joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018bb
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x41b780
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x472038
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41b7fd
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x3d
push esi
call edi
add esp, 8
test eax, eax
jne 0x41b7fd
push 0x3b
push esi
call edi
add esp, 8
test eax, eax
jne 0x41b7fd
lea ecx, [esp + 0x1c]
call fcn.0041fb60
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
push esi
mov dword [esp + 0x1c], 0
call fcn.00401384
test eax, eax
jne 0x41b813
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00420610
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 8]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
inc esi
push esi
call sub.MFC42u.DLL_operatornew
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
push eax
call fcn.00434fb0
mov ecx, dword [esp + 0x30]
add esp, 0x10
push ebx
call fcn.004208d0
push ebx
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00420610
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8

Function at 0x4018e3
Capabilities:
Get hostname
Resolve dns

Disassembly:
jmp 0x40a870
sub esp, 0x100
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push pe_nt_image_headers32
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x40a8ad
xor eax, eax
pop edi
add esp, 0x100
ret 8
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x40a8c8
pop edi
add esp, 0x100
ret 8
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [ecx], 0
je 0x40a902
push ebx
mov ebx, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x110]
xor edx, edx
cmp eax, ebx
jge 0x40a8f4
mov ecx, dword [edx + ecx]
inc eax
add esi, 4
mov ecx, dword [ecx]
mov dword [esi - 4], ecx
mov ecx, dword [edi + 0xc]
add edx, 4
cmp dword [edx + ecx], 0
jne 0x40a8e4
pop esi
pop ebx
pop edi
add esp, 0x100
ret 8
Function at 0x40c350
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x487300]
test eax, eax
jne 0x40c3ce
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x4870a0
mov dword [0x487300], 1
mov dword [0x4870a0], 0x114
call esi
mov edx, dword [0x4870b0]
xor eax, eax
cmp edx, 2
push 0x4871e0
sete al
mov dword [0x4824c8], eax
mov dword [0x4871e0], 0x11c
call esi
push 0x482768
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
mov dword [0x4872fc], eax
test eax, eax
push 0x4871b8
je 0x40c3c8
call eax
ret
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
ret

Function at 0x40f1e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x18]
mov eax, 0x1f3
not ecx
dec ecx
push edi
mov ebx, ecx
push ebp
sub eax, ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x40f220
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
push esi
mov esi, 1
test byte [edi], 0x10
je 0x40f30c
mov al, byte [edi + 0x2c]
lea edx, [edi + 0x2c]
cmp al, 0x2e
jne 0x40f253
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x40f24b
mov cl, byte [edi + 0x2e]
test cl, cl
je 0x40f2e1
test al, al
je 0x40f2e1
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
cmp eax, ecx
jb 0x40f2dd
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebx + ebp - 1], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x482a58
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x24]
mov ecx, edx
mov edx, dword [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
push ebp
call fcn.0040f1e0
mov byte [ebx + ebp - 1], 0x2a
add esp, 0x10
mov esi, eax
mov byte [ebx + ebp], 0
mov edi, dword [esp + 0x1c]
test esi, esi
je 0x40f2f9
mov edx, dword [esp + 0x18]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40f226
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x24]
lea ecx, [edi + 0x2c]
push eax
push ecx
push ebp
mov byte [ebx + ebp - 1], 0
call dword [esp + 0x2c]
mov esi, eax
mov byte [ebx + ebp - 1], 0x2a
jmp 0x40f2e1
Function at 0x40f4b0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ebx, dword [esp + 0x1c]
add esp, 4
mov edi, eax
mov eax, 0x1f3
sub eax, edi
push ebx
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x40f4ee
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push ebp
mov dword [esp + 0x18], 1
test byte [ebx], 0x10
je 0x40f56f
cmp word [ebx + 0x2c], 0x2e
lea ebp, [ebx + 0x2c]
jne 0x40f51c
mov ax, word [ebx + 0x2e]
cmp ax, 0x2e
jne 0x40f517
cmp word [ebx + 0x30], 0
je 0x40f58f
test ax, ax
je 0x40f58f
push ebp
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [esp + 0x14]
add esp, 4
inc eax
cmp ecx, eax
jb 0x40f58f
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_wcscat]
push esi
mov word [esi + edi*2 - 2], 0
call ebp
push 0x482a5c
push esi
call ebp
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
push ecx
push ebx
push esi
call fcn.0040f4b0
mov word [esi + edi*2 - 2], 0x2a
add esp, 0x20
mov dword [esp + 0x18], eax
mov word [esi + edi*2], 0
jmp 0x40f58f
mov edx, dword [esp + 0x24]
lea eax, [ebx + 0x2c]
push edx
push eax
push esi
mov word [esi + edi*2 - 2], 0
call dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov word [esi + edi*2 - 2], 0x2a
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40f5ab
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40f4f7
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x18]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41c580
Capabilities:
Get file size

Disassembly:
jmp 0x41c580
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0xffffffff
jne 0x41c5f9
mov eax, dword [esi + 0x28]
test eax, eax
je 0x41c5ac
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
jne 0x41c5b8
xor eax, eax
pop esi
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x500000
jbe 0x41c5e9
mov eax, dword [esi + 0x24]
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, 1
pop esi
ret
mov edx, dword [esi + 0x24]
push 2
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, 1
pop esi
ret
Function at 0x453d30
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x453ead
mov eax, dword [esp + 0x10]
test eax, eax
je 0x453e8c
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x453d86
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call sub.MFC42u.DLL_operatornew
mov esi, eax
add esp, 4
test esi, esi
je 0x453ead
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x453ea4
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x453ea4
mov edi, dword [esp + 0x20]
test edi, edi
je 0x453ea4
push ebp
push edi
call fcn.00453d30
add esp, 8
test eax, eax
je 0x453e99
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x488a84]
test eax, eax
je 0x453e35
test ebp, ebp
je 0x453e35
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x453ea4
jmp 0x453e41
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x453ea4
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x453e83
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x453ea4
mov eax, dword [esp + 0x14]
jmp 0x453dde
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x453ea4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x457e90
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x45800d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x457fec
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x457ee6
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call sub.MFC42u.DLL_operatornew
mov esi, eax
add esp, 4
test esi, esi
je 0x45800d
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x458004
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x458004
mov edi, dword [esp + 0x20]
test edi, edi
je 0x458004
push ebp
push edi
call fcn.00457e90
add esp, 8
test eax, eax
je 0x457ff9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x488d0c]
test eax, eax
je 0x457f95
test ebp, ebp
je 0x457f95
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x458004
jmp 0x457fa1
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x458004
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x457fe3
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x458004
mov eax, dword [esp + 0x14]
jmp 0x457f3e
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x458004
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x45930b
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x47454b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00425550
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push 0x104
push eax
mov dword [esp + 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004262d0
lea edx, [esp + 8]
push 1
push edx
mov ecx, esi
call fcn.004285b0
mov eax, dword [eax]
push 0x4809cc
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.00425ff0
test edi, edi
je 0x45938f
push 0x4809cc
mov ecx, esi
call fcn.00426c30
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret

Function at 0x4594eb
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x47458b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00425550
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push 0x104
push eax
mov dword [esp + 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004262d0
lea edx, [esp + 8]
push 1
push edx
mov ecx, esi
call fcn.004285b0
mov eax, dword [eax]
push 0x4809cc
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.00425ff0
test edi, edi
je 0x45956f
push 0x4809cc
mov ecx, esi
call fcn.00426c30
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x5b8909
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf05a71d0
jmp 0x5b8b5e
call fcn.005b8973
xchg esi, eax
pop ss
xchg edx, esp
adc dword [eax + reloc.RASAPI32.dll_RasHangUpA], ebx
mov byte [ebx - 0x5b], bh
aam 0x47
out dx, al
stc
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
pushfd
jmp 0x5b810d
rcr si, 8
je 0x5b89e8
mov ch, byte [esp]
neg bh
jmp 0x5b89d2
sub esp, 0xbc
jmp 0x5b8a8c
neg ecx
lea esp, [esp + 1]
jmp 0x5b8a09
lea ebp, [esp + 4]
mov ch, byte [esp]
not esi
xchg ah, dl
mov eax, ecx
jmp 0x5b89b1
mov ch, byte [esp]
neg bh
jmp 0x5b89d2
mov eax, dword [esp + 4]
neg ecx
lea esp, [esp + 1]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp]
jmp 0x5b89a4
mov esi, esp
lea eax, [eax*4]
mov ebx, 0x5fcbf2bd
xchg dx, bx
xchg esi, edx
sub esp, 5
ja 0x5b89ff
mov eax, dword [esp + 4]
jmp 0x5b89ca
jmp 0x5b8b10

Function at 0x5b8ab7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esi*4]
jmp 0x5b8aeb
xchg bx, ax
lea ebx, reloc.RASAPI32.dll_RasHangUpA
xchg bl, al
neg bx
jmp 0x5b8acb
jl 0x5b8aa1
lea edx, [esi*4]
jmp 0x5b8aeb

Function at 0x5f5b5f
Capabilities:
Encrypt data using aes

Disassembly:
xchg bl, bh
xchg bp, si
jmp 0x5f5c16
dec edi
lea ebp, [esi*4]
movzx esi, byte [eax + 0xb]
neg bl
shl edx, 8
mov ebp, dword [esp]
jmp 0x5f5be3
Function at 0x5f5bf9
Capabilities:
Encrypt data using aes

Disassembly:
movzx eax, byte [eax + 0xf]
jmp 0x5f5c47
lea ebp, [esi + esi]
neg bx
rol bl, cl
cmc
jmp 0x5f5c24
xor edx, esi
shl edx, 8
call 0x5f5c2f
xchg byte [esi + 0x5e], ah
pushal
jmp 0x5f5c70
mov bx, 0xdcb2
mov edi, ebp
rcl bl, cl
lea edi, [ecx + 0xfd]
shl edx, 8
jmp 0x5f5bff
lea esp, [esp + 2]
xor edx, eax
mov di, word [esp]
call fcn.005f5c5a
mov eax, edx
mov ebp, ebx
bswap esi
mov ebp, 0xa87738c
jmp 0x5f5ced
lea esp, [esp + 1]
add esi, 0xbc58943
lea esp, [esp + 8]
lea edi, [esi + edi]
jmp 0x5f5d1d
shr eax, 0x10
mov esi, 0xf43a77bc
sub esp, 9
mov byte [esp + 6], dl
jmp 0x5f5cca
mov edi, 0x563c75b9
lea esp, [esp + 0x38]
xor eax, 0x1000000
mov ebx, dword [esp]
mov bh, byte [esp]
jmp 0x5f5d33
and eax, esi
mov di, word [esp]
lea edi, [esi*4]
mov eax, dword [eax*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x5f5cfe
mov edi, dword [esp]
lea ebx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x5f5f04
pushal
jmp 0x5f5da0
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
sub bh, 0xb1
xchg ebx, ebp
neg bx
and edi, 0xff0000
jmp 0x5f5d5d
xor eax, edi
jmp 0x5f5dae
mov ebx, dword [ecx + 4]
lea esp, [esp + 0x20]
and eax, 0xff000000
jmp 0x5f5d8a
mov edi, edx
lea ebp, [esp + edi]
lea ebp, [esi + edi]
jmp 0x5f5de9
mov bh, 0xcf
and edi, esi
not bl
lea ebp, [eax + edi]
jmp 0x5f5d73
push ebx
jmp 0x5f5e09
shr edi, 0x18
shl ebp, cl
dec bp
pushfd
jmp 0x5f5dd3
pop ebx
jmp 0x5f5e33
mov ebx, edi
lea ebx, [ebx*4]
lea ebx, reloc.RASAPI32.dll_RasHangUpA
movzx edi, byte [ebx]
jmp 0x5f5df3
and edi, esi
lea ebp, [esp + edi]
push ebp
jmp 0x5f5e3d
xor eax, edi
not edi
bswap ebp
mov edi, edx
jmp 0x5f5e1d
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
not bp
mov bp, 0x545
clc
jmp 0x5f5e80
lea esp, [esp + 2]
popal
setne bh
mov bl, byte [esp]
shr edi, 8
jmp 0x5f5dc8
xor eax, edi
clc
mov di, 0xdeef
lea edi, reloc.RASAPI32.dll_RasHangUpA
jmp 0x5f5ebd
mov ebp, 0xff00
stc
and edi, ebp
jmp 0x5f5e6a
stc
xor ebx, eax
call fcn.005f5e8a
aad 0x54
retf 0x5cad
lea esp, [esp + 8]
xor eax, dword [ecx]
mov edi, dword [esp]
lea edi, [ecx + 0x10]
jmp 0x5f5ea0
pushal
xchg ah, al
bswap edi
mov dword [esp], edx
push si
jmp 0x5f5e57
Function at 0x5f5c2f
Capabilities:
Encrypt data using aes

Disassembly:
movzx eax, byte [eax + 0xf]
jmp 0x5f5c47
lea ebp, [esi + esi]
neg bx
rol bl, cl
cmc
jmp 0x5f5c24
xor edx, esi
shl edx, 8
call 0x5f5c2f
xchg byte [esi + 0x5e], ah
pushal
jmp 0x5f5c70
mov bx, 0xdcb2
mov edi, ebp
rcl bl, cl
lea edi, [ecx + 0xfd]
shl edx, 8
jmp 0x5f5bff
lea esp, [esp + 2]
xor edx, eax
mov di, word [esp]
call fcn.005f5c5a
mov eax, edx
mov ebp, ebx
bswap esi
mov ebp, 0xa87738c
jmp 0x5f5ced
lea esp, [esp + 1]
add esi, 0xbc58943
lea esp, [esp + 8]
lea edi, [esi + edi]
jmp 0x5f5d1d
shr eax, 0x10
mov esi, 0xf43a77bc
sub esp, 9
mov byte [esp + 6], dl
jmp 0x5f5cca
mov edi, 0x563c75b9
lea esp, [esp + 0x38]
xor eax, 0x1000000
mov ebx, dword [esp]
mov bh, byte [esp]
jmp 0x5f5d33
and eax, esi
mov di, word [esp]
lea edi, [esi*4]
mov eax, dword [eax*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x5f5cfe
mov edi, dword [esp]
lea ebx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x5f5f04
pushal
jmp 0x5f5da0
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
sub bh, 0xb1
xchg ebx, ebp
neg bx
and edi, 0xff0000
jmp 0x5f5d5d
xor eax, edi
jmp 0x5f5dae
mov ebx, dword [ecx + 4]
lea esp, [esp + 0x20]
and eax, 0xff000000
jmp 0x5f5d8a
mov edi, edx
lea ebp, [esp + edi]
lea ebp, [esi + edi]
jmp 0x5f5de9
mov bh, 0xcf
and edi, esi
not bl
lea ebp, [eax + edi]
jmp 0x5f5d73
push ebx
jmp 0x5f5e09
shr edi, 0x18
shl ebp, cl
dec bp
pushfd
jmp 0x5f5dd3
pop ebx
jmp 0x5f5e33
mov ebx, edi
lea ebx, [ebx*4]
lea ebx, reloc.RASAPI32.dll_RasHangUpA
movzx edi, byte [ebx]
jmp 0x5f5df3
and edi, esi
lea ebp, [esp + edi]
push ebp
jmp 0x5f5e3d
xor eax, edi
not edi
bswap ebp
mov edi, edx
jmp 0x5f5e1d
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
not bp
mov bp, 0x545
clc
jmp 0x5f5e80
lea esp, [esp + 2]
popal
setne bh
mov bl, byte [esp]
shr edi, 8
jmp 0x5f5dc8
xor eax, edi
clc
mov di, 0xdeef
lea edi, reloc.RASAPI32.dll_RasHangUpA
jmp 0x5f5ebd
mov ebp, 0xff00
stc
and edi, ebp
jmp 0x5f5e6a
stc
xor ebx, eax
call fcn.005f5e8a
aad 0x54
retf 0x5cad
lea esp, [esp + 8]
xor eax, dword [ecx]
mov edi, dword [esp]
lea edi, [ecx + 0x10]
jmp 0x5f5ea0
pushal
xchg ah, al
bswap edi
mov dword [esp], edx
push si
jmp 0x5f5e57

Function at 0x5f5c5a
Capabilities:
Encrypt data using aes

Disassembly:
lea eax, [ecx - 0x42]
jmp 0x5f5c95
mov dword [ecx + 0xc], edx
neg ebx
xchg bp, ax
lea ebx, reloc.RASAPI32.dll_RasHangUpA
add si, 0x1c43
jmp 0x5f5c7f
Function at 0x5f5e8a
Capabilities:
Encrypt data using aes

Disassembly:
mov dl, dh
mov dx, word [esp]
jmp 0x5f5f54
mov dword [edi], eax
shr eax, cl
jmp 0x5f5ee1
pushal
mov ebx, 0x4d7a7972
jmp 0x5f5eeb
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
jmp 0x5f5ecb
mov dword [ecx + 0x18], eax
mov bh, dl
mov bh, 0x8e
jmp 0x5f5f47
shl ax, cl
bsf ebx, eax
clc
mov ecx, 0xde14bd72
jmp 0x5f5f7e
mov eax, ecx
add eax, 0x1c
mov dword [eax], edx
pop eax
jmp 0x5f5f13
xor edx, eax
bsf bx, si
mov ax, 0xe3ae
push eax
jmp 0x5f5f29
mov eax, edi
rcl dh, 4
mov dh, ah
not edi
sub ch, cl
jmp 0x5f5f65
mov edx, dword [eax + 0xc]
clc
mov cl, 0x86
jmp 0x5f5fcc
mov ebx, 0x5b3604
lea esp, [esp + 0x24]
jmp 0x5f5977
pushal
lea ebx, [esi*4]
stc
mov ax, cx
mov dword [esp], edx
call fcn.005f5f8c
push dword [esp + 1]
push dword [esp + 5]
lea esp, [esp + 0xc]
popal
pushal
push edi
jmp 0x5f5ff3
mov ecx, edx
lea edi, [eax*4]
rcr edi, 0xe
shr ecx, 8
jmp 0x5f5fa2
pop word [esp + 1]
mov byte [esp], dh
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x5f6002
and ecx, esi
stc
mov ecx, dword [ecx*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 8
jmp 0x5f5fdd
shr edi, 0x10
and edi, esi
push eax
mov byte [esp + 1], dl
jmp 0x5f6264
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
stc
lea esp, [esp + 0x2c]
and ecx, 0xff0000
call fcn.005f610c

Function at 0x5f603c
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x5f605b

Function at 0x5f6077
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
and edx, esi
call fcn.005f603c
shr edi, 0x18
pushfd
stc
sub esp, 0x13
lea esp, [esp + 3]
jmp 0x5f609e
add esp, 3
lea esp, [esp + 1]
xor ecx, edi
sub edi, 0xb88d74c2
jmp 0x5f6052
and edx, ebp
bt di, bp
mov edi, dword [esp]
lea edi, [ecx*4]
jmp 0x5f60cb
movzx edi, byte [edi*4 + 0x5b1e00]
xor ecx, edi
lea edi, [ebx*4]
mov di, 0x4895
jmp 0x5f6088
xchg dl, dh
add di, bp
jmp 0x5f60ed
xor ecx, edx
neg edx
lea esp, [esp + 0x18]
xor ecx, dword [ebx]
jmp 0x5f60b5
bswap edx
jmp 0x5f6127
lea edi, [eax + 0x10]
cmc
lea edx, [eax + ebp]
xor ecx, dword [eax]
jmp 0x5f60d7
rcr edx, 0x14
jmp 0x5f61e0
add ebx, 4
mov dword [edi], ecx
mov edx, dword [esp]
bsf edx, ebx
jmp 0x5f6111
push dword [esp]
xor ecx, edx
not edx
setp dh
jmp 0x5f61ae
xor edx, ecx
mov dword [eax + 0x1c], edx
lea esp, [esp + 8]
cmp ebx, 0x5b3628
jmp 0x5f6185
rcl ch, cl
mov ecx, 0x86a7dff8
lea ecx, [ecx + ebx]
mov ecx, dword [eax + 8]
push esp
jmp 0x5f6134
pop eax
mov esi, 0x848af556
mov di, word [esp]
push sp
lea esp, [esp + 2]
jmp 0x5f6195
jne 0x5f5977
lea edi, [ecx + ebx]
setge al
push 0xa
jmp 0x5f616f
mov edi, dword [esp]
xchg bh, bl
jmp 0x5f61bf
mov dword [eax + 0x18], ecx
mov dh, byte [esp]
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [eax + 0xc]
jmp 0x5f6140
mov esi, dword [esp + 4]
bswap ebx
bswap ebx
lea ebx, [esi*4]
mov ebx, 0xc3fc60b6
jmp 0x5f6203
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
jmp 0x5f615f
lea esp, [esp + 8]
pop ebp
pop ebx
ret