joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f80
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x407136
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov ecx, edi
shr ecx, 0x10
mov eax, edi
or eax, 0xffff
xor edi, 0xffff0000
and edi, eax
test esi, esi
je 0x40712f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x407016
mov eax, dword [esp + 4]
sub eax, dword [esp]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x40712f
xor edx, edx
cmp ebx, 8
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
jb 0x407098
and ebx, 0x1ff8
mov dword [esp], ebx
xor eax, eax
mov edx, eax
movzx esi, byte [ebp + eax]
add esi, edi
mov eax, esi
and eax, ecx
xor ecx, esi
movzx ebx, byte [ebp + edx + 1]
add ebx, esi
movzx edi, byte [ebp + edx + 2]
add edi, ebx
add ebx, ecx
lea ecx, [ebx + eax*2]
mov ebx, dword [esp + 4]
movzx eax, byte [ebp + edx + 3]
add eax, edi
add ecx, edi
movzx esi, byte [ebp + edx + 4]
add esi, eax
add ecx, eax
movzx eax, byte [ebp + edx + 5]
add eax, esi
add ecx, esi
movzx esi, byte [ebp + edx + 6]
add esi, eax
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, esi
add ecx, esi
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ebx
jb 0x407030
add ebp, eax
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov eax, edx
sub eax, ebx
jae 0x406fdd
mov dword [esp + 0xc], eax
mov eax, ebx
and eax, 3
mov dword [esp], edx
je 0x4070df
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4070c0
mov eax, dword [esp]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406fd0
jmp 0x4070ee
mov eax, edx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406fd0
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x407100
jmp 0x406fd0
shl ecx, 0x10
add ecx, edi
jmp 0x40713b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x407150
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4071a8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4071aa
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44cc50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
or edi, ebp
xor edi, ebx
xor eax, dword [edi*4 + 0x44cc50]
inc esi
cmp edx, esi
jne 0x407170
not eax
jmp 0x4071aa
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ca40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, edx
mov eax, dword [esp + 0x14]
mov edx, dword [edx + 8]
mov esi, 1
cmp edx, eax
jae 0x40cab0
cmp dword [esp + 0x18], 0
je 0x40ca8e
cmp edx, 1
adc edx, 0
cmp edx, eax
jae 0x40ca92
mov ebx, edx
nop
nop
nop
nop
nop
nop
nop
mov ebp, edx
or ebp, 2
and ebx, 2
imul ebp, ebx
and edx, 0xfffffffd
xor ebx, 2
imul ebx, edx
add ebx, ebp
mov edx, ebx
cmp ebx, eax
jb 0x40ca70
jmp 0x40ca94
mov ebx, eax
jmp 0x40ca94
mov ebx, edx
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40caae
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40cab0
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d4b0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00444dc0
test al, al
je 0x40d69e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043c390
test al, al
je 0x40d699
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xe2a510ed
mov dword [esp + 8], 0x1618c216
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d536
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d6b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d510
mov dword [esp + 4], 0x27baded
mov dword [esp + 8], 0x1063c6ff
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40d586
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d6f0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40d560
mov dword [esp + 4], 0x23222101
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x40d5d6
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d750
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x40d5b0
test esi, esi
je 0x40d626
mov dword [esp + 4], 0x315bfd17
mov dword [esp + 8], 0x9f80acd6
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40d626
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d7c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40d600
mov dword [esp + 4], 0x720d0c0f
mov dword [esp + 8], 0x76717073
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d686
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d840
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d660
call fcn.0040eca0
test al, al
je 0x40d699
call fcn.00412700
call fcn.00410760
call fcn.004459a0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40dab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, ecx
mov edi, dword [esp + 0x6c]
add edi, dword [ecx + 0x60]
mov word [esp + 4], 0x1b1d
mov byte [esp + 6], 0x22
mov dword [esp + 7], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 6
ja 0x40db1b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x18]
push eax
call fcn.0040e840
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 7
jb 0x40daf0
mov dword [esp + 0xc], 0x22202c46
mov dword [esp + 0x10], 0x1522
mov byte [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 8
ja 0x40db7b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 0xc]
push dword [esp + 0x18]
push eax
call fcn.0040e7e0
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 9
jb 0x40db50
mov dword [esp + 0x18], 0xd2d4181f
mov dword [esp + 0x1c], 0xdeda0c00
mov dword [esp + 0x20], 0xddd2d40f
mov dword [esp + 0x24], 0x262922d1
mov dword [esp + 0x28], 0xf6213532
mov dword [esp + 0x2c], 0x240bc1cb
mov dword [esp + 0x30], 0x23293f26
mov dword [esp + 0x34], 0x3a12fc3c
mov dword [esp + 0x38], 0x243b3b21
mov dword [esp + 0x3c], 0x34312b3f
mov dword [esp + 0x40], 0x3bc2e536
mov dword [esp + 0x44], 0xce0d1131
mov dword [esp + 0x48], 0x6160400
mov dword [esp + 0x4c], 0xa04f7dd
mov dword [esp + 0x50], 0xcfd10807
mov byte [esp + 0x54], 0x90
mov dword [esp + 0x55], 0
mov dword [esp + 0x58], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x40dc46
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.0040e770
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x40dc20
mov ecx, dword [esp + 0x70]
movzx edx, byte [esp + 0x18]
mov eax, edi
test dl, dl
je 0x40dc6b
lea ebx, [esp + 0x19]
mov eax, edi
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40dc60
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40dc8b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40dc80
mov ecx, dword [esp + 0x74]
mov byte [eax], 0
movzx edx, byte [esp + 0xc]
test dl, dl
je 0x40dcab
lea ebx, [esp + 0xd]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40dca0
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40dccb
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40dcc0
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x40dceb
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40dce0
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x410120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x4557f8]
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x4101ce
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44ffa4]
xor eax, eax
jmp 0x41074c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov esi, dword [str.p_u_u]
mov dword [esp + 0x3c], 0x9705992d
mov dword [esp + 0x40], 0x930b9512
mov dword [esp + 0x44], 0x8f1a9104
mov dword [esp + 0x48], 0x8bd98d2d
mov dword [esp + 0x4c], 0x87d489c5
mov dword [esp + 0x50], 0x83e285d4
mov dword [esp + 0x54], 0xff5581d8
mov dword [esp + 0x58], 0xfb68fd65
mov dword [esp + 0x5c], 0xf765f964
mov dword [esp + 0x60], 0xf37df57f
mov dword [esp + 0x64], 0xef5cf190
mov dword [esp + 0x68], 0xeb8aed40
mov dword [esp + 0x6c], 0xe7b6e9b9
mov dword [esp + 0x70], 0xe3b2e5b6
mov dword [esp + 0x74], 0xdfbee1a7
mov dword [esp + 0x78], 0xdb43dd77
mov dword [esp + 0x7c], 0xd79cd94a
mov dword [esp + 0x80], 0xd395d598
mov dword [esp + 0x84], 0xcf46d1b0
mov dword [esp + 0x88], 0xcb86cd86
mov dword [esp + 0x8c], 0xc7a6c991
mov dword [esp + 0x90], 0xc352c585
mov dword [esp + 0x94], 0x3faac150
mov dword [esp + 0x98], 0x3b913da1
mov dword [esp + 0x9c], 0x37a839a5
mov dword [esp + 0xa0], 0x33ab3583
mov dword [esp + 0xa4], 0x2f7d31bc
mov dword [esp + 0xa8], 0x2b652d61
mov dword [esp + 0xac], 0x27742963
mov dword [esp + 0xb0], 0x2368256b
mov dword [esp + 0xb4], 0x1f462140
mov dword [esp + 0xb8], 0x1ba21dab
mov dword [esp + 0xbc], 0x17a319b4
mov dword [esp + 0xc0], 0x134615a0
mov dword [esp + 0xc4], 0xf9a1170
mov dword [esp + 0xc8], 0xb9d0d95
mov dword [esp + 0xcc], 0x7660995
mov dword [esp + 0xd0], 0x39f05bf
mov dword [esp + 0xd4], 0x7fe9019f
mov dword [esp + 0xd8], 0x7b237def
mov dword [esp + 0xdc], 0x77c97918
mov dword [esp + 0xe0], 0x73fc75ec
mov dword [esp + 0xe4], 0x6ffb71e3
mov dword [esp + 0xe8], 0x6b396df1
mov dword [esp + 0xec], 0x67376939
mov dword [esp + 0xf0], 0x6330652d
mov dword [esp + 0xf4], 0x5f0c6130
mov dword [esp + 0xf8], 0x5b085d0c
mov dword [esp + 0xfc], 0x57365908
mov dword [esp + 0x100], 0x53f355fb
mov dword [esp + 0x104], 0x4fef51ca
mov dword [esp + 0x108], 0x4bd34dc2
mov dword [esp + 0x10c], 0x470b491b
mov dword [esp + 0x110], 0x4309450b
mov dword [esp + 0x114], 0xbff14112
mov dword [esp + 0x118], 0xbbbabdf6
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xe2
ja 0x41130d
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
movzx eax, byte [esp + eax + 0x3c]
push dword [esp + 8]
push eax
call fcn.00412390
add esp, 8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x3c], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xe3
jb 0x4112e0
lea ebx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebx
call esi
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x4501f4]
mov ecx, 0x45fc7bb4
xor ecx, dword [0x4501fc]
add eax, ecx
inc eax
jmp eax

Function at 0x412700
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x450a90]
Function at 0x41d6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa50
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41d6d0
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x456b30]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d704
mov eax, 0xffffffff
jmp 0x41d707
lea eax, [ebx + ebx]
push eax
call fcn.0040cb60
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x456b30]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x41d73c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040cb60
add esp, 4
mov esi, eax
mov dword [esp + 0xd8], 0x61d267c0
mov dword [esp + 0xdc], 0x5def63c3
mov dword [esp + 0xe0], 0x59be5fd0
mov dword [esp + 0xe4], 0x55c55bf6
mov dword [esp + 0xe8], 0x51db57c6
mov dword [esp + 0xec], 0x4dc353cb
mov dword [esp + 0xf0], 0x494e4fda
mov dword [esp + 0x690], 0
mov eax, dword [esp + 0x690]
cmp eax, 0x1b
ja 0x41d7f0
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x690]
movzx eax, byte [esp + eax + 0xd8]
push dword [esp + 0x690]
push eax
call fcn.00422970
add esp, 8
mov ecx, dword [esp + 0x690]
mov byte [esp + ecx + 0xd8], al
inc dword [esp + 0x690]
mov eax, dword [esp + 0x690]
cmp eax, 0x1c
jb 0x41d7b0
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x41d821
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d810
mov word [eax], 0
movzx ecx, word [esp + 0xd8]
test cx, cx
je 0x41d851
lea edx, [esp + 0xda]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d840
mov word [eax], 0
lea eax, [esp + 0x518]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00449640
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4514e0]
Function at 0x424c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x424c30
cmp eax, 0xffffffdd
jge 0x424c47
mov eax, 0xffffffff
jmp 0x424c4a
add eax, 0x22
push eax
call fcn.0040cb60
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x7fe97904
mov dword [esp + 0x1c], 0x63f17de8
mov dword [esp + 0x20], 0x670761f6
mov dword [esp + 0x24], 0x6b0f650f
mov dword [esp + 0x28], 0x6f0a6914
mov dword [esp + 0x2c], 0x93f86d09
mov dword [esp + 0x30], 0x970391f1
mov dword [esp + 0x34], 0x9b0e95f8
mov dword [esp + 0x38], 0x9998
mov byte [esp + 0x3c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x24
ja 0x424ceb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00425950
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x25
jb 0x424cc0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x424d11
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x424d00
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424d41
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424d30
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x49db4bdf
mov dword [esp + 0x1c], 0x459547ce
mov dword [esp + 0x20], 0x41ca43df
mov dword [esp + 0x24], 0x7de57fcc
mov dword [esp + 0x28], 0x79f77bee
mov dword [esp + 0x2c], 0x75e777ef
mov dword [esp + 0x30], 0x71a773e6
mov dword [esp + 0x34], 0x6dbb6fa5
mov dword [esp + 0x38], 0x69886bba
mov dword [esp + 0x3c], 0x65eb67e3
mov dword [esp + 0x40], 0x61ec63ff
mov dword [esp + 0x44], 0x1d8f1f9d
mov dword [esp + 0x48], 0x19961b8e
mov dword [esp + 0x4c], 0x159e1783
mov dword [esp + 0x50], 0x11e51398
mov dword [esp + 0x54], 0xdcd0f8c
mov dword [esp + 0x58], 0x90a0bda
mov dword [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x47
ja 0x424e26
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.004259b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x48
jb 0x424e00
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x425130
push ecx
push esi
call fcn.00425bb0
add esp, 0x10
jmp dword [0x45199c]
Function at 0x42be60
Capabilities:
Copy file
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0042be80
add esp, 4
test al, al
je 0x42c530
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
mov dword [esp + 0xc], 0
mov esi, 0x20219
mov eax, 1
lea ebx, [esp + 0x66]
jmp dword [eax*4 + 0x452840]
Function at 0x42ed60
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov edi, dword [0x456b30]
mov dword [esp + 0x1c], 0x7f3f795d
mov dword [esp + 0x20], 0x63f27dec
mov dword [esp + 0x24], 0x67076124
mov dword [esp + 0x28], 0x6b0b65f0
mov dword [esp + 0x2c], 0x6f12694d
mov dword [esp + 0x30], 0x93016d1e
mov dword [esp + 0x34], 0x97f39104
mov dword [esp + 0x38], 0x9bfb9504
mov dword [esp + 0x3c], 0x9fb199fc
mov dword [esp + 0x40], 0x83fe9db3
mov dword [esp + 0x44], 0x87e38117
mov dword [esp + 0x48], 0x8b1d8513
mov dword [esp + 0x4c], 0x8f1d89e1
mov dword [esp + 0x50], 0xb3e08d1e
mov dword [esp + 0x54], 0xb7dbb128
mov dword [esp + 0x58], 0xbbbab5d8
mov word [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x41
ja 0x42ee36
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x1c]
push dword [esp]
push eax
call fcn.00431150
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x1c], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x42
jb 0x42ee10
lea esi, [esp + 0x78]
lea eax, [esp + 0x1c]
push esi
push 0
push 0
push 0x1f
push eax
push 0
call edi
mov edi, dword [esp + 0x78]
test edi, edi
jns 0x42ee59
mov eax, 0xffffffff
jmp 0x42ee5c
lea eax, [edi + edi]
push eax
call fcn.0040cb60
add esp, 4
mov ebp, eax
mov ebx, dword [0x456b30]
mov dword [esp + 0x1c], 0x3373311d
mov dword [esp + 0x20], 0x3f4e3d4c
mov dword [esp + 0x24], 0x3b5b3974
mov dword [esp + 0x28], 0x47274538
mov dword [esp + 0x2c], 0x4326416d
mov dword [esp + 0x30], 0x4f394d1a
mov dword [esp + 0x34], 0x4b274934
mov dword [esp + 0x38], 0x57375524
mov dword [esp + 0x3c], 0x5379513c
mov dword [esp + 0x40], 0x5f3a5d77
mov dword [esp + 0x44], 0x5b37592b
mov dword [esp + 0x48], 0x67156517
mov dword [esp + 0x4c], 0x63156109
mov dword [esp + 0x50], 0x6f586d1a
mov dword [esp + 0x54], 0x6b1f6910
mov dword [esp + 0x58], 0x77767500
mov word [esp + 0x5c], 0
mov byte [esp + 0x5e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x42
ja 0x42ef36
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x1c]
push dword [esp]
push eax
call fcn.004311d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x1c], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x43
jb 0x42ef10
push esi
push edi
push ebp
push 0x1f
lea edi, [esp + 0x2c]
push edi
push 0
call ebx
lea eax, [esp + 0x68]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00449640
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x452af0]
out dx, eax
inc edx
add byte [edi + ebp*8 - 0xa63ffbe], al
inc edx
add byte [ebp - 0x79ffbd11], ah
cmc
inc edx
add bl, bl
out dx, eax
inc edx
add cl, ah
out dx, eax
inc edx
add byte [eax], al
invalid
Function at 0x437b30
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0041d2d0
sub esp, 0x10
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x437b69
jmp 0x437c9f
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x437ba5
jmp 0x437c97
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call fcn.0040cda0
add esp, 4
mov edx, eax
cmp edx, 0
setne al
mov ecx, dword [ebp - 0x18]
jmp 0x437bd2
xor ebx, ebx
test al, 1
jne 0x437bdd
jmp 0x437c8b
mov al, byte [edi]
mov byte [ebp - 0x14], al
mov byte [esi], 0x73
mov byte [esi + 1], 0x45
mov byte [esi + 2], 0x5b
mov byte [esi + 3], 0x43
mov byte [esi + 4], 0x5e
mov byte [esi + 5], 0x4a
mov byte [esi + 6], 0x5f
mov byte [esi + 7], 0x4d
mov byte [esi + 8], 0x54
mov byte [esi + 9], 0xf
mov byte [esi + 0xa], 0x46
mov byte [esi + 0xb], 0x43
mov byte [esi + 0xc], 0x38
mov byte [esi + 0xd], 0x45
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x10
jne 0x437c1e
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jae 0x437c68
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov edi, edx
call fcn.0043c2e0
mov edx, edi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x437c31
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040da30
mov bl, al
and bl, 1
mov ecx, dword [ebp - 0x18]
jmp 0x437c8b
sub esp, 4
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x437c9f
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret