joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push 0x2e
push edi
call fcn.004093d0
add esp, 8
test eax, eax
je 0x402c86
mov ebx, eax
jmp 0x402c64
mov edi, ebx
inc edi
push 0x2e
push edi
call fcn.004093d0
add esp, 8
mov ebx, eax
test eax, eax
je 0x402c86
mov eax, ebx
sub eax, edi
mov ecx, esi
mov edx, edi
push eax
call fcn.00402650
add esp, 4
xor esi, esi
test eax, eax
je 0x402c50
cmp dword [eax + 4], 4
jne 0x402c50
mov esi, dword [eax + 8]
jmp 0x402c50
xor eax, eax
test esi, esi
je 0x402ce6
test edi, edi
je 0x402ce6
push edi
call fcn.00409360
add esp, 4
test eax, eax
je 0x402cca
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + ebp]
test edx, edx
je 0x402cd1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc ebp
mov ecx, ebx
cmp eax, ebp
jne 0x402cb0
jmp 0x402cd3
mov ebx, 0x1505
jmp 0x402cd3
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [esi + 0x20]
lea ebp, [ecx - 1]
mov edx, ecx
sub edx, 1
jae 0x402cee
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov dword [esp], esi
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 4], edx
jmp 0x402d04
inc ebp
dec ecx
je 0x402ce4
mov eax, ebp
and eax, edx
mov esi, dword [esp + 0x14]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
je 0x402ce4
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + esi*4], ebx
jne 0x402d00
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 0x10], ecx
call fcn.00409360
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
add esp, 4
cmp eax, dword [esp + 8]
jne 0x402d00
push dword [esp + 8]
push dword [esp + 0x14]
push edi
call fcn.00409380
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x402d00
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + esi*4]
jmp 0x402ce6
Function at 0x402f70
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403094
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x403049
cmp ecx, 5
je 0x40304e
cmp ecx, 4
jne 0x403094
mov esi, dword [eax + 8]
cmp dword [esi + 0x18], 0
je 0x402fd3
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0xc]
push dword [eax + edi*4]
call dword [0x43fbe0]
add esp, 4
mov eax, dword [esi + 0x10]
push dword [eax + edi*4]
call fcn.00402f70
add esp, 4
inc edi
cmp edi, dword [esi + 0x18]
jb 0x402fb0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push dword [esi + 4]
call dword [0x43fbe0]
add esp, 4
push dword [esi + 0xc]
call dword [0x43fbe0]
add esp, 4
push dword [esi + 0x10]
call dword [0x43fbe0]
add esp, 4
push dword [esi + 0x14]
call dword [0x43fbe0]
add esp, 4
push dword [esi + 8]
call dword [0x43fbe0]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
jmp 0x40308a
push dword [eax + 8]
jmp 0x40308b
mov esi, dword [eax + 8]
cmp dword [esi + 8], 0
je 0x40307e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 4]
push dword [eax + edi*4]
call fcn.00402f70
add esp, 4
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esi + 8]
jb 0x403060
push dword [esi + 4]
call dword [0x43fbe0]
add esp, 4
push esi
call dword [0x43fbe0]
add esp, 4
pop esi
pop edi
jmp dword [0x43fbe0]
Function at 0x4030a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x4031a8
mov esi, edx
test edx, edx
je 0x4031a8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x4031a8
push esi
call fcn.00409360
add esp, 4
test eax, eax
je 0x4030fa
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x403101
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x4030e0
jmp 0x403103
mov ebp, 0x1505
jmp 0x403103
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x4031b0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40316a
call fcn.004032a0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x4031a8
push ecx
call fcn.00409360
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x40321f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x4031c8
inc ebx
dec esi
je 0x40311f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x403124
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x4031c0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00409360
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4031c0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00409380
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4031c0
mov eax, 0xffffffff
jmp 0x4031a8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x403238
inc ebx
dec esi
je 0x403165
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40316a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x403230
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00409360
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403230
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00409380
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x403230
jmp 0x40316a
Function at 0x403960
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403b26
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x403b1f
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x4039fb
add ebp, dword [esp + 0x10]
mov ebx, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul esi, edx, 0xfff1
mov eax, ecx
mov edx, 0x80078071
mul edx
sub edi, esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov eax, ebx
not eax
mov edx, dword [esp + 4]
and eax, edx
not edx
and ebx, edx
mov esi, 0x15b0
sub ebx, eax
je 0x403b1f
xor eax, eax
cmp esi, 8
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
jb 0x403a7c
mov eax, esi
and eax, 0x1ff8
mov dword [esp], eax
mov edx, 7
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 3]
add esi, eax
add ecx, esi
movzx edi, byte [ebp + 4]
add edi, esi
mov eax, ecx
and eax, edi
xor ecx, edi
movzx esi, byte [ebp + 5]
add esi, edi
movzx ebx, byte [ebp + 6]
add ebx, esi
add esi, ecx
lea ecx, [esi + eax*2]
mov esi, dword [esp + 4]
movzx edi, byte [ebp + 7]
add edi, ebx
add ecx, ebx
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, esi
jb 0x403a20
mov ebx, dword [esp + 8]
mov eax, dword [esp]
mov edx, esi
sub edx, eax
jbe 0x4039b8
mov dword [esp + 0x10], edx
mov dword [esp], eax
not eax
add eax, esi
mov edx, esi
and edx, 3
je 0x403ad1
mov dword [esp + 0xc], eax
neg edx
xor eax, eax
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx]
add edi, esi
add ecx, edi
inc ebx
dec eax
cmp edx, eax
jne 0x403ab0
mov edx, dword [esp]
sub edx, eax
mov eax, dword [esp + 0xc]
cmp eax, 3
jb 0x4039b0
jmp 0x403adf
mov ebx, ebp
mov edx, dword [esp]
cmp eax, 3
jb 0x4039b0
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403af0
jmp 0x4039b0
shl ecx, 0x10
or ecx, edi
jmp 0x403b2b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403ba3
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x403ba5
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
not ebx
or ebx, 0xf
add ebx, eax
inc ebx
shr eax, 4
mov ebp, edi
and ebp, 0xf
xor ebp, ebx
xor eax, dword [ebp*4 + 0x43ca18]
mov ebx, eax
not ebx
shr eax, 4
or ebx, 0x3ffffff0
shr edi, 4
xor edi, ebx
not edi
xor eax, dword [edi*4 + 0x43ca18]
inc esi
cmp edx, esi
jne 0x403b60
not eax
jmp 0x403ba5
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4091b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x40920d
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x40920d
test ebx, ebx
je 0x4092ad
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov esi, ebx
and esi, 7
je 0x409253
neg esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
dec edi
cmp esi, edi
jne 0x4091f0
lea esi, [ebx + edi]
add ecx, edi
add edx, edi
cmp ebx, 8
jae 0x40925a
jmp 0x4092ad
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
xor ecx, 3
mov edx, ebx
or edx, 0xfffffffc
and edx, ecx
add edx, eax
mov ebp, ebx
and ebp, 0xfffffffc
add ebp, esi
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, ebp
mov edi, edx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
test bl, 1
je 0x4092ad
and ebx, 2
movzx eax, byte [ebp + ebx]
mov byte [edx + ebx], al
jmp 0x4092ad
mov esi, ebx
cmp ebx, 8
jb 0x4092ad
neg esi
xor edi, edi
nop
nop
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
movzx eax, byte [ecx + edi - 1]
mov byte [edx + edi - 1], al
movzx eax, byte [ecx + edi - 2]
mov byte [edx + edi - 2], al
movzx eax, byte [ecx + edi - 3]
mov byte [edx + edi - 3], al
movzx eax, byte [ecx + edi - 4]
mov byte [edx + edi - 4], al
movzx eax, byte [ecx + edi - 5]
mov byte [edx + edi - 5], al
movzx eax, byte [ecx + edi - 6]
mov byte [edx + edi - 6], al
movzx eax, byte [ecx + edi - 7]
mov byte [edx + edi - 7], al
add edi, 0xfffffff8
cmp esi, edi
jne 0x409260
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409780
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409820
sub esp, 0x100
mov esi, esp
call fcn.004374a0
test al, 1
jne 0x40979c
jmp 0x4097df
call fcn.00431d60
test al, 1
jne 0x4097a7
jmp 0x4097d8
call fcn.0040a850
test al, 1
jne 0x4097b2
jmp 0x4097d6
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409800
add esp, 8
call fcn.0040ee70
call fcn.0040b7a0
jmp 0x4097d6
jmp 0x4097d8
call fcn.00437a80
jmp 0x4097df
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x4099aa
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x4098bd
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4098e1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x4098b0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x4098b0
lea esi, [ebx + 1]
push esi
call fcn.00409130
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x4099b8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409928
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x4099ba
movzx edx, word [edi]
test dx, dx
je 0x4099ba
cmp dx, 0x7f
jbe 0x409910
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x409970
cmp esi, 0x7ff
ja 0x409970
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409917
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x409917
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409917
push 1
call fcn.00409130
add esp, 4
mov ebp, eax
jmp 0x4099ba
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4099d7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x4099d2
test eax, eax
jne 0x4099d0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405da0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x416c60
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, esp
push eax
mov ecx, esp
push eax
mov dword [esi + 0x14], esp
push eax
mov edi, esp
push eax
mov dword [esi + 0x40], esp
push eax
mov dword [esi + 0x28], esp
push eax
mov dword [esi + 0x4c], esp
push eax
mov dword [esi + 0x48], esp
sub esp, 0x38
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x44], edx
mov esp, edx
push eax
sub esp, 0x1c
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x20], edx
mov esp, edx
push eax
sub esp, 0x14
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x64], edx
mov esp, edx
push eax
sub esp, 0x1c
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x50], edx
mov esp, edx
push eax
sub esp, 0x34
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x68], edx
mov esp, edx
push eax
sub esp, 0x1c
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
sub esp, 0x1c
mov dword [esi + 0x30], esp
sub esp, 0x28
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x6c], edx
mov esp, edx