joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10123e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101a4cc6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.TlsRawRecord.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
call fcn.100182e0
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call fcn.100182e0
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 1
call fcn.100182e0
mov byte [esi + 0x68], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x10123eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a4d06
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.TlsRawRecord.0
lea ecx, [esi + 0x4c]
mov dword [esp + 0x14], 1
call fcn.10018a90
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.10018a90
lea ecx, [esi + 0x14]
mov dword [esp + 0x14], 0xffffffff
call fcn.10018a90
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x10123fc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101a4d89
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.10049000
xor ebx, ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.TlsServerHello.0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.100182e0
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 1
call fcn.100182e0
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 2
mov dword [esi + 0x6c], ebx
call fcn.100182e0
lea ecx, [esi + 0x94]
mov byte [esp + 0x18], 3
mov byte [esi + 0x8e], bl
mov byte [esi + 0x8f], bl
mov byte [esi + 0x90], bl
mov byte [esi + 0x91], bl
call fcn.100182e0
mov byte [esi + 0xb0], bl
mov byte [esi + 0xb1], bl
mov dword [esi + 0xb4], ebx
mov byte [esi + 0xb8], bl
mov byte [esi + 0x8c], bl
mov byte [esi + 0x8d], bl
mov dword [esi + 0x28], 2
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x101241a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101a4e46
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.10049000
xor edi, edi
mov dword [esi + 0x28], edi
lea ecx, [esi + 0x144]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.TlsSessionTicket.0
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x140], edi
call fcn.100182e0
push 0xff
lea eax, [esi + 0x40]
push edi
push eax
mov byte [esp + 0x24], 1
mov dword [esi + 0x160], edi
mov dword [esi + 0x28], 4
call fcn.10016e50
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x101243b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101a4ed7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.10049000
xor ebx, ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.TlsServerKeyExchange.0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.100182e0
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 1
call fcn.100182e0
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 2
call fcn.100182e0
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 3
call fcn.100182e0
lea ecx, [esi + 0xa4]
mov byte [esp + 0x18], 4
call fcn.100182e0
mov byte [esi + 0xc0], bl
mov dword [esi + 0xc4], ebx
mov dword [esi + 0x1c8], ebx
mov dword [esi + 0x28], 0xc
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x10128810
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10199258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 0x344]
test edi, edi
je 0x10128848
cmp byte [esp + 0x38], 0
je 0x10128855
lea ecx, [esi + 0x324]
call fcn.100f6330
mov edi, eax
lea ecx, [esp + 0xc]
call fcn.100182e0
push 0x40
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
mov byte [esp + 0x28], 1
call fcn.1001cc40
test al, al
jne 0x101288a1
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.10018a90
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x14
cmp dword [esi + 0x64], 2
jne 0x101288b0
lea eax, [esp + 0xc]
push eax
push 2
jmp 0x101288b7
lea ecx, [esp + 0xc]
push ecx
push 7
push edi
lea ecx, [esi + 0x324]
call fcn.1008bea0
push eax
call fcn.1007de20
add esp, 0x10
cmp byte [esp + 0x3c], 0
mov edi, str.client_finished
jne 0x101288dd
mov edi, str.server_finished
mov edx, dword [esp + 0x40]
mov eax, dword [esi + 0x7c]
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.100f6330
push eax
lea ecx, [esp + 0x1c]
call fcn.1008bea0
push eax
push edi
push 0x30
lea ecx, [esi + 0x2ec]
call fcn.1008bea0
push eax
mov ecx, esi
call fcn.1011df10
mov edx, dword [esi + 0x7c]
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0xc]
mov dword [eax], edx
mov dword [esp + 0x30], 0xffffffff
call fcn.10018a90
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x14
Function at 0x10139eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a6848
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x30]
push str.sshTlsCloseChannel
push edi
lea ecx, [esp + 0x14]
call fcn.10061630
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push edi
push eax
push ecx
lea ecx, [esi + 0xc]
mov dword [esp + 0x2c], 0
call fcn.10149d80
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x20], 0xffffffff
call fcn.100616a0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0xc

Function at 0x10139f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a5598
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x30]
push str.sshTlsCloseTunnel
push edi
lea ecx, [esp + 0x18]
call fcn.10061630
mov eax, dword [esp + 0x2c]
push edi
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x2c], 0
call fcn.10149e40
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x24], 0xffffffff
call fcn.100616a0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x1013a5f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a9778
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x44]
movzx eax, byte [edi + 0x127]
push eax
push str.scReceiveBytes
push edi
lea ecx, [esp + 0x20]
call fcn.10061660
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
mov byte [ebp], 0
mov dword [esp + 0x28], 0
mov byte [ebx], 0
call fcn.100f6330
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push edi
push ecx
mov ecx, dword [esp + 0x38]
push ebx
push edx
push eax
push ecx
lea edx, [esi + 0xc]
push edx
lea ecx, [esi + 0x8c]
call fcn.10139070
mov bl, al
movzx eax, byte [esi + 0xb4]
lea ecx, [esp + 0x14]
mov byte [ebp], al
mov dword [esp + 0x28], 0xffffffff
call fcn.100616a0
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x1c
Function at 0x1013b5a0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
xor edx, edx
mov ecx, dword [0x1026bcc0]
mov dh, byte [ecx + 3]
push edi
movzx edi, byte [ecx + 1]
mov dl, byte [ecx + 2]
shl edx, 8
or edx, edi
movzx edi, byte [ecx]
shl edx, 8
or edx, edi
mov dword [esi], edx
xor edx, edx
mov dh, byte [ecx + 7]
movzx edi, byte [ecx + 5]
mov dl, byte [ecx + 6]
shl edx, 8
or edx, edi
movzx edi, byte [ecx + 4]
shl edx, 8
or edx, edi
mov dword [esi + 4], edx
xor edx, edx
mov dh, byte [ecx + 0xb]
movzx edi, byte [ecx + 9]
mov dl, byte [ecx + 0xa]
shl edx, 8
or edx, edi
movzx edi, byte [ecx + 8]
shl edx, 8
or edx, edi
mov dword [esi + 8], edx
xor edx, edx
mov dh, byte [ecx + 0xf]
movzx edi, byte [ecx + 0xd]
mov dl, byte [ecx + 0xe]
movzx ecx, byte [ecx + 0xc]
shl edx, 8
or edx, edi
shl edx, 8
or edx, ecx
mov dword [esi + 0xc], edx
xor edx, edx
mov dh, byte [eax + 3]
movzx ecx, byte [eax + 1]
mov dl, byte [eax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax]
shl edx, 8
or edx, ecx
mov dword [esi + 0x10], edx
xor edx, edx
mov dh, byte [eax + 7]
movzx ecx, byte [eax + 5]
mov dl, byte [eax + 6]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 4]
shl edx, 8
or edx, ecx
mov dword [esi + 0x14], edx
movzx ecx, byte [eax + 9]
xor edx, edx
mov dh, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 8]
shl edx, 8
or edx, ecx
mov dword [esi + 0x18], edx
movzx ecx, byte [eax + 0xd]
xor edx, edx
mov dh, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0xc]
shl edx, 8
or edx, ecx
mov dword [esi + 0x1c], edx
xor edx, edx
mov dh, byte [eax + 0x13]
movzx ecx, byte [eax + 0x11]
pop edi
mov dl, byte [eax + 0x12]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0x10]
shl edx, 8
or edx, ecx
mov dword [esi + 0x20], edx
movzx ecx, byte [eax + 0x15]
xor edx, edx
mov dh, byte [eax + 0x17]
mov dl, byte [eax + 0x16]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0x14]
shl edx, 8
or edx, ecx
mov dword [esi + 0x24], edx
movzx ecx, byte [eax + 0x19]
xor edx, edx
mov dh, byte [eax + 0x1b]
mov dl, byte [eax + 0x1a]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0x18]
shl edx, 8
or edx, ecx
mov dword [esi + 0x28], edx
movzx ecx, byte [eax + 0x1d]
xor edx, edx
mov dh, byte [eax + 0x1f]
mov dl, byte [eax + 0x1e]
movzx eax, byte [eax + 0x1c]
mov dword [esi + 0x40], 0x40
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
mov dword [esi + 0x2c], edx
ret
Function at 0x1013db10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10199258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.100182e0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0
call fcn.1001c380
cmp byte [esi + 0x8a1], 0
mov edi, dword [esp + 0x44]
push 0
push edi
je 0x1013dbe9
mov edx, dword [esp + 0x48]
push edx
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esi + 0x8bc]
call fcn.100cc700
test al, al
jne 0x1013dbbb
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.Failed_to_begin_zlib_decompression.
mov ecx, edi
call eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.10018a90
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x10
mov byte [esi + 0x8a1], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.10018a90
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x10
mov ecx, dword [esp + 0x48]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esi + 0x8bc]
call fcn.100cc560
test al, al
jne 0x1013dbc2
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
push str.Failed_to_continue_zlib_decompression.
mov ecx, edi
call edx
jmp 0x1013db94

Function at 0x10141470
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0
je 0x101414c0
cmp dword [esi + 4], 0
jne 0x10141489
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
cmp dword [esi + 0x10], 0x3e8
jae 0x10141499
mov dword [esi + 0x10], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 4]
cmp eax, ecx
jbe 0x101414c0
sub eax, ecx
cmp eax, dword [esi + 0x10]
jbe 0x101414c0
mov esi, dword [esp + 0xc]
mov ecx, esi
call fcn.10095ac0
mov al, 1
mov byte [esi + 0x14], al
pop esi
ret 0xc
xor al, al
pop esi
ret 0xc
Function at 0x101421b0
Capabilities:
Access peb ldr_data

Disassembly:
push esi
mov esi, ecx
mov ecx, 0xc64d29ea
cmp dword [esi + 0xa0], ecx
jne 0x100a233f
mov eax, dword [esi + 0xa70]
test eax, eax
je 0x100a2370
cmp dword [eax + 0x24], ecx
je 0x100a2384
push 0
call fcn.100c11a0
add esp, 4
cmp dword [esi + 0xa7c], 2
jne 0x100a2390
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edx
push eax
push ecx
lea ecx, [esi + 0x164]
call fcn.10139c50
pop esi
ret 0xc
cmp dword [esi + 0xa7c], 2
jne 0x100a2390
lea ecx, [esi + 0x164]
call fcn.10139e90
test eax, eax
je 0x100a2349
pop esi
mov ecx, eax
jmp 0x101421b0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edx
push eax
push ecx
lea ecx, [esi + 0x720]
call fcn.101122d0
pop esi
ret 0xc
push 0xffffffffffffffff
push 0x10194cf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
lea ecx, [esi + 0x820]
mov dword [esp + 0x2c], 0
call fcn.1014a0b0
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 0xc
Function at 0x101479f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x101a9778
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x30]
movzx eax, byte [esi + 0x24]
mov edi, dword [esp + 0x3c]
push eax
push str.readExpectedMessage
push edi
lea ecx, [esp + 0x20]
call fcn.10061660
xor ebp, ebp
cmp byte [esi + 0x24], 0
mov dword [esp + 0x28], ebp
je 0x10147a54
cmp dword [esi + 0x28], ebp
jne 0x10147a54
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.No_m_pHandler.
mov ecx, edi
call eax
cmp dword [esi + 4], ebp
mov dword [esi + 0x3c], ebp
jne 0x10147a64
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
mov ebp, dword [esp + 0x38]
mov eax, dword [esi + 0x10]
cmp eax, 5
jne 0x10147a97
cmp dword [0x10270278], 0xa
jge 0x10147a8e
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.sshRp.m_totalTimeoutMs_wf_is_too_small__2_
mov ecx, edi
call eax
add dword [0x10270278], 1
mov dword [esi + 0x10], 0x7530
jmp 0x10147a9b
test eax, eax
je 0x10147acc
cmp dword [esi + 4], 0
jne 0x10147aa9
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
cmp dword [esi + 0x10], 0x3e8
jae 0x10147ab9
mov dword [esi + 0x10], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 4]
cmp eax, ecx
jbe 0x10147acc
sub eax, ecx
cmp eax, dword [esi + 0x10]
ja 0x10147b1e
push edi
push ebp
push esi
mov ecx, ebx
call fcn.10147490
test al, al
je 0x10147b50
mov ecx, ebp
call fcn.10095a60
test al, al
jne 0x10147b50
cmp byte [esp + 0x34], al
je 0x10147af5
cmp dword [esi + 0x3c], 0x5d
je 0x10147a68
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.100616a0
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov ecx, ebp
call fcn.10095ac0
mov byte [ebp + 0x14], 1
cmp byte [edi + 0x125], 0
je 0x10147b50
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.Too_much_time_elapsed_waiting_for_response.
mov ecx, edi
call eax
mov ecx, dword [esi + 0x10]
push ecx
push str.totalTimeoutMs
mov ecx, edi
call fcn.100612a0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.100616a0
xor al, al
jmp 0x10147b08
Function at 0x10147fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x101a7530
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0xa8]
push str.readUntilRcvWindowAdjust
push esi
lea ecx, [esp + 0x24]
call fcn.10061630
xor ebx, ebx
mov dword [esp + 0x94], ebx
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x9c]
cmp dword [eax + 0xb0], ebx
jne 0x1014816d
mov ebp, dword [esp + 0xa0]
mov edi, dword [esp + 0xa4]
jmp 0x10148050
lea ecx, [esp + 0x68]
mov dword [esp + 0x28], vtable.SshReadParams.0
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x30], 1
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], 0xea60
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x50], ebx
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], bl
mov byte [esp + 0x58], bl
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x60], bl
mov dword [esp + 0x64], ebx
call fcn.100182e0
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x38], ecx
mov ecx, edi
mov byte [esp + 0x94], 1
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x34], ebx
call fcn.10095ac0
mov ecx, dword [esp + 0x14]
push esi
push edi
push ebp
call fcn.10147490
mov ecx, dword [edi + 4]
cmp ecx, ebx
je 0x10148103
push esi
call fcn.1007aa60
test al, al
jne 0x1014819f
mov ecx, edi
call fcn.10095a30
test al, al
jne 0x101481e5
cmp byte [esp + 0x57], bl
jne 0x101481f4
cmp byte [esp + 0x55], bl
jne 0x101481fb
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [esp + 0x18]
cmp eax, 0xea60
ja 0x10148202
lea ecx, [esp + 0x68]
mov byte [esp + 0x94], bl
mov dword [esp + 0x28], vtable.SshReadParams.0
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], ebx
call fcn.10018a90
mov edx, dword [esp + 0x9c]
cmp dword [edx + 0xb0], ebx
je 0x10148050
lea ecx, [esp + 0x1c]
mov dword [esp + 0x94], 0xffffffff
call fcn.100616a0
mov al, 1
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret 0x10
push str.aborted_by_user_application.
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
mov ecx, esi
call edx
lea ecx, [esp + 0x68]
mov byte [esp + 0x94], bl
mov dword [esp + 0x28], vtable.SshReadParams.0
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], ebx
call fcn.10018a90
lea ecx, [esp + 0x1c]
mov dword [esp + 0x94], 0xffffffff
call fcn.100616a0
xor al, al
jmp 0x10148183
push esi
push str.sshWindowAdjust1
mov ecx, edi
call fcn.10095b30
jmp 0x101481ad
push str.Received_DISCONNECT
jmp 0x101481a4
push str.Received_CHANNEL_CLOSE
jmp 0x101481a4
mov ecx, dword [esp + 0x14]
push esi
push edi
call fcn.101417c0
push str.No_WINDOW_ADJUST_seems_to_be_coming...
jmp 0x101481a4
Function at 0x10151030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10199258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
mov ecx, esi
call fcn.10010600
lea ecx, [esp + 0xc]
call fcn.100182e0
mov edi, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
push 5
mov ecx, edi
mov dword [esp + 0x38], 0
call fcn.100f6330
push eax
mov ecx, edi
call fcn.1008bea0
push eax
call fcn.1007de20
add esp, 0x10
push esi
push str.base64
lea ecx, [esp + 0x14]
call fcn.1001d4e0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.10018a90
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 8
Function at 0x10157830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195df0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.1005ff60
push str.CloseSession
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0
call fcn.100615f0
lea eax, [esi + 0x2c]
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.10156740
lea ecx, [esp + 0xc]
mov bl, al
mov byte [esp + 0x2c], 0
call fcn.100616a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x1015b360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a90e6
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x1026d48c]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov edi, dword [esp + 0xb4]
mov esi, dword [esp + 0xb8]
lea ecx, [esp + 0xc]
call fcn.100182e0
push 0
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0
call fcn.10018f60
push 0
lea ecx, [esp + 0x10]
call fcn.10018f60
push 0
lea ecx, [esp + 0x10]
call fcn.10018f60
push 7
lea ecx, [esp + 0x10]
call fcn.10018f60
push 7
push 0x101fe138
lea ecx, [esp + 0x14]
call fcn.10019380
lea eax, [esp + 0xc]
push eax
lea ecx, [edi + 0x84]
call fcn.10164de0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [edi + 0x98]
call fcn.10164de0
add esp, 8
lea ecx, [esp + 0x28]
call fcn.100690a0
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xb4], 1
call fcn.100693b0
mov ecx, esi
call fcn.10010600
push str.ssh_rsa
mov ecx, esi
call fcn.10010b90
mov ecx, edi
call fcn.1015f7d0
push eax
mov ecx, esi
call fcn.10014210
push 0x20
mov ecx, esi
call fcn.100139f0
push esi
push 1
lea ecx, [esp + 0x8c]
push 0x10
push ecx
call fcn.10019e60
add esp, 0x10
mov ecx, esi
call fcn.10012750
lea ecx, [esp + 0x28]
mov byte [esp + 0xac], 0
call fcn.100690d0
lea ecx, [esp + 0xc]
mov dword [esp + 0xac], 0xffffffff
call fcn.10018a90
mov al, 1
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1018f87e
add esp, 0xa4
ret