joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10207b50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 1
jb 0x10207bfc
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
sub esi, edx
lea esp, [esp]
mov al, byte [edx]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x10207b7d
jmp dword [ecx*4 + 0x10207c00]
mov al, 0x41
jmp case.default.0x10207b7d
mov al, 0x42
jmp case.default.0x10207b7d
mov al, 0x43
jmp case.default.0x10207b7d
mov al, 0x44
jmp case.default.0x10207b7d
mov al, 0x45
jmp case.default.0x10207b7d
mov al, 0x46
jmp case.default.0x10207b7d
mov al, 0x47
jmp case.default.0x10207b7d
mov al, 0x48
jmp case.default.0x10207b7d
mov al, 0x49
jmp case.default.0x10207b7d
mov al, 0x4a
jmp case.default.0x10207b7d
mov al, 0x4b
jmp case.default.0x10207b7d
mov al, 0x4c
jmp case.default.0x10207b7d
mov al, 0x4d
jmp case.default.0x10207b7d
mov al, 0x4e
jmp case.default.0x10207b7d
mov al, 0x4f
jmp case.default.0x10207b7d
mov al, 0x50
jmp case.default.0x10207b7d
mov al, 0x51
jmp case.default.0x10207b7d
mov al, 0x52
jmp case.default.0x10207b7d
mov al, 0x53
jmp case.default.0x10207b7d
mov al, 0x54
jmp case.default.0x10207b7d
mov al, 0x55
jmp case.default.0x10207b7d
mov al, 0x56
jmp case.default.0x10207b7d
mov al, 0x57
jmp case.default.0x10207b7d
mov al, 0x58
jmp case.default.0x10207b7d
mov al, 0x59
jmp case.default.0x10207b7d
mov al, 0x5a
mov byte [esi + edx], al
mov al, byte [edx]
inc edx
test al, al
je 0x10207bfb
dec edi
jne 0x10207b70
pop esi
pop edi
pop ebp
ret
Function at 0x10210aa0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x10255d64
push ecx
call fcn.101fa700
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.1020fc50
test eax, eax
jne 0x10210ad4
mov eax, esi
pop ebp
jmp fcn.10210060
pop ebp
ret
Function at 0x10210e80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + 0x408]
push edi
mov edi, dword [ebx]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [ebp - 0x84]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x10210ef8
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.10230070
mov edx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 0x148], edx
mov ecx, dword [esi + 0x14c]
cmp ecx, 4
jge 0x10210f21
push str.Received_too_short_packet
push edi
call fcn.101fa7b0
add esp, 8
mov dword [esi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x15c]
movzx eax, byte [edx]
movzx edx, byte [edx + 1]
shl ax, 8
movzx eax, ax
or eax, edx
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x10210f46
jmp dword [eax*4 + 0x10211068]
cmp ecx, 4
jle case.0x10210f46.4
mov eax, dword [esi + 0x15c]
movzx edx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl dx, 8
movzx edx, dx
or edx, eax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, edx
jne case.0x10210f46.4
add ecx, 0xfffffffc
push ecx
mov ecx, dword [esi + 0x15c]
add ecx, 4
push ecx
push 1
push ebx
call fcn.101fab90
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10210fb3
mov eax, 5
mov ecx, esi
call fcn.10210e00
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x70], eax
mov eax, dword [edi + 0x70]
adc dword [edi + 0x74], edx
mov edx, dword [edi + 0x74]
push edx
push eax
push edi
call fcn.102011f0
mov ebx, dword [ebp + 8]
jmp 0x10211039
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl cx, 8
movzx edx, cx
mov ecx, dword [esi + 0x15c]
add ecx, 4
push ecx
or edx, eax
push 0x10255d64
push edi
mov dword [esi + 8], edx
call fcn.101fa700
jmp 0x10211039
mov edx, dword [esi + 0x15c]
add ecx, 0xfffffffe
push ecx
add edx, 2
push edx
push esi
call fcn.1020fdb0
add esp, 0xc
test eax, eax
je case.0x10210f46.4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x102591fc
push edi
call fcn.101fa7b0
add esp, 0xc
push ebx
call fcn.102012b0
add esp, 4
test eax, eax
je 0x10210f18
mov eax, 5
mov ecx, esi
call fcn.10210e00
pop edi
pop esi
mov eax, 0x2a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102127c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x102127f4
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.101fa7b0
add esp, 0xc
mov eax, 2
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x10212811
shr eax, 8
test al, al
jne 0x10212811
xor eax, eax
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.101fa7b0
add esp, 8
mov eax, 2
mov esp, ebp
pop ebp
ret

Function at 0x102129a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [edi + 0x150]
push ebx
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [ebp - 4]
mov ebx, eax
mov al, byte [ebp + 8]
push ecx
push edx
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], al
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x102129e5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.101fa7b0
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ebx
mov ebx, str.SENT
call fcn.102128a0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10212ab0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov ebx, eax
mov eax, dword [edi]
mov eax, dword [eax + 0x128]
mov ecx, dword [eax + ebx*4 + 0xc08]
dec ecx
je 0x10212b42
dec ecx
je 0x10212b1e
dec ecx
jne 0x10212b98
mov ecx, dword [eax + ebx*4 + 0x1008]
xor edx, edx
sub ecx, edx
je 0x10212b11
dec ecx
jne 0x10212b98
mov dword [eax + ebx*4 + 0xc08], 2
mov dword [eax + ebx*4 + 0x1008], edx
push 0xfd
mov eax, ebx
call fcn.102129a0
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov dword [eax + ebx*4 + 0xc08], edx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + ebx*4 + 0x1008]
xor edx, edx
sub ecx, edx
je 0x10212b11
dec ecx
jne 0x10212b98
pop edi
mov dword [eax + ebx*4 + 0xc08], edx
mov dword [eax + ebx*4 + 0x1008], edx
pop ebx
mov esp, ebp
pop ebp
ret
push esi
xor edx, edx
push edx
push 3
mov dword [eax + ebx*4 + 0xc08], edx
mov edx, dword [edi + 0x150]
mov esi, dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
mov word [ebp - 4], 0xfeff
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x10212b84
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.101fa7b0
add esp, 0xc
mov ecx, dword [edi]
mov eax, ebx
mov esi, 0xfe
mov ebx, str.SENT
call fcn.102128a0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10212ba0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov ebx, eax
mov eax, dword [edi]
mov eax, dword [eax + 0x128]
mov ecx, dword [eax + ebx*4 + 8]
dec ecx
je 0x10212c26
dec ecx
je 0x10212c05
dec ecx
jne 0x10212c79
mov ecx, dword [eax + ebx*4 + 0x408]
xor edx, edx
sub ecx, edx
je 0x10212bfb
dec ecx
jne 0x10212c79
mov dword [eax + ebx*4 + 8], 2
mov dword [eax + ebx*4 + 0x408], edx
push 0xfb
mov eax, ebx
call fcn.102129a0
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov dword [eax + ebx*4 + 8], edx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + ebx*4 + 0x408]
xor edx, edx
sub ecx, edx
je 0x10212bfb
dec ecx
jne 0x10212c79
pop edi
mov dword [eax + ebx*4 + 8], edx
mov dword [eax + ebx*4 + 0x408], edx
pop ebx
mov esp, ebp
pop ebp
ret
push esi
xor edx, edx
push edx
push 3
mov dword [eax + ebx*4 + 8], edx
mov edx, dword [edi + 0x150]
mov esi, dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
mov word [ebp - 4], 0xfcff
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x10212c65
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.101fa7b0
add esp, 0xc
mov ecx, dword [edi]
mov eax, ebx
mov esi, 0xfc
mov ebx, str.SENT
call fcn.102128a0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10213700
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x128]
mov dword [ebp - 4], eax
jne 0x1021384f
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea esi, [ebx + 0x1eb0]
mov dword [esi], edi
cmp edi, esi
jae 0x10213736
mov byte [edi], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10213741
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x1021374c
mov byte [eax], 0x1f
inc dword [esi]
movzx ecx, word [ebx + 0x1ca8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [ebp + 0xc], edx
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
mov eax, dword [esi]
cmp eax, esi
jae 0x1021377e
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x1021378b
mov dl, byte [ebp + 0xd]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10213795
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x1021379f
mov byte [eax], ch
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x102137aa
mov byte [eax], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x102137b5
mov byte [eax], 0xf0
inc dword [esi]
mov eax, dword [esi]
mov dword [ebx + 0x1eb4], eax
sub eax, edi
sub eax, 2
push eax
lea edx, [ebx + 0x1cb2]
push edx
mov dword [esi], edi
mov esi, dword [ebp - 4]
push 0x3e
call fcn.10212c80
mov esi, dword [sym.imp.WS2_32.dll_send]
add esp, 0xc
push 0
push 3
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x150]
push eax
call esi
test eax, eax
jns 0x1021380c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 4]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.101fa7b0
add esp, 0xc
lea edx, [ebx + 0x1cb3]
push 4
push edx
call fcn.102134e0
mov eax, dword [edi + 0x150]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push eax
call esi
pop edi
pop esi
test eax, eax
jns 0x1021384f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 4]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.101fa7b0
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10214350
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [edi]
push ebx
mov ebx, dword [edi + 0x154]
push esi
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x18]
push edx
push ebx
mov dword [ebp - 8], eax
or esi, 0xffffffff
mov dword [ebp - 4], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x10214398
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
mov dword [ebp - 4], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push ebx
push edi
call fcn.101fd4e0
add esp, 8
cmp esi, 0xffffffff
jne 0x102143c3
mov edx, dword [ebp - 8]
push str.Error_accept__ing_server_connect
push edx
call fcn.101fa7b0
add esp, 8
pop esi
mov eax, 0x1e
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
push str.Connection_accepted_from_server_n
push ebx
call fcn.101fa700
push 1
push esi
mov dword [edi + 0x154], esi
call fcn.1021bf20
mov dword [edi + 0x164], 1
mov eax, dword [ebx + 0x1b0]
add esp, 0x10
test eax, eax
je 0x10214428
mov ecx, dword [ebx + 0x1b4]
push 1
push esi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x10214428
push esi
push edi
call fcn.101fd4e0
add esp, 8
pop esi
mov dword [edi + 0x154], 0xffffffff
mov eax, 0x2a
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10217d00
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [edi]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
cmp eax, 2
je 0x10217d38
push str.Couldnt_set_desired_mode
push ebx
call fcn.101fa7b0
add esp, 8
pop edi
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x10217d4f
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.101fa700
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x10217d67
push edi
call fcn.10217c80
add esp, 4
pop edi
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x10217d7c
push edi
call fcn.10214d20
add esp, 4
pop edi
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x10217d94
push 0xd
push 1
call fcn.10217060
add esp, 8
pop edi
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x10217da7
push 0xe
push 1
call fcn.10217060
add esp, 8
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x1021a6b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.102355e7
add esp, 4
mov byte [ebp - 0x104], 0
test eax, eax
je 0x1021a700
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x104], 0
je 0x1021a700
lea edx, [ebp - 0x104]
push edx
call dword [0x102d99c0]
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1021cc20
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x1021cc42
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x1021cc36
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x1021cc72
cmp dword [esi + 8], 0
jne 0x1021cc65
mov ecx, dword [eax + 8]
push 0x10256a58
push ecx
call fcn.102327c7
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x1021cc65
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.1023259a
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1021cc94
mov eax, dword [esi + 8]
test eax, eax
je 0x1021cc8e
push eax
call fcn.102322dc
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x1021db30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push esi
push edi
mov edi, eax
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp + 8]
mov esi, eax
sar esi, 1
and ecx, 1
lea eax, [esi + edi]
add esi, ecx
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
mov dword [ebp - 4], eax
push edx
lea eax, [ebp - 0x204]
call fcn.1021d990
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 4]
push ebx
push eax
push ecx
lea eax, [ebp - 0x104]
call fcn.1021da50
add esp, 0x18
xor eax, eax
pop edi
pop esi
test ebx, ebx
jle 0x1021dba9
jmp 0x1021db90
mov dl, byte [ebp + eax - 0x104]
xor dl, byte [ebp + eax - 0x204]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx], dl
inc eax
cmp eax, ebx
jl 0x1021db90
mov esp, ebp
pop ebp
ret

Function at 0x1021dbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov ecx, dword [0x102ac98c]
mov eax, dword [str.master_secret]
mov edx, dword [0x102ac990]
push ebx
push esi
mov dword [ebp - 0x8c], ecx
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx + 0x14]
push edi
mov dword [ebp - 0x90], eax
mov ax, word [0x102ac994]
mov dword [ebp - 0x88], edx
mov word [ebp - 0x84], ax
lea esi, [ebx + 0xf8]
mov ecx, 8
lea edi, [ebp - 0x83]
rep movsd dword es:[edi], dword [esi]
push 0x30
lea esi, [ebx + 0x118]
mov ecx, 8
lea edi, [ebp - 0x63]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x90]
push 0x4d
push edx
lea eax, [ebp - 0x190]
mov esi, 0x18
add ebx, 0xc8
call fcn.1021d990
push 0x30
lea eax, [ebp - 0x90]
push 0x4d
push eax
add edi, esi
lea eax, [ebp - 0x290]
call fcn.1021da50
lea ecx, [ebp - 0x18f]
mov edx, ebx
sub edx, ecx
sub ecx, ebx
mov dword [ebp + 0xc], ecx
lea ecx, [ebp - 0x28f]
sub ecx, ebx
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x18e]
sub ecx, ebx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x28e]
sub ecx, ebx
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x18d]
sub ecx, ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28d]
sub ecx, ebx
mov esi, 0xfffffffe
add esp, 0x18
lea eax, [ebx + 2]
mov dword [ebp - 0xc], ecx
sub esi, ebx
lea ecx, [esi + eax]
movzx ebx, byte [ebp + ecx - 0x290]
xor bl, byte [ebp + ecx - 0x190]
lea edi, [ebp + ecx - 0x18f]
mov byte [edi + edx], bl
movzx ebx, byte [ebp + ecx - 0x28f]
xor bl, byte [edi]
mov edi, dword [ebp + 0xc]
mov byte [eax - 1], bl
movzx ebx, byte [ebp + ecx - 0x18e]
xor bl, byte [ebp + ecx - 0x28e]
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + eax]
xor cl, byte [edi + eax]
mov edi, dword [ebp - 0x10]
mov byte [eax + 1], cl
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax]
xor cl, byte [edi + eax]
mov edi, dword [ebp - 4]
mov byte [eax + 2], cl
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax]
xor cl, byte [edi + eax]
mov byte [eax], bl
mov byte [eax + 3], cl
add eax, 6
lea ecx, [esi + eax]
cmp ecx, 0x30
jl 0x1021dca4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1021dd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
sub esp, 0x3c8
push ebx
push esi
push edi
mov ecx, 0x16
mov esi, eax
lea edi, [ebp - 0x368]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x58]
mov ecx, 0x18
lea edi, [ebp - 0x3c8]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
lea ebx, [ebp - 0x90]
test esi, esi
je 0x1021ddf3
mov edx, ebx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1021ddd4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1021dde3
sub eax, edx
lea ebx, [ebp + eax - 0x90]
lea ecx, [ebp - 0x368]
push ecx
push ebx
call sym.lime.ndll__MD5_Final_8
lea edx, [ebp - 0x3c8]
push edx
add ebx, 0x10
push ebx
call fcn.10225410
add esp, 8
test esi, esi
je 0x1021df8e
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 0x14]
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x90]
sub ebx, eax
push 0x18
add edi, 0xc8
lea esi, [ebx + 0x14]
push edi
push esi
push eax
lea ebx, [edi + 0x18]
call fcn.10222aa0
push esi
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.10230070
lea eax, [ebp - 0x210]
push eax
push 0x18
push edi
lea ecx, [esi + 0x10]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.10222aa0
lea eax, [ebp - 0x110]
push eax
push 0x18
push ebx
lea ecx, [ebp - 0x90]
push esi
push ecx
call fcn.10222b90
add esp, 0x48
push esi
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0xfc]
push eax
call fcn.10230070
lea ecx, [ebp - 0x310]
push ecx
push 0x18
push ebx
add esi, 0x14
lea edx, [ebp - 0x110]
push esi
push edx
call fcn.10222b90
mov ecx, dword [ebp + 0x10]
lea esi, [ebp - 0x20f]
mov edx, ecx
sub edx, esi
sub esi, ecx
mov dword [ebp + 0xc], esi
lea esi, [ebp - 0x30f]
sub esi, ecx
mov dword [ebp + 8], esi
lea esi, [ebp - 0x20e]
sub esi, ecx
mov dword [ebp - 0xc], esi
lea esi, [ebp - 0x30e]
sub esi, ecx
mov dword [ebp - 8], esi
lea esi, [ebp - 0x20d]
sub esi, ecx
mov dword [ebp - 4], esi
lea esi, [ebp - 0x30d]
sub esi, ecx
mov dword [ebp - 0x10], esi
mov esi, 0xfffffffe
add esp, 0x20
lea eax, [ecx + 2]
sub esi, ecx
lea ecx, [esi + eax]
movzx ebx, byte [ebp + ecx - 0x310]
xor bl, byte [ebp + ecx - 0x210]
lea edi, [ebp + ecx - 0x20f]
mov byte [edi + edx], bl
movzx ebx, byte [ebp + ecx - 0x30f]
xor bl, byte [edi]
mov edi, dword [ebp + 0xc]
mov byte [eax - 1], bl
movzx ebx, byte [ebp + ecx - 0x20e]
xor bl, byte [ebp + ecx - 0x30e]
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + eax]
xor cl, byte [edi + eax]
mov edi, dword [ebp - 0xc]
mov byte [eax + 1], cl
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax]
xor cl, byte [edi + eax]
mov edi, dword [ebp - 4]
mov byte [eax + 2], cl
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ecx + eax]
xor cl, byte [edi + eax]
mov byte [eax], bl
mov byte [eax + 3], cl
add eax, 6
lea ecx, [esi + eax]
cmp ecx, 0xc
jl 0x1021df12
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
mov ecx, 9
lea esi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1021edc0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push edi
movzx edi, word [esi + 0x442c]
xor eax, eax
lea ebx, [esi + 0x28]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov al, byte [ebp + 8]
mov byte [ebx], al
mov byte [ebx + 1], 3
mov cl, byte [esi + 0xb]
add edi, 5
push edi
and cl, 0xf
mov byte [ebx + 2], cl
mov dl, byte [esi + 0x442d]
push edi
mov byte [ebx + 3], dl
movzx eax, byte [esi + 0x442c]
push ebx
push str.sending__d_bytes
push esi
mov byte [ebx + 4], al
call fcn.1021e900
add esp, 0x14
test edi, edi
jle 0x1021ee85
lea ebx, [ebx]
mov eax, dword [ebp - 4]
push 0
mov ecx, edi
sub ecx, eax
push ecx
lea edx, [ebx + eax]
mov eax, dword [esi + 0x18]
push edx
push eax
call sub.WS2_32.dll_send
mov dword [ebp - 8], eax
test eax, eax
js 0x1021ee43
add dword [ebp - 4], eax
jmp 0x1021ee50
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
jne 0x1021eea3
cmp dword [ebp - 4], edi
je 0x1021ee85
mov eax, dword [esi + 0x18]
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
mov dword [ebp - 0x108], eax
push 0
inc eax
push eax
mov dword [ebp - 0x10c], 1
call sub.WS2_32.dll_select
test eax, eax
js 0x1021eea3
cmp dword [ebp - 4], edi
jl 0x1021ee20
or dword [esi], 1
xor edx, edx
cmp byte [ebp + 8], 0x17
mov word [esi + 0x442c], dx
je 0x1021ee9a
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff00
pop ebx
mov esp, ebp
pop ebp
ret