joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008b3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x1008b3c3
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x1008b43d
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.100a0e30
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x1008b411
sub eax, edi
jmp 0x1008b413
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x1008b402
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x1008b430
sub eax, edi
jmp 0x1008b432
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x1008b421
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x1008b4f2
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x1008b463
mov ebx, ecx
test ebx, ebx
je 0x1008b4b6
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x1008b485
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.1008d6f0
jmp 0x1008b49e
cmp eax, 2
jne 0x1008b4a4
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x1008b497
xor eax, eax
jmp 0x1008b4a1
mov edx, ebx
call fcn.1008d960
mov edx, dword [ebp - 8]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.100a0e30
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x1008b4de
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x1008b4f2
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x1008b3c0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1009c0cb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100eb6ac]
jne 0x1009c0d5
repz ret
jmp fcn.100a3a7e

Function at 0x100ab830
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100eb6ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100a5cc8
and dword [ebp - 0x14], 0
cmp dword [0x100efce4], 0
mov dword [ebp - 0x18], eax
jne 0x100ab8e3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100ab98b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100ab98b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100efce4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100efce8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100efcec], eax
call edi
push eax
call esi
mov dword [0x100efcf4], eax
test eax, eax
je 0x100ab8e3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100efcf0], eax
mov eax, dword [0x100efcf0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100ab93c
cmp dword [0x100efcf4], ecx
je 0x100ab93c
push eax
call esi
push dword [0x100efcf4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100ab93c
test ebx, ebx
je 0x100ab93c
call edi
test eax, eax
je 0x100ab933
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100ab933
test byte [ebp - 8], 1
jne 0x100ab93c
or dword [ebp + 0x10], 0x200000
jmp 0x100ab96f
mov eax, dword [0x100efce8]
cmp eax, dword [ebp - 0x18]
je 0x100ab96f
push eax
call esi
test eax, eax
je 0x100ab96f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100ab96f
mov eax, dword [0x100efcec]
cmp eax, dword [ebp - 0x18]
je 0x100ab96f
push eax
call esi
test eax, eax
je 0x100ab96f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100efce4]
call esi
test eax, eax
je 0x100ab98b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100ab98d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009c0cb
leave
ret
Function at 0x10004490
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x1006a778]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x100044e1
push 3
push 2
push eax
push eax
push 6
call fcn.1004aa10
add esp, 0x14
test al, al
je 0x100044d5
mov dword [0x1006a778], 2
add esp, 0xc
ret
mov dword [0x1006a778], 1
jmp 0x100044e6
cmp eax, 2
je 0x1000452c
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10004511
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x1000452c
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x10005020
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x1006a744]
xor eax, esp
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x194]
push esi
mov esi, dword [eax + 8]
lea eax, [esp + 0xc]
push 0x80
push 0
push eax
mov dword [esp + 0x14], 0x80
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x98]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100050c4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x8c]
push 0x100
push eax
push esi
call fcn.1003d3d0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.1000c060
add esp, 0x1c
mov eax, 2
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.10056613
add esp, 0x188
ret
lea eax, [esi + 0x100]
push eax
lea eax, [esi + 0xd0]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
call fcn.100070d0
add esp, 0x10
test al, al
jne 0x10005137
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push edi
call esi
mov edi, dword [eax]
call esi
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push edi
call fcn.1003d3d0
push eax
push dword [esi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.1000c060
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.10056613
add esp, 0x188
ret
mov ecx, dword [esp + 0x18c]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.10056613
add esp, 0x188
ret

Function at 0x1000ac00
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1000ac8c
push esi
call fcn.100197e0
add esp, 4
test al, al
jne 0x1000ac8c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1000ac23
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1000c1c0
add esp, 0xc
test eax, eax
je 0x1000ac57
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1000c1c0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1000ac59
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x1000ac85
mov al, byte [esi]
push eax
call fcn.1003ca80
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x1000ac67
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1000afb0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x20]
push edi
xor edi, edi
mov dword [esp + 0xc], edi
mov dword [eax], edi
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 4], eax
test eax, eax
jne 0x1000b13f
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1000b12a
push ebx
push ebp
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1000b00c
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000b000
sub eax, edx
inc eax
jmp 0x1000b00e
xor eax, eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], eax
cmp ecx, 2
jne 0x1000b01f
lea ebp, [ecx + 0xe]
jmp 0x1000b02b
cmp ecx, 0x17
jne 0x1000b0cc
lea ebp, [ecx + 5]
cmp dword [esi + 0x18], 0
je 0x1000b0cc
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1000b0cc
cmp ecx, ebp
jb 0x1000b0cc
add eax, 0x20
add eax, ebp
push eax
call dword [0x100691ac]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000b11b
mov ecx, dword [esi]
mov dword [ebx], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x20]
push ebp
mov dword [ebx + 0x10], ebp
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x18], eax
push dword [esi + 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x20]
add esp, 0xc
test ecx, ecx
je 0x1000b0b8
mov eax, dword [ebx + 0x18]
add eax, ebp
push ecx
mov dword [ebx + 0x14], eax
push dword [esi + 0x14]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x18]
test edi, edi
cmove edi, ebx
test eax, eax
je 0x1000b0c8
mov dword [eax + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x1000aff2
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
pop ebp
pop ebx
test eax, eax
je 0x1000b0ec
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x1000b126
test edi, edi
je 0x1000b10b
mov esi, dword [edi + 0x1c]
push edi
call dword [0x100691b0]
add esp, 4
mov edi, esi
test esi, esi
jne 0x1000b0f4
mov esi, dword [esp + 8]
mov eax, dword [esp + 0x28]
xor edi, edi
mov dword [eax], edi
mov eax, esi
pop esi
pop edi
add esp, 0x10
ret
mov esi, 8
mov dword [esp + 0x10], esi
jmp 0x1000b0db
test edi, edi
jne 0x1000b136
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
mov dword [eax], edi
mov eax, esi
pop esi
pop edi
add esp, 0x10
ret

Function at 0x1000b4a0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x1000b4ec
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x1000b4b1
pop ebx
pop edi
pop esi
ret
Function at 0x1000bfb0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6d0], 0
je 0x1000c04f
cmp dword [edi + 0x1a4], 0
je 0x1000c007
push edi
call fcn.1002a560
push 1
push edi
mov byte [esp + 0x14], al
call fcn.1002a810
push dword [edi + 0x154]
mov eax, dword [edi + 0x1a4]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push dword [esp + 0x28]
push edi
call fcn.1002a810
add esp, 0x28
pop edi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x1000c01c
sub eax, 1
je 0x1000c01c
sub eax, 1
jne 0x1000c04f
push dword [edi + 0x150]
lea eax, [ecx*2 + 0x100590a4]
push 1
add eax, ecx
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x150]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
pop edi
ret

Function at 0x1000da30
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
xor eax, eax
test ecx, ecx
je 0x1000da57
cmp ecx, 0xffffffff
cmovne eax, ecx
ret
Function at 0x10012ab0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x8c
mov eax, dword [0x1006a744]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov ebx, dword [edi + 0xc]
mov esi, dword [ebx + 0x124]
push esi
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x10012b1b
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [esp + 0xc], eax
jmp 0x10012b1f
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
jne 0x10012b4f
push str.Error_accept__ing_server_connect
push edi
call fcn.1000c060
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.10056613
add esp, 0x8c
ret
push str.Connection_accepted_from_server
push edi
call fcn.1000c130
mov byte [ebx + 0x1cd], 0
push 1
push dword [esp + 0x18]
call fcn.1002e5e0
lea eax, [esp + 0x1c]
push eax
push 1
push ebx
push edi
call fcn.100041b0
add esp, 0x20
test eax, eax
jne 0x10012be9
cmp dword [edi + 0x1ac], eax
je 0x10012be7
push 1
push edi
call fcn.1002a810
mov eax, dword [edi + 0x1ac]
push 1
push dword [esp + 0x18]
push dword [edi + 0x1b0]
call eax
push 0
push edi
mov esi, eax
call fcn.1002a810
add esp, 0x1c
test esi, esi
je 0x10012be7
push 1
push edi
call fcn.100056f0
push 1
push ebx
push edi
call fcn.10005560
add esp, 0x14
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.10056613
add esp, 0x8c
ret
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10056613
add esp, 0x8c
ret
Function at 0x10014b00
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x10014b30
push str.Couldnt_set_desired_mode
push esi
call fcn.1000c060
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x10014b47
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.1000c130
add esp, 0xc
mov al, byte [esp + 0x18]
push ebp
cmp al, 0x13
jne 0x10014b61
push ebx
push esi
call fcn.10014a00
add esp, 8
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp al, 0x14
jne 0x10014c6d
mov edi, dword [esi + 0xc]
xor ebx, ebx
cmp byte [esi + 0x4d0], 2
mov dword [esp + 0x18], edi
jne 0x10014bde
mov eax, dword [esi + 0x124]
mov eax, dword [eax]
test eax, eax
je 0x10014bde
push 3
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push ebx
push eax
call fcn.10010250
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x10014c98
push 0x2f
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x10014bcd
mov ebx, dword [esp + 0x14]
mov ecx, 1
sub eax, ebx
cmovne ecx, eax
mov byte [ecx + ebx], 0
jmp 0x10014bda
push dword [esp + 0x14]
call dword [0x100691b0]
add esp, 4
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x504]
test ecx, ecx
jne 0x10014bfc
cmp byte [esi + 0xd47], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov edx, 0x1005835b
test ebx, ebx
mov eax, edx
cmovne eax, ebx
push eax
mov eax, 0x1005af9c
cmove eax, edx
push eax
push ecx
push 0x1005afa0
call sym.libcurl.dll_curl_maprintf
push ebx
mov ebp, eax
call dword [0x100691b0]
add esp, 0x14
test ebp, ebp
jne 0x10014c39
mov edi, 0x1b
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push 0x10058a10
lea eax, [edi + 0x378]
push eax
push esi
call fcn.1002f5a0
push ebp
mov edi, eax
call dword [0x100691b0]
add esp, 0x14
test edi, edi
jne 0x10014c98
mov eax, dword [esi + 0xc]
pop ebp
mov byte [eax + 0x416], 0x1f
mov eax, edi
pop edi
pop esi
pop ebx
ret
cmp al, 0x15
jne 0x10014c85
push 0xd
push 1
push esi
call fcn.10014560
add esp, 0xc
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp al, 0x16
jne 0x10014c98
push 0xe
push 1
push esi
call fcn.10014560
add esp, 0xc
mov edi, eax
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x10017890
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
xor ebp, ebp
push esi
push edi
lea esi, [ebp + 1]
push esi
push ebp
call dword [0x100691b4]
mov edi, eax
add esp, 8
test edi, edi
je 0x100178e7
nop word [eax + eax]
push esi
push edi
push dword [esp + 0x1c]
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x100178ff
cmp esi, ebx
je 0x100178ff
cmp esi, 0x8000
ja 0x100178ff
cmp esi, ebx
jb 0x100178f8
push esi
push edi
call dword [0x100691b4]
mov edi, eax
add esp, 8
test edi, edi
jne 0x100178b0
push ebp
call dword [0x100691b0]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [0x100691b0]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x100191f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x100691ac]
mov esi, eax
add esp, 4
test esi, esi
jne 0x1001921b
pop esi
pop ebp
add esp, 0xc
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x1001926a
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [edi]
push ebx
push dword [esp + 0x2c]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov ebx, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x28], ebx
jmp 0x10019272
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x30]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x100192e3
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x100192a0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x10019315
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push str.6:_u
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x1005bab7
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x100192f0
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x10019340
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.1004ac70
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x100691ac]
mov esi, eax
add esp, 8
test esi, esi
je 0x100194c2
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x100193c2
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10019433
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x100193f0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x10019465
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push str.6:_u
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x1005bab7
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x10019440
push dword [esp + 0x30]
call fcn.1004ac70
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x10019490
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x100691b0]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x100197e0
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x1006a744]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x10019828
lea eax, [esp + 8]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
pop esi
setg al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10056613
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov al, 1
pop esi
xor ecx, esp
call fcn.10056613
add esp, 0x18
ret

Function at 0x10019940
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1001997e
mov eax, dword [esi + 0x70]
cmp byte [eax + 0xe8], 0
jne 0x1001996f
push 0
call fcn.10019940
add esp, 4
test al, al
mov eax, dword [esi + 0x70]
setne cl
inc cl
mov byte [eax + 0xe8], cl
mov eax, dword [esi + 0x70]
pop esi
cmp byte [eax + 0xe8], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x10019993
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret