joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b409e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x34
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x24], 0
mov ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
test eax, eax
je 0x6b409ef8
lea edx, [esp + 0x24]
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.libcrypto_1_1.dll_ASN1_item_i2d
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x6b409f00
mov dword [esp + 8], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x28], ebx
call sym.libcrypto_1_1.dll_ASN1_item_d2i
mov dword [esp + 8], 0x42
mov ebx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], str.crypto_asn1_a_dup.c
mov dword [esp], eax
call sym.libcrypto_1_1.dll_CRYPTO_free
mov eax, dword [esp + 0x2c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b409f2e
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret
xor ebx, ebx
jmp 0x6b409edf
mov dword [esp + 0x10], 0x3d
mov dword [esp + 0xc], str.crypto_asn1_a_dup.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0xbf
mov dword [esp], 0xd
call sym.libcrypto_1_1.dll_ERR_put_error
jmp 0x6b409edf
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6b40a550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x28], eax
test ebx, ebx
je 0x6b40a638
movzx ebp, byte [ecx]
mov eax, ebp
and eax, 0xffffff80
mov byte [esp + 0x2f], al
test edx, edx
je 0x6b40a57c
movzx edi, al
mov dword [edx], edi
cmp ebx, 1
je 0x6b40a670
movzx esi, byte [ecx]
mov eax, esi
test al, al
jne 0x6b40a5f8
movzx esi, byte [ecx + 1]
and esi, 0xffffff80
mov edx, esi
cmp byte [esp + 0x2f], dl
je 0x6b40a6a0
lea edi, [ebx - 1]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x6b40a5e9
mov eax, ebp
sub ebx, edi
mov edx, ebp
movsx esi, al
add ecx, ebx
sar dl, 7
lea ebp, [edi - 1]
shr esi, 0x1f
mov ebx, esi
mov esi, ecx
mov ecx, dword [esp + 0x28]
lea esi, [esi]
nop
movzx eax, byte [esi + ebp]
xor eax, edx
movzx eax, al
add ebx, eax
mov byte [ecx + ebp], bl
sub ebp, 1
shr ebx, 8
cmp ebp, 0xffffffff
jne 0x6b40a5d0
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, ebx
cmp al, 0xff
jne 0x6b40a5a4
mov eax, dword [esp + 0x28]
mov esi, 1
xor edi, edi
mov edx, ebp
lea esi, [esi]
nop
movzx ebp, byte [ecx + esi]
add esi, 1
or edi, ebp
cmp ebx, esi
ja 0x6b40a610
mov dword [esp + 0x28], eax
mov ebp, edx
test edi, edi
jne 0x6b40a58e
mov edi, ebx
jmp 0x6b40a5a4
mov dword [esp + 0x10], 0x9a
xor edi, edi
mov dword [esp + 0xc], str.crypto_asn1_a_int.c
mov dword [esp + 8], 0xde
mov dword [esp + 4], 0xe2
mov dword [esp], 0xd
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x28]
mov edi, 1
test edx, edx
je 0x6b40a5e9
movzx ecx, byte [ecx]
mov eax, ebp
mov ebx, ecx
neg ecx
test al, al
mov eax, edi
cmovns ecx, ebx
mov byte [edx], cl
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0xbb
xor edi, edi
mov dword [esp + 0xc], str.crypto_asn1_a_int.c
mov dword [esp + 8], 0xdd
mov dword [esp + 4], 0xe2
mov dword [esp], 0xd
call sym.libcrypto_1_1.dll_ERR_put_error
jmp 0x6b40a5e9
Function at 0x6b40a750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + 8]
mov ecx, dword [eax]
test esi, esi
je 0x6b40a7a0
test ecx, ecx
je 0x6b40a7a0
mov eax, dword [eax + 4]
movzx edx, byte [esi]
mov edi, ecx
and eax, 0x100
jne 0x6b40a820
cmp edx, 0x7f
jbe 0x6b40a840
lea eax, [ecx + 1]
mov byte [esp + 3], 0
mov dword [esp + 4], eax
mov ecx, eax
mov ebx, dword [esp + 4]
jmp 0x6b40a7b6
mov byte [esp + 3], 0
xor ebx, ebx
mov ecx, 1
xor edi, edi
mov dword [esp + 4], 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6b40a80e
mov eax, dword [esp + 0x20]
mov ebp, dword [eax]
test ebp, ebp
je 0x6b40a80e
movzx eax, byte [esp + 3]
sub ebx, edi
lea edx, [edi - 1]
add ebx, ebp
mov byte [ebp], al
and eax, 1
mov ebp, ebx
movzx eax, al
test edi, edi
je 0x6b40a804
lea esi, [esi]
nop
movzx ebx, byte [esp + 3]
xor bl, byte [esi + edx]
movzx edi, bl
add eax, edi
mov byte [ebp + edx], al
sub edx, 1
shr eax, 8
cmp edx, 0xffffffff
jne 0x6b40a7e8
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 4]
add dword [eax], esi
add esp, 8
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp edx, 0x80
jbe 0x6b40a858
lea eax, [ecx + 1]
mov byte [esp + 3], 0xff
mov dword [esp + 4], eax
mov ecx, eax
jmp 0x6b40a792
test eax, eax
jne 0x6b40a820
mov dword [esp + 4], ecx
mov byte [esp + 3], 0
jmp 0x6b40a792
mov dword [esp + 4], ecx
mov byte [esp + 3], 0xff
jne 0x6b40a792
cmp ecx, 1
je 0x6b40a844
lea eax, [esi + 1]
lea ebp, [esi + ecx]
xor edx, edx
lea esi, [esi]
movzx ebx, byte [eax]
add eax, 1
or edx, ebx
cmp ebp, eax
jne 0x6b40a878
test edx, edx
setne al
mov edx, eax
and eax, 1
add eax, ecx
neg edx
mov byte [esp + 3], dl
mov ecx, eax
mov dword [esp + 4], eax
jmp 0x6b40a792

Function at 0x6b40b0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ecx, 8
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
mov dword [ebx + 4], 2
mov edx, esi
test esi, esi
js 0x6b40b148
sub ecx, 1
lea esi, [esp + 0x14]
mov byte [esp + ecx + 0x14], al
shrd eax, edx, 8
shr edx, 8
add esi, ecx
mov ebp, edx
or ebp, eax
jne 0x6b40b100
mov eax, 8
mov dword [esp + 4], esi
sub eax, ecx
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym.libcrypto_1_1.dll_ASN1_STRING_set
mov edx, dword [esp + 0x1c]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b40b174
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
neg eax
adc edx, 0
neg edx
nop
sub ecx, 1
lea edi, [esp + 0x14]
mov byte [esp + ecx + 0x14], al
shrd eax, edx, 8
shr edx, 8
lea esi, [edi + ecx]
mov ebp, edx
or ebp, eax
jne 0x6b40b150
mov dword [ebx + 4], 0x102
jmp 0x6b40b11a
call sym.___stack_chk_fail
lea esi, [esi]
Function at 0x6b40b430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ecx, 8
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov esi, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov eax, esi
mov dword [ebx + 4], 2
cdq
test esi, esi
js 0x6b40b4a8
lea esi, [esi]
sub ecx, 1
lea esi, [esp + 0x14]
mov byte [esp + ecx + 0x14], al
shrd eax, edx, 8
shr edx, 8
add esi, ecx
mov ebp, edx
or ebp, eax
jne 0x6b40b460
mov eax, 8
mov dword [esp + 4], esi
sub eax, ecx
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym.libcrypto_1_1.dll_ASN1_STRING_set
mov edx, dword [esp + 0x1c]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b40b4d4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
neg eax
adc edx, 0
neg edx
nop
sub ecx, 1
lea edi, [esp + 0x14]
mov byte [esp + ecx + 0x14], al
shrd eax, edx, 8
shr edx, 8
lea esi, [edi + ecx]
mov ebp, edx
or ebp, eax
jne 0x6b40b4b0
mov dword [ebx + 4], 0x102
jmp 0x6b40b47a
call sym.___stack_chk_fail
lea esi, [esi]

Function at 0x6b40bd50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ecx, 8
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov esi, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov eax, esi
mov dword [ebx + 4], 0xa
cdq
test esi, esi
js 0x6b40bdc8
lea esi, [esi]
sub ecx, 1
lea esi, [esp + 0x14]
mov byte [esp + ecx + 0x14], al
shrd eax, edx, 8
shr edx, 8
add esi, ecx
mov ebp, edx
or ebp, eax
jne 0x6b40bd80
mov eax, 8
mov dword [esp + 4], esi
sub eax, ecx
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym.libcrypto_1_1.dll_ASN1_STRING_set
mov edx, dword [esp + 0x1c]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b40bdf4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
neg eax
adc edx, 0
neg edx
nop
sub ecx, 1
lea edi, [esp + 0x14]
mov byte [esp + ecx + 0x14], al
shrd eax, edx, 8
shr edx, 8
lea esi, [edi + ecx]
mov ebp, edx
or ebp, eax
jne 0x6b40bdd0
mov dword [ebx + 4], 0x10a
jmp 0x6b40bd9a
call sym.___stack_chk_fail
lea esi, [esi]
Function at 0x6b40e470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x7c], edi
xor edi, edi
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x18], eax
test eax, eax
je 0x6b40e590
mov ecx, dword [eax]
mov edi, dword [eax + 8]
xor edx, edx
xor ebx, ebx
test ecx, ecx
jle 0x6b40e547
mov dword [esp + 0x14], ebx
mov ebp, ecx
jmp 0x6b40e4f5
cmp al, 0x1f
setle cl
cmp al, 0xa
mov esi, ecx
setne cl
mov ebx, esi
test bl, cl
je 0x6b40e4dc
cmp al, 0xd
mov ebx, 0x2e
cmovne eax, ebx
mov byte [esp + edx + 0x2c], al
add edx, 1
cmp edx, 0x4f
jg 0x6b40e512
add dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
cmp eax, ebp
jge 0x6b40e543
mov eax, dword [esp + 0x14]
movzx eax, byte [edi + eax]
cmp al, 0x7f
jne 0x6b40e4c0
mov eax, 0x2e
mov byte [esp + edx + 0x2c], al
add edx, 1
cmp edx, 0x4f
jle 0x6b40e4e8
lea eax, [esp + 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_BIO_write
test eax, eax
jle 0x6b40e590
mov eax, dword [esp + 0x18]
add dword [esp + 0x14], 1
xor edx, edx
mov ebp, dword [eax]
mov eax, dword [esp + 0x14]
cmp eax, ebp
jl 0x6b40e4f5
test edx, edx
jne 0x6b40e568
mov eax, 1
mov edi, dword [esp + 0x7c]
xor edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b40e594
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_BIO_write
test eax, eax
setg al
movzx eax, al
jmp 0x6b40e54c
xor eax, eax
jmp 0x6b40e54c
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop

Function at 0x6b40f030
Capabilities:
Write file on windows

Disassembly:
push ebx
mov eax, 1
sub esp, 0x18
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
test edx, edx
je 0x6b40f069
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._fwrite
cmp ebx, eax
sete al
movzx eax, al
add esp, 0x18
pop ebx
ret
Function at 0x6b42ba40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x6b42bb1f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x6b42bab5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b42ba7f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6b42bbd6
call 0x6b42bac7
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6b42bb77
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.libcrypto_1_1.dll_BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b42bb2c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6b42bbd6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.libcrypto_1_1.dll_BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b42bbd4
jmp 0x6b42bbd6
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x6b42bde0
Capabilities:
Resolve dns

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov eax, dword [edx]
bswap eax
mov dword [esp + 0x14], eax
mov eax, dword [edx + 4]
mov dword [esp + 4], ecx
bswap eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x3c]
test eax, eax
lea eax, [esp + 0x14]
mov dword [esp], eax
je 0x6b42be50
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x14]
bswap eax
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
bswap eax
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b42be57
add esp, 0x28
pop ebx
ret
call sym.libcrypto_1_1.dll_BF_decrypt
jmp 0x6b42be24
call sym.___stack_chk_fail
nop
nop
nop
nop
Function at 0x6b42be60
Capabilities:
Encrypt data using blowfish
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x3c], edi
xor edi, edi
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov ebp, dword [esp + 0x68]
mov ebx, dword [esp + 0x60]
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x64]
bswap edi
bswap edx
mov dword [esp + 0x2c], edi
bswap edi
mov dword [esp + 0x18], eax
mov eax, dword [eax]
mov dword [esp + 0x30], edx
bswap edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edx
test ebp, ebp
je 0x6b42bf49
lea edi, [ebx + ebp]
mov dword [esp + 0x1c], ecx
xor ebp, ebp
mov edx, ebp
mov ebp, edi
mov edi, edx
lea esi, [esi]
test eax, eax
jne 0x6b42bf14
mov eax, dword [esp + 0x14]
add ebx, 1
add edi, 1
add esi, 1
mov dword [esp + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
bswap eax
mov dword [esp + 0x34], eax
xor al, byte [ebx - 1]
bswap edx
mov byte [esi - 1], al
mov dword [esp + 0x38], edx
cmp ebx, ebp
je 0x6b42bf68
mov eax, 1
movzx edx, byte [ebx]
add ebx, 1
xor dl, byte [esp + eax + 0x34]
add eax, 1
add esi, 1
and eax, 7
mov byte [esi - 1], dl
cmp ebp, ebx
jne 0x6b42bed0
mov ecx, dword [esp + 0x1c]
mov ebp, edi
test ebp, ebp
je 0x6b42bf49
mov ebx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
bswap ebx
bswap edx
mov dword [ecx], ebx
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0x3c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b42bf75
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov ebp, edi
mov eax, 1
jmp 0x6b42bf34
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
Function at 0x6b42bf80
Capabilities:
Encode data using xor
Encrypt data using blowfish
Resolve dns

Disassembly:
push ebp
push edi
push esi
mov esi, 0x6b5ccb00
push ebx
sub esp, 0x3c
mov edx, dword [0x6b5ccb00]
mov edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x2c], edi
xor edi, edi
mov ebx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov dword [ebx], edx
mov edx, dword [0x6b5cdb44]
lea edi, [ebx + 4]
and edi, 0xfffffffc
mov dword [ebx + 0x1044], edx
mov edx, ebx
sub edx, edi
lea ecx, [edx + 0x1048]
sub esi, edx
shr ecx, 2
cmp eax, 0x48
rep movsd dword es:[edi], dword [esi]
mov edi, 0x48
lea ecx, [ebx + 0x48]
mov dword [esp + 0x1c], ebx
cmovg eax, edi
mov dword [esp + 0x18], ecx
mov esi, ebx
mov ebx, ecx
lea edi, [ebp + eax]
mov eax, ebp
nop
lea ecx, [eax + 1]
movzx edx, byte [eax]
cmp edi, ecx
cmovbe ecx, ebp
shl edx, 8
lea eax, [ecx + 1]
movzx ecx, byte [ecx]
or edx, ecx
cmp edi, eax
cmovbe eax, ebp
shl edx, 8
lea ecx, [eax + 1]
movzx eax, byte [eax]
or edx, eax
cmp edi, ecx
cmovbe ecx, ebp
shl edx, 8
lea eax, [ecx + 1]
movzx ecx, byte [ecx]
or edx, ecx
cmp edi, eax
cmovbe eax, ebp
xor dword [esi], edx
add esi, 4
cmp ebx, esi
jne 0x6b42bff0
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x24], 0
lea edi, [esp + 0x24]
mov dword [esp + 0x28], 0
mov ebp, dword [esp + 0x18]
mov esi, ebx
lea esi, [esi]
mov dword [esp + 4], ebx
add esi, 8
mov dword [esp], edi
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x24]
mov dword [esi - 8], eax
mov eax, dword [esp + 0x28]
mov dword [esi - 4], eax
cmp esi, ebp
jne 0x6b42c058
lea ebp, [ebx + 0x1048]
nop
mov dword [esp + 4], ebx
add esi, 8
mov dword [esp], edi
call sym.libcrypto_1_1.dll_BF_encrypt
mov eax, dword [esp + 0x24]
mov dword [esi - 8], eax
mov eax, dword [esp + 0x28]
mov dword [esi - 4], eax
cmp esi, ebp
jne 0x6b42c080
mov eax, dword [esp + 0x2c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b42c0b5
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
Function at 0x6b42cb70
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x4c], eax
xor eax, eax
cmp dword [esp + 0x7c], 0x17
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebp, dword [esp + 0x84]
ja 0x6b42cbab
movzx ecx, byte [esp + 0x7c]
mov eax, 1
shl eax, cl
test eax, 0x800005
jne 0x6b42cbf3
mov dword [esp + 0x10], 0x293
xor ebx, ebx
mov dword [esp + 0xc], str.crypto_bio_b_addr.c
mov dword [esp + 8], 0x83
mov dword [esp + 4], 0x8f
mov dword [esp], 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
mov eax, dword [esp + 0x4c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b42cceb
add esp, 0x5c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.libcrypto_1_1.dll_BIO_sock_init
mov ebx, eax
cmp eax, 1
je 0x6b42cc08
xor ebx, ebx
jmp 0x6b42cbd9
lea edx, [esp + 0x2c]
xor ecx, ecx
xor eax, eax
mov dword [edx + eax], ecx
add eax, 4
cmp eax, 0x20
jb 0x6b42cc10
mov eax, dword [esp + 0x7c]
cmp dword [esp + 0x78], 1
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x34], eax
je 0x6b42cc90
mov dword [esp], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edx
mov dword [esp + 4], edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
mov esi, eax
test eax, eax
je 0x6b42cbd9
cmp eax, 8
jne 0x6b42cca0
mov dword [esp + 0x10], 0x2c5
xor ebx, ebx
mov dword [esp + 0xc], str.crypto_bio_b_addr.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x8f
mov dword [esp], 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
jmp 0x6b42cbd9
mov dword [esp + 0x2c], 1
jmp 0x6b42cc35
mov dword [esp + 0x10], 0x2d4
xor ebx, ebx
mov dword [esp + 0xc], str.crypto_bio_b_addr.c
mov dword [esp + 8], 2
mov dword [esp + 4], 0x8f
mov dword [esp], 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
mov dword [esp], esi
call dbg.gai_strerrorW
mov dword [esp], 1
mov dword [esp + 4], eax
call sym.libcrypto_1_1.dll_ERR_add_error_data
jmp 0x6b42cbd9
call sym.___stack_chk_fail
Function at 0x6b42ccf0
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x4c], eax
xor eax, eax
cmp dword [esp + 0x7c], 0x17
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebp, dword [esp + 0x88]
ja 0x6b42cd2b
movzx ecx, byte [esp + 0x7c]
mov eax, 1
shl eax, cl
test eax, 0x800005
jne 0x6b42cd73
mov dword [esp + 0x10], 0x293
xor ebx, ebx
mov dword [esp + 0xc], str.crypto_bio_b_addr.c
mov dword [esp + 8], 0x83
mov dword [esp + 4], 0x8f
mov dword [esp], 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
mov eax, dword [esp + 0x4c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b42ce7b
add esp, 0x5c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.libcrypto_1_1.dll_BIO_sock_init
mov ebx, eax
cmp eax, 1
je 0x6b42cd88
xor ebx, ebx
jmp 0x6b42cd59
lea edx, [esp + 0x2c]
xor ecx, ecx
xor eax, eax
mov dword [edx + eax], ecx
add eax, 4
cmp eax, 0x20
jb 0x6b42cd90
mov eax, dword [esp + 0x7c]
cmp dword [esp + 0x78], 1
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x38], eax
je 0x6b42ce20
mov dword [esp], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edx
mov dword [esp + 4], edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
mov esi, eax
test eax, eax
je 0x6b42cd59
cmp eax, 8
jne 0x6b42ce30
mov dword [esp + 0x10], 0x2c5
xor ebx, ebx
mov dword [esp + 0xc], str.crypto_bio_b_addr.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x8f
mov dword [esp], 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
jmp 0x6b42cd59
mov dword [esp + 0x2c], 1
jmp 0x6b42cdc0
mov dword [esp + 0x10], 0x2d4
xor ebx, ebx
mov dword [esp + 0xc], str.crypto_bio_b_addr.c
mov dword [esp + 8], 2
mov dword [esp + 4], 0x8f
mov dword [esp], 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
mov dword [esp], esi
call dbg.gai_strerrorW
mov dword [esp], 1
mov dword [esp + 4], eax
call sym.libcrypto_1_1.dll_ERR_add_error_data
jmp 0x6b42cd59
call sym.___stack_chk_fail

Function at 0x6b42d140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp sym._BIO_dump_indent_cb.constprop.0

Function at 0x6b42d4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
mov eax, sym._write_fp
jmp sym._BIO_dump_indent_cb.constprop.0

Function at 0x6b42d500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
mov eax, sym._write_bio
jmp sym._BIO_dump_indent_cb.constprop.0
Function at 0x6b42fa10
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x3c
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x2c], eax
xor eax, eax
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 8], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edx
xor edx, edx
call sym.__dopr
test eax, eax
je 0x6b42fa90
mov edx, dword [esp + 0x28]
test edx, edx
jne 0x6b42fa90
mov eax, dword [esp + 0x24]
test eax, eax
mov eax, 0xffffffff
cmovns eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b42fa97
add esp, 0x3c
ret
mov eax, 0xffffffff
jmp 0x6b42fa78
call sym.___stack_chk_fail
lea esi, [esi]

Function at 0x6b42faa0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x3c
xor edx, edx
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x2c], eax
xor eax, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
lea eax, [esp + 0x1c]
call sym.__dopr
test eax, eax
je 0x6b42fb10
mov edx, dword [esp + 0x28]
test edx, edx
jne 0x6b42fb10
mov eax, dword [esp + 0x24]
test eax, eax
mov eax, 0xffffffff
cmovns eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b42fb17
add esp, 0x3c
ret
mov eax, 0xffffffff
jmp 0x6b42fb00
call sym.___stack_chk_fail
nop
nop
nop
nop