joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dd50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [ebp + 8]
mov byte [esp + 0xf], 0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x42df10
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp + 0x48], eax
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
setne al
test al, 1
jne 0x42ddc2
jmp 0x42df08
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00409210
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], 0
je 0x42def4
mov esi, dword [ebp + 8]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
jmp 0x42ddfe
call fcn.0040eef0
mov al, byte [esp + 0x14]
mov byte [esp + 0x1c], al
mov byte [esp + 0x20], 0x73
mov byte [esp + 0x21], 0x2d
mov byte [esp + 0x22], 0x2b
mov byte [esp + 0x23], 0x23
mov byte [esp + 0x24], 0x56
mov byte [esp + 0x25], 0x2a
mov byte [esp + 0x26], 0x57
mov byte [esp + 0x27], 0x25
mov byte [esp + 0x28], 0x4c
mov byte [esp + 0x29], 0x77
mov byte [esp + 0x2a], 0x3e
mov byte [esp + 0x2b], 0x23
mov byte [esp + 0x2c], 0x38
mov byte [esp + 0x2d], 0xad
mov byte [esp + 0x30], 0
mov word [esp + 0x2e], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x11
jae 0x42ded1
mov dword [esp + 0x40], edi
jmp 0x42de74
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
movzx edx, byte [esp + ecx + 0x20]
mov edi, eax
add edi, 0x8709c3e8
and edi, edx
lea ecx, [eax + edx - 0x78f63c18]
add eax, 0xe8
and eax, edx
add eax, edi
mov edx, eax
xor edx, ecx
not eax
and ecx, eax
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x44]
add al, 0xa8
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x20], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x11
jb 0x42de74
mov edi, dword [esp + 0x40]
jmp 0x42ded1
lea eax, [esp + 0x20]
mov ecx, esi
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
call fcn.004099f0
sub esp, 0xc
and al, 1
mov byte [esp + 0xf], al
jmp 0x42def2
jmp 0x42def4
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42df06
jmp 0x42df08
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42df10
mov al, byte [esp + 0xf]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432f00
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x432fbd
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x432f60
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.004366c0
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x432f50
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x4330b4
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x43309d
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x433060
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4330b4
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x433105
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.004366c0
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.004366c0
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433cd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov eax, 0xfffffffe
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x433ce0
test eax, eax
je 0x433d03
mov ebx, eax
sar ebx, 1
test al, 2
jne 0x433d0a
mov edx, ebx
cmp ebx, 1
jne 0x433d3f
jmp 0x433da9
mov eax, edi
jmp 0x433da9
lea edx, [ebx - 1]
movzx eax, word [ecx]
add ecx, 2
xor eax, edi
mov esi, eax
and esi, 0x1000193
mov edi, eax
or eax, 0x1000193
imul eax, esi
xor esi, 0x1000193
and edi, 0xfefffe6c
imul edi, esi
add eax, edi
mov edi, eax
cmp ebx, 1
je 0x433da9
xor esi, esi
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
mov eax, edi
and eax, 0x1000193
mov ebx, edi
or edi, 0x1000193
imul edi, eax
xor eax, 0x1000193
and ebx, 0xfefffe6c
imul ebx, eax
add edi, ebx
movzx eax, word [ecx + esi*2 + 2]
xor eax, edi
mov edi, eax
and edi, 0x1000193
mov ebx, eax
or eax, 0x1000193
imul eax, edi
xor edi, 0x1000193
and ebx, 0xfefffe6c
imul ebx, edi
add eax, ebx
add esi, 2
cmp edx, esi
jne 0x433d50
pop esi
pop edi
pop ebx
ret
Function at 0x434510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43461b
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x434559
mov edx, dword [esp + 0x1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x43461d
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.004195e0
add esp, 4
mov ebx, eax
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.004195e0
mov edx, dword [esp + 0x20]
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea ecx, [esi + 1]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
cmp edi, edx
jae 0x434540
movzx eax, byte [ebp + edi]
push eax
call fcn.004195e0
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x434540
mov bl, al
movzx eax, al
shl bh, 4
mov ecx, eax
not ecx
or ecx, 0x3c
add eax, ecx
inc eax
shr eax, 2
add al, bh
lea ecx, [esi + 2]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 1], al
lea eax, [edi + 1]
cmp eax, edx
jae 0x434540
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.004195e0
add esp, 4
cmp al, 0x40
je 0x43452e
shl bl, 6
add al, bl
mov ecx, esi
and ecx, 1
mov edx, dword [esp]
xor edx, 1
lea edx, [edx + ecx*2]
mov dword [esp], edx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 2], al
jmp 0x43452e
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 8], 0xfbf8f996
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x437da0
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xf5d56df
xor eax, 0x8f5d56df
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0xe7
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x437d60
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
push ecx
push 0
push dword [eax + 0x18]
call dword [0x450888]
mov esp, ebp
pop ebp
ret
Function at 0x438100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edx, dword [ecx + 4]
test edx, edx
je 0x438200
xor eax, eax
cmp dword [ecx], 0
jne 0x438205
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xe
ja 0x4381cf
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [eax - 0x25adae87]
mov edi, esi
and edi, edx
xor esi, edx
lea esi, [esi + edi*2]
add eax, 0x79
and eax, edx
add eax, eax
sub esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
add al, 0xb1
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xf
jb 0x438190
mov eax, dword [esp + 8]
mov esi, dword [0x448868]
test esi, esi
je 0x438205
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x44886c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x94b236a1
je 0x43820f
inc edi
cmp esi, edi
jne 0x4381f0
jmp 0x438205
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x438205
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x448870]
push esi
call fcn.00439850
add esp, 0x1c
jmp 0x438205

Function at 0x438240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
test eax, eax
je 0x438327
mov esi, ecx
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xe
ja 0x4382d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx - 0x25adae87]
mov ebx, edi
and ebx, edx
xor edi, edx
lea edi, [edi + ebx*2]
add ecx, 0x79
and ecx, edx
add ecx, ecx
sub edi, ecx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
add cl, 0xb1
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xf
jb 0x438290
mov ecx, dword [0x448868]
test ecx, ecx
je 0x43831a
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x44886c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x11081610
je 0x438300
inc edi
cmp ecx, edi
jne 0x4382f0
jmp 0x43831a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43831a
push eax
push 1
push dword [0x448870]
push ecx
call fcn.00439850
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x43853e
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x43853e
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xe
ja 0x4383d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx - 0x25adae87]
mov ebx, edi
and ebx, edx
xor edi, edx
lea edi, [edi + ebx*2]
add ecx, 0x79
and ecx, edx
add ecx, ecx
sub edi, ecx
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x18]
add cl, 0xb1
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xf
jb 0x438390
mov ebx, dword [ebp + 0x10]
mov edi, dword [esp + 8]
mov edx, dword [0x448868]
test edx, edx
je 0x438425
xor ecx, ecx
mov ebx, dword [0x44886c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + ecx*8], 0xac3673b8
je 0x438403
inc ecx
cmp edx, ecx
jne 0x4383f0
mov ebx, dword [ebp + 0x10]
jmp 0x438425
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0x10]
je 0x438425
push dword [ebp + 8]
push eax
push 2
push dword [0x448870]
push ecx
call fcn.00439850
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0xc], 1
mov eax, ebx
sbb eax, 0
jl 0x438533
cmp edi, 0xc000010a
jne 0x438533
mov ecx, 0xffffd8f0
mov edi, dword [ebp + 0xc]
mov eax, edi
mul ecx
sub edx, edi
imul ecx, ebx, 0xffffd8f0
add ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esi]
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xe
ja 0x4384e3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx - 0x25adae87]
mov ebx, edi
and ebx, edx
xor edi, edx
lea edi, [edi + ebx*2]
add ecx, 0x79
and ecx, edx
add ecx, ecx
sub edi, ecx
mov dword [esp], edi
mov ecx, dword [esp]
add cl, 0xb1
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xf
jb 0x4384a0
mov edi, dword [esp + 8]
mov ecx, dword [0x448868]
test ecx, ecx
je 0x438533
xor edx, edx
mov ebx, dword [0x44886c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0xb33e16a3
je 0x438510
inc edx
cmp ecx, edx
jne 0x438500
jmp 0x438533
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, edi
je 0x438533
lea edx, [esp + 0x18]
push edx
push 0
push eax
push 3
push dword [0x448870]
push ecx
call fcn.00439850
add esp, 0x18
mov edi, eax
test edi, edi
js 0x43853e
mov ecx, esi
call fcn.00438240
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x438550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x438567
lea edx, [esp + 0x18]
mov ecx, dword [ecx]
mov dword [esp + 8], 0x32353437
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xe
ja 0x4385df
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
lea edi, [eax - 0x25adae87]
mov ebx, edi
and ebx, esi
xor edi, esi
lea edi, [edi + ebx*2]
add eax, 0x79
and eax, esi
add eax, eax
sub edi, eax
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
add al, 0xb1
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xf
jb 0x4385a0
mov eax, dword [esp + 8]
mov esi, dword [0x448868]
test esi, esi
je 0x438634
xor edi, edi
mov ebx, dword [0x44886c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc99a73c4
je 0x438610
inc edi
cmp esi, edi
jne 0x438600
jmp 0x438634
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x438634
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x448870]
push esi
call fcn.00439850
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43abf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 0x10], 0x535051a6
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x43ac97
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov eax, dword [esp]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add eax, 0x539d02b3
mov esi, 0xac62fd4c
sub esi, ecx
lea edi, [ecx + 0xb3]
and edi, edx
or esi, edx
add ecx, esi
add ecx, 0x539d02b4
mov edx, ecx
and edx, edi
xor edi, ecx
lea ecx, [edi + edx*2]
mov edx, ecx
xor edx, eax
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov ecx, eax
or ecx, 0x1a
and eax, 0x1a
add eax, ecx
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x43ac30
mov eax, dword [esp + 0x10]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
jmp dword [ecx*4 + 0x447190]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp + 4], 0
mov esi, dword [edx]
xor eax, eax
cmp esi, edx
setne al
mov dword [esp + 8], edx
jmp dword [eax*4 + 0x447198]
jmp dword [edi*4 + 0x4471b0]
mov esi, dword [esi]
xor eax, eax
cmp esi, edx
setne al
jmp dword [eax*4 + 0x447198]
mov ebx, dword [esi + 0x30]
xor eax, eax
test ebx, ebx
setne al
mov edi, 1
jmp dword [eax*4 + 0x4471a0]
mov edx, dword [ebp + 8]
movzx ecx, word [edx]
movzx eax, word [ebx]
test ecx, ecx
je 0x43ad15
add edx, 2
add ebx, 2
cmp cx, ax
je 0x43ad00
movzx eax, ax
mov edx, eax
xor edx, ecx
not eax
and eax, ecx
add eax, eax
xor ecx, ecx
cmp eax, edx
sete cl
mov edx, dword [esp + 8]
jmp dword [ecx*4 + 0x4471a8]
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
xor eax, eax
jmp dword [eax*4 + 0x4471b0]
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
mov dword [esi + 0x24], esp
push eax
mov dword [esi + 0x10], esp
sub esp, 0x10
mov ecx, esp
and ecx, 0xfffffff8
mov esp, ecx
push eax
mov eax, esp
sub esp, 0x10
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
mov edx, esp
sub esp, 0x10
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
jmp dword [esi + 0xc]
Function at 0x43b390
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
mov dword [esp + 0x20], 0x83825b4d
mov dword [esp + 0x24], 0
mov dword [esp + 0x27], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
ja 0x43b426
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x20]
mov esi, ecx
and esi, 0x3d821c40
xor ecx, 0xbd821c40
lea esi, [ecx + esi*2]
lea ecx, [esi + edx]
mov edi, edx
not edi
or edi, esi
add edi, edx
and esi, edx
lea edx, [esi + edi]
inc edx
mov esi, edx
xor esi, ecx
not edx
and edx, ecx
add edx, edx
sub edx, esi
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x1c]
add cl, 0x40
mov edx, dword [esp]
mov byte [esp + edx + 0x20], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xb
jb 0x43b3d0
xor ecx, ecx
cmp dword [esp + 0x20], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447310]
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + ecx]
mov dword [esp + 4], edx
mov dword [esp + 0x20], 0x1b1a54a8
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 8
ja 0x43b4b3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edx, byte [esp + edi + 0x20]
lea ebx, [esi + 0xac]
mov edi, edx
not edi
or edi, ebx
and ebx, edx
add ebx, edi
neg ebx
lea edx, [esi + ebx]
add edx, 0x13bf95ab
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x1c]
add dl, 0x4c
mov esi, dword [esp]
mov byte [esp + esi + 0x20], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 9
jb 0x43b470
xor edx, edx
mov esi, dword [esp + 4]
cmp esi, dword [esp + 0x20]
setne dl
mov esi, dword [ebp + 8]
jmp dword [edx*4 + 0x447318]
mov edx, dword [esi + ecx + 0x7c]
mov eax, dword [esi + ecx + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [case.0x43b4c3.5]
nop
nop
nop
nop
nop
jmp eax
xor ecx, ecx
test edx, edx
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x447330]
xor ecx, ecx
cmp dword [esp + 0x10], 0
sete cl
jmp dword [ecx*4 + 0x447338]
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + eax + 0x20]
add ecx, esi
mov dword [esp + 0x48], ecx
mov ecx, dword [esi + eax + 0x24]
add ecx, esi
mov dword [esp + 0x38], ecx
mov ecx, dword [esi + eax + 0x1c]
add ecx, esi
mov dword [esp + 0x34], ecx
mov edi, dword [0x44734c]
mov eax, dword [esi + eax + 0x18]
mov dword [esp + 0x4c], eax
mov eax, dword [0x447368]
mov dword [esp + 0x44], eax
xor ebx, ebx
mov eax, dword [0x447394]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edi
nop
jmp edi
mov ecx, dword [case.0x43b4c3.1]
nop
nop
nop
jmp ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402d82
Capabilities:
Create pipe
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x244ca44]
mov ecx, dword [0x244c4d4]
sub esp, 0xc04
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x402e5c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov ebx, ecx
mov dword [esp + 0xc], eax
cmp dword [0x244ca44], 0x959
jne 0x402e49
push esi
lea eax, [esp + 0x14]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x4029e0
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
lea eax, [esp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call edi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
lea eax, [esp + 0x814]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call fcn.00402b67
add ebx, 8
dec dword [esp + 0xc]
jne 0x402db5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret