x1001ea61
mov byte [ebp - 0x19c], al
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x19c]
push eax
push edi
push edi
push str.ProxyServer
push dword [ebp + 8]
mov dword [ebp - 4], 0x18f
call esi
test eax, eax
jne 0x1001ea61
lea eax, [ebp - 0x19c]
push str.socks
push eax
call fcn.1001a66c
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x1001ea61
add ebx, 6
push 0x3a
push ebx
call fcn.1001a965
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1001ea61
cmp byte [edi], 0
je 0x1001ea61
mov esi, dword [ebp - 0xc]
push ebx
mov ecx, esi
mov byte [esi + 0x2a0], 3
call fcn.10001141
push 0x3b
push edi
call fcn.1001a965
push edi
call fcn.1001a704
add esp, 0xc
test eax, eax
je 0x1001ea61
mov dword [esi + 0x29c], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4

Function at 0x1001fe9f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
xor eax, eax
sub esp, 0x60
cmp dword [ebp + 0xc], 0xa
push 0x10
setg al
push 0
lea eax, [eax*4 + 0xc]
mov dword [ecx], eax
lea eax, [ebp - 0x10]
push eax
call fcn.1003e4bd
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push eax
call fcn.1003e4ed
add esp, 0x18
xor ecx, ecx
push esi
lea eax, [ebp + ecx - 0xf]
movzx edx, byte [eax - 1]
movzx esi, byte [eax]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 1]
movzx eax, byte [eax + 2]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ebp + ecx - 0x20], edx
add ecx, 4
cmp ecx, 0x10
jl 0x1001fedc
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10017e71
add esp, 0xc
test eax, eax
jne 0x1001ff5c
push edi
mov edi, dword [ebp + 0x10]
push 0x10
pop ecx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
lea esi, [ebp - 0x60]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.10017e71
add esp, 0xc
pop edi
test eax, eax
jne 0x1001ff5c
mov cl, byte [ebp + eax*4 - 0x60]
mov edx, dword [ebp + 0x14]
and cl, 0x1f
mov byte [eax + edx], cl
inc eax
cmp eax, 0x10
jl 0x1001ff47
xor eax, eax
pop esi
leave
ret
Function at 0x1001ff5f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 5]
push ebx
movzx ebx, byte [eax]
shl ebx, 8
xor ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
xor ebx, ecx
movzx ecx, byte [eax + 3]
shl ebx, 8
xor ebx, ecx
movzx ecx, byte [eax + 4]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 6]
movzx eax, byte [eax + 7]
shl ecx, 8
xor ecx, edx
shl ecx, 8
push esi
xor esi, esi
xor ecx, eax
cmp dword [ebp + 0x10], esi
jle 0x1001ffdb
push edi
mov eax, dword [ebp + 0xc]
movzx eax, byte [esi + eax]
push eax
mov eax, dword [ebp + 8]
push dword [eax + esi*4]
mov eax, esi
push ecx
push 3
mov edi, ebx
mov ebx, ecx
cdq
pop ecx
idiv ecx
push edx
call fcn.10018609
xor eax, edi
add esp, 0x10
inc esi
cmp esi, dword [ebp + 0x10]
mov ecx, eax
jl 0x1001ffac
pop edi
mov esi, dword [ebp + 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr eax, 0x18
mov byte [esi + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 5], al
mov eax, ebx
shr eax, 8
mov byte [esi + 6], al
mov byte [esi + 7], bl
mov byte [esi + 3], cl
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10020019
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 5]
push ebx
movzx ebx, byte [eax]
shl ebx, 8
xor ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
xor ebx, ecx
movzx ecx, byte [eax + 3]
shl ebx, 8
xor ebx, ecx
movzx ecx, byte [eax + 4]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 6]
movzx eax, byte [eax + 7]
shl ecx, 8
xor ecx, edx
push esi
mov esi, dword [ebp + 0x10]
shl ecx, 8
xor ecx, eax
dec esi
js 0x10020091
push edi
mov eax, dword [ebp + 0xc]
movzx eax, byte [esi + eax]
push eax
mov eax, dword [ebp + 8]
push dword [eax + esi*4]
mov eax, esi
push ecx
push 3
mov edi, ebx
mov ebx, ecx
cdq
pop ecx
idiv ecx
push edx
call fcn.10018609
xor eax, edi
add esp, 0x10
dec esi
mov ecx, eax
jns 0x10020065
pop edi
mov esi, dword [ebp + 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr eax, 0x18
mov byte [esi + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 5], al
mov eax, ebx
shr eax, 8
mov byte [esi + 6], al
mov byte [esi + 7], bl
mov byte [esi + 3], cl
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x100205f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 2]
movzx edx, byte [eax + 6]
push ebx
movzx ebx, byte [eax + 3]
shl ebx, 8
xor ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
xor ebx, ecx
movzx ecx, byte [eax]
push esi
shl ebx, 8
push edi
mov edi, dword [ebp + 8]
xor ebx, dword [edi + 0x10]
lea esi, [edi + 0x9c]
xor ebx, ecx
movzx ecx, byte [eax + 7]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 5]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 4]
shl ecx, 8
xor ecx, edx
xor ecx, dword [edi + 0x14]
movzx edx, byte [eax + 0xa]
mov dword [ebp + 8], ecx
movzx ecx, byte [eax + 0xb]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 9]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 8]
shl ecx, 8
xor ecx, edx
xor ecx, dword [edi + 0x18]
movzx edx, byte [eax + 0xe]
mov dword [ebp - 8], ecx
movzx ecx, byte [eax + 0xf]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 0xd]
movzx eax, byte [eax + 0xc]
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
xor ecx, dword [edi + 0x1c]
mov dword [ebp - 0xc], 8
mov dword [ebp + 0x10], ecx
push 0
push ebx
push dword [ebp + 0xc]
call fcn.10018849
push 3
push dword [ebp + 8]
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
call fcn.10018849
mov ecx, dword [esi]
lea ecx, [ecx + eax*2]
add ecx, dword [ebp - 4]
sub esi, 4
xor dword [ebp + 0x10], ecx
mov edx, dword [esi]
mov ecx, dword [ebp - 8]
ror dword [ebp + 0x10], 1
add edx, eax
add edx, dword [ebp - 4]
rol ecx, 1
xor ecx, edx
push 0
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
sub esi, 4
call fcn.10018849
push 3
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
call fcn.10018849
mov ecx, dword [esi]
lea ecx, [ecx + eax*2]
add ecx, dword [ebp - 4]
sub esi, 4
xor dword [ebp + 8], ecx
mov ecx, dword [esi]
add esp, 0x30
ror dword [ebp + 8], 1
add ecx, eax
add ecx, dword [ebp - 4]
rol ebx, 1
xor ebx, ecx
sub esi, 4
dec dword [ebp - 0xc]
jne 0x1002069f
mov eax, dword [edi + 4]
xor ebx, dword [edi + 8]
mov ecx, dword [ebp - 8]
xor ecx, dword [edi]
xor dword [ebp + 0x10], eax
mov eax, dword [edi + 0xc]
xor dword [ebp + 8], eax
mov eax, dword [ebp + 0x14]
mov edx, ecx
shr edx, 0x18
mov byte [eax + 3], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov byte [eax], cl
mov ecx, dword [ebp + 0x10]
mov edx, ecx
shr edx, 0x18
mov byte [eax + 7], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 6], dl
mov edx, ecx
mov byte [eax + 4], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [eax + 0xb], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 0xa], cl
shr edx, 8
mov ecx, ebx
mov byte [eax + 5], dl
shr ecx, 8
mov byte [eax + 9], cl
mov ecx, dword [ebp + 8]
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0xf], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 0xe], dl
mov edx, ecx
pop edi
shr edx, 8
mov byte [eax + 8], bl
pop esi
mov byte [eax + 0xd], dl
mov byte [eax + 0xc], cl
xor eax, eax
pop ebx
leave
ret
Function at 0x100215ed
Capabilities:
Initialize winsock library
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x100523a4]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], eax
push edi
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x4000
mov dword [ebp - 0x28], 0x1001ae36
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], str.__ipworksssl_socket_wnd__
call dword [sym.imp.USER32.dll_RegisterClassA]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ws2_32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1002168c
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [ebp - 4]
mov dword [0x100523b0], eax
call esi
push str.getnameinfo
push dword [ebp - 4]
mov dword [0x100523b4], eax
call esi
push str.gethostbyaddr
push dword [ebp - 4]
mov dword [0x100523b8], eax
call esi
mov dword [0x100523bc], eax
xor eax, eax
push 0x18e
mov word [ebp - 0x1bc], ax
lea eax, [ebp - 0x1ba]
push ebx
push eax
call fcn.1003e4bd
add esp, 0xc
lea eax, [ebp - 0x1bc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x100523a8], eax
movzx eax, word [ebp - 0x1bc]
push str.netapi32.dll
mov dword [0x100523ac], eax
call edi
mov edi, eax
cmp edi, ebx
je 0x100216f4
push str.DsGetDcNameA
push edi
call esi
push str.NetApiBufferFree
push edi
mov dword [0x100523c0], eax
call esi
mov dword [0x100523c4], eax
call fcn.10021194
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10021abd
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
lea ecx, [esi + 0x10]
call fcn.10001d04
and dword [esi + 4], 0
cmp dword [esi + 0x1a4], 0xffffffff
je 0x10021b1d
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.1003e4bd
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x1a4]
mov dword [ebp - 4], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x10021b0f
xor eax, eax
jmp 0x10021b23
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
jmp 0x10021b23
mov eax, dword [esi + 0x1974]
pop esi
leave
ret

Function at 0x10021cd3
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x10]
call fcn.10001d04
mov eax, dword [esi + 0x1a4]
and dword [esi + 4], 0
cmp eax, 0xffffffff
je 0x10021d0c
push 4
lea ecx, [esp + 0xc]
push ecx
push 1
push 6
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10021d0c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x10021d18
mov al, byte [esp + 8]
mov byte [esi + 0x1d9d], al
xor eax, eax
pop esi
ret 4