joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d9a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x14], ecx
mov edi, dword [ecx + 0x60]
mov word [esp], 0xc5c3
mov byte [esp + 2], 0xce
mov dword [esp + 3], 0
mov ebx, 0x236821cd
nop
nop
movzx ecx, byte [esp + ebx - 0x236821cd]
mov eax, ecx
and eax, ebx
add al, al
sub cl, al
movzx eax, cl
add eax, ebx
dec al
mov byte [esp + ebx - 0x236821cd], al
inc ebx
cmp ebx, 0x236821d4
jne 0x40d9d0
mov dword [esp + 8], 0x7e04006e
mov word [esp + 0xc], 0x737a
mov dword [esp + 0xe], 0
mov word [esp + 0x12], 0
mov ebx, 0xb06b8a3d
mov ebp, 0xc2
nop
movzx ecx, byte [esp + ebx + 0x4f9475cb]
mov eax, ebp
xor eax, ebx
and eax, ecx
xor eax, ebx
mov ecx, eax
and ecx, 1
xor eax, 1
add eax, 0xce
or eax, ecx
add eax, ecx
mov byte [esp + ebx + 0x4f9475cb], al
inc ebx
dec ebp
cmp ebx, 0xb06b8a49
jne 0x40da20
mov dword [esp + 0x18], 0x9e845053
mov dword [esp + 0x1c], 0x829e6c68
mov dword [esp + 0x20], 0x858e8473
mov dword [esp + 0x24], 0x8a818689
mov dword [esp + 0x28], 0x42898586
mov dword [esp + 0x2c], 0xbc6f2927
mov dword [esp + 0x30], 0xbfb183ba
mov dword [esp + 0x34], 0xbe567c84
mov dword [esp + 0x38], 0x8cb7b789
mov dword [esp + 0x3c], 0xacb98fbb
mov dword [esp + 0x40], 0xa77e55aa
mov dword [esp + 0x44], 0x62ada9a9
mov dword [esp + 0x48], 0xb29ab4a8
mov dword [esp + 0x4c], 0xcea47355
mov dword [esp + 0x50], 0xb29d0db
mov byte [esp + 0x54], 0x68
mov dword [esp + 0x55], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
add al, 9
xor al, byte [esp + ebx + 0x18]
add al, 0xd3
mov byte [esp + ebx + 0x18], al
inc ebx
cmp ebx, 0x41
jne 0x40dae0
mov eax, dword [esp + 0x70]
add eax, edi
movzx ebx, byte [esp + 0x18]
mov edi, eax
test bl, bl
je 0x40db1c
lea ebp, [esp + 0x19]
mov edi, eax
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40db10
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40db3b
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40db30
mov byte [edi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40db5b
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40db50
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40db7b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40db70
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40db9b
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40db90
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x14]
add dword [eax + 0x60], edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a0
mov eax, dword [0x44fa24]
mov dword [esp + 0x120], 0x93928990
mov byte [esp + 0x124], 0
xor edx, edx
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x120]
mov esi, ecx
or esi, 0x760f47dc
add esi, edx
mov edi, edx
xor edi, 0xdc
lea esi, [edi + esi*2]
add esi, 2
lea edi, [ebx + ebx]
not edi
add edi, ebx
mov ebp, edi
xor ebp, 0xfa
or edi, 5
and edi, ebp
and ebx, 0xfffffffa
or ebx, edi
xor ebx, esi
xor bl, 5
add bl, 0xb4
mov byte [esp + edx + 0x120], bl
lea esi, [edx + 1]
dec ecx
mov edx, esi
cmp esi, 5
jne 0x40e7f0
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x20], 0x812d873d
mov dword [esp + 0x24], 0x8d2a8336
mov dword [esp + 0x28], 0x89328f30
mov dword [esp + 0x2c], 0x957c8b38
mov dword [esp + 0x30], 0x91229738
mov dword [esp + 0x34], 0x9d929324
mov dword [esp + 0x38], 0
mov edx, 0xed14fbe1
mov esi, 0x1e
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x12eb043f]
mov ebx, esi
xor ebx, edx
and ebx, edi
xor ebx, edx
mov edi, 0x31
sub edi, ebx
add ebx, 0xce
and edi, 0x34
and ebx, 0xcb
sub ebx, edi
inc bl
mov byte [esp + edx + 0x12eb043f], bl
inc edx
dec esi
cmp edx, 0xed14fbfd
jne 0x40e890
lea esi, [esp + 0x20]
push ecx
push 0
push esi
call eax
mov ecx, 0x44f9ec
push eax
call fcn.00440050
movzx eax, al
mov eax, dword [eax*4 + 0x449a8c]
mov ecx, 0x9402cd73
xor ecx, dword [0x449a94]
add eax, ecx
inc eax
jmp eax
Function at 0x410a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0x49db4bbf
mov dword [esp + 0x3c], 0x45d147ce
mov dword [esp + 0x40], 0x41d643d0
mov dword [esp + 0x44], 0x7daf7fdf
mov dword [esp + 0x48], 0x79a87bb7
mov dword [esp + 0x4c], 0x755677a8
mov dword [esp + 0x50], 0x719b73ac
mov dword [esp + 0x54], 0x6dfc6fe7
mov dword [esp + 0x58], 0x69fb6bf0
mov dword [esp + 0x5c], 0x65eb67e1
mov dword [esp + 0x60], 0x61906344
mov dword [esp + 0x64], 0x1d3e1f8c
mov dword [esp + 0x68], 0x19ca1bd3
mov dword [esp + 0x6c], 0x15c617ca
mov dword [esp + 0x70], 0x113213d1
mov dword [esp + 0x74], 0xd990ff9
mov dword [esp + 0x78], 0x9c00b9e
mov dword [esp + 0x7c], 0x5c307c4
mov dword [esp + 0x80], 0x18a0324
mov dword [esp + 0x84], 0x3df23fca
mov dword [esp + 0x88], 0x391a3beb
mov dword [esp + 0x8c], 0x35a637c7
mov dword [esp + 0x90], 0x31a633a4
mov dword [esp + 0x94], 0x2dc72fab
mov dword [esp + 0x98], 0x29b42bb7
mov dword [esp + 0x9c], 0x25b127dd
mov dword [esp + 0xa0], 0x21f323a8
mov dword [esp + 0xa4], 0xdd13dfeb
mov dword [esp + 0xa8], 0xd908db15
mov dword [esp + 0xac], 0xd51cd715
mov dword [esp + 0xb0], 0xd10ad3f4
mov dword [esp + 0xb4], 0xcd36cf25
mov dword [esp + 0xb8], 0xc939cb20
mov dword [esp + 0xbc], 0xc512c73c
mov dword [esp + 0xc0], 0xc156c3e4
mov dword [esp + 0xc4], 0xfd6bff57
mov dword [esp + 0xc8], 0xf9dafb67
mov dword [esp + 0xcc], 0xf56df701
mov dword [esp + 0xd0], 0xf167f369
mov dword [esp + 0xd4], 0xed39ef61
mov dword [esp + 0xd8], 0xe917ebcc
mov dword [esp + 0xdc], 0xe568e770
mov dword [esp + 0xe0], 0xe171e375
mov dword [esp + 0xe4], 0x9d4f9f7b
mov dword [esp + 0xe8], 0x99559b53
mov dword [esp + 0xec], 0x9544975f
mov dword [esp + 0xf0], 0x91409344
mov dword [esp + 0xf4], 0x8d5c8f40
mov dword [esp + 0xf8], 0x89aa8b5c
mov dword [esp + 0xfc], 0x85198765
mov dword [esp + 0x100], 0x811d831e
mov dword [esp + 0x104], 0xbd29bf0e
mov dword [esp + 0x108], 0xb971bb6d
mov dword [esp + 0x10c], 0xb57fb775
mov dword [esp + 0x110], 0xb17fb366
mov dword [esp + 0x114], 0xadaeaf7a
mov byte [esp + 0x11a], 0
mov word [esp + 0x118], 0
mov eax, dword [0x44f9f4]
mov ecx, 0x13
mov edx, 0xec
nop
nop
nop
movzx esi, byte [esp + ecx + 0x25]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0xa1
mov byte [esp + ecx + 0x25], bl
inc ecx
dec edx
cmp ecx, 0xf6
jne 0x410cf0
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x449fe0]
mov ecx, 0x2857f555
xor ecx, dword [0x449fe8]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax

Function at 0x4114a0
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, eax
shr ecx, 0x1f
xor eax, eax
jmp dword [ecx*4 + 0x44a8ec]
