joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b4d9520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x108c
call fcn.6b714eb0
mov esi, edx
mov edi, ecx
mov dword [esp + 0x40], 0x6574696d
mov dword [esp + 0x3c], 0x616e7944
mov dword [esp + 0x38], 0x74617753
mov dword [esp + 0x34], 0x68736966
mov dword [esp + 0x30], 0x776f6c42
mov dword [esp + 0x2c], 0x63697461
mov dword [esp + 0x28], 0x6d6f7268
mov dword [esp + 0x24], 0x6379784f
lea ebx, [esp + 0x44]
push ebx
call fcn.6b4da6e0
add esp, 4
push 0x40
push edi
push 0x40
push esi
push ebx
call fcn.6b4da9f0
add esp, 0x14
mov ebp, 0x40
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x40
push esi
push ebx
call fcn.6b4da770
add esp, 0xc
push 0x40
push edi
push ebx
call fcn.6b4da770
add esp, 0xc
dec ebp
jne 0x6b4d95a0
mov word [esp + 2], 0
lea edi, [esp + 2]
lea esi, [esp + 0x24]
push edi
push 0x20
push esi
call fcn.6b4da700
add esp, 0xc
mov dword [esp + 4], eax
push edi
push 0x20
push esi
call fcn.6b4da700
add esp, 0xc
mov dword [esp + 8], eax
push edi
push 0x20
push esi
call fcn.6b4da700
add esp, 0xc
mov dword [esp + 0xc], eax
push edi
push 0x20
push esi
call fcn.6b4da700
add esp, 0xc
mov dword [esp + 0x10], eax
push edi
push 0x20
push esi
call fcn.6b4da700
add esp, 0xc
mov dword [esp + 0x14], eax
push edi
push 0x20
push esi
call fcn.6b4da700
add esp, 0xc
mov dword [esp + 0x18], eax
push edi
push 0x20
push esi
call fcn.6b4da700
add esp, 0xc
mov dword [esp + 0x1c], eax
push edi
push 0x20
push esi
call fcn.6b4da700
add esp, 0xc
mov dword [esp + 0x20], eax
mov ebp, 0x40
lea edi, [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 4
push edi
push ebx
call fcn.6b4dacd0
add esp, 0xc
dec ebp
jne 0x6b4d9660
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10a0]
mov dword [ecx], eax
mov eax, dword [esp + 8]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 0x1c], eax
push 0x20
push esi
call fcn.6b4c6250
add esp, 8
push 0x20
push edi
call fcn.6b4c6250
add esp, 8
push 0x1048
push ebx
call fcn.6b4c6250
add esp, 0x1094
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6b4da6e0
Capabilities:
Encrypt data using blowfish

Disassembly:
push 0x1048
push 0x6b74d634
push dword [esp + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
ret
Function at 0x6b5310a0
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, 1
cmp byte [0x6b83d5f4], 0
jne 0x6b53113d
mov byte [0x6b83d5f4], 1
push 0x190
push 0
push 0x6b83d464
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x6b83d464
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x6b53113d
call fcn.6b5620e0
push str.BIO_sock_init
push 0
push 0x6b75fe4a
call fcn.6b5621e0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_wsastartup__
push eax
push 2
call fcn.6b562290
add esp, 0xc
call fcn.6b5620e0
push str.BIO_sock_init
push 0
push 0x6b75fe4a
call fcn.6b5621e0
add esp, 0xc
push 0
push 0x7a
push 0x20
call fcn.6b562290
add esp, 0xc
mov esi, 0xffffffff
mov eax, esi
pop esi
ret

Function at 0x6b531600
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test eax, eax
jns 0x6b531651
call fcn.6b5620e0
push str.BIO_socket_ioctl
push 0
push 0x6b75fe4a
call fcn.6b5621e0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_ioctlsocket__
push eax
push 2
call fcn.6b562290
add esp, 0xc
xor eax, eax
test esi, esi
sete al
add esp, 4
pop esi
ret

Function at 0x6b531730
Capabilities:
Get socket status

Disassembly:
push edi
push esi
sub esp, 0x10c
mov esi, dword [esp + 0x118]
mov eax, 0xffffffff
cmp esi, 0x3f
ja 0x6b5317a4
mov edi, dword [esp + 0x120]
test edi, edi
je 0x6b5317ad
push 0
call dword [sym.imp.msvcrt.dll_time]
add esp, 4
mov ecx, eax
xor eax, eax
cmp ecx, edi
jge 0x6b5317a4
mov eax, dword [esp + 0x11c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0
sub edi, ecx
mov dword [esp], edi
inc esi
xor ecx, ecx
test eax, eax
lea edx, [esp + 8]
cmovne eax, edx
cmove ecx, edx
mov edx, esp
push edx
push 0
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
add esp, 0x10c
pop esi
pop edi
ret
mov eax, 1
add esp, 0x10c
pop esi
pop edi
ret
Function at 0x6b531850
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x14]
mov dword [esp], 1
cmp edi, 0xffffffff
je 0x6b5318fb
mov ebx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call fcn.6b531600
add esp, 8
test eax, eax
je 0x6b531925
test bl, 4
je 0x6b53192e
mov eax, esp
push 4
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x6b53192e
call fcn.6b5620e0
push str.BIO_connect
push 0
push 0x6b75fef8
call fcn.6b5621e0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_setsockopt__
push eax
push 2
call fcn.6b562290
add esp, 0xc
call fcn.6b5620e0
push str.BIO_connect
push 0
push 0x6b75fef8
call fcn.6b5621e0
add esp, 0xc
push 0
push 0x89
jmp 0x6b53191b
call fcn.6b5620e0
push str.BIO_connect
push 0
push 0x6b75fef8
call fcn.6b5621e0
add esp, 0xc
push 0
push 0x87
push 0x20
call fcn.6b562290
add esp, 0xc
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
ret
test bl, 0x10
je 0x6b531998
mov eax, esp
push 4
push eax
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x6b531998
call fcn.6b5620e0
push str.BIO_connect
push 0
push 0x6b75fef8
call fcn.6b5621e0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_setsockopt__
push eax
push 2
call fcn.6b562290
add esp, 0xc
call fcn.6b5620e0
push str.BIO_connect
push 0
push 0x6b75fef8
call fcn.6b5621e0
add esp, 0xc
push 0
push 0x8a
jmp 0x6b53191b
mov ebx, dword [esp + 0x18]
push ebx
call fcn.6b52d7d0
add esp, 4
mov esi, eax
push ebx
call fcn.6b52d7f0
add esp, 4
push eax
push esi
push edi
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, eax
mov eax, 1
cmp ecx, 0xffffffff
jne 0x6b531927
push 0xffffffffffffffff
call fcn.6b5338a0
add esp, 4
test eax, eax
jne 0x6b531925
call fcn.6b5620e0
push str.BIO_connect
push 0
push 0x6b75fef8
call fcn.6b5621e0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_connect__
push eax
push 2
call fcn.6b562290
add esp, 0xc
call fcn.6b5620e0
push str.BIO_connect
push 0
push 0x6b75fef8
call fcn.6b5621e0
add esp, 0xc
push 0
push 0x67
jmp 0x6b53191b
Function at 0x6b5329c0
Capabilities:
Check if file exists

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
push ebp
push edi
call fcn.6b586a60
add esp, 8
mov esi, eax
push 0x62
push ebp
call sub.msvcrt.dll_strchr
add esp, 8
xor ebx, ebx
test eax, eax
sete al
test esi, esi
je 0x6b532a36
mov byte [esp + 3], al
push 0x6b7603c0
call fcn.6b52e190
add esp, 4
test eax, eax
je 0x6b532a9f
mov edi, eax
mov al, byte [esp + 3]
mov bl, al
shl ebx, 4
or ebx, 1
push 0x8000
push edi
call fcn.6b52e2e0
add esp, 8
push esi
push ebx
push 0x6a
push edi
call fcn.6b52ec50
add esp, 0x10
jmp 0x6b532ad6
call fcn.6b5620e0
push str.BIO_new_file
push 0
push 0x6b76039c
call fcn.6b5621e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
push edi
push str.calling_fopen__s___s_
push eax
push 2
call fcn.6b562290
add esp, 0x14
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 2
je 0x6b532a7d
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 6
jne 0x6b532aaa
call fcn.6b5620e0
push str.BIO_new_file
push 0
push 0x6b76039c
call fcn.6b5621e0
add esp, 0xc
push 0
push pe_nt_image_headers32
jmp 0x6b532aca
push esi
call sub.msvcrt.dll_fclose
add esp, 4
jmp 0x6b532ad4
call fcn.6b5620e0
push str.BIO_new_file
push 0
push 0x6b76039c
call fcn.6b5621e0
add esp, 0xc
push 0
push 0x80002
push 0x20
call fcn.6b562290
add esp, 0xc
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b536f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
lea ebx, [ecx - 1]
test byte [eax + 0x10], 4
jne 0x6b536fd1
test ecx, ecx
je 0x6b5370bd
shl ebx, 5
mov eax, dword [eax]
mov ecx, dword [eax + ecx*4 - 4]
xor eax, eax
test ecx, ecx
setne al
mov edx, ecx
shr edx, 0x10
mov esi, edx
neg esi
sar esi, 0x1f
xor edx, ecx
and edx, esi
and esi, 0x10
or esi, eax
xor edx, ecx
mov ecx, edx
shr ecx, 8
mov eax, ecx
neg eax
sar eax, 0x1f
xor ecx, edx
and ecx, eax
mov edi, eax
and edi, 8
or edi, esi
xor ecx, edx
mov esi, ecx
shr esi, 4
mov edx, esi
neg edx
sar edx, 0x1f
xor esi, ecx
and esi, edx
and edx, 4
or edx, edi
xor esi, ecx
mov eax, esi
shr eax, 2
mov ecx, eax
neg ecx
sar ecx, 0x1f
xor eax, esi
and eax, ecx
and ecx, 2
or ecx, edx
or ecx, ebx
xor eax, esi
shr eax, 1
neg eax
shr eax, 0x1f
add eax, ecx
jmp 0x6b5370d9
mov edx, dword [eax + 8]
test edx, edx
mov dword [esp + 4], ecx
jle 0x6b5370c1
add ecx, 0x7fffffff
mov dword [esp + 0x14], ecx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp], 0
mov dword [esp + 0xc], edx
xor esi, esi
mov dword [esp + 8], ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
mov ecx, eax
mov dword [esp + 0x18], eax
xor ebx, dword [esp + 8]
dec ebx
and ebx, dword [esp + 0x14]
sar ebx, 0x1f
mov ebp, dword [esp]
or ebp, ebx
mov dword [esp], ebp
not ebp
and ebp, 0x20
add ebp, esi
mov eax, dword [esp + 0x10]
mov edx, dword [eax + ecx*4]
xor eax, eax
test edx, edx
setne al
mov edi, edx
shr edi, 0x10
mov esi, edi
neg esi
sar esi, 0x1f
xor edi, edx
and edi, esi
and esi, 0x10
or esi, eax
xor edi, edx
mov eax, edi
shr eax, 8
mov edx, eax
neg edx
sar edx, 0x1f
xor eax, edi
and eax, edx
and edx, 8
or edx, esi
xor eax, edi
mov edi, eax
shr edi, 4
mov ecx, edi
neg ecx
sar ecx, 0x1f
xor edi, eax
and edi, ecx
and ecx, 4
or ecx, edx
xor edi, eax
mov esi, edi
shr esi, 2
mov edx, esi
neg edx
sar edx, 0x1f
xor esi, edi
and esi, edx
and edx, 2
or edx, ecx
xor esi, edi
shr esi, 1
neg esi
shr esi, 0x1f
add esi, edx
and esi, ebx
add esi, ebp
mov ecx, dword [esp + 0x18]
inc ecx
mov eax, ecx
cmp dword [esp + 0xc], ecx
jne 0x6b537010
jmp 0x6b5370c3
xor eax, eax
jmp 0x6b5370d9
xor esi, esi
mov ecx, 0x80000000
mov eax, dword [esp + 4]
sub ecx, eax
not eax
and eax, ecx
sar eax, 0x1f
not eax
and eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b538080
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
cmp esi, edx
je 0x6b538107
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, ecx
not edi
dec ecx
and ecx, edi
shr ecx, 0x1f
dec ecx
mov edi, dword [esi + 4]
mov ebx, dword [edx + 4]
xor ebx, edi
and ebx, ecx
xor edi, ebx
mov dword [esi + 4], edi
xor dword [edx + 4], ebx
mov edi, dword [esi + 0xc]
mov ebx, dword [edx + 0xc]
xor ebx, edi
and ebx, ecx
xor edi, ebx
mov dword [esi + 0xc], edi
xor dword [edx + 0xc], ebx
mov edi, dword [esi + 0x10]
mov ebx, dword [edx + 0x10]
xor ebx, edi
and ebx, ecx
and ebx, 4
xor edi, ebx
mov dword [esi + 0x10], edi
xor dword [edx + 0x10], ebx
test eax, eax
jle 0x6b538107
mov esi, dword [esi]
mov edx, dword [edx]
xor edi, edi
nop
nop
mov ebx, dword [esi + edi*4]
mov ebp, dword [edx + edi*4]
xor ebp, ebx
and ebp, ecx
xor ebx, ebp
mov dword [esi + edi*4], ebx
xor dword [edx + edi*4], ebp
inc edi
cmp eax, edi
jne 0x6b5380f0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b57f6e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x124
mov edi, dword [esp + 0x144]
mov ebp, dword [esp + 0x140]
mov esi, dword [esp + 0x13c]
mov ecx, dword [esp + 0x138]
test edi, edi
mov eax, dword [ecx]
je 0x6b57f726
cmp eax, edi
je 0x6b57f722
xor ebx, ebx
test esi, esi
je 0x6b57f927
test ebp, ebp
js 0x6b57f927
mov dword [ecx], edi
jmp 0x6b57f730
test eax, eax
mov edi, eax
je 0x6b57f7c5
push edi
call fcn.6b56ed00
add esp, 4
xor ebx, ebx
test al, 2
jne 0x6b57f927
test esi, esi
je 0x6b57f7cc
push edi
call fcn.6b56ec80
add esp, 4
cmp eax, 0x90
ja 0x6b57f927
cmp eax, ebp
jge 0x6b57f7fb
push dword [esp + 0x148]
push edi
mov eax, dword [esp + 0x140]
push dword [eax + 4]
call fcn.6b564600
add esp, 0xc
test eax, eax
je 0x6b57f927
push ebp
push esi
mov esi, dword [esp + 0x140]
push dword [esi + 4]
call fcn.6b564620
add esp, 0xc
test eax, eax
je 0x6b57f927
mov eax, esp
lea ecx, [esp + 4]
push eax
push ecx
push dword [esi + 4]
call fcn.6b564760
add esp, 0xc
test eax, eax
je 0x6b57f927
mov ebp, dword [esp]
jmp 0x6b57f815
xor ebx, ebx
jmp 0x6b57f927
mov dl, 1
mov ecx, dword [esp + 0x138]
push dword [ecx + 8]
push dword [ecx + 4]
mov esi, edx
call fcn.6b564b10
add esp, 8
xor ebx, ebx
test eax, eax
setne bl
mov eax, esi
test al, al
je 0x6b57f900
jmp 0x6b57f927
test ebp, ebp
js 0x6b57f927
lea eax, [esp + 4]
push ebp
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esp], ebp
cmp ebp, 0x90
je 0x6b57f834
lea eax, [esp + ebp + 4]
mov ecx, 0x90
sub ecx, ebp
push ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0xffffff70
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x94]
xor cl, 0x36
mov byte [esp + eax + 0x124], cl
inc eax
jne 0x6b57f840
push dword [esp + 0x148]
push edi
mov esi, dword [esp + 0x140]
push dword [esi + 8]
call fcn.6b564600
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x6b57f900
mov ebp, dword [esi + 8]
push edi
call fcn.6b56ec80
add esp, 4
lea esi, [esp + 0x94]
push eax
push esi
push ebp
call fcn.6b564620
add esp, 0xc
test eax, eax
je 0x6b57f900
mov eax, 0xffffff70
movzx ecx, byte [esp + eax + 0x94]
xor cl, 0x5c
mov byte [esp + eax + 0x124], cl
inc eax
jne 0x6b57f8a0
push dword [esp + 0x148]
push edi
mov ebp, dword [esp + 0x140]
push dword [ebp + 0xc]
call fcn.6b564600
add esp, 0xc
test eax, eax
je 0x6b57f900
mov ebx, dword [ebp + 0xc]
push edi
call fcn.6b56ec80
add esp, 4
push eax
push esi
push ebx
call fcn.6b564620
mov ecx, dword [esp + 0x144]
add esp, 0xc
xor edx, edx
test eax, eax
mov ebx, 0
jne 0x6b57f7d5
lea eax, [esp + 4]
push 0x90
push eax
call fcn.6b58f580
add esp, 8
lea eax, [esp + 0x94]
push 0x90
push eax
call fcn.6b58f580
add esp, 8
mov eax, ebx
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b57fe10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edx, dword [esp + 0x10]
xor eax, eax
test edx, edx
je 0x6b57fe60
mov bl, byte [edx]
test bl, bl
je 0x6b57fe60
inc edx
xor ecx, ecx
mov eax, 0x100
nop
movsx esi, bl
mov edi, ecx
mov ebx, eax
or ebx, esi
add eax, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
and cl, 0xf
rol edi, cl
imul ebx, ebx
mov ecx, ebx
xor ecx, edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x6b57fe30
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x6b580400
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
je 0x6b580458
mov cl, byte [esi]
test cl, cl
je 0x6b580458
inc esi
xor edi, edi
mov ebx, 0x100
nop
movsx eax, cl
push eax
call fcn.6b582bd0
add esp, 4
mov ecx, eax
shr ecx, 2
xor ecx, eax
mov edx, edi
or eax, ebx
and cl, 0xf
rol edx, cl
imul eax, eax
mov edi, eax
xor edi, edx
add ebx, 0x100
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x6b580420
mov eax, edi
shr eax, 0x10
xor eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x6b5829c0
Capabilities:
Access the windows event log
Check os version
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x220
mov esi, esp
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x6b582a27
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x6b582a27
lea eax, [ebp + 0xc]
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
push eax
push ebx
push 0x200
push ecx
mov ebx, ecx
call dword [sym.imp.msvcrt.dll__vsnprintf]
add esp, 0x10
test eax, eax
mov ecx, 0x200
cmovns ecx, eax
lea eax, [esi + 8]
push 0
push eax
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x6b582b69
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
lea edi, [eax + 1]
lea eax, [eax + eax + 5]
and eax, 0xfffffffc
call fcn.6b714eb0
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push edi
push ebx
push edi
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 8]
test eax, eax
jne 0x6b582a7d
test edi, edi
je 0x6b582a7d
xor eax, eax
nop
nop
nop
nop
nop
movsx ecx, byte [edx + eax]
mov word [ebx + eax*2], cx
inc eax
cmp edi, eax
jne 0x6b582a70
test edi, edi
je 0x6b582ae9
xor eax, eax
jmp 0x6b582a95
inc eax
cmp eax, edi
jae 0x6b582ae9
cmp word [ebx + eax*2], 0x25
jne 0x6b582a90
inc eax
movzx ecx, word [ebx + eax*2]
mov edx, ecx
add edx, 0xffffffd0
cmp dx, 0xa
jb case.0x6b582abc.0
lea edx, [ecx - 0x2a]
cmp dx, 0x39
ja case.default.0x6b582abc
movzx ecx, dx
jmp dword [ecx*4 + 0x6b7738b4]
mov word [ebx + eax*2], 0x63
jmp case.0x6b582abc.1
cmp cx, 0x73
jne case.0x6b582abc.1
mov word [ebx + eax*2], 0x53
jmp case.0x6b582abc.1
mov word [ebx + eax*2], 0x73
jmp case.0x6b582abc.1
mov word [ebx + eax*2], 0x43
jmp case.0x6b582abc.1
lea eax, [ebp + 0xc]
mov dword [esi + 0xc], eax
lea edi, [esi + 0x10]
push eax
push ebx
push 0xff
push edi
call dword [sym.imp.msvcrt.dll__vsnwprintf]
add esp, 0x10
mov word [esi + 0x20e], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x6b582b59
call fcn.6b5828c0
test eax, eax
jle 0x6b582b59
mov ebx, edi
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x6b582b69
mov edi, eax
mov dword [esi + 8], ebx
lea eax, [esi + 8]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x6b582b69
push 0x10
push str.OpenSSL:_FATAL
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b58ec00
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop esi
pop edi
ret

Function at 0x6b58f5e0
Capabilities:
Encode data using xor

Disassembly:
endbr32
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
cmp ecx, 0
je 0x6b58f60f
mov dl, byte [esi]
lea esi, [esi + 1]
xor dl, byte [edi]
lea edi, [edi + 1]
or al, dl
dec ecx
jne 0x6b58f5fb
neg eax
shr eax, 0x1f
pop edi
pop esi
ret

Function at 0x6b58f9a0
Capabilities:
Hash data with md5

Disassembly:
push edi
mov edx, dword [esp + 8]
lea edi, [edx + 0x10]
xor eax, eax
mov ecx, 0x13
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov eax, 1
pop edi
ret
Function at 0x6b590090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, dword [ebp + 8]
mov al, byte [esi]
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov byte [esp + 3], al
movzx ebx, al
test bl, 0x40
mov dword [esp + 8], ecx
jne 0x6b5900c2
lea eax, [esi + 0x10]
push ecx
push eax
push esi
call edi
add esp, 0xc
and ebx, 7
mov byte [esi], bl
mov eax, ebx
xor eax, 0xf
test ebx, ebx
mov dword [esp + 0x20], eax
je 0x6b5900f7
xor edx, edx
mov ecx, eax
nop
nop
nop
nop
movzx eax, byte [esi + ecx]
or eax, edx
mov byte [esi + ecx], 0
shl eax, 8
inc ecx
cmp ecx, 0xf
mov edx, eax
jne 0x6b5900e0
jmp 0x6b5900f9
xor eax, eax
movzx ecx, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
mov eax, 0xffffffff
mov edx, dword [ebp + 0x14]
cmp ecx, edx
jne 0x6b590273
mov dword [esp + 4], edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
cmp edx, 0x10
jb 0x6b5901dd
lea eax, [esi + 0x10]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 4]
jmp 0x6b5901a1
mov eax, dword [edi]
mov ecx, dword [edi + 4]
xor eax, dword [esp + 0x10]
xor ecx, dword [esp + 0x14]
mov dword [ebx + 4], ecx
mov dword [ebx], eax
xor dword [esi + 0x14], ecx
xor dword [esi + 0x10], eax
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
xor eax, dword [esp + 0x18]
xor ecx, dword [esp + 0x1c]
mov dword [ebx + 0xc], ecx
mov dword [ebx + 8], eax
xor dword [esi + 0x18], eax
xor dword [esi + 0x1c], ecx
push dword [esp + 8]
mov eax, dword [esp + 0x28]
push eax
push eax
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0x10]
call ebx
mov ecx, ebx
mov ebx, dword [esp + 0x34]
add esp, 0xc
add edi, 0x10
add ebx, 0x10
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
cmp edx, 0xf
jbe 0x6b5901dd
mov dword [esp + 0xc], edx
push dword [esp + 8]
lea eax, [esp + 0x14]
push eax
push esi
call ecx
add esp, 0xc
mov eax, 7
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax + 8]
inc cl
mov byte [esi + eax + 8], cl
sub eax, 1
jb 0x6b590140
test cl, cl
je 0x6b5901c0
jmp 0x6b590140
test edx, edx
je 0x6b590224
lea eax, [esp + 0x10]
push dword [esp + 8]
push eax
push esi
mov dword [esp + 0x18], edx
call dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add esp, 0xc
xor eax, eax
movzx ecx, byte [edi + eax]
xor cl, byte [esp + eax + 0x10]
mov byte [ebx + eax], cl
xor byte [esi + eax + 0x10], cl
inc eax
cmp edx, eax
jne 0x6b590200
lea eax, [esi + 0x10]
push dword [esp + 8]
push eax
push eax
call dword [esp + 0x10]
add esp, 0xc
mov edx, dword [esp + 0x20]
lea eax, [esi + edx]
mov ecx, 0x10
sub ecx, edx
push ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push dword [esp + 8]
push eax
push esi
call dword [esp + 0x10]
add esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor dword [esi + 0x14], ecx
xor dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
xor dword [esi + 0x18], ecx
xor dword [esi + 0x1c], eax
mov al, byte [esp + 3]
mov byte [esi], al
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret