joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100230d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [GetStartupInfoA], eax
call fcn.01003ab0
xor ebx, ebx
inc ebx
xor edi, edi
cmp dword [ebp + 0x14], 7
je 0x100221d
cmp dword [ebp + 0x14], 2
mov dword [0x1005b38], edi
jne 0x1002223
mov dword [0x1005b38], ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0x16fd
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x64
push dword [GetStartupInfoA]
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, dword [GetStartupInfoA]
push 0x7f00
push edi
mov dword [GetLayout], eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], 0x1001bc9
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push ebx
mov dword [ebp - 0x34], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov esi, 0x1005aa0
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x100233b
push 0x1f4
push dword [GetStartupInfoA]
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0x1f5
push dword [GetStartupInfoA]
mov dword [reloc.GDI32.dll_SetDIBitsToDevice], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [ebp + 0x14], eax
call fcn.01002bc2
mov eax, dword [0x1005b88]
mov ecx, dword [0x1005b20]
mov edx, dword [reloc.GDI32.dll_GetLayout]
push edi
push dword [GetStartupInfoA]
add ecx, eax
push edi
push edi
push ecx
mov ecx, dword [SetDIBitsToDevice]
add edx, ecx
push edx
mov edx, dword [0x10056b4]
sub edx, eax
mov eax, dword [0x10056b0]
push edx
sub eax, ecx
push eax
push 0xca0000
push esi
push esi
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, edi
mov dword [0x1005b24], eax
jne 0x1002325
push 0x3e8
jmp 0x1002336
push ebx
call fcn.01001950
call fcn.01002b14
test eax, eax
jne 0x1002342
push 5
call fcn.01003950
xor eax, eax
jmp 0x10023c6
push dword [0x10056c4]
call fcn.01003ce5
call fcn.0100367a
push ebx
push dword [0x1005b24]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x1005b24]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
mov dword [0x1005b38], edi
jmp 0x10023a4
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x14]
push dword [0x1005b24]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x10023a4
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
push edi
lea eax, [ebp - 0x24]
push edi
push eax
call esi
test eax, eax
jne 0x1002379
call fcn.0100263c
cmp dword [reloc.USER32.dll_GetDC], edi
je 0x10023c3
call fcn.01002dab
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1002332
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [GetStartupInfoA], eax
call fcn.01003ab0
xor ebx, ebx
inc ebx
xor edi, edi
cmp dword [ebp + 0x14], 7
je 0x100221d
cmp dword [ebp + 0x14], 2
mov dword [0x1005b38], edi
jne 0x1002223
mov dword [0x1005b38], ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0x16fd
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x64
push dword [GetStartupInfoA]
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, dword [GetStartupInfoA]
push 0x7f00
push edi
mov dword [GetLayout], eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], 0x1001bc9
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push ebx
mov dword [ebp - 0x34], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov esi, 0x1005aa0
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x100233b
push 0x1f4
push dword [GetStartupInfoA]
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0x1f5
push dword [GetStartupInfoA]
mov dword [reloc.GDI32.dll_SetDIBitsToDevice], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [ebp + 0x14], eax
call fcn.01002bc2
mov eax, dword [0x1005b88]
mov ecx, dword [0x1005b20]
mov edx, dword [reloc.GDI32.dll_GetLayout]
push edi
push dword [GetStartupInfoA]
add ecx, eax
push edi
push edi
push ecx
mov ecx, dword [SetDIBitsToDevice]
add edx, ecx
push edx
mov edx, dword [0x10056b4]
sub edx, eax
mov eax, dword [0x10056b0]
push edx
sub eax, ecx
push eax
push 0xca0000
push esi
push esi
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, edi
mov dword [0x1005b24], eax
jne 0x1002325
push 0x3e8
jmp 0x1002336
push ebx
call fcn.01001950
call fcn.01002b14
test eax, eax
jne 0x1002342
push 5
call fcn.01003950
xor eax, eax
jmp 0x10023c6
push dword [0x10056c4]
call fcn.01003ce5
call fcn.0100367a
push ebx
push dword [0x1005b24]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x1005b24]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
mov dword [0x1005b38], edi
jmp 0x10023a4
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x14]
push dword [0x1005b24]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x10023a4
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
push edi
lea eax, [ebp - 0x24]
push edi
push eax
call esi
test eax, eax
jne 0x1002379
call fcn.0100263c
cmp dword [reloc.USER32.dll_GetDC], edi
je 0x10023c3
call fcn.01002dab
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10036b3
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x10056ac]
mov ecx, dword [0x10056a8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, dword [0x1005334]
mov dword [0x1005164], edi
jne 0x10036a4
cmp ecx, dword [0x1005338]
jne 0x10036a4
push 4
jmp 0x10036a6
push 6
pop ebx
mov dword [0x1005334], eax
mov dword [0x1005338], ecx
call fcn.01002ed5
mov eax, dword [0x10056a4]
mov dword [0x1005160], edi
mov dword [0x1005330], eax
push dword [0x1005334]
call fcn.01003940
push dword [0x1005338]
mov esi, eax
inc esi
call fcn.01003940
inc eax
mov ecx, eax
shl ecx, 5
test byte [ecx + esi + 0x1005340], 0x80
jne 0x10036c7
shl eax, 5
lea eax, [eax + esi + 0x1005340]
or byte [eax], 0x80
dec dword [0x1005330]
jne 0x10036c7
mov ecx, dword [0x1005338]
imul ecx, dword [0x1005334]
mov eax, dword [0x10056a4]
sub ecx, eax
push edi
mov dword [0x100579c], edi
mov dword [0x1005330], eax
mov dword [0x1005194], eax
mov dword [0x10057a4], edi
mov dword [0x10057a0], ecx
mov dword [0x1005000], 1
call fcn.0100346a
push ebx
call fcn.01001950
pop edi
pop esi
pop ebx
ret
Function at 0x735442
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07208f8
jmp 0x735524
lea esp, [esp + 5]
lea esp, [esp + 3]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x73577b
push dword [esp + 3]
jmp 0x73544c
jl 0x73542c
lea esp, [esp + 5]
lea esp, [esp + 3]
jmp 0x73545c
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x73577b
mov bl, dl
bsf ax, sp
jmp 0x73549e
mov bl, dl
bsf ax, sp
lea ebp, [esp]
bswap edx
jmp 0x7354bf
neg dx
ja 0x7354cd
bsr eax, ebp
mov ch, byte [esp]
jmp 0x73550a
xchg bh, ch
xchg cl, bh
sub esp, 0xc0
mov edi, esp
jmp 0x7354a5
bsr eax, ebp
mov ch, byte [esp]
jmp 0x73550a
mov esi, dword [esp + 0x2c]
mov bl, cl
bsf bx, dx
jae 0x735498
jb 0x735482
lea ebx, [eax - 0x5c]
xchg bx, ax
btr edx, ebx
xchg bh, dl
bsr ax, ax
bswap edx
jmp 0x73554f
mov ecx, esi
lea eax, reloc.RASAPI32.dll_RasHangUpA
lea eax, [eax + ebx]
bts dx, sp
jmp 0x7355c3
rdtsc
not dx
mov bh, 0x86
mov eax, ecx
jmp 0x7354e6
btc ebx, edi
setno dh
push esp
mov ax, word [esp + 2]
jmp 0x73558e
mov eax, 0x9df7c7fc
add esi, 0x7c344b7b
mov ebx, dword [esp]
lea eax, [ebx - 0xb5]
inc ax
jmp 0x7355a4
push esp
mov ax, word [esp + 2]
jmp 0x73558e
btr edx, ebx
xchg bh, dl
bsr ax, ax
jmp 0x735502
lea esp, [esp + 4]
dec esi
xchg al, bh
inc bl
ja 0x7356af
jbe 0x7355d0
sub eax, 0x1960f3c
jg 0x73552f
btc ebx, edi
setno dh
jmp 0x735567
je 0x7354f4
lea ebx, [eax - 0x5c]
xchg bx, ax
jmp 0x735580
mov eax, 0xf956686
clc
jmp 0x7355ec
mov eax, 0xf956686
clc
inc esi
rol dx, cl
jmp 0x735629
call fcn.00735632
inc ebx
rcl byte [esi + 0x31], 0xc0
jbe 0x7355fd
invalid
jge 0x7355ed
je 0x735589
inc esp
int3
bswap ebx
clc
jmp 0x73565f
jno 0x7355f2
jo 0x7355f2
mov dword [esp], ebx
lea esp, [esp + 2]
jmp 0x735665
jae 0x735657
xchg ebx, edx
bsf ebx, ebx
jmp 0x735608
xchg ebx, edx
bsf ebx, ebx
bswap ebx
clc
not esi
ror al, cl
jmp 0x73560d
rol esi, 0
mov al, 0xd0
rdtsc
lea ebx, [ebp*4]
shl bh, cl
jmp 0x7356dc
add esi, dword [ebp]
inc bx
jmp 0x7356b4
mov ebx, 0xbd3f89c
lea edx, [esi*4]
mov dl, 0x3b
jmp 0x7356c4
jmp 0x7355e6
jae 0x735691
mov ebx, 0xbd3f89c
lea edx, [esi*4]
jmp 0x735714
jl 0x735686
jge 0x735686
mov dl, 0x3b
jmp 0x7356c4
pushfd
jmp 0x734f94

Function at 0x735632
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bp
xchg dx, bx
mov byte [esp + 2], bl
mov dx, word [esp + 1]
push word [esp + 2]
jmp 0x73567b
jp 0x735611
mov dword [esp], ebx
lea esp, [esp + 2]
jmp 0x735665
Function at 0x7359ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00735a4f
lodsb al, byte [esi]
daa
mov bh, 0xd2
and dword [edx - reloc.RASAPI32.dll_RasHangUpA], ebx
pop eax
cdq
xor eax, 0x89be5724

Function at 0x73a3c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
mov edi, ecx
lea edi, reloc.RASAPI32.dll_RasHangUpA
lea esp, [esp + 8]
sub ecx, 0x10018e26
jmp 0x73a385

Function at 0x73d1b4
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x72389a

Function at 0x755719
Capabilities:
Encrypt data using aes

Disassembly:
lea ebx, [ebx + 9]
movzx esi, byte [ebx]
pop ebx
shl edx, 8
jmp 0x7556f8
movzx edx, byte [eax + 8]
push ebx
mov ebx, eax
jmp 0x75565f
movzx edx, byte [eax + 0xc]
jmp 0x7556dc
xor edx, esi
mov dword [ecx + 8], edx
jmp 0x75568b
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
jmp 0x7556a1
xor edx, esi
jmp 0x755764
movzx esi, byte [eax + 0xd]
shl edx, 8
jmp 0x7556c6
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
jmp 0x7556bb
mov dword [esi], edx
pop esi
jmp 0x75573c
push esi
mov esi, ecx
lea esi, [esi + 0xc]
jmp 0x755703
xor edx, esi
shl edx, 8
xor edx, eax
jmp 0x755719
mov eax, edx
shr eax, 0x10
mov esi, 0xff
jmp 0x75574d
and eax, esi
jmp 0x755771
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
jmp 0x755733
mov eax, dword [eax*4 + reloc.RASAPI32.dll_RasHangUpA]
lea esp, [esp + 0x40]
xor eax, 0x1000000
shl bp, 0xf
jmp 0x7557c8
shl edx, 8
xor edx, esi
mov dword [ecx + 4], edx
jmp 0x755682
and edi, esi
bswap ebp
bsr bx, bx
mov ebp, edi
jmp 0x7557d5
mov ebx, dword [ecx + 4]
mov bp, si
lea ebp, [ecx + edi]
jmp 0x7559f8
mov edi, edx
lea ebp, [eax + ebx]
bsf ebp, ebx
shr edi, 8
jmp 0x7557a4
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
setle bl
xchg bl, bh
and edi, 0xff0000
btr ebx, ebx
jmp 0x7557b0
mov bh, byte [esp + 3]
jmp 0x755797
xor eax, edi
mov edi, edx
inc bp
and edi, esi
jmp 0x755879
and edi, ebp
call fcn.0075584f
mov ch, 0x26
mov ah, 0xd3
wait
lds ebx, [ebx - 0x35]
scasb al, byte es:[edi]
pop ebp
call 0xc21d6163
out dx, eax
sbb byte [esi - 0x3f], ah
fisttp qword [edx]
shr edi, 0x18
rcr bp, 0xa
bsf bp, si
movzx edi, byte [edi*4 + 0x72c900]
jmp 0x755804
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov ebp, 0xff00
clc
jmp 0x75580e
ror edi, 0xb
pushfd
mov edi, edx
lea ebp, reloc.RASAPI32.dll_RasHangUpA
jmp 0x755824
and eax, 0xff000000
bsr ebp, edx
xor eax, edi
clc
jmp 0x7558ab

Function at 0x75584f
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x19
lea esp, [esp + 1]
jmp 0x75585d
add esp, 2
lea esp, [esp + 2]
xor eax, edi
bts edi, esi
jmp 0x755839
lea esp, [esp + 0x1c]
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
jmp 0x755888
xor ebx, eax
stc
mov dword [edi], eax
jmp 0x7558d2
mov edi, ecx
add edi, 0x14
mov dword [edi], ebx
pop edi
add bl, ah
jmp 0x7558bc
xchg bl, bh
neg bx
jmp 0x75592d
mov eax, dword [ecx + 8]
xor eax, ebx
push edi
jmp 0x75588f
mov ebx, esi
mov eax, esi
mov dword [ecx + 0x1c], edx
mov ebx, 0x72e104
jmp 0x7216cf
mov dword [ecx + 0x18], eax
mov bx, 0x78bd
xor edx, eax
xchg bx, ax
jmp 0x7558fd
Function at 0x7559df
Capabilities:
Encrypt data using aes

Disassembly:
movzx edi, byte [edi*4 + 0x72c900]
jmp 0x755a1e
stc
jmp 0x755a29
xor ecx, edi
bsr di, dx
and edx, ebp
cmc
jmp 0x755a08
xor ecx, edx
mov dl, al
mov dx, cx
bsr edx, eax
jmp 0x755b0b
lea esp, [esp + 2]
lea esp, [esp + 0x14]
add ebx, 4
mov dword [edi], ecx
call fcn.00755a54
mov dx, word [esp + 1]
lea esp, [esp + 0x20]
xor ecx, dword [eax]
btc dx, cx
sub esp, 0x16
jmp 0x755a71
lea esp, [esp + 0x28]
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
pushal
jmp 0x755abc

Function at 0x755a83
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x7558da
mov eax, edi
mov edx, dword [eax + 0xc]
bsr cx, bx
mov edi, esi
jmp 0x75590e
pushal
mov dword [esp], edx
clc
popal
cmc
jmp 0x7559bd
mov ecx, dword [esp]
cmc
mov ecx, edx
shr ecx, 8
jmp 0x7558e7
mov esi, edi
jmp 0x755976
shr edi, 0x10
and edi, esi
push esi
jmp 0x75593b
lea esi, [esi*4]
lea esi, reloc.RASAPI32.dll_RasHangUpA
mov edi, dword [esi]
pop esi
call fcn.00755959
xor ecx, edi
bswap edi
inc edi
jmp 0x7559cc
and ecx, esi
sub esp, 4
pushal
mov ecx, dword [ecx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x755951
mov edi, edx
call 0x7559d4
in al, 0x21
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x755a46
push cx
lea esp, [esp + 2]
shr edi, 0x18
call fcn.007559df
add esp, 0
sub esp, 0x16
lea esp, [esp + 2]
lea esp, [esp + 0x18]
popal
jmp 0x755aa3
add esi, 4
mov edx, dword [esi]
pop esi
push edx
clc
jmp 0x755ae6
mov dword [eax + 0x14], edx
mov ecx, dword [esp]
neg ecx
jmp 0x755af3
cmc
xor edx, ecx
lea ecx, reloc.RASAPI32.dll_RasHangUpA
xchg cl, ch
jmp 0x755ad0
mov ecx, dword [eax + 8]
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x755b2d
push ebp
jmp 0x755b4f
xor ecx, edx
lea edx, [esp + edi]
xchg dh, dl
mov dx, si
jmp 0x755b17
shr dx, 3
jmp 0x755b5a
mov ebp, eax
add ebp, 0x18
mov dword [ebp], ecx
pop ebp
jmp 0x755b39
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
jmp 0x75606f
lea esp, [esp + 0x2c]
cmp ebx, 0x72e128
jmp 0x755c55
pop eax
call fcn.00755ba2
jne 0x7216cf
mov ebx, esi
push 0xa
jmp 0x755bbc
pushfd
add esp, 3
pushfd
push dword [esp + 4]
lea esp, [esp + 1]
jmp 0x755b67

Function at 0x755cbb
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x755cde
mov dword [edx - 4], edi
jmp 0x755d1b
mov edi, dword [ecx]
call 0x755d05
Function at 0x755cd1
Capabilities:
Encrypt data using aes

Disassembly:
pop ebp
jmp 0x755cb0
push ebp
mov ebp, ecx
add ebp, 0xfffffffc
mov edi, dword [ebp]
jmp 0x755c8c
push ebp
mov ebp, ecx
add ebp, 0xfffffffc
jmp 0x755cf4
mov word [esp + 1], dx
mov dword [edx - 8], edi
btc edi, esp
jmp 0x755ca2
mov dword [ebp], eax
pop ebp
mov ax, 0x1ea
dec ax
mov eax, dword [edx]
call fcn.00755cbb
mov word [esp + 1], bp
pop word [esp]
lea esp, [esp + 2]
jmp 0x755d22
mov dword [ecx], eax
mov ax, 0x633f
mov eax, dword [edx + 4]
jmp 0x755eb7
clc
jmp 0x755d78
lea esp, [esp + 0x2c]
sub ebx, 4
add ecx, 0x10
cmc
jmp 0x755d55
sub edx, 0x10
pushfd
mov word [esp], bp
lea esp, [esp + 4]
jmp 0x755d8a
cmp dword [ebp - 4], ebx
jl 0x721d59
not eax
jmp 0x755e29
mov dword [ecx + 4], eax
cmc
mov dword [edx + 4], edi
pushfd
mov word [esp], cx
jmp 0x755d6b
mov eax, dword [ebp - 8]
jmp 0x721d6f
mov dword [edx], edi
mov edi, 0x269e3fc5
mov edi, dword [ecx + 4]
pushal
jmp 0x755da4

Function at 0x755d05
Capabilities:
Encrypt data using aes

Disassembly:
pop ebp
jmp 0x755cb0
push ebp
mov ebp, ecx
add ebp, 0xfffffffc
mov edi, dword [ebp]
jmp 0x755c8c
push ebp
mov ebp, ecx
add ebp, 0xfffffffc
jmp 0x755cf4
mov word [esp + 1], dx
mov dword [edx - 8], edi
btc edi, esp
jmp 0x755ca2
mov dword [ebp], eax
pop ebp
mov ax, 0x1ea
dec ax
mov eax, dword [edx]
call fcn.00755cbb
mov word [esp + 1], bp
pop word [esp]
lea esp, [esp + 2]
jmp 0x755d22
mov dword [ecx], eax
mov ax, 0x633f
mov eax, dword [edx + 4]
jmp 0x755eb7
clc
jmp 0x755d78
lea esp, [esp + 0x2c]
sub ebx, 4
add ecx, 0x10
cmc
jmp 0x755d55
sub edx, 0x10
pushfd
mov word [esp], bp
lea esp, [esp + 4]
jmp 0x755d8a
cmp dword [ebp - 4], ebx
jl 0x721d59
not eax
jmp 0x755e29
mov dword [ecx + 4], eax
cmc
mov dword [edx + 4], edi
pushfd
mov word [esp], cx
jmp 0x755d6b
mov eax, dword [ebp - 8]
jmp 0x721d6f
mov dword [edx], edi
mov edi, 0x269e3fc5
mov edi, dword [ecx + 4]
pushal
jmp 0x755da4
Function at 0x755ef4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edx, ecx
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x755f20
and edx, ecx
sub esp, 0x1a
pop dword [esp + 0xa]
mov dword [esp + 0xd], edi
lea esp, [esp + 2]
jmp 0x755f51
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
push edi
jmp 0x755ff6
cmc
mov dword [esi], edi
dec edi
bswap edi
sub esp, 3
jmp 0x755fc6
lea esp, [esp + 0x14]
popal
add edi, 4
mov edx, dword [edi]
pop edi
jmp 0x755f84
lea esi, [esi*4]
lea esi, reloc.RASAPI32.dll_RasHangUpA
mov ebx, dword [esi]
pop esi
jmp 0x755fd1
pop di
lea esp, [esp + 1]
push esi
mov esi, ebx
jmp 0x755fb0
mov di, 0x7897
bsr edi, edx
mov edi, edx
sub esp, 0x18
push word [esp + 0x10]
jmp 0x75603e
pushal
shl ah, cl
mov dword [esp], esi
sub esp, 0x17
add esp, 1
pop word [esp + 8]
jmp 0x755fa3
and edi, ecx
jmp 0x756050
push si
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x756009
push dword [esp + 0x11]
mov dword [esp + 0xf], esi
lea esp, [esp + 2]
shr edi, 0x18
pushal
jmp 0x75601f
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
and ebx, ecx
call fcn.00756081
sub dword [edx + reloc.RASAPI32.dll_RasHangUpA], edi
or dword [edi + reloc.RASAPI32.dll_RasHangUpA], ebx
jb 0x7560d9
jl 0x7560bd
salc
dec ebx
jmp 0x7560e5
mov ecx, esi
jmp 0x75611c
adc al, 0x8e
sbb al, 0x7b
xchg esi, eax
push edx
lahf
out 0x11, al
nop
adc ecx, dword [edx + reloc.RASAPI32.dll_RasHangUpA]
mov bx, word [esp]
push ecx
jmp 0x7560cf
and edx, ecx
pushal
jmp 0x75612b
add ecx, 9
movzx ebx, byte [ecx]
pop ecx
push cx
lea esp, [esp + 2]
jmp 0x756106
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
stc
pushal
and edx, ecx
jmp 0x75613c
lea esp, [esp + 0x40]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
lea edx, [esi*4]
jmp 0x7562a8
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
call 0x7561b6
mov ecx, esi
add ecx, 8
mov dword [ecx], edi
pop ecx
jmp 0x7562d8
rcl edi, 0
sub esp, 4
stc
pop word [esp]
lea esp, [esp + 2]
jmp 0x75630c
push eax
mov eax, ebx
lea eax, [eax*4]
jmp 0x75631c
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov ebx, dword [eax]
pop eax
bsf edi, ebp
jmp 0x756356
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
pushal
jmp 0x756394
mov edi, edx
shr edi, 0x18
cmc
jmp 0x756340
and edi, ecx
call fcn.00756374
sub esp, 6
lea esp, [esp + 3]
lea esp, [esp + 3]
jmp 0x7563c5
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0x19
lea esp, [esp + 1]
jmp 0x756478
and edx, ecx
call 0x756444

Function at 0x756081
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x40]
jmp 0x756154
and ebx, ecx
call fcn.007560ca
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov bl, dh
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x7560ff
Function at 0x7560b2
Capabilities:
Encrypt data using aes

Disassembly:
mov ch, bh
jmp 0x75527b
mov ecx, eax
lea esp, [esp + 4]
call fcn.0073d005
dec eax
jmp 0x756332
lea esp, [esp + 0x20]
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov cx, 0x719c
call fcn.007552de
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
bsf eax, eax
push dword [ebp + 0x18]
mov cl, 0xe0
pushal
jmp 0x75609f

Function at 0x756374
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and ebx, ecx
sub esp, 0xa
add esp, 7
mov byte [esp], ch
lea esp, [esp + 3]
jmp 0x7563b1
mov word [esp + 1], dx
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x75635e
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
rol bx, cl
movzx ebx, byte [esi + 0xe]
jmp 0x75639b

Function at 0x7563f3
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 1], bx
jmp 0x75641d
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0x11
mov dword [esp], edi
lea esp, [esp + 1]
jmp 0x756461
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x756539
and edx, ecx
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x75644b
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
call fcn.007564ed

Function at 0x7564ed
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 4]
jne 0x721e68
je 0x721d85
mov word [esp + 1], bx
push word [esp]
jmp 0x7564ae

Function at 0x8084ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dh
xchg dword [esp], ecx
mov ecx, dword [esp + 2]
mov eax, 0x868028fd
xchg dword [esp], ecx
jmp 0x8084b1
mov cx, 0x900f
pop word [esp + 1]
setb cl
mov dword [esp], edi
xchg edx, eax
push word [esp + 2]
jmp 0x80847e
lea eax, [eax*4]
xchg dword [esp], ecx
mov word [esp + 2], dx
mov edx, edi
jmp 0x80854f
mov dh, 0x9d
pop dx
jmp 0x808499
bswap edx
push dword [esp + 1]
mov cl, 0x91
mov dh, 0x63
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov cx, 0x3bca
jmp 0x808526
rdtsc
lea ecx, reloc.RASAPI32.dll_RasHangUpA
mov cl, 0x5a
mov word [esp], bp
mov byte [esp + 2], bl
xchg byte [esp], dl
jmp 0x8084d0
mov ch, byte [esp]
rdtsc
push word [esp + 1]
mov cx, word [esp]
pushfd
jmp 0x80857f
mov word [esp + 1], bp
pop eax
mov dword [esp], ecx
mov dl, ah
setne dh
mov edx, dword [esp + 3]
jmp 0x808510
mov dword [esp], ecx
push word [esp + 1]
pop ecx
xchg dword [esp], edx
setb al
rdtsc
jmp 0x8084f9
rdtsc
mov ecx, 0xd37af60a
rdtsc
mov edx, dword [esp]
lea eax, [eax + edx]
mov eax, dword [esp + 0xc]
jmp 0x808594
lea ecx, [eax + edi]
push sp
rdtsc
lea ecx, [ebx*4]
rdtsc
xchg dx, ax
jmp 0x808562
not edx
call fcn.0080864e
inc edi
je 0x8085f2
je 0x808602
jb 0x808617
jne 0x808615
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [esi], ah
popal
and al, 0x18

Function at 0x80bc33
Capabilities:
Parse pe header

Disassembly:
call 0x80bc0b
mov eax, dword [eax]
jmp 0x80bc75
mov eax, dword [eax + 8]
push eax
jmp 0x80aff6