joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6008f7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x6b1890]
je 0x600912
inc edi
cmp edi, 0x17
jb 0x600903
cmp edi, 0x17
jae 0x600a92
push ebp
push 3
call fcn.0060a74e
cmp eax, 1
pop ecx
je 0x600a5e
push 3
call fcn.0060a74e
test eax, eax
pop ecx
jne 0x600946
cmp dword [0x6b16ec], 1
je 0x600a5e
cmp ebx, 0xfc
je 0x600a91
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x6d2ef8
push ebp
call fcn.00601954
add esp, 0xc
test eax, eax
je 0x60097c
push esi
push esi
push esi
push esi
push esi
call fcn.00601719
add esp, 0x14
push 0x104
mov esi, 0x6d2f11
push esi
push 0
mov byte [0x6d3015], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6009c0
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00601954
add esp, 0xc
test eax, eax
je 0x6009c0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00601719
add esp, 0x14
push esi
call fcn.005fc590
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x600a05
push esi
call fcn.005fc590
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6d320c
push 0x68d334
sub ecx, eax
push ecx
push eax
call fcn.00605d6e
add esp, 0x14
test eax, eax
je 0x600a05
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00601719
add esp, 0x14
jmp 0x600a07
xor esi, esi
push 0x68d330
push ebx
push ebp
call fcn.0060a6dd
add esp, 0xc
test eax, eax
je 0x600a27
push esi
push esi
push esi
push esi
push esi
call fcn.00601719
add esp, 0x14
push dword [edi*8 + 0x6b1894]
push ebx
push ebp
call fcn.0060a6dd
add esp, 0xc
test eax, eax
je 0x600a49
push esi
push esi
push esi
push esi
push esi
call fcn.00601719
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0060a520
add esp, 0xc
jmp 0x600a91
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x600a91
cmp ebp, 0xffffffff
je 0x600a91
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x6b1894]
push dword [esi]
call fcn.005fc590
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x60a520
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.005fef51
xor ebx, ebx
cmp dword [0x6d37fc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x60a5f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x60a6d6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x691254
push edi
call esi
cmp eax, ebx
je 0x60a6d6
push eax
call fcn.005feee3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6d37fc], eax
call esi
push eax
call fcn.005feee3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6d3800], eax
call esi
push eax
call fcn.005feee3
mov dword [0x6d3804], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00600684
test eax, eax
pop ecx
pop ecx
je 0x60a5c4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00601719
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x60a5f6
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.005feee3
cmp eax, ebx
pop ecx
mov dword [0x6d380c], eax
je 0x60a5f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005feee3
pop ecx
mov dword [0x6d3808], eax
mov eax, dword [0x6d3808]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x60a67b
cmp dword [0x6d380c], ecx
je 0x60a67b
push eax
call fcn.005fef5a
push dword [0x6d380c]
mov esi, eax
call fcn.005fef5a
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x60a67b
cmp edi, ebx
je 0x60a67b
call esi
cmp eax, ebx
je 0x60a648
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x60a648
test byte [ebp - 0x18], 1
jne 0x60a67b
lea eax, [ebp - 0x10]
push eax
call fcn.006006bb
test eax, eax
pop ecx
je 0x60a663
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00601719
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x60a672
or dword [ebp + 0x10], 0x200000
jmp 0x60a6b6
or dword [ebp + 0x10], 0x40000
jmp 0x60a6b6
mov eax, dword [0x6d3800]
cmp eax, dword [ebp - 8]
je 0x60a6b6
push eax
call fcn.005fef5a
cmp eax, ebx
pop ecx
je 0x60a6b6
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x60a6b6
mov eax, dword [0x6d3804]
cmp eax, dword [ebp - 8]
je 0x60a6b6
push eax
call fcn.005fef5a
cmp eax, ebx
pop ecx
je 0x60a6b6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6d37fc]
call fcn.005fef5a
cmp eax, ebx
pop ecx
je 0x60a6d6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x60a6d8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6108c8
Capabilities:
Encode data using xor

Disassembly:
or dword [ecx], 0xffffffff
push esi
xor edx, edx
add ecx, 4
push edi
push 8
mov eax, edx
pop esi
mov edi, eax
and edi, 1
neg edi
and edi, dword [esp + 0xc]
shr eax, 1
xor eax, edi
dec esi
jne 0x6108d7
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0x100
jl 0x6108d2
pop edi
pop esi
ret 4

Function at 0x6108fc
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
mov edx, dword [esp + 4]
mov eax, dword [ecx]
jle 0x610923
push esi
push edi
movzx esi, byte [edx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4 + 4]
inc edx
dec dword [esp + 0x10]
jne 0x61090b
pop edi
pop esi
mov dword [ecx], eax
ret 8
Function at 0x4163f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 0xc]
lea eax, [edx + 5]
push esi
cmp eax, 4
ja case.0x416403.2
jmp dword [eax*4 + 0x4164ac]
mov ecx, dword [ebp + 8]
xor eax, eax
add ecx, 0xffffffc0
cmp edx, 0xfffffffc
sete al
push eax
call fcn.00416b20
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x18]
lea eax, [esi + 8]
push eax
call edx
test byte [esi + 0x68], 4
je 0x416461
mov eax, dword [esi + 0x5c]
and dword [esi + 0x68], 0xfffffffb
test eax, eax
je 0x416461
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x416461
mov eax, dword [esi + 0x5c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, str.FAIL
test edx, edx
jle 0x41648e
push 0x30b
push 0x495260
call fcn.00415910
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x317
push str.Unrecognized_Negative_verb_in_DoVerb__.__bad.
call fcn.00415910
add esp, 8
mov eax, 0x80004001
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x41b900
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4934c4]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0041b7f0
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41b981
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x41b947
mov edx, dword [ebp - 0x18]
push edx
jmp 0x41b97b
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0043df70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004554c3
mov esp, ebp
pop ebp
ret
Function at 0x403436
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x41cce0
push esi
push edi
push 0
push 0x400
push 0x53bf08
push dword [0x533cb4]
call dword [sym.imp.WS2_32.dll_recv]
push str.MonRecvCommand
push 0x5001d1
push 0
push 3
mov edi, eax
call fcn.00401780
add esp, 0x10
cmp edi, 0xffffffff
jne 0x41cd3f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.00403db9
xor eax, eax
cmp esi, 0x2733
setne al
lea eax, [eax*2 + 1]
jmp 0x41cdac
test edi, edi
jle 0x41cd91
mov eax, dword [0x53bf04]
xor esi, esi
nop word [eax + eax]
cmp esi, eax
jne 0x41cd88
push 4
lea eax, [esi + 0x53bf09]
push str.END
push eax
call fcn.00405821
inc dword [0x53bf00]
add esp, 0xc
test eax, eax
je 0x41cd8d
mov eax, dword [0x53bf04]
movsx ecx, byte [esi + 0x53bf08]
inc eax
add eax, ecx
mov dword [0x53bf04], eax
inc esi
cmp esi, edi
jl 0x41cd50
xor eax, eax
jmp 0x41cdac
push str.Command_buffer_overflow
push 0x5001d1
push 0
push 3
call fcn.00401780
add esp, 0x10
mov eax, 3
push 0x53bf08
push eax
push str.MonRecvCommand__d__s
push 0x5001d1
push 2
push 3
mov dword [0x53c308], eax
call fcn.00401780
mov eax, dword [0x53c308]
add esp, 0x18
pop edi
pop esi
ret

Function at 0x40575e
Capabilities:
Terminate thread

Disassembly:
jmp 0x411460
push esi
mov esi, ecx
mov eax, dword [esi + 0xc04]
mov dword [esi], vtable.SOL::IPAddressChangeNotifier.0
test eax, eax
je 0x411484
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc04], 0
push 0xbe0
lea eax, [esi + 0x1c]
push 0
push eax
call fcn.00402b12
add esp, 0xc
mov dword [esi + 0xc00], 0
mov dword [esi + 0xbfc], 0
mov ecx, esi
mov dword [esi + 0x14], vtable.SOL::Object.0
pop esi
jmp fcn.004021da

Function at 0x405768
Capabilities:
Resume thread

Disassembly:
jmp 0x415180
push dword [ecx + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x40fb80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
jle 0x40fbd0
mov eax, dword [ebp + 0xc]
add eax, 2
push esi
movzx ecx, byte [eax - 1]
lea eax, [eax + 4]
movzx edx, byte [eax - 3]
mov esi, dword [ecx*4 + 0x532560]
movzx ecx, byte [eax - 6]
xor esi, dword [edx*4 + 0x532d60]
xor esi, dword [ecx*4 + 0x532160]
movzx ecx, byte [eax - 4]
xor esi, dword [ecx*4 + 0x532960]
mov ecx, dword [ebp + 8]
mov dword [ecx + edi*4], esi
inc edi
cmp edi, ebx
jl 0x40fb95
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40fbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0x18
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edx, edx
jle 0x40fd57
push ebx
mov ebx, dword [ebp + 0x10]
cmp edx, 2
jb 0x40fd3b
lea eax, [edx - 1]
lea eax, [ebx + eax*4]
cmp edi, eax
ja 0x40fc30
lea eax, [edx - 1]
lea eax, [edi + eax*4]
cmp eax, ebx
jae 0x40fd3b
lea eax, [edx - 1]
lea eax, [esi + eax*4]
cmp edi, eax
ja 0x40fc48
lea eax, [edx - 1]
lea eax, [edi + eax*4]
cmp eax, esi
jae 0x40fd3b
cmp edx, 0x10
jb 0x40fcf9
mov eax, edx
add ebx, 0x10
and eax, 0xfffffff0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], eax
mov edx, edi
sub edx, dword [ebp + 0x10]
lea eax, [edi + 0x20]
mov dword [ebp - 8], eax
mov ebx, esi
sub ebx, dword [ebp + 0x10]
mov eax, esi
sub eax, edi
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp - 8]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
nop dword [eax + eax]
movups xmm1, xmmword [esi + ecx*4]
mov esi, dword [ebp - 0xc]
lea eax, [eax + 0x40]
movups xmm0, xmmword [eax - 0x50]
lea edi, [edi + 0x40]
xorps xmm1, xmm0
movups xmmword [edi - 0x60], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [ebx + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [esi + eax - 0x40], xmm1
mov esi, dword [ebp - 0x10]
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [esi + edi - 0x40]
mov esi, dword [ebp - 0x14]
xorps xmm1, xmm0
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [esi + ecx*4]
mov esi, dword [ebp + 0xc]
add ecx, 0x10
movups xmm0, xmmword [eax - 0x20]
xorps xmm1, xmm0
movups xmmword [edi - 0x30], xmm1
cmp ecx, dword [ebp - 0x18]
jl 0x40fc90
mov edi, dword [ebp + 8]
mov eax, edx
and al, 0xf
cmp al, 2
jb 0x40fd34
mov eax, dword [ebp + 0x10]
jmp 0x40fd00
mov eax, dword [ebp + 0x10]
mov ebx, esi
sub ebx, eax
mov esi, dword [ebp + 0xc]
lea eax, [eax + ecx*4]
mov dword [ebp + 0x14], edx
and dword [ebp + 0x14], 0xfffffffe
sub edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
movq xmm1, qword [eax + ebx]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 2
xorps xmm1, xmm0
movq qword [eax + edi - 8], xmm1
cmp ecx, dword [ebp + 0x14]
jl 0x40fd13
mov edi, dword [ebp + 8]
cmp ecx, edx
jge 0x40fd56
mov ebx, dword [ebp + 0x10]
sub esi, ebx
lea eax, [ebx + ecx*4]
sub edi, ebx
sub edx, ecx
mov ecx, dword [esi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x40fd44
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40fdc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jle 0x40fe23
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
add eax, 2
sub dword [ebp + 0x10], edi
nop dword [eax]
movzx ecx, byte [eax - 1]
lea eax, [eax + 4]
movzx edx, byte [eax - 3]
lea edi, [edi + 4]
mov esi, dword [ecx*4 + 0x531560]
movzx ecx, byte [eax - 6]
xor esi, dword [edx*4 + 0x531d60]
xor esi, dword [ecx*4 + 0x531160]
movzx ecx, byte [eax - 4]
xor esi, dword [ecx*4 + 0x531960]
mov ecx, dword [ebp + 0x10]
xor esi, dword [ecx + edi - 4]
mov dword [edi - 4], esi
sub ebx, 1
jne 0x40fde0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x410030
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x533d80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, dword [eax]
lea esi, [eax + 0x2c]
mov edi, dword [ebp + 8]
lea ecx, [eax + 0xc]
push ebx
push esi
mov dword [ebp - 0x2c], ecx
mov ecx, dword [eax + 8]
push edi
push edi
mov dword [ebp - 0x28], ecx
call fcn.0040fbf0
lea eax, [ebx*4]
add esp, 0x10
add esi, eax
mov eax, dword [ebp - 0x28]
cmp eax, 1
jle 0x4100b1
dec eax
mov dword [ebp - 0x28], eax
nop dword [eax + eax]
push str.cw
push ebx
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0040fe40
push ebx
push esi
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.0040fdc0
lea eax, [ebx*4]
add esp, 0x24
add esi, eax
sub dword [ebp - 0x28], 1
jne 0x410080
push str.cw
push ebx
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0040fe40
push ebx
push esi
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.0040fbf0
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00402a5e
mov esp, ebp
pop ebp
ret
Function at 0x4119a0
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 8
push eax
mov dword [ebp - 4], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push connect
push connect
push connect
push connect
push 1
push 0
push str.tooltips_class32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x535364], eax
test eax, eax
je 0x411a32
push 0
push 0x404048
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EnumChildWindows]
test eax, eax
je 0x411a32
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4034d1
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor ecx, ecx
mov dword [0x535368], eax
test eax, eax
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412c60
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x533d80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63
lea eax, [ebp - 0x67]
mov byte [ebp - 0x68], 0
push 0
push eax
call fcn.00402b12
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push str.MonitorSockDidIPChange__
push 0x5001d1
push 0
push 3
call fcn.00401780
add esp, 0x10
lea eax, [ebp - 0xcc]
push 0x64
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x412ceb
mov eax, dword [eax + 0xc]
push 0x64
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0040465b
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, str.127.0.0.1
lea eax, [ebp - 0x68]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412d20
test dl, dl
je 0x412d1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412d20
add eax, 2
add ecx, 2
test dl, dl
jne 0x412d00
xor eax, eax
jmp 0x412d25
sbb eax, eax
or eax, 1
test eax, eax
je 0x412da4
mov ecx, 0x536428
lea eax, [ebp - 0x68]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412d51
test dl, dl
je 0x412d4d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412d51
add eax, 2
add ecx, 2
test dl, dl
jne 0x412d31
xor eax, eax
jmp 0x412d56
sbb eax, eax
or eax, 1
test eax, eax
je 0x412da4
push 0x536428
lea eax, [ebp - 0x68]
push eax
push 1
push str.MonitorSockDidIPChange___ret_d_new_s._old_s.
push 0x5001d1
push 3
push 3
call fcn.00401780
add esp, 0x1c
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x68]
lea ecx, [ecx + 1]
mov byte [ecx + 0x536427], al
test al, al
jne 0x412d80
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402a5e
mov esp, ebp
pop ebp
ret
push 0x536428
lea ecx, [ebp - 0x68]
push ecx
push 0
push str.MonitorSockDidIPChange___ret_d_new_s._old_s.
push 0x5001d1
push 3
push 3
call fcn.00401780
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
xor eax, eax
call fcn.00402a5e
mov esp, ebp
pop ebp
ret
Function at 0x4134b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
jle 0x4134d5
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x5353e8
mov dword [esi + eax*4], ecx
test ecx, ecx
je 0x4134d7
inc eax
add ecx, 0x51
cmp eax, edx
jl 0x4134c5
pop esi
pop ebp
ret
push 0x10
push 0
push str.Cannot_allocate_memory_from_process_default_heap_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x41f5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x41f64e
mov edx, dword [ebp + 0x10]
xor eax, eax
dec edx
test edx, edx
jle 0x41f64e
push esi
mov esi, dword [ebp + 0xc]
cmp edx, 0x10
jb 0x41f644
mov ecx, edx
push edi
and ecx, 0x8000000f
jns 0x41f60c
dec ecx
or ecx, 0xfffffff0
inc ecx
movaps xmm2, xmmword [str.uuuuuuuuuuuuuuuu]
mov edi, edx
movups xmm3, xmmword [0x503ec0]
sub edi, ecx
nop
movups xmm0, xmmword [eax + esi]
movaps xmm1, xmm2
andnps xmm1, xmm3
xorps xmm1, xmm0
xorps xmm1, xmmword [str.eeeeeeeeeeeeeeee]
movups xmmword [eax + esi], xmm1
add eax, 0x10
cmp eax, edi
jl 0x41f620
pop edi
cmp eax, edx
jge 0x41f64d
xor byte [eax + esi], 0xef
inc eax
cmp eax, edx
jl 0x41f644
pop esi
pop ebp
ret
Function at 0x492370
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401acd
mov eax, dword [0x533d80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x53b518]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x492548
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x492497
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x492497
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x492475
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x4923f9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x492501
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x492568
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x492543
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x492568
jmp 0x4923d2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402a5e
mov esp, ebp
pop ebp
ret