joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c6b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10039534]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
jmp 0x1002c6dc
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x3c
jge 0x1002c6ed
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
jmp 0x1002c6d3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
xor edx, edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
push 0x1c
push 0x7b
lea eax, [ebp - 0x20]
push eax
call fcn.100090e0
add esp, 0xc
push 0x1f8
call fcn.1000840c
add esp, 4
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x28], ecx
push 0x1f8
push 0x7b
mov edx, dword [ebp - 0x28]
push edx
call fcn.100090e0
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.10008b84
add esp, 4
mov dword [ebp - 0x30], 1
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
add eax, 9
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 1
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
add edx, 9
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
add ecx, 9
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], 1
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
add eax, 9
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 1
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
add edx, 9
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x58]
add eax, 1
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
add ecx, 9
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], 1
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
add eax, 9
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], 1
mov ecx, dword [ebp - 0x68]
add ecx, 1
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x68]
add edx, 9
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x70], 1
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
add ecx, 9
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], 1
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x78]
add eax, 9
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008b75
mov esp, ebp
pop ebp
ret
Function at 0x1002ea80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
call fcn.10027df0
push 0x3c
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.100090e0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x100361dc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x38], 0x40
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x1002eae1
xor eax, eax
jmp 0x1002eaf2
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1002f4e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030c1e
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x10039534]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1002b650
push str.SoftwareBaidu_
lea ecx, [ebp - 0x2c]
call fcn.10004500
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100045e0
mov dword [ebp - 0x238], 0x100
lea ecx, [ebp - 0x30]
push ecx
push 0xf003f
push 0
lea ecx, [ebp - 0x2c]
call fcn.100046a0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002f5bc
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x34]
push ecx
push 0
mov ecx, dword [ebp + 0xc]
call fcn.100046a0
push eax
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002f599
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.100045c0
jmp 0x1002f5ba
mov dword [ebp - 0x23c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10004580
mov eax, dword [ebp - 0x23c]
jmp 0x1002f601
jmp 0x1002f5dd
mov dword [ebp - 0x240], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10004580
mov eax, dword [ebp - 0x240]
jmp 0x1002f601
call fcn.1002b480
mov dword [ebp - 0x244], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10004580
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10008b75
mov esp, ebp
pop ebp
ret
Function at 0x1002f860
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030c99
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x10039534]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.100282a0
mov word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.100090e0
add esp, 0xc
mov dword [ebp - 0x228], 0
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x260]
call fcn.10004500
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.100044d0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x244]
push eax
call fcn.1002ed40
add esp, 4
push 0x100361b4
lea ecx, [ebp - 0x260]
call fcn.10004600
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x260]
call fcn.100045e0
lea edx, [ebp - 0x260]
push edx
mov ecx, dword [ebp + 8]
call fcn.100045a0
push 0
lea ecx, [ebp - 0x260]
call fcn.100046a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.10004580
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.10004580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10008b75
mov esp, ebp
pop ebp
ret
Function at 0x10030090
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x10039534]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
jne 0x100300b1
xor al, al
jmp 0x10030121
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100300c7
xor al, al
jmp 0x10030121
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10030114
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10030100
mov byte [ebp - 1], 1
jmp 0x10030114
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100300e5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10008b75
mov esp, ebp
pop ebp
ret
Function at 0x4040b0
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x118
lea ecx, [esp + 4]
push edi
push eax
push str.Explorer.exe__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push eax
push 1
push 0
push str.Shell
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x118
ret

Function at 0x40b250
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40b283
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40b283
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x40b283
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40b283
mov al, 1
ret
xor al, al
ret
Function at 0x40c1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov edx, dword [eax + 0x3c]
add edx, eax
cmp dword [edx + 0x74], 0
jbe 0x40c313
cmp word [edx + 0x14], 0x68
jb 0x40c313
add edx, 0x78
je 0x40c313
mov eax, dword [edi]
push dword [edx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40c313
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 0x3c]
add edx, ecx
cmp dword [edx + 0x74], 0
jbe 0x40c313
cmp word [edx + 0x14], 0x68
jb 0x40c313
add edx, 0x78
je 0x40c313
mov eax, dword [edi]
push dword [edx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x40c313
mov ecx, dword [ebp + 8]
cmp ecx, 0xffff
ja 0x40c278
movzx ebx, cx
jmp 0x40c349
mov eax, dword [edi]
push dword [ebx + 0x20]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov ecx, dword [ebx + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edx
lea ebx, [eax + ecx*4]
cmp eax, ebx
je 0x40c313
nop
mov eax, ebx
sub eax, edx
sar eax, 2
mov eax, eax
test eax, eax
jns 0x40c2b0
add eax, 1
sar eax, 1
push dword [edx + eax*4]
lea ecx, [edx + eax*4]
mov eax, dword [edi]
mov dword [ebp - 8], ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
mov dl, byte [esi]
test dl, dl
je 0x40c2f1
mov cl, dl
sub esi, eax
nop dword [eax]
mov dl, cl
cmp cl, byte [eax]
jne 0x40c2f1
mov cl, byte [esi + eax + 1]
inc eax
mov dl, cl
test cl, cl
jne 0x40c2e0
movzx eax, byte [eax]
movzx ecx, dl
sub ecx, eax
je 0x40c31e
mov edx, dword [ebp - 8]
test ecx, ecx
cmovle ebx, edx
add edx, 4
test ecx, ecx
cmovle edx, dword [ebp - 4]
mov dword [ebp - 4], edx
cmp edx, ebx
jne 0x40c2a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov ebx, dword [ebp - 0x10]
mov esi, dword [eax + 4]
mov ecx, esi
push dword [ebx + 0x24]
call dword [0x5c689c]
mov ecx, edi
call esi
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x14]
sar edx, 2
mov ax, word [eax + edx*2]
add ax, word [ebx + 0x10]
movzx ebx, ax
mov eax, dword [edi]
mov ecx, dword [ebp - 0xc]
mov esi, dword [eax + 4]
push dword [ecx + 0x1c]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov edx, dword [ebp - 0xc]
movzx ecx, bx
pop edi
pop esi
sub ecx, dword [edx + 0x10]
pop ebx
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret 4
Function at 0x5251d3
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
cld
mov dl, pe_nt_image_headers32
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00525255
jae 0x5251e0
xor ecx, ecx
call fcn.00525255
jae 0x52520f
xor eax, eax
call fcn.00525255
jae 0x52521f
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00525255
adc al, al
jae 0x525201
jne 0x52524b
stosb byte es:[edi], al
jmp 0x5251e3
call fcn.00525261
sub ecx, ebx
jne 0x525228
call fcn.0052525f
jmp 0x525247
lodsb al, byte [esi]
shr eax, 1
je 0x525271
adc ecx, ecx
jmp 0x525244
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0052525f
cmp eax, 0x7d00
jae 0x525244
cmp ah, 5
jae 0x525245
cmp eax, 0x7f
ja 0x525246
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5251e3
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x521b48
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], si
mov byte [esp + 2], bh
push word [esp + 2]
jg 0x521c07
jle 0x521bd3
div dword [esi - 0x1c]
cmp dword [esi - 0x35], 0xffffffe7
push cs
cdq
clc
lea esp, [esp + 2]
mov dword [esp], edx
jmp 0x521c0e
lea esp, [esp + 2]
mov dword [esp], edx
call fcn.00521b85
call fcn.00521c2d
add edx, 0xb58e269a
jmp 0x522391
mov cl, 0xd2
mov cl, al
lea ecx, [eax + ebp]
bswap ecx
jmp 0x5223c3
jmp 0x5223d9
mov esp, ebp
mov ecx, dword [esp]
mov ch, dl
bsf ecx, edx
jb 0x5223ad
lea ecx, [ebx + ebp]
jmp 0x5223dc
lea ecx, [ebx + ebp]
push edx
ret

Function at 0x521b91
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x521be5

Function at 0x521c2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x521c7a
xchg bx, ax
jmp 0x521c64
xchg bx, ax
mov ch, byte [esp]
not edx
jmp 0x521d1c
mov ch, byte [esp]
not edx
jmp 0x521d1c
mov cl, 0xb3
lea esi, [esp + 4]
inc bh
jo 0x521c2f
jno 0x521c37
jae 0x521c87
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
invalid
mov cx, bp
bt edx, ebp
jmp 0x521cff
bts dx, di
ja 0x521c9a
mov cx, bp
bt edx, ebp
mov cl, 0xf5
mov dl, byte [esp]
jmp fcn.00521d04
mov ebx, edi
rdtsc
setne ch
mov dh, 0x32
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov ax, 0x1769
jmp 0x521cb0
mov cl, 0xf5
mov dl, byte [esp]
sub esp, 0xbc
mov ebp, esp
mov ch, 0x47
rdtsc
jmp 0x521cd4

Function at 0x523f55
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
jmp 0x52400c
inc esi
mov di, si
xchg dword [esp + 8], ecx
call fcn.00523fc1
mov edx, 0x49aba89
jmp 0x524064
sub esp, 0xc0
mov ebp, esp
dec ax
jnp 0x52404e
mov dh, byte [esp]
mov ecx, dword [esp]
jmp fcn.00524096

Function at 0x550d10
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp], dl
jmp 0x551055
lea esp, [esp + 4]
jl 0x5149c9
setae ah
mov eax, dword [ebp - 8]
jmp 0x5149df
Function at 0x550d18
Capabilities:
Encrypt data using aes

Disassembly:
mov dx, word [esp]
lea ebx, [edi*4]
xchg bl, dl
rol dl, 6
jmp 0x550d40
pop edi
xchg bx, si
mov bl, dh
jmp 0x55132f
push dword [esp]
lea esp, [esp + 2]
jmp 0x550f92
movzx ebx, byte [esi + 0x11]
mov edi, ebx
push edi
jmp 0x550d7e
mov ecx, 0xff
jmp 0x514a0d
lea edi, [edi*4]
lea edi, reloc.RASAPI32.dll_RasHangUpA
mov ebx, dword [edi]
pop edi
jmp 0x550f1a
pushal
mov esi, ebp
mov ah, 0xc1
mov dword [esp], ebx
popal
jmp 0x550d68
lea ecx, [eax - 1]
push sp
lea esp, [esp + 2]
mov dword [ebp - 4], ecx
jmp 0x550d5e
popal
jmp 0x550ddf
mov edx, dword [esi]
pushal
or esi, ecx
mov eax, ecx
mov dword [esp], edx
jmp 0x550da7
shr edi, 0x18
sub esp, 0x13
lea esp, [esp + 3]
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
call 0x550dc9
and ebx, ecx
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x550e47
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
call 0x550e04
movzx ebx, byte [esi + 5]
jmp 0x550eba
add esi, 0x10
bsf di, bp
lea edx, [esi + 0x90]
mov dl, al
neg dl
jmp 0x550dbd
and edx, ecx
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
call fcn.00550ea0
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov edx, esp
mov dh, bh
jmp 0x550efb
mov ebp, esi
mov dword [ebp], edi
pop ebp
jmp 0x550f53
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [esi + 4]
push ebp
jmp 0x550ee5
sub esp, 0xf
btc dx, ax
pop dword [esp + 2]
lea esp, [esp + 3]
lea esp, [esp + 8]
jmp 0x550e8a
shr edi, 0x18
sub esp, 6
mov byte [esp + 2], dh
lea esp, [esp + 2]
jmp 0x550f75
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov edi, edx
cmc
jmp 0x550f32
and edi, ecx
stc
stc
stc
jmp 0x550feb
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
pushal
mov byte [esp + 7], ah
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x550f5f
lea esp, [esp + 8]
jle 0x514a23
lea edi, [eax + ecx]
mov bh, 0x51
jmp 0x550d99
sub esp, 0xe
call fcn.00550fcd
jo 0x550fab
add byte [eax], al
add byte [eax - 5], dh
imul ecx, dword [esi], reloc.RASAPI32.dll_RasHangUpA
dec edi
push esi
fdiv qword [edx + 0x15]
in al, 0x25
test eax, 0x3d826bc8
lea ebx, reloc.RASAPI32.dll_RasHangUpA
mov edi, dword [ebx]
pop ebx
cmc
and ebx, ecx
jmp 0x550fa6
push ebx
mov ebx, edi
lea ebx, [ebx*4]
jmp 0x550fbf
mov bx, word [esp]
jmp 0x551390
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
pop ebx
leave
ret
pop esi
pushal
pop bx
bswap ebx
mov ebx, 0x595127e7
jmp 0x551371
Function at 0x550fcd
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp + 0xd], edi
lea esp, [esp + 2]
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x55100d
and ebx, ecx
push di
mov word [esp], bp
push word [esp]
jmp 0x551031
movzx ebx, byte [esi + 6]
stc
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x550ff7
movzx ebx, byte [esi + 9]
jmp 0x5512d9
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
not bx
bsr ebx, edx
jmp 0x55101b
mov ebp, 0x63d7ebda
in al, dx
bound eax, qword [0xf97730f4]
imul ecx, dword [eax], reloc.RASAPI32.dll_RasHangUpA
xchg edx, eax
or eax, 0x24648d9c
add al, 0xf
mov word [edx + 0x39], gs
cld
dec dword [edi]
xchg ebx, eax
les ecx, [ebx + 0x75e9f845]
cmp esp, edi
dec dword [ebx - reloc.RASAPI32.dll_RasHangUpA]
invalid
mov edx, dword [esi + 8]
push eax
mov eax, esi
jmp 0x5510a3
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
lea edi, [edx*4]
xor di, sp
call 0x551126
loopne 0x5510fd
jecxz 0x551012
jne 0x551040
mul cl
and byte [ebp - 0x72fddb9c], cl
and al, 0x20
lea esp, [esp + 2]
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
cmc
jmp 0x55106a
add eax, 4
mov dword [eax], edi
pop eax
bsr edi, edx
lea edi, reloc.RASAPI32.dll_RasHangUpA
shr di, 0
jmp 0x551072
mov edx, dword [ecx]
pop ecx
pushfd
and edx, ecx
sub esp, 0xa
jmp 0x551091
pushal
and edi, ecx
push ecx
clc
pop word [esp]
jmp 0x551104
shr edi, 0x18
sub esp, 0x19
lea esp, [esp + 1]
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov ebp, 0x51f570
jmp 0x5510d8
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
call fcn.00551194
enter 0xffffffffffffcd5d, 0xffffffffffffff94
salc
cmp ch, byte [esi + 0x3b65b3c]
aas
push es
mov cl, 0xb0
mov bl, 0xaa
mov edi, edx
jmp 0x5510f1
push ecx
mov ecx, edx
lea ecx, [ecx*4]
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x5510cd
and edx, ecx
sub esp, 0x14
push di
lea esp, [esp + 2]
jmp 0x5511d5
Function at 0x551194
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x11
mov word [esp + 6], si
lea esp, [esp + 1]
jmp 0x55114b
mov edi, esi
add edi, 0xa
movzx ebx, byte [edi]
pop edi
jmp 0x55112a
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x55117b
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
lea ebx, [eax*4]
mov bl, al
push edi
jmp 0x551140
and ebx, ecx
sub esp, 6
lea esp, [esp + 2]
jmp 0x5511ae
and ebx, ecx
jmp 0x551164
sub esp, 7
lea esp, [esp + 1]
lea esp, [esp + 2]
jmp 0x551298
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov ebx, edx
movzx ebx, byte [esi + 0xd]
jmp 0x551198
xchg dh, cl
mov dl, cl
rol cl, cl
mov dword [esp + 0x18], esi
pushfd
pushal
jmp 0x55121e
mov edx, dword [esi + 0xc]
stc
push ecx
pushal
jmp 0x5511ea
push si
call fcn.00551241
push es
movsb byte es:[edi], byte [esi]
cmp bl, byte [ebp - 0x54]
sub edx, dword [ecx - 0x2f]
inc ecx
and bl, dl
rcl byte [ebx - 0x36]
lea esp, [esp + 0x24]
popal
add ecx, 8
mov dword [ecx], edi
pop ecx
jmp 0x551208
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
lea edx, [eax + ecx]
lea edx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x551200
and edx, ecx
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
and edx, ecx
jmp 0x551258

Function at 0x5fa93b
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp]
mov byte [esp + 1], al
push edx
mov dword [esp + 0x10], edx
pushfd
jmp 0x5fa980
lea esp, [esp + 2]
mov word [esp], dx
push esi
pushal
lea esp, [esp + 2]
mov dword [esp + 0x30], ebx
jmp 0x5faa0a

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x56b67d9a
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x53f6051a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x100055e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.10007470
test eax, eax
jne 0x1000568c
mov ecx, esi
call fcn.100074f0
test eax, eax
jne 0x1000568c
mov ecx, esi
call fcn.10006bf0
test eax, eax
jne 0x1000568c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000561a
call fcn.1002b5d0
push 0xbf800000
push 0xbf800000
push 0xffffffffffffffff
push 0x15
call fcn.10021b50
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x10
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
mov ebp, eax
call edi
mov ecx, esi
call fcn.10004f40
cmp eax, 5
je 0x1000566f
push 0x3e8
call edi
mov ecx, esi
call fcn.10004f40
cmp eax, 5
je 0x1000566f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
call ebx
sub eax, ebp
cmp eax, 0x2710
ja 0x10005666
push 0x1f4
call edi
mov ecx, esi
call fcn.10007470
test eax, eax
je 0x1000566f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4

Function at 0x100056a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, ecx
call fcn.10007470
test eax, eax
je 0x100056f9
push ebx
push esi
push edi
push 0xffffffffffffffff
push 0x15
call fcn.10021790
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, eax
push 0xfa
call ebx
mov ecx, ebp
call fcn.10007470
test eax, eax
je 0x100056f6
call esi
sub eax, edi
cmp eax, 0xfa0
jbe 0x100056cb
push 0xffffffffffffffff
push 0x15
call fcn.10021790
add esp, 8
jmp 0x100056cb
pop edi
pop esi
pop ebx
mov eax, 1
pop ebp
ret