joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402199
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x407514], ebx
push esi
push edi
jne 0x402219
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x402254
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x407514], eax
je 0x402254
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x407518], eax
call esi
cmp dword [0x4073b8], 2
mov dword [0x40751c], eax
jne 0x402219
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x407524], eax
je 0x402219
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x407520], eax
mov eax, dword [0x407520]
test eax, eax
je 0x40225e
call eax
test eax, eax
je 0x402245
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x407524]
test eax, eax
je 0x402245
test byte [ebp - 8], 1
jne 0x40225e
cmp dword [0x4073c4], 4
jb 0x402258
or byte [ebp + 0x12], 0x20
jmp 0x40227d
xor eax, eax
jmp 0x40228d
or byte [ebp + 0x12], 4
jmp 0x40227d
mov eax, dword [0x407518]
test eax, eax
je 0x40227d
call eax
mov ebx, eax
test ebx, ebx
je 0x40227d
mov eax, dword [0x40751c]
test eax, eax
je 0x40227d
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x407514]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4039de
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x403a0c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x403a13
cmp ebx, dword [eax + 4]
jae 0x403a13
xor eax, eax
jmp 0x403c03
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x403a24
xor eax, eax
inc eax
jmp 0x403c02
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x403a3a
cmp ecx, edx
jae 0x403b7f
cmp dword [eax + 4], 0
je 0x403a43
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x403a2b
cmp dword [ebp + 8], 0
je 0x403a65
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x403b7f
cmp eax, esi
jae 0x403b7f
mov eax, dword [0x407530]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x403a8a
cmp dword [esi*4 + 0x407538], edi
je 0x403b83
inc esi
cmp esi, eax
jl 0x403a78
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x403bff
cmp dword [ebp - 8], 0x1000000
jne 0x403bff
test byte [ebp - 0xc], 0xcc
je 0x403b08
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x403bff
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x403bff
cmp word [eax + 0x18], 0x10b
jne 0x403bff
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x403bff
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x403b08
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x403b08
test byte [ecx + 0x27], 0x80
jne 0x403b7f
push 1
push 0x407578
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x403a1c
mov ecx, dword [0x407530]
test ecx, ecx
mov edx, ecx
jle 0x403b3c
lea eax, [ecx*4 + 0x407534]
cmp dword [eax], edi
je 0x403b3c
dec edx
sub eax, 4
test edx, edx
jg 0x403b30
test edx, edx
jne 0x403b6d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x403b49
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x403b61
lea eax, [edx*4 + 0x407538]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x403b4f
cmp ecx, 0x10
jge 0x403b6d
inc ecx
mov dword [0x407530], ecx
push 0
push 0x407578
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x403a1c
xor eax, eax
jmp 0x403c02
test esi, esi
jle 0x403a1c
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x407578
call ebx
test eax, eax
jne 0x403a1c
cmp dword [esi*4 + 0x407538], edi
je 0x403bd9
mov eax, dword [0x407530]
lea esi, [eax - 1]
test esi, esi
jl 0x403bc7
cmp dword [esi*4 + 0x407538], edi
je 0x403bc3
dec esi
jns 0x403bb7
test esi, esi
jge 0x403bd7
cmp eax, 0x10
jge 0x403bd2
inc eax
mov dword [0x407530], eax
lea esi, [eax - 1]
jmp 0x403bd9
je 0x403bf1
xor ecx, ecx
test esi, esi
jl 0x403bf1
lea eax, [ecx*4 + 0x407538]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x403bdf
push 0
push 0x407578
call ebx
jmp 0x403a1c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404a8c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004020a0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x404b27
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4073b8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x404b27
cmp eax, 1
je 0x404b48
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x404b27
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x404af4
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x404b23
xor eax, eax
inc eax
jmp 0x404b67
cmp edi, eax
jae 0x404b2b
xor eax, eax
jmp 0x404b67
cmp eax, esi
jae 0x404b32
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4073b8]
jmp 0x404b4b
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5c7df4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x976008], 0x8088405
inc edx
mov dword [ebx + 0x976008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x5e07f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x5e0851
test eax, edx
je 0x5e0854
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x5e080f
movzx eax, word [eax]
sub eax, ecx
jmp 0x5e0836
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x5e0837
add ecx, 4
js 0x5e0827
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x5e0834
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x5e0836
xor eax, eax
ret
test eax, eax
je 0x5e0860
test edx, edx
jne 0x5e0800
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x5e95b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.005cacdc
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.005cfd70
mov edi, eax
cmp edi, 0x104
jbe 0x5e9563
mov eax, edi
add eax, eax
call fcn.005c7a0c
mov esi, eax
jmp 0x5e9565
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.005cfd70
push esi
call fcn.005d2e84
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x5e959e
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x5e9588
mov eax, esp
cmp esi, eax
je 0x5e95ab
mov eax, esi
call fcn.005c7a28
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x5e95e4
cmp bl, 0
je 0x5e95e0
cmp bl, 0x41
jl 0x5e95db
cmp bl, 0x5a
jg 0x5e95db
or bl, 0x20
xor al, bl
inc esi
jmp 0x5e95bf
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x5e9524
Function at 0x8d5224
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x8d522c
mov eax, edx
pop esi
pop ebx
ret
Function at 0x961ffa
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x30], eax
xor edx, edx
mov dword [esi + 0x4c], edx
xor ecx, ecx
mov dword [esi + 0x20], ecx
push esi
call fcn.00961fd8
pop ecx
xor ecx, ecx
mov eax, ecx
xor edx, edx
mov ebx, eax
shr ebx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ebx, eax
mov eax, ebx
inc edx
cmp edx, 8
jl 0x96201e
mov dword [esi + ecx*4 + 0x70], eax
inc ecx
cmp ecx, 0x100
jb 0x96201a
pop esi
pop ebx
pop ebp
ret

Function at 0x964bcb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov esi, pe_nt_image_headers32
or ebx, 0x100
add edi, edi
mov eax, ebx
shr eax, 7
and eax, 1
push eax
mov edx, esi
and edx, edi
add edx, esi
mov ecx, ebx
shr ecx, 8
add edx, ecx
shl edx, 2
add edx, dword [ebp + 0xc]
push edx
push dword [ebp + 8]
call fcn.00964b39
add esp, 0xc
add ebx, ebx
mov ecx, ebx
xor ecx, edi
not ecx
and esi, ecx
cmp ebx, 0x10000
jb 0x964be2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x964c8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 0xc]
xor edx, edx
or eax, 0x100
mov ecx, eax
shr ecx, 8
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + ecx*4]
mov ebx, eax
shr ebx, 7
and ebx, 1
neg ebx
and ebx, 0x7ff
xor ecx, ebx
shr ecx, 4
mov ebx, dword [ebp + 0x10]
add edx, dword [ebx + ecx*4]
add eax, eax
cmp eax, 0x10000
jb 0x964c99
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x964ccd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edx, pe_nt_image_headers32
or eax, 0x100
add ecx, ecx
mov esi, edx
and esi, ecx
add esi, edx
mov edi, eax
shr edi, 8
add esi, edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 7
and edi, 1
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
add ebx, dword [edi + esi*4]
add eax, eax
mov esi, eax
xor esi, ecx
not esi
and edx, esi
cmp eax, 0x10000
jb 0x964ce5
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x964daf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov edi, 1
shl edi, cl
or eax, edi
cmp eax, 1
je 0x964df4
mov ecx, eax
shr ecx, 1
mov ecx, dword [ebx + ecx*4]
mov edi, eax
and edi, 1
neg edi
and edi, 0x7ff
xor ecx, edi
shr ecx, 4
add edx, dword [esi + ecx*4]
shr eax, 1
cmp eax, 1
jne 0x964dd1
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x964dfb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, 1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x964e46
mov edx, ebx
and edx, 1
shr ebx, 1
mov esi, dword [ebp + 8]
mov esi, dword [esi + eax*4]
mov edi, edx
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
mov esi, dword [edi + esi*4]
add dword [ebp - 4], esi
add eax, eax
or edx, eax
mov eax, edx
dec ecx
test ecx, ecx
jne 0x964e16
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x96ad68
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
add edx, 0x18
add eax, edx
mov edx, dword [ebp - 0x2c]
movzx edx, word [edx + 0x14]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x96ae9b
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x10], 0
jne 0x96ae27
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x96ae21
push 4
push 0x1000
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x1c]
push eax
call fcn.00880ce4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x96adff
mov byte [ebp - 0xd], 0
jmp 0x96ae9f
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
call fcn.005c8354
add dword [ebp - 0x24], 0x28
jmp 0x96ae8f
push 4
push 0x1000
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x1c]
push eax
call fcn.00880ce4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x96ae53
mov byte [ebp - 0xd], 0
jmp 0x96ae9f
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
add eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
call fcn.005c7bb0
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [eax + 8], edx
add dword [ebp - 0x24], 0x28
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x96adbb
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x96dd28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x96d269
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.005c7dcc
mov eax, dword [0x97d6bc]
inc dword [eax]
mov eax, 3
call fcn.005c7df4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x96dd76
mov eax, dword [0x97d54c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x28], 1
jne 0x96dd86
mov eax, dword [str._oRh]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x28], 2
jne 0x96dd96
mov eax, dword [0x97d6a0]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x78], 0
je 0x96de5f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
call fcn.005c7dcc
mov eax, dword [0x97d6bc]
inc dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
fild qword [ebp - 0x38]
fdiv dword [0x96d298]
call fcn.005c8254
call fcn.005c7df4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
cmp byte [ebp - 1], 0
jne 0x96de5f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
call fcn.005c7bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x96de78
cmp dword [ebp - 0x10], 0
jne 0x96de8d
mov eax, 0x64
call fcn.0096cdd4
jmp 0x96dd3f
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a2507
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ch, dl
inc edi
jmp 0x5a24bd
rdtsc
mov dl, 0xac
mov di, word [esp]
lea ebp, [esp]
mov cl, ch
jmp 0x5a24dc
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
pushfd
xchg ecx, edi
sub dx, 0x60f0
jmp 0x5a24d5
mov dl, 0xac
mov di, word [esp]
jmp 0x5a247f
mov esi, dword [esp + 0x28]
shr ch, 5
jo 0x5a2477
rdtsc
jmp 0x5a24a7
jne 0x5a2472
xchg ch, dl
inc edi
jmp 0x5a2475
xchg dh, al
shr ah, 1
jmp 0x5a253e
push edx
sub esp, 0xbc
jmp 0x5a251f
xchg bh, cl
jmp 0x5a2543
pop word [esp]
mov word [esp], bx
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x5a2495
mov edi, esp
mov ebx, 0xa85eec7c
bsr dx, bp
jl 0x5a24f0
xchg bh, cl
clc
jmp 0x5a2544
jl 0x5a24e7
push edx
jmp 0x5a24e8
clc
mov ecx, esi
lea ebx, [ebp + 0x17]
and bx, 0x792c
jmp 0x5a2892
not edx
rdtsc
jmp 0x5a21dd
jle 0x5a2554
not edx
rdtsc
jmp 0x5a21dd

Function at 0x5c2b9d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov dword [esp + 0x10], ebp
push edx
pop word [esp]
call fcn.005c2b86
cmp ch, byte [edi + 0x6a95a3f]
push eax
rcl byte [esi + 0x31], 0xc0
jle 0x5c2b51
sar byte [esi - 3], 0xcc
int3
mov eax, 0xb5393ab4
xchg al, ah
not ax
setnp al
push ebx
jmp 0x5c2b32
lea esp, [esp + 4]
jl 0x595171
jge 0x5c2b55

Function at 0x5c2ba9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 0x11]
setno dh
jmp 0x5c2c49
push edx
mov edi, dword [esp + 4]
mov si, 0x559b
jmp 0x5c346a
lea esp, [esp + 4]
jle 0x59514f
jg 0x5c2bb9
jnp 0x5c2c09
int 0x5c
lea ecx, [eax - 1]
neg bh
jmp 0x5c2bfe
and al, 0x20
mov dword [ebp - 4], ecx
bts ecx, ebx
jmp 0x5c2c71
xor eax, 0x891605c4
sbb dword [eax - 0x75], edi
dec edx
mov byte [edx], ch
mov eax, 0xcbad2adf
mov edx, dword [esi]
mov di, word [esp]
mov edi, edx
jmp 0x5c2c7b
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
pushal
sub esp, 0x10
push dword [esp + 0xa]
jmp 0x5c2cb6
in al, dx
inc esi
jno 0x5c2bd5
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
add esi, 0x10
neg dh
sbb al, 0x9d
add al, 0xf4
pop ecx
add byte [ebx - 0x2109ef3a], al
lea edx, [eax*4]
jmp 0x5c2c28
mov ecx, 0xff
jmp 0x595138
shr edi, 0x18
sub esp, 0xc
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
and edi, ecx
jmp 0x5c2c32
pop dword [esp]
and ebx, ecx
call 0x5c2cc1
jb 0x5c2c45
in al, dx
or ah, byte [esi - 0x77]
jl 0x5c2cec
add al, 0x8d
and al, 2
jmp 0x5c2d83
and al, 5
jmp 0x5c2d4b
btc ebx, edx
lea esp, [esp + 0x20]
movzx ebx, byte [esi + 2]
call 0x5c2d00
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
stc
call fcn.005c2d5b
pop es
mov ds, word [ebx + edi*2]
xchg esi, eax
daa
xchg ebx, eax
and esi, dword [ebx - reloc.RASAPI32.dll_RasHangUpA]
adc dword [eax + reloc.RASAPI32.dll_RasHangUpA], edx
and al, 2
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
and ebx, ecx
push esp
jmp 0x5c2d29
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
bt ebx, edx
bswap ebx
pushal
jmp 0x5c2d19
lea esp, [esp + 8]
Function at 0x5c2e01
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
stc
mov dh, bh
mov edx, dword [esi + 4]
stc
jmp 0x5c2e55
and edx, ecx
lea esp, [esp + 0xc]
jmp 0x5c2de1
mov edi, edx
call 0x5c2e98
mov ebp, 0x28d9be28
xchg esi, eax
fld qword [ebp - 0x2b]
mov esp, 0x6774f24f
mov ds, word [ecx]
js 0x5c2e91
sub esp, 0x18
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
pushal
mov edi, 0xc7f79ea8
jmp 0x5c2e1d
push edx
lea esp, [esp + 1]
push word [esp]
lea esp, [esp + 1]
mov dword [esi], edi
jmp 0x5c2e36
test esp, ebp
pop ds
test al, 4
mov bh, 0x9e
pop word [esp]
call fcn.005c2e7f

Function at 0x5c2f90
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmc
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x5c2f63
and edx, ecx
push edi
mov edi, edx
jmp 0x5c2fac
and edx, ecx
cmc
cmc
push edx
call 0x5c2f90
dec ebx
jmp 0x5c3041
pushal
pushal
mov dword [esp + 0x33], esi
jmp 0x5c2ff5
lea edi, [edi*4]
lea edi, reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [edi]
pop edi
jmp 0x5c2f85
mov dword [ebp], edi
pop ebp
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x5c301f
push ebp
mov ebp, esi
lea ebp, [ebp + 4]
jmp 0x5c2fd9
mov edx, edi
lea edx, [edx*4]
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov edi, dword [edx]
jmp 0x5c3027
mov edi, edx
shr edi, 0x18
push edx
jmp 0x5c2ffd
pop edx
and edi, ecx
push ecx
jmp 0x5c3059
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
neg dh
neg dx
mov edx, dword [esi + 8]
jmp 0x5c2f95
mov ecx, edi
jmp 0x5c3387
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov dx, 0x71dd
add edx, ecx
jmp 0x5c30d1
mov dword [esp], esi
and edx, ecx
sub esp, 0xe
sub esp, 0x12
jmp 0x5c3081
and edx, ecx
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
push edx
mov dword [esp], esi
jmp 0x5c30a4
mov edx, dword [esi + 0xc]
sub esp, 0xa
pop dword [esp]
pushal
mov word [esp + 0xc], di
jmp 0x5c3171
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
not ebx
lea ebx, [ecx*4]
mov ebx, 0x988651e
movzx ebx, byte [esi + 0xd]
jmp 0x5c30c2
and ebx, ecx
sub esp, 0x1e
push word [esp + 0x1b]
lea esp, [esp + 0x20]
jmp 0x5c30e9
shl edi, 0x13
mov edi, edx
call 0x5c312f
sbb ch, al
add eax, 0x6d000001
cmc
or al, 0xff
inc edx
jge 0x5c3122
je 0x5c3151
out dx, al
pop ecx
lea ebx, [ebx]
mov ebp, esi
sbb eax, 0x8cbffeac
dec edx
mov al, 0x8b
sbb al, 0x9d
add al, 0xf4
mov edi, 0xb04af28c
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov di, 0xca6f
bts edi, edi
not di
jmp 0x5c3124
pop ecx
add byte [esi - 0x41], ah
outsd dx, dword [esi]
retf 0xab0f
lea esp, [esp + 2]
mov dword [esi + 8], edi
bsf di, si
mov di, word [esp]
mov edi, dword [esp]
jmp 0x5c3147
lea ebx, [esp + edx]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
clc
jmp 0x5c3114
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov bl, byte [esp]
mov bx, 0xef4d
jmp 0x5c3258
lea ecx, [ecx*4]
lea ecx, reloc.RASAPI32.dll_RasHangUpA
mov edi, dword [ecx]
pop ecx
jmp 0x5c32ce