joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ed90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
push ebx
mov ebx, dword [esp + 0x420]
mov ecx, ebx
call sub.MFC42.DLL_CString::Empty
mov ecx, dword [esp + 0x418]
mov edx, dword [esp + 0x414]
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41edd7
xor eax, eax
pop ebx
add esp, 0x40c
ret 0x10
push esi
mov esi, dword [esp + 0x420]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x14], eax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push esi
push eax
mov dword [esp + 0x28], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop edi
pop esi
test eax, eax
je 0x41ee3a
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebx
add esp, 0x40c
ret 0x10
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x435020
push ebx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov eax, 1
pop ebx
add esp, 0x40c
ret 0x10

Function at 0x41ee70
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42b168
push eax
mov dword fs:[0], esp
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0x440b68
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x41eed7
lea ecx, [esp + 0x1c]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret 0x10
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x1c]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x41ef27
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret 0x10
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0xc
ret 0x10
Function at 0x41ef60
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42b18b
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebp
push esi
mov ebp, ecx
push 0xffffffffffffffff
mov ecx, dword [esp + 0x134]
push 0
call sub.MFC42.DLL_CStringArray::SetSize
mov esi, dword [esp + 0x12c]
mov eax, dword [ebp + 0x94]
push esi
push str.CXSyncExeDlg::GetReistryValueList__strSubKey___s.
mov ecx, dword [eax + 0xd0]
push 2
push ecx
call fcn.00407c90
mov eax, dword [esp + 0x138]
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41f0fa
push ebx
push edi
mov ecx, 0x41
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
xor esi, esi
mov dword [esp + 0x14], 0x104
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push esi
lea edx, [esp + 0x2c]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x148], esi
call ebx
cmp eax, 0x103
je 0x41f0b2
test eax, eax
jne 0x41f06d
mov eax, dword [esp + 0x134]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x134]
push edx
push eax
push ecx
mov ecx, ebp
call fcn.0041ed90
test eax, eax
je 0x41f06d
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x41f06d
mov ecx, dword [esp + 0x138]
lea edx, [esp + 0x10]
push edx
mov eax, dword [ecx + 8]
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow_1
push 0x440b68
lea ecx, [esp + 0x14]
inc esi
mov dword [esp + 0x18], 0x104
call sub.MFC42.DLL_CString::operator_1
xor eax, eax
mov edx, dword [esp + 0x18]
push eax
mov ecx, 0x41
lea edi, [esp + 0x20]
push eax
push eax
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x2c]
push eax
push ecx
push esi
push edx
call ebx
cmp eax, 0x103
jne 0x41f024
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x138]
mov edx, dword [ebp + 0x94]
mov eax, dword [ecx + 8]
push eax
mov eax, dword [edx + 0xd0]
push str.CXSyncExeDlg::GetReistryValueList__Font_count___d.
push 2
push eax
call fcn.00407c90
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x128], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop ebx
mov ecx, dword [esp + 0x118]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x11c
ret 0xc
Function at 0x41f5d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x42b238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov esi, ecx
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0x54], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
xor ebx, ebx
lea ecx, [esp + 0x60]
push ebx
mov byte [esp + 0x58], 2
call sub.MFC42.DLL_CString::GetBuffer
push eax
push ebx
lea ecx, [esp + 0x64]
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea eax, [esp + 0x14]
push str.CXSyncExeDlg::GetProcessHandleByShellExecute__File_s__Parameters_s
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0xc]
push ebx
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esi + 0x94]
push eax
push 2
mov edx, dword [ecx + 0xd0]
push edx
call fcn.00407c90
add esp, 0xc
lea ecx, [esp + 0x5c]
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x18], ebx
push ebx
mov dword [esp + 0x18], 0x500
mov dword [esp + 0x20], str.runas
call sub.MFC42.DLL_CString::GetBuffer
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
cmp dword [eax - 8], ebx
je 0x41f69d
push ebx
lea ecx, [esp + 0x64]
call sub.MFC42.DLL_CString::GetBuffer
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 1
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x41f73d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x10]
push str.CXSyncExeDlg::GetProcessHandleByShellExecute__ShellExecuteEx___Fail__ErrNo___d
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
push ebx
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [esi + 0x94]
push 2
mov ecx, dword [eax + 0xd0]
push ecx
call fcn.00407c90
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0x54], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x5c]
mov byte [esp + 0x54], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x60]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret 8
mov esi, dword [esp + 0x48]
lea ecx, [esp + 0xc]
mov byte [esp + 0x54], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x5c]
mov byte [esp + 0x54], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x60]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x4c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret 8
Function at 0x423580
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x42358b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x42368e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x42f6b8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x42f6b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x42f6b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x42f6b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x42f6b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x42f6b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x42f6b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x42f6b8]
xor eax, edx
inc ecx
dec edi
jne 0x4235a6
pop edi
test esi, esi
je 0x4236b0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x42f6b8]
xor eax, edx
inc ecx
dec esi
jne 0x423692
pop esi
pop ebx
not eax
ret

Function at 0x424000
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x424041
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x424036
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x424054
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x424fd0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x425088
cmp dword [ebp + 4], 0xffffffff
jne 0x425088
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x435084
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x42504d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x42504d
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.00423d90
add esp, 0x10
test eax, eax
jne 0x425070
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.004242d0
add esp, 4
mov dword [ebp], eax
mov eax, dword [0x44140c]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x4254c0
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
test ebx, ebx
je 0x425588
mov al, byte [ebx]
test al, al
je 0x425588
push esi
push edi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x4254ee
cmp al, 0x5c
jne 0x4254f0
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4254e6
mov edi, dword [esp + 0x218]
cmp esi, ebx
je 0x425525
sub esi, ebx
lea eax, [esp + 0xc]
push esi
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.004254c0
add esp, 0x14
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x426120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x42612b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x42622e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x42fac0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x42fac0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x42fac0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x42fac0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x42fac0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x42fac0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x42fac0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x42fac0]
xor eax, edx
inc ecx
dec edi
jne 0x426146
pop edi
test esi, esi
je 0x426250
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x42fac0]
xor eax, edx
inc ecx
dec esi
jne 0x426232
pop esi
pop ebx
not eax
ret
Function at 0x402120
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 0x108]
push eax
push 0x88
push 0x419010
call fcn.00402100
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
push 0x38
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
call fcn.00402100
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
push 0x41
push str.Microsoft_Enhanced_DSS_and_Diffie_Hellman_Cryptographic_Provider
call fcn.00402100
add esp, 0xc
mov byte [ebp - 0x109], 0
mov dword [0x41a024], 0
mov dword [0x41a12c], 0
push 0x80
lea eax, [ebp - 0x108]
push eax
push 0x41a028
call sub.MSVCRT.dll_memmove
add esp, 0xc
push 0x80
push 0x41a028
push 0x41a028
call fcn.004022d0
add esp, 0xc
push 0x80
push 0x41a0a8
call fcn.00403310
add esp, 8
mov byte [0x41a0a8], 2
push 0xf0000000
push 0xd
lea ecx, [ebp - 0x48]
push ecx
push 0
push 0x41a024
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x402242
push 0xf0000000
push 0x18
lea edx, [ebp - 0x80]
push edx
push 0
push 0x41a12c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x402229
call fcn.00403280
mov byte [ebp - 0x109], al
movzx eax, byte [ebp - 0x109]
test eax, eax
jne 0x402229
push 0
mov ecx, dword [0x41a12c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movzx edx, byte [ebp - 0x109]
test edx, edx
jne 0x402242
push 0
mov eax, dword [0x41a024]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 0x109]
mov esp, ebp
pop ebp
ret

Function at 0x4023c0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
lea edx, [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x40
push 1
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x40240b
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004022d0
add esp, 0xc
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4025d0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 5], 0
mov dword [ebp - 4], 0x10
push 0x10
mov eax, dword [ebp + 8]
add eax, 8
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x18
push ecx
call sub.MSVCRT.dll_memmove
add esp, 0xc
push 0x10
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x402661
mov dword [ebp - 0xc], 0xf
jmp 0x40262e
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x40265b
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 8]
add dl, 1
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov byte [eax + 8], dl
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 8]
test edx, edx
je 0x402659
jmp 0x40265b
jmp 0x402625
mov byte [ebp - 5], 1
jmp 0x402672
push 0x10
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
call fcn.00403310
add esp, 8
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x402680
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x1c], 8
mov byte [ebp - 0x1b], 2
xor eax, eax
mov word [ebp - 0x1a], ax
mov dword [ebp - 0x18], 0x660e
mov dword [ebp - 0x14], 0x10
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call sub.MSVCRT.dll_memmove
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [0x41a12c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x40275e
mov dword [ebp - 0x20], 2
push 0
lea eax, [ebp - 0x20]
push eax
push 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x402741
cmp dword [ebp + 0x10], 0
je 0x402717
push 0x10
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call sub.MSVCRT.dll_memmove
add esp, 0xc
jmp 0x402728
push 0x10
mov edx, dword [ebp + 8]
add edx, 8
push edx
call fcn.00403310
add esp, 8
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004025d0
add esp, 4
mov byte [ebp - 0x21], al
movzx edx, byte [ebp - 0x21]
test edx, edx
jne 0x40275e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov al, byte [ebp - 0x21]
mov esp, ebp
pop ebp
ret
Function at 0x4029f0
Capabilities:
Hash data via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [ebp - 5], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x402a51
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateHash]
test eax, eax
je 0x402a51
push 0
lea edx, [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x403c60
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
mov dword [0x419ee0], 0
push 0x11c
push 0x419db8
call fcn.00403310
add esp, 8
mov dword [0x419db8], 0x11c
push 0x419db8
call dword [0x419fe4]
push 0x400
push 0
call fcn.00403330
add esp, 8
mov dword [0x419db4], eax
cmp dword [0x419db4], 0
je 0x403df9
mov dword [ebp - 0x814], 0x400
lea eax, [ebp - 0x870]
push eax
push 0x50
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:72.0__Gecko_20100101_Firefox_72.0
call fcn.00402100
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x870]
push ecx
mov edx, dword [0x419db4]
push edx
call fcn.00403ac0
add esp, 0xc
mov eax, dword [0x419db4]
push eax
push 0x4153ac
push 0x400
lea ecx, [ebp - 0x808]
push ecx
call dword [0x419fac]
add esp, 0x10
xor edx, edx
mov word [ebp - 0xa], dx
cmp dword [0x419dbc], 6
jb 0x403d45
cmp dword [0x419dc0], 3
jb 0x403d45
movzx eax, word [0x419ecc]
test eax, eax
jl 0x403d45
mov dword [ebp - 0x874], 1
jmp 0x403d4f
mov dword [ebp - 0x874], 0
mov cl, byte [ebp - 0x874]
mov byte [ebp - 1], cl
push 0
push 0
push 0
movzx edx, byte [ebp - 1]
neg edx
sbb edx, edx
and edx, 4
push edx
lea eax, [ebp - 0x808]
push eax
call dword [0x419fc8]
mov dword [0x419ed8], eax
cmp dword [0x419ed8], 0
je 0x403dec
push 0
push 0x419ee8
call fcn.00403b70
add esp, 8
lea ecx, [ebp - 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [ebp - 0x80c]
mov dword [ebp - 0x81c], edx
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x814]
push ecx
lea edx, [ebp - 0x820]
push edx
call dword [0x419fb0]
mov eax, dword [ebp - 0x814]
push eax
call fcn.00403bf0
add esp, 4
mov ecx, dword [ebp - 0x814]
mov dword [0x419ed4], ecx
mov al, 1
jmp 0x403dfb
push 0x419db4
call fcn.004033c0
add esp, 4
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x404220
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x11], 0
push 0x28cc
mov eax, dword [ebp + 0xc]
push eax
call fcn.00403310
add esp, 8
push 0x10
lea ecx, [ebp - 0x10]
push ecx
call fcn.00403310
add esp, 8
lea edx, [ebp - 0x10]
push edx
call dword [0x41a01c]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x404284
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0x11], cl
movzx edx, byte [ebp - 0x11]
test edx, edx
je 0x404284
mov dword [ebp - 0x10], 1
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x404324
mov byte [ebp - 0x11], 0
cmp dword [ebp - 0x10], 0
je 0x4042af
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00404130
add esp, 0xc
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x4042d4
cmp dword [ebp - 0xc], 0
je 0x4042d4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00404130
add esp, 0xc
mov byte [ebp - 0x11], al
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
jne 0x4042f4
cmp dword [ebp - 8], 0
je 0x4042f4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
push 1
call fcn.00403e20
add esp, 0xc
cmp dword [ebp - 0xc], 0
je 0x404304
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x404314
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x404324
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esp, ebp
pop ebp
ret