joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c4450
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x1021a680], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x100c3eb0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x100c41a0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.100c3e60
je 0x100c44c2
movzx eax, word [esp + 0x234]
mov eax, dword [eax*8 + 0x10208d00]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.1008545e
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100c45bd
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.100923f5
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.1009b270
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100c453d
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x100c4584
push esi
call ebp
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.100923f5
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.1009b270
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x100c45b9
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x100c45ed
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
mov dword [esp + edi*8 + 0x14], eax
test eax, eax
je 0x100c45ed
inc edi
cmp edi, 3
jl 0x100c4586
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x10208d00], edx
mov dword [0x10208d08], eax
mov dword [fcn.100c3e60], ecx
pop edi
pop esi
pop ebp
pop ebx
movzx edx, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [edx*8 + 0x10208d00]
xor ecx, esp
mov dword [0x1021a680], 1
call fcn.1008545e
add esp, 0x230
ret 4
push esi
call ebp
jmp 0x100c45b9

Function at 0x100c4b60
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.1008eb77
add esp, 0x18
test eax, eax
je 0x100c4b83
cmp eax, 0xffffffff
jne 0x100c4b85
xor eax, eax
ret

Function at 0x100c7f10
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x100c7f1f
jmp dword [ecx*4 + 0x100c7f74]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
Function at 0x100d0b60
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x101b04f4
push ecx
call fcn.100c10f0
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.100cfd40
test eax, eax
jne 0x100d0b90
mov eax, esi
jmp fcn.100d01d0
ret
Function at 0x100d0fa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
mov ebx, dword [ebp]
push esi
mov esi, dword [ebp + 0x3f0]
push edi
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
lea edi, [esi + 0x15c]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x100d102f
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.10088150
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x100d106a
push str.Received_too_short_packet
push ebx
call fcn.100c1180
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1008545e
add esp, 0x88
ret
mov eax, edi
call fcn.100cfee0
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x100d1083
jmp dword [eax*4 + 0x100d116c]
cmp edx, 4
jle case.0x100d1083.4
mov eax, edi
call fcn.100cfef0
movzx ecx, word [esi + 0x40]
inc ecx
cmp cx, ax
jne case.0x100d1083.4
add edx, 0xfffffffc
push edx
mov edx, dword [edi]
add edx, 4
push edx
push 1
push ebp
call fcn.100c1460
mov edi, eax
add esp, 0x10
test edi, edi
je 0x100d10d6
mov ecx, 5
mov eax, esi
call fcn.100d0f20
mov eax, edi
jmp 0x100d1051
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x38], eax
mov ecx, dword [ebx + 0x38]
adc dword [ebx + 0x3c], edx
mov eax, dword [ebx + 0x3c]
push eax
push ecx
push ebx
call fcn.100cb470
jmp 0x100d1142
mov eax, edi
call fcn.100cfef0
movzx edx, ax
mov eax, dword [edi]
add eax, 4
push eax
push 0x101b04f4
push ebx
mov dword [esi + 8], edx
call fcn.100c10f0
jmp 0x100d1142
mov ecx, dword [edi]
add edx, 0xfffffffe
push edx
add ecx, 2
push ecx
push esi
call fcn.100cff80
add esp, 0xc
test eax, eax
je case.0x100d1083.4
jmp 0x100d1051
push str.Internal_error:_Unexpected_packet
push 0x10196058
push ebx
call fcn.100c1180
add esp, 0xc
push ebp
call fcn.100cb530
add esp, 4
test eax, eax
je 0x100d104f
mov ecx, 5
mov eax, esi
call fcn.100d0f20
mov eax, 0x2a
jmp 0x100d1051
Function at 0x100d2270
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100d22a5
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.100c1180
add esp, 0xc
jmp 0x100d22de
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp]
cmp al, 2
jne 0x100d22d0
shr eax, 8
test al, al
jne 0x100d22d0
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.1008545e
add esp, 0x194
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.100c1180
add esp, 8
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.1008545e
add esp, 0x194
ret

Function at 0x100d2460
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x130]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x100d24a4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.100c1180
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.100d2360
add esp, 4
pop esi
pop ecx
ret
Function at 0x100d3aa0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esi + 0x134]
push ebp
push edi
mov edi, dword [esi]
push 1
push 0
push edi
or ebp, 0xffffffff
mov dword [esp + 0x18], 0x10
call fcn.100c15c0
add esp, 0xc
test eax, eax
jl 0x100d3b09
mov ecx, 0x3e8
cmp eax, ecx
jge 0x100d3ae0
mov ecx, eax
push ecx
push 0xffffffffffffffff
push ebx
call fcn.100dba10
add esp, 0xc
cmp eax, 0xffffffff
je 0x100d3ba4
test eax, eax
jne 0x100d3b2e
push 1
push eax
push edi
call fcn.100c15c0
add esp, 0xc
test eax, eax
jge 0x100d3ad5
push str.Timeout_while_waiting_for_server_connect
push edi
call fcn.100c1180
add esp, 8
pop edi
pop ebp
mov eax, 0x1c
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1008545e
add esp, 0x18
ret
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x100d3b5e
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebp, eax
push ebx
push esi
call fcn.100c1df0
add esp, 8
cmp ebp, 0xffffffff
jne 0x100d3b74
push str.Error_accept__ing_server_connect
jmp 0x100d3ba9
push str.Connection_accepted_from_server_n
push edi
call fcn.100c10f0
push 1
push ebp
mov dword [esi + 0x134], ebp
call fcn.100deaf0
add esp, 0x10
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1008545e
add esp, 0x18
ret
push str.Error_while_waiting_for_server_connect
push edi
call fcn.100c1180
mov ecx, dword [esp + 0x28]
add esp, 8
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x1e
call fcn.1008545e
add esp, 0x18
ret
Function at 0x100d4b50
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x100d4b86
push str.Couldnt_set_desired_mode
push ebx
call fcn.100c1180
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x100d4b9d
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.100c10f0
add esp, 0xc
cmp ebp, 0x13
jne 0x100d4baf
mov eax, edi
call fcn.100d4710
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x100d4bc3
push edi
call fcn.100d4760
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x100d4bd5
mov eax, edi
call fcn.100d4880
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x100d4be3
mov eax, edi
call fcn.100d4890
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x100dba10
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
cmp ebx, 0xffffffff
jne 0x100dba54
cmp ebp, ebx
jne 0x100dba54
mov eax, dword [esp + 0x334]
push eax
call fcn.100db9e0
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x100dba6f
mov esi, edi
call fcn.100c7d90
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
cmp ebx, 0xffffffff
je 0x100dbaa3
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
mov dword [esp + 0x228], eax
cmp ebp, 0xffffffff
je 0x100dbae7
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
test ecx, ecx
jbe 0x100dbad0
cmp dword [esp + eax*4 + 0x24], ebp
je 0x100dbad0
inc eax
cmp eax, ecx
jb 0x100dbac5
cmp eax, ecx
jne 0x100dbae1
cmp ecx, 0x40
jae 0x100dbae1
mov dword [esp + eax*4 + 0x24], ebp
inc dword [esp + 0x20]
cmp ebp, edx
jbe 0x100dbae7
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea ecx, [esp + 0x18]
lea ebp, [edx + 1]
dec ebx
and ebx, ecx
xor eax, eax
cmp edi, eax
jle 0x100dbb29
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov edx, esi
sub edx, eax
imul edx, edx, 0x3e8
mov dword [esp + 0x1c], edx
jmp 0x100dbb33
jne 0x100dbb33
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x130]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x100dbb9d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x100dbb66
cmp eax, 0x2714
jne 0x100dbba1
test edi, edi
jle 0x100dbaf8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.100c7d90
push edx
push eax
call fcn.100c7dc0
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x100dbaf8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x100dbbaf
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x100dbbbe
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x100dbbf5
lea edx, [esp + 0x124]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100dbbe3
mov esi, 1
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100dbbf5
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x100dbc28
lea ecx, [esp + 0x228]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100dbc16
or esi, 2
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100dbc28
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x100dcab0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.100a5bef
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x100dcb15
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x100dcb15
lea edx, [esp]
push edx
call dword [0x10208cf4]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1008545e
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.1008545e
add esp, 0x108
ret
jmp 0x100dcab0

Function at 0x100dcb30
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.100a5bef
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x100dcb15
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x100dcb15
lea edx, [esp]
push edx
call dword [0x10208cf4]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1008545e
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.1008545e
add esp, 0x108
ret
jmp 0x100dcab0

Function at 0x100def10
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a4]
test esi, esi
jne 0x100def29
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.100c7d90
push edx
push eax
call fcn.100c7dc0
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x100def76
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x120]
push eax
push ecx
call fcn.100c7d90
push edx
push eax
call fcn.100c7dc0
mov ecx, dword [edi + 0x19c]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x100def78
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x100dffd0
Capabilities:
Authenticate hmac

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x10208ce8]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100dfff5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x100e003c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x100e0040
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x100e009e
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x100e0063
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x100e00e1
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x101b69a6
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x101b69a7
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x100e00b0
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x100e0000
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x10208ce8]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100dfff5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x100e003c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x100e0040
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x100e009e
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x100e0063
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x100e00e1
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x101b69a6
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x101b69a7
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x100e00b0
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x100e01b0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x100e01e2
push 0x2e
push esi
call fcn.1008c440
add esp, 8
test eax, eax
je 0x100e01e0
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x100f70b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
inc edx
cmp eax, 0x302
mov dword [esp + 0x18], edx
jge 0x100f70dd
cmp eax, 0x100
je 0x100f70dd
mov esi, dword [esp + 0x10]
cmp edx, dword [esi + 4]
jbe 0x100f70f9
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 4]
add edx, ecx
cmp edx, eax
ja 0x100f70d8
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub eax, ecx
mov dword [esi + 4], eax
test dword [edi + 0x100], 0x200
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push ebx
movzx ebx, byte [eax + ecx - 1]
push ebp
je 0x100f715a
cmp dword [edi + 0x88], 0
jne 0x100f715a
mov edx, dword [edi + 0x58]
mov ecx, 8
mov eax, 0x101bc484
add edx, ecx
sub edx, eax
lea esp, [esp]
mov ebp, dword [edx + eax]
cmp ebp, dword [eax]
jne 0x100f714d
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x100f7130
test bl, 1
jne 0x100f714d
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov edx, dword [edi + 0x58]
test byte [edx], 8
je 0x100f715a
test ebx, ebx
jbe 0x100f715a
dec ebx
mov eax, dword [edi + 0x80]
mov ecx, dword [eax]
push ecx
call fcn.10126d80
add esp, 4
test eax, 0x200000
je 0x100f7184
or edx, 0xffffffff
pop ebp
sub edx, ebx
add dword [esi + 4], edx
pop ebx
pop edi
mov eax, 1
pop esi
ret
mov edx, dword [esi + 4]
mov eax, edx
sub eax, ebx
sub eax, dword [esp + 0x20]
mov ecx, 0xff
not eax
lea edi, [edx - 1]
sar eax, 0x1f
cmp edi, ecx
jae 0x100f71a2
mov ecx, edi
test ecx, ecx
jbe 0x100f71dd
mov edi, dword [esi + 0xc]
mov dword [esp + 0x20], ebx
lea edi, [edi + edx - 1]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x20]
movzx ebp, byte [edi]
not ecx
sar ecx, 0x1f
movzx ecx, cl
xor ebp, ebx
and ecx, ebp
not ecx
and eax, ecx
mov ecx, 1
sub dword [esp + 0x20], ecx
sub edi, ecx
sub dword [esp + 0x14], ecx
jne 0x100f71b5
mov ecx, eax
shr ecx, 4
and eax, ecx
mov ecx, eax
shr ecx, 2
and eax, ecx
lea ecx, [eax + eax]
and ecx, eax
shl ecx, 0x1e
sar ecx, 0x1f
lea eax, [ebx + 1]
and eax, ecx
sub edx, eax
shl eax, 8
or dword [esi], eax
pop ebp
mov eax, ecx
pop ebx
and eax, 1
not ecx
pop edi
mov dword [esi + 4], edx
or eax, ecx
pop esi
ret
Function at 0x100f7220
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.100860f0
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x9c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb0]
push edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x10], edi
sub edi, esi
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], edi
cmp dword [esp + 0xb8], esi
jae 0x100f7284
push str.orig_len___md_size
push 0x113
push str.._ssl_s3_cbc.c
call fcn.10107950
add esp, 0xc
cmp esi, 0x40
jbe 0x100f72a0
push str.md_size___EVP_MAX_MD_SIZE
push 0x114
push str.._ssl_s3_cbc.c
call fcn.10107950
add esp, 0xc
mov eax, dword [esp + 0xb8]
lea ebp, [esp + 0x24]
neg ebp
and ebp, 0x3f
lea edx, [esi + 0x100]
lea ebp, [esp + ebp + 0x24]
cmp eax, edx
jbe 0x100f72c8
mov ebx, eax
sub ebx, esi
sub ebx, 0x100
mov eax, esi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebx
add eax, edi
xor edx, edx
div esi
push esi
push 0
push ebp
mov edi, edx
mov dword [esp + 0x28], edi
call fcn.10085bc0
add esp, 0xc
xor ecx, ecx
cmp ebx, dword [esp + 0xb8]
jae 0x100f7365
mov eax, dword [esp + 0xb0]
mov eax, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xb8]
mov edi, ebx
sub edi, edx
sub edx, dword [esp + 0x14]
sub eax, ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
jmp 0x100f7328
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov bl, byte [ebx]
mov eax, edi
not eax
sar eax, 0x1f
add edx, edi
not al
and al, bl
not edx
sar edx, 0x1f
and al, dl
or byte [ecx + ebp], al
mov edx, 1
add dword [esp + 0x18], edx
add ecx, edx
mov eax, ecx
sub eax, esi
sar eax, 0x1f
and ecx, eax
add edi, edx
sub dword [esp + 0x10], edx
jne 0x100f7324
mov edi, dword [esp + 0x1c]
xor eax, eax
test esi, esi
jbe 0x100f7391
jmp 0x100f7370
mov ecx, edi
xor ecx, 0x20
mov dl, byte [ecx + ebp]
mov cl, byte [edi + ebp]
mov edx, dword [esp + 0x20]
mov byte [edx + eax], cl
inc edi
mov ecx, edi
sub ecx, esi
sar ecx, 0x1f
inc eax
and edi, ecx
cmp eax, esi
jb 0x100f7370
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1008545e
add esp, 0x98
ret