joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f00
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
xor eax, eax
mov word [ebp - 0x460], ax
mov word [ebp - 0x668], ax
lea eax, [ebp - 0x668]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4020cc
cmp eax, 0x104
jae 0x4020cc
push ebx
push esi
push edi
xor ebx, ebx
jmp 0x401f50
mov esi, dword [ebx + 0x40138c]
xor eax, eax
mov word [ebp - 0x254], ax
mov word [ebp - 0x45c], ax
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x45c]
push 0x104
push eax
call fcn.00402ef0
add esp, 0xc
test al, al
je 0x4020bd
push esi
lea eax, [ebp - 0x45c]
push 0x104
push eax
call fcn.00402ea0
add esp, 0xc
test al, al
je 0x4020bd
push 0x401384
lea eax, [ebp - 0x45c]
push 0x104
push eax
call fcn.00402ea0
add esp, 0xc
test al, al
je 0x4020bd
push 0x24c
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x250], 0
push 0
push eax
call fcn.00402dc0
add esp, 0xc
lea eax, [ebp - 0x250]
push 0
push 0
push 1
push eax
push 0
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4020bd
xor eax, eax
mov word [ebp - 0x66c], ax
mov word [ebp - 0x874], ax
mov edi, edi
test byte [ebp - 0x250], 0x10
je 0x4020a0
cmp word [ebp - 0x1c], 0
lea esi, [ebp - 0x1c]
lea eax, [ebp - 0x224]
cmove esi, eax
test esi, esi
je 0x402059
cmp word [esi], 0x2e
jne 0x402059
movzx eax, word [esi + 2]
test ax, ax
je 0x4020a0
cmp eax, 0x2e
jne 0x402059
cmp word [esi + 4], 0
je 0x4020a0
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x874]
push 0x104
push eax
call fcn.00402ef0
add esp, 0xc
test al, al
je 0x4020a0
push esi
lea eax, [ebp - 0x874]
push 0x104
push eax
call fcn.00402ea0
add esp, 0xc
test al, al
je 0x4020a0
lea eax, [ebp - 0x874]
push eax
call fcn.004024d0
add esp, 4
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402020
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
add ebx, 4
cmp ebx, 8
jb 0x401f50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4021b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
xor eax, eax
mov word [ebp - 4], ax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4021ff
cmp eax, 0x104
jae 0x4021ff
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call fcn.00401e00
add esp, 8
test al, al
je 0x4021ff
mov al, 1
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jae 0x40224e
test eax, eax
je 0x40224e
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402df0
add esp, 8
test eax, eax
je 0x40224e
push dword [ebp + 0xc]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call fcn.00401e00
add esp, 8
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x402260
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4024d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push esi
mov esi, dword [ebp + 8]
push edi
push 0x104
push esi
call fcn.00402f40
push 0x401378
push 0x104
push esi
mov edi, eax
call fcn.00402ea0
add esp, 0x14
test al, al
je 0x4025dc
push ebx
push 0x24c
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x250], 0
push 0
push eax
call fcn.00402dc0
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4025c6
cmp word [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x224]
cmove ecx, eax
test ecx, ecx
je 0x402570
cmp word [ecx], 0x2e
jne 0x402570
movzx eax, word [ecx + 2]
test ax, ax
je 0x4025ad
cmp eax, 0x2e
jne 0x402570
cmp word [ecx + 4], 0
je 0x4025ad
lea eax, [edi + 1]
cmp eax, 0x104
jae 0x402580
xor edx, edx
mov word [esi + eax*2], dx
push ecx
push 0x104
push esi
call fcn.00402ea0
add esp, 0xc
test al, al
je 0x4025ad
test byte [ebp - 0x250], 0x10
push esi
je 0x4025a7
call fcn.004024d0
add esp, 4
jmp 0x4025ad
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x250]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402540
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
cmp edi, 0x104
jae 0x4025d5
xor eax, eax
mov word [esi + edi*2], ax
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4025f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
push 0
push eax
call fcn.00402dc0
add esp, 0xc
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x10], xmm0
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x402642
xor al, al
mov esp, ebp
pop ebp
ret
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0x10]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40266f
push dword [ebp - 0x10]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x402686
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
neg eax
sbb al, al
and bl, al
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402c60
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
push esi
call fcn.00401f00
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0x65
call fcn.00401590
lea ecx, [ebp - 0x20]
call fcn.00401600
test al, al
je 0x402d8a
mov eax, dword [ebp - 0x10]
dec eax
je 0x402d9c
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x43c], ax
mov word [ebp - 0x644], ax
lea eax, [ebp - 0x644]
push eax
push esi
call fcn.004021b0
add esp, 8
test al, al
jne 0x402cd3
lea ecx, [ebp - 0x20]
mov esi, 0x65
call fcn.004015c0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp - 0x24], ax
mov word [ebp - 0x22c], ax
mov word [ebp - 0x230], ax
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.00402870
add esp, 0x14
test al, al
jne 0x402d1d
mov dword [ebp - 4], 0x66
jmp 0x402d5c
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004026a0
mov ecx, dword [ebp - 4]
add esp, 0x10
test al, al
mov edx, 0x67
cmove ecx, edx
mov dword [ebp - 4], ecx
call fcn.00402800
test al, al
je 0x402d8a
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x22c]
push eax
call esi
lea eax, [ebp - 0x438]
push eax
call esi
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x20]
call fcn.004015c0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
xor esi, esi
call fcn.004015c0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403140
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40315f
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x403177
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
push dword [esi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4031c8
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x4031d3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
test eax, eax
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5b13d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 1]
pop eax
rdtsc
jmp 0x5b136d
neg eax
mov edx, dword [esp + 1]
pop eax
rdtsc
mov dl, ah
jmp 0x5b13ab
mov dl, ah
jmp 0x5b13ab
call fcn.005b1395
or dword [ecx + reloc.RASAPI32.dll_RasHangUpA], ecx
test eax, 0x2adfb82a
xlatb
leave
dec edi
fistp qword [edx + 0x66620049]
xchg edx, eax
xchg dx, ax
bsf ax, ax
js 0x5b135c
neg eax
jmp 0x5b1346
rol cl, 0
bsf ax, dx
jl 0x5b1371
jge 0x5b1371
jmp 0x5b13f8
lea esp, [esp + 4]
sub cl, 0x54
cmc
ja 0x5b13e0
jbe 0x5b144b
jae 0x5b13bc
pushal
pop es
aam 0x77
mul dword [edi + 2]
int1
lds ebp, [edx - 0x7b]
xor al, 0x27
dec esi
mov edx, 0xd1ab6cff
jmp 0x5b1389
not edx
lea edx, [ecx*4]
shl dh, 3
call fcn.005b141b
fcomp qword [ecx - 0x37]
test al, 0x5b
add bh, byte [eax]
bt edx, ebx
lea eax, reloc.RASAPI32.dll_RasHangUpA
bswap edx
jmp 0x5b13b8
not edx
lea edx, [ecx*4]
shl dh, 3
jmp 0x5b13ec

Function at 0x5b141b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
sub cl, 0xa9
cmp al, dh
ja 0x5b1433
lea eax, [ebx + edi]
rdtsc
jmp 0x5b1459
jmp 0x5b1405
rdtsc
lea edx, [ecx + esi]
jmp 0x5b14a5
lea eax, [ebx + edi]
jmp 0x5b141d
lea edx, [ecx + esi]
jmp 0x5b14a5
dec ah
jmp 0x5b1466
push esp
mov edx, ecx
btc ax, dx
ja 0x5b148a
setle al
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x5b148c
ror cl, 0
sub esp, 0
jne 0x5b145e
dec ah
push esp
jmp 0x5b1467
Function at 0x5b407d
Capabilities:
Encrypt data using aes

Disassembly:
call 0x5b407d
jl 0x5b407a
salc
inc ecx
nop
push ebp
invalid
push esi
bswap esi
shl esi, cl
ror si, 0xb
push edi
jmp 0x5b4063
mov edi, 0x5c00bc
mov esi, dword [edi]
pop edi
clc
sub esp, 1
lea esp, [esp + 1]
jmp 0x5b40a0
mov ch, 0x67
in eax, 0x8d
and al, 0x24
lea esp, [esp + 8]
jmp 0x5b4053
and dword [ebx], 0
stc
push edi
call fcn.005b4086

Function at 0x5b4086
Capabilities:
Encrypt data using aes

Disassembly:
push 0x5bf740
push esp
jmp 0x5ee422
jmp fcn.005ee4f7
lea eax, [edx + 0x2c]
jmp 0x5b40e9
push 4
jmp 0x5eeaa5
jmp 0x5b40aa
lea esp, [esp + 4]
test esi, esi
jne 0x5b403d
pushfd
jmp 0x5b4123
mov ax, word [esp]
call fcn.005b4163
adc ecx, dword [edx + reloc.RASAPI32.dll_RasHangUpA]
sub al, dh
jle 0x5b40fe
xchg esp, eax
clc
inc eax
mov edi, eax
test edi, edi
jne 0x5b3fe2
je 0x5b400e
invalid
lea esp, [esp + 4]
push 0x5bf730
call fcn.005cc676
out 0xf5, eax
jmp 0x5b40ff
invalid
mov dword [esp], edi
call fcn.005cc7a7
jp 0x5ee3b7
invalid
jne 0x5b3ff8
call fcn.005ee90c
xor eax, eax
jmp 0x5ee763
push ebx
call esi
test eax, eax
jmp 0x5eea0e

Function at 0x5c01ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 0x30]
rdtsc
jmp 0x5c01d9
bsf eax, ecx
jp 0x5c0215
sub esp, 3
pop cx
jmp 0x5c0250
sub esp, 3
pop cx
call 0x5c0220
or dword [edx + reloc.RASAPI32.dll_RasHangUpA], 0x243c8b66
lea ebp, [ebx + esi]
xchg dword [esp], esi
jmp 0x5c0301
rdtsc
not cx
stc
bsf ax, ax
mov dx, 0xb70d
push dword [esp + 0x18]
ret 0x1c
sub esp, 0x1a
lea edi, [ecx + ebp]
neg edi
rdtsc
lea esp, [esp + 2]
xchg dword [esp + 0x18], esi
jmp 0x5c0266
mov ebp, dword [esp]
dec ecx
lea ecx, [ebp - 0x5d]
xchg al, dl
lea esi, [esi - 0x20]
lea ecx, [ebp*4]
jmp 0x5c0280

Function at 0x5c05b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx + 0x8d]
sets al
rcr dx, cl
pushal
shl dh, 1
jmp 0x5c05fb
mov edx, ecx
rdtsc
rdtsc
mov dx, 0x6dd2
xchg dword [esp], edi
jmp 0x5c05a1
xchg dl, dh
xchg dx, ax
push dword [esp + 0x20]
ret 0x24
lea edi, [edi - 0x31]
bswap eax
xchg edx, eax
inc ax
xchg dword [esp + 0x20], edi
mov ah, cl
jmp 0x5c05e5
Function at 0x5c1d75
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
xchg dword [esp], eax
jmp 0x5c1d86
bswap edx
not dl
mov dx, di
mov edx, esi
lea eax, [eax + 8]
mov dl, ah
jmp 0x5c1dd4
cmp edx, 0x35457c73
neg dl
call 0x5c1da8
not edx
rcl edx, 0xd
jmp 0x5c1e64
mov dl, 0xf4
xor edx, 0x89948a06
neg edx
jmp 0x5c1e30
ror al, 0
bswap edx
or dl, ah
jbe 0x5c1ed3
ja 0x5c1e84
ljmp 0xff6c:0x769bfc6e
mov dl, 0xf4
xor edx, 0x89948a06
neg edx
jmp 0x5c1e30
dec al
setl dl
inc edx
je 0x5c1e04
jne 0x5c1e46
setnp dl
mov edx, dword [esp]
jmp 0x5c1edf
dec edx
lea edx, [ecx + esi]
sbb edx, ebp
jmp 0x5c1e6e
mov dx, si
mov dh, 0xd2
jmp 0x5c1eb3
neg dx
jl 0x5c1e8c
mov dx, si
mov dh, 0xd2
call fcn.005c1ee6
inc ecx
ret
bsf edx, edi
add bl, al
js 0x5c1f64
jns 0x5c1f64
jle 0x5c1ebe
outsb dx, byte [esi]
or eax, edi
invalid
dec edx
lea edx, [ecx + esi]
sbb edx, ebp
setnp dl
mov edx, dword [esp]
ror al, 0
mov edx, ebp
jmp 0x5c1ea2
and al, 0xeb
pop ebx
jmp 0x5c1fcf
call 0x5c1f4e
lahf
sbb byte [esi - 0xc86e717], cl
jne 0x5c1f57
invalid
mov cl, 0xb0
mov bl, 0xb8
aas
scasd eax, dword es:[edi]
jmp [ebp + 0x66]

Function at 0x5c1ee6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x2b70
lea edx, [esi*4]
pushfd
mov edx, esi
xchg dword [esp + 4], esi
call fcn.005c1f1a
scasd eax, dword es:[edi]
sub dword [ecx - reloc.RASAPI32.dll_RasHangUpA], edi
bsf edx, edi
jmp 0x5c1eb6

Function at 0x5c1f1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5c2082
btc edx, ebx
bsf dx, bp
mov dl, byte [esp]
xchg dword [esp + 4], esi
mov dl, 0x64
shr edx, cl
call fcn.005c1f4c
dec esi
setbe dh
sub esp, 0x18
jmp 0x5c204e
rdtsc
lea edx, [edi + ebp]
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov dh, dl
jmp 0x5c1fd2
sbb eax, esi
bt eax, ebp
jmp 0x5c1fe3
mov eax, 0x6dffaf3f
rol dx, 0xd
bsr ax, di
jle 0x5c1fbc
jg 0x5c2020
add cl, 0x19
mov al, 0x40
mov dh, byte [esp]
mov ax, 0xbb34
xchg dx, ax
jmp 0x5c200a
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov dh, dl
mov eax, 0x6dffaf3f
jmp 0x5c1fd7
lea edx, reloc.RASAPI32.dll_RasHangUpA
neg ax
jo 0x5c2027
mov al, ah
jmp 0x5c2032
sbb eax, esi
bt eax, ebp
jmp 0x5c1fe3
mov al, ah
rcr edx, 0x18
call fcn.005c20e5
mov es, ecx
ficomp dword [eax]
rcr edx, 0x18
jmp 0x5c205b
sub cl, 6
mov al, 0xbb
mov dx, 0xbbb7
sub ah, bh
jg 0x5c205d
jle 0x5c2065
sbb bl, byte [ecx - 0x516497f7]
js 0x5c20a9
jbe 0x5c1f9f
rdtsc
lea edx, [edi + ebp]
jmp 0x5c1ffb
jmp 0x5c2037
not al
call fcn.005c20fb
psadbw mm2, mm0
not al
adc edx, esi
jmp 0x5c2113
xchg dword [esp], edx
pop word [esp]
rcl dx, cl
lea esp, [esp + 2]
lea esi, [esi + 0x53]
mov edx, dword [esp]
jmp 0x5c1f7b
jmp 0x5c20ca
xchg dword [esp], eax
mov dl, 0x31
rdtsc
mov eax, ecx
sub esp, 0xc
push dword [esp + 0xc]
ret 0x10
call fcn.005c2dd3
xor byte [ebx - 0x7342b1d5], bh
push ss
pushfd
xor dl, byte [ebp - 0x5c]
and ebp, dword [ecx - 0x78]
sub ecx, dword [edi]
lahf
les ecx, [edi]
xchg edx, eax
les esp, [esi - 0x75]
add al, 0x24
Function at 0x5c4fc8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 3], edi
mov dword [esp + 2], edi
mov dword [esp + 4], ebx
call fcn.005c4fed
ficomp dword [edx + esi*8 - 0x6b]
insb byte es:[edi], dx
sub dword [eax - 0x15], ecx
add bh, byte [ebp + 0x50241489]
call fcn.005c4fc8

Function at 0x5ede11
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, dword [esi]
shr edi, cl
jmp 0x5ede14
cmc
jmp 0x5eddfb
mov edi, edx
shr edi, 0x18
push ecx
jmp 0x5ede56
mov ecx, edi
jmp 0x5ede40

Function at 0x5ee077
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
sub esp, 2
lea esp, [esp + 2]
jmp 0x5ee0ba
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
call fcn.005ee0a4
lea eax, [eax*4]
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [eax]
pop eax
jmp 0x5ee107
mov edx, dword [esi + 8]
jmp 0x5f0099
and edx, ecx
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov dx, word [esp]
jmp 0x5ee0f1
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
push eax
clc
clc
jmp 0x5ee13e
add esp, 1
stc
lea esp, [esp + 3]
shr edi, 0x18
pushfd
jmp 0x5ee11a
and edi, ecx
push ebp
pushal
jmp 0x5ee476
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov edi, 0xf10e880a
lea edi, [edx*4]
mov edi, edx
pushfd
jmp 0x5ee130
mov dl, dh
dec bx
mov dword [esp + 8], edi
push cx
call fcn.005ee27e
mov ebx, dword [esp]
jmp 0x5ee4aa
lea esp, [esp + 4]
test eax, eax
call fcn.005ee4d7
sbb al, 0x9c
xor dl, byte [ebp - 0x5c]
invalid
mov dword [esi + 4], edi
lea edi, [esi*4]
mov di, 0xfd56
xor edi, 0x29064a92
jmp 0x5ee158

Function at 0x5ee0a4
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 9]
stc
jmp 0x5ee0ea
and edx, ecx
push eax
mov eax, edx
jmp 0x5ee0ca

Function at 0x5ee1f5
Capabilities:
Encrypt data using aes

Disassembly:
lea ebx, reloc.RASAPI32.dll_RasHangUpA
mov bh, byte [esp]
jmp 0x5ee1af
and ebx, ecx
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov bx, 0x3bab
jmp 0x5ee170
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
push eax
jmp 0x5ee20b
lea ebx, [edx*4]
movzx ebx, byte [esi + 0xa]
sub esp, 0x19
mov word [esp + 6], si
lea esp, [esp + 1]
jmp 0x5ee199
popal
lea ebp, [ebp*4]
lea ebp, reloc.RASAPI32.dll_RasHangUpA
mov edi, dword [ebp]
pop ebp
jmp 0x5ee186
movzx ebx, byte [esi + 0xd]
push sp
lea esp, [esp + 2]
and edx, ecx
call 0x5ee1f5
das
add esp, 0
jmp 0x5ee230
and ebx, ecx
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x5ee1e3
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov dx, word [esp]
not dx
jmp 0x5ee255
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
and edx, ecx
lea esp, [esp + 4]
jmp 0x5ee21a
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x5ee261
mov dx, 0x67ad
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
jmp 0x5ee23f
pushal
and di, 0x2a34
inc eax
neg eax
mov dword [esp], edx
call fcn.005ee3a7
inc ebp
les ebx, [edx + 0x3d]
int3
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x5ee1cf
Function at 0x5ee28b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x5ee349
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
clc
bsr bx, ax
jmp 0x5ee30a
mov edi, dword [ebp]
pop ebp
and ebx, ecx
push edi
jmp 0x5ee2d5
and edx, ecx
stc
jmp 0x5ee32e
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
push ebx
jmp 0x5ee2f4
and ebx, ecx
cmc
jmp 0x5ee371
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
stc
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x5ee318
push ebp
mov ebp, edi
lea ebp, [ebp*4]
lea ebp, reloc.RASAPI32.dll_RasHangUpA
jmp 0x5ee2eb
and edx, ecx
jmp 0x5ee38a
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0xc
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0x5ee35b
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x5ee3e8
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x5b3e8d
je 0x5b3e77
test esi, esi
pushfd
push dword [esp + 1]
push dword [esp]
jmp 0x5ee445
push 0x5c00bc
call fcn.005cc98c
jg 0x5ee395
in al, dx
sbb byte [ebx + 0x16eb09c4], al
aaa
mov bh, 0x27
inc edx
mov cl, 0xb7
sub al, byte [ebp - 0xc]
lea esp, [esp + 0xc]
je 0x5b400e
push ebp
lea esp, [esp + 4]
push esi
jmp 0x5ee406

Function at 0x5ee3a7
Capabilities:
Encrypt data using aes

Disassembly:
pop dword [esp + 0xe]
inc esp
and al, 0xe
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
and edi, ecx
call fcn.005ee28b
cli
jle 0x5ee2a2
mov eax, dword [esi - reloc.RASAPI32.dll_RasHangUpA]
cmpsb byte [esi], byte es:[edi]
push ebp
pop esi
aam 0x4a
sub eax, 0x8dc15bdc
and al, 2
lea esp, [esp + 2]
lea esp, [esp + 2]
popal
shr edi, 0x18
pushal
jmp 0x5ee2a1
jmp 0x5ee2c6
Function at 0x7791be
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
pop edx
mov edx, 0xee4cbfe0
pushal
ror di, 0xc
mov dh, byte [esp + 1]
jmp 0x779233
setle dl
inc di
mov dl, cl
mov esi, dword [esp]
sub esp, 0
mov esi, ebx
jmp 0x779219
pop dword [esp + 0x18]
lea esp, [esp + 0x1d]
lea esi, [ecx*4]
mov dx, si
mov dl, bh
xchg dh, dl
jmp 0x7791eb
lea esp, [esp + 1]
lea esp, [esp]
mov dx, ax
mov edx, dword [esp]
dec dx
push word [esp + 1]
jmp 0x779248
rcl dx, 9
lea esp, [esp + 7]
mov dword [esp + 0xa], edi
inc si
setbe dh
xchg dl, dh
jmp 0x779201
xchg dword [esp], esi
lea esp, [esp + 1]
lea edi, reloc.RASAPI32.dll_RasHangUpA
pop dx
mov dl, 0x3f
jmp 0x7792a2
pop esi
dec si
mov dword [esp + 0xa], eax
mov dh, byte [esp + 0x1a]
setae dl
push word [esp + 0x19]
jmp 0x779329
rol dx, 0xc
pushal
xchg word [esp + 0x18], dx
mov dl, 0xc0
pop dx
xchg dh, dl
jmp 0x77927f
pop dword [esp + 0x17]
xchg edx, edi
push dword [esp + 0x16]
mov dl, bl
btc edi, edi
jmp 0x7792fa
pop edi
push dword [esp + 0x11]
xchg byte [esp + 0xb], dl
xchg word [esp + 2], dx
xchg byte [esp + 0x21], dl
sub esp, 0
jmp 0x7792b4
mov di, 0x2d57
not dx
mov dword [esp + 9], eax
mov dx, word [esp + 0x26]
jmp 0x7793bd
mov edi, 0xc7f9026d
bt dx, cx
mov dword [esp + 0x1b], esi
bt edi, edx
mov byte [esp + 0x1f], al
mov di, 0xb057
jmp 0x7792e1
xchg dword [esp + 2], esi
push dword [esp + 0x16]
push word [esp + 0xe]
push dword [esp + 9]
xchg esi, edx
bswap edi
jmp 0x7792ca
lea esi, [eax + edi]
lea esp, [esp + 0x1d]
std
add esp, 4
pop si
add esp, 0
jmp 0x779388
mov dh, ch
mov si, word [esp + 0x16]
bsf esi, edi
cmc
mov dh, ch
lea edi, reloc.RASAPI32.dll_RasHangUpA
jmp 0x779340
mov edx, 0x30e8a20e
mov edi, 0xcd3568b7
sete dh
setl dh
jmp 0x779399
mov byte [esp], dh
xchg byte [esp], dh
push esp
mov dword [esp], ebx
xchg dx, si
mov dh, dl
jmp 0x779372
bt di, sp
mov dx, word [esp + 2]
lea edx, [eax + eax]
lea edx, [eax + ebx]
inc dh
or dh, 6
jmp 0x7793f0
bt di, cx
lea edi, reloc.RASAPI32.dll_RasHangUpA
pop word [esp + 0x18]
mov di, cx
xchg word [esp + 0x1d], di
mov di, 0x3a9a
jmp 0x77935d
xchg byte [esp + 1], dh
push ebx
neg edx
mov dh, byte [esp]
lea edi, [edx*4]
call fcn.007793da
jo 0x77947b
push 0xffffffffffffff85
xor al, 0x27
pop dword [esp + 0xa]
pop esi
mov esi, dword [esp + 0x57]
lea esp, [esp + 0x6c]
popfd
jmp 0x77953e
dec edi
mov edx, dword [esp + 0x31]
bsr esi, ecx
mov si, sp
mov esi, edx
pushal
btc esi, ebx
jmp 0x779466
mov dword [esp], edx
push sp
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x7794fd
lea esp, [esp + 1]
push eax
push ecx
pushfd
mov word [esp], bx
mov word [esp + 1], ax
jmp 0x7794ac
push ebx
push esp
call fcn.007794d4
lea esp, [esp + 4]
push edx
push dword [esp + 3]
lea esp, [esp + 7]
jmp 0x7794c2

Function at 0x7793da
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp + 2]
jmp 0x779426
mov si, sp
inc di
mov dx, ax
mov esi, ebx
mov dx, sp
mov si, 0x366
jmp 0x77949a
mov dh, byte [esp]
mov dl, 8
mov edi, dword [esp + 0x14]
mov edx, dword [esp]
dec esi
lea edx, [esi + edi]
jmp 0x77947c
Function at 0x779504
Capabilities:
Parse pe header

Disassembly:
call fcn.00778338
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x779566
pop word [esp]
mov word [esp], sp
push word [esp]
mov dword [esp], edi
jmp 0x7794e1
mov ebx, eax
mov eax, dword [ebx]
pop ebx
jmp 0x7796d6
mov eax, dword [eax + 0x1c]
push ebx
jmp 0x779550
mov eax, dword [eax + 8]
push eax
jmp 0x778333

Function at 0x77951a
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp], esi
call fcn.00779504
mov dword [esp + 4], ebp
push bx
mov word [esp], bx
lea esp, [esp + 2]
jmp 0x7794d9