joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45673399
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0x18], 3
mov dword [ebp - 0xc], 0x456781d4
cmp eax, esi
je 0x456733b9
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push 2
push esi
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
mov edx, eax
mov dword [ebp - 0x10], edx
cmp edx, esi
jne 0x456733d6
xor eax, eax
jmp 0x45673442
push ebx
mov ecx, edx
mov dword [ebp - 0x14], esi
push edi
test ecx, ecx
je 0x4567343e
movzx esi, word [ecx + 0xe]
movzx eax, word [ecx + 0xc]
and dword [ebp - 8], 0
lea eax, [ecx + eax*8 + 0x10]
test esi, esi
je 0x4567343e
mov ecx, esi
shl ecx, 3
sub ecx, edx
add ecx, eax
cmp ecx, dword [ebp - 4]
jae 0x4567343e
mov ecx, dword [ebp - 0xc]
movzx ecx, word [ecx]
add dword [ebp - 0xc], 2
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 8]
add ecx, esi
shr ecx, 1
lea edx, [eax + ecx*8]
test dword [edx], 0x80000000
jne 0x4567343e
movzx ebx, word [edx]
movzx edi, word [ebp - 0x1c]
sub edi, ebx
je 0x45673447
test edi, edi
jge 0x45673435
mov esi, ecx
jmp 0x45673439
inc ecx
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], esi
jb 0x45673410
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 8
cmp esi, dword [ebp - 8]
jbe 0x4567343e
mov ecx, dword [edx + 4]
test ecx, ecx
jns 0x45673472
and ecx, 0x7fffffff
cmp dword [ebp - 4], ecx
jbe 0x4567343e
mov eax, dword [ebp - 4]
sub eax, ecx
cmp eax, 0x10
jb 0x4567343e
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add ecx, edx
jmp 0x4567348c
cmp dword [ebp - 4], ecx
jbe 0x4567343e
mov eax, dword [ebp - 4]
sub eax, ecx
cmp eax, 0x10
jb 0x4567343e
mov edx, dword [ebp - 0x10]
lea eax, [ecx + edx]
mov dword [ebp - 0x14], eax
xor ecx, ecx
dec dword [ebp - 0x18]
jne 0x456733dd
test eax, eax
je 0x4567343e
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
push dword [eax]
push dword [ebp + 8]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
push eax
call dword [sym.imp.ntdll.dll_RtlAddressInSectionTable]
jmp 0x45673440

Function at 0x4567351d
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x8003
push dword [0x45679bc8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x456735a3
push edi
push 0xc
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_MD5Update]
push 0x1b
pop ecx
lea eax, [ebp - 0x70]
lea edi, [ebp - 0x70]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_MD5Final]
push ebx
lea eax, [ebp - 0x18]
push eax
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
pop edi
test eax, eax
je 0x4567359a
mov eax, dword [ebp + 8]
push ebx
push ebx
push dword [0x45678bc4]
add eax, 0xc
push 0x80
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
je 0x4567359a
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x456735ab
Capabilities:
Access pe header
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x94
push 0x45676f08
call fcn.456742dc
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov edi, eax
cmp edi, ebx
je 0x456736b6
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.45673399
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x456736b6
mov esi, 0x80
cmp dword [ebp - 0x1c], esi
jne 0x456736b6
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0x8003
push dword [0x45679bc8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x456736b6
mov ebx, dword [edi + 0x58]
push esi
push dword [ebp - 0x20]
lea eax, [ebp - 0xa4]
push eax
call sub.ntdll.dll_memcpy
push esi
push 0
push dword [ebp - 0x20]
call sub.ntdll.dll_memset
add esp, 0x18
and dword [edi + 0x58], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_MD5Update]
mov dword [edi + 0x58], ebx
push esi
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0x20]
call sub.ntdll.dll_memcpy
add esp, 0xc
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_MD5Final]
xor ebx, ebx
push ebx
add edi, 0x58
push edi
push 2
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x456736a1
push ebx
push ebx
push dword [0x45678bc4]
push esi
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
je 0x456736a1
inc ebx
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x456736b6
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
call fcn.45674317
ret 0xc

Function at 0x45673b3a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x45678270]
push esi
push edi
jmp 0x45673b5b
mov ecx, dword [0x45678274]
dec eax
mov ecx, dword [ecx + eax*8]
cmp ecx, dword [ebp + 8]
je 0x45673beb
test eax, eax
jne 0x45673b48
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.45672c24
test esi, esi
jne 0x45673be5
xor ecx, ecx
push ebx
mov eax, 0x45678004
inc ecx
lock xadd dword [eax], ecx
inc ecx
push 0x10
pop ebx
cmp ecx, ebx
jge 0x45673be4
mov esi, ebx
call fcn.45672020
mov esi, eax
test esi, esi
je 0x45673be4
mov eax, dword [ebp + 0xc]
lea edi, [esi + 0xc]
and dword [edi], 0
push ebx
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push edi
push 0
mov dword [edi + 4], 0x6e65774c
mov dword [edi + 0xc], eax
call dword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov dword [edi], eax
push 4
mov dword [esi + 8], ebx
pop ecx
mov eax, 0x66747032
xor dword [edi], eax
rol eax, 1
add edi, 4
dec ecx
jne 0x45673bce
push esi
call fcn.45672b95
push esi
call fcn.4567200a
pop ebx
pop edi
pop esi
leave
ret 8
xor esi, esi
inc esi
jmp 0x45673b61
Function at 0x45673bf3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push 0x10
pop esi
call fcn.45672020
mov ebx, eax
test ebx, ebx
je 0x45673c52
mov eax, dword [esp + 0x10]
push edi
lea edi, [ebx + 0xc]
and dword [edi], 0
push esi
mov dword [edi + 8], eax
mov eax, dword [0x45679bf8]
push edi
push 0
mov dword [edi + 4], 0x6765744c
mov dword [edi + 0xc], eax
call dword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov dword [edi], eax
push 4
mov dword [ebx + 8], esi
pop ecx
mov eax, 0x66747032
xor dword [edi], eax
rol eax, 1
add edi, 4
dec ecx
jne 0x45673c37
push ebx
push dword [esp + 0x14]
call fcn.45673b0a
push ebx
call fcn.4567200a
pop edi
pop esi
pop ebx
ret 8

Function at 0x45673fac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov byte [ebp - 1], bl
push edi
shr ebx, 8
xor edi, edi
inc byte [ebp - 1]
movzx eax, byte [ebp - 1]
add eax, esi
add bl, byte [eax]
mov dl, byte [eax]
movzx ecx, bl
add ecx, esi
mov byte [ebp - 2], dl
mov dl, byte [ecx]
mov byte [eax], dl
mov dl, byte [ebp - 2]
mov byte [ecx], dl
movzx eax, byte [eax]
movzx ecx, byte [ecx]
mov edx, dword [ebp + 8]
add eax, ecx
and eax, 0xff
mov al, byte [eax + esi]
add edx, edi
xor byte [edx], al
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x45673fbc
movzx ecx, byte [ebp - 1]
movzx eax, bl
shl eax, 8
pop edi
or eax, ecx
pop ebx
leave
ret 8
Function at 0x6aebca80
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], edi
mov eax, dword [edi + 4]
mov edx, dword [ebx + 8]
lea esi, [edx + eax]
cmp esi, eax
jb 0x6aee57d3
mov ecx, dword [ebx + 0xc]
lea eax, [ecx + esi]
cmp eax, esi
jb 0x6aee57d3
lea esi, [eax + 0x20]
mov dword [ebp - 8], esi
cmp esi, eax
jb 0x6aee57d3
mov eax, dword [edi + 0x14]
lea esi, [eax + 1]
mov dword [ebp - 0x10], esi
cmp esi, eax
jb 0x6aee57d3
add eax, 0x3d
mov dword [ebp - 0x18], eax
cmp eax, 0x3d
jb 0x6aee57d3
lea eax, [ecx + edx]
cmp eax, edx
jb 0x6aee57d3
lea esi, [eax + 0x28]
cmp esi, eax
jb 0x6aee57d3
mov edi, dword [0x6af0a4ac]
push esi
cmp edi, fcn.6aebcc00
jne 0x6aee5751
call fcn.6aebcc00
mov edi, eax
test edi, edi
je 0x6aee5760
push esi
push 0
push edi
call fcn.6aee0e40
lea ecx, [edi + 0x28]
mov dword [edi + 0x18], ecx
lea esi, [edi + 0x18]
mov eax, dword [ebx + 8]
add eax, ecx
mov dword [edi + 0x1c], eax
push dword [ebx + 8]
push dword [ebx]
push ecx
call fcn.6aee3315
push dword [ebx + 0xc]
push dword [ebx + 4]
push dword [edi + 0x1c]
call fcn.6aee3315
mov eax, dword [ebx + 8]
add esp, 0x24
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0x24], eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 0xc]
cmp eax, ecx
je 0x6aebcb6f
inc dword [eax - 4]
mov eax, dword [eax]
cmp eax, ecx
jne 0x6aebcb66
mov edx, dword [ecx]
lea eax, [edi + 0x10]
cmp dword [edx + 4], ecx
jne 0x6aebcbf1
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [edx + 4], eax
mov dword [ecx], eax
xor ecx, ecx
mov eax, dword [ebp - 8]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x14], eax
xor al, al
mov dword [edi + 8], esi
mov dword [edi + 0xc], 0x3e
mov edx, dword [esi + 8]
test edx, edx
je 0x6aebcbb3
mov esi, dword [esi]
rol al, 1
xor al, byte [esi + ecx]
inc ecx
cmp ecx, edx
jb 0x6aebcba6
lea esi, [edi + 0x18]
movzx eax, al
add eax, 0x7d
mov ecx, dword [ebx + eax*8 + 4]
lea eax, [ebx + eax*8]
cmp dword [ecx], eax
jne 0x6aebcbf1
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [eax + 4], edi
test byte [0x6af0b6d5], 0x80
jne 0x6aee576a
test byte [0x6af0b6d1], 0x80
jne 0x6aee57b8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 3
int 0x29
int3
mov ecx, edi
call dword [0x6af0c358]
call edi
jmp 0x6aebcb0d
mov eax, 0xc000009a
jmp 0x6aebcbea
mov eax, dword [edi + 0x24]
cmp eax, 0x1f40
jbe 0x6aee5779
mov eax, 0x1f40
mov ecx, dword [edi + 0x20]
cmp ecx, 0x1f40
jbe 0x6aee5789
mov ecx, 0x1f40
push dword [edi + 0x1c]
movzx eax, ax
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], ax
push dword [ebp - 0x14]
movzx eax, cx
push dword [esi]
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], ax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push ebx
call 0x6af08c5f
jmp 0x6aebcbdb
push dword [ebx + 0x14]
mov edx, 0x6aeb2fe8
mov ecx, 0xf
push dword [ebx + 4]
push ebx
call fcn.6af08420
jmp 0x6aebcbe8
mov eax, 0xc0000095
jmp 0x6aebcbea
Function at 0x6aebcd20
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
lea eax, [ecx + 0x3e8]
mov edx, 0x100
mov dword [eax + 4], eax
mov dword [eax], eax
add eax, 8
sub edx, 1
jne 0x6aebcd36
push ebx
push esi
xor eax, eax
mov ebx, 0x6aeb1030
xor esi, esi
push edi
lea edi, [ecx + 0x18]
mov dword [ebp - 4], esi
inc eax
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
xor ecx, ecx
mov edx, dword [ebx + 8]
mov dword [ebp - 0xc], eax
xor al, al
test edx, edx
je 0x6aebcd7d
mov esi, dword [ebx]
lea esp, [esp]
rol al, 1
xor al, byte [esi + ecx]
inc ecx
cmp ecx, edx
jb 0x6aebcd70
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add ecx, 0x3e8
movzx eax, al
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 4]
cmp dword [ecx], eax
jne 0x6aebcdbd
mov dword [edi], eax
add esi, 0x10
mov dword [edi + 4], ecx
add ebx, 0x10
mov dword [ecx], edi
mov dword [eax + 4], edi
add edi, 0x10
mov dword [ebp - 4], esi
cmp esi, 0x3d0
jae 0x6aebcdb6
mov eax, dword [ebp - 0xc]
jmp 0x6aebcd55
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 3
int 0x29
Function at 0x6aec7e50
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov eax, ecx
mov ebx, eax
mov dword [ebp - 4], eax
shl ebx, 6
add ebx, dword [0x6af0b6dc]
push edi
push ebx
mov dword [ebp - 0x18], ebx
call dword [0x6af0c198]
lea eax, [ebx + 0x10]
push eax
mov dword [ebp - 0x14], eax
call dword [0x6af0c08c]
test ax, ax
jne 0x6aec7f8b
cmp dword [ebx + 4], 0
jne 0x6aec7eb1
mov ecx, 0x2000
call fcn.6aee2e74
mov dword [ebx + 4], eax
test eax, eax
je 0x6aec7edf
push 0x2000
push 0
push eax
call fcn.6aee0e40
add esp, 0xc
cmp dword [ebx + 8], 0x800
jb 0x6aec7ecc
push ebx
call dword [0x6af0c1a0]
pop edi
mov eax, 0x486
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x1000
call fcn.6aee2e74
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x6aec7ef1
push ebx
call dword [0x6af0c1a0]
pop edi
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea esi, [edi + 0x1000]
mov dword [ebp - 0x10], esi
cmp edi, esi
jae 0x6aec7f4f
mov eax, 0xfffffff4
lea esi, [edi + 0xc]
sub eax, edi
mov edi, 0x100
mov dword [ebp - 8], eax
lea eax, [esi - 8]
push eax
call dword [0x6af0c1a4]
mov eax, dword [ebp - 4]
mov byte [esi], al
mov eax, dword [ebx + 8]
shl eax, 8
xor eax, dword [esi]
and eax, 0xffff00
mov dword [esi - 4], 0
xor dword [esi], eax
mov eax, dword [ebp - 8]
add eax, esi
sar eax, 4
mov byte [esi + 3], al
add esi, 0x10
sub edi, 1
jne 0x6aec7f11
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
xor ecx, ecx
lea eax, [ebp - 0x10]
lock or dword [eax], ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [eax + ecx*4], edi
xor ecx, ecx
lea eax, [ebp - 0x10]
lock or dword [eax], ecx
inc dword [ebx + 8]
lea eax, [ebp - 0x10]
lock or dword [eax], ecx
cmp edi, esi
jae 0x6aec7f8a
mov ebx, dword [ebp - 0x14]
push edi
push ebx
call dword [0x6af0c084]
add edi, 0x10
cmp edi, esi
jb 0x6aec7f78
mov ebx, dword [ebp - 0x18]
pop esi
push ebx
call dword [0x6af0c1a0]
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6aecd860
Capabilities:
Encrypt data via sspi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x6af09160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x48], edx
xor edx, edx
mov dword [ebp - 0x44], edx
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx + 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 0x50]
mov dword [ebp - 0x50], eax
cmp dword [esi + 0x1c], edx
jbe 0x6aecd97d
push edi
xor edi, edi
lea esp, [esp]
mov eax, dword [esi + 0x18]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edi + eax + 8]
mov eax, dword [edi + eax + 4]
sub ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
add eax, edx
mov dword [ebp - 0x20], eax
add eax, ecx
test byte [0x6af0b68e], 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 6
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x38], eax
jne 0x6aee910a
push 0
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x48]
lea eax, [ebx + 0x20]
push eax
call dword [0x6af0e078]
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x6aee91a2
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x1c]
mov eax, dword [esi + 0x18]
add ecx, dword [ebp - 0x34]
mov dword [edi + eax + 8], ecx
test byte [0x6af0b68e], 4
jne 0x6aee913b
mov edx, dword [ebp - 0x44]
add edi, 0xc
inc edx
mov dword [ebp - 0x44], edx
cmp edx, dword [esi + 0x1c]
jb 0x6aecd8a0
mov eax, dword [ebp - 0x54]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.6aee0390
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x6aecd96d
mov eax, dword [esi + 0x18]
push 0
push dword [ebp - 0x48]
push 0
push dword [edi + eax + 8]
push dword [edi + eax + 4]
push edx
push eax
push 0
push dword [ebx + 0x20]
mov edx, 0x6aeb4348
push 0
push dword [ebx + 0x24]
push esi
push dword [ebx + 4]
call fcn.6af020e3
jmp 0x6aecd91b
mov eax, dword [esi + 0x18]
mov edx, 0x6aeb41f8
push 0
push dword [ebp - 0x48]
push 0
push dword [edi + eax + 8]
push dword [edi + eax + 4]
push dword [ebp - 0x44]
push eax
push 0
push dword [ebx + 0x20]
push 0
push dword [ebx + 0x24]
push esi
push dword [ebx + 4]
call fcn.6af020e3
test byte [0x6af0b68e], 4
je 0x6aecd956
mov ecx, dword [esi + 0x18]
mov eax, dword [edi + ecx + 4]
push eax
push dword [ebp - 0x48]
push dword [edi + ecx + 8]
push eax
push dword [ebp - 0x44]
push ecx
push 0
push dword [ebx + 0x20]
push 0
push dword [ebx + 0x24]
push esi
push dword [ebx + 4]
call fcn.6af01fe9
jmp 0x6aecd956
test byte [0x6af0b68e], 8
je 0x6aecd96c
mov edx, dword [ebp - 0x44]
mov ecx, dword [esi + 0x18]
mov edi, dword [ebp - 0x54]
push edi
push dword [ebp - 0x48]
lea eax, [edx + edx*2]
push 0
push dword [ecx + eax*4 + 8]
push dword [ecx + eax*4 + 4]
push edx
push ecx
push 0
push dword [ebx + 0x20]
mov edx, 0x6aeb4788
push 0
push dword [ebx + 0x24]
push esi
push dword [ebx + 4]
call fcn.6af020e3
mov eax, edi
jmp 0x6aecd96c
Function at 0x6aed002a
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x6af09160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3c
lea eax, [ebp - 0x40]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x44], esi
call fcn.6aee0e40
and dword [ebp - 0x3c], 0
lea ebx, [esi + 0x28]
add esp, 0xc
mov dword [ebp - 0x40], 0x20002
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 6
mov eax, dword [esi + 4]
push 4
pop edi
cmp dword [eax + 0x38], 0
jne 0x6aed0111
call fcn.6aed0129
test eax, eax
jne 0x6aee98f5
mov eax, dword [esi + 4]
cmp byte [eax + 0x41], 0
jne 0x6aee98f5
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x40]
test byte [0x6af0b6d0], 4
jne 0x6aee9909
test byte [0x6af0b68c], 0x40
mov eax, dword [esi + 4]
mov edi, dword [eax + 0x18]
jne 0x6aee9929
xor ecx, ecx
lea eax, [esi + 0x28]
push ecx
push ecx
push eax
push ecx
lea eax, [esi + 0x40]
push eax
lea eax, [ebp - 0x40]
push eax
push ecx
push 0xc
push ecx
push edi
call dword [0x6af0e0fc]
cmp eax, 0x3e5
jne 0x6aee9944
test byte [0x6af0b68e], 0x40
jne 0x6aee9953
push 0
push dword [esi + 0x3c]
push dword [esi + 0x44]
call dword [0x6af0c1f0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6aee0390
leave
ret
mov dword [ebp - 0x14], edi
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x40], 0x80020002
jmp 0x6aed0080
mov ecx, dword [ebp - 0x40]
or ecx, 0xc0000000
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x40], ecx
jmp 0x6aed00a0
push dword [ebp - 0xc]
mov eax, dword [esi + 4]
push edi
push ecx
movzx eax, byte [eax + 0x41]
push eax
call fcn.6aed0129
push eax
call fcn.6af08ad4
mov ecx, dword [ebp - 0x40]
jmp 0x6aed00ad
push 0
push 0
push ecx
push edi
push esi
mov edx, 0x6aeb4618
mov ecx, 0x6af090e0
call fcn.6af0318d
jmp 0x6aed00c0
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.6af036da
jmp 0x6aed0102
push 3
push ebx
mov edx, 0x6aeb2c88
call fcn.6af009b6
jmp 0x6aed00f4
Function at 0x6aedc668
Capabilities:
Access peb ldr_data

Disassembly:
sub edx, 0
je 0x6aedc672
sub edx, 1
je 0x6aedc678
xor eax, eax
inc eax
ret 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov dword [0x6af0b7d4], eax
jmp 0x6aedc672

Function at 0x6aedc982
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x6af09160]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
mov dword [esp + 0x14], eax
mov ebx, edx
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x10]
push 0x38
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x28]
push esi
push eax
mov dword [esp + 0x1c], ecx
call fcn.6aee0e40
mov al, byte [ebp + 0xc]
add esp, 0xc
or dword [esp + 0x1c], 0xffffffff
or dword [edi + 4], 0xffffffff
or dword [edi], 0xffffffff
mov dword [esp + 0x5c], 0xa400
mov dword [esp + 0x60], 0xae06
test al, al
jne 0x6aeed351
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], 4
mov dword [esp + 0x54], 0x200118
test ecx, 0x2800
je 0x6aedca34
cmp ebx, 1
je 0x6aeed372
lea ecx, [esp + 0x5c]
mov dword [esp + 0x54], 0x600118
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], 2
cmp ebx, 1
je 0x6aeed372
mov dword [esp + 0x44], ecx
test edx, edx
jne 0x6aeed381
test byte [0x6af0b68e], 1
movzx eax, al
mov dword [esp + 0x14], eax
jne 0x6aeed39a
xor ecx, ecx
lea eax, [esp + 0x24]
push ecx
push edi
push ecx
push ecx
push eax
push ecx
push 2
push 0x6aeb2a20
push ecx
call dword [0x6af0e06c]
test eax, eax
jne 0x6aeed3bb
test byte [0x6af0b68e], 1
jne 0x6aeed3df
mov ecx, dword [esp + 0x1c]
call fcn.6aec9294
test esi, esi
jne 0x6aeed40e
mov eax, esi
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.6aee0390
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x1c]
xor ecx, ecx
call fcn.6aecf6a0
mov esi, eax
test esi, esi
jne 0x6aedca9f
mov edx, dword [esp + 0x20]
mov al, byte [ebp + 0xc]
jmp 0x6aedc9f3
or dword [esp + 0x4c], 0xffffffff
or dword [esp + 0x48], 0xffffffff
jmp 0x6aedca3d
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x10]
jmp 0x6aedca49
push 0
push 0
push 0
push 0
push 0
push ebx
push eax
push edx
push ecx
push dword [esp + 0x3c]
mov edx, 0x6aeb45e8
call fcn.6aefff0d
jmp 0x6aedca5d
or dword [edi + 4], 0xffffffff
mov esi, eax
or dword [edi], 0xffffffff
test byte [0x6af0b68e], 0x20
je 0x6aedca8c
push eax
xor eax, eax
mov edx, 0x6aeb41d8
push eax
push eax
push eax
push eax
jmp 0x6aeed3ee
xor eax, eax
mov edx, 0x6aeb46a8
push eax
push eax
push dword [edi]
push eax
push dword [edi + 4]
mov ecx, dword [esp + 0x28]
push ebx
movzx eax, cx
mov ecx, dword [esp + 0x28]
push eax
push dword [esp + 0x3c]
push ecx
push dword [esp + 0x3c]
call fcn.6aefff0d
jmp 0x6aedca8c
cmp esi, 0x3e5
je 0x6aedca9d
cmp esi, 0xea
je 0x6aedca9d
test byte [0x6af0b6c8], 4
je 0x6aedca9d
push esi
push 0xa
mov edx, 0x6aeb2f1c
pop ecx
call fcn.6af08166
jmp 0x6aedca9d
Function at 0x6aee06d9
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x6aee0716
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x6aee070f
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x6aee071b
add edx, 0x28
cmp edx, esi
jne 0x6aee0700
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x6aee0718

Function at 0x6aee22c0
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6af09160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov byte [ebp - 0x11], dl
push edi
xor ebx, ebx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], ebx
lea edi, [esi + 0xec]
push edi
call dword [0x6af0c198]
mov eax, dword [esi + 0xf0]
cmp eax, 0xffffffff
jne 0x6aee2316
mov ebx, dword [esi + 0xa4]
test ebx, ebx
jne 0x6aee23ec
mov ebx, 0x54f
jmp 0x6aee23ec
push ebx
push ebx
push 0x7010
push 0xffff
push eax
call dword [0x6af0e108]
cmp eax, 0xffffffff
jne 0x6aee233c
xor cl, cl
call fcn.6aeceefb
mov ebx, eax
jmp 0x6aee23ec
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x80
push eax
lea eax, [esi + 0xf8]
push eax
push dword [esi + 0xf0]
call dword [0x6af0e0b4]
cmp eax, 0xffffffff
je 0x6aee232e
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x80
push eax
lea eax, [esi + 0x178]
push eax
push dword [esi + 0xf0]
call dword [0x6af0e0b8]
cmp eax, 0xffffffff
je 0x6aee232e
mov byte [esi + 0x206], bl
cmp byte [ebp - 0x11], bl
je 0x6aee23ec
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xf
push 6
push dword [esi + 0xf0]
call dword [0x6af0e0a8]
cmp eax, 0xffffffff
jne 0x6aee23ca
test byte [0x6af0b6d0], 4
je 0x6aee23ec
xor cl, cl
call fcn.6aeceefb
push eax
push 0x1f
mov edx, 0x6aeb2f4c
pop ecx
call fcn.6af08166
jmp 0x6aee23ec
test byte [0x6af0b6d0], 4
je 0x6aee23e3
push dword [ebp - 0xc]
mov edx, 0x6aeb2f4c
push 0x20
pop ecx
call fcn.6af08166
mov al, byte [ebp - 0xc]
mov byte [esi + 0x206], al
push edi
call dword [0x6af0c1a0]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6aee0390
leave
ret