joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4107e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488aa3
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], edx
mov esi, ecx
cmp byte [esi], 0
mov dword [ebp - 0x58], 0xf
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x6c], 0
jne 0x410830
xor ecx, ecx
jmp 0x41083c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410833
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x6c]
call fcn.00420190
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa8]
cmp dword [ebp - 0x58], 0x10
lea eax, [ebp - 0x6c]
push ecx
cmovae eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0xa4]
push ecx
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0xa4], xmm0
push eax
movups xmmword [ebp - 0x94], xmm0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 1
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x4108a2
mov esi, 2
jmp 0x4109bb
mov esi, dword [ebp - 0xa8]
mov dword [ebp - 0xac], esi
test esi, esi
je 0x4109b2
nop word [eax + eax]
mov dword [ebp - 0x70], 0xf
mov dword [ebp - 0x74], 0
mov byte [ebp - 0x84], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x84]
cmp dword [esi + 4], 2
mov edi, dword [esi + 0x18]
push 4
jne 0x4108f4
add edi, 4
push str.IPv4
jmp 0x4108fc
add edi, 8
push str.IPv6
call fcn.00420190
push 0x41
lea eax, [ebp - 0x54]
push eax
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_inet_ntop]
lea eax, [ebp - 0x54]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410916
mov edi, dword [ebp - 0xb0]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x410926
mov ecx, eax
mov edx, 0x49b684
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x420e50
call fcn.00420a00
lea edx, [ebp - 0x84]
mov ecx, eax
call fcn.00420c50
mov edx, 0x49b5d8
mov ecx, eax
call fcn.00420a00
lea edx, [ebp - 0x54]
mov ecx, eax
call fcn.00420a00
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x70]
cmp eax, 0x10
jb 0x410995
inc eax
push eax
push dword [ebp - 0x84]
call fcn.004206c0
mov esi, dword [ebp - 0xac]
mov esi, dword [esi + 0x1c]
mov dword [ebp - 0xac], esi
test esi, esi
jne 0x4108c0
mov esi, dword [ebp - 0xa8]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
xor esi, esi
mov ecx, dword [ebp - 0x58]
cmp ecx, 0x10
jb 0x4109cd
inc ecx
push ecx
push dword [ebp - 0x6c]
call fcn.004206c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
Function at 0x410ac0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
mov esi, ecx
xor ecx, ecx
nop
mov eax, ecx
shr eax, 1
test cl, 1
je 0x410ade
xor eax, 0xedb88320
test al, 1
je 0x410aeb
shr eax, 1
xor eax, 0xedb88320
jmp 0x410aed
shr eax, 1
test al, 1
je 0x410afa
shr eax, 1
xor eax, 0xedb88320
jmp 0x410afc
shr eax, 1
test al, 1
je 0x410b09
shr eax, 1
xor eax, 0xedb88320
jmp 0x410b0b
shr eax, 1
test al, 1
je 0x410b18
shr eax, 1
xor eax, 0xedb88320
jmp 0x410b1a
shr eax, 1
test al, 1
je 0x410b27
shr eax, 1
xor eax, 0xedb88320
jmp 0x410b29
shr eax, 1
test al, 1
je 0x410b36
shr eax, 1
xor eax, 0xedb88320
jmp 0x410b38
shr eax, 1
test al, 1
je 0x410b45
shr eax, 1
xor eax, 0xedb88320
jmp 0x410b47
shr eax, 1
mov dword [ebp + ecx*4 - 0x400], eax
inc ecx
cmp ecx, 0x100
jb 0x410ad0
or ecx, 0xffffffff
test edx, edx
je 0x410b7c
movzx eax, byte [esi]
lea esi, [esi + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [ebp + eax*4 - 0x400]
sub edx, 1
jne 0x410b62
not ecx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410b90
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push edi
push 0x288
mov dword [ebp - 8], 0x288
call esi
mov edi, eax
add esp, 4
test edi, edi
jne 0x410bd4
pop edi
mov eax, str.Null
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 8]
push eax
push edi
call ebx
cmp eax, 0x6f
jne 0x410bfc
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp - 8]
call esi
mov edi, eax
add esp, 8
test edi, edi
je 0x410c50
lea eax, [ebp - 8]
push eax
push edi
call ebx
test eax, eax
jne 0x410c42
mov esi, edi
test edi, edi
je 0x410c50
nop dword [eax]
lea ebx, [esi + 0x10c]
push str.Intel
push ebx
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
jne 0x410c66
push str.Realtek
push ebx
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
jne 0x410c66
mov esi, dword [esi]
test esi, esi
jne 0x410c10
test edi, edi
je 0x410c50
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop ebx
pop edi
mov eax, str.Null
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x190]
lea ecx, [esi + 0x194]
call fcn.00410a60
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
Function at 0x410ef0
Capabilities:
Get disk information
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1f4
mov eax, dword [0x4a4014]
xor eax, esp
mov dword [esp + 0x1f0], eax
push esi
push 0x80
lea eax, [esp + 0x174]
mov esi, ecx
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0x80
push 0x7a9028
push 0x49b6c8
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
call fcn.00410b90
push eax
push dword [esp + 8]
call fcn.00410c90
push eax
lea eax, [esp + 0x7c]
push str._d_d_s
push eax
call fcn.0040dd00
add esp, 0x14
test esi, esi
jne 0x41102f
lea ecx, [esp + 0x70]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
lea edx, [ecx + 1]
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410f91
sub ecx, edx
lea edx, [esp + 0x70]
push ecx
lea ecx, [esp + 0xc]
call fcn.00401d00
add esp, 4
lea edx, [esp + 0x18]
lea ecx, [esp + 0x60]
push 8
call fcn.004015a0
mov ecx, dword [esp + 0x1c]
add esp, 4
shr ecx, 3
mov eax, 0x38
and ecx, 0x3f
cmp ecx, 0x38
jb 0x410fd6
mov eax, 0x78
sub eax, ecx
mov edx, 0x4a4458
push eax
lea ecx, [esp + 0xc]
call fcn.00401d00
add esp, 4
lea edx, [esp + 0x60]
lea ecx, [esp + 8]
push 8
call fcn.00401d00
add esp, 4
lea edx, [esp + 8]
lea ecx, [esp + 0x60]
push 0x10
call fcn.004015a0
add esp, 4
lea ecx, [esp + 0x60]
mov edx, 0x10
call fcn.00410a60
pop esi
mov ecx, dword [esp + 0x1f0]
xor ecx, esp
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
push 0x80
push 0
push 0x7a9028
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x7c]
add esp, 0xc
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x411050
sub edx, ecx
lea ecx, [esp + 0x70]
call fcn.00410ac0
push eax
push 0x49b148
push 0x7a9028
call fcn.00420e80
mov ecx, dword [esp + 0x200]
add esp, 0xc
mov eax, 0x7a9028
pop esi
xor ecx, esp
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
Function at 0x411a80
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x1c
lea eax, [ebp - 0x828]
push eax
push 0x411a40
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp - 0x824]
lea eax, [ebp - 0x804]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x80c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x808]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x49b158
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push 0x49b168
push eax
call fcn.0040dcc0
add esp, 0x10
push str.ItemName
push 0x84
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x411b90
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
lea eax, [ebp - 0x804]
push 0x49b6e8
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x411b8f
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x411b8f
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
lea ecx, [ebp - 0x808]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x80c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c14d
mov esp, ebp
pop ebp
ret

Function at 0x411c50
Capabilities:
Create directory
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov bl, 0x44
nop dword [eax]
lea eax, [ebp - 0x108]
mov byte [ebp - 0x108], bl
push eax
mov word [ebp - 0x107], 0x5c3a
mov byte [ebp - 0x105], 0
call esi
cmp eax, 3
je 0x411ca7
inc bl
cmp bl, 0x5a
jle 0x411c70
push str.C:LogInfo
push 0x49b740
jmp 0x411cb3
lea eax, [ebp - 0x108]
push eax
push str._sLogInfo
push 0x4a6c00
call fcn.0040dd00
add esp, 0xc
push 0x4a6c00
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
je 0x411cdd
push 0
push 0x4a6c00
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
Function at 0x4133d0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
push dword [esi]
call ebx
push dword [esi + 4]
mov edi, eax
call ebx
mov ebx, dword [ebp - 4]
xor esi, esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
sub ebx, eax
nop dword [eax]
lea eax, [ebx + esi*4]
push dword [ebp + eax - 0x18]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp + esi*4 - 0x18], eax
inc esi
cmp esi, 4
jl 0x413400
mov ebx, dword [ebp - 8]
mov edx, 0xe3779b90
mov esi, 0x10
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0x14]
shl eax, 4
add eax, dword [ebp - 0x18]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx + 0x61c88647]
sub edi, ecx
sub esi, 1
jne 0x413424
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push edi
call esi
mov edi, dword [ebp + 8]
push ebx
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x414aa0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4a603c], 0
push esi
mov esi, ecx
jne 0x414ad0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x424]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0x824]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x424]
mov dword [ebp - 0xb], 0
xorps xmm0, xmm0
mov byte [ebp - 7], 0
movups xmmword [ebp - 0x23], xmm0
push 0
push 0
push eax
push 0
movq qword [ebp - 0x13], xmm0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x824]
push 0x49ab84
push eax
call fcn.0040dcc0
push esi
lea eax, [ebp - 0x24]
push 0x49aa8c
push eax
call fcn.0040dce0
add esp, 0x18
lea eax, [ebp - 0x824]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
push 0x49ab9c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 2
je 0x414b81
cmp eax, 3
je 0x414b81
cmp eax, 4
je 0x414b81
cmp eax, 5
jne 0x414abf
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
Function at 0x4165b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8fc
mov eax, dword [0x4a4014]
xor eax, esp
mov dword [esp + 0x8f8], eax
push ebx
push esi
push edi
push 0x400
lea eax, [esp + 0x104]
mov dword [esp + 0x1c], edx
push 0
push eax
mov dword [esp + 0x28], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x500]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x100]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0x504]
push 0x49ab84
push eax
call fcn.0040dcc0
add esp, 0xc
lea eax, [esp + 0x100]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x20]
push eax
call fcn.0040dfa0
test eax, eax
je 0x41667c
mov ebx, dword [eax]
mov dword [esp + 0x10], ebx
jmp 0x416684
mov dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x24]
call fcn.0040dfa0
test eax, eax
je 0x41669f
mov ebx, dword [eax + 4]
mov dword [esp + 0x14], ebx
jmp 0x4166a7
mov dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x24]
call fcn.0040dfa0
test eax, eax
je 0x4166be
mov ebx, dword [eax + 8]
jmp 0x4166c1
or ebx, 0xffffffff
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x24]
call fcn.0040dfa0
test eax, eax
je 0x4166db
mov edi, dword [eax + 0xc]
jmp 0x4166dd
xor edi, edi
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x24]
call fcn.0040dfa0
test eax, eax
je 0x4166f8
mov esi, dword [eax + 0x10]
inc esi
jmp 0x4166fa
xor esi, esi
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x24]
call fcn.0040dfa0
test eax, eax
je 0x416719
mov eax, dword [eax + 0x14]
add eax, 0x76c
jmp 0x41671b
xor eax, eax
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x1c]
push ebx
push edi
push esi
push eax
push dword [esp + 0x38]
lea eax, [esp + 0x120]
push str._u_____d__d__d__d__d__d_____s_n
push eax
call fcn.0040dcc0
lea eax, [esp + 0x528]
push 0x49bd34
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 0x30
test esi, esi
je 0x41677d
lea eax, [esp + 0x100]
push eax
push 0x49b740
push esi
call fcn.00421500
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0x904]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
Function at 0x417d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0xa0
mov dword [ebp - 0xb0], eax
mov esi, ecx
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xac], edx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xa4]
call dword [0x4a6d08]
mov ebx, eax
xor edi, edi
lea edx, [ebx + 8]
xor eax, eax
mov dword [edx], esi
mov dword [ebp - 0xa8], ebx
lea ecx, [ebx + 0xc]
mov esi, ecx
sub esi, edx
cmp edx, ecx
cmova esi, eax
test esi, esi
je 0x417dbf
nop word [eax + eax]
mov al, byte [edx]
lea edx, [edx + 1]
not al
inc edi
ror al, 2
not al
ror al, 3
ror al, 3
movzx eax, al
imul ecx, eax, 0x802
imul eax, eax, 0x8020
and ecx, 0x22110
and eax, 0x88440
or ecx, eax
imul eax, ecx, 0x10101
shr eax, 0x10
mov byte [edx - 1], al
cmp edi, esi
jne 0x417d80
lea edx, [ebx + 0xe]
mov eax, 0x10
mov word [edx], ax
xor ecx, ecx
lea eax, [ebx + 0x10]
xor esi, esi
mov edi, eax
sub edi, edx
cmp edx, eax
cmova edi, ecx
test edi, edi
je 0x417e16
nop
mov al, byte [edx]
lea edx, [edx + 1]
movzx ecx, al
inc esi
shl al, 2
movzx eax, al
shr ecx, 6
or ecx, eax
movzx eax, byte [ecx + 0x49c2b0]
movzx eax, byte [eax + 0x49c2b0]
movzx eax, byte [eax + 0x49c2b0]
xor al, 0xea
sub al, 7
xor al, 0xbc
mov byte [edx - 1], al
cmp esi, edi
jne 0x417de0
lea esi, [ebx + 0x11]
xor edi, edi
mov ebx, dword [ebp + 8]
lea edx, [esi + 1]
mov al, byte [edi + ebx]
mov byte [esi], al
mov eax, esi
mov cl, byte [eax]
add cl, 0x66
rol cl, 3
mov byte [eax], cl
inc eax
cmp eax, edx
jne 0x417e28
inc edi
add esi, 2
add edx, 2
cmp edi, 0x10
jl 0x417e21
mov ebx, dword [ebp - 0xa8]
xor edi, edi
mov eax, dword [ebp + 0xc]
lea edx, [ebx + 0x94]
mov dword [edx], eax
xor eax, eax
lea ecx, [ebx + 0x98]
mov esi, ecx
sub esi, edx
cmp edx, ecx
cmova esi, eax
test esi, esi
je 0x417eaf
nop dword [eax + eax]
mov al, byte [edx]
lea edx, [edx + 1]
not al
inc edi
ror al, 2
not al
ror al, 3
ror al, 3
movzx eax, al
imul ecx, eax, 0x802
imul eax, eax, 0x8020
and ecx, 0x22110
and eax, 0x88440
or ecx, eax
imul eax, ecx, 0x10101
shr eax, 0x10
mov byte [edx - 1], al
cmp edi, esi
jne 0x417e70
mov ecx, dword [ebp - 0xac]
lea edx, [ebx + 0x9c]
lea eax, [ebx + 0xa0]
mov dword [edx], ecx
mov esi, eax
xor ecx, ecx
sub esi, edx
xor edi, edi
cmp edx, eax
cmova esi, ecx
test esi, esi
je 0x417f13
mov al, byte [edx]
lea edx, [edx + 1]
not al
inc edi
ror al, 2
not al
ror al, 3
ror al, 3
movzx eax, al
imul ecx, eax, 0x802
imul eax, eax, 0x8020
and ecx, 0x22110
and eax, 0x88440
or ecx, eax
imul eax, ecx, 0x10101
shr eax, 0x10
mov byte [edx - 1], al
cmp edi, esi
jne 0x417ed4
mov ebx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xa4]
push ebx
call dword [0x4a6d04]
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 4]
sub eax, dword [ebx]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
Function at 0x41aea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00487b00
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x1010]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWARETencentQQ
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41af89
push 0x1000
push eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1008], 3
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x100c], 0x400
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push str.path
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41af89
mov eax, dword [ebp - 0x100c]
push eax
mov dword [ebx], eax
call dword [sym.imp.mfc140u.dll_operator]
push dword [ebp - 0x100c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x100c]
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
push esi
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 0x2c
mov esi, 1
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c14d
mov esp, ebp
pop ebp
ret

Function at 0x41afb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, esi
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x41afd0
sub edi, ecx
sar edi, 1
test esi, esi
jne 0x41aff5
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
cmp edi, 0x104
jge 0x41afe3
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea ecx, [ebp - 0x210]
add esp, 0xc
sub ecx, esi
nop dword [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x41b020
add edi, edi
cmp edi, 0x20a
jae 0x41b0f5
xor eax, eax
mov word [ebp + edi - 0x210], ax
add edi, 2
cmp edi, 0x20a
jae 0x41b0f5
mov dword [ebp - 0x218], eax
xorps xmm0, xmm0
mov word [ebp + edi - 0x210], ax
mov ecx, 0x414
movq qword [ebp - 0x220], xmm0
mov ax, word [ebp - 0x220]
or ax, cx
mov dword [ebp - 0x21a], 0
movups xmmword [ebp - 0x230], xmm0
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x228], ecx
mov ecx, 0xffbf
and ax, cx
mov dword [ebp - 0x216], 0
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x22c], 3
mov dword [ebp - 0x224], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0042c14d
mov esp, ebp
pop ebp
ret
call fcn.0042c4ec
int3
Function at 0x4225d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x422601
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4225f0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x42ab50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a5a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi]
test edx, edx
setne al
test al, al
je 0x42abdc
cmp byte [edx + 0x15], 0
jne 0x42abdc
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.0042a5c0
push esi
mov dword [ebp - 4], 0
call fcn.0042b440
mov eax, dword [0x7a6fe0]
mov esi, dword [eax + 4]
lea eax, [ebp - 0x20]
push eax
push 0
add esi, 8
push esi
push 0x42a740
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi]
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x1c]
call fcn.0042a660
mov eax, esi
jmp 0x42abde
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042c14d
mov esp, ebp
pop ebp
ret 4
Function at 0x436fc0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x43706f
push esi
call fcn.0044af20
add esp, 4
test al, al
jne 0x43706f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x436fe7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0045a280
add esp, 0xc
test eax, eax
je 0x43701b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0045a280
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x43701d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x43704e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.0044c060
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x437030
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret