joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4139d5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
mov ecx, esi
ror eax, 8
mov esi, dword [esp + 0x28]
add eax, edx
ror esi, 8
xor eax, edi
add esi, edi
rol edx, 3
xor esi, ebx
rol edi, 3
xor edx, eax
mov dword [esp + 0x28], ebp
xor edi, esi
mov ebp, ecx
inc ebx
cmp ebx, 0x1b
jb 0x413a06
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x413a38
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
mov edx, dword [esp + 0x10]
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
test edx, edx
je 0x413b3d
xor eax, eax
lea ecx, [ebx + 0xf]
inc eax
mov dword [esp + 0x2c], ecx
sub eax, ebx
push esi
mov dword [esp + 0xc], eax
push edi
lea eax, [esp + 0x14]
cmp eax, ecx
ja 0x413a6f
lea eax, [esp + 0x23]
mov esi, ebx
lea edi, [esp + 0x14]
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x28]
mov eax, dword [esi + ecx*4]
xor dword [esp + ecx*4 + 0x14], eax
inc ecx
cmp ecx, 4
jb 0x413a7f
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], 0x10
add ecx, edi
add eax, esi
rol edi, 5
xor edi, ecx
rol esi, 8
xor esi, eax
rol ecx, 0x10
add eax, edi
add ecx, esi
rol edi, 7
rol esi, 0xd
xor edi, eax
xor esi, ecx
rol eax, 0x10
sub dword [esp + 0x30], 1
jne 0x413aa4
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + ecx*4]
xor dword [esp + ecx*4 + 0x14], eax
inc ecx
cmp ecx, 4
jb 0x413ae3
push 0x10
pop esi
cmp edx, esi
mov ecx, edx
cmova ecx, esi
test ecx, ecx
je 0x413b13
lea edi, [esp + 0x14]
mov esi, ebp
sub edi, ebp
mov ebx, ecx
mov al, byte [edi + esi]
xor byte [esi], al
inc esi
sub ebx, 1
jne 0x413b08
mov ebx, dword [esp + 0x10]
sub edx, ecx
add ebp, ecx
mov ecx, dword [esp + 0x34]
add byte [ecx], 1
jne 0x413b2c
dec ecx
lea eax, [ebx + ecx]
test eax, eax
jg 0x413b1f
mov ebx, dword [esp + 0x2c]
lea ecx, [ebx + 0xf]
test edx, edx
jne 0x413a63
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x413b43
Capabilities:
Decompress data using aplib

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x18]
and dword [esp + 0x10], 0
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov al, byte [ecx]
push esi
push edi
mov byte [ebp], al
or edi, 0xffffffff
lea eax, [ebp + 1]
xor esi, esi
mov dword [esp + 0x18], eax
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
call fcn.00413ce6
pop ecx
test eax, eax
je 0x413cba
lea eax, [esp + 0x14]
push eax
call fcn.00413ce6
test eax, eax
lea eax, [esp + 0x18]
pop ecx
push eax
je 0x413c19
call fcn.00413ce6
pop ecx
test eax, eax
je 0x413bdd
push 4
xor esi, esi
pop ebx
lea eax, [esp + 0x14]
push eax
call fcn.00413ce6
pop ecx
lea esi, [eax + esi*2]
sub ebx, 1
jne 0x413bab
mov edx, dword [esp + 0x18]
test esi, esi
je 0x413bd0
mov eax, edx
sub eax, esi
mov al, byte [eax]
mov byte [edx], al
jmp 0x413bd3
mov byte [edx], 0
mov ebx, dword [esp + 0x10]
inc edx
jmp 0x413ccc
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
movzx edi, byte [eax]
inc eax
mov ecx, edi
mov dword [esp + 0x14], eax
and ecx, 1
add ecx, 2
shr edi, 1
je 0x413c0d
mov esi, edx
sub esi, edi
mov al, byte [esi]
mov byte [edx], al
inc edx
inc esi
sub ecx, 1
jne 0x413bfd
jmp 0x413cb1
xor ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
jmp 0x413cb5
call fcn.00413d1d
mov edx, eax
pop ecx
test esi, esi
jne 0x413c50
cmp edx, 2
jne 0x413c50
lea eax, [esp + 0x14]
push eax
call fcn.00413d1d
mov edx, dword [esp + 0x1c]
mov esi, eax
pop ecx
test esi, esi
je 0x413cb5
mov ecx, edx
sub ecx, edi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
sub esi, 1
jne 0x413c43
jmp 0x413cb1
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x14]
xor esi, 1
sub edx, esi
shl edx, 8
movzx edi, byte [ecx]
add edi, 0xfffffe00
add edi, edx
inc ecx
push eax
mov dword [esp + 0x18], ecx
call fcn.00413d1d
pop ecx
mov ecx, eax
cmp edi, 0x7d00
jb 0x413c82
inc ecx
mov edx, dword [esp + 0x18]
lea eax, [ecx + 1]
cmp edi, 0x500
cmovb eax, ecx
cmp edi, 0x80
lea esi, [eax + 2]
cmovae esi, eax
test esi, esi
je 0x413cb5
mov ecx, edx
sub ecx, edi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
sub esi, 1
jne 0x413ca6
mov dword [esp + 0x18], edx
xor esi, esi
inc esi
jmp 0x413cd2
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x14], ecx
xor esi, esi
mov dword [esp + 0x18], edx
test ebx, ebx
je 0x413b75
pop edi
pop esi
sub edx, ebp
pop ebp
mov eax, edx
pop ebx
add esp, 0x14
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
nop
mov ecx, 0x780e7471
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x6f702429
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401180
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
lea edx, [esp + 4]
mov dword [esp + 4], 0x3c
push edx
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], str.properties
mov dword [esp + 0x18], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
neg eax
sbb eax, eax
pop edi
neg eax
add esp, 0x3c
ret

Function at 0x4011d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
mov esi, dword [esp + 0x48]
push 2
push 0x44b244
push esi
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x401202
mov eax, dword [esp + 0x44]
push esi
push eax
call fcn.00409110
add esp, 8
mov al, 1
pop esi
add esp, 0x3c
ret
push edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x48]
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x10], pe_nt_image_headers32
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], str.explore
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
dec eax
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
add esp, 0x3c
ret
Function at 0x401f80
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x7830
call fcn.00444620
mov eax, dword [esp + 0x7838]
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401fbd
pop esi
xor al, al
pop ebx
add esp, 0x7830
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x10]
push ebx
push ecx
push 1
push 0x44b2f4
push esi
call ebp
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x10]
shl edx, 4
push ebx
push eax
mov edx, dword [edx + 0x44b068]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call ebp
lea ecx, [esp + 0x10]
push ebx
push ecx
push 2
push 0x44b2f0
push esi
call ebp
mov eax, dword [esp + 0x20]
inc eax
cmp eax, 4
mov dword [esp + 0x20], eax
jb 0x401fc9
lea edx, [esp + 0x10]
push ebx
push edx
push 2
push 0x44b2ec
push esi
call ebp
mov eax, dword [esp + 0x7844]
push ebx
push ebx
push 0x1004
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebx
jle 0x4020fd
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x7844]
lea edx, [esp + 0x18]
push edx
push ebx
lea ecx, [esp + 0x48]
push 0x1005
push eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], 0x7800
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x40208d
mov byte [esp + 0x40], bl
lea ecx, [esp + 0x10]
push ebx
push ecx
push 1
push 0x44b2f4
push esi
call ebp
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ebx
dec ecx
push edx
lea eax, [esp + 0x48]
push ecx
push eax
push esi
call ebp
lea ecx, [esp + 0x10]
push ebx
push ecx
push 2
push 0x44b2f0
push esi
call ebp
mov eax, dword [esp + 0x20]
inc eax
cmp eax, 4
mov dword [esp + 0x20], eax
jb 0x40205c
lea edx, [esp + 0x10]
push ebx
push edx
push 2
push 0x44b2ec
push esi
call ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x402050
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
add esp, 0x7830
ret

Function at 0x4071d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
mov eax, dword [ecx + 4]
push ebx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40721a
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40721a
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
pop ebx
ret 0x10
Function at 0x407220
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
ret 0xc

Function at 0x407240
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x14
lea eax, [esp + 0x18]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4072c3
push ebx
mov ebx, dword [esp + 0x20]
push esi
xor esi, esi
test ebx, ebx
jbe 0x4072b6
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push edi
mov edi, dword [esp + 0x30]
push esi
lea ecx, [esp + 0x18]
push 0x44b428
push ecx
mov dword [esp + 0x1c], 4
call ebp
mov ecx, dword [esp + 0x34]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
inc esi
add edi, 4
cmp esi, ebx
jb 0x40727a
pop edi
pop ebp
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x14
ret 0xc

Function at 0x4072d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x18
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40736a
mov eax, dword [esp + 0x20]
push esi
xor esi, esi
test eax, eax
jbe 0x40735e
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebp
mov ebp, dword [esp + 0x30]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
lea ecx, [esp + 0x1c]
push 0x44b428
push ecx
mov dword [esp + 0x1c], 4
call edi
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x30]
push eax
push 0
push 0
push ecx
push edx
call ebx
test eax, eax
jne 0x40734f
mov ax, word [esp + 0x14]
mov word [ebp], ax
mov eax, dword [esp + 0x30]
inc esi
add ebp, 2
cmp esi, eax
jb 0x407310
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x18
ret 0xc

Function at 0x407370
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push eax
mov eax, dword [esp + 8]
push edx
push 3
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc
Function at 0x407390
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x18]
push 0
push eax
mov eax, dword [ecx + 4]
push 0
push 0x20006
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40743e
push ebp
mov ebp, dword [esp + 0x20]
push esi
xor esi, esi
test ebp, ebp
jbe 0x407431
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push edi
mov edi, dword [esp + 0x30]
push esi
lea ecx, [esp + 0x18]
push 0x44b428
push ecx
call ebx
mov ax, word [edi]
add esp, 0xc
mov edx, eax
and edx, 0xffff
test ax, ax
mov dword [esp + 0x10], edx
je 0x407417
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x10]
push 4
push eax
push 4
lea ecx, [esp + 0x20]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x407427
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc esi
add edi, 2
cmp esi, ebp
jb 0x4073d6
pop edi
pop ebx
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x14
ret 0xc

Function at 0x4074d0
Capabilities:
Delete file

Disassembly:
sub esp, 0x12c
push ebp
mov ebp, dword [esp + 0x138]
push edi
push 0x453568
push ebp
call fcn.0040dea0
mov edi, eax
add esp, 8
test edi, edi
jne 0x4074fc
pop edi
pop ebp
add esp, 0x12c
ret
mov eax, dword [esp + 0x138]
push eax
push edi
call fcn.0040df80
add esp, 8
test eax, eax
je 0x407525
push edi
call fcn.0040dfc0
add esp, 4
xor eax, eax
pop edi
pop ebp
add esp, 0x12c
ret
lea ecx, [esp + 8]
push ecx
push 0xffffffffffffffff
push edi
call fcn.0040dec0
add esp, 0xc
test eax, eax
je 0x40754d
push edi
call fcn.0040dfc0
add esp, 4
xor eax, eax
pop edi
pop ebp
add esp, 0x12c
ret
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
test ebx, ebx
jle 0x407579
lea edx, [esp + 0x10]
push edx
push esi
push edi
call fcn.0040dec0
lea eax, [esp + 0x20]
push eax
push esi
push edi
call fcn.0040df60
add esp, 0x18
inc esi
cmp esi, ebx
jl 0x407559
push edi
call fcn.0040dfc0
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 0x12c
ret
Function at 0x4075a0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push edi
mov edi, dword [esi + 0xc]
mov ecx, dword [eax]
mov eax, dword [edx]
mov dword [esp + 0x10], edi
mov edi, dword [esi + 8]
mov dword [esp + 0x28], edi
mov edi, dword [esi + 4]
mov esi, dword [esi]
mov dword [esp + 0x18], edi
mov edx, 0xf1bbcdc8
mov dword [esp + 0x14], esi
mov edi, 8
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
mov esi, ecx
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [ecx + edx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
sub eax, esi
mov esi, eax
shl esi, 4
add esi, ebx
mov ebx, eax
shr ebx, 5
add ebx, ebp
xor esi, ebx
lea ebx, [eax + edx]
xor esi, ebx
add edx, 0x61c88647
sub ecx, esi
dec edi
jne 0x4075dc
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov ecx, dword [esp + 0x18]
pop ebx
mov dword [ecx], eax
add esp, 0xc
ret

Function at 0x407680
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fopen]
push esi
push edi
push 0x44b508
push eax
call ebp
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
mov esi, eax
push 2
push 0
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push esi
mov ebx, eax
call edi
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov edi, eax
push ebx
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fread]
push esi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [esp + 0x50]
push ecx
push ebx
push edi
call fcn.00407640
mov edx, dword [esp + 0x64]
add esp, 0x48
push 0x44b504
push edx
call ebp
mov esi, eax
push esi
push ebx
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
push edi
call fcn.0040e2ac
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x407e10
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
push esi
xor esi, esi
mov eax, dword [ebp + 0x14]
cmp eax, esi
jne 0x407e25
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push ebx
push edi
push eax
mov eax, dword [ebp + 4]
push 0x2712
push eax
call fcn.0040e450
mov cl, byte [esp + 0x1f]
mov edi, str.Mozilla_5.0__iPhone__CPU_iPhone_OS_14_0_1_like_Mac_OS_X__AppleWebKit_605.1.15__KHTML__like_Gecko__Mobile_15E148_MicroMessenger_8.0.27_0x18001b34__NetType_4G_Language_zh_CN
mov byte [esp + 0x20], cl
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebx, ecx
lea ecx, [esp + 0x18]
push ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x407e96
mov edi, dword [esp + 0x18]
mov ecx, ebx
mov edx, ecx
mov esi, str.Mozilla_5.0__iPhone__CPU_iPhone_OS_14_0_1_like_Mac_OS_X__AppleWebKit_605.1.15__KHTML__like_Gecko__Mobile_15E148_MicroMessenger_8.0.27_0x18001b34__NetType_4G_Language_zh_CN
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebx
xor esi, esi
mov byte [eax + ebx], 0
mov eax, dword [esp + 0x18]
pop edi
cmp eax, esi
pop ebx
jne 0x407ea5
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov ecx, dword [ebp + 4]
push eax
push 0x2722
push ecx
call fcn.0040e450
mov edx, dword [ebp + 4]
add esp, 0xc
push 5
push 0x44
push edx
call fcn.0040e450
mov eax, dword [ebp + 4]
add esp, 0xc
push 1
push 0x34
push eax
call fcn.0040e450
mov ecx, dword [ebp + 4]
add esp, 0xc
push 1
push 0x63
push ecx
call fcn.0040e450
mov edx, dword [ebp + 4]
add esp, 0xc
push esi
push 0x2f
push edx
call fcn.0040e450
mov eax, dword [ebp + 4]
add esp, 0xc
push 0x408180
push 0x4e2b
push eax
call fcn.0040e450
mov ecx, dword [ebp + 4]
add esp, 0xc
push ebp
push 0x2711
push ecx
call fcn.0040e450
mov edx, dword [ebp + 4]
add esp, 0xc
push esi
push 0x40
push edx
call fcn.0040e450
mov eax, dword [ebp + 4]
add esp, 0xc
push esi
push 0x51
push eax
call fcn.0040e450
mov ecx, dword [esp + 0x1c]
add esp, 0xc
cmp ecx, esi
pop esi
pop ebp
je 0x407f64
mov al, byte [ecx - 1]
test al, al
je 0x407f5a
cmp al, 0xff
je 0x407f5a
dec al
mov byte [ecx - 1], al
add esp, 0x14
ret
dec ecx
push ecx
call fcn.0040e2ac
add esp, 4
add esp, 0x14
ret

Function at 0x4081a0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
ret 0xc
Function at 0x408cb0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetParent]
lea eax, [esp + 0x10]
push edi
push eax
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
sub edx, ecx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
push eax
push str.SoftwareSysinternalsAccessEnum
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x48]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push 0
push 0x44b898
push edx
call edi
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push 0x44b894
push ecx
call edi
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x1c]
push 4
push edx
push 4
push 0
push 0x44b890
push eax
call edi
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x20]
push 4
push ecx
push 4
push 0
push str.hwyx
push edx
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x408d8f
mov ecx, dword [esp + 0x18]
cmp ecx, 0xffffffff
je 0x408d8f
mov edx, dword [esp + 0x20]
push 4
push edx
mov edx, dword [esp + 0x24]
push edx
push ecx
push eax
push 0
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
xor esi, esi
push esi
lea eax, [esp + 0x28]
push str.Column_d
push eax
call ebp
add esp, 0xc
push 0
push esi
push 0x101d
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
push 4
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
push 4
lea edx, [esp + 0x30]
push 0
push edx
push eax
call edi
inc esi
cmp esi, 8
jl 0x408d97
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x40b530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40b53b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x40b63e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x44708c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x44708c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x44708c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x44708c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x44708c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x44708c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x44708c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x44708c]
xor eax, edx
inc ecx
dec edi
jne 0x40b556
pop edi
test esi, esi
je 0x40b660
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x44708c]
xor eax, edx
inc ecx
dec esi
jne 0x40b642
pop esi
pop ebx
not eax
ret

Function at 0x40b670
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x44708c]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x44708c]
xor eax, edx
mov dword [ecx + 8], eax
ret