joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x533ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5801d4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004e1c5d
mov ecx, dword [eax + 4]
call fcn.004de8ec
mov eax, dword [esi + 0xc4]
mov edi, dword [esi + 0x78]
lea ecx, [esp + 0x1c]
push ecx
xor ebp, ebp
mov ecx, esi
mov dword [esp + 0x38], ebp
mov dword [esi + 0x78], eax
call fcn.0046b940
mov edx, dword [esi + 0x94]
mov dword [esi + 0x78], edi
mov edi, 1
mov dword [esp + 0x18], edx
mov dword [esi + 0x94], edi
cmp dword [esp + 0x3c], ebp
je 0x46d1ff
mov ecx, dword [0x5b2f68]
push ebp
call fcn.004e5015
cmp eax, ebp
je 0x46d1f1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x144]
call eax
cmp eax, esi
jne 0x46d1f1
push 0x4ea0
mov dword [esp + 0x40], edi
call fcn.0046c170
add esp, 4
mov eax, dword [esi + 0x294]
mov edi, dword [esi + 0x84]
mov edx, dword [esi + 0x2e0]
push ebp
push edi
mov edi, dword [esp + 0x44]
push ebp
mov ecx, eax
push edi
shl ecx, 5
mov ecx, dword [ecx + edx - 0x20]
dec eax
push eax
mov eax, dword [0x5a9d14]
dec ecx
push ecx
push ebp
push ebp
lea edx, [esi + 0x2a4]
push edx
push eax
mov ecx, esi
call fcn.0046ccc0
mov edi, dword [esi + 0x2ac]
push 0xffffffffffffffff
lea ebx, [esi + 0x154]
push edi
mov ecx, ebx
mov dword [esp + 0x1c], edi
call fcn.004614f0
xor edx, edx
cmp edi, ebp
jle 0x46d196
xor edi, edi
mov edi, edi
cmp edi, ebp
jl 0x46d1fa
cmp edx, dword [esi + 0x2ac]
jge 0x46d1fa
mov ecx, dword [esi + 0x2a8]
add ecx, edi
cmp edx, dword [ebx + 8]
jge 0x46d1fa
mov eax, dword [ebx + 4]
mov ebp, dword [ecx]
add eax, edi
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [eax + 4], ebp
mov ecx, dword [ecx + 8]
inc edx
add edi, 0xc
xor ebp, ebp
cmp edx, dword [esp + 0x14]
mov dword [eax + 8], ecx
jl 0x46d150
mov eax, dword [esi + 0x2a8]
cmp eax, ebp
je 0x46d1af
push eax
call fcn.004d7727
add esp, 4
mov dword [esi + 0x2a8], ebp
mov dword [esi + 0x2b0], ebp
mov dword [esi + 0x2ac], ebp
cmp dword [esi + 0xc4], ebp
jne 0x46d1cd
mov dword [esi + 0xc4], 1
cmp dword [esp + 0x3c], ebp
je 0x46d25f
mov ecx, dword [0x5b2f68]
push 0x64
call fcn.00457870
mov ecx, dword [0x5b2f68]
call fcn.00458820
jmp 0x46d25f
mov dword [esp + 0x3c], ebp
jmp 0x46d0ef
call fcn.004e0962
cmp dword [esi + 0x84], ebp
je 0x46d22e
mov ecx, esi
mov dword [esi + 0x84], ebp
call fcn.0046a490
mov edx, dword [esi + 0x294]
sub edx, edi
push edx
push ebp
push ebp
mov ecx, esi
mov dword [esi + 0x84], edi
call fcn.0046c760
jmp 0x46d25f
mov eax, dword [esi + 0x158]
cmp eax, ebp
je 0x46d247
push eax
call fcn.004d7727
add esp, 4
mov dword [esi + 0x158], ebp
mov dword [esi + 0x160], ebp
mov dword [esi + 0x15c], ebp
mov dword [esi + 0x288], ebp
mov dword [esi + 0xc4], ebp
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov dword [esi + 0x94], eax
call fcn.0046b9c0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], 0xffffffff
call fcn.004132c0
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x488f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
cmp dword [esp + 0x28], 0
push edi
mov edi, ecx
mov eax, dword [edi + 0xa4]
je 0x489121
cmp dword [eax + 0x19c], 0
jle 0x488ff3
push ebx
mov ebx, dword [edi + 0x7c]
imul ebx, dword [0x589ce0]
push ebp
push esi
mov ecx, eax
mov edx, dword [ecx + 0x1a8]
push 0
push edx
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.0046aaf0
mov ecx, dword [edi + 0xa4]
mov eax, dword [ecx + 0x1ac]
push 0
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.0046aaf0
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
mov ebp, eax
sub ebp, dword [edi + 0x78]
sub esi, eax
imul ebp, dword [0x589ccc]
inc esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x38], 0
test esi, esi
jg 0x489004
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x24
ret 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
push 0
add ecx, eax
push ecx
mov ecx, dword [edi + 0xa4]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00469150
mov ecx, dword [edi + 0xa4]
mov eax, dword [esp + 0x20]
sub eax, dword [ecx + 0x1a8]
js 0x4890fc
mov edx, ecx
mov edx, dword [edx + 0x198]
lea eax, [eax + eax*2]
mov ebp, dword [edx + eax*4]
lea eax, [edx + eax*4]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
cmp ebp, edx
jne 0x489071
mov ecx, dword [0x589074]
mov esi, ecx
add eax, ebp
imul esi, ebp
imul eax, ecx
sub esi, ebx
sub eax, ebx
jmp 0x4890dd
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x3c]
add eax, edx
push eax
call fcn.00482000
mov ecx, dword [edi + 0xa4]
mov edx, dword [0x5a9d14]
push 0
add ecx, 0x108
push ecx
push ebp
mov ebp, dword [esp + 0x30]
push ebp
push edx
call fcn.004668d0
mov ecx, dword [esp + 0x3c]
mov edx, dword [0x5a9d14]
mov esi, eax
mov eax, dword [edi + 0xa4]
push 0
add eax, 0x108
push eax
push ecx
push ebp
push edx
sub esi, ebx
call fcn.004668d0
mov ecx, dword [0x589074]
imul ecx, dword [esp + 0x54]
sub ecx, ebx
add esp, 0x28
add eax, ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [0x589ccc]
add edx, ecx
push edx
push eax
push ecx
push esi
mov ecx, edi
call fcn.00487d30
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
add ebp, dword [0x589ccc]
inc eax
cmp eax, esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x14], ebp
jl 0x489000
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x24
ret 4
mov ecx, dword [eax + 0x188]
mov edx, dword [eax + 0x18c]
push ecx
mov ecx, dword [eax + 0x180]
push edx
mov edx, dword [eax + 0x184]
push ecx
push edx
mov ecx, edi
call fcn.00487f00
pop edi
add esp, 0x24
ret 4
Function at 0x4a8540
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
lea edx, [ecx + eax]
cmp ecx, edx
jae 0x4a8574
mov eax, dword [esp + 4]
push esi
push edi
movzx edi, byte [ecx]
movzx esi, al
shr ax, 8
xor esi, edi
xor ax, word [esi*2 + 0x5b3a50]
inc ecx
movzx eax, ax
cmp ecx, edx
jb 0x4a8555
pop edi
pop esi
ret
mov ax, word [esp + 4]
ret
Function at 0x4ab2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x535d20
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x5801d4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [0x53d76c]
push esi
lea ecx, [esp + 0x34]
call fcn.004e27f3
xor ebx, ebx
push ebx
push 1
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
mov dword [esp + 0x70], ebx
call fcn.004aa710
mov dword [esp + 0x18], 0x5417a0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x60], 1
call fcn.004e1c5d
mov eax, dword [eax + 0xc]
push 0x7e3
push eax
call dword [0x53d678]
push eax
lea ecx, [esp + 0x1c]
call fcn.004ee559
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
call dword [0x53d698]
push eax
call fcn.004ee524
mov edi, eax
push edi
call fcn.0041d530
mov edx, dword [edi + 4]
mov eax, dword [0x5b2f68]
mov ecx, dword [eax + 0x1674]
push edx
mov edx, dword [eax + 0x1670]
push ecx
push edx
call fcn.004c38b0
mov ecx, dword [esi + 0x20]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call dword [0x53d640]
mov eax, dword [esp + 0x2c]
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
lea eax, [eax + edx - 0xc]
lea ecx, [eax + 0x19]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [ecx + 0x19]
push edx
push eax
push ecx
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x58], 0x14
call dword [0x53d700]
mov edx, dword [0x5b2f68]
mov eax, dword [edx + 0x20]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov eax, dword [edi + 4]
push edx
push 0x42
push eax
call dword [0x53d67c]
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
call fcn.004aa710
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], bl
mov dword [esp + 0x18], 0x5417a0
call fcn.004ee5b1
lea ecx, [esp + 0x30]
mov dword [esp + 0x60], 0xffffffff
call fcn.004e2847
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x54
ret
Function at 0x6bd57d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0x6bd457
mov dx, cx
xchg dword [esp], edx
mov dh, ch
jmp 0x6bd492
jb 0x6bd4ae
jae 0x6bd4ae
mov dh, 0x3a
mov dh, 0x42
push word [esp + 1]
pop edx
add esp, 1
jb 0x6bd52d
jae 0x6bd4f0
lcall 0xc38b, 0x7e17e4f5
mov eax, ebx
push esp
mov dh, byte [esp + 1]
mov dword [esp], esi
mov dx, word [esp + 2]
jmp 0x6bd478
add ebx, ecx
jb 0x6bd450
pushal
mov dx, cx
xchg dword [esp], edx
mov dh, ch
jmp 0x6bd492
lea esp, [esp + 0xc]
neg eax
push esp
xchg byte [esp + 2], dh
xchg dh, dl
jmp 0x6bd55c
sub esp, 0xc
lea esp, [esp + 1]
jmp 0x6bd4bd
mov dh, byte [esp]
mov dx, 0xfd73
mov dh, byte [esp]
jmp 0x6bd4d5
mov dh, byte [esp]
mov dx, 0xfd73
mov dh, byte [esp]
sub esp, 0xc
lea esp, [esp + 1]
jmp 0x6bd4bd
jmp 0x6bd50b
lea edx, [edx + edi]
jmp 0x6bd802
mov byte [esp], ch
lea edx, [esi*4]
jmp 0x6bd52f
sub dh, ah
jb 0x6bd545
mov byte [esp], ch
lea edx, [esi*4]
lea edx, [edx + edi]
call fcn.006bd6eb
inc eax
rol dword [ecx + 0x20], 1
rcl dword [eax], cl
rcl byte [ebx - 0x36]
xchg esp, eax
pop eax
mov ax, word [esp]
btc edx, edx
jmp 0x6bd474
shr edx, 0x1d
jno 0x6bd5ba
shl dx, cl
lea edx, [esi*4]
xchg dh, dl
sub dh, ah
push esp
jmp 0x6bd5e2
shl dx, cl
lea edx, [esi*4]
jmp 0x6bd606
bsf dx, ax
pop word [esp]
mov dx, 0xf2cd
lea esp, [esp + 2]
jmp 0x6bd60d
xchg dh, dl
sub dh, ah
push esp
jmp 0x6bd5e2
not eax
mov edx, 0x4ebc85c6
mov dx, word [esp]
not dh
mov dh, bh
jmp 0x6bd642
mov dx, word [esp]
lea edx, [ebp*4]
mov dx, word [esp]
bsr dx, bp
jl 0x6bd693
jge 0x6bd678
add al, 0x9d
or eax, 0x6c11a754
jg 0x6bd6a8
int1
xchg dword [esp + 8], eax
btc edx, edi
lea edx, [ebp - 7]
mov dx, 0x1d35
jmp 0x6bd6c1
btc edx, edi
lea edx, [ebp - 7]
mov dx, 0x1d35
bswap edx
mov dh, ch
ror eax, 0
bswap edx
jmp 0x6bd6c7
inc ebp
invalid
bswap edx
mov dh, ch
jmp 0x6bd6a1
mov dx, 0xc693
lea edx, [ebx*4]
mov edx, dword [esp]
mov dh, ch
bsf dx, ax
jno 0x6bd738
jo 0x6bd71e
rcl dword [ebx - 0x3d]
cmpsb byte [esi], byte es:[edi]
push ebp
nop
push esi
rol dword [eax - reloc.iphlpapi.dll_GetAdaptersInfo], 0x66
stc
not dx
neg eax
dec dx
jo 0x6bd6f7
mov dx, word [esp]
mov dh, 0xc3
not edx
sub dh, dh
jmp 0x6bd753
jmp 0x6bd71e
lea esp, [esp + 4]
not eax
mov edx, dword [esp]
mov dx, 0xb52f
mov dx, 0xa857
jmp 0x6bd58a
Function at 0x6bd6eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
not dx
sub esp, 6
call fcn.006bd6b8
mov dx, word [esp]
jmp 0x6bd701
mov dh, 0xc3
not edx
sub dh, dh
jmp 0x6bd78a
bsf dx, si
jmp 0x6bd771
int 0x79
out dx, al
lea edx, [ebp + 0xef]
jmp 0x6bd790
add ebp, 4
dec dx
jp 0x6bd79d
jnp 0x6bd7d6
std
jns 0x6bd750
mov byte [ebx - 0x38], bh
fstp qword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
in eax, 0x3b
add ecx, eax
rdtsc
push edx
lea edx, [edi*4]
rol ax, cl
jmp 0x6bd7b7
lea edx, [ebp + 0xef]
bswap edx
ror dh, 7
jl 0x6bd73a
bsf dx, si
jmp 0x6bd771
rdtsc
mov dh, 0x1a
lea edx, [eax*4]
and dh, bh
mov edx, dword [esp]
jmp 0x6bd7e3
jb 0x6bd75b
jae 0x6bd75b
and dh, bh
mov edx, dword [esp]
jmp 0x6bd7e3
rdtsc
mov dh, 0x1a
lea edx, [eax*4]
jmp 0x6bd7bb
lea edx, [ebx*4]
bswap edx
ror eax, 0x11
je 0x6bd818
rol ax, cl
mov al, 0xd6
shl dx, cl
bswap eax
jmp 0x6bd820
rol ax, cl
jmp 0x6bd9ae
sub ebx, 0x3720aef2
sub esp, 0
jo 0x6bd8fb
jno 0x6bd8a6
and bl, byte [ebp - 0x54]
mov edi, 0x8af78a86
add al, 0x24
mov dh, 8
call fcn.006bd57d
lea edx, [ebp - 0xa7]
push edx
push dword [esp]
and dh, bh
jmp 0x6bd88e
add ebx, 0x270e0ab8
neg dh
jo 0x6bd842
lea edx, [ebp - 0xa7]
jmp 0x6bd86e
push edx
push dword [esp]
and dh, bh
mov dx, word [esp + 6]
jmp 0x6bd893
rdtsc
bsr ax, bp
jmp 0x6bd907
mov dx, word [esp + 6]
xchg byte [esp + 4], dh
xchg dword [esp + 1], edx
jmp 0x6bd8e3
lea edx, [ebp - 0x17]
clc
xchg dx, ax
jmp 0x6bd886
lea eax, [edi*4]
push esp
mov edx, 0x4ae3e452
not eax
rdtsc
call fcn.006bd984
adc eax, 0xc3c184
rol ebx, 0
setae ah
lea eax, [ebp*4]
rdtsc
jmp 0x6bd8cb
lea edx, [ebp - 0x17]
clc
xchg dx, ax
rdtsc
bsr ax, bp
mov al, byte [esp]
mov al, 0x36
jmp 0x6bd858
mov al, 0xd6
shl dx, cl
bswap eax
jmp 0x6bd820
Function at 0x6d358a
Capabilities:
Encrypt data using aes

Disassembly:
shr edi, 0x18
bts ebp, ebx
jmp 0x6d35c4
mov ebp, 0x7563dc0c
mov bp, word [esp]
neg ebp
jmp 0x6d35ab

Function at 0x6d3f74
Capabilities:
Encrypt data using aes

Disassembly:
pushal
call fcn.006d3fb4
movsd dword es:[edi], dword [esi]
jmp 0x701968
push dword [esp]
jmp 0x6d40b9
lea eax, [ecx*4]
mov eax, 0x17d25802
mov eax, dword [ebp - 8]
jmp 0x6a6514
lea esp, [esp + 0xc]
jl 0x6a64fd
not ah
mov ax, 0x92f
jmp 0x6d4039
push 0x4da37050
call fcn.006b3eea
push 0x4da370b3
call fcn.006b3eea
mov cl, 0x2f
mov edi, 0xc28029da
jge 0x7019d1
fbld tbyte [esi]
push ecx
push 0x4da37099
call fcn.006b3eea
push 0x4da35b15
call fcn.006b3eea
retf
arpl word [ebx - 0x5d], bx
dec ebp
call fcn.006b3eea
sbb cl, byte [ebx + 0x3f8d7e1b]
mov al, 0x2c
mov byte [0xb9f734c5], al
push 0x4da35b49
call fcn.006b3eea
xchg dword [edx], ebx
mov bh, ch
sbb ch, byte [ecx - 0x75108025]
jns 0x7019e2
ror byte [ebp - 0x24], cl
das
sub edx, esi
cvtpi2ps xmm4, qword [esi + 0xf8a56c]
jmp 0x7019b6

Function at 0x6d3fb4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push edx
jmp 0x6a64e1
pop word [esp]
push word [esp + 1]
pushal
jmp 0x6d4759
jmp 0x6d3fba
lea esp, [esp + 0x24]
cmp eax, 1
jle 0x6a64da
mov cl, byte [esp]
jmp 0x6d3fd7
mov dword [esp + 0x11], ebp
jmp 0x6d3f95
sub esp, 4
mov di, 0x603f
xchg dword [esp], edi
jmp 0x6d4001
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
mov ecx, 0xff
jmp 0x6a658d
add esi, 0x10
mov edx, dword [esi]
lea edi, [ebx + ebx]
jmp 0x6d4012
lea esp, [esp + 4]
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d3fe7
pushal
xchg ch, al
stc
mov eax, 0x5e31eace
mov ebp, dword [esp]
jmp 0x6d4095
push edx
mov byte [esp], ah
jmp 0x6d4066
lea ebp, [ebp*4]
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
mov edi, dword [ebp]
pop ebp
jmp 0x6d406e
shr edi, 0x18
push ebp
mov ebp, edi
jmp 0x6d404d
sub esp, 4
mov word [esp], sp
push esp
and edi, ecx
sub esp, 0xc
jmp 0x6d40f8
lea esp, [esp + 0x42]
pushal
jmp 0x6d40db
mov dword [esp], edx
sub esp, 8
push word [esp + 5]
lea esp, [esp + 2]
lea esp, [esp + 8]
popal
jmp 0x6d4020
and ebx, ecx
lea esp, [esp + 0x58]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
lea ebx, [ecx - 0xfb]
jmp 0x6d4138
pushal
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
pushal
pushal
push word [esp + 0x31]
jmp 0x6d407d
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
clc
call 0x6d4146
and bh, byte [ebp + 0x76c7342d]
sub al, 0x8e
sbb al, 0x7b
xchg esi, eax
adc dword [edi + reloc.iphlpapi.dll_GetAdaptersInfo], ebx
add eax, edi
cmp al, byte [esi + 0x5eb60ffb]
add dl, byte [edx - 0x15]
salc
and ebx, ecx
sub esp, 0x10
mov word [esp + 0xa], di
jmp 0x6d43a5
mov ebx, 0x3af80136
xchg bl, bh
movzx ebx, byte [esi + 2]
push edx
jmp 0x6d411c
movzx ebx, byte [esi + 5]
pushal
and edx, ecx
call fcn.006d4203
add esp, 5
lea esp, [esp + 3]
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d4222
mov edi, dword [esp + 0x24]
pushal
xchg word [esp + 0xb], si
jmp 0x6d47f3
Function at 0x6d4146
Capabilities:
Encrypt data using aes

Disassembly:
push edx
jmp 0x6a64e1
pop word [esp]
push word [esp + 1]
pushal
jmp 0x6d4759
jmp 0x6d3fba
lea esp, [esp + 0x24]
cmp eax, 1
jle 0x6a64da
mov cl, byte [esp]
jmp 0x6d3fd7
mov dword [esp + 0x11], ebp
jmp 0x6d3f95
sub esp, 4
mov di, 0x603f
xchg dword [esp], edi
jmp 0x6d4001
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
mov ecx, 0xff
jmp 0x6a658d
add esi, 0x10
mov edx, dword [esi]
lea edi, [ebx + ebx]
jmp 0x6d4012
lea esp, [esp + 4]
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d3fe7
pushal
xchg ch, al
stc
mov eax, 0x5e31eace
mov ebp, dword [esp]
jmp 0x6d4095
push edx
mov byte [esp], ah
jmp 0x6d4066
lea ebp, [ebp*4]
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
mov edi, dword [ebp]
pop ebp
jmp 0x6d406e
shr edi, 0x18
push ebp
mov ebp, edi
jmp 0x6d404d
sub esp, 4
mov word [esp], sp
push esp
and edi, ecx
sub esp, 0xc
jmp 0x6d40f8
lea esp, [esp + 0x42]
pushal
jmp 0x6d40db
mov dword [esp], edx
sub esp, 8
push word [esp + 5]
lea esp, [esp + 2]
lea esp, [esp + 8]
popal
jmp 0x6d4020
and ebx, ecx
lea esp, [esp + 0x58]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
lea ebx, [ecx - 0xfb]
jmp 0x6d4138
pushal
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
pushal
pushal
push word [esp + 0x31]
jmp 0x6d407d
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
clc
call 0x6d4146
and bh, byte [ebp + 0x76c7342d]
sub al, 0x8e
sbb al, 0x7b
xchg esi, eax
adc dword [edi + reloc.iphlpapi.dll_GetAdaptersInfo], ebx
add eax, edi
cmp al, byte [esi + 0x5eb60ffb]
add dl, byte [edx - 0x15]
salc
and ebx, ecx
sub esp, 0x10
mov word [esp + 0xa], di
jmp 0x6d43a5
mov ebx, 0x3af80136
xchg bl, bh
movzx ebx, byte [esi + 2]
push edx
jmp 0x6d411c
movzx ebx, byte [esi + 5]
pushal
and edx, ecx
call fcn.006d4203
add esp, 5
lea esp, [esp + 3]
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d4222
mov edi, dword [esp + 0x24]
pushal
xchg word [esp + 0xb], si
jmp 0x6d47f3

Function at 0x6d422e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp]
sub esp, 2
jmp 0x6d4256
and edi, ecx
push edx
mov word [esp], di
mov dword [esp], esi
push word [esp + 1]
jmp 0x6d426b
lea esp, [esp + 2]
jmp 0x6d4317
lea esp, [esp + 4]
movzx ebx, byte [esi + 6]
cmc
call fcn.006d42fc
mov ecx, 0x29dabf2f
int1
rol dword [eax - 0x2a], 1
mov cl, 0x40
hlt
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
push esp
mov ebx, dword [esp + 1]
jmp 0x6d429b
sub esp, 2
lea esp, [esp + 1]
mov byte [esp], ch
lea esp, [esp + 1]
lea esp, [esp + 0x34]
jmp 0x6d42b7
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
clc
clc
and ebx, ecx
jmp 0x6d42ce
Function at 0x6d42fc
Capabilities:
Encrypt data using aes

Disassembly:
clc
sub esp, 0x14
push word [esp + 3]
mov dword [esp + 0x11], ebp
insb byte es:[edi], dx
and al, 0x11
lea esp, [esp + 2]
jmp 0x6d4352
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d42e2
jae 0x6d42ec
jne 0x6d4325
out dx, eax
sub dword [ebx + reloc.iphlpapi.dll_GetAdaptersInfo], eax
test eax, 0x98b9ae07
sti
ror byte [ebx + 0xbc8bd3c], cl
imul eax, dword [eax], reloc.iphlpapi.dll_GetAdaptersInfo
movzx ebx, byte [esi + 9]
sub esp, 0x1a
add esp, 0x19
lea esp, [esp + 1]
jmp 0x6d4361
mov dh, 0x5e
or dword [ebx - reloc.iphlpapi.dll_GetAdaptersInfo], eax
sbb dword [ebp - 0x14fedb9c], ecx
sub eax, 0x245dcd55
xlatb
pushal
fmul qword [ebp + 0x33282464]
cmp al, 0x9d
enter 0x6b0f, 0
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d4324
and ebx, ecx
sub esp, 0x12
mov word [esp], bx
lea esp, [esp + 2]
jmp 0x6d433b
and edx, ecx
call fcn.006d4384
rcr byte [eax - 0x32], 0xa9
pop eax
out dx, eax
mov ch, 0x25
dec esp
mov edi, 0xbe57247e
mov dword [eax - 0x4d], esp
loopne 0x6d4305
adc al, 0x24

Function at 0x6d4384
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x16
add esp, 0xf
pop dword [esp]
lea esp, [esp + 3]
jmp 0x6d43dc
mov edx, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
stc
call fcn.006d43bc
into
dec esp
ret 0x54a5

Function at 0x6d43bc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 2], dh
and edx, ecx
jmp 0x6d448e
mov edi, edx
cmc
call fcn.006d4474
invalid
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
push edx
pop edi
neg di
jmp 0x6d440d
xor edi, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
setb dh
cmc
mov edx, dword [esi + 8]
jmp 0x6d442a
stc
sub esp, 0x1e
lea esp, [esp + 0x15]
lea esp, [esp + 1]
lea esp, [esp + 0x10]
jmp 0x6d444b

Function at 0x6d458f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d453b

Function at 0x6d45dc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea ebp, [ebp + 8]
mov dword [ebp], edi
pop ebp
jmp 0x6d466a
push ebp
mov ebp, esi
jmp 0x6d45c0
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
mov edi, edx
call fcn.006d4626
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d46bf
mov ebp, edx
lea ebp, [ebp*4]
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
mov edx, dword [ebp]
pop ebp
jmp 0x6d46ee
and edx, ecx
pushal
push ebp
jmp 0x6d46a3
and ebx, ecx
call fcn.006d46c5

Function at 0x6d462b
Capabilities:
Encrypt data using aes

Disassembly:
cmc
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d464f

Function at 0x6d470e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edx, ecx
sub esp, 0x12
lea esp, [esp + 2]
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d46ca
Function at 0x6d471b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp]
mov byte [esp], dh
lea esp, [esp + 1]
jmp 0x6d4746

Function at 0x6d476f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
movzx ebx, byte [esi + 0xe]
clc
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x6d4678
lea ebx, [ecx + ebx]
jmp 0x6d4691

Function at 0x6d4787
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
sub esp, 0x1e
lea esp, [esp + 2]
and ebx, ecx
jmp 0x6d44c6
lea esp, [esp + 3]
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
movzx ebx, byte [esi + 0xa]
jmp 0x6d44e1
stc
and ebx, ecx
sub esp, 0xa
mov dword [esp + 3], esi
add esp, 7
jmp 0x6d451d
mov word [esp], dx
and edi, ecx
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
clc
jmp 0x6d4551
mov dword [esp], esi
jmp 0x6d45b0