joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b5f28
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jns 0x6b5f9e
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.006b8d37
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2714
jne 0x6b5f97
jmp 0x6b5f50
mov eax, dword [ebp - 0x10]
neg eax
jmp 0x6b5fa1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b5fb1
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x6b5fb3
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jns 0x6b6029
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.006b8d37
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2714
jne 0x6b6022
jmp 0x6b5fdb
mov eax, dword [ebp - 0x10]
neg eax
jmp 0x6b602c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b603c
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6b6904
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, edx
mov byte [ebp - 0x30], al
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
cmp dword [ebp - 0x28], eax
jbe 0x6b694e
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
cmp byte [ebp - 0x30], 0
je 0x6b6982
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
jmp 0x6b69a1
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x28]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll__write
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jns 0x6b6a54
cmp byte [ebp - 0x30], 0
je 0x6b69be
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.006b8d37
jmp 0x6b69c7
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xb
je 0x6b6a18
cmp dword [ebp - 0x10], 0x2733
je 0x6b6a18
cmp dword [ebp - 0x10], 0x2747
jne 0x6b6a0e
mov dword [esp + 0x10], str.write___failed:_WSAENOBUFS._Not_enough_ram_
mov dword [esp + 0xc], 0x7928cc
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp], 4
call fcn.006bf072
mov eax, 0xffffffff
jmp 0x6b6ac2
call fcn.006b635b
test al, al
je 0x6b6a4d
mov dword [esp + 0x10], str.write___would_block__returning.
mov dword [esp + 0xc], 0x7928cc
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp], 7
call fcn.006bf072
mov eax, 0
jmp 0x6b6ac2
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x14]
sub edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.006933b8
cmp dword [ebp - 0x14], 0x7fffffff
setne al
movzx eax, al
test eax, eax
jne 0x6b6abf
mov dword [esp], str.src_lib_net_buffers_net.c
call fcn.006c14d2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.write_result___0x7fffffff
mov dword [esp + 8], str.flush_chunk
mov dword [esp + 4], 0xad
mov dword [esp], eax
call fcn.006c1140
call fcn.006c14b8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b6ad2
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6b7d02
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, edx
mov word [ebp - 0x20], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
je 0x6b7ddc
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 8]
cmp ax, 2
jne 0x6b7d76
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.006b3681
jmp 0x6b7dd5
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 8]
cmp ax, 0x17
jne 0x6b7d9c
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.006b3820
jmp 0x6b7dd5
mov dword [esp], str.src_lib_net_resolve.c
call fcn.006c14d2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x7929ff
mov dword [esp + 8], str.tor_addr_lookup_host_impl
mov dword [esp + 4], 0xa6
mov dword [esp], eax
call fcn.006c1140
call fcn.006c14b8
mov eax, 0
jmp 0x6b7df1
cmp dword [ebp - 0x10], 0x2afa
jne 0x6b7dec
mov eax, 1
jmp 0x6b7df1
mov eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b7e01
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x6b82c4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
lea eax, [ebp - 0x19c]
mov dword [esp + 4], eax
mov dword [esp], 0x101
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x6b833e
mov eax, dword [ebp - 0x1a0]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Error_initializing_windows_network_layer:_code_was__d
mov dword [esp + 0xc], str.network_init
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp], 4
call fcn.006bf072
mov eax, 0xffffffff
jmp 0x6b8343
mov eax, 0
mov edx, dword [ebp - 0xc]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b8353
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6b860a
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b865a
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6b9740
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__beginthread]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x6b9788
mov eax, 0xffffffff
jmp 0x6b978d
mov eax, 0
mov edx, dword [ebp - 0xc]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b979d
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x6b9a1f
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call eax
mov edx, dword [ebp - 0x1c]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x6b9a52
mov eax, 0xffffffff
jmp 0x6b9a57
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b9a67
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x6b9abf
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x6b9bac
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6b9bac
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.006c1578
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Error_retrieving_thread_local_value:__s
mov dword [esp + 0xc], 0x793588
mov dword [esp + 4], 1
mov dword [esp + 8], 0
mov dword [esp], 3
call fcn.006bf072
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
cmp dword [ebp - 0x14], 0
sete al
movzx eax, al
test eax, eax
jne 0x6b9bac
mov dword [esp], str.src_lib_thread_compat_winthreads.c
call fcn.006c14d2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.err__0l
mov dword [esp + 8], str.tor_threadlocal_get
mov dword [esp + 4], 0x84
mov dword [esp], eax
call fcn.006c1140
call fcn.006c14b8
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b9bbf
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6b9bc1
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x6b9cb1
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.006c1578
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Error_adjusting_thread_local_value:__s
mov dword [esp + 0xc], 0x7935b0
mov dword [esp + 4], 1
mov dword [esp + 8], 0
mov dword [esp], 3
call fcn.006bf072
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
cmp dword [ebp - 0x18], 0
setne al
movzx eax, al
test eax, eax
jne 0x6b9cb1
mov dword [esp], str.src_lib_thread_compat_winthreads.c
call fcn.006c14d2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x793583
mov dword [esp + 8], str.tor_threadlocal_set
mov dword [esp + 4], 0x93
mov dword [esp], eax
call fcn.006c1140
call fcn.006c14b8
nop
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6b9cc2
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6c1ba9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x20]
add eax, 1
movzx eax, byte [eax]
test al, al
je 0x6c1c04
jmp 0x6c1bd8
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test al, al
je 0x6c1c1e
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x6c1bd4
jmp 0x6c1c1e
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test al, al
je 0x6c1c1e
mov eax, dword [ebp - 0x1c]
movzx edx, byte [eax]
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
cmp dl, al
je 0x6c1c00
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6c1c31
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x6c2261
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
jmp 0x6c2294
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x794640]
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov byte [eax], dl
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test al, al
jne 0x6c2279
nop
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6c22af
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x6c22b1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
jmp 0x6c22e4
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x794540]
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov byte [eax], dl
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test al, al
jne 0x6c22c9
nop
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6c22ff
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6c2a36
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6c2a6a
mov eax, 0
jmp 0x6c2b0b
mov dword [ebp - 0x14], 0
jmp 0x6c2afa
cmp dword [ebp - 0x14], 0
jne 0x6c2aac
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.006c1da8
test eax, eax
jne 0x6c2af6
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x5f
je 0x6c2af6
mov eax, 0
jmp 0x6c2b0b
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.006c1da8
test eax, eax
jne 0x6c2af6
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.006c1e5e
test eax, eax
jne 0x6c2af6
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x5f
je 0x6c2af6
mov eax, 0
jmp 0x6c2b0b
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jb 0x6c2a76
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6c2b1b
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6c3984
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x38], 0
fldz
fstp qword [ebp - 0x28]
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x3c], 0
je 0x6c39ce
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
test eax, eax
je 0x6c39ce
cmp dword [ebp - 0x40], 0
jne 0x6c39d8
mov eax, 0xffffffff
jmp 0x6c3b37
cmp dword [ebp - 0x44], 0
jns 0x6c39e5
mov dword [ebp - 0x44], 0x270f
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
movzx eax, byte [eax]
cmp al, 0x2d
jne 0x6c3a3c
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
jmp 0x6c3a3c
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
lea ecx, [eax + 1]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.006c366f
mov dword [ebp - 0x30], eax
fld qword [ebp - 0x28]
fld qword [0x794a60]
fmulp st(1)
fild dword [ebp - 0x30]
faddp st(1)
fstp qword [ebp - 0x28]
add dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
movzx eax, byte [eax]
test al, al
je 0x6c3a67
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.006c3507
test eax, eax
je 0x6c3a67
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x44]
jl 0x6c3a07
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
movzx eax, byte [eax]
cmp al, 0x2e
jne 0x6c3b10
fldz
fstp qword [ebp - 0x20]
fld1
fstp qword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
add dword [ebp - 0x34], 1
jmp 0x6c3ad7
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
lea ecx, [eax + 1]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.006c366f
mov dword [ebp - 0x2c], eax
fld qword [ebp - 0x20]
fld qword [0x794a60]
fmulp st(1)
fild dword [ebp - 0x2c]
faddp st(1)
fstp qword [ebp - 0x20]
fld qword [ebp - 0x18]
fld qword [0x794a60]
fmulp st(1)
fstp qword [ebp - 0x18]
add dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
movzx eax, byte [eax]
test al, al
je 0x6c3b02
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.006c3507
test eax, eax
je 0x6c3b02
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x44]
jl 0x6c3a94
fld qword [ebp - 0x20]
fdiv qword [ebp - 0x18]
fld qword [ebp - 0x28]
faddp st(1)
fstp qword [ebp - 0x28]
cmp dword [ebp - 0x34], 0
jne 0x6c3b1d
mov eax, 0xffffffff
jmp 0x6c3b37
cmp dword [ebp - 0x38], 0
je 0x6c3b2a
fld qword [ebp - 0x28]
fchs
jmp 0x6c3b2d
fld qword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
fstp qword [eax]
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6c3b47
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6ccea5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 0x1c], 0
jne 0x6ccecb
mov eax, 0x79523f
jmp 0x6ccf5c
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 0x78]
test al, al
je 0x6ccedd
mov eax, 0x795250
jmp 0x6ccf5c
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 1
je 0x6cceee
mov eax, 0x7953bd
jmp 0x6ccf5c
mov dword [ebp - 0x14], 0
jmp 0x6ccf31
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x2c]
cmp dword [ebp - 0x14], eax
jb 0x6ccf07
call fcn.006c14b8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 0x14]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call fcn.006c979c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6ccf2d
mov eax, dword [ebp - 0x10]
jmp 0x6ccf5c
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x2c]
cmp dword [ebp - 0x14], eax
jb 0x6ccef7
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x2c]
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 0x29]
movzx eax, al
cmp edx, eax
je 0x6ccf57
mov eax, str.Length_mismatch_for_ext
jmp 0x6ccf5c
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6ccf6c
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x6ddff5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 0x1c], 0
jne 0x6de01b
mov eax, 0x796925
jmp 0x6de0ed
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 0x44]
test al, al
je 0x6de030
mov eax, 0x796938
jmp 0x6de0ed
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
call fcn.006d788f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6de04f
mov eax, dword [ebp - 0x14]
jmp 0x6de0ed
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 0x18]
cmp al, 1
je 0x6de064
mov eax, 0x79695d
jmp 0x6de0ed
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x1a]
movzx eax, ax
cmp edx, eax
je 0x6de07f
mov eax, str.Length_mismatch_for_onion_key
jmp 0x6de0ed
mov dword [ebp - 0x18], 0
jmp 0x6de0c2
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x2c]
cmp dword [ebp - 0x18], eax
jb 0x6de098
call fcn.006c14b8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 0x18]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call fcn.006cb790
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6de0be
mov eax, dword [ebp - 0x10]
jmp 0x6de0ed
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x2c]
cmp dword [ebp - 0x18], eax
jb 0x6de088
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x2c]
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 0x28]
movzx eax, al
cmp edx, eax
je 0x6de0e8
mov eax, str.Length_mismatch_for_nspecs
jmp 0x6de0ed
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6de0fd
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x6ec780
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.006f3460
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.006f3460
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]