joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x4058ea
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x4058ea
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4058ea
cmp dword [ecx], 0
jne 0x4058ea
push edi
call fcn.0040c790
add esp, 4
test eax, eax
je 0x40574a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [edi + ebx]
test edx, edx
je 0x405751
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x405730
jmp 0x405753
mov esi, 0x1505
jmp 0x405753
mov esi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
mov edi, edx
sub edi, 1
jae 0x405826
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov ebx, dword [esp + 0x2c]
jb 0x4057aa
call fcn.004059c0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x4058ea
push ebx
call fcn.0040c790
add esp, 4
lea edi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, ebx
push edi
push esi
push eax
call fcn.00405900
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040c790
add esp, 4
mov ebx, eax
and eax, 1
mov ecx, ebx
xor ecx, 1
lea eax, [ecx + eax*2]
push eax
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x4058e5
mov edi, eax
mov byte [eax + ebx], 0
push ebx
push dword [esp + 0x30]
push eax
call fcn.0040c660
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov edi, dword [esp + 0x30]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [edi], eax
xor eax, eax
jmp 0x4058ea
mov dword [esp], eax
mov eax, edx
mov edx, esi
not edx
or edi, edx
mov edx, eax
xor edx, 1
mov ebx, eax
and ebx, 0xfffffffe
add ebx, ebx
sub ebx, edx
mov dword [esp + 0xc], ebx
mov edx, eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea ebx, [esi + edi]
inc ebx
jmp 0x405868
inc ebx
dec edx
je 0x405765
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edi, dword [eax + ebp*4]
cmp edi, 0xffffffff
je 0x40576a
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x405860
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c790
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405860
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c7b0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405860
mov eax, dword [ecx + 0x10]
push dword [eax + edi*4]
call fcn.00404770
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + edi*4], ecx
mov edi, ecx
jmp 0x40581b
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406980
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x406b26
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406b1f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x406a10
add ebp, dword [esp + 0x10]
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x406b1f
mov dword [esp], esi
xor edx, edx
cmp ebx, 8
jb 0x406a7a
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [ebp]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebp + 7]
add edi, edx
add ecx, edi
mov esi, eax
and esi, 8
xor eax, 8
lea edx, [eax + esi*2]
add ebp, 8
lea esi, [eax + esi*2]
add esi, 7
mov eax, edx
cmp esi, ebx
jb 0x406a20
mov eax, edx
sub eax, ebx
mov dword [esp + 4], ebx
jae 0x4069d4
sub ebx, edx
mov dword [esp + 0x10], ebx
and ebx, 3
mov dword [esp + 8], ebx
je 0x406ad0
mov dword [esp + 0xc], eax
neg dword [esp + 8]
xor esi, esi
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec esi
cmp dword [esp + 8], esi
jne 0x406ab0
sub edx, esi
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffffc
ja 0x4069d0
jmp 0x406adb
mov ebx, ebp
cmp eax, 0xfffffffc
ja 0x4069d0
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x406af0
jmp 0x4069d0
shl ecx, 0x10
or ecx, edi
jmp 0x406b2b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410fa0
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44b688]
Function at 0x41afe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x41b000
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41b020
sar ebp, 1
sar eax, 1
lea ecx, [eax + ebp]
add ecx, 2
test ecx, ecx
jns 0x41b040
mov eax, 0xffffffff
jmp 0x41b049
add eax, ebp
lea eax, [eax*2 + 4]
push eax
call fcn.0040c630
add esp, 4
movzx ecx, word [esi]
mov edi, eax
test cx, cx
je 0x41b081
add esi, 2
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x41b070
mov word [edi], 0x5c
add edi, 2
mov edx, dword [esp + 0x38]
movzx ecx, word [edx]
test cx, cx
je 0x41b0b1
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b0a0
mov word [edi], 0
lea ecx, [esp + 0x10]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x24], eax
push eax
call fcn.00444c60
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44bd3c]

Function at 0x41e0b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x94
mov ecx, dword [ebp + 0x10]
push eax
sub esp, 0x30
mov dword [ebp - 0x98], esp
sub esp, 0x14
mov dword [ebp - 0x90], esp
sub esp, 0x24
mov dword [ebp - 0x8c], esp
sub esp, 0x20
mov dword [ebp - 0x88], esp
sub esp, 0x44
mov dword [ebp - 0x94], esp
sub esp, 0x34
mov dword [ebp - 0x4c], esp
sub esp, 0x1c
mov dword [ebp - 0x40], esp
sub esp, 8
mov dword [ebp - 0x84], esp
xor eax, eax
test ecx, ecx
setne al
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x30], 0
jmp dword [eax*4 + 0x44c148]
Function at 0x421600
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x421620
cmp eax, 0xffffffdd
jge 0x421637
mov eax, 0xffffffff
jmp 0x42163a
add eax, 0x22
push eax
call fcn.0040c630
add esp, 4
mov esi, eax
mov dword [esp + 8], 0xd7a9c9ac
mov dword [esp + 0xc], 0xd3a1d5a8
mov dword [esp + 0x10], 0xdfbfd1ae
mov dword [esp + 0x14], 0xdbb7ddb7
mov dword [esp + 0x18], 0xe78ad9bc
mov dword [esp + 0x1c], 0xe388e589
mov dword [esp + 0x20], 0xef93e181
mov dword [esp + 0x24], 0xeb96ed98
mov dword [esp + 0x28], 0xe9e8
mov byte [esp + 0x2c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x24
ja 0x4216e9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xf81aea4e
and eax, 0xf81aea4e
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
add al, 0x7a
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x25
jb 0x4216b0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x421711
add ecx, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x421700
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x421741
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x421730
mov word [eax], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov dword [esp + 8], 0x118f1f83
mov dword [esp + 0xc], 0x154d139a
mov dword [esp + 0x10], 0x99e1773
mov dword [esp + 0x14], 0xd6d0b9c
mov dword [esp + 0x18], 0x19b0f92
mov dword [esp + 0x1c], 0x593039b
mov dword [esp + 0x20], 0x395b079a
mov dword [esp + 0x24], 0x3d673b65
mov dword [esp + 0x28], 0x31503f66
mov dword [esp + 0x2c], 0x35a733a7
mov dword [esp + 0x30], 0x29a43753
mov dword [esp + 0x34], 0x2dbb2b6d
mov dword [esp + 0x38], 0x21ba2fb2
mov dword [esp + 0x3c], 0x25aa2347
mov dword [esp + 0x40], 0x595d27b0
mov dword [esp + 0x44], 0x5d155b3c
mov dword [esp + 0x48], 0x515e5f06
mov word [esp + 0x4c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x45
ja 0x421841
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xf62d4e05
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xe7
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x46
jb 0x421810
lea eax, [esp + 0x50]
lea ecx, [esp + 8]
push eax
push 0x421b00
push ecx
push esi
call fcn.004222a0
add esp, 0x10
jmp dword [0x44c394]
Function at 0x421990
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4219a0
cmp eax, 0xffffffed
jge 0x4219b7
mov eax, 0xffffffff
jmp 0x4219ba
add eax, 0x12
push eax
call fcn.0040c630
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x43e941fc
mov dword [esp + 8], 0x47df45e1
mov dword [esp + 0xc], 0x4b24491c
mov dword [esp + 0x10], 0x4fec4de8
mov word [esp + 0x14], 0xb1b0
mov dword [esp + 0x16], 0
mov word [esp + 0x1a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x17
ja 0x421a53
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x2ff2f7f0
mov ebx, eax
xor ebx, 0x500d080f
or eax, 0x2ff2f7f0
and eax, ebx
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0x50
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x18
jb 0x421a10
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x421a81
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x421a70
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x421ab1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x421aa0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00444e20
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x44c39c]

Function at 0x4220d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebp, dword [esp + 0x64]
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x6c]
movzx ecx, byte [esp + 0x68]
mov dword [esp + 0x30], ebp
mov byte [esp + 0x34], cl
mov dword [esp + 0x38], eax
test ebp, ebp
setg al
and al, cl
movzx eax, al
jmp dword [eax*4 + 0x44c4d8]
Function at 0x4283f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x850
mov dword [esp + 8], 0
xor edi, edi
mov eax, 0x20219
mov ecx, 1
xor ebp, ebp
jmp dword [ecx*4 + 0x44d1ec]
Function at 0x42c210
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov eax, dword [0x451450]
mov dword [esp + 0x30], 0x69ad6b8f
mov dword [esp + 0x34], 0x6dfe6ff8
mov dword [esp + 0x38], 0x51f553a8
mov dword [esp + 0x3c], 0x55f157c4
mov dword [esp + 0x40], 0x59e65bbf
mov dword [esp + 0x44], 0x5dcf5fea
mov dword [esp + 0x48], 0x41e943c8
mov dword [esp + 0x4c], 0x45e147d0
mov dword [esp + 0x50], 0x49a74be0
mov dword [esp + 0x54], 0x4df24fa5
mov dword [esp + 0x58], 0x319933d9
mov dword [esp + 0x5c], 0x35a337a5
mov dword [esp + 0x60], 0x39ab3b9b
mov dword [esp + 0x64], 0x3dec3faa
mov dword [esp + 0x68], 0x21b123a4
mov dword [esp + 0x6c], 0x2526278c
mov byte [esp + 0x70], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x40
ja 0x42c305
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x30]
mov esi, ecx
xor esi, 0x65c5a17
and ecx, 0x65c5a17
lea ecx, [esi + ecx*2]
lea esi, [ecx + edx]
not edx
or ecx, edx
sub edx, ecx
lea ecx, [esi + edx*2]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x8d
mov edx, dword [esp]
mov byte [esp + edx + 0x30], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x41
jb 0x42c2c0
lea esi, [esp + 0x88]
lea ecx, [esp + 0x30]
push esi
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov edi, dword [esp + 0x88]
test edi, edi
jns 0x42c32e
mov eax, 0xffffffff
jmp 0x42c331
lea eax, [edi + edi]
push eax
call fcn.0040c630
add esp, 4
mov dword [esp + 0x7c], eax
mov eax, dword [0x451450]
mov dword [esp + 0x30], 0x39f53bd7
mov dword [esp + 0x34], 0x25b627a8
mov dword [esp + 0x38], 0x218d23e8
mov dword [esp + 0x3c], 0x2d812fbc
mov dword [esp + 0x40], 0x298e2bc7
mov dword [esp + 0x44], 0x1587179a
mov dword [esp + 0x48], 0x11b91388
mov dword [esp + 0x4c], 0x1db11f80
mov dword [esp + 0x50], 0x19cf1bb0
mov dword [esp + 0x54], 0x5a207cd
mov dword [esp + 0x58], 0x1a90399
mov dword [esp + 0x5c], 0xd930f9d
mov dword [esp + 0x60], 0x99b0b9b
mov dword [esp + 0x64], 0xf524f79a
mov dword [esp + 0x68], 0xf161f36c
mov dword [esp + 0x6c], 0xfdfeff64
mov byte [esp + 0x70], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x40
ja 0x42c42b
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x30]
mov ebx, edx
xor ebx, 0xade4e7cb
add edx, edx
and edx, 0x5bc9cf96
mov ebp, edx
and ebp, ebx
xor edx, ebx
lea edx, [edx + ebp*2]
mov ebx, edx
and ebx, ecx
add edx, ecx
add ebx, ebx
sub edx, ebx
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
add cl, 9
mov edx, dword [esp]
mov byte [esp + edx + 0x30], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x41
jb 0x42c3e0
push esi
push edi
mov esi, dword [esp + 0x84]
push esi
push 0x1f
lea edi, [esp + 0x40]
push edi
push 0
call eax
lea eax, [esp + 0x1c]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00444c60
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d624]
Function at 0x434cd0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x434cff
jmp 0x434e40
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
jmp 0x434d2d
xor ebx, ebx
cmp edi, 0
je 0x434e3a
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.0040c790
add esp, 4
mov edx, eax
jmp 0x434d59
cmp edx, 0
setne al
jmp 0x434d61
xor ebx, ebx
test al, 1
jne 0x434d6c
jmp 0x434e2c
jmp 0x434d6e
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0xc7
mov byte [ebp - 0x27], 0x9d
mov byte [ebp - 0x26], 0x5f
mov byte [ebp - 0x25], 0x67
mov byte [ebp - 0x24], 0x5a
mov byte [ebp - 0x23], 0x66
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x6d
mov byte [ebp - 0x20], 0x5c
mov byte [ebp - 0x1f], 0x23
mov byte [ebp - 0x1e], 0x62
mov byte [ebp - 0x1d], 0x67
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0xfd
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x11
jne 0x434db0
jmp 0x434dbf
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x11
jae 0x434dff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.00437b90
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x434dc6
jmp 0x434e01
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d200
mov bl, al
jmp 0x434e21
and bl, 1
jmp 0x434e26
jmp 0x434e28
jmp 0x434e2a
jmp 0x434e2c
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x434e3a
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x43a660
mov dword [esp + 4], 0x2060499
mov word [esp + 8], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 5
ja 0x43a6e0
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
mov ebx, esi
xor ebx, 0x8534ce01
and esi, 0x534ce01
lea ebx, [ebx + esi*2]
mov esi, ebx
and esi, edi
xor ebx, edi
sub ebx, esi
lea edi, [ebx + esi*2]
mov ebx, edi
not ebx
and ebx, esi
not esi
and esi, edi
sub esi, ebx
mov dword [esp + 0x10], esi
mov ebx, dword [esp + 0x10]
add bl, 0xfb
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 6
jb 0x43a690
test edx, edx
je 0x43a74e
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x43a716
mov dword [esp + 0xc], edi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx]
xor eax, edi
imul eax, esi
add ecx, 2
inc ebp
cmp ebx, ebp
jne 0x43a700
sub edx, ebp
mov edi, dword [esp + 0xc]
cmp edi, 3
jb 0x43a74e
xor edi, edi
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x43a720
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ecb0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0xd7d6c9f8
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x43ed1b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0xba27454e
and ecx, 0x3a27454e
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x7a
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x43ece0
mov ecx, dword [esp + 4]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x459470]
add esp, 0x10
pop esi
ret
Function at 0x43ee10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x303f3e86
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43ee86
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x810b4ff5
and eax, 0x10b4ff5
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, eax
not ecx
and ecx, 0xc9
and eax, 0x36
sub eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43ee40
mov edi, dword [esp + 4]
mov eax, dword [0x451454]
test eax, eax
je 0x43eed6
xor ecx, ecx
mov edx, dword [0x451458]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43eeb0
inc ecx
cmp eax, ecx
jne 0x43eea0
jmp 0x43eed6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43eed6
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x45145c]
push eax
call fcn.00441840
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43f030
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.0043ecb0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x303f3e86
mov dword [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 7
ja 0x43ef67
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x810b4ff5
and edx, 0x10b4ff5
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov esi, edx
not esi
and esi, 0xc9
and edx, 0x36
sub edx, esi
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 8
jb 0x43ef20
mov edi, dword [esp + 4]
mov edx, dword [0x451454]
test edx, edx
je 0x43efb6
xor ebx, ebx
mov ebp, dword [0x451458]
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43ef91
inc ebx
cmp edx, ebx
jne 0x43ef80
jmp 0x43efb6
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43efb6
push 0
push ecx
push eax
push 5
push 4
push dword [0x45145c]
push edx
mov esi, eax
call fcn.00441840
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43f027
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [edx + esi + 0x3c]
add edx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ebx + ebp]
movzx esi, word [ecx + ebp]
test edi, edi
je 0x43eff4
add ebp, 2
cmp di, si
je 0x43efe0
movzx esi, si
mov ebx, esi
not ebx
and ebx, edi
not edi
and edi, esi
cmp ebx, edi
je 0x43f012
mov esi, dword [edx]
test esi, esi
jne 0x43efd0
mov edi, 0xc0000225
jmp 0x43f027
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043ed40
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4