joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b62c080
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov ebp, dword [ecx + 8]
xor edi, edi
test ebp, ebp
mov eax, 1
mov ebx, 0
je 0x6b62c0c5
mov esi, dword [ecx]
test esi, esi
mov edx, 0
je 0x6b62c109
mov al, byte [ebp]
mov ch, byte [ecx + 5]
test ch, 1
sete cl
test al, al
sets ah
test ch, 1
jne 0x6b62c0c9
and cl, ah
xor ebx, ebx
movzx edx, cl
jmp 0x6b62c104
xor edx, edx
jmp 0x6b62c109
mov bl, 0xff
mov edx, 1
cmp al, 0x80
ja 0x6b62c104
xor edx, edx
cmp al, 0x80
jne 0x6b62c104
xor ebx, ebx
cmp esi, 2
jb 0x6b62c0fd
lea eax, [esi - 1]
lea ecx, [ebp + 1]
nop
movzx edi, byte [ecx]
or ebx, edi
inc ecx
dec eax
jne 0x6b62c0f0
neg ebx
sbb ebx, ebx
mov eax, ebx
and al, 1
movzx edx, al
lea eax, [edx + esi]
mov edi, esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x6b62c14d
mov esi, dword [ecx]
test esi, esi
je 0x6b62c14d
mov byte [esi], bl
test edi, edi
je 0x6b62c147
mov ecx, ebx
and cl, 1
movzx ecx, cl
lea esi, [edx + esi - 1]
nop
nop
nop
movzx edx, byte [ebp + edi - 1]
xor dl, bl
movzx edx, dl
add edx, ecx
mov ecx, edx
shr ecx, 8
mov byte [esi + edi], dl
dec edi
jne 0x6b62c130
mov ecx, dword [esp + 0x18]
add dword [ecx], eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6b62c250
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x6b62c288
mov esi, dword [esp + 0x14]
movzx ebx, byte [esi]
mov eax, ebx
and eax, 0xffffff80
test edx, edx
je 0x6b62c26e
mov dword [edx], eax
cmp ebp, 1
jne 0x6b62c2bb
mov edi, 1
test ecx, ecx
je 0x6b62c2b4
test al, al
mov al, byte [esi]
je 0x6b62c284
neg al
mov byte [ecx], al
jmp 0x6b62c2b4
call fcn.6b5620e0
push str.c2i_ibuf
push 0
push 0x6b7ab8e1
call fcn.6b5621e0
add esp, 0xc
push 0
push 0xde
push 0xd
call fcn.6b562290
add esp, 0xc
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
mov dl, byte [esi]
test dl, dl
je 0x6b62c2e5
xor edi, edi
cmp dl, 0xff
jne 0x6b62c318
lea edx, [ebp - 1]
inc esi
xor ebp, ebp
nop
nop
movzx edi, byte [esi]
or ebp, edi
inc esi
dec edx
jne 0x6b62c2d0
test ebp, ebp
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
je 0x6b62c316
mov dl, byte [esi + 1]
and dl, 0x80
mov edi, 0xffffffff
cmp al, dl
jne 0x6b62c318
call fcn.6b5620e0
push str.c2i_ibuf
push 0
push 0x6b7ab8e1
call fcn.6b5621e0
add esp, 0xc
push 0
push 0xdd
jmp 0x6b62c2a8
xor edi, edi
add edi, ebp
test ecx, ecx
je 0x6b62c2b4
test edi, edi
je 0x6b62c2b2
sar bl, 7
mov eax, ebx
and al, 1
mov edx, ebp
movzx ebp, al
lea eax, [edx + esi - 1]
mov esi, edi
nop
nop
nop
nop
movzx edx, byte [eax]
xor dl, bl
movzx edx, dl
add edx, ebp
mov ebp, edx
shr ebp, 8
dec eax
mov byte [ecx + esi - 1], dl
dec esi
jne 0x6b62c340
jmp 0x6b62c2b4
Function at 0x6b695d70
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ebx, dword [edx]
test ebx, ebx
je 0x6b695e76
mov edi, dword [esp + 0x2c]
test byte [edx + 0x5c], 2
mov eax, 0x6b7c4f4f
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
cmove esi, eax
test ebx, ebx
jle 0x6b695e7a
mov dword [esp + 8], esi
lea eax, [edx + 9]
mov dword [esp + 4], 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [eax - 1]
mov edx, eax
mov eax, ecx
shl eax, 0x10
cmp ebx, 2
jle 0x6b695ea0
mov esi, edx
movzx edx, byte [edx]
mov edi, esi
mov dword [esp + 0xc], esi
shr ecx, 2
mov esi, dword [esp + 8]
movzx ecx, byte [esi + ecx]
mov byte [esp + 3], cl
movzx edi, byte [edi + 1]
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 4]
movzx ebx, byte [esp + 3]
mov ebp, dword [esp + 0x2c]
mov byte [ebp + ecx - 4], bl
shl edx, 8
or eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [esi + eax]
mov ebx, dword [esp + 0x2c]
mov byte [ebx + ecx - 3], al
or edx, edi
shr edx, 6
and edx, 0x3f
movzx eax, byte [esi + edx]
mov byte [ebx + ecx - 2], al
and edi, 0x3f
movzx eax, byte [esi + edi]
mov byte [ebx + ecx - 1], al
mov ebx, dword [esp + 0x10]
add ecx, 4
mov dword [esp + 4], ecx
mov eax, dword [esp + 0xc]
add eax, 3
add ebx, 0xfffffffd
jne 0x6b695dc0
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 4]
lea eax, [edi + esi - 4]
add esi, 0xfffffffc
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov byte [eax], 0
test byte [edx + 0x5c], 1
je 0x6b695e87
jmp 0x6b695e8c
xor esi, esi
jmp 0x6b695e96
xor esi, esi
mov eax, edi
mov byte [eax], 0
test byte [edx + 0x5c], 1
jne 0x6b695e8c
mov byte [edi + esi], 0xa
inc esi
mov byte [edi + esi], 0
mov dword [edx], 0
mov dword [ecx], esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
jne 0x6b695eac
mov ecx, edx
movzx ecx, byte [edx]
shl ecx, 8
or eax, ecx
mov edx, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x12
mov ebp, ebx
mov ebx, dword [esp + 8]
mov cl, byte [ebx + ecx]
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 4]
mov byte [edi + esi - 4], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ebx + ecx]
mov byte [edi + esi - 3], cl
mov cl, 0x3d
cmp ebp, 1
je 0x6b695ee9
shr eax, 6
and eax, 0x3f
mov cl, byte [ebx + eax]
lea eax, [edi + esi]
mov byte [edi + esi - 2], cl
mov byte [edi + esi - 1], 0x3d
mov ecx, dword [esp + 0x30]
mov byte [eax], 0
test byte [edx + 0x5c], 1
je 0x6b695e87
jmp 0x6b695e8c
Function at 0x6b695f10
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
test ebp, ebp
jle 0x6b695fac
mov esi, dword [esp + 0x1c]
inc esi
mov eax, 4
nop
movzx ebx, byte [esi - 1]
mov edi, ebx
shl edi, 0x10
cmp ebp, 2
jle 0x6b695fb0
mov dword [esp], ebp
movzx ebp, byte [esi]
shr ebx, 2
movzx ebx, byte [ebx + 0x6b7c4f4f]
movzx edx, byte [esi + 1]
mov ecx, dword [esp + 0x18]
mov byte [ecx + eax - 4], bl
shl ebp, 8
or edi, ebp
shr edi, 0xc
and edi, 0x3f
movzx ebx, byte [edi + 0x6b7c4f4f]
mov byte [ecx + eax - 3], bl
or ebp, edx
shr ebp, 6
and ebp, 0x3f
movzx ebx, byte [ebp + 0x6b7c4f4f]
mov ebp, dword [esp]
mov byte [ecx + eax - 2], bl
and edx, 0x3f
movzx edx, byte [edx + 0x6b7c4f4f]
mov byte [ecx + eax - 1], dl
add eax, 4
add esi, 3
add ebp, 0xfffffffd
jne 0x6b695f30
mov edx, dword [esp + 0x18]
lea edx, [edx + eax - 4]
add eax, 0xfffffffc
jmp 0x6b695ffd
xor eax, eax
jmp 0x6b695ffd
jne 0x6b695fba
movzx esi, byte [esi]
shl esi, 8
or edi, esi
mov esi, edi
shr esi, 0x12
mov bl, byte [esi + 0x6b7c4f4f]
mov edx, dword [esp + 0x18]
mov byte [edx + eax - 4], bl
mov esi, edi
shr esi, 0xc
and esi, 0x3f
mov bl, byte [esi + 0x6b7c4f4f]
mov byte [edx + eax - 3], bl
mov bl, 0x3d
cmp ebp, 1
je 0x6b695ff2
shr edi, 6
and edi, 0x3f
mov bl, byte [edi + 0x6b7c4f4f]
mov byte [edx + eax - 2], bl
mov byte [edx + eax - 1], 0x3d
add edx, eax
mov byte [edx], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b6c9b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
cmp ecx, dword [ebx + 4]
mov edi, eax
cmovl edi, ebx
cmovl ebx, eax
push dword [edi + 4]
push esi
call fcn.6b537550
add esp, 8
test eax, eax
je 0x6b6c9b7d
cmp dword [ebx + 4], 0
jle 0x6b6c9b81
mov ecx, dword [edi]
mov edx, dword [ebx]
mov ebp, dword [esi]
xor eax, eax
mov esi, dword [edx + eax*4]
xor esi, dword [ecx + eax*4]
mov dword [ebp + eax*4], esi
inc eax
cmp eax, dword [ebx + 4]
jl 0x6b6c9b60
mov ebx, dword [edi + 4]
cmp eax, ebx
mov ebp, dword [esp + 0x14]
jl 0x6b6c9b8e
jmp 0x6b6c9bae
xor eax, eax
jmp 0x6b6c9bbf
xor eax, eax
mov ebx, dword [edi + 4]
cmp eax, ebx
mov ebp, dword [esp + 0x14]
jge 0x6b6c9bae
mov ecx, dword [edi]
mov edx, dword [ebp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [ecx + eax*4]
mov dword [edx + eax*4], esi
inc eax
mov ebx, dword [edi + 4]
cmp eax, ebx
jl 0x6b6c9ba0
mov dword [ebp + 4], ebx
push ebp
call fcn.6b537830
add esp, 4
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b6e2010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x34]
mov eax, 0xffffffb8
test edi, edi
je 0x6b6e2239
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
movzx ebx, byte [ecx]
test bl, bl
js 0x6b6e206c
cmp ebx, edi
jae 0x6b6e2239
dec edx
inc ecx
push 0
push dword [esp + 0x40]
push dword [esp + 0x40]
push 6
push ebx
push ecx
push edx
push dword [esp + 0x38]
call fcn.6b6e31f0
add esp, 0x20
mov edx, eax
cmp eax, 0xffffff88
jbe 0x6b6e20ce
jmp 0x6b6e2239
lea ebp, [ebx - 0x7e]
shr ebp, 1
cmp ebp, edi
jae 0x6b6e2239
add ebx, 0xffffff81
mov eax, 0xffffffec
cmp ebx, edx
jae 0x6b6e2239
test ebx, ebx
je 0x6b6e21df
xor eax, eax
mov esi, dword [esp + 0x1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
shr edx, 1
mov edi, ebx
movzx ebx, byte [ecx + edx + 1]
shr bl, 4
mov byte [esi + eax], bl
mov ebx, edi
movzx edx, byte [ecx + edx + 1]
and dl, 0xf
mov byte [esi + eax + 1], dl
add eax, 2
cmp eax, edi
jb 0x6b6e20a0
mov edx, ebx
mov ebx, ebp
mov esi, dword [esp + 0x24]
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi], 0
mov eax, 0xffffffec
test edx, edx
je 0x6b6e2239
mov dword [esp], ebx
xor ebp, ebp
mov edi, dword [esp + 0x1c]
mov dword [esp + 4], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edi]
cmp ecx, 0xb
ja 0x6b6e2239
inc dword [esi + ecx*4]
movzx ecx, byte [edi]
mov ebx, 1
shl ebx, cl
sar ebx, 1
add ebp, ebx
mov ebx, dword [esp + 0x1c]
inc edi
dec edx
jne 0x6b6e2150
test ebp, ebp
je 0x6b6e2239
cmp ebp, 0xfff
ja 0x6b6e2239
bsr ecx, ebp
xor ecx, 0xffffffe0
add ecx, 0x21
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
mov edx, 1
mov edi, 1
shl edi, cl
sub edi, ebp
bsr ecx, edi
shl edx, cl
cmp edx, edi
jne 0x6b6e2239
lea edx, [ecx + 1]
mov edi, dword [esp + 4]
mov byte [ebx + edi], dl
inc dword [esi + ecx*4 + 4]
mov ecx, dword [esi + 4]
cmp ecx, 2
jb 0x6b6e2239
and ecx, 1
mov ecx, dword [esp]
jne 0x6b6e2239
mov edx, edi
inc edx
mov eax, dword [esp + 0x28]
mov dword [eax], edx
inc ecx
mov eax, ecx
jmp 0x6b6e2239
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b6edf80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], edx
mov eax, dword [esp + 0x18]
mov esi, dword [eax + 0x118]
mov dword [eax + 0x120], 0x3020100
mov edi, 0x7060504
mov ebx, 0x49
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [eax + ebx*4], edi
add edi, 0x4040404
lea ebp, [ebx + 1]
add ebx, 0xffffffb9
cmp ebx, esi
mov ebx, ebp
jbe 0x6b6edfb0
cmp dword [esp], 0
je 0x6b6ee013
xor edi, edi
xor esi, esi
nop
movzx edx, byte [ecx + edi]
mov bl, byte [eax + edx + 0x120]
mov byte [ecx + edi], bl
mov byte [eax + 0x11f], bl
mov ebp, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + ebp + 0x11f]
mov byte [eax + ebp + 0x120], bl
test ebp, ebp
lea ebp, [ebp - 1]
jg 0x6b6edff0
or esi, edx
inc edi
cmp edi, dword [esp]
jne 0x6b6edfd0
shr esi, 2
jmp 0x6b6ee015
xor esi, esi
mov dword [eax + 0x118], esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b6f32d0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp dword [0x6b83e858], 0
jne 0x6b6f32f8
mov dword [ebp - 4], 3
jmp 0x6b6f331e
mov eax, dword [0x6b83e858]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret
Function at 0x6b6f4690
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
pop ebp
ret

Function at 0x6b6f5f40
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0
pop ebp
ret
Function at 0x6b6f85b0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x6a09e667
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xbb67ae85
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x3c6ef372
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xa54ff53a
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x510e527f
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x9b05688c
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0x1f83d9ab
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0x5be0cd19
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], 0
pop ebp
ret

Function at 0x6b6f8630
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], 0xc1059ed8
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0x367cd507
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x3070dd17
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xf70e5939
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xffc00b31
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x68581511
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0x64f98fa7
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0xbefa4fa4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], 0
pop ebp
ret
Function at 0x6b6f8aa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xfc
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xdc], eax
mov eax, esp
mov dword [ebp - 0xe0], ecx
mov ecx, dword [ebp - 0xdc]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xd8]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0xd4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xd0]
mov dword [eax], ecx
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xec], edi
mov dword [ebp - 0xf0], ebx
call fcn.6b6fd2c0
mov ecx, eax
sub eax, 0xfffffffb
mov dword [ebp - 0xf4], ecx
je 0x6b6f8b65
jmp 0x6b6f8b46
mov eax, dword [ebp - 0xf4]
test eax, eax
jne 0x6b6f8b71
jmp 0x6b6f8b59
mov dword [ebp - 0x10], 0
jmp 0x6b6f8cde
mov dword [ebp - 0x10], 1
jmp 0x6b6f8cde
mov dword [esp], 0x8048
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x6b6f8b96
mov dword [ebp - 0x10], 1
jmp 0x6b6f8cde
lea eax, [ebp - 0xc0]
mov dword [esp], eax
call dword [ebp + 0x18]
mov dword [ebp - 0xc4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_feof
cmp eax, 0
je 0x6b6f8bc5
jmp 0x6b6f8c85
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc4]
mov ecx, 0x8000
sub ecx, dword [ebp - 0xc4]
mov edx, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call sub.msvcrt.dll_fread
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x8000
jne 0x6b6f8c21
jmp 0x6b6f8c63
cmp dword [ebp - 0xc8], 0
jne 0x6b6f8c5e
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
cmp eax, 0
je 0x6b6f8c59
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.6b721a48
mov dword [ebp - 0x10], 1
jmp 0x6b6f8cde
jmp 0x6b6f8c85
jmp 0x6b6f8bac
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0x8000
lea eax, [ebp - 0xc0]
mov dword [esp + 8], eax
call fcn.6b6f9080
jmp 0x6b6f8ba2
cmp dword [ebp - 0xc4], 0
jbe 0x6b6f8cb1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc4]
mov dword [esp], eax
mov dword [esp + 4], ecx
lea eax, [ebp - 0xc0]
mov dword [esp + 8], eax
call fcn.6b6f8dc0
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0xc0]
mov dword [esp], edx
mov dword [esp + 4], ecx
call eax
mov ecx, dword [ebp - 0x14]
mov dword [esp], ecx
mov dword [ebp - 0xf8], eax
call fcn.6b721a48
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
add esp, 0xfc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b7135b0
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x25c
mov eax, dword [0x6b83f4cc]
mov dword [esp + 0x24], 0x6b83a3bc
movzx ebx, word [esp + 0x270]
mov dword [esp + 0x28], 0x6b7137c0
mov dword [esp + 0x2c], str.getnameinfo
mov dword [esp + 0x30], 0x6b713b90
mov dword [esp + 0x34], str.freeaddrinfo
mov dword [esp + 0x38], fcn.6b713770
test eax, eax
je 0x6b713610
mov eax, dword [ebx*8 + 0x6b72874c]
add esp, 0x25c
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea esi, [esp + 0x3f]
mov dword [esp + 4], 0x104
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
sub esp, 8
test eax, eax
jne 0x6b713640
mov dword [0x6b83f4cc], 1
jmp 0x6b7135fb
lea edi, [esp + 0x144]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call sub.msvcrt.dll_strlen
add eax, edi
mov dword [eax], 0x3273775c
mov dword [eax + 4], 0x32335f
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call eax
sub esp, 4
mov ebp, eax
test eax, eax
je 0x6b713700
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0x6b83a3bc
mov dword [esp + 0x18], eax
call eax
sub esp, 8
test eax, eax
je 0x6b7136f0
lea esi, [esp + 0x24]
lea edi, [esp + 0x3c]
mov eax, dword [esi]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
call eax
mov dword [esi + 4], eax
sub esp, 8
test eax, eax
je 0x6b71375a
add esi, 8
cmp esi, edi
jne 0x6b7136a6
mov eax, dword [esp + 0x28]
mov dword [0x6b72874c], eax
mov eax, dword [esp + 0x30]
mov dword [0x6b728754], eax
mov eax, dword [esp + 0x38]
mov dword [fcn.6b713770], eax
jmp 0x6b71362c
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
lea esi, [esi]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call sub.msvcrt.dll_strlen
add eax, edi
mov dword [eax], 0x6873775c
mov dword [eax + 4], 0x367069
mov eax, dword [esp + 0x1c]
mov dword [esp], edi
call eax
sub esp, 4
mov ebp, eax
test eax, eax
je 0x6b71362c
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0x6b83a3bc
mov dword [esp + 0x18], eax
call eax
sub esp, 8
test eax, eax
jne 0x6b71369e
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
jmp 0x6b71362c
Function at 0x6b714150
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x4c]
mov dword [ebx], 0
mov byte [eax], 0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
test eax, eax
je 0x6b714228
cmp dword [eax + 8], 0x40002
mov edi, eax
jne 0x6b7141f4
mov ebp, dword [eax + 0xc]
mov eax, dword [ebp]
test eax, eax
je 0x6b7141f4
mov dword [esp + 0x1c], edi
movzx esi, si
mov edi, ebp
mov ebp, dword [esp + 0x48]
jmp 0x6b7141bc
add edi, 4
lea ebx, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
je 0x6b7141f0
mov eax, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.6b713ec0
mov dword [ebx], eax
sub esp, 0x10
test eax, eax
jne 0x6b7141b0
add esp, 0x2c
mov eax, 8
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov edi, dword [esp + 0x1c]
mov dword [esp + 8], 0x400
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_strncpy
mov eax, dword [esp + 0x50]
mov byte [eax + 0x400], 0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea edx, [eax - 0x2afa]
cmp edx, 3
mov edx, 0x2af9
cmovae eax, edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18

Function at 0x6b714410
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6b722200
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6b722200
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]