joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458020
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x491248
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x458059
inc eax
mov dword [esi + 0x10], eax
jmp 0x45816c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x45806d
mov eax, 0xffffffc7
jmp 0x45816e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x45807e
cmp dword [esi + 8], eax
jne 0x45806d
cmp dword [esi + 8], eax
jne 0x458097
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x458097
mov eax, 0xffffffc7
jmp 0x45816e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x4580ab
push eax
mov ecx, ebx
call fcn.00457850
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00427290
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x4580dc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004272b0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00456fc0
test eax, eax
mov dword [esp + 0x38], eax
je 0x45810f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4d0f70
call fcn.00427490
mov eax, dword [esp + 0x38]
jmp 0x45816e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00457e80
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x458153
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00457ea0
mov esi, eax
test esi, esi
jne 0x458183
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00457e80
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x458125
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4d0f70
call fcn.00427490
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4d0f70
call fcn.00427490
mov eax, esi
jmp 0x45816e

Function at 0x45b2b0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x45b310
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x45b310
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x45b310
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x45b310
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x45b350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x461290
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x491878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0048a4bd
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00460c30
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0048a3eb
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00486cb4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00486cb4
push 1
push 0
push 0
mov ecx, esi
call fcn.00486c5c
push 1
push 0
push 1
mov ecx, esi
call fcn.00486c5c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048a52f
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x461410
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x491898
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0048a4bd
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00460c30
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0048a3eb
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4614d4
cmp dword [esp + 0x40], 1
jne 0x4614d2
cmp ecx, eax
jge 0x4614d4
mov eax, ecx
cmp eax, 0xc8
jge 0x4614e0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00461290
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048a52f
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x461c60
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x491903
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004850cd
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0048a765
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0048bc81
test eax, eax
je 0x461d7c
mov ecx, dword [esp + 0x3c]
call fcn.0048a792
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x461d40
push edi
mov ecx, esi
call fcn.00487dfe
mov ecx, esi
call fcn.00461ee0
cmp dword [esp + 0x38], 1
jne 0x461d75
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00487f39
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x464790
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4647c3
push esi
call fcn.00467890
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4647bc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x464849
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x464832
mov eax, dword [esi + 8]
test eax, eax
je 0x4647e7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46482e
cmp eax, 2
je 0x464832
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4647da
cmp eax, 3
je 0x46480d
cmp eax, 1
jne 0x4647da
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4647da
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4647da
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00464870
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x464858
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00464870
add esp, 4
pop esi
ret
Function at 0x485ec2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x485efa
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00483f79
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00483f51
jmp 0x485f06
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4875b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4875fa
call fcn.0048d106
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4875fa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4875f1
xor eax, eax
jmp 0x487602
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00487608
pop edi
pop esi
pop ebx
ret 4

Function at 0x48d636
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48d664
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48d682
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048d59c
jmp 0x48d682
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48d682
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048d59c
test edi, edi
mov eax, edi
jne 0x48d66c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x665f64
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], bx
lea esp, [esp + 5]
call 0x665f64
adc al, 0x60
lea esp, [esp + 0x10]
mov dword [esp], esi
pop word [esp + 6]
jmp 0x665fd5
push word [esp + 5]
call 0x665f4e
pop word [esp + 0xf]
push dword [esp + 4]
mov dword [esp + 0x3c], esp
push edx
push dword [esp]
push dword [esp + 2]
jmp 0x665f55
lea esp, [esp + 1]
mov dword [esp + 0x50], ebp
call fcn.00665faf
push word [esp + 5]
pop word [esp + 1]
lea esp, [esp + 5]
mov byte [esp], dh
jmp 0x666000
lea esp, [esp]
call fcn.00666073
pushfd
setge bh
mov dl, dh
lea eax, [ecx - 0xb3]
lea ebp, [ecx*4]
jmp 0x66604a

Function at 0x665fbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
lea esp, [esp + 3]
mov dword [esp + 0x54], esi
call 0x665ff9
pop esp
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x665ff8
xlatb
pop word [esp]
push edx
jmp 0x665fe2

Function at 0x665ff9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
lea esp, [esp + 3]
mov dword [esp + 0x54], esi
call 0x665ff9
pop esp
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x665ff8
xlatb
pop word [esp]
push edx
jmp 0x665fe2

Function at 0x666073
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
lea esp, [esp + 1]
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0x666008

Function at 0x6854e5
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x68550c
lea esp, [esp + 4]
movzx ebx, byte [esi + 0x11]
inc dh
stc
cmc
inc dh
jmp 0x685563
add esi, 0x10
lea edx, [ecx + edx]
push esp
jmp 0x685544
mov edx, dword [esi]
mov edi, edx
sub esp, 0x12
pushal
jmp 0x685597
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
xchg di, dx
mov edi, esi
setno dh
xchg dh, dl
jmp 0x68551c
lea esp, [esp + 2]
shr edi, 0x18
call fcn.00685576
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasDialA]
jmp 0x685612
movzx ebx, byte [esi + 2]
push ecx
pushal
jmp 0x6855f5
btc edx, ebx
mov dword [esp + 0x18], ebx
call fcn.0068565c
xchg ebp, eax
sbb al, 0xb2
aad 0x24
out 0xe5, al
imul edi, ecx, 0x8ad6b98
stosd dword es:[edi], eax
ret 0x4c7d
and ebx, ecx
lea esp, [esp + 0x54]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
jmp 0x6855e9
Function at 0x685870
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x685873
clc
jmp 0x685857
and edx, ecx
pushal
pop word [esp + 0x13]
pop word [esp + 0x19]
jmp 0x685bb6
btr edx, edx
sub esp, 0
mov edx, dword [esi + 8]
push esp
pop word [esp]
call fcn.00685935
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasDialA]
jmp 0x685b62
pushal
lea esi, [edi*4]
btr ebp, edx
not eax
mov dword [esp], edx
jmp 0x685b19
mov di, 0x3489
cmp di, 0x7aea
jmp 0x685aa1
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
lea edi, [ecx*4]
bsr di, cx
jmp 0x685abe
shr edi, 0x18
clc
sub esp, 0x10
push dword [esp + 0xa]
pop dword [esp + 6]
jmp 0x685b42
and edi, ecx
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasDialA]
clc
cmc
jmp 0x685b29
popal
push edx
lea esp, [esp + 1]
lea esp, [esp + 1]
lea esp, [esp + 2]
jmp 0x685aed
and ebx, ecx
push esp
pop word [esp]
push word [esp + 1]
mov word [esp], di
jmp 0x685b9b
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasDialA]
push edx
mov byte [esp], ah
mov byte [esp + 2], ch
mov byte [esp], bh
jmp 0x685afe
mov edx, dword [esi + 0xc]
push esp
pop word [esp]
pushal
lea esp, [esp + 2]
jmp 0x685ad6
movzx ebx, byte [esi + 0xe]
call 0x685b7e
push ebp
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x685de0
lea esp, [esp + 0x38]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
jmp 0x685b74
push word [esp + 9]
lea esp, [esp + 2]
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasDialA]
mov dl, dh
jmp 0x685a64
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
clc

Function at 0x68598f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 2]
and edi, ecx
pushal
jmp 0x685968
push edx
mov byte [esp + 1], ah
push dword [esp + 2]
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasDialA]
sub esp, 2
jmp 0x685937
push ebp
mov ebp, edi
lea ebp, [ebp*4]
jmp 0x685978
lea ebp, reloc.RASAPI32.dll_RasDialA
mov edi, dword [ebp]
pop ebp
jmp 0x6859d9
shr edi, 0x18
jmp 0x685953
push esp
lea esp, [esp + 1]
lea esp, [esp + 3]
and ebx, ecx
call fcn.00685a38
dec eax
rol byte [eax + 0x27], cl
rcl byte [ebx], cl
retf 0xc757
movzx ebx, byte [esi + 0xa]
stc
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
cmc
jmp 0x685994
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
bts ebx, esp
jmp 0x6859b7
Function at 0x685a38
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 0xd]
sub esp, 0xc
add esp, 5
mov dword [esp], eax
jmp 0x685a18
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
setno bh
lea ebx, [eax*4]
jmp 0x6859eb
lea esp, [esp + 3]
and edx, ecx
sub esp, 0xc
mov byte [esp + 3], dh
pop word [esp + 7]
jmp 0x685a3d
inc esi
and eax, edx
int 0x5c
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x6859bc
invalid
sub esp, 0x18
jmp 0x685a01
in al, dx
sbb bl, ch
les ecx, [ebp - 0x74fddb9c]
adc al, 0x95
jl 0x685a76
lea esp, [esp + 2]
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasDialA]
call 0x685a4e
add al, ch
add dword [eax], eax
add byte [eax], al
and ecx, dword [eax - reloc.RASAPI32.dll_RasDialA]
inc ecx
jp 0x685a2e
dec esi
sub eax, ebx
pop edi
mov ch, 0x35
movsd dword es:[edi], dword [esi]
int3
dec dword [ebp + reloc.RASAPI32.dll_RasDialA]
cmp al, 0x95
jl 0x685ac0
add cl, ch
fild dword [eax]
add byte [eax], al
test eax, 0x2adfb82a
lcall 0x9249, 0xbadf4fc9
bound ebx, qword [ebp - 0x7c0735df]
in al, dx
push cs
lea esp, [esp + 2]
jmp 0x685a77
mov dword [esi], esi
cmp edi, 0xd8eb7aea
outsb dx, byte [esi]
call 0x5a50744d
add byte [0xc80ffc95], 0x34

Function at 0x685a4e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 0xd]
sub esp, 0xc
add esp, 5
mov dword [esp], eax
jmp 0x685a18
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
setno bh
lea ebx, [eax*4]
jmp 0x6859eb
lea esp, [esp + 3]
and edx, ecx
sub esp, 0xc
mov byte [esp + 3], dh
pop word [esp + 7]
jmp 0x685a3d
inc esi
and eax, edx
int 0x5c
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x6859bc
invalid
sub esp, 0x18
jmp 0x685a01
in al, dx
sbb bl, ch
les ecx, [ebp - 0x74fddb9c]
adc al, 0x95
jl 0x685a76
lea esp, [esp + 2]
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasDialA]
call 0x685a4e
add al, ch
add dword [eax], eax
add byte [eax], al
and ecx, dword [eax - reloc.RASAPI32.dll_RasDialA]
inc ecx
jp 0x685a2e
dec esi
sub eax, ebx
pop edi
mov ch, 0x35
movsd dword es:[edi], dword [esi]
int3
dec dword [ebp + reloc.RASAPI32.dll_RasDialA]
cmp al, 0x95
jl 0x685ac0
add cl, ch
fild dword [eax]
add byte [eax], al
test eax, 0x2adfb82a
lcall 0x9249, 0xbadf4fc9
bound ebx, qword [ebp - 0x7c0735df]
in al, dx
push cs
lea esp, [esp + 2]
jmp 0x685a77
mov dword [esi], esi
cmp edi, 0xd8eb7aea
outsb dx, byte [esi]
call 0x5a50744d
add byte [0xc80ffc95], 0x34
Function at 0x685b7e
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x685873
clc
jmp 0x685857
and edx, ecx
pushal
pop word [esp + 0x13]
pop word [esp + 0x19]
jmp 0x685bb6
btr edx, edx
sub esp, 0
mov edx, dword [esi + 8]
push esp
pop word [esp]
call fcn.00685935
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasDialA]
jmp 0x685b62
pushal
lea esi, [edi*4]
btr ebp, edx
not eax
mov dword [esp], edx
jmp 0x685b19
mov di, 0x3489
cmp di, 0x7aea
jmp 0x685aa1
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
lea edi, [ecx*4]
bsr di, cx
jmp 0x685abe
shr edi, 0x18
clc
sub esp, 0x10
push dword [esp + 0xa]
pop dword [esp + 6]
jmp 0x685b42
and edi, ecx
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasDialA]
clc
cmc
jmp 0x685b29
popal
push edx
lea esp, [esp + 1]
lea esp, [esp + 1]
lea esp, [esp + 2]
jmp 0x685aed
and ebx, ecx
push esp
pop word [esp]
push word [esp + 1]
mov word [esp], di
jmp 0x685b9b
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasDialA]
push edx
mov byte [esp], ah
mov byte [esp + 2], ch
mov byte [esp], bh
jmp 0x685afe
mov edx, dword [esi + 0xc]
push esp
pop word [esp]
pushal
lea esp, [esp + 2]
jmp 0x685ad6
movzx ebx, byte [esi + 0xe]
call 0x685b7e
push ebp
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x685de0
lea esp, [esp + 0x38]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
jmp 0x685b74
push word [esp + 9]
lea esp, [esp + 2]
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasDialA]
mov dl, dh
jmp 0x685a64
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasDialA]
clc

Function at 0x686d12
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], esi
pushal
mov byte [esp + 0x1b], dh
jmp 0x686d32
jg 0x686d6d
int1
lea esp, [esp + 0x24]
jb 0x68615f
jae 0x6871b1
out dx, al
jb 0x686d25
xchg dword [edx - 0x4d], esi
in al, dx
ja 0x686d32
xor byte [ecx - 0x37], 0xea
test dword [reloc.RASAPI32.dll_RasDialA], edx
cmpsd dword [esi], dword es:[edi]
into
pop ecx
lea esp, [esp + 8]
cmp dl, 0x2f
call fcn.00686d5f
mov eax, 0x3acfa83a
stc
lcall 0xf297, 0x19ea8f1f
in eax, dx
cld
iretd
cmp dl, 0x2b
call 0x686f38
push dword [esp]
call fcn.00685f73
Function at 0x687a31
Capabilities:
Encode data using base64

Disassembly:
cmp cl, 0x30
jmp 0x686b08
cmp cl, 0x2b
jmp 0x686807
lea esp, [esp + 0x15]
lea esp, [esp + 1]
lea esp, [esp + 0xc]
je 0x659087
sub esp, 6
jmp 0x686a45
je 0x659087
cmp cl, 0x2f
pushal
push word [esp + 0x1f]
jmp 0x6867e2
pushal
mov dword [esp + 0xd], ebp
pop word [esp + 0xd]
call fcn.006867d8
je 0x659087
xor al, 0x28
std
dec dword [edi]
test dword [ebx + 0x27], esp
std
push dword [esi - 0xc]
jne 0x658fbc
jbe 0x68684f
push 0xd
cld
aas
pushal
loope 0x6868d3
adc bl, ah
push ecx
mov byte [0x22d7b022], al
out 0xe3, eax
sbb dh, byte [ebp + 0x52]
push edx
push word [esp + 1]
push word [esp + 5]
pop dword [esp]
lea esp, [esp + 4]
jmp 0x68684d
sub esp, 0x18
mov byte [esp + 4], dh
pop word [esp + 0xd]
lea esp, [esp + 0x1c]
cmp cl, 0x3d
jmp 0x68686e
jb 0x685d40
push esp
lea esp, [esp + 4]
cmp cl, 0x39
jmp 0x686825
lea esp, [esp + 4]
jbe 0x659087
ja 0x6590cf
cmp cl, 0x7a
push esp
push word [esp + 3]
pop word [esp + 1]
mov byte [esp + 2], ch
jmp 0x686d4f
lea esp, [esp + 4]
jb 0x6590cf
cmc
jmp 0x687203

Function at 0x68a922
Capabilities:
Hash data with md5

Disassembly:
mov dword [esp], ecx
call 0x68a922
mov al, byte [0xeb24048f]
inc edx
std
not dword [bp + si - reloc.RASAPI32.dll_RasDialA]
add eax, 0x98690e98
push ebp
cmc
or al, 0xff
jp 0x68a99e
xchg edi, eax
inc eax
adc dh, bh
fdivr qword [edx + 0x1440c798]
jbe 0x68a9fd
xor dl, byte [eax]

Function at 0x778f9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x778fd5
mov bp, word [esp + 0xe]
lea esp, [esp + 0xf]
xchg dword [esp + 6], edx
xchg edx, ebp
cpuid
mov edi, 0x252f91ee
jmp 0x77a729
mov ch, byte [esp + 0x1d]
bsf cx, si
mov eax, 0xb5d97ef2
pop ebp
mov edi, dword [esp + 0x21]
jmp 0x778f9d
xchg dword [esp + 4], esi
cld

Function at 0x779215
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 3]
xchg dx, si
rdtsc
xchg dword [esp + 0xa], ecx
jmp 0x7792ce
lea esp, [esp + 1]
stc
mov bl, 0x58
cmc
sub esp, 0x16
lea esp, [esp + 0x15]
mov edx, 0xda95f570
mov cx, 0x601b
lea edi, [ebp + 0x4f]
neg ax
xchg ch, dl
jmp 0x77927d
mov cx, word [esp + 0x1c]
mov bx, 0x8487
mov byte [esp + 0xb], dh
add esp, 0xf
push dword [esp + 4]
setbe dh
jmp 0x7792a1

Function at 0x7798ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov esi, dword [esp]
sub esp, 0x1c
pop ax
xchg di, bx
lea eax, [eax + edx]
jmp 0x7798cf

Function at 0x77e3ff
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
jmp 0x77e50e
mov dword [esp], ebp
pushal
mov word [esp + 0xe], dx
push word [esp + 0x15]
mov word [esp + 0xe], sp
jmp 0x77e4d2
pop word [esp]
mov word [esp], bx
mov word [esp], di
lea esp, [esp + 3]
mov dword [esp + 0xc8], esi
push edx
jmp 0x77e404
Function at 0x403b60
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4081b0
push 0x404784
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffbd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x304], 0
mov dword [ebp - 4], 0
jmp 0x403bd6
popal
popfd
push 0x403b9c
retf
lcall 0x3e3, 0
pushfd
pushal
rdtsc
xchg ecx, eax
rdtsc
sub eax, ecx
mov dword [ebp - 0x304], eax
push 0xf74843ff
call ebx
or eax, eax
je 0x403bce
mov edi, eax
mov ecx, 0x14
mov al, 0x8b
cld
repne scasb al, byte es:[edi]
or ecx, ecx
je 0x403bce
mov esi, dword [edi + 1]
push 0xb7483068
call ebx
or eax, eax
je 0x403bce
call eax
or eax, eax
je 0x403bce
mov dword [eax + esi], 1
jmp 0x403bce