joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4124b2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47d7a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c050
and dword [ebp - 0x14], 0
cmp dword [0x47f7d4], 0
mov dword [ebp - 0x18], eax
jne 0x412565
push 0x403a84
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41260d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403a78
push ebx
call edi
test eax, eax
je 0x41260d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403a68
push ebx
mov dword [0x47f7d4], eax
call edi
push eax
call esi
push 0x403a54
push ebx
mov dword [0x47f7d8], eax
call edi
push eax
call esi
push 0x403a38
push ebx
mov dword [0x47f7dc], eax
call edi
push eax
call esi
mov dword [0x47f7e4], eax
test eax, eax
je 0x412565
push 0x403a20
push ebx
call edi
push eax
call esi
mov dword [0x47f7e0], eax
mov eax, dword [0x47f7e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4125be
cmp dword [0x47f7e4], ecx
je 0x4125be
push eax
call esi
push dword [0x47f7e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4125be
test ebx, ebx
je 0x4125be
call edi
test eax, eax
je 0x4125b5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4125b5
test byte [ebp - 8], 1
jne 0x4125be
or dword [ebp + 0x10], 0x200000
jmp 0x4125f1
mov eax, dword [0x47f7d8]
cmp eax, dword [ebp - 0x18]
je 0x4125f1
push eax
call esi
test eax, eax
je 0x4125f1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4125f1
mov eax, dword [0x47f7dc]
cmp eax, dword [ebp - 0x18]
je 0x4125f1
push eax
call esi
test eax, eax
je 0x4125f1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47f7d4]
call esi
test eax, eax
je 0x41260d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41260f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f61
leave
ret
Function at 0x477170
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0xc0c
cmp dword [0x80356c], 0x37
jne 0x477209
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0x4042a4
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x804560]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x4845bc]
mov byte [ecx + esi], al
add esp, 0xc0c
ret
Function at 0x477480
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x80356c]
sub esp, 0x684
push ebx
push ebp
push esi
mov esi, dword [0x4845bc]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x47767f
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
jmp 0x4774b6
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0x80356c], 0x1c
jne 0x4774cd
lea eax, [esp + 0x38]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x47e708]
mov ebx, dword [0x47e710]
mov ebp, dword [0x47e714]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x47e70c]
mov dword [esp + 0x18], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0x20
jmp 0x477516
mov eax, dword [esp + 0x18]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x1c], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x8034dc], edi
mov eax, dword [esp + 0x1c]
add dword [0x8034dc], eax
mov eax, dword [0x8034dc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0x80356c], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x4775ad
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x80356c], 0x979
mov dword [0x8034e0], 0xff6b3619
mov dword [0x8034e4], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x4775f7
push 0
lea ecx, [esp + 0x294]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x1c]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
mov eax, dword [0x80356c]
cmp eax, 0x93
je 0x47761d
add esi, 0x61c88647
dec dword [esp + 0x28]
jne 0x477510
cmp eax, 0x8d4
jne 0x477634
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0x80356c], 0x17
jne 0x47766e
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x40]
push edx
push 0x404250
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x20], esi
jne 0x4774b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x684
ret
Function at 0x6f8c89f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test edx, edx
jns 0x6f8c8a08
not edx
mov edi, 0xffffffff
mov eax, edi
xor eax, edx
mov byte [ebp - 0x19], al
cmp edx, 0x7f
jbe 0x6f8c8a70
lea eax, [ebp - 0x1a]
lea esi, [esi]
nop
shr edx, 8
mov ebx, edi
dec eax
xor ebx, edx
mov byte [eax + 1], bl
cmp edx, 0x7f
ja 0x6f8c8a20
lea edx, [ebp - 0x19]
sub edx, eax
mov byte [eax], dl
lea esi, [esi]
nop
dec eax
mov byte [eax], cl
shr ecx, 8
jne 0x6f8c8a40
lea edx, [ebp - 0x18]
mov dword [esp], esi
sub edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sym._ber_write
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 1
lea eax, [ebp - 0x1a]
jmp 0x6f8c8a35

Function at 0x6f8c9d60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov eax, 0x101c
mov ebp, esp
push edi
push esi
push ebx
call fcn.6f8c2eec
sub esp, eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
cmp eax, 0xf
ja case.0x6f8c9ca0.0
jmp dword [eax*4 + 0x6f91bc9c]
mov ecx, dword [ebx + 8]
mov ebx, dword [ecx + 8]
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ecx
mov eax, dword [ebx + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov eax, dword [ebx + 8]
test eax, eax
je 0x6f8c9cee
lea esi, [esi]
nop
cmp dword [eax + 8], edx
je 0x6f8c9d05
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x6f8c9ce0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + 0x10], eax
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
test edx, edx
je 0x6f8c9d21
mov eax, dword [ebx + 0xc]
mov dword [edx], eax
cmp dword [ebx + 0xc], 0xffffffff
jne 0x6f8c9d05
mov eax, 0xffffffff
jmp 0x6f8c9cee
movzx eax, byte [ebx + 0x14]
shr al, 1
and eax, 1
jmp 0x6f8c9cee
test edx, edx
je 0x6f8c9d05
mov eax, dword [ebx + 0x10]
mov dword [edx], eax
mov eax, 1
jmp 0x6f8c9cee
mov eax, dword [edx]
mov dword [ebx + 0xc], eax
mov eax, 1
jmp 0x6f8c9cee
test edx, edx
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], 0x8004667e
setne dl
movzx edx, dl
mov dword [esp], eax
mov dword [ebp - 0x1018], edx
lea edx, [ebp - 0x1018]
mov dword [esp + 8], edx
call dword [sym.imp.ws2_32.dll_ioctlsocket]
sub esp, 0xc
test eax, eax
je 0x6f8c9d05
jmp 0x6f8c9d27
movzx eax, byte [ebx + 0x14]
and eax, 1
jmp 0x6f8c9cee
mov edi, dword [sym.imp.ucrtbase.dll__errno]
lea esi, [ebp - 0x1018]
lea esi, [esi]
mov eax, dword [ebx + 8]
mov edx, dword [eax + 8]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0xc]
test eax, eax
jns 0x6f8c9df0
call edi
cmp dword [eax], 4
jne 0x6f8c9d05
jmp 0x6f8c9dc0
cmp eax, 0x1000
je 0x6f8c9dc0
jmp 0x6f8c9d05
Function at 0x6f8cbec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6f8cbf1b
cmp byte [esi + ebx - 1], 0xa
je 0x6f8cbeef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6f916954], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6f8ddda0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 0xc]
mov ebx, dword [ecx + 4]
mov edx, dword [ecx]
mov esi, dword [ecx + 8]
lea ecx, [ebp - 0x1c]
movzx eax, al
mov dword [esp + 4], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp], edx
call sym.wldap32.dll_ldap_create_sort_control
mov ebx, eax
test eax, eax
je 0x6f8dddf0
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__strdup]
mov edi, dword [ebp - 0x1c]
mov dword [esi], eax
mov edx, dword [edi + 4]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
sub esp, 0xc
test eax, eax
je 0x6f8dde70
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x2c], edx
call sym._memcpy
mov edx, dword [ebp - 0x2c]
mov dword [esi + 4], edx
mov eax, dword [ebp - 0x1c]
movzx edx, byte [eax + 0xc]
mov byte [esi + 0xc], dl
mov dword [esp], eax
call sym.wldap32.dll_ldap_control_free
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esi + 4], 0
jmp 0x6f8dde50

Function at 0x6f8dde80
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 0xc]
mov ebx, dword [ecx + 4]
mov edx, dword [ecx]
mov esi, dword [ecx + 8]
lea ecx, [ebp - 0x1c]
movzx eax, al
mov dword [esp + 4], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp], edx
call sym.wldap32.dll_ldap_create_sort_controlW
mov ebx, eax
test eax, eax
je 0x6f8dded0
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov edi, dword [ebp - 0x1c]
mov dword [esi], eax
mov edx, dword [edi + 4]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
sub esp, 0xc
test eax, eax
je 0x6f8ddf50
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x2c], edx
call sym._memcpy
mov edx, dword [ebp - 0x2c]
mov dword [esi + 4], edx
mov eax, dword [ebp - 0x1c]
movzx edx, byte [eax + 0xc]
mov byte [esi + 0xc], dl
mov dword [esp], eax
call sym.wldap32.dll_ldap_control_freeW
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esi + 4], 0
jmp 0x6f8ddf30
Function at 0x6f8e4d60
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esi], 0
add eax, ecx
mov dword [ebp - 0x14], eax
cmp ecx, eax
jae 0x6f8e4e49
mov eax, ecx
xor ebx, ebx
movsx edx, byte [eax + ebx]
cmp dl, 0x3d
je 0x6f8e4da6
test dl, dl
js 0x6f8e4e60
cmp byte [edx + 0x6f91f320], 0x3f
ja 0x6f8e4e60
inc ebx
cmp ebx, 4
jne 0x6f8e4d88
movzx edx, byte [eax]
and edx, 0x7f
movsx ebx, byte [edx + 0x6f91f320]
lea edi, [ebx*4]
mov ebx, edi
mov dword [ebp - 0x10], edi
mov byte [ecx], bl
movzx edx, byte [eax + 1]
and edx, 0x7f
movzx edx, byte [edx + 0x6f91f320]
mov ebx, edx
sar bl, 4
mov edi, ebx
movzx ebx, byte [ebp - 0x10]
or ebx, edi
mov byte [ecx], bl
movsx ebx, dl
shl ebx, 4
mov byte [ecx + 1], bl
movzx edx, byte [eax + 2]
mov dword [ebp - 0x10], ebx
cmp dl, 0x3d
je 0x6f8e4e6d
and edx, 0x7f
movsx edx, byte [edx + 0x6f91f320]
mov ebx, edx
shl edx, 6
sar bl, 2
mov byte [ecx + 2], dl
mov edi, ebx
movzx ebx, byte [ebp - 0x10]
or ebx, edi
mov byte [ecx + 1], bl
movzx ebx, byte [eax + 3]
cmp bl, 0x3d
je 0x6f8e4e79
and ebx, 0x7f
add ecx, 3
add eax, 4
or dl, byte [ebx + 0x6f91f320]
mov byte [ecx - 1], dl
mov edi, dword [esi]
lea edx, [edi + 3]
mov dword [esi], edx
cmp dword [ebp - 0x14], eax
ja 0x6f8e4d86
mov ecx, dword [esi + 4]
add ecx, edx
mov byte [ecx], 0
add esp, 8
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 8
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
add ecx, dword [esi + 4]
jmp 0x6f8e4e49
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
add ecx, dword [esi + 4]
jmp 0x6f8e4e49
Function at 0x6f8e5ad0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x25c
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x6f8e5c90
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x228], eax
mov ebx, dword [ebp + 0x10]
lea edx, [ebp - 0x228]
mov eax, 0
test ebx, ebx
cmovne eax, edx
mov dword [ebp - 0x23c], eax
jmp 0x6f8e5b3e
call dword [sym.imp.ucrtbase.dll__errno]
cmp dword [eax], 4
jne 0x6f8e5c0c
mov eax, dword [edi]
test byte [eax + 0xa0], 2
je 0x6f8e5c0c
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x220]
mov dword [esp + 8], eax
mov eax, dword [0x6f9166f8]
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x118], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_select]
sub esp, 0x14
mov ebx, eax
cmp eax, 0xffffffff
je 0x6f8e5b20
test eax, eax
jne 0x6f8e5bbc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x6f8e5bbc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
jne 0x6f8e5bbc
mov edx, dword [eax + 4]
mov ebx, 0xfffffffe
test edx, edx
je 0x6f8e5c0c
lea eax, [ebp - 0x11c]
mov dword [esp], esi
mov ebx, dword [sym.imp.ws2_32.dll___WSAFDIsSet]
mov dword [esp + 4], eax
call ebx
sub esp, 8
test eax, eax
jne 0x6f8e5c20
lea eax, [ebp - 0x220]
mov dword [esp], esi
mov dword [esp + 4], eax
call ebx
sub esp, 8
test eax, eax
je 0x6f8e5ca9
mov dword [esp + 4], 0
xor ebx, ebx
mov dword [esp], esi
call sym._ber_pvt_socket_set_nonblock
cmp eax, 0xffffffff
sete bl
neg ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x22c]
mov dword [esp + 8], 0x1007
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x22c], 4
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xffff
mov dword [esp], esi
call dword [sym.imp.ws2_32.dll_getsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
je 0x6f8e5c69
mov eax, dword [ebp - 0x230]
test eax, eax
jne 0x6f8e5c75
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [ebp - 0x230], eax
mov dword [esp], eax
mov ebx, 0xffffffff
call dword [sym.imp.ws2_32.dll_WSASetLastError]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
jmp 0x6f8e5b01
mov dword [esp], 0x274c
mov ebx, 0xffffffff
call dword [sym.imp.ws2_32.dll_WSASetLastError]
sub esp, 4
jmp 0x6f8e5c0c
Function at 0x6f8e6a50
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov edx, dword [0x6f9166f8]
test edx, edx
jne 0x6f8e6a71
mov dword [0x6f9166f8], 0x40
mov edx, 0x40
mov eax, dword [ebp + 8]
mov ecx, 0x41
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
lea edi, [eax + 0x208]
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x30c]
lea esi, [eax + 0x104]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp], edx
mov dword [esp + 0x10], ecx
lea ecx, [eax + 0x30c]
add eax, 0x208
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ws2_32.dll_select]
sub esp, 0x14
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x6f8e73d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
movzx edx, byte [eax]
mov ebx, eax
mov eax, edx
and eax, 0xffffffdf
sub eax, 0x41
cmp al, 0x19
ja 0x6f8e7490
movzx eax, byte [ebx + 1]
test al, al
je 0x6f8e74e0
mov ecx, 1
jmp 0x6f8e742a
mov edx, eax
and edx, 0xffffffdf
sub edx, 0x41
cmp dl, 0x19
jbe 0x6f8e741d
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x6f8e741d
cmp al, 0x2d
jne 0x6f8e74f0
inc ecx
movzx eax, byte [ebx + ecx]
test al, al
je 0x6f8e74e0
cmp al, 0x3b
jne 0x6f8e7400
lea ebx, [ebx + ecx + 1]
movzx edx, byte [ebx]
mov eax, edx
and eax, 0xffffffdf
sub eax, 0x41
cmp al, 0x19
jbe 0x6f8e7451
lea eax, [edx - 0x30]
cmp al, 9
jbe 0x6f8e7451
cmp dl, 0x2d
jne 0x6f8e74f0
movzx eax, byte [ebx + 1]
test al, al
je 0x6f8e74e0
mov ecx, 1
jmp 0x6f8e748a
mov edx, eax
and edx, 0xffffffdf
sub edx, 0x41
cmp dl, 0x19
jbe 0x6f8e7481
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x6f8e7481
cmp al, 0x2d
jne 0x6f8e74f0
inc ecx
movzx eax, byte [ebx + ecx]
test al, al
je 0x6f8e74e0
cmp al, 0x3b
jne 0x6f8e7468
jmp 0x6f8e742e
sub edx, 0x30
xor eax, eax
cmp dl, 9
ja 0x6f8e74e5
movzx eax, byte [ebx + 1]
test al, al
je 0x6f8e74e0
xor esi, esi
mov edx, 1
jmp 0x6f8e74c7
cmp al, 0x2e
jne 0x6f8e74f0
cmp esi, 1
je 0x6f8e74f0
mov esi, 1
inc edx
movzx eax, byte [ebx + edx]
test al, al
je 0x6f8e7510
cmp al, 0x3b
je 0x6f8e7500
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x6f8e74b0
xor esi, esi
jmp 0x6f8e74be
mov eax, 1
pop ebx
pop esi
pop ebp
ret
pop ebx
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
lea ebx, [ebx + edx + 1]
test esi, esi
je 0x6f8e7432
jmp 0x6f8e74e5
mov eax, esi
xor eax, 1
jmp 0x6f8e74e5
Function at 0x6f8f16e0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov esi, dword [ebp + 8]
test esi, esi
je 0x6f8f17b0
lea edx, [ebp - 0x78]
xor eax, eax
lea ebx, [ebp - 0x7c]
mov ecx, 7
mov edi, edx
mov dword [ebp - 0x7c], 2
rep stosd dword es:[edi], eax
mov dword [esp], 0x6f9166f0
call sym._ldap_pvt_thread_mutex_lock
lea eax, [ebp - 0x80]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sym._getaddrinfo_16
sub esp, 0x10
mov ebx, eax
mov dword [esp], 0x6f9166f0
call sym._ldap_pvt_thread_mutex_unlock
test ebx, ebx
jne 0x6f8f1790
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
mov dword [esp + 4], 0
test eax, eax
je 0x6f8f17df
mov dword [esp], eax
call sym._ber_strdup_x
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x8c], eax
mov dword [esp], edx
call sym._freeaddrinfo_4
mov eax, dword [ebp - 0x8c]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
mov dword [esp + 4], 0
call sym._ber_strdup_x
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x59]
mov dword [esp + 4], 0x40
mov esi, 0x6f91d9af
mov dword [esp], ebx
call dword [sym.imp.ws2_32.dll_gethostname]
sub esp, 8
test eax, eax
jne 0x6f8f16f7
mov byte [ebp - 0x19], 0
mov esi, ebx
jmp 0x6f8f16f7
mov dword [esp], esi
call sym._ber_strdup_x
jmp 0x6f8f1769

Function at 0x6f8f17f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [esp], 0x6f9166f0
call sym._ldap_pvt_thread_mutex_lock
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._getnameinfo_28
sub esp, 0x1c
mov ebx, eax
mov dword [esp], 0x6f9166f0
call sym._ldap_pvt_thread_mutex_unlock
test ebx, ebx
je 0x6f8f187c
mov ecx, 0x2afa
mov edx, str.Temporary_failure_in_name_resolution
xor eax, eax
jmp 0x6f8f1873
inc eax
mov edx, dword [eax*8 + str.o]
test edx, edx
je 0x6f8f1888
mov ecx, dword [eax*8 + 0x6f91fb00]
cmp ebx, ecx
jne 0x6f8f1860
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov edx, str.Unknown_error
jmp 0x6f8f1877
Function at 0x6f8f3060
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], 0x400000
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.ucrtbase.dll__beginthreadex]
test eax, eax
je 0x6f8f30c8
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [0x6f916830]
mov dword [eax*8 + 0x6f916960], ecx
mov dword [eax*8 + 0x6f916964], edx
inc eax
mov dword [0x6f916830], eax
xor eax, eax
leave
ret
leave
mov eax, 0xffffffff
ret

Function at 0x6f8f3190
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6f8f31b0
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
leave
ret
leave
mov eax, 0xffffffff
ret

Function at 0x6f8ff0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x4e815d
mov ebx, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._ldap_set_option
test eax, eax
je 0x6f8ff110
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], 0x4e815e
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp sym._ldap_set_option