joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411928
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
mov eax, dword [ebp + 0x10]
shl eax, 3
mov dword [ebp - 4], eax
mov dword [0x3dcbe68], 0x67452301
mov dword [0x3dcbe6c], 0xefcdab89
mov dword [0x3dcbe70], 0x98badcfe
mov dword [0x3dcbe74], 0x10325476
cmp dword [ebp + 0x10], 0x40
jle 0x411995
push dword [ebp + 0xc]
lea edx, [ebp - 0xc8]
push edx
call fcn.00411b35
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.00411b8e
pop ecx
add dword [ebp + 0xc], 0x40
sub dword [ebp + 0x10], 0x40
cmp dword [ebp + 0x10], 0x40
jg 0x411968
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov byte [edx + ebp - 0x88], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x41199a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x88]
push eax
call fcn.0040dcff
mov eax, dword [ebp + 0x10]
mov byte [eax + ebp - 0x88], 0x80
cmp dword [ebp + 0x10], 0x37
jg 0x411a08
push dword [ebp - 4]
lea edx, [ebp - 0x50]
push edx
call fcn.00411afa
add esp, 8
lea ecx, [ebp - 0x88]
push ecx
lea eax, [ebp - 0xc8]
push eax
call fcn.00411b35
add esp, 8
lea edx, [ebp - 0xc8]
push edx
call fcn.00411b8e
pop ecx
jmp 0x411a5a
push dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
call fcn.00411afa
add esp, 8
lea eax, [ebp - 0x88]
push eax
lea edx, [ebp - 0xc8]
push edx
call fcn.00411b35
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.00411b8e
pop ecx
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0xc8]
push edx
call fcn.00411b35
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.00411b8e
pop ecx
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov byte [edx + ebp - 0x88], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x411a5f
lea ecx, [ebp - 0x88]
push ecx
lea eax, [ebp - 0xc8]
push eax
call fcn.00411b35
add esp, 8
push dword [0x3dcbe68]
push dword [ebp + 8]
call fcn.00411afa
add esp, 8
push dword [0x3dcbe6c]
mov edx, dword [ebp + 8]
add edx, 4
push edx
call fcn.00411afa
add esp, 8
push dword [0x3dcbe70]
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call fcn.00411afa
add esp, 8
push dword [0x3dcbe74]
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
call fcn.00411afa
add esp, 8
xor edx, edx
mov dword [0x3dcbe74], edx
mov dword [0x3dcbe70], edx
mov dword [0x3dcbe6c], edx
mov dword [0x3dcbe68], edx
mov esp, ebp
pop ebp
ret

Function at 0x4126c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x14]
jge 0x4126f8
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dl, byte [eax + ecx]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
xor dl, byte [eax + ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov byte [ecx + eax], dl
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x14]
jl 0x4126d2
pop ecx
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x6b243ec0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x20
mov edi, dword [eax]
cmp dword [edi + 4], 2
je 0x6b243f18
mov esi, dword [eax + 8]
test esi, esi
je 0x6b243f40
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call sub.msvcrt.dll_fread
test eax, eax
jne 0x6b243f11
mov eax, dword [ebx + 8]
test eax, eax
je 0x6b243f09
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx + 8], 0
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
xor eax, eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov esi, dword [eax + 0xc]
xor eax, eax
test esi, esi
je 0x6b243f11
mov eax, dword [edi + 8]
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
mov dword [esp + 0xc], eax
call esi
jmp 0x6b243eef
mov dword [esp + 4], 0x6b2874a0
mov eax, dword [edi + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, eax
test esi, esi
mov dword [ebx + 8], eax
mov eax, 0xffffffff
jne 0x6b243ed7
jmp 0x6b243f11
Function at 0x6b246e70
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x3c4]
test eax, eax
je 0x6b246fe0
mov eax, dword [esi + 0x4b8]
test eax, eax
je 0x6b246ea3
mov dword [esp], esi
call fcn.6b246940
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.6b267d50
mov ebx, dword [esi + 0x4c0]
mov edi, dword [esi + 0x3c4]
test ebx, ebx
je 0x6b246ed2
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x6b246f10
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x6b246ef4
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 0x4c0]
test eax, eax
je 0x6b246eec
cmp edx, dword [eax + 0x18]
je 0x6b246ef4
mov dword [esp], edx
call fcn.6b246da0
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 2
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6b267db0
lea edx, [ebx + 0xc]
mov eax, ebx
call fcn.6b245a20
mov dword [esp + 4], edi
mov dword [esp], 0x6b287825
call sym.libcurl.dll_curl_strequal
test eax, eax
je 0x6b247040
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0x1c], 1
lea edi, [eax + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x87
mov dword [esp + 4], 1
mov dword [esp], str._Netscape_HTTP_Cookie_File_n_http:__curl.haxx.se_docs_http_cookies.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebx]
test ebx, ebx
jne 0x6b246f97
jmp 0x6b247021
mov dword [esp + 8], eax
mov dword [esp + 4], 0x6b2878d9
mov dword [esp], edi
call sym.libcurl.dll_curl_mfprintf
mov dword [esp], ebp
call dword [0x6b28604c]
mov ebx, dword [ebx]
test ebx, ebx
je 0x6b247021
mov eax, ebx
call fcn.6b245920
test eax, eax
mov ebp, eax
jne 0x6b246f70
mov dword [esp + 4], str._n_Fatal_libcurl_error_n
mov dword [esp], edi
call sym.libcurl.dll_curl_mfprintf
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x6b247067
mov eax, dword [esi + 0x3c4]
mov dword [esp + 4], str.WARNING:_failed_to_save_cookies_in__s_n
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.6b24c140
jmp 0x6b246ed2
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x6b247004
mov eax, dword [esi + 0x4b8]
test eax, eax
je 0x6b247004
mov dword [esp], eax
call sym.libcurl.dll_curl_slist_free_all
mov dword [esi + 0x4b8], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.6b267d50
jmp 0x6b246ed2
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6b246ed2
mov dword [esp], edi
call sub.msvcrt.dll_fclose
jmp 0x6b246ed2
mov dword [esp], edi
mov dword [esp + 4], 0x6b287835
call sub.msvcrt.dll_fopen
test eax, eax
mov edi, eax
je 0x6b246fc0
mov dword [esp + 0x1c], 0
jmp 0x6b246f42
mov dword [esp], edi
call sub.msvcrt.dll_fclose
jmp 0x6b246fc0
Function at 0x6b24bd40
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x24
mov eax, dword [eax + 0x1e0]
test eax, eax
je 0x6b24bd80
mov esi, dword [ebx + 0x16c]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], esi
call eax
mov esi, eax
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
xor esi, esi
cmp edx, 2
ja 0x6b24bd72
mov eax, dword [ebx + 0x168]
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], eax
lea eax, [edx + edx*2 + 0x6b28843c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x168]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret

Function at 0x6b24be80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ws2_32.dll_recv
sub esp, 0x10
cmp eax, 0xffffffff
je 0x6b24beb8
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
xor eax, eax
leave
ret
call sub.ws2_32.dll_WSAGetLastError
leave
mov edx, eax
mov eax, 0x51
cmp edx, 0x2733
mov edx, 0x38
cmovne eax, edx
ret

Function at 0x6b24c280
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [esi + eax*4 + 0x138]
mov dword [esp], eax
call sub.ws2_32.dll_send
mov ebx, eax
mov eax, dword [ebp + 0x18]
sub esp, 0x10
cmp ebx, 0xffffffff
mov dword [eax], 0
je 0x6b24c2d1
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
mov edi, eax
je 0x6b24c320
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.6b268f00
mov dword [esp + 4], str.Send_failure:__s
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.6b24c1c0
mov eax, dword [esi]
mov dword [eax + 0x861c], edi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x18]
xor ebx, ebx
mov dword [eax], 0x51
jmp 0x6b24c2c7
Function at 0x6b24db30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x4c
mov edx, dword [eax + 0x13c]
lea ecx, [ebp - 0x2c]
mov esi, dword [eax]
lea edi, [ebp - 0x28]
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], edi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c], 0x10
call sub.ws2_32.dll_getsockname
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
sub esp, 0xc
test eax, eax
je 0x6b24dba0
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.6b262a20
mov dword [esp], esi
mov dword [esp + 4], str.Error_accept__ing_server_connect
call fcn.6b24c1c0
lea esp, [ebp - 0xc]
mov eax, 0x1e
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], edx
mov dword [ebp - 0x2c], 0x10
call sub.ws2_32.dll_accept
mov edx, dword [ebp - 0x3c]
sub esp, 0xc
mov edi, eax
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.6b262a20
cmp edi, 0xffffffff
je 0x6b24db7f
mov dword [esp + 4], str.Connection_accepted_from_server_n
mov dword [esp], esi
call fcn.6b24c140
mov dword [ebx + 0x13c], edi
mov dword [esp + 4], 1
mov dword [esp], edi
call fcn.6b2703b0
mov dword [ebx + 0x144], 1
mov eax, dword [esi + 0x1e8]
test eax, eax
je 0x6b24dc25
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov edx, dword [esi + 0x1ec]
mov dword [esp], edx
call eax
test eax, eax
jne 0x6b24dc30
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.6b262a20
mov eax, 0x2a
mov dword [ebx + 0x13c], 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6b25f350
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sub.ws2_32.dll_WSAStartup
mov edx, 2
sub esp, 8
test eax, eax
je 0x6b25f380
mov eax, edx
leave
ret
movzx eax, word [ebp - 0x198]
cmp al, 2
je 0x6b25f3a0
call sub.ws2_32.dll_WSACleanup
mov edx, 2
mov eax, edx
leave
ret
shr ax, 8
cmp al, 2
jne 0x6b25f38b
call fcn.6b270190
mov edx, eax
jmp 0x6b25f37b

Function at 0x6b2626a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x22c]
mov esi, dword [ebx]
test eax, eax
jne 0x6b2627c0
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x11c]
lea edi, [ebp - 0x118]
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x11c], pe_nt_image_headers32
call sub.ws2_32.dll_getpeername
mov edx, dword [ebp - 0x12c]
sub esp, 0xc
test eax, eax
je 0x6b262730
call sub.ws2_32.dll_WSAGetLastError
mov dword [esp], ebx
mov dword [esp + 4], eax
mov edi, eax
call fcn.6b268f00
mov dword [esp + 8], edi
mov dword [esp + 4], 0x6b28b9f8
mov dword [esp], esi
mov dword [esp + 0xc], eax
call fcn.6b24c1c0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x98]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov dword [ebp - 0x11c], pe_nt_image_headers32
mov dword [esp], eax
call sub.ws2_32.dll_getsockname
sub esp, 0xc
test eax, eax
jne 0x6b2627d0
lea ecx, [ebx + 0xcc]
mov eax, edi
lea edx, [ebx + 0x9e]
call fcn.6b262430
test eax, eax
jne 0x6b2627a0
call sub.kernel32.dll_GetLastError
mov dword [esp], ebx
mov dword [esp + 4], eax
mov edi, eax
call fcn.6b268f00
mov dword [esp + 8], edi
mov dword [esp + 4], str.ssrem_inet_ntop___failed_with_errno__d:__s
mov dword [esp], esi
mov dword [esp + 0xc], eax
call fcn.6b24c1c0
jmp 0x6b262726
lea ecx, [ebx + 0x100]
lea edx, [ebx + 0xd0]
lea eax, [ebp - 0x98]
call fcn.6b262430
test eax, eax
je 0x6b262803
nop
lea esi, [esi]
mov dword [esp], ebx
call fcn.6b262580
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.ws2_32.dll_WSAGetLastError
mov dword [esp], ebx
mov dword [esp + 4], eax
mov edi, eax
call fcn.6b268f00
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], str.getsockname___failed_with_errno__d:__s
mov dword [esp + 0xc], eax
call fcn.6b24c1c0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov dword [esp], ebx
mov dword [esp + 4], eax
mov edi, eax
call fcn.6b268f00
mov dword [esp + 8], edi
mov dword [esp + 4], str.ssloc_inet_ntop___failed_with_errno__d:__s
mov dword [esp], esi
mov dword [esp + 0xc], eax
call fcn.6b24c1c0
jmp 0x6b262726
Function at 0x6b262840
Capabilities:
Check os version
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0xc4
mov eax, dword [0x6b2a0188]
mov dword [ebp - 0xa8], 0x4020
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 4
test eax, eax
mov edx, eax
je 0x6b262900
cmp edx, 2
je 0x6b2628c0
lea eax, [ebp - 0xa0]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xa4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call sub.ws2_32.dll_getsockopt
sub esp, 0x14
test eax, eax
jne 0x6b2628c5
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa4], eax
jle 0x6b2628c5
mov edi, dword [ebp - 4]
leave
ret
lea eax, [ebp - 0xa8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call sub.ws2_32.dll_setsockopt
mov edi, dword [ebp - 4]
sub esp, 0x14
leave
ret
lea edx, [ebp - 0x9c]
mov ecx, 0x25
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp], edx
mov dword [ebp - 0x9c], 0x94
mov dword [0x6b2a0188], 1
call sub.kernel32.dll_GetVersionExA
sub esp, 4
test eax, eax
je 0x6b262950
cmp dword [ebp - 0x98], 5
jbe 0x6b262950
mov dword [0x6b2a0188], 2
jmp 0x6b2628c0
mov edx, dword [0x6b2a0188]
jmp 0x6b262877

Function at 0x6b262960
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov eax, 0xffffffff
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x5e0]
test esi, esi
je 0x6b2629bb
mov edx, dword [ebx + 0x44]
test edx, edx
je 0x6b2629bb
lea eax, [ebp - 0x10]
mov dword [esp + 8], 0x6b262380
mov dword [esp + 4], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 0
mov dword [esp], eax
call fcn.6b27dab0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x6b2629c2
mov dword [ebx + 0x5e0], 0
mov eax, 0xffffffff
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x6b2629ce
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [esi + 0x158]
mov ebx, dword [esi + 0x138]
test eax, eax
je 0x6b2629f0
mov dword [esp], esi
call fcn.6b26bd40
test eax, eax
je 0x6b2629b6
mov eax, ebx
jmp 0x6b2629bb
lea eax, [ebp - 0x11]
mov dword [esp + 0xc], 2
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.ws2_32.dll_recv
sub esp, 0x10
test eax, eax
je 0x6b2629b6
mov eax, ebx
jmp 0x6b2629bb
Function at 0x6b268c20
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.advapi32.dll_CryptAcquireContextA
sub esp, 0x14
test eax, eax
je 0x6b268c85
lea eax, [ebx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8003
mov eax, dword [ebx]
mov dword [esp], eax
call sub.advapi32.dll_CryptCreateHash
sub esp, 0x14
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x6b268c90
Capabilities:
Hash data via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x10]
mov dword [esp], esi
call fcn.6b268c20
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp], eax
call fcn.6b2783a0
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.advapi32.dll_CryptHashData
mov eax, dword [ebp + 8]
sub esp, 0x10
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.6b268b50
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x6b26a0f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0xc]
mov dword [esp + 8], esi
mov dword [esp], 2
mov dword [esp + 4], ebx
call fcn.6b268db0
test eax, eax
jle 0x6b26a138
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 2
mov dword [esp + 0xc], eax
call fcn.6b26f190
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], ebx
call sub.ws2_32.dll_gethostbyname
mov edx, eax
sub esp, 4
xor eax, eax
test edx, edx
je 0x6b26a131
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.6b26f040
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6b26c5d0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp + 8], str.Connected_for_receive
mov dword [esp + 4], 0x6b28e1a0
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.6b24c140
mov eax, ebx
mov dword [ebx], 1
call fcn.6b26c390
test eax, eax
je 0x6b26c610
add esp, 0x14
pop ebx
pop esi
ret
add esp, 0x14
mov edx, esi
mov eax, ebx
pop ebx
pop esi
jmp fcn.6b26c030
Function at 0x6b26c9d0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp + 8], str.Connected_for_transmit
mov dword [esp + 4], 0x6b28e1a0
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.6b24c140
mov eax, ebx
mov dword [ebx], 2
call fcn.6b26c390
test eax, eax
je 0x6b26ca10
add esp, 0x14
pop ebx
pop esi
ret
add esp, 0x14
mov edx, esi
mov eax, ebx
pop ebx
pop esi
jmp fcn.6b26c620
Function at 0x6b278290
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp], 0
mov dword [esp + 8], eax
call sub.msvcrt.dll__beginthreadex
xor edx, edx
lea ecx, [eax - 1]
cmp ecx, 0xfffffffd
cmovbe edx, eax
add esp, 0x2c
mov eax, edx
ret
Function at 0x6b2838b0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], 0x6b294724
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6b283900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x6b2839cb
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x6b283951
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x6b283939
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x40]
cmp ecx, 4
je 0x6b283949
cmp ecx, 0x40
je 0x6b283949
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6b2838b0
lea esi, [esi]
lea edi, [edi]

Function at 0x6b284c79
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov eax, esi
mov byte [ebp - 0x19], al
lea eax, [ebp - 0x1b]
mov dword [esp + 4], eax
mov dword [esp], edx
mov byte [ebp - 0x1a], cl
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x1b], 0xff
call sub.ws2_32.dll_send
mov ecx, dword [ebp - 0x2c]
sub esp, 0x10
test eax, eax
jns 0x6b284cdd
call sub.ws2_32.dll_WSAGetLastError
mov dword [esp + 4], str.Sending_data_failed___d_
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.6b24c1c0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebx]
mov edx, str.SENT
mov dword [esp], esi
call fcn.6b284b58
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret