joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445fc3
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp dword [0x6af818], 0
push esi
push edi
jne 0x4460e2
lea eax, [ebp - 0x94]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x94]
push 0x45d758
push eax
call esi
lea eax, [ebp - 0x94]
push str.MATRIX.INI
push eax
call esi
lea eax, [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
and dword [0x6af834], 0
push eax
lea eax, [ebp - 0x40]
push 0x1f
push eax
push 0x45d764
push str.HiRes
push 0x45d770
call esi
cmp byte [ebp - 0x40], 0x4e
je 0x44608c
cmp byte [ebp - 0x40], 0x6e
je 0x44608c
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x20]
push 0x1f
push eax
push 0x45d778
push str.hrwert
push 0x45d784
call esi
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_atol
pop ecx
mov edi, eax
call fcn.00445c38
test ax, ax
jle 0x44608c
test edi, edi
mov dword [0x6af834], 1
jne 0x446088
push 1
pop edi
mov eax, edi
jmp 0x4460e4
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x20]
push 0x1f
push eax
push 0x45d78c
push str.wert
push str.DELAY
call esi
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_atol
test eax, eax
pop ecx
jg 0x4460e4
mov esi, 0x640
cmp word [ebp + 8], 0x4d
jne 0x4460cb
call fcn.004466f7
jmp 0x4460d2
push 1
call fcn.0044650f
test ax, ax
jne 0x4460ea
add esi, 0x64
cmp esi, 0x1b58
jle 0x4460bd
xor eax, eax
pop edi
pop esi
leave
ret 4
call fcn.004480b8
call fcn.004460fd
lea eax, [esi + esi*2 + 0x3e8]
jmp 0x4460e4

Function at 0x4463e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push 8
pop esi
test byte [esp + 8], 1
je 0x4463f2
call fcn.0044637c
jmp 0x4463f7
call fcn.0044628c
call fcn.004463ae
call fcn.004463ae
shr byte [esp + 8], 1
call fcn.00446325
dec esi
jne 0x4463e4
cmp dword [esp + 0xc], 0
je 0x446467
push ebx
push edi
call fcn.004460fd
call fcn.004463ae
call fcn.004460fd
cmp dword [esp + 0x18], 0
je 0x446451
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x32
ja 0x44644c
call fcn.0044646e
test eax, eax
jne 0x446458
jmp 0x446438
push 1
pop ebx
jmp 0x446458
call fcn.0044646e
mov ebx, eax
call fcn.00446325
pop edi
test ebx, ebx
pop ebx
je 0x446467
xor eax, eax
jmp 0x44646a
push 1
pop eax
pop esi
ret 0xc

Function at 0x44648d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
call fcn.0044637c
push 8
xor ebx, ebx
pop esi
call fcn.004463ae
sar ebx, 1
and ebx, 0x7f
call fcn.0044646e
test eax, eax
je 0x4464af
or bl, 0x80
call fcn.00446325
dec esi
jne 0x446499
cmp dword [esp + 0xc], 0
je 0x4464c5
call fcn.0044637c
jmp 0x4464ca
call fcn.0044628c
call fcn.004460fd
call fcn.004463ae
call fcn.004460fd
cmp dword [esp + 0x10], 0
je 0x4464fe
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call fcn.0044646e
test eax, eax
jne 0x4464fd
call esi
sub eax, edi
cmp eax, 0x32
jb 0x4464eb
pop edi
call fcn.00446325
call fcn.0044637c
mov al, bl
pop esi
pop ebx
ret 8
Function at 0x446a03
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ax, word [0x6afc6a]
push esi
push edi
push 2
pop edi
xor esi, esi
push edi
push eax
mov ax, word [0x6afc68]
push eax
call fcn.0044a0e8
test al, 1
jne 0x446a3c
mov ax, word [0x6afc6a]
push esi
push eax
mov ax, word [0x6afc68]
push eax
call fcn.0044a0e8
and al, 7
cmp al, 7
jge 0x446a3f
push 1
pop esi
mov ax, word [0x6afc6a]
push 0
push eax
mov ax, word [0x6afc68]
push eax
call fcn.0044a0e8
or al, 7
push eax
mov ax, word [0x6afc6a]
push 0
push eax
mov ax, word [0x6afc68]
push eax
call fcn.0044a0ae
mov ax, word [0x6afc6a]
push edi
push eax
mov ax, word [0x6afc68]
push eax
call fcn.0044a0e8
and ax, 0xde
push eax
mov ax, word [0x6afc6a]
push edi
push eax
mov ax, word [0x6afc68]
push eax
call fcn.0044a0ae
test esi, esi
je 0x446ae5
mov ax, word [0x6afc6a]
push 0
push eax
mov ax, word [0x6afc68]
push eax
call fcn.0044a0e8
mov word [0x6af82a], ax
mov ax, word [0x6afc6a]
push edi
push eax
mov ax, word [0x6afc68]
push eax
call fcn.0044a0e8
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [0x6af828], ax
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x78
jb 0x446adc
pop edi
pop esi
ret

Function at 0x448621
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp word [ebp + 0xc], 0
jle 0x448642
movsx ecx, word [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [eax]
add dl, byte [ebp + 0x10]
inc dl
xor dl, byte [ebp + 0x14]
mov byte [eax], dl
inc eax
dec ecx
jne 0x448632
pop ebp
ret 0x10

Function at 0x4486d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp word [ebp + 0xc], 0
jle 0x4486f9
mov cl, byte [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
movsx esi, word [ebp + 0xc]
not cl
mov dl, byte [eax]
xor dl, byte [ebp + 0x14]
add dl, cl
mov byte [eax], dl
inc eax
dec esi
jne 0x4486eb
pop esi
pop ebp
ret 0x10

Function at 0x449662
Capabilities:
Create service
Get common file path
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push esi
push edi
lea eax, [ebp - 0xa4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xa4]
push 0x45d8f4
push eax
call esi
mov edi, str.IWPORT
lea eax, [ebp - 0xa4]
push edi
push eax
call esi
lea eax, [ebp - 0xa4]
push 0x45d908
push eax
call esi
xor esi, esi
lea eax, [ebp - 0xa4]
push esi
push esi
push str.Parallel_arbitrator
push esi
push str.Extended_base
push eax
push 1
push 2
push 1
push 0xf01ff
push edi
push edi
push dword [0x45d8a4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
cmp edi, esi
jne 0x4496f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x4496f5
push 1
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x449702
Capabilities:
Get common file path
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push edi
mov edi, str.IWPORT
push 0xf01ff
push edi
xor ebx, ebx
push dword [0x45d8a4]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4497c0
push esi
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x420
push 0x80
neg eax
sbb eax, eax
inc eax
or dword [ebp - 4], eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xac]
push 0x45d8f4
push eax
call esi
lea eax, [ebp - 0xac]
push edi
push eax
call esi
lea eax, [ebp - 0xac]
push 0x45d908
push eax
call esi
push edi
push ebx
push ebx
push str.Parallel_arbitrator
push ebx
lea eax, [ebp - 0xac]
push str.Extended_base
push eax
push 1
push 2
push 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x4497c7
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [0x45d8a4], eax
je 0x44981f
push esi
push edi
push 0xf01ff
push str.IWPORT
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x449815
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov ebx, eax
call edi
push dword [0x45d8a4]
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x449885
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
xor ebx, ebx
push edi
cmp dword [0x6af814], ebx
lea eax, [ebp - 0x16c]
push 0x45d918
push eax
je 0x4498f0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x16c]
push str.IWPORT
push eax
call esi
lea eax, [ebp - 0x16c]
push str..VXD
push eax
call esi
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x16c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x45d898], eax
jmp 0x449a08
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x16c]
push str.IWPORT
push eax
call esi
mov eax, dword [ebp + 8]
inc eax
push eax
lea eax, [ebp - 8]
push 0x45d920
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x16c]
push eax
call esi
push 1
mov edi, 0x80
pop eax
push ebx
push edi
push 3
mov dword [0x45d89c], eax
mov dword [0x45d8a0], eax
push ebx
push ebx
lea eax, [ebp - 0x16c]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x45d898], eax
jne 0x449a08
lea eax, [ebp - 0x6c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x6c]
push 0x45d8f4
push eax
call esi
lea eax, [ebp - 0x6c]
push str.IWPORT
push eax
call esi
lea eax, [ebp - 0x6c]
push 0x45d908
push eax
call esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call sub.MSVCRT.dll__access
pop ecx
test eax, eax
pop ecx
jne 0x449a08
push 0xf003f
push ebx
push ebx
mov dword [0x45d8a0], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [0x45d8a4], eax
je 0x449a08
call fcn.00449702
test eax, eax
jne 0x4499df
mov dword [0x45d89c], ebx
call fcn.00449662
test eax, eax
je 0x4499fc
call fcn.00449702
test eax, eax
je 0x4499fc
push ebx
push edi
push 3
push ebx
push ebx
lea eax, [ebp - 0x16c]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x45d898], eax
push dword [0x45d8a4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x44b393
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x101
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test ax, ax
jne 0x44b3c3
and dword [ebp - 4], 0
and byte [ebp - 0x148], al
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test ax, ax
jne 0x44b3e4
and dword [ebp - 8], 0
and byte [ebp - 0x18], al
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.0044b4e7
test ax, ax
jle 0x44b47d
mov ecx, dword [ebp + 0xc]
movsx edx, cx
movsx eax, ax
dec edx
cmp eax, edx
jle 0x44b410
lea eax, [ecx - 1]
movsx eax, ax
and byte [ebp + eax - 0x34], 0
mov edx, dword [ebp - 4]
lea esi, [ecx - 1]
lea edx, [eax + edx + 1]
cmp edx, esi
jle 0x44b454
sub ecx, eax
sub ecx, 2
mov dword [ebp - 4], ecx
jns 0x44b42d
xor ecx, ecx
mov dword [ebp - 4], ecx
and byte [ebp + ecx - 0x148], 0
lea eax, [ebp + ecx - 0x148]
cmp ecx, 3
jle 0x44b454
push 3
add eax, 0xfffffffd
push 0x45d934
push eax
call sub.MSVCRT.dll_strncpy
add esp, 0xc
cmp dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
jle 0x44b46e
lea eax, [ebp - 0x148]
push 0x45d938
push eax
call esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x148]
push eax
call esi
jmp 0x44b4d2
mov esi, dword [ebp + 0xc]
push ebx
lea ebx, [esi - 1]
cmp dword [ebp - 4], ebx
jge 0x44b4b8
cmp dword [ebp - 4], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
jle 0x44b4aa
cmp dword [ebp - 8], 0
jle 0x44b4aa
lea eax, [ebp - 0x148]
push 0x45d93c
push eax
call edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x148]
push eax
call edi
pop edi
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebx
pop ebx
jle 0x44b4d2
and byte [ebp + esi - 0x149], 0
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
leave
ret 8
Function at 0x44c1cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 0xa8]
xor edi, edi
push 0x80
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xa8]
push str.SYSTEM32DRIVERS_
push eax
call esi
cmp dword [0x6afc6c], 9
jne 0x44c213
push str.IWUSB_X64
jmp 0x44c218
push str.IWUSB
lea eax, [ebp - 0xa8]
push eax
call esi
lea eax, [ebp - 0xa8]
push str..SYS
push eax
call esi
push str.VERSION.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
call fcn.0044502c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoSizeA
push ebx
call esi
lea ecx, [ebp - 0x10]
mov dword [0x6afba8], eax
push ecx
lea ecx, [ebp - 0xa8]
push ecx
call eax
cmp eax, edi
mov dword [ebp - 4], eax
je 0x44c368
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push str.GetFileVersionInfoA
push ebx
mov edi, eax
call esi
push edi
lea ecx, [ebp - 0xa8]
push dword [ebp - 4]
mov dword [0x6afbac], eax
push dword [ebp - 0x10]
push ecx
call eax
push 0x45db24
push ebx
call esi
lea ecx, [ebp - 0x28]
mov dword [0x6afbb0], eax
push ecx
lea ecx, [ebp - 0x24]
push ecx
push str.VarFileInfoTranslation
push edi
call eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
movzx eax, word [eax]
shr ecx, 0x10
push ecx
push eax
lea eax, [ebp - 0x10c]
push str.StringFileInfo_04hX_04hXFileVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.VerQueryValueA
push ebx
call esi
lea ecx, [ebp - 0x28]
mov dword [0x6afbb0], eax
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push edi
call eax
test eax, eax
jne 0x44c304
xor edi, edi
jmp 0x44c34f
and byte [ebp - 0x20], 0
and byte [ebp - 0x18], 0
push 1
lea eax, [ebp - 0x20]
push dword [ebp - 0xc]
push eax
call sub.MSVCRT.dll_strncat
mov eax, dword [ebp - 0xc]
push 2
add eax, 2
push eax
lea eax, [ebp - 0x18]
push eax
call sub.MSVCRT.dll_strncat
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_atoi
xor edx, edx
mov dh, al
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], edx
call sub.MSVCRT.dll_atoi
mov ecx, dword [ebp - 4]
add esp, 0x20
or ecx, eax
mov edi, ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.004450b1
mov ax, di
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6aa490
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x65b015
lea edi, [esi - 0x25a015]
push edi
or ebp, 0xffffffff
jmp 0x6aa4b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6aa4b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6aa4a8
mov eax, 1
add ebx, ebx
jne 0x6aa4cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6aa4dc
jne 0x6aa4fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6aa4fb
dec eax
add ebx, ebx
jne 0x6aa4e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6aa4c0
add ebx, ebx
jne 0x6aa4f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6aa54d
xor ecx, ecx
sub eax, 3
jb 0x6aa513
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6aa582
sar eax, 1
mov ebp, eax
jmp 0x6aa51e
add ebx, ebx
jne 0x6aa51e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6aa4ec
inc ecx
add ebx, ebx
jne 0x6aa52c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6aa4ec
add ebx, ebx
jne 0x6aa539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6aa52e
jne 0x6aa54a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6aa52e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6aa56c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6aa55e
jmp 0x6aa4ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6aa56c
add edi, ecx
jmp 0x6aa4ae
pop esi
mov edi, esi
mov ecx, 0xae86
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6aa58a
cmp byte [edi], 0xe
jne 0x6aa58a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6aa58f
lea edi, [esi + 0x2a8000]
mov eax, dword [edi]
or eax, eax
je 0x6aa607
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2aa534]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2aa570]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6aa5bc
mov ecx, edi
jns 0x6aa5eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2aa578]
or eax, eax
je 0x6aa601
mov dword [ebx], eax
add ebx, 4
jmp 0x6aa5d9
call dword [esi + 0x2aa574]
mov ebp, dword [esi + 0x2aa57c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6aa63b
sub esp, 0xffffff80
jmp 0x402ba0
Function at 0x77a5cb
Capabilities:
Check for trap flag exception

Disassembly:
mov esi, dword [esp + 0xc]
mov dl, byte [esp]
not edx
mov dl, al
jmp 0x77a611
mov ebp, dword [esp + 0x10]
mov dh, byte [esp]
mov edx, dword [esp]
setae dl
mov edx, dword [esp]

Function at 0x77a656
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
lea esp, [esp + 4]
pop word [esp]
lea esp, [esp + 2]
jmp 0x77a658
jmp 0x77a640
push eax
not ax
mov eax, dword [esp]
mov ax, bx
mov ax, 0x10b2
setle ah
jmp 0x77a6b7
not edx
lea eax, reloc.RASAPI32.dll_RasGetConnectStatusA
xchg di, ax
mov dx, 0xa54b
jmp 0x77a70e
rdtsc
pushal
bswap edx
mov dword [esp + 0x13], edi
mov ax, cx
mov ah, byte [esp]
jmp 0x77a681
push edx
lea edx, [edx*4]
not dh
xchg edx, eax
mov dx, 0x8d8e
lea edx, [ecx*4]
jmp 0x77a697
mov edi, dword [esp]
mov edi, dword [esp + 0x13]
setne dl
setns dl
rdtsc
lea edx, [edi*4]
call fcn.0077a6e5

Function at 0x792267
Capabilities:
Encrypt data using aes

Disassembly:
call 0x792252
mov eax, dword [ebp + 8]
lea edx, reloc.RASAPI32.dll_RasGetConnectStatusA
jmp 0x792236
jmp 0x79227f
xchg cx, di
jmp 0x791ec6
not ch
mov ecx, dword [ebp + 0x10]
neg edi
jmp 0x791f07
mov edi, dword [ecx + eax*4]
jmp 0x791f3a
mov eax, dword [ebp + 0x14]
sub esp, 8
not edi
mov edi, edx
jmp 0x791ef1
lea esp, [esp + 8]
push 0x20
stc
push bp
lea ecx, [edi*4]
jmp 0x793a65
mov edx, esi
mov cl, byte [esp]
bswap ecx
jmp 0x792257
lea esp, [esp + 4]
lea ecx, reloc.RASAPI32.dll_RasGetConnectStatusA
call 0x792267
lea esp, fs:[esp + 4]
jmp 0x792317
dec dword [ebp + 0x14]
jns 0x791bd7
pop ebx
jmp 0x75e6fc
lea eax, reloc.RASAPI32.dll_RasGetConnectStatusA
jmp 0x7922da
pop edi
mov esi, dword [esp]
mov eax, esp
mov dword [ebp + 0x14], 0x30c
mov esi, ebp
jmp 0x79228e
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0x791bbf
call 0x77b7cb
lea esi, [edx*4]
mov esi, dword [esp]
mov edi, 0x669baf9c
bswap eax
jmp 0x7922a4
lea esp, [esp + 4]
dec ebx
jne 0x791b77
je 0x791b61
mov byte [esp], dh
shl edi, 2
jmp 0x79249d
lea esp, [esp + 2]
pop ecx
push cx

Function at 0x7922b5
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jmp 0x7922bf
mov byte [eax], 0
inc eax
jmp 0x791bbf
Function at 0x7928a5
Capabilities:
Encrypt data using aes

Disassembly:
call 0x792252
mov eax, dword [ebp + 8]
lea edx, reloc.RASAPI32.dll_RasGetConnectStatusA
jmp 0x792236
jmp 0x79227f
xchg cx, di
jmp 0x791ec6
not ch
mov ecx, dword [ebp + 0x10]
neg edi
jmp 0x791f07
mov edi, dword [ecx + eax*4]
jmp 0x791f3a
mov eax, dword [ebp + 0x14]
sub esp, 8
not edi
mov edi, edx
jmp 0x791ef1
lea esp, [esp + 8]
push 0x20
stc
push bp
lea ecx, [edi*4]
jmp 0x793a65
mov edx, esi
mov cl, byte [esp]
bswap ecx
jmp 0x792257
lea esp, [esp + 4]
lea ecx, reloc.RASAPI32.dll_RasGetConnectStatusA
call 0x792267
lea esp, fs:[esp + 4]
jmp 0x792317
dec dword [ebp + 0x14]
jns 0x791bd7
pop ebx
jmp 0x75e6fc
lea eax, reloc.RASAPI32.dll_RasGetConnectStatusA
jmp 0x7922da
pop edi
mov esi, dword [esp]
mov eax, esp
mov dword [ebp + 0x14], 0x30c
mov esi, ebp
jmp 0x79228e
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0x791bbf
call 0x77b7cb
lea esi, [edx*4]
mov esi, dword [esp]
mov edi, 0x669baf9c
bswap eax
jmp 0x7922a4
lea esp, [esp + 4]
dec ebx
jne 0x791b77
je 0x791b61
mov byte [esp], dh
shl edi, 2
jmp 0x79249d
lea esp, [esp + 2]
pop ecx
push cx
Function at 0x793009
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
popal
shr edi, 0x18
pushfd
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasGetConnectStatusA]
jmp 0x79302d
clc
push cx
lea esp, [esp + 2]
jmp 0x793017
lea esp, [esp + 3]
lea esp, [esp + 1]
lea esp, [esp + 4]
jmp 0x792fe2
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasGetConnectStatusA]
jmp 0x793054
pushal
mov byte [esp + 0xc], ah
lea esp, [esp + 0x13]
lea esp, [esp + 1]
and edi, ecx
jmp 0x792ff0
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasGetConnectStatusA]
sub esp, 5
jmp 0x793061
and ebx, ecx
push cx
add esp, 1
lea esp, [esp + 1]
jmp 0x79303e
lea esp, [esp + 1]
push ecx
mov ecx, esi
jmp 0x7930ab
add ecx, 6
movzx ebx, byte [ecx]
pop ecx
push ecx

Function at 0x7930f4
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 0xc], di
jmp 0x79312d
and edx, ecx
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasGetConnectStatusA]
sub esp, 1
lea esp, [esp + 1]
jmp 0x793117

Function at 0x793161
Capabilities:
Encrypt data using aes

Disassembly:
lea ebx, [edx + ebx]
push eax
pushal
bswap ebx
jmp 0x7930d5
pushfd
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasGetConnectStatusA]
jmp 0x7930eb

Function at 0x79320f
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasGetConnectStatusA]
lea edx, [eax + edx]
jmp 0x7931fb
inc dl
mov dl, 0x21
mov edx, dword [esi + 8]
call fcn.0079318c
and ebx, ecx
call 0x79320f
adc al, 0x8d
and al, 3
pushal
lea esp, [esp + 1]
jmp 0x793238
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasGetConnectStatusA]
mov bl, byte [esp]
mov bh, byte [esp]
jmp 0x793760
mov ebx, dword [edi]
pop edi
call 0x793275
push edi
mov edi, ebx
lea edi, [edi*4]
lea edi, reloc.RASAPI32.dll_RasGetConnectStatusA
jmp 0x7932b4
movzx ebx, byte [esi + 0xa]
pushfd
add esp, 3
lea esp, [esp + 1]
jmp 0x793384

Function at 0x7932bc
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x7932e6
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasGetConnectStatusA]
and edx, ecx
jmp 0x79332d
lea esp, [esp + 0x1c]

Function at 0x793399
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x7933e3
lea esp, [esp + 3]
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasGetConnectStatusA]
neg bx
dec bl
jmp 0x7933cd
mov dword [esp], ebx
and ebx, ecx
sub esp, 0x1f
clc
push dword [esp + 0x10]
jmp 0x79339b

Function at 0x793439
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x793460