joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b476ab0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x104
mov ebp, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + ebp*4 + 0x130]
mov eax, dword [edi + 0x270]
test byte [eax + 0x44], 3
je 0x6b476ba2
cmp dword [edi + ebp*4 + 0x148], 0x6b476c80
jne 0x6b476ba2
shl ebp, 4
mov ebx, dword [edi + ebp + 0x15c]
sub ebx, dword [edi + ebp + 0x160]
jne 0x6b476b14
cmp dword [edi + ebp + 0x158], 0
jne 0x6b476ba2
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.6b4761e0
add esp, 0x14
cmp eax, 0xffffffff
je 0x6b476ba2
and eax, 1
je 0x6b476ba2
lea ecx, [edi + ebp + 0x160]
mov eax, dword [ecx - 8]
test eax, eax
mov dword [esp], ecx
je 0x6b476b44
mov ecx, dword [ecx]
jmp 0x6b476b8c
lea ebx, [edi + ebp + 0x15c]
mov eax, dword [esp + 0x118]
mov eax, dword [eax + 0x4c0]
add eax, eax
mov dword [ebx], eax
mov ecx, dword [0x6b83acf8]
push eax
call dword [ecx]
mov ecx, dword [esp + 4]
add esp, 4
mov dword [ecx - 8], eax
test eax, eax
je 0x6b476c29
mov dword [ecx], 0
mov dword [edi + ebp + 0x164], 0
mov ebx, dword [ebx]
xor ecx, ecx
add ecx, eax
push 0
push ebx
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x6b476ba2
mov ecx, dword [esp]
add dword [ecx], eax
push 0
push dword [esp + 0x128]
push dword [esp + 0x128]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [esp + 0x128]
mov dword [edi], 0
cmp eax, 0xffffffff
jne 0x6b476c1e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x6b476be2
mov dword [edi], 0x51
xor eax, eax
jmp 0x6b476c1e
mov esi, eax
lea eax, [esp + 4]
push 0x100
push eax
push esi
call fcn.6b481730
add esp, 0xc
push eax
push str.Send_failure:__s
mov ebx, dword [esp + 0x120]
push ebx
call fcn.6b476950
add esp, 0xc
mov dword [ebx + 0x89c], esi
mov dword [edi], 0x37
mov eax, 0xffffffff
add esp, 0x104
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x128]
mov dword [eax], 0x1b
jmp 0x6b476c19
Function at 0x6b47edb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [esp], 0x10
mov dword [esp + 0x14], 1
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
je 0x6b47ef71
mov esi, eax
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov word [esp + 4], 2
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 8], eax
mov word [esp + 6], 0
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6b47ef53
lea ebp, [esp + 4]
push 0x10
push ebp
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x6b47ef53
mov edi, esp
push edi
push ebp
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x6b47ef53
cmp dword [esp], 0x10
jl 0x6b47ef53
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x6b47ef53
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x6b47ef53
push 0x10
push ebp
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x6b47ef53
push 1
push esi
call fcn.6b471820
add esp, 8
test eax, eax
js 0x6b47ef53
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x18]
push 0
push 0x2710
push 1
push eax
call fcn.6b476320
add esp, 0x10
push 0
push 0
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x6b47ef53
mov dword [esp], 0x10
push edi
push ebp
push dword [ebx]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x6b47ef53
cmp dword [esp], 0x10
jl 0x6b47ef53
mov dword [esp], 0x10
lea eax, [esp + 0x20]
push edi
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x6b47ef53
cmp dword [esp], 0x10
jl 0x6b47ef53
movzx eax, word [esp + 4]
cmp ax, word [esp + 0x20]
jne 0x6b47ef53
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x24]
jne 0x6b47ef53
movzx eax, word [esp + 6]
xor edi, edi
cmp ax, word [esp + 0x22]
je 0x6b47ef68
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push esi
call edi
push dword [ebx]
call edi
mov esi, dword [ebx + 4]
mov edi, 0xffffffff
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x6b47ef76
mov edi, 0xffffffff
mov eax, edi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b4820d0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
test byte [esp + 0x194], 2
jne 0x6b4820f0
call fcn.6b44c140
test eax, eax
je 0x6b48211f
add esp, 0x190
ret
mov eax, esp
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x6b482113
movzx eax, word [esp]
cmp eax, 0x202
je 0x6b4820e0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x190
ret
push 0x6b73554c
call fcn.6b482180
add esp, 4
mov dword [0x6b83d034], eax
test eax, eax
je 0x6b48214a
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x6b48214a
mov dword [0x6b83d030], eax
push 3
push 2
push 0
push 6
call fcn.6b48f120
add esp, 0x10
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x6b83d038], ecx
push 0x6b83d040
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add esp, 0x190
ret

Function at 0x6b482180
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edi, edi
test eax, eax
je 0x6b482280
mov ebx, eax
mov ebp, dword [esp + 0x14]
push str.LoadLibraryExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x6b735580
push ebp
call sub.msvcrt.dll_strpbrk
add esp, 8
test eax, eax
je 0x6b4821c7
test esi, esi
je 0x6b4821ea
push 8
jmp 0x6b4821e0
test esi, esi
je 0x6b4821f6
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x6b4821f6
push 0x800
push 0
push ebp
call esi
jmp 0x6b482282
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x6b482282
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x6b482280
mov ebp, eax
push dword [esp + 0x14]
call sub.msvcrt.dll_strlen
add esp, 4
mov ecx, dword [0x6b83acf8]
lea eax, [ebp + eax + 1]
push eax
call dword [ecx]
add esp, 4
mov ebx, eax
xor edi, edi
test eax, eax
je 0x6b482275
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x6b482275
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
mov word [ebx + eax], 0x5c
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
mov ecx, ebx
add ecx, eax
push dword [esp + 0x14]
push ecx
call sub.msvcrt.dll_strcpy
add esp, 8
test esi, esi
je 0x6b48226c
push 8
push 0
push ebx
call esi
jmp 0x6b482273
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov eax, dword [0x6b83acf4]
push ebx
call dword [eax]
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b484150
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
cmp edx, 0x1f
jne 0x6b48428e
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov dword [esp], ecx
mov ebp, dword [ecx + 0x114]
lea edi, [ebp + 0x1eb4]
mov word [ebp + 0x1cb4], 0xfaff
lea eax, [ebp + 0x1cb7]
mov dword [esp + 4], eax
mov dword [ebp + 0x1eb4], eax
mov byte [ebp + 0x1cb6], 0x1f
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
mov ebx, eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov esi, dword [ebp + 0x1eb4]
cmp esi, edi
jb 0x6b484293
cmp esi, edi
jb 0x6b4842ac
cmp esi, edi
jb 0x6b4842c5
cmp esi, edi
jb 0x6b4842de
cmp esi, edi
jae 0x6b4841ee
lea eax, [esi + 1]
mov dword [ebp + 0x1eb4], eax
mov byte [esi], 0xff
mov esi, dword [ebp + 0x1eb4]
lea ebx, [ebp + 0x1cb4]
lea eax, [ebp + 0x1cb6]
cmp esi, edi
jae 0x6b484210
lea ecx, [esi + 1]
mov dword [ebp + 0x1eb4], ecx
mov byte [esi], 0xf0
mov esi, dword [ebp + 0x1eb4]
mov edi, dword [esp]
mov dword [ebp + 0x1eb8], esi
mov dword [ebp + 0x1eb4], ebx
sub esi, ebx
add esi, 0xfffffffe
mov ecx, edi
mov edx, 0x3e
push esi
push eax
call fcn.6b484320
add esp, 8
push 0
push 3
push ebx
mov esi, dword [esp + 0x14]
push dword [esi + 0x130]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x6b484263
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.6b476950
add esp, 0xc
mov ecx, edi
mov edx, dword [esp + 4]
push 4
call fcn.6b483d10
add esp, 4
add ebp, 0x1cbb
push 0
push 2
push ebp
push dword [esi + 0x130]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x6b4842fc
add esp, 0xc
jmp 0x6b484311
lea ecx, [esi + 1]
mov dword [ebp + 0x1eb4], ecx
mov byte [esi], bl
mov esi, dword [ebp + 0x1eb4]
cmp esi, edi
jae 0x6b4841c8
lea ecx, [esi + 1]
mov dword [ebp + 0x1eb4], ecx
mov byte [esi], bh
mov esi, dword [ebp + 0x1eb4]
cmp esi, edi
jae 0x6b4841d0
lea ecx, [esi + 1]
mov dword [ebp + 0x1eb4], ecx
mov byte [esi], al
mov esi, dword [ebp + 0x1eb4]
cmp esi, edi
jae 0x6b4841d8
lea ecx, [esi + 1]
mov dword [ebp + 0x1eb4], ecx
mov byte [esi], ah
mov esi, dword [ebp + 0x1eb4]
cmp esi, edi
jb 0x6b4841dc
jmp 0x6b4841ee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.6b476950
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b493fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x110
mov esi, ecx
mov ecx, dword [ecx + 0x70]
test ecx, ecx
je 0x6b493fe2
xor eax, eax
cmp dword [ecx + 0xd8], 0
jne 0x6b49413b
call fcn.6b5a83d0
test eax, eax
je 0x6b494007
mov ecx, dword [esi + 0x70]
xor eax, eax
test ecx, ecx
je 0x6b49413b
mov dword [ecx + 0xd8], 1
jmp 0x6b49413b
mov eax, dword [esi + 0x5a0]
test eax, eax
je 0x6b494030
push 0x400
push eax
call fcn.6b5a9850
add esp, 8
call fcn.6b5a83d0
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x6b49413b
mov dword [esp + 4], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0x40000
mov edi, 0x300
mov ebx, 2
nop
mov dword [esp + 0xc], eax
call fcn.6b485a50
mov dword [esp], eax
mov ebp, edx
push 0
push 1
call fcn.6b4761a0
add esp, 8
lea esi, [ebx - 1]
imul esi, dword [esp]
imul ebp, ebx
mov dword [esp], ebp
call fcn.6b485a50
mov dword [esp + 8], eax
call fcn.6b485a50
mov ebp, edx
add ebp, dword [esp + 8]
imul ebp, edi
xor ebp, esi
call fcn.6b485a50
mov esi, eax
call fcn.6b485a50
mov eax, dword [esp + 0xc]
add edx, esi
imul edx, eax
xor edx, dword [esp]
mov dword [esp + ebx*8], ebp
mov dword [esp + ebx*8 + 4], edx
add eax, 0x10000
add edi, 0x100
inc ebx
cmp ebx, 0xa
jne 0x6b494050
push 0x40400000
push 0
push 0x40
lea edi, [esp + 0x1c]
push edi
call fcn.6b5a8340
add esp, 0x10
call fcn.6b5a83d0
test eax, eax
je 0x6b494040
mov byte [esp + 0x10], 0
push 0x100
push edi
call fcn.6b5a9b60
add esp, 8
cmp byte [esp + 0x10], 0
mov esi, dword [esp + 4]
je 0x6b49411c
push 0x400
push edi
call fcn.6b5a9850
add esp, 8
call fcn.6b5a83d0
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x6b49413b
push str.libcurl_is_now_using_a_weak_random_seed_
push esi
call fcn.6b4767f0
add esp, 8
call fcn.6b5a83d0
xor ecx, ecx
test eax, eax
mov eax, 0x23
cmovne eax, ecx
add esp, 0x110
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b4c61d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x6b4c61ff
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor edi, edi
nop
nop
nop
movzx ebx, byte [ecx + edi]
xor bl, byte [edx + edi]
mov byte [esi + edi], bl
inc edi
cmp eax, edi
jne 0x6b4c61f0
pop esi
pop edi
pop ebx
ret
Function at 0x6b4c6530