Function at 0x41da80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x41daa0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41dac0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x41dae0
mov eax, 0xffffffff
jmp 0x41dae9
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.0040ce80
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x41db21
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x41db10
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [ebp]
test cx, cx
je 0x41db51
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41db40
mov word [ebx], 0
mov ecx, esp
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x20], eax
push eax
call fcn.00444710
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b58c]
Function at 0x41dde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1118
call fcn.0040cde0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x41de00
lea edx, [eax + ecx]
add edx, 0xfffffffe
add ecx, eax
mov edi, 1
sub edi, ecx
and edi, eax
mov esi, eax
not esi
and esi, edx
sub esi, edi
sar esi, 1
lea ecx, [esp + 0x58]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x450d38]
mov ebx, dword [esp + 0x58]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41de4c
mov eax, 0xffffffff
jmp 0x41de4f
lea eax, [ebx + ebx]
push eax
call fcn.0040ce80
add esp, 4
lea ecx, [esp + 0x58]
push ecx
push ebx
mov dword [esp + 0x38], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x450d38]
mov eax, dword [esp + 0x58]
mov ecx, eax
add ecx, 0xd
js 0x41de84
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040ce80
add esp, 4
mov edi, eax
mov dword [esp + 0x114], 0xf3a6f154
mov dword [esp + 0x118], 0xff4dfd5d
mov dword [esp + 0x11c], 0xfb9af944
mov dword [esp + 0x120], 0xc76bc59a
mov dword [esp + 0x124], 0xc371c172
mov dword [esp + 0x128], 0xcf79cd65
mov dword [esp + 0x12c], 0xcbcac97e
mov dword [esp + 0x130], 0
mov eax, 0x2d53e2d4
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x2d53e1c0]
mov edx, eax
and edx, esi
mov ebx, edx
and ebx, 0xfffffffd
mov ecx, edx
or ecx, 0xfffffffd
inc ecx
imul ecx, ebx
mov ebx, edx
and ebx, 2
or edx, 2
imul edx, ebx
add ecx, esi
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x5b
add edx, edx
xor ecx, 0x24
sub edx, ecx
mov byte [esp + eax - 0x2d53e1c0], dl
inc eax
cmp eax, 0x2d53e2f4
jne 0x41def0
mov eax, dword [esp + 0x30]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41df61
mov eax, dword [esp + 0x30]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41df50
mov word [eax], 0
movzx ecx, word [esp + 0x114]
test cx, cx
je 0x41df91
lea edx, [esp + 0x116]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41df80
mov word [eax], 0
lea eax, [esp + 0xa8]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00444710
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b948]
Function at 0x423fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x423fc0
sar ebx, 1
mov eax, esp
push eax
push 0
push 0
push ebx
push edi
push 0
call dword [0x450d38]
mov ebp, dword [esp]
test ebp, ebp
jns 0x423fec
mov eax, 0xffffffff
jmp 0x423ff3
lea eax, [ebp*2]
push eax
call fcn.0040ce80
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebp
push esi
push ebx
push edi
push 0
call dword [0x450d38]
lea edi, [esp + 0xc]
push edi
push esi
call fcn.004448b0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44bdc4]
Function at 0x425c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
push eax
mov ebx, esp
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425c50
cmp eax, 0xffffffed
jge 0x425c67
mov eax, 0xffffffff
jmp 0x425c6a
add eax, 0x12
push eax
call fcn.0040ce80
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], 0xcf51c9a4
mov dword [ebp - 0x20], 0xc34bcda9
mov dword [ebp - 0x1c], 0xc794c194
mov dword [ebp - 0x18], 0xfb9cc5a0
mov dword [ebp - 0x14], 0xf9f8
mov byte [ebp - 0x10], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x52
xor cl, byte [ebp + eax - 0x24]
add cl, 0x66
mov byte [ebp + eax - 0x24], cl
inc eax
cmp eax, 0x15
jne 0x425ca0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x425ce1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x425cd0
mov word [eax], 0
movzx ecx, word [ebp - 0x24]
test cx, cx
je 0x425d11
lea edx, [ebp - 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425d00
mov word [eax], 0
push ebx
push esi
call fcn.004448b0
add esp, 8
mov edi, eax
mov ebx, dword [ebx]
jmp dword [0x44be7c]

Function at 0x425c9a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
push eax
mov ebx, esp
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425c50
cmp eax, 0xffffffed
jge 0x425c67
mov eax, 0xffffffff
jmp 0x425c6a
add eax, 0x12
push eax
call fcn.0040ce80
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], 0xcf51c9a4
mov dword [ebp - 0x20], 0xc34bcda9
mov dword [ebp - 0x1c], 0xc794c194
mov dword [ebp - 0x18], 0xfb9cc5a0
mov dword [ebp - 0x14], 0xf9f8
mov byte [ebp - 0x10], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x52
xor cl, byte [ebp + eax - 0x24]
add cl, 0x66
mov byte [ebp + eax - 0x24], cl
inc eax
cmp eax, 0x15
jne 0x425ca0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x425ce1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x425cd0
mov word [eax], 0
movzx ecx, word [ebp - 0x24]
test cx, cx
je 0x425d11
lea edx, [ebp - 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425d00
mov word [eax], 0
push ebx
push esi
call fcn.004448b0
add esp, 8
mov edi, eax
mov ebx, dword [ebx]
jmp dword [0x44be7c]
Function at 0x4284d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp], 0xd986dbff
mov dword [esp + 4], 0xddbbdfa9
mov dword [esp + 8], 0xd1aed3bb
mov dword [esp + 0xc], 0xd5a6d797
mov dword [esp + 0x10], 0xe9aeeba4
mov dword [esp + 0x14], 0xed9aef8f
mov dword [esp + 0x18], 0xe1d9e38b
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xe7e0
mov byte [esp + 0x20], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
neg edx
lea esi, [edx + edx]
and esi, 0x62
xor edx, 0xce
sub edx, esi
inc dl
xor dl, byte [esp + ecx]
add dl, 0xf5
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x21
jb 0x428530
lea ebx, [esp + 0x7a]
mov esi, esp
mov edx, esi
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x96]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x50]
push edi
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x450d38]
mov ebx, dword [esp + 0x50]
mov ebp, 0xffffffff
test ebx, ebx
jns 0x4285ab
mov eax, 0xffffffff
jmp 0x4285ae
lea eax, [ebx + ebx]
push eax
call fcn.0040ce80
add esp, 4
push edi
push ebx
mov dword [esp + 0x64], eax
push eax
push 0xe
lea eax, [esp + 0x8a]
push eax
push 0
call dword [0x450d38]
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
js 0x4285e2
lea ebp, [eax*2 + 0x12]
push ebp
call fcn.0040ce80
add esp, 4
mov ebx, eax
mov dword [esp], 0x33823194
mov dword [esp + 4], 0x2f8d2d8d
mov dword [esp + 8], 0x2b8b29b3
mov dword [esp + 0xc], 0x27bb25bb
mov dword [esp + 0x10], 0x232221b3
mov dword [esp + 0x14], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x4c
xor cl, byte [esp + eax]
add cl, 0x84
mov byte [esp + eax], cl
inc eax
cmp eax, 0x18
jne 0x428620
mov ebp, dword [esp + 0x5c]
movzx ecx, word [ebp]
mov eax, ebx
test cx, cx
je 0x428661
lea edx, [ebp + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428650
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x428691
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428680
mov word [eax], 0
lea eax, [esp + 0x74]
push eax
push ebx
call fcn.004448b0
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x58], ebx
jmp dword [eax*4 + 0x44c514]
Function at 0x42e290
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc4
mov dword [esp + 0x18], 0x145072b
mov dword [esp + 0x1c], 0xd720370
mov dword [esp + 0x20], 0x96d0f40
mov dword [esp + 0x24], 0x15690b74
mov dword [esp + 0x28], 0x1172173b
mov dword [esp + 0x2c], 0x1d631346
mov dword [esp + 0x30], 0x19711f60
mov dword [esp + 0x34], 0x25791b68
mov dword [esp + 0x38], 0x21132748
mov dword [esp + 0x3c], 0x2d462315
mov dword [esp + 0x40], 0x29412f51
mov dword [esp + 0x44], 0x35572b55
mov dword [esp + 0x48], 0x3147375f
mov dword [esp + 0x4c], 0x3d043346
mov dword [esp + 0x50], 0x39493f44
mov dword [esp + 0x54], 0x453a3b4c
lea eax, [esp + 0x58]
mov dword [esp + 0x58], 0
mov ecx, 0x17c06f81
mov edx, 0x7e
movzx esi, byte [esp + ecx - 0x17c06f69]
mov edi, esi
not edi
mov ebx, edi
and ebx, 0x46
or edi, 0xb9
add esi, edi
inc esi
or esi, ebx
mov edi, ecx
xor edi, 0x46
mov ebp, ecx
or ebp, 0xb9
and ebp, edi
mov ebx, edx
and ebx, 0x46
xor ebx, ebp
xor ebx, esi
add bl, 0x7b
mov byte [esp + ecx - 0x17c06f69], bl
inc ecx
dec edx
cmp ecx, 0x17c06fc5
jne 0x42e330
lea esi, [esp + 0x84]
lea edx, [esp + 0x18]
mov ecx, 0x10
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xc4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x80]
push edi
push 0
push 0
push 0x1f
push esi
push 0
call dword [0x450d38]
mov ebx, dword [esp + 0x80]
test ebx, ebx
jns 0x42e3c7
mov eax, 0xffffffff
jmp 0x42e3ca
lea eax, [ebx + ebx]
push eax
call fcn.0040ce80
add esp, 4
mov ebp, eax
push edi
push ebx
push eax
push 0x1f
push esi
push 0
call dword [0x450d38]
lea eax, [esp + 0x14]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00444710
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44cf50]
Function at 0x4344f0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2a0
mov dword [esp + 0x284], 0x44d8bc
mov dword [esp + 0x84], 0
lea eax, [esp + 0x84]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x447aa0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x447ab0
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x280], eax
mov eax, dword [esp + 0x284]
mov ecx, dword [esp + 0x280]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x27c], 0x44d8c4
mov dword [esp + 0x274], 0x44d8cc
mov dword [esp + 0x26c], 0x44d8d4
mov dword [esp + 0x264], 0x44d8dc
mov dword [esp + 0x25c], 0x44d8e4
mov dword [esp + 0x254], 0x44d040
mov dword [esp + 0x250], 0x9f
mov dword [esp + 0x24c], 0x44d8ec
mov dword [esp + 0x244], 0x44d040
mov dword [esp + 0x240], 0xa2
mov dword [esp + 0x23c], 0x44d040
mov dword [esp + 0x238], 0xa2
mov dword [esp + 0x234], 0x44d8f4
mov dword [esp + 0x22c], 0x44d8fc
mov dword [esp + 0x224], 0x44d040
mov dword [esp + 0x220], 0xa5
mov dword [esp + 0x21c], 0x44d904
mov dword [esp + 0x214], 0x44d90c
mov dword [esp + 0x20c], 0x44d914
mov dword [esp + 0x204], 0x44d91c
mov dword [esp + 0x1fc], 0x44d924
mov dword [esp + 0x1f4], 0x44d040
mov dword [esp + 0x1f0], 0xab
mov dword [esp + 0x1ec], 0x44d92c
mov dword [esp + 0x1e4], 0x44d040
mov dword [esp + 0x1e0], 0xad
mov dword [esp + 0x1dc], 0x44d040
mov dword [esp + 0x1d8], 0xae
mov dword [esp + 0x1d4], 0x44d040
mov dword [esp + 0x1d0], 0xaf
mov dword [esp + 0x1cc], 0x44d934
mov dword [esp + 0x1c4], 0x44d93c
mov dword [esp + 0x1bc], 0x44d944
mov dword [esp + 0x1b4], 0x44d040
mov dword [esp + 0x1b0], 0xb3
mov dword [esp + 0x1ac], 0x44d040
mov dword [esp + 0x1a8], 0xb4
mov dword [esp + 0x1a4], 0x44d94c
mov dword [esp + 0x19c], 0x44d954
mov dword [esp + 0x194], 0x44d040
mov dword [esp + 0x190], 0xb7
mov dword [esp + 0x18c], 0x44d040
mov dword [esp + 0x188], 0xb8
mov dword [esp + 0x184], 0x44d040
mov dword [esp + 0x180], 0x9a
mov dword [esp + 0x17c], 0x44d040
mov dword [esp + 0x178], 0xa6
mov dword [esp + 0x174], 0x44d040
mov dword [esp + 0x170], 0xa9
mov dword [esp + 0x16c], 0x44d040
mov dword [esp + 0x168], 0xb1
mov dword [esp + 0x164], 0x44d040
mov dword [esp + 0x160], 0xb5
xor ebx, ebx
jmp eax
Function at 0x435dc0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.0040e7b0
sub esp, 0x14
mov edi, esp
jmp 0x435dd5
call fcn.0040e7b0
push eax
mov esi, esp
jmp 0x435ddf
jmp 0x435de1
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x435e04
jmp 0x435f57
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x435f4f
mov dword [ebp - 0x1c], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00432220
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x435e6d
jmp 0x435f40
mov dword [ebp - 0x14], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.0040ce80
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00432290
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x59
mov byte [edi + 1], 0xb3
mov byte [edi + 2], 0xbd
mov byte [edi + 3], 0xb1
mov byte [edi + 4], 0x42
mov byte [edi + 5], 0xb2
mov byte [edi + 6], 0x41
mov byte [edi + 7], 0xcf
mov byte [edi + 8], 0xc0
mov byte [edi + 9], 9
mov byte [edi + 0xa], 0xd2
mov byte [edi + 0xb], 0xd1
mov byte [edi + 0xc], 0xd4
mov byte [edi + 0xd], 0x5b
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x14
jne 0x435edd
mov ecx, dword [ebp + 8]
xor eax, eax
mov esi, dword [ebp - 0x18]
cmp eax, 0x14
jae 0x435f0b
mov dh, byte [edi + eax]
mov dl, al
add dl, 0x39
xor dl, dh
add dl, 0xe3
mov byte [edi + eax], dl
add eax, 1
jmp 0x435ef1
jmp 0x435f0d
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
call fcn.0040d920
mov bl, al
and bl, 1
jmp 0x435f2a
jmp 0x435f2c
jmp 0x435f2e
sub esp, 4
mov dword [esp], esi
call fcn.0040ce90
add esp, 4
jmp 0x435f3e
jmp 0x435f40
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x435f57
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret