joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6588692c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov dword [ebp - 0x54], 0x658db3c0
mov dword [ebp - 0x50], 0x6592f006
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x65886a2c
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x6c]
mov dword [esp], eax
call fcn.658e7610
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [ebp - 0x68], 0xffffffff
call sub.USER32.dll_GetWindowTextLengthA
sub esp, 4
inc eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.65908a24
lea eax, [ebp - 0x38]
mov dword [esp + 8], eax
mov dword [esp + 4], str.
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [ebp - 0x68], 2
call fcn.65912068
jmp 0x658869d1
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.65908a54
cmp dword [ebp - 0x1c], 0xfe
jle 0x658869ec
mov dword [ebp - 0x1c], 0xfe
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [ebp - 0x68], 1
call fcn.65911ce8
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.658f61c4
mov edx, dword [ebp - 0x1c]
dec edx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextA
sub esp, 0xc
jmp 0x65886a71
lea eax, [ebp - 0x6c]
mov dword [esp], eax
call fcn.658e76f0
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x6588a080
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
sub esp, 4
cmp dword [ebp - 0x24], 1
ja 0x6588a0a0
inc dword [0x6593a050]
leave
ret

Function at 0x6588a0a2
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x164
mov byte [ebp - 9], 0x41
cmp byte [ebp - 9], 0x5a
ja 0x6588a17c
mov dword [ebp - 0x10], 0
movzx eax, byte [ebp - 9]
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], 0x3a
mov byte [ebp - 0xe], 0x5c
lea eax, [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 4
jne 0x6588a172
lea edx, [ebp - 0x128]
mov eax, 0x110
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov dword [esp + 0x1c], 0x100
lea eax, [ebp - 0x128]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVolumeInformationA
sub esp, 0x20
test eax, eax
je 0x6588a172
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp], str.VBoxSharedFolderFS
call sub.msvcrt.dll__strcmpi
test eax, eax
jne 0x6588a172
inc dword [0x6593a050]
lea eax, [ebp - 9]
inc byte [eax]
jmp 0x6588a0b0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 0x100
mov dword [ebp - 0x13c], str.vmware
mov eax, dword [ebp - 0x138]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMControlSet001ServicesDiskEnum
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
lea eax, [ebp - 0x138]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x65934148
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0x130]
cmp byte [eax], 0
je 0x6588a262
mov eax, dword [ebp - 0x12c]
mov ebx, dword [ebp - 0x130]
add ebx, eax
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0x130]
movsx eax, byte [eax]
mov dword [esp], eax
call sub.msvcrt.dll_tolower
mov byte [ebx], al
lea eax, [ebp - 0x130]
inc dword [eax]
jmp 0x6588a220
mov eax, dword [ebp - 0x13c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x6588a284
inc dword [0x6593a050]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x6588e23c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [ebp - 0x104], 0x658db3c0
mov dword [ebp - 0x100], 0x6592f13a
lea eax, [ebp - 0xfc]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x6588e466
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call fcn.658e7610
mov dword [esp], str.frAQBc8Wsa1x
call fcn.6588e200
test al, al
je 0x6588e29c
mov dword [esp], str.frAQBc8Wsa1x
call sub.msvcrt.dll_remove
mov eax, dword [ebp + 8]
cmp byte [eax + 0x25c], 0
je 0x6588e427
mov dword [esp + 4], 8
mov dword [esp], 0x10
call fcn.6592db04
mov dword [esp + 4], eax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
mov dword [ebp - 0x118], 0xffffffff
call fcn.6591d864
mov dword [esp + 4], str.Tibiantis_CAM_Player
lea eax, [ebp - 0xd8]
add eax, 8
mov dword [esp], eax
mov dword [ebp - 0x118], 3
call fcn.6592d0c0
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xd8]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.658f789c
sub esp, 4
lea eax, [ebp - 0xe8]
mov dword [esp], eax
mov dword [ebp - 0x118], 2
call fcn.658f61c4
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xa4]
mov dword [esp], eax
call sub.USER32.dll_SetWindowTextA
sub esp, 8
jmp 0x6588e37e
lea eax, [ebp - 0xe8]
mov dword [esp], eax
mov dword [ebp - 0x118], 3
call fcn.65912888
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6588f392
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x50]
mov dword [esp], eax
call fcn.658f0038
mov dword [esp], eax
call fcn.658bb2a0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x50]
mov dword [esp], eax
call fcn.658b6326
jmp 0x6588e40f
lea eax, [ebp - 0xd8]
mov dword [esp], eax
mov dword [ebp - 0x118], 0xffffffff
call fcn.6591de04
mov edx, dword [ebp + 8]
mov dword [ebp - 0x12c], edx
mov dword [esp], 0x84
mov dword [ebp - 0x118], 0xffffffff
call fcn.658dc7d0
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
mov dword [ebp - 0x118], 1
call fcn.658a519e
jmp 0x6588e4d9
mov eax, dword [ebp - 0x130]
mov edx, dword [ebp - 0x12c]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [0x6593a30c]
mov dword [esp], eax
mov dword [ebp - 0x118], 0xffffffff
call fcn.658c3cd4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.6589a116
mov eax, dword [ebp + 8]
mov byte [eax + 0x28], 1
mov edx, dword [ebp + 8]
mov dword [ebp - 0x138], edx
call fcn.65883644
mov edx, dword [ebp - 0x138]
mov byte [edx + 0x284], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x13c], eax
call fcn.65883664
mov edx, dword [ebp - 0x13c]
mov byte [edx + 0x285], al
call fcn.6588a080
call fcn.6588a0a2
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call fcn.658e76f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6588f844
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.658efc14
mov dword [esp + 4], 0x719d78
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.658b5b34
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.658efe50
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
movzx eax, word [eax]
add eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
je 0x6588f8d4
mov dword [esp + 0xc], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
sub eax, edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [esp + 4], eax
mov eax, dword [0x6593a10c]
mov dword [esp], eax
call sub.WS2_32.DLL_send
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x6588f8ca
jmp 0x6588f8d4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
add dword [eax], edx
jmp 0x6588f889
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6588f8f6
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.658eff20
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.658dd120
leave
ret
Function at 0x65892e18
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.658f61c4
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.
mov eax, dword [ebp + 8]
add eax, 0x144
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
add eax, 0x144
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebx + 0x140], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x140]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x65895360
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [ebp - 0x2c], 0x658db3c0
mov dword [ebp - 0x28], 0x6592f362
lea eax, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov dword [eax], edx
mov edx, 0x658953f9
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.658e7610
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [ebp - 0x40], 0xffffffff
call fcn.659123c8
mov dword [esp], 0
mov dword [ebp - 0x40], 1
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x65895432
mov dword [esp], 1
call sub.USER32.dll_GetClipboardData
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x658953eb
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.65910558
mov dword [ebp - 0x40], 1
call sub.USER32.dll_CloseClipboard
jmp 0x65895432
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.658e76f0
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x6589544a
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x6589553f
call sub.USER32.dll_EmptyClipboard
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658f61a4
inc eax
mov dword [esp + 4], eax
mov dword [esp], 2
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x658954a0
call sub.USER32.dll_CloseClipboard
jmp 0x6589553f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658f61a4
lea ebx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658f61a4
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658f61c4
mov esi, eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x658b4192
Capabilities:
Hash data with crc32
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.658e8060
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov dword [esp], eax
call fcn.658f61c4
mov dword [esp + 4], 0x6593525c
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x658b41d9
mov dword [ebp - 0x2020], 0
jmp 0x658b428c
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 1
lea eax, [ebp - 0x2018]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x658b4273
mov dword [ebp - 0x201c], 0
mov eax, dword [ebp - 0x201c]
cmp eax, dword [ebp - 0x10]
jae 0x658b41fb
mov eax, dword [ebp - 0x14]
mov ecx, eax
shr ecx, 8
movzx edx, byte [ebp - 0x14]
lea eax, [ebp - 8]
add eax, dword [ebp - 0x201c]
sub eax, 0x2010
movzx eax, byte [eax]
xor eax, edx
mov eax, dword [eax*4 + 0x65932080]
xor eax, ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x201c]
inc dword [eax]
jmp 0x658b4233
lea eax, [ebp - 0x14]
not dword [eax]
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2020], eax
mov eax, dword [ebp - 0x2020]
leave
ret
Function at 0x658b5b34
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
add eax, 8
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658f5450
add eax, 2
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
and eax, 7
test eax, eax
je 0x658b5bb4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jns 0x658b5b94
add dword [ebp - 0x44], 7
mov eax, dword [ebp - 0x44]
sar eax, 3
shl eax, 3
mov edx, dword [ebp - 0x40]
sub edx, eax
mov eax, 8
sub eax, edx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
add dword [eax], edx
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658efe50
add eax, 2
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jns 0x658b5bdc
add dword [ebp - 0x48], 3
mov eax, dword [ebp - 0x48]
sar eax, 2
cmp eax, dword [ebp - 0x24]
jle 0x658b5cc3
mov eax, dword [ebp - 0x24]
lea edx, [eax*4]
mov eax, dword [ebp - 0x28]
mov eax, dword [edx + eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
shl eax, 2
add eax, dword [ebp - 0x28]
add eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0x61c88647
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
cmp dword [ebp - 0x3c], 0x1f
jg 0x658b5c94
mov eax, dword [ebp - 0x30]
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x30]
shr eax, 5
xor eax, edx
mov ecx, eax
add ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
and edx, 3
mov eax, dword [ebp - 0x38]
add eax, dword [ebp + edx*4 - 0x18]
mov edx, ecx
xor edx, eax
lea eax, [ebp - 0x2c]
add dword [eax], edx
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
sub dword [eax], edx
mov eax, dword [ebp - 0x2c]
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x2c]
shr eax, 5
xor eax, edx
mov ecx, eax
add ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
shr eax, 0xb
mov edx, eax
and edx, 3
mov eax, dword [ebp - 0x38]
add eax, dword [ebp + edx*4 - 0x18]
mov edx, ecx
xor edx, eax
lea eax, [ebp - 0x30]
add dword [eax], edx
lea eax, [ebp - 0x3c]
inc dword [eax]
jmp 0x658b5c24
mov eax, dword [ebp - 0x24]
lea ecx, [eax*4]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0x24]
shl eax, 2
add eax, dword [ebp - 0x28]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
lea eax, [ebp - 0x24]
add dword [eax], 2
jmp 0x658b5bcc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658efe50
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov word [edx], ax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658efc04
leave
ret
Function at 0x658b5cea
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658f5450
sub eax, 2
and eax, 7
test eax, eax
je 0x658b5d12
mov dword [ebp - 0x3c], 0
jmp 0x658b5eae
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
add eax, 8
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658efe50
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658f5444
lea eax, [ebx + eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658f5450
sub eax, 2
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jns 0x658b5d81
add dword [ebp - 0x40], 3
mov eax, dword [ebp - 0x40]
sar eax, 2
cmp eax, dword [ebp - 0x20]
jle 0x658b5e68
mov eax, dword [ebp - 0x20]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [edx + eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
shl eax, 2
add eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x61c88647
mov dword [ebp - 0x34], 0xc6ef3720
mov dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 0x1f
jg 0x658b5e39
mov eax, dword [ebp - 0x28]
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x28]
shr eax, 5
xor eax, edx
mov ecx, eax
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
shr eax, 0xb
mov edx, eax
and edx, 3
mov eax, dword [ebp - 0x34]
add eax, dword [ebp + edx*4 - 0x18]
mov edx, ecx
xor edx, eax
lea eax, [ebp - 0x2c]
sub dword [eax], edx
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x34]
add dword [eax], edx
mov eax, dword [ebp - 0x2c]
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x2c]
shr eax, 5
xor eax, edx
mov ecx, eax
add ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
and edx, 3
mov eax, dword [ebp - 0x34]
add eax, dword [ebp + edx*4 - 0x18]
mov edx, ecx
xor edx, eax
lea eax, [ebp - 0x28]
sub dword [eax], edx
lea eax, [ebp - 0x38]
inc dword [eax]
jmp 0x658b5dc9
mov eax, dword [ebp - 0x20]
lea ecx, [eax*4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0x20]
shl eax, 2
add eax, dword [ebp - 0x1c]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
lea eax, [ebp - 0x20]
add dword [eax], 2
jmp 0x658b5d71
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658efd28
movzx eax, ax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658f5450
cmp eax, dword [ebp - 0x38]
jge 0x658b5e92
mov dword [ebp - 0x3c], 0
jmp 0x658b5eae
mov eax, dword [ebp - 0x38]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.658efc04
mov dword [ebp - 0x3c], 1
mov eax, dword [ebp - 0x3c]
add esp, 0x54
pop ebx
pop ebp
ret
Function at 0x658b793a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov dword [ebp - 0x44], 0x658db3c0
mov dword [ebp - 0x40], 0x6592feb0
lea eax, [ebp - 0x3c]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x658b79b6
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.658e7610
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.658efc14
mov eax, dword [ebp + 8]
add eax, 0x130
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x58], 0xffffffff
call fcn.658bd672
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [ebp - 0x58], 1
call fcn.658b5b34
jmp 0x658b79ef
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x58], 0xffffffff
call fcn.658bd6a4
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.658efe50
movzx eax, word [eax]
add eax, 2
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.658efe50
mov dword [esp + 0xc], 0
mov edx, dword [ebp - 0x68]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL_send
sub esp, 0x10
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.658e76f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x658c2d86
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xbc
mov dword [ebp - 0x74], 0x658db3c0
mov dword [ebp - 0x70], 0x6593018e
lea eax, [ebp - 0x6c]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x658c2ea5
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x8c]
mov dword [esp], eax
call fcn.658e7610
mov eax, dword [ebp + 8]
add eax, 8
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x88], 0xffffffff
call fcn.658bd672
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [ebp - 0x88], 4
call fcn.658f61c4
mov dword [esp], eax
call sub.WS2_32.DLL_gethostbyname
sub esp, 4
mov edx, dword [ebp - 0x90]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0x24]
test eax, eax
jne 0x658c2fe6
lea eax, [ebp - 0x38]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call fcn.65908a24
lea eax, [ebp - 0x58]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Could_not_find_IP_address_for
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov dword [ebp - 0x88], 3
call fcn.65912068
lea eax, [ebp - 0x48]
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
mov dword [ebp - 0x88], 2
call fcn.6592dd90
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
add eax, 0x14
mov dword [esp], eax
mov dword [ebp - 0x88], 1
call fcn.65912a28
jmp 0x658c2f12
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x88], 2
call fcn.65912888
jmp 0x658c2f58
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov dword [ebp - 0x88], 3
call fcn.65912888
jmp 0x658c2f94
lea eax, [ebp - 0x58]
mov dword [esp], eax
call fcn.65908a54
jmp 0x658c2fe6
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x88], 0xffffffff
call fcn.658bd6a4
lea eax, [ebp - 0x8c]
mov dword [esp], eax
call fcn.658e76f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x658c3644
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0x14]
mov byte [ebp - 5], al
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov byte [eax + 8], 0
cmp byte [ebp - 5], 0
je 0x658c36b4
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
test eax, eax
setne al
mov byte [ebx + 8], al
mov ebx, dword [ebp - 4]
leave
ret