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6b4d9290
push ebp
push ebx
push edi
push esi
sub esp, 0xe0
mov edi, 0xffffffff
cmp dword [esp + 0x10c], 0
je 0x6b4d9509
mov ebx, dword [esp + 0x100]
cmp ebx, 0x100000
ja 0x6b4d9509
mov esi, dword [esp + 0xf8]
test esi, esi
je 0x6b4d9509
test ebx, ebx
je 0x6b4d9509
mov eax, dword [esp + 0x108]
dec eax
cmp eax, 0x3ff
ja 0x6b4d9509
lea eax, [ebx + 4]
mov dword [esp + 0x18], eax
push eax
push 1
call sub.msvcrt.dll_calloc
add esp, 8
test eax, eax
je 0x6b4d9509
mov ebp, dword [esp + 0x108]
lea edi, [ebp + 0x1f]
shr edi, 5
push ebx
push dword [esp + 0x100]
mov dword [esp + 0x14], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, esp
push eax
call fcn.6b4d5990
add esp, 4
push esi
mov esi, ebp
push dword [esp + 0xf8]
push dword [esp + 8]
call fcn.6b564620
add esp, 0xc
lea eax, [esp + 0x60]
push 0
push eax
push dword [esp + 8]
call fcn.6b564700
add esp, 0xc
push dword [esp]
call fcn.6b564090
add esp, 4
lea eax, [edi + ebp - 1]
mov dword [esp + 0x10], 0
xor edx, edx
mov dword [esp + 0x1c], edi
div di
movzx eax, ax
mov dword [esp + 4], eax
mov ecx, 1
lea ebx, [esp + 0xa0]
lea edi, [esp + 0x40]
mov dword [esp + 0x14], ebp
jmp 0x6b4d93b5
xor eax, eax
mov ecx, dword [esp + 8]
inc ecx
inc dword [esp + 0x10]
sub dword [esp + 0x14], eax
je 0x6b4d94ec
mov dword [esp + 8], ecx
mov eax, ecx
bswap eax
mov ecx, dword [esp + 0x100]
mov esi, dword [esp + 0xc]
mov dword [esi + ecx], eax
mov eax, esp
push eax
call fcn.6b4d5990
add esp, 4
push dword [esp + 0x18]
push esi
push dword [esp + 8]
call fcn.6b564620
add esp, 0xc
push 0
push ebx
push dword [esp + 8]
call fcn.6b564700
add esp, 0xc
push dword [esp]
call fcn.6b564090
add esp, 4
lea ecx, [esp + 0x60]
mov edx, ebx
push edi
call fcn.6b4d9520
add esp, 4
push 0x20
push edi
lea eax, [esp + 0x28]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [esp + 0x10c], 2
jb 0x6b4d9496
mov esi, 1
nop
mov eax, esp
push eax
call fcn.6b4d5990
add esp, 4
push 0x20
push edi
push dword [esp + 8]
call fcn.6b564620
add esp, 0xc
push 0
push ebx
push dword [esp + 8]
call fcn.6b564700
add esp, 0xc
push dword [esp]
call fcn.6b564090
add esp, 4
lea ecx, [esp + 0x60]
mov edx, ebx
push edi
call fcn.6b4d9520
add esp, 4
mov eax, 0xffffffe0
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x60]
xor byte [esp + eax + 0x40], cl
inc eax
jne 0x6b4d9480
inc esi
cmp esi, dword [esp + 0x10c]
jne 0x6b4d9430
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
cmovae eax, ecx
mov dword [esp + 4], eax
test eax, eax
je 0x6b4d93a0
xor eax, eax
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x108]
nop
nop
nop
nop
cmp ecx, esi
jae 0x6b4d93a2
movzx edx, byte [esp + eax + 0x20]
mov ebp, dword [esp + 0x104]
mov byte [ebp + ecx], dl
inc eax
add ecx, dword [esp + 0x1c]
cmp dword [esp + 4], eax
jne 0x6b4d94c0
mov eax, dword [esp + 4]
jmp 0x6b4d93a2
push 0x20
lea eax, [esp + 0x24]
push eax
call fcn.6b4c6250
add esp, 8
push dword [esp + 0xc]
call fcn.6b721a48
add esp, 4
xor edi, edi
mov eax, edi
add esp, 0xe0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b4c8dd0
Capabilities:
Get socket status

Disassembly:
push ebx
push edi
push esi
sub esp, 0x21c
mov edi, dword [esp + 0x22c]
mov dword [edi + 0x158], 0
lea eax, [esp + 8]
push eax
push edi
call fcn.6b4d9130
add esp, 8
mov esi, eax
test eax, eax
jne 0x6b4c8f36
mov edx, dword [esp + 8]
imul esi, edx, 0x3e8
mov eax, dword [edi + 0x54]
mov ebx, dword [edi + 0x14c]
test ebx, ebx
mov ecx, 0x3e8
cmovne ecx, esi
test eax, eax
jle 0x6b4c8e33
test edx, edx
je 0x6b4c8edc
cmp ecx, eax
jg 0x6b4c8edc
test ecx, ecx
setle al
mov esi, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
shr eax, 0x1f
sar edx, 6
add edx, eax
mov dword [esp + 0xc], edx
imul eax, edx, 0xfffffc18
add eax, ecx
imul eax, eax, 0x3e8
mov dword [esp + 0x10], eax
xor eax, eax
test bl, 1
je 0x6b4c8e89
mov eax, dword [edi + 0x144]
mov dword [esp + 0x11c], eax
mov dword [esp + 0x118], 1
lea eax, [esp + 0x118]
test bl, 2
jne 0x6b4c8e98
mov ecx, dword [edi + 0x144]
xor edx, edx
jmp 0x6b4c8eae
mov ecx, dword [edi + 0x144]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 1
lea edx, [esp + 0x14]
mov ebx, esi
inc ecx
xor esi, esi
test bl, bl
lea ebx, [esp + 0xc]
cmovne ebx, esi
push ebx
push 0
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x6b4c8ed5
jns 0x6b4c8f36
push str.Error_waiting_on_socket
jmp 0x6b4c8f29
push str.Timed_out_waiting_on_socket
jmp 0x6b4c8f29
mov esi, dword [esp + 0x230]
push 0
call dword [sym.imp.msvcrt.dll_time]
add esp, 4
push esi
push eax
call dword [sym.imp.msvcrt.dll_difftime]
add esp, 8
fmul dword [0x6b74a6b0]
fnstcw word [esp]
movzx eax, word [esp]
or eax, 0xc00
mov word [esp + 2], ax
fldcw word [esp + 2]
fistp dword [esp + 4]
fldcw word [esp]
mov ecx, dword [edi + 0x54]
sub ecx, dword [esp + 4]
jge 0x6b4c8f42
push str.API_timeout_expired
push 0xfffffffffffffff7
push edi
call fcn.6b4c5c00
add esp, 0xc
mov esi, eax
mov eax, esi
add esp, 0x21c
pop esi
pop edi
pop ebx
ret
xor esi, esi
jmp 0x6b4c8e3a
Function at 0x6b4d15b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, edx
mov esi, ecx
push 0x6b74ba4c
push dword [esp + 0x3c]
call fcn.6b721a68
add esp, 8
test eax, eax
je 0x6b4d15ea
mov ebx, eax
push eax
call sub.msvcrt.dll_feof
add esp, 4
test eax, eax
je 0x6b4d15f1
push ebx
call sub.msvcrt.dll_rewind
add esp, 4
jmp 0x6b4d163c
push str.Unable_to_open_public_key_file
jmp 0x6b4d164a
mov dword [esp + 0xc], edi
xor edi, edi
lea ebp, [esp + 3]
nop
nop
nop
nop
nop
push ebx
push 1
push 1
push ebp
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x6b4d162e
movzx eax, byte [esp + 3]
cmp al, 0xa
je 0x6b4d162e
cmp al, 0xd
je 0x6b4d162e
inc edi
push ebx
call sub.msvcrt.dll_feof
add esp, 4
test eax, eax
je 0x6b4d1600
push ebx
call sub.msvcrt.dll_rewind
add esp, 4
cmp edi, 1
ja 0x6b4d1661
push ebx
call sub.msvcrt.dll_fclose
add esp, 4
push str.Invalid_data_in_public_key_file
push 0xfffffffffffffff0
push esi
call fcn.6b4c5c00
add esp, 0xc
mov ebx, eax
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
push edi
call dword [esi + 4]
add esp, 8
test eax, eax
je 0x6b4d1730
mov ebp, eax
push ebx
push edi
push 1
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, edi
jne 0x6b4d1745
push ebx
call sub.msvcrt.dll_fclose
add esp, 4
inc edi
mov ebx, dword [sym.imp.msvcrt.dll_isspace]
nop
nop
nop
nop
nop
nop
nop
nop
cmp edi, 1
je 0x6b4d1760
movzx eax, byte [ebp + edi - 2]
push eax
call ebx
add esp, 4
dec edi
test eax, eax
jne 0x6b4d16a0
push edi
push 0x20
push ebp
call sub.msvcrt.dll_memchr
add esp, 0xc
test eax, eax
je 0x6b4d1772
inc eax
xor ebx, ebx
mov ecx, eax
sub ecx, ebp
mov edx, eax
mov dword [esp + 8], eax
mov eax, 0
mov dword [esp + 4], ecx
cmova eax, ecx
mov ecx, edi
sub ecx, eax
push ecx
push 0x20
push edx
call sub.msvcrt.dll_memchr
add esp, 0xc
mov ecx, ebp
add ecx, edi
test eax, eax
cmovne ecx, eax
mov edi, dword [esp + 8]
sub ecx, edi
lea eax, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edi
push eax
push edx
push esi
call fcn.6b4c5d70
add esp, 0x14
test eax, eax
je 0x6b4d1784
push esi
push ebp
call dword [esi + 0xc]
add esp, 8
push str.Invalid_key_data__not_base64_encoded
jmp 0x6b4d164a
push ebx
call sub.msvcrt.dll_fclose
add esp, 4
push str.Unable_to_allocate_memory_for_public_key_data
push 0xfffffffffffffffa
jmp 0x6b4d164c
push esi
push ebp
call dword [esi + 0xc]
add esp, 8
push ebx
call sub.msvcrt.dll_fclose
add esp, 4
push str.Unable_to_read_public_key_from_file
jmp 0x6b4d164a
push esi
push ebp
call dword [esi + 0xc]
add esp, 8
push str.Missing_public_key_data
jmp 0x6b4d164a
push esi
push ebp
call dword [esi + 0xc]
add esp, 8
push str.Invalid_public_key_data
jmp 0x6b4d164a
mov eax, dword [esp + 0xc]
mov dword [eax], ebp
mov ecx, dword [esp + 4]
dec ecx
mov eax, dword [esp + 0x2c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
mov dword [ecx], eax
jmp 0x6b4d1657
Function at 0x6b4d3720
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1004
call fcn.6b714eb0
mov edi, dword [esp + 0x1018]
cmp dword [esp + 0x1020], 1
jne 0x6b4d37cf
push 0x6b74c330
push dword [esp + 0x1020]
call fcn.6b721a68
add esp, 8
mov dword [esp], eax
test eax, eax
je 0x6b4d37d8
lea eax, [edi + 4]
push eax
call fcn.6b4c6140
add esp, 4
xor esi, esi
test eax, eax
je 0x6b4d3800
mov ebp, eax
lea esi, [esp + 8]
nop
nop
mov dword [esp + 4], 0
mov ecx, edi
mov edx, ebp
push 1
lea eax, [esp + 8]
push eax
push 0xffc
push esi
call fcn.6b4d3460
add esp, 0x10
test eax, eax
jne 0x6b4d37fe
mov ebx, dword [esp + 4]
push dword [esp]
push ebx
push 1
push esi
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, ebx
jne 0x6b4d37ed
push ebp
call fcn.6b4c6150
add esp, 4
mov ebp, eax
test eax, eax
jne 0x6b4d3780
xor esi, esi
jmp 0x6b4d3800
push str.Unsupported_type_of_known_host_information_store
push 0xffffffffffffffdf
jmp 0x6b4d37df
push str.Failed_to_open_file
push 0xfffffffffffffff0
push dword [edi]
call fcn.6b4c5c00
add esp, 0xc
mov esi, eax
jmp 0x6b4d380b
push str.Write_failed
push 0xfffffffffffffff0
push dword [edi]
call fcn.6b4c5c00
add esp, 0xc
mov esi, eax
push dword [esp]
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, esi
add esp, 0x1004
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b4d9130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
cmp dword [ebp + 0xd2d0], 0
je 0x6b4d917d
push 0
call dword [sym.imp.msvcrt.dll_time]
add esp, 4
mov edi, eax
mov ecx, dword [ebp + 0xd2d0]
mov eax, dword [ebp + 0xd2d8]
lea edx, [ecx + eax]
cmp edx, edi
jle 0x6b4d9192
xor esi, esi
test ebx, ebx
je 0x6b4d9216
sub eax, edi
add eax, ecx
mov dword [ebx], eax
jmp 0x6b4d9216
xor esi, esi
test ebx, ebx
je 0x6b4d9216
mov dword [ebx], 0
jmp 0x6b4d9216
mov dword [esp + 0x18], 0x576772
mov dword [esp + 0x14], 0x6f2e3268
mov dword [esp + 0x10], 0x73736269
mov dword [esp + 0xc], 0x6c406576
mov dword [esp + 8], 0x696c6170
mov dword [esp + 4], 0x65656b15
mov dword [esp], 0x50
mov al, byte [ebp + 0xd2d4]
mov byte [esp + 0x1a], al
mov eax, esp
push 0
push 0
push 0x1b
push eax
push ebp
call fcn.6b4d2110
add esp, 0x14
cmp eax, 0xffffffdb
je 0x6b4d91f0
mov esi, eax
test eax, eax
jne 0x6b4d9206
mov dword [ebp + 0xd2d8], edi
test ebx, ebx
je 0x6b4d9202
mov eax, dword [ebp + 0xd2d0]
mov dword [ebx], eax
xor esi, esi
jmp 0x6b4d9216
push str.Unable_to_send_keepalive_message
push 0xfffffffffffffff9
push ebp
call fcn.6b4c5c00
add esp, 0xc
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret