joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x77ac60
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x77ab84]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x50ca0b
push 0x4c
push 1
call fcn.00521555
mov esi, eax
add esp, 8
test esi, esi
jne 0x50c9d3
push 0x77ac60
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x77ab84]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x76ff08]
inc eax
lea edx, [esi + 0xc]
mov dword [0x76ff08], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.00510530
add esp, 8
mov byte [esi + 0x3c], 1
push 0x77ac60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x50ce90
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.0052112d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.0052387c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x50cf8a
call fcn.0052112d
cmp dword [eax], 0
je 0x50ced7
call fcn.0052112d
mov ebp, dword [eax]
jmp 0x50ceda
or ebp, 0xffffffff
call fcn.0050ca20
test esi, esi
mov dword [eax], ebp
jne 0x50ceef
call fcn.0052112d
cmp dword [eax], 4
je 0x50cf3f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x50cf22
cmp esi, 0xffffffff
je 0x50cf64
test al, 6
je 0x50cf22
call fcn.0050ca20
mov ecx, dword [eax]
push ecx
push ebx
call fcn.00510560
add esp, 4
push eax
push 0x24
push 9
call fcn.0050d270
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x50cf82
test al, 6
je 0x50cf30
test ah, 2
je 0x50cf82
test esi, esi
jbe 0x50cf8e
test ah, 2
je 0x50cf8e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.0052112d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.0052387c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x50cf8a
jmp 0x50cec4
call fcn.0050ca20
mov eax, dword [eax]
push eax
push ebx
call fcn.00510560
add esp, 4
push eax
push 0x24
push 2
call fcn.0050d270
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x50cf9b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x50cfa4
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x523714
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x523734
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005210ba
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x523757
test byte [esp + 8], 2
je 0x523757
call fcn.0052112d
mov dword [eax], 0xd
call fcn.00521136
mov dword [eax], 5
jmp 0x523730
xor eax, eax
ret
Function at 0x53bc50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5582d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.00530b14
mov eax, dword [0x654040]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.00530a46
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0053c730
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x53bcf7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x53bcee
cmp al, 0xff
je 0x53bcee
dec al
mov byte [ecx], al
jmp 0x53bcf7
push ecx
call fcn.00545e32
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x53bd28
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x53bd1f
cmp al, 0xff
je 0x53bd1f
dec al
mov byte [ecx], al
jmp 0x53bd28
push ecx
call fcn.00545e32
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x5484ab
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5484e3
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00546523
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005464fb
jmp 0x5484ef
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x549ca6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x549ce8
call fcn.0054fedd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x549ce8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x549cdf
xor eax, eax
jmp 0x549cf0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00549cf6
pop edi
pop esi
pop ebx
ret 4

Function at 0x55040d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x55043b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x550459
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00550373
jmp 0x550459
mov eax, dword [esi + 0x14]
test eax, eax
je 0x550459
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00550373
test edi, edi
mov eax, edi
jne 0x550443
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4085a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4085b5
pop dword [ebp - 0x20]
mov eax, 0x4085b5
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x4b03ab0f
add dword [ebp - 0x30], 0x34e9a3c
mov dword [ebp - 0x2c], 0x54fb95a2
sub dword [ebp - 0x2c], 0x22c8495d
mov dword [ebp - 0x28], 0x57334c20
sub dword [ebp - 0x28], 0xae707f2
mov dword [ebp - 0x24], 0x383989eb
sub dword [ebp - 0x24], 0x383989eb
lea eax, [ebp - 0x30]
push eax
mov eax, 0x7b9eba1b
sub eax, 0x7b5c89a7
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x8fea01e3
sub dword [ebp - 0x30], 0x1b77988d
mov dword [ebp - 0x2c], 0x9af3f6aa
sub dword [ebp - 0x2c], 0x59879535
mov dword [ebp - 0x28], 0x9075d8a6
add dword [ebp - 0x28], 0xd2f993c6
mov dword [ebp - 0x24], 0xfec5ff25
add dword [ebp - 0x24], 0x13a00db
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xa7324b44
sub eax, 0xa6f01a20
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3ae34
push 0
call eax
mov ecx, 0x3cb2
xor edi, edi
add edi, eax
mov edx, 0x5d38bc99
sub edx, 0x5cf57899
add edx, dword [ebp - 0x20]
mov esi, 0xcbf9df53
add esi, 0x3bda249c
sub dword [ebp - 0xc], edi
mov ebx, dword [edx]
xor dword [ebp - 0x10], 0xc1206d77
add ebx, esi
xor dword [ebp - 0x18], esi
mov dword [edi], ebx
add edi, 0x29a97aef
add edi, 0xd6568515
add edx, 0x72b5d822
add edx, 0x8d4a27e2
loop 0x4086ce
add eax, 0x86fef1d
add eax, 0xf790f67e
mov ebx, eax
add eax, 0x4e23e3f8
sub eax, 0x4e23e3f3
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401237
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x30], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41b2f8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b2fc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x24], eax
call fcn.00401230
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x41b300]
add ebx, 0x23f
mov edx, dword [0x41b304]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, edi
mov dword [ebp - 0x10], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xae8e8c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xae8e88]
cmove eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
cmp dword [0xae8e8c], 0x3eb
mov dword [0xae8e88], eax
mov eax, dword [0xae8de0]
cmove eax, dword [ebp - 0x10]
mov dword [0xae8de0], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add dword [ebp - 8], edx
and dword [ebp - 0xc], 0
mov dword [0xae8e84], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + esi]
mov edx, esi
lea ebx, [ebx + 0x61c88647]
shr edx, cl
add edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
xor edx, eax
mov eax, dword [ebp - 4]
xor eax, edx
mov edx, dword [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
jne 0x401291
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cd19
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41af20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040972e
mov dword [ebp - 0x14], eax
cmp dword [0x44467c], esi
jne 0x40ce0c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40cd99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40ceec
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40ceec
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ceec
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x44467c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x444680], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x444684], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44468c], eax
test eax, eax
je 0x40ce09
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x444688], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ce31
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ce24
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40ce46
push 4
pop eax
jmp 0x40ceee
cmp dword [ebp - 0x14], esi
je 0x40ce46
push dword [0x44467c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ce2b
mov eax, dword [0x444688]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40cea4
cmp dword [0x44468c], edi
je 0x40cea4
push eax
call ebx
push dword [0x44468c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cea4
test eax, eax
je 0x40cea4
call ecx
test eax, eax
je 0x40ce99
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40ce99
test byte [ebp - 8], 1
jne 0x40cea4
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40ced4
mov eax, dword [0x444680]
cmp eax, edi
je 0x40ced1
push eax
call ebx
test eax, eax
je 0x40ced1
call eax
mov esi, eax
test esi, esi
je 0x40ced1
mov eax, dword [0x444684]
cmp eax, edi
je 0x40ced1
push eax
call ebx
test eax, eax
je 0x40ced1
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x44467c]
call ebx
test eax, eax
je 0x40ceec
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40ceee
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404187
mov esp, ebp
pop ebp
ret
Function at 0x100a3270
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x10266634]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x94], ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x100a33f5
cmp byte [eax], 0
je 0x100a33f5
lea eax, [ebp - 0x8c]
push 0x101f976c
push eax
call sub.avutil_56.dll_av_get_token
add esp, 8
mov dword [ebp - 0x90], eax
test eax, eax
je 0x100a341e
mov cl, byte [eax]
xorps xmm0, xmm0
xor esi, esi
movlpd qword [ebp - 0xa8], xmm0
movlpd qword [ebp - 0xa0], xmm0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x88], 0
test cl, cl
je 0x100a3306
cmp cl, 0x3f
cmovne esi, eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0xac], 2
push eax
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb0], 0
push eax
push 0x101eb914
push esi
mov dword [ebp - 0xb4], 0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x100a3373
push eax
mov dword [ebp - 0x88], 0
call fcn.100011f9
push eax
push 0x101eb914
test esi, esi
mov eax, str.unknown
cmovne eax, esi
push eax
push str.getaddrinfo__s___s_:__s_n
push 0x10
push ebx
call sub.avutil_56.dll_av_log
add esp, 0x1c
lea eax, [ebp - 0x90]
push eax
call fcn.101e0e4b
mov esi, dword [ebp - 0x88]
add esp, 4
test esi, esi
je 0x100a3408
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [esi + 0x10]
lea eax, [ebp - 0x84]
push dword [esi + 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
lea eax, [ebp - 0x84]
push eax
push 0x80
push dword [ebp - 0x94]
push edi
call sub.avutil_56.dll_av_dynarray2_add
add esp, 0x10
cmp dword [edi], 0
je 0x100a341e
mov eax, dword [ebp - 0x8c]
cmp byte [eax], 0
je 0x100a33ed
inc eax
mov dword [ebp - 0x8c], eax
test eax, eax
jne 0x100a32a6
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100014c9
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffea
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100014c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xfffffff4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100014c9
mov esp, ebp
pop ebp
ret
Function at 0x10130780
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x10266634]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push eax
push str._s:_n
push 0x30
push edi
call sub.avutil_56.dll_av_log
add esp, 0x10
test esi, esi
je 0x101307ed
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_getnameinfo]
push 0xa
push 0x14
lea eax, [ebp - 0x18]
push eax
push 0x64
lea eax, [ebp - 0x7c]
push eax
push dword [esi + 0x10]
push dword [esi + 0x18]
call ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.Address__s_port__s_n
push 0x30
push edi
call sub.avutil_56.dll_av_log
mov esi, dword [esi + 0x1c]
add esp, 0x14
test esi, esi
jne 0x101307b7
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100014c9
mov esp, ebp
pop ebp
ret
Function at 0x1014a3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, ebx
shr esi, 2
push edi
mov edi, dword [ebp + 0xc]
lea eax, [esi*4]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 8]
test esi, esi
je 0x1014a3fc
mov ecx, dword [eax]
add eax, 4
xor ecx, dword [edi]
add edi, 4
mov dword [edx], ecx
add edx, 4
sub esi, 1
jne 0x1014a3e8
sub ebx, dword [ebp + 0x14]
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp + 0x14], ebx
mov dword [ebp - 4], esi
test ebx, ebx
jle 0x1014a506
cmp ebx, 0x40
jb 0x1014a4eb
lea ecx, [ebx - 1]
mov dword [ebp - 4], esi
add ecx, edi
cmp edx, ecx
ja 0x1014a434
lea ecx, [ebx - 1]
add ecx, edx
cmp ecx, edi
jae 0x1014a4eb
lea ecx, [ebx - 1]
add ecx, eax
cmp edx, ecx
ja 0x1014a44a
lea ecx, [ebx - 1]
add ecx, edx
cmp ecx, eax
jae 0x1014a4eb
mov ecx, ebx
and ecx, 0x8000003f
jns 0x1014a459
dec ecx
or ecx, 0xffffffc0
inc ecx
mov dword [ebp - 4], ebx
mov ebx, eax
sub dword [ebp - 4], ecx
sub ebx, edi
mov dword [ebp - 8], ebx
lea ecx, [edi + 0x10]
mov ebx, edx
sub ebx, edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0x10], ebx
mov ebx, eax
sub ebx, edx
mov dword [ebp - 0x14], ebx
lea ebx, [edx + 0x20]
nop dword [eax]
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [esi + eax]
lea ebx, [ebx + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x40]
movups xmmword [ebx - 0x60], xmm1
movups xmm1, xmmword [edi + ecx - 0x40]
mov edi, dword [ebp - 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x30]
movups xmmword [edi + ecx - 0x40], xmm1
mov edi, dword [ebp - 0x14]
movups xmm1, xmmword [edi + ebx - 0x40]
mov edi, dword [ebp - 8]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x20]
movups xmmword [ebx - 0x40], xmm1
movups xmm1, xmmword [esi + eax + 0x30]
add esi, 0x40
pxor xmm1, xmm0
movups xmmword [ebx - 0x30], xmm1
cmp esi, dword [ebp - 4]
jl 0x1014a480
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
cmp esi, ebx
jge 0x1014a506
add esi, edi
sub eax, edi
sub edx, edi
sub ebx, dword [ebp - 4]
mov cl, byte [esi + eax]
lea esi, [esi + 1]
xor cl, byte [esi - 1]
mov byte [esi + edx - 1], cl
sub ebx, 1
jne 0x1014a4f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101503f0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, 0x2710
test edi, edi
je 0x101504b5
push 0x10208ca0
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strspn]
add edi, eax
push ebx
mov al, byte [edi]
mov byte [ebp + 0xb], al
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov ecx, dword [ebp - 4]
add esp, 0x14
mov edi, eax
mov dword [ebp - 8], edi
mov dl, byte [ecx]
inc ecx
mov dword [ebp - 4], ecx
cmp dl, 0x2e
jne 0x10150476
mov edi, ecx
mov cl, byte [ecx]
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x10150473
test esi, esi
je 0x10150473
movsx eax, cl
lea ecx, [edi + 1]
sub eax, 0x30
mov dword [ebp - 4], ecx
imul eax, esi
add ebx, eax
mov eax, 0x66666667
imul esi
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
jmp 0x10150440
mov edi, dword [ebp - 8]
mov eax, edi
mov ecx, bind
cdq
sub ecx, ebx
mov esi, eax
mov eax, 0x14f8b589
xor esi, edx
sub esi, edx
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jg 0x101504b5
mov eax, ebx
neg eax
cmp byte [ebp + 0xb], 0x2d
cmovne eax, ebx
imul ecx, edi, 0x186a0
pop edi
pop esi
pop ebx
add eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1017bf80
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x24], xmm0
push esi
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x24], 4
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1017bfda
push eax
call fcn.100011f9
push eax
push esi
push str.getaddrinfo__s_:__s_n
push 0x10
push dword [ebp + 8]
call sub.avutil_56.dll_av_log
add esp, 0x18
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov ecx, 0x80
cmp dword [esi + 0x10], ecx
cmovb ecx, dword [esi + 0x10]
push ecx
push dword [esi + 0x18]
push dword [ebp + 0x10]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1018bdb0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push dword [ebp + 0x14]
xorps xmm0, xmm0
push 0x10241c1c
push dword [ebp + 0x10]
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call sub.avutil_56.dll_av_strlcpy
mov esi, dword [ebp + 8]
add esp, 0xc
cmp byte [esi], 0
je 0x1018be45
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1018be45
push 2
push eax
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
push esi
push dword [eax + 0x10]
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0x17
jne 0x1018be28
push dword [ebp + 0x14]
push 0x10241c20
push dword [ebp + 0x10]
call sub.avutil_56.dll_av_strlcpy
mov eax, dword [ebp - 4]
add esp, 0xc
push dword [eax + 0x18]
call fcn.10001cbc
add esp, 4
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret