joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bfb0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0xf80404]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x45bfc3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x45c004
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0xf804ac]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x45c036
mov bl, byte [esp + ecx + 0x4c]
jmp 0x45c03a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x45c02b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x45c058
mov bl, byte [esp + ecx + 0x4c]
jmp 0x45c05c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x45c04d
xor ecx, ecx
mov eax, 0xf80414
xor ebx, ebx
mov bl, byte [ecx + 0xf804bc]
cmp byte [esp + ebx + 0x14], 0
je 0x45c087
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0xf804d4]
cmp byte [esp + ebx + 0x14], 0
je 0x45c09e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x45c06e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x45bff7
lea edx, [esp + 0x84]
push edx
call fcn.0045c0e0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x461070
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xfadc44]
xor edx, edx
cmp eax, edx
jne 0x461096
xor eax, eax
mov byte [eax + 0xfadb44], al
inc eax
cmp eax, 0x100
jl 0x46107e
mov dword [0xfadc44], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xfadb44
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x461127
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4610fa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4610c8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x461130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x461183
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x46116a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x467b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a068e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00468440
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xea1794
call fcn.00491d5d
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x467bb3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00491d5d
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x467bac
push 0
mov ecx, eax
call fcn.0045ecb0
mov dword [esi + 0xc], eax
jmp 0x467bb5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x467bb5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4943c0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4943f8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00492477
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049244f
jmp 0x494404
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x495ab6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x495af8
call fcn.0049b565
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x495af8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x495aef
xor eax, eax
jmp 0x495b00
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00495b06
pop edi
pop esi
pop ebx
ret 4

Function at 0x49ba95
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49bac3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49bae1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049b9fb
jmp 0x49bae1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49bae1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049b9fb
test edi, edi
mov eax, edi
jne 0x49bacb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4012f0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0xa4
mov dword [ebp - 0xc], str.c:windows_system32driversetchosts
mov eax, dword [str._r_n222.25.191.83___www.baidu.com]
mov dword [ebp - 0x58], eax
mov eax, dword [0x40302c]
mov dword [ebp - 0x54], eax
mov eax, dword [0x403030]
mov dword [ebp - 0x50], eax
mov eax, dword [0x403034]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x403038]
mov dword [ebp - 0x48], eax
mov eax, dword [0x40303c]
mov dword [ebp - 0x44], eax
mov eax, dword [0x403040]
mov dword [ebp - 0x40], eax
mov eax, dword [0x403044]
mov dword [ebp - 0x3c], eax
movzx eax, byte [0x403048]
mov byte [ebp - 0x38], al
lea edi, [ebp - 0x37]
cld
mov ecx, 0x11
mov al, 0
rep stosb byte es:[edi], al
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0xc
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
lea eax, [ebp - 0x68]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0x10000000
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xffffffff
jne 0x4013ed
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.File_open_failed
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov dword [ebp - 0x7c], 0xffffffff
jmp 0x401545
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sym._lstrlenA_4
sub esp, 4
lea edx, [eax + 1]
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x70]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
lea eax, [ebp - 0x58]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40145b
cmp dword [ebp - 0x70], 0
jne 0x401487
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.WriteFile_failed.
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
jmp 0x40153e
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.YEAH
mov dword [esp + 4], str.Handle_succeed.
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str._flushdns
mov dword [esp + 8], str.ipconfig
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x1f
jbe 0x401517
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.YEAH
mov dword [esp + 4], str.ShellExecute_succeed.
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
jmp 0x40153e
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.FUCK
mov dword [esp + 4], str.ShellExecute_failed.
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
mov edi, dword [ebp - 4]
leave
ret 0x10
Function at 0x401550
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00401b80
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x401588
jmp 0x401624
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x401587
cmp cl, 0x22
je 0x4015e0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x401600
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x401600
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x4015c0
jmp 0x401600
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x4015e0
cmp cl, 0x22
je 0x401660
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40161e
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or eax, edx
test al, 1
jne 0x401610
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x401642
movzx edx, word [ebp - 0x28]
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x401600

Function at 0x401c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x4d1d84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x106733c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x4d1e48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4d1dbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x4d1e5f
dec edx
je 0x4d1ea0
jmp 0x4d1efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4d1efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d1f60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4d1f7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4d208f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4d1fb0
je 0x4d1ffc
sub ecx, 0x2b
je 0x4d1ff2
sub ecx, 4
je 0x4d1ff7
dec ecx
sub ecx, 0xa
jb 0x4d1fe1
jmp 0x4d1fff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4d1fc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4d1fd0
jmp 0x4d1fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4d1fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4d1fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4d1fff
mov byte [eax], 0x3e
jmp 0x4d1fff
mov byte [eax], 0x3f
jmp 0x4d1fff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4d1f8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4d204f
cmp byte [esp + 3], 0xff
jne 0x4d204f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4d2087
cmp dl, 0xff
je 0x4d2087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4d1f88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x4d211c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x10787a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x4d2138
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d213a
shr eax, 1
dec edx
jne 0x4d212b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4d2124
pop ebx
ret
Function at 0x4d2150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4d2159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c9a38
xor eax, eax
push ebp
push 0x4d2239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004d211c
mov eax, dword [0x1077e0c]
mov byte [eax], 0
mov dword [ebx], reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [ebp - 4]
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.004c7e7c
mov edx, 1
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.004c8218
call fcn.004c7ba8
test eax, eax
jne 0x4d2216
lea eax, [ebp - 8]
push eax
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov ecx, 0xfff1
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.004c7fcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x4d2210
lea eax, reloc.RASAPI32.dll_RasHangUpA
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x4d21ec
cmp dword [ebp - 8], 0
jne 0x4d21c3
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.004c7fec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2240
lea eax, [ebp - 4]
call fcn.004c9588
ret

Function at 0x4dd718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4dd738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4dd726
pop edi
pop esi
pop ebx
ret
Function at 0x4e5fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x1078cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004e5f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.004e5fac
mov dword [ebx], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004e5f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.004e5fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004e5f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.004e5fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004e5f70
mov edi, eax
mov eax, edi
call fcn.004e5fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x4e5fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e6138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x4e616d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x4e6193
inc ebx
cmp ebx, 0xf
jne 0x4e617d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x4e614f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x797236
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 4]
jmp 0x7c97b7
push esi
jmp 0x7c9881
lea esp, [esp + 0x20]
push edi
sub esp, 0x10
jmp 0x7c98a7
movzx eax, byte [edx]
pushal
push word [esp + 0xf]
lea esp, [esp + 2]
jmp 0x7c9851
bswap esi
bswap esi
mov esi, eax
mov cl, byte [esi]
jmp 0x7c9868
sub esp, 8
lea esp, [esp + 1]
jmp 0x7c9c82
lea esp, [esp + 0x10]
movzx edi, cl
sub esp, 2
push word [esp + 1]
add esp, 3
jmp 0x7c988b
jne 0x7c97d3
je 0x7c983b
sub eax, edi
push esp
mov byte [esp + 1], ah
lea esp, [esp + 0xc]
jmp 0x7c99d4

Function at 0x7a294c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], sp
jmp 0x7a29bd
btc edx, ebx
ror bh, 3
jmp 0x7a2a72
lea esp, [esp + 1]
lea esp, [esp + 3]
lea esi, [esp]
bswap ecx
cmc
jmp 0x7a2a8c
jmp 0x7a2a4f
not ebx
jmp 0x7a27bd
mov edi, esp
mov ecx, ebp
rdtsc
shl cx, cl
jnp 0x7a29d0
mov ax, 0x1231
jmp 0x7a2a53
mov ax, 0x1231
mov ecx, ebp
mov ax, 0xc069
mov bx, word [esp]
xchg edx, eax
jmp 0x7a29d2
sub esp, 0xc0
jmp 0x7a29fb
jno 0x7a29a7
btc edx, ebx
ror bh, 3
jmp 0x7a2a72

Function at 0x7a3796
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov dh, ch
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov ax, 0xde87
jmp 0x7a3e0b
mov eax, ecx
inc al
xchg dword [esp], ecx
dec edx
neg dx
setl dh
jmp 0x7a3884
sub esp, 2
lea esp, [esp + 2]
lea ecx, [ecx + 0x1f]
rdtsc
xchg dx, ax
mov dx, sp
jmp 0x7a3a0b
mov dh, bh
xchg dword [esp], ecx
mov dh, bh
rol dh, 3
xchg edx, eax
mov dl, byte [esp]
jmp 0x7a3c7a

Function at 0x7cc2d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
mov word [esp], dx
mov word [esp], di
mov edx, 0xcfc3e190
shl dx, cl
add esp, 1
jmp 0x7cc3d7
mov dh, byte [esp + 1]
dec edx
je 0x7cc29f
bswap edx
jmp 0x7cc2dc
pop dx
jmp 0x7cc2ba
mov word [esp], dx
mov word [esp], di
mov edx, 0xcfc3e190
jmp 0x7cc61f
push edx
lea edx, [eax + 0x19]
lea esp, [esp + 1]
lea esp, [esp + 4]
sub cl, al
jmp 0x7cc33f
shl dx, cl
jmp 0x7cc2b1