joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c150
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x18], 0
xorps xmm0, xmm0
push edi
movlpd qword [esp + 0x10], xmm0
mov al, byte [esi]
cmp al, 0x2d
jne 0x41c188
mov dword [esp + 0x1c], 1
nop dword [eax]
mov al, byte [esi + 1]
inc esi
cmp al, 0x2d
je 0x41c180
movzx eax, al
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
mov ebx, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x41c1e6
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
movsx eax, byte [esi]
sub eax, 0x30
cdq
mov edi, edx
mov edx, ebx
shld edx, ecx, 2
shl ecx, 2
add dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
adc ebx, edx
shld ebx, ecx, 1
add ecx, ecx
add eax, ecx
mov dword [esp + 0x10], eax
movzx eax, byte [esi + 1]
adc ebx, edi
inc esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
mov ecx, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x41c1a5
mov edi, dword [esp + 0x10]
nop word [eax + eax]
movsx eax, byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_ispunct]
add esp, 4
test eax, eax
jne 0x41c212
movsx eax, byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
add esp, 4
test eax, eax
je 0x41c215
inc esi
jmp 0x41c1f0
movsx eax, byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
add esp, 4
test eax, eax
je 0x41c231
mov eax, edi
or eax, ebx
jne 0x41c231
lea edi, [eax + 1]
xor ebx, ebx
mov al, byte [esi]
test al, al
je 0x41c2bc
movsx eax, al
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
add eax, 0xffffff9c
add esp, 4
cmp eax, 0x13
ja case.0x41c25b.101
movzx eax, byte [eax + 0x41c324]
jmp dword [eax*4 + 0x41c30c]
mov eax, edi
mov ecx, ebx
shld ebx, edi, 4
shl edi, 4
sub edi, eax
sbb ebx, ecx
shld ebx, edi, 2
shl edi, 2
jmp case.0x41c25b.115
mov ecx, 0xe10
jmp 0x41c28d
mov ecx, 0x15180
jmp 0x41c28d
mov ecx, 0x93a80
mov eax, ebx
mul ecx
mov ebx, eax
mov eax, edi
mul ecx
add ebx, edx
mov edi, eax
test ebx, ebx
jne 0x41c2c7
cmp edi, 0x15180
jae 0x41c2c7
cmp dword [esp + 0x1c], ebx
je 0x41c2bc
mov ecx, 0x15180
mov eax, ebx
sub ecx, edi
mov edi, ecx
sbb eax, ebx
mov ebx, eax
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.__rotate_offset:_value_is_greater_than_1_day_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push str.__rotate_offset:_unknown_character_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop dword [eax]
add edx, 0xc27a0041
inc ecx
add byte [edx - 0x3e], ah
inc ecx
add byte [ebx - 0x77ffbe3e], bl
ret 0x41
Function at 0x41c2e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x18], 0
xorps xmm0, xmm0
push edi
movlpd qword [esp + 0x10], xmm0
mov al, byte [esi]
cmp al, 0x2d
jne 0x41c188
mov dword [esp + 0x1c], 1
nop dword [eax]
mov al, byte [esi + 1]
inc esi
cmp al, 0x2d
je 0x41c180
movzx eax, al
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
mov ebx, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x41c1e6
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
movsx eax, byte [esi]
sub eax, 0x30
cdq
mov edi, edx
mov edx, ebx
shld edx, ecx, 2
shl ecx, 2
add dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
adc ebx, edx
shld ebx, ecx, 1
add ecx, ecx
add eax, ecx
mov dword [esp + 0x10], eax
movzx eax, byte [esi + 1]
adc ebx, edi
inc esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
mov ecx, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x41c1a5
mov edi, dword [esp + 0x10]
nop word [eax + eax]
movsx eax, byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_ispunct]
add esp, 4
test eax, eax
jne 0x41c212
movsx eax, byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
add esp, 4
test eax, eax
je 0x41c215
inc esi
jmp 0x41c1f0
movsx eax, byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
add esp, 4
test eax, eax
je 0x41c231
mov eax, edi
or eax, ebx
jne 0x41c231
lea edi, [eax + 1]
xor ebx, ebx
mov al, byte [esi]
test al, al
je 0x41c2bc
movsx eax, al
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
add eax, 0xffffff9c
add esp, 4
cmp eax, 0x13
ja case.0x41c25b.101
movzx eax, byte [eax + 0x41c324]
jmp dword [eax*4 + 0x41c30c]
mov eax, edi
mov ecx, ebx
shld ebx, edi, 4
shl edi, 4
sub edi, eax
sbb ebx, ecx
shld ebx, edi, 2
shl edi, 2
jmp case.0x41c25b.115
mov ecx, 0xe10
jmp 0x41c28d
mov ecx, 0x15180
jmp 0x41c28d
mov ecx, 0x93a80
mov eax, ebx
mul ecx
mov ebx, eax
mov eax, edi
mul ecx
add ebx, edx
mov edi, eax
test ebx, ebx
jne 0x41c2c7
cmp edi, 0x15180
jae 0x41c2c7
cmp dword [esp + 0x1c], ebx
je 0x41c2bc
mov ecx, 0x15180
mov eax, ebx
sub ecx, edi
mov edi, ecx
sbb eax, ebx
mov ebx, eax
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.__rotate_offset:_value_is_greater_than_1_day_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push str.__rotate_offset:_unknown_character_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop dword [eax]
add edx, 0xc27a0041
inc ecx
add byte [edx - 0x3e], ah
inc ecx
add byte [ebx - 0x77ffbe3e], bl
ret 0x41
Function at 0x426370
Capabilities:
Terminate process

Disassembly:
push ecx
push str.usage:_segscan__options____IPRANGE_...__pPORT__PORT...___nSEGSCAN_is_a_fast_port_scanner._The_primary_input_parameters_are_the_nIP_addresses_ranges_you_want_to_scan__and_the_port_numbers._An_example_nis_the_following__which_scans_the_10.x.x.x_network_for_web_servers:_n_n____segscan_10.0.0.0_8__p80_n_nThe_program_auto_detects_network_interface_adapter_settings._If_this_nfails__youll_have_to_set_these_manually._The_following_is_an_nexample_of_all_the_parameters_that_are_needed:_n_n______adapter_ip_192.168.10.123_n______adapter_mac_00_11_22_33_44_55_n______router_mac_66_55_44_33_22_11_n_nParameters_can_be_set_either_via_the_command_line_or_config_file._The_nnames_are_the_same_for_both._Thus__the_above_adapter_settings_would_nappear_as_follows_in_a_configuration_file:_n_n____adapter_ip__192.168.10.123_n____adapter_mac__00_11_22_33_44_55_n____router_mac__66_55_44_33_22_11_n_nAll_single_dash_parameters_have_a_spelled_out_double_dash_equivalent__nso__p80_is_the_same_as___ports_80__or_ports__80_in_config_file_._nTo_use_the_config_file__type:_n_n____segscan__c__filename__n_nTo_generate_a_config_file_from_the_current_settings__use_the___echo_noption._This_stops_the_program_from_actually_running__and_just_echoes_nthe_current_configuration_instead._This_is_a_useful_way_to_generate_nyour_first_config_file__or_see_a_list_of_parameters_you_didnt_know_nabout._I_suggest_you_try_it_now:_n_n____segscan__p1234___echo_n_n
call fcn.00401330
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x42ff20
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x458004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x210], 0x100
mov ebx, dword [esi + 0x258]
jne 0x43000c
mov edi, dword [esi + 0x2e0]
cmp edi, 1
jge 0x42ffe9
push 0
push 1
xorps xmm0, xmm0
push 2
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42ff8e
push str.redis:_socket___failed_to_create_socket_n
push 0
call fcn.0041b440
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 0x2c0]
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
movzx eax, word [esi + 0x2d8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, 2
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x42ffe3
push str.redis:_connect___failed_n
push 0
call fcn.0041b440
push str.connect
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 0xc
mov dword [esi + 0x2e0], edi
mov eax, dword [esi + 0x20c]
push edi
push esi
mov eax, dword [eax + 8]
call eax
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443732
mov esp, ebp
pop ebp
ret
cmp byte [edi], 0x2d
jne 0x430026
cmp byte [edi + 1], 0
jne 0x430026
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
test eax, eax
jne 0x43008c
push 0
and ebx, 0x40
push 0x100
mov eax, ebx
neg eax
push 2
sbb eax, eax
push 0
and eax, 4
push 7
or eax, 0x40000000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4300a4
push 0x140
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open_osfhandle]
add esp, 8
cmp eax, 0xffffffff
jne 0x430079
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
push 0x44c394
call esi
add esp, 4
jmp 0x4300aa
push 0x44c3a4
push eax
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
add esp, 8
test eax, eax
je 0x4300a4
or dword [esi + 0x220], 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443732
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, str.writing
test ebx, ebx
mov eax, str.appending
cmove eax, ecx
push eax
push str.out:_could_not_open_file_for__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push edi
call esi
add esp, 4
mov dword [0x45bba4], 1
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00443732
mov esp, ebp
pop ebp
ret
Function at 0x431710
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
push eax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.004448f0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
movsd qword [ebp - 0x28], xmm0
call fcn.004448f0
movaps xmm1, xmm0
xorps xmm0, xmm0
divsd xmm1, qword [ebp - 0x28]
movlpd qword [ebp - 0x28], xmm0
mulsd xmm1, qword [0x456c70]
movsd xmm0, qword [0x456ca0]
comisd xmm1, xmm0
jb 0x431796
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x431796
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
add esi, 0
adc edi, 0x80000000
jmp 0x43179c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
movaps xmm0, xmm1
call fcn.00444840
mov ecx, dword [ebp + 0xc]
add eax, esi
mov ebx, dword [ebp + 8]
adc edx, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], edx
test ecx, ecx
jne 0x4317c0
cmp ebx, 0x3e8
jbe 0x431838
mov eax, ebx
mov edx, 0x1a9fbe77
mul edx
mov edi, 0x624dd2f
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, ebx
mul edi
mov edi, eax
mov dword [ebp - 4], edx
mov eax, ecx
mov ecx, 0x1a9fbe77
mul ecx
mov ecx, eax
mov ebx, edx
mov eax, dword [ebp + 0xc]
mov edx, 0x624dd2f
mul edx
add ecx, esi
mov dword [ebp - 0xc], eax
adc ebx, 0
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
add edi, ecx
mov ecx, dword [ebp - 4]
adc ecx, 0
xor eax, eax
add ebx, ecx
mov ecx, dword [ebp + 8]
adc eax, eax
add edx, ebx
mov ebx, dword [ebp - 0x14]
adc ebx, eax
mov eax, dword [ebp + 0xc]
sub ecx, edx
sbb eax, ebx
shrd ecx, eax, 1
shr eax, 1
add ecx, edx
adc eax, ebx
shrd ecx, eax, 9
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
push eax
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.004448f0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movsd qword [ebp - 0x18], xmm0
call fcn.004448f0
movaps xmm1, xmm0
xorps xmm0, xmm0
divsd xmm1, qword [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
mulsd xmm1, qword [0x456c70]
movsd xmm0, qword [0x456ca0]
comisd xmm1, xmm0
jb 0x4318b5
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x4318b5
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
add esi, 0
adc edi, 0x80000000
jmp 0x4318bb
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
movaps xmm0, xmm1
call fcn.00444840
add eax, esi
adc edx, edi
sub eax, dword [ebp - 0x1c]
sbb edx, dword [ebp - 0x24]
cmp edx, dword [ebp + 0xc]
jb 0x431838
ja 0x4318e0
cmp eax, ebx
jb 0x431838
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433b90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x458004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x540
call edi
mov esi, eax
add esp, 4
test esi, esi
jne 0x433be2
push str.smack
push str._s:_out_of_memory_error_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x540
push 0
push esi
call sub.VCRUNTIME140.dll_memset
and dword [esi + 4], 0xfffffffe
add esp, 0xc
push 9
call edi
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x433bbc
movq xmm0, qword [str.ssl_oids]
xor ebx, ebx
movq qword [ecx], xmm0
mov al, byte [0x453de8]
mov byte [ecx + 8], al
mov dword [0x4dc30c], esi
mov dword [ebp - 0x110], ebx
cmp dword [str.selftest], ebx
je 0x433d49
xor eax, eax
mov esi, dword [eax + 0x45b118]
xor edi, edi
mov al, byte [esi]
test al, al
je 0x433d17
cmp al, 0x2e
jne 0x433c56
nop dword [eax + eax]
inc esi
cmp byte [esi], 0x2e
je 0x433c50
push 0
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov edx, dword [ebp - 0x10c]
add esp, 0xc
mov ebx, eax
cmp esi, edx
je 0x433d11
mov ecx, ebx
mov esi, edx
and ecx, 0xf0000000
or ecx, 0
je 0x433c8f
mov eax, 4
jmp 0x433cc4
mov eax, ebx
and eax, 0xffe00000
or eax, 0
je 0x433ca2
mov eax, 3
jmp 0x433cc4
mov eax, ebx
and eax, 0xffffc000
or eax, 0
je 0x433cb5
mov eax, 2
jmp 0x433cc4
mov eax, ebx
and eax, 0xffffff80
or eax, 0
je 0x433cf4
mov eax, 1
lea ecx, [eax*8]
mov edx, eax
sub ecx, eax
nop
cmp edi, 0x100
jae 0x433ce6
mov eax, ebx
shr eax, cl
or al, 0x80
mov byte [ebp + edi - 0x108], al
inc edi
sub ecx, 7
sub edx, 1
jne 0x433cd0
mov edx, dword [ebp - 0x10c]
cmp edi, 0x100
jae 0x433d07
and bl, 0x7f
mov byte [ebp + edi - 0x108], bl
inc edi
mov al, byte [edx]
test al, al
jne 0x433c47
mov ebx, dword [ebp - 0x110]
mov ecx, dword [0x4dc30c]
lea edx, [ebp - 0x108]
push 5
push ebx
push edi
call fcn.0043a740
inc ebx
add esp, 0xc
mov dword [ebp - 0x110], ebx
lea eax, [ebx + ebx*2]
shl eax, 2
cmp dword [eax + 0x45b11c], 0
jne 0x433c35
mov ecx, dword [0x4dc30c]
call fcn.0043aee0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443732
mov esp, ebp
pop ebp
ret
Function at 0x434ca0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
mov eax, dword [0x458004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x8f8], ecx
push edi
movups xmm0, xmmword [ebx + 0x28]
mov eax, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x68]
mov dword [ebp - 0x8f4], eax
add ecx, edx
mov edx, dword [ebx + 0x6c]
lea eax, [ebp - 0x818]
movups xmmword [ebp - 0x910], xmm0
push 0x800
movq xmm0, qword [ebx + 0x38]
push eax
movq qword [ebp - 0x900], xmm0
mov dword [ebp - 0x8e8], 0
mov dword [ebp - 0x8f0], 0
mov dword [ebp - 0x8ec], 0xe
mov byte [ebp - 0x818], 0
call fcn.00434c10
mov edi, eax
add esp, 8
cmp edi, dword [ebx + 0x6c]
jne 0x434ef5
movzx esi, byte [ebp - 0x815]
xor edx, edx
movzx ecx, byte [ebp - 0x816]
movzx eax, byte [ebp - 0x818]
shl esi, 8
or esi, ecx
movzx ecx, byte [ebp - 0x817]
shl esi, 8
or esi, ecx
mov dword [ebp - 0x818], 0
shl esi, 8
or ecx, 0xffffffff
or esi, eax
test edi, edi
je 0x434d8c
nop word [eax + eax]
movzx eax, byte [ebp + edx - 0x818]
inc edx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x449be0]
cmp edx, edi
jb 0x434d70
not ecx
cmp esi, ecx
jne 0x434ef5
cmp edi, 0x10
jb 0x434ef5
lea eax, [ebp - 0x814]
cmp dword [eax], 0x7265744c
jne 0x434ef5
push 0xb
push str.ZeroAccess:
mov edx, 0xe
lea ecx, [ebp - 0x8f0]
call fcn.0040eb00
movzx esi, byte [ebp - 0x809]
add esp, 8
movzx eax, byte [ebp - 0x80a]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 0x80b]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 0x80c]
shl esi, 8
or esi, eax
cmp esi, 0x100
ja 0x434ef5
lea eax, [esi*8 + 0x10]
cmp eax, edi
ja 0x434ef5
xor edi, edi
test esi, esi
je 0x434e7a
movzx eax, byte [ebp + edi*8 - 0x805]
push eax
movzx eax, byte [ebp + edi*8 - 0x806]
push eax
movzx eax, byte [ebp + edi*8 - 0x807]
push eax
movzx eax, byte [ebp + edi*8 - 0x808]
push eax
push str._u._u._u._u
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.00404800
lea eax, [ebp - 0x18]
add esp, 0x1c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434e54
sub eax, edx
lea ecx, [ebp - 0x8f0]
push eax
lea eax, [ebp - 0x18]
mov edx, 0xe
push eax
call fcn.0040eb00
inc edi
add esp, 8
cmp edi, esi
jb 0x434e17
lea eax, [ebp - 0x8f0]
cmp dword [eax + 4], 0xe
je 0x434e90
mov eax, dword [eax]
test eax, eax
jne 0x434e80
xor edx, edx
jmp 0x434e93
mov edx, dword [eax + 8]
lea ecx, [ebp - 0x8f0]
nop dword [eax]
cmp word [ecx + 4], 0xe
je 0x434ead
mov ecx, dword [ecx]
test ecx, ecx
jne 0x434ea0
movups xmm0, xmmword [ebp - 0x910]
lea eax, [ecx + 0x10]
neg ecx
push edx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [ebx + 0x1c]
push 0xe
push dword [ebp - 0x8f4]
push 0x11
sub esp, 0x18
mov eax, esp
push dword [ebp + 0xc]
movups xmmword [eax], xmm0
push dword [ebp + 8]
movq xmm0, qword [ebp - 0x900]
push dword [ebp - 0x8f8]
movq qword [eax + 0x10], xmm0
call fcn.00431390
add esp, 0x3c
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443732
mov esp, ebp
pop ebp
ret
Function at 0x434f10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x458004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x94]
mov edx, 0x10
push 0x80
push eax
mov ecx, 0x449bcc
call fcn.00434c10
movzx edi, byte [ebp - 0x91]
add esp, 8
movzx eax, byte [ebp - 0x92]
or esi, 0xffffffff
mov ecx, dword [ebp - 0x94]
shl edi, 8
or edi, eax
mov dword [ebp - 0x94], 0
shl edi, 8
movzx eax, ch
or edi, eax
movzx eax, cl
shl edi, 8
or edi, eax
xor ecx, ecx
nop dword [eax]
movzx eax, byte [ebp + ecx - 0x94]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x449be0]
movzx eax, byte [ebp + ecx - 0x93]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x449be0]
movzx eax, byte [ebp + ecx - 0x92]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x449be0]
movzx eax, byte [ebp + ecx - 0x91]
add ecx, 4
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x449be0]
cmp ecx, 0x10
jb 0x434f80
xorps xmm0, xmm0
or ecx, 0xffffffff
movups xmmword [ebp - 0x14], xmm0
not esi
mov dword [ebp - 0x10], 0x6765744c
mov dword [ebp - 8], 0xf0a577f
xor edx, edx
movzx eax, byte [ebp + edx - 0x14]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x449be0]
movzx eax, byte [ebp + edx - 0x13]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x449be0]
movzx eax, byte [ebp + edx - 0x12]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x449be0]
movzx eax, byte [ebp + edx - 0x11]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x449be0]
cmp edx, 0x10
jb 0x435000
not ecx
mov edx, 0x10
mov eax, ecx
mov byte [ebp - 0x14], cl
shr eax, 0x18
mov byte [ebp - 0x11], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x12], al
mov eax, ecx
shr eax, 8
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x94]
push 0x10
push eax
call fcn.00434c10
add esp, 8
lea ecx, [ebp - 0x94]
mov edx, 0x449bcc
mov ebx, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4350c9
add ecx, 4
add edx, 4
sub ebx, 4
jae 0x4350a0
xor eax, eax
cmp edi, esi
pop edi
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443732
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443732
mov esp, ebp
pop ebp
ret
Function at 0x4357a0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 4], 0x288
mov esi, 1
mov al, byte [ebx]
test al, al
je 0x4357ec
cmp al, 0x30
jl 0x4357c8
cmp al, 0x39
jle 0x4357ca
xor esi, esi
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4357c0
test esi, esi
je 0x4357ec
push ebx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov ecx, eax
call fcn.00436f70
test eax, eax
cmovne ebx, eax
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x288
call esi
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x435828
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
mov eax, 0xe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea ecx, [ebp - 4]
push ecx
push eax
call edi
cmp eax, 0x6f
jne 0x435867
nop word [eax + eax]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [ebp - 4]
call esi
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x435803
lea ecx, [ebp - 4]
push ecx
push eax
call edi
cmp eax, 0x6f
je 0x435840
test eax, eax
je 0x435891
push eax
push str.if:_GetAdaptersInfo_failed_with_error:__u_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
mov eax, 0xe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 8]
mov esi, edi
nop word [eax + eax]
cmp dword [esi + 8], 0x7665445c
lea eax, [esi + 8]
mov ecx, ebx
jne 0x4358c3
cmp dword [eax + 4], 0x5c656369
jne 0x4358c3
cmp dword [eax + 8], 0x5f46504e
jne 0x4358c3
add eax, 0xc
cmp dword [ebx], 0x7665445c
jne 0x4358e0
cmp dword [ebx + 4], 0x5c656369
jne 0x4358e0
cmp dword [ebx + 8], 0x5f46504e
jne 0x4358e0
lea ecx, [ebx + 0xc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x435900
test dl, dl
je 0x4358fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x435900
add eax, 2
add ecx, 2
test dl, dl
jne 0x4358e0
xor eax, eax
jmp 0x435905
sbb eax, eax
or eax, 1
test eax, eax
je 0x435922
mov esi, dword [esi]
test esi, esi
jne 0x4358a0
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x435949
cmp dword [esi + 0x190], 6
jne 0x43581c
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi + 0x194]
mov dword [ecx], eax
mov ax, word [esi + 0x198]
mov word [ecx + 4], ax
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret