joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcd28a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0xcd29a8
mov esi, edx
test edx, edx
je 0xcd29a8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0xcd29a8
push esi
call fcn.00cd8f00
add esp, 4
test eax, eax
je 0xcd28fa
xor edi, edi
mov ecx, 0x1505
movzx edx, byte [esi + edi]
test edx, edx
je 0xcd2901
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0xcd28e0
jmp 0xcd2903
mov ebp, 0x1505
jmp 0xcd2903
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0xcd29b0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0xcd296a
call fcn.00cd2aa0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0xcd29a8
push ecx
call fcn.00cd8f00
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0xcd2a1f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0xcd29c8
inc ebx
dec esi
je 0xcd291f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0xcd2924
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0xcd29c0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00cd8f00
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0xcd29c0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00cd8f20
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0xcd29c0
mov eax, 0xffffffff
jmp 0xcd29a8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0xcd2a38
inc ebx
dec esi
je 0xcd2965
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0xcd296a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0xcd2a30
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00cd8f00
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0xcd2a30
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00cd8f20
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0xcd2a30
jmp 0xcd296a
Function at 0xcd31e0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0xcd3376
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0xcd336f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0xcd3271
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 0xc]
mov eax, 0x15b0
je 0xcd336f
xor edx, edx
cmp eax, 8
mov dword [esp + 8], esi
jb 0xcd32e5
mov edx, eax
and edx, 0x1ff8
mov dword [esp], edx
mov edx, 7
nop dword [eax]
mov ebx, eax
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + 7]
add edi, eax
mov eax, ebx
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0xcd3290
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov ebx, eax
sub ebx, edx
mov dword [esp + 0xc], eax
jbe 0xcd3238
mov dword [esp], edx
not edx
add edx, eax
mov dword [esp + 4], edx
mov edx, eax
and edx, 3
mov dword [esp + 0x10], ebx
je 0xcd3324
neg edx
xor eax, eax
mov ebx, ebp
nop
movzx esi, byte [ebx]
add edi, esi
add ecx, edi
inc ebx
dec eax
cmp edx, eax
jne 0xcd3310
mov edx, dword [esp]
sub edx, eax
jmp 0xcd3329
mov ebx, ebp
mov edx, dword [esp]
mov eax, dword [esp + 4]
cmp eax, 3
jb 0xcd3230
mov eax, dword [esp + 0xc]
sub eax, edx
xor edx, edx
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0xcd3340
jmp 0xcd3230
shl ecx, 0x10
or ecx, edi
jmp 0xcd337b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xcd3390
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0xcd33be
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0xcd345c
not eax
test bl, 1
jne 0xcd33c5
mov edx, ebx
cmp ebx, 1
jne 0xcd33f6
jmp 0xcd345a
xor eax, eax
jmp 0xcd345c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0xd0c948]
inc ecx
mov eax, edi
shr eax, 4
shr esi, 4
and edi, 0xf
xor edi, esi
xor eax, dword [edi*4 + 0xd0c948]
cmp ebx, 1
je 0xcd345a
xor esi, esi
nop dword [eax + eax]
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0xd0c948]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0xd0c948]
movzx ebx, byte [ecx + esi + 1]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0xd0c948]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0xd0c948]
add esi, 2
cmp edx, esi
jne 0xcd3400
not eax
pop esi
pop edi
pop ebx
ret
Function at 0xcd9360
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
call fcn.00cd9410
sub esp, 0x208
mov esi, esp
jmp 0xcd9374
call fcn.00cd9410
sub esp, 0x100
mov edi, esp
call fcn.00d06970
jmp 0xcd9388
test al, 1
jne 0xcd938e
jmp 0xcd93dc
call fcn.00d01490
test al, 1
jne 0xcd9399
jmp 0xcd93d7
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, str.primarily_often_on_modified_in_or_uses_the_on_the_play_of_is_that_eleet_replacements_leetspeak__ways_other_via_used_resemblance_spellings_similarity_a_internet._glyphs_of_it_system_or_their_character_reflection
sub esp, 8
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00cd93f0
add esp, 8
call fcn.00cda580
test al, 1
jne 0xcd93d0
jmp 0xcd93d7
call fcn.00cdf460
jmp 0xcd93d7
call fcn.00d07190
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0xcd9480
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx edx, word [edi]
test dx, dx
je 0xcd9596
lea eax, [edi + 2]
xor ebx, ebx
mov ecx, 1
nop word [eax + eax]
movzx esi, dx
xor edx, edx
cmp esi, 0x800
setb dl
xor edx, 3
cmp esi, 0x80
cmovb edx, ecx
add ebx, edx
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0xcd94b0
lea esi, [ebx + 1]
push esi
call fcn.00cd8c00
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0xcd95a4
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0xcd9518
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0xcd95a6
movzx edx, word [edi]
test dx, dx
je 0xcd95a6
cmp dx, 0x7f
jbe 0xcd9500
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0xcd9560
cmp ecx, 2
jb 0xcd9560
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0xcd9507
xor esi, esi
cmp ecx, 3
jb 0xcd9507
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0xcd9507
push 1
call fcn.00cd8c00
add esp, 4
mov ebp, eax
jmp 0xcd95a6
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0xcd95c7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0xcd95c2
test eax, eax
jne 0xcd95c0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00cd5560
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0xce45f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov esi, 0xfffffffe
nop word cs:[eax + eax]
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0xce4610
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov eax, 0xfffffffe
nop word cs:[eax + eax]
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0xce4630
sar esi, 1
sar eax, 1
add eax, esi
add eax, 2
lea ecx, [eax + eax]
test eax, eax
mov eax, 0xffffffff
cmovns eax, ecx
push eax
call fcn.00cd8c00
add esp, 4
mov ebx, eax
movzx ecx, word [edi]
test cx, cx
je 0xce4681
add edi, 2
mov eax, ebx
nop dword [eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0xce4670
mov word [eax], 0x5c
add eax, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0xce46b1
add edx, 2
nop word [eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xce46a0
mov word [eax], 0
lea eax, [esp + 0x10]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00d09df0
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0xd11e80]
mov ecx, 0xc0c328ec
xor ecx, dword [0xd11e88]
add eax, ecx
inc eax
jmp eax
add dword [edi], ecx
xchg esp, eax
ror dword [ebx + 0x14c96], 0
xor edx, 0x23c9238f
mov edi, dword [esi + 0x308]
mov edx, dword [edi + edx*4]
mov edi, dword [0xd157cc]
xor edi, 0xee4ca2ec
sub edx, edi
jmp edx
add byte [eax], al
add dword [eax], eax
add byte [eax], al
mov eax, dword [esi + 0x2bc]
mov ecx, dword [esi + 0x2b8]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0xd15850]
xor ecx, 0x170975d
sub eax, ecx
jmp eax
Function at 0xcea020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
movaps xmm0, xmmword [0xd0dd70]
movups xmmword [esp + 0x20], xmm0
movaps xmm0, xmmword [0xd0dd80]
movups xmmword [esp + 0x30], xmm0
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0xf5f6
mov dword [esp + 0x46], 0
mov dword [esp + 0x42], 0
mov byte [esp + 0x4a], 0
mov dword [esp + 8], 0
mov ecx, dword [esp + 8]
cmp ecx, 0x2a
ja 0xcea0d3
nop dword [eax + eax]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 8]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx + 0xbd]
and esi, edx
mov edi, 0x73f30742
sub edi, ecx
or edi, edx
not edi
add edi, edx
sub edi, esi
mov dword [esp + 0x70], edi
mov ecx, dword [esp + 0x70]
mov edx, ecx
or edx, 0xd4
and ecx, 0xd4
add ecx, edx
inc cl
mov edx, dword [esp + 8]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 8]
mov ecx, dword [esp + 8]
cmp ecx, 0x2b
jb 0xcea080
lea edi, [esp + 0x70]
lea ebx, [esp + 0x20]
mov edx, ebx
mov ecx, 8
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x90]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 4]
mov eax, 0xfffffffe
nop word cs:[eax + eax]
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0xcea110
lea ecx, [eax + 0x22]
cmp eax, 0xffffffdd
mov eax, 0xffffffff
cmovge eax, ecx
push eax
call fcn.00cd8c00
add esp, 4
mov esi, eax
movzx ecx, word [edi]
test cx, cx
je 0xcea161
add edi, 2
mov eax, esi
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0xcea150
mov word [eax], 0
movzx ecx, word [esp + 0x70]
test cx, cx
je 0xcea191
lea edx, [esp + 0x72]
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xcea180
mov word [eax], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0xd0dd90]
movups xmmword [esp + 0x20], xmm0
movaps xmm0, xmmword [0xd0dda0]
movups xmmword [esp + 0x30], xmm0
movaps xmm0, xmmword [0xd0ddb0]
movups xmmword [esp + 0x40], xmm0
movaps xmm0, xmmword [0xd0ddc0]
movups xmmword [esp + 0x50], xmm0
mov dword [esp + 0x60], 0xb3b2cd22
mov dword [esp + 0x64], 0
mov word [esp + 0x68], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x49
ja 0xcea253
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x20]
lea edx, [eax + 0xfe]
and edx, ecx
mov edi, 0x6d63d801
sub edi, eax
or edi, ecx
not edi
add edi, ecx
sub edi, edx
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x1c]
add al, 0xe
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x20], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x4a
jb 0xcea210
lea eax, [esp + 8]
push eax
push 0xcea5b0
push ebx
push esi
call fcn.00ceaab0
add esp, 0x10
mov ebx, eax
mov eax, dword [0xd12cd4]
mov ecx, 0x82f44e97
xor ecx, dword [0xd12cdc]
add eax, ecx
inc eax
jmp eax
Function at 0xcea3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
movaps xmm0, xmmword [0xd0ddd0]
movups xmmword [esp + 8], xmm0
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x908
mov dword [esp + 0x1e], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 0x22], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1d
ja 0xcea460
nop dword [eax]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
add ecx, 0x3ad37dac
mov esi, ecx
and esi, edx
mov edi, ecx
xor edi, edx
lea ebx, [edi + esi*2]
or ecx, edx
xor ecx, edi
add ecx, esi
mov edx, ebx
xor edx, ecx
not ecx
and ecx, ebx
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
add cl, 0x4c
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1e
jb 0xcea410
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea edx, [esp + 8]
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop dword [eax]
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0xcea490
lea ecx, [eax + 0x12]
cmp eax, 0xffffffed
mov eax, 0xffffffff
cmovge eax, ecx
push eax
call fcn.00cd8c00
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0xcea4e1
add ebx, 2
mov eax, esi
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0xcea4d0
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0xcea511
lea edx, [esp + 0x2a]
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xcea500
mov word [eax], 0
lea eax, [esp + 8]
push eax
push esi
call fcn.00d09fb0
add esp, 8
mov ecx, dword [0xd12d18]
mov edx, 0x1222ab09
xor edx, dword [0xd12d1c]
add ecx, edx
inc ecx
nop dword [eax + eax]
jmp ecx
Function at 0xcef6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x860
mov dword [esp + 0x10], 0
mov eax, 0x20219
mov ecx, 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
jmp dword [ecx*4 + 0xd141b0]
Function at 0xcfc830
Capabilities:
Encode data using xor
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, esp
mov ebx, dword [ebp + 8]
call fcn.00cd9410
push eax
mov eax, esp
jmp 0xcfc84b
mov dword [esi + 0x20], eax
call fcn.00cd9410
sub esp, 0x18
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov dword [esi + 0x1c], esp
jmp 0xcfc863
mov dword [esi + 0x24], ebx
mov byte [esi + 3], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0xcfc87e
jmp 0xcfc880
cmp eax, 0
setne al
test al, 1
jne 0xcfc88f
jmp 0xcfca10
jmp 0xcfc891
xor eax, eax
lea eax, [esi + 0x2c]
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
jmp 0xcfc8ac
jmp 0xcfc8ae
jmp 0xcfc8b0
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
jmp 0xcfc8c8
jmp 0xcfc8ca
cmp eax, 0
setne al
test al, 1
jne 0xcfc8d9
jmp 0xcfca00
mov eax, dword [esi + 8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
sub esp, 4
mov dword [esp], eax
call fcn.00cd8f00
add esp, 4
mov edx, dword [esi + 0x20]
jmp 0xcfc901
mov dword [edx], eax
jmp 0xcfc905
mov eax, dword [edx]
cmp eax, 0
setne al
jmp 0xcfc90f
jmp 0xcfc911
test al, 1
jne 0xcfc91a
jmp 0xcfc9f1
mov ecx, dword [esi + 0x24]
mov edx, dword [edx]
mov eax, dword [esi + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x1c]
mov bl, byte [eax]
mov byte [esi + 0xc], bl
mov byte [edi], 0x73
mov byte [edi + 1], 0x15
mov byte [edi + 2], 0x13
mov byte [edi + 3], 0x2b
mov byte [edi + 4], 0x18
mov byte [edi + 5], 0x2c
mov byte [edi + 6], 0x1f
mov byte [edi + 7], 0x2d
mov byte [edi + 8], 0x1a
mov byte [edi + 9], 0x4f
mov byte [edi + 0xa], 0x34
mov byte [edi + 0xb], 0x3b
mov byte [edi + 0xc], 0x36
mov byte [edi + 0xd], 0xa5
mov dword [edi + 0x12], 0
mov dword [edi + 0xe], 0
mov byte [edi + 0x16], 0
mov dword [esi + 4], 0
mov ebx, dword [esi + 4]
cmp ebx, 0x17
jae 0xcfc9d6
mov dword [esi + 0x18], edx
jmp 0xcfc98a
mov edx, dword [esi + 4]
mov eax, dword [esi + 4]
movzx eax, byte [edi + eax]
mov ebx, edx
add ebx, 0xb4b33f47
and ebx, eax
lea eax, [edx + eax - 0x4b4cc0b9]
add ebx, ebx
sub eax, ebx
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x28]
mov edx, eax
xor edx, 0xe
and eax, 0xe
lea eax, [edx + eax*2]
inc al
mov edx, dword [esi + 4]
mov byte [edi + edx], al
mov eax, dword [esi + 4]
inc eax
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, 0x17
jb 0xcfc98a
mov edx, dword [esi + 0x18]
jmp 0xcfc9d6
sub esp, 0xc
mov dword [esp], edi
mov eax, dword [esi + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00cd9620
and al, 1
mov byte [esi + 3], al
mov eax, dword [esi + 8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0xcfca02
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0xcfca0a
jmp 0xcfca0c
jmp 0xcfca0e
jmp 0xcfca10
mov al, byte [esi + 3]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xd03060
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
movups xmm0, xmmword [0xd0ee14]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0xc3d2e1f0
cmp ebx, 0x40
jb 0xd03107
mov edi, ebx
shr edi, 6
xor ebx, ebx
nop
mov ebp, eax
xor esi, esi
nop word cs:[eax + eax]
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x20], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x20], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x20], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x20], ecx
add esi, 4
cmp esi, 0x40
jne 0xd030a0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00d03990
add esp, 8
mov eax, ebx
and eax, 1
xor ebx, 1
lea ebx, [ebx + eax*2]
lea eax, [esi + ebp]
cmp ebx, edi
jb 0xd03090
add ebp, esi
mov eax, ebp
mov ebx, dword [esp + 0x78]
xorps xmm0, xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
mov edi, ebx
and edi, 0x3f
je 0xd031a8
mov ecx, ebx
and ecx, 1
xor edx, edx
cmp edi, 1
je 0xd03191
mov dword [esp + 4], edi
mov dword [esp], ecx
sub edi, ecx
mov dword [esp + 8], edi
xor ebx, ebx
xor edx, edx
nop word cs:[eax + eax]
movzx ebp, byte [eax + edx]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edi, edx
and edi, 0xfffffffc
xor ebp, dword [esp + edi + 0x20]
mov dword [esp + edi + 0x20], ebp
movzx esi, byte [eax + edx + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edi + 0x20], esi
add edx, 2
add ebx, 0x10
cmp dword [esp + 8], edx
jne 0xd03150
add eax, edx
mov ebx, dword [esp + 0x78]
mov edi, dword [esp + 4]
mov ecx, dword [esp]
test ecx, ecx
je 0xd031a8
movzx eax, byte [eax]
lea ecx, [edx*8]
shl eax, cl
and edx, 0xfffffffc
xor dword [esp + edx + 0x20], eax
mov eax, ebx
xor eax, 0x1c
mov ecx, ebx
or ecx, 3
and ecx, eax
shl ecx, 3
or cl, 7
mov eax, 1
shl eax, cl
mov esi, dword [esp + 0x7c]
mov ecx, ebx
and ecx, 0x3c
xor dword [esp + ecx + 0x20], eax
cmp edi, 0x37
jbe 0xd031f9
lea edi, [esp + 0x20]
lea eax, [esp + 0xc]
push edi
push eax
call fcn.00d03990
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x60]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
lea eax, [ebx*8]
mov dword [esp + 0x58], eax
shr ebx, 0x1d
mov dword [esp + 0x5c], ebx
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00d03990
add esp, 8
mov eax, dword [esp + 0xc]
mov dword [esi], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x10], eax
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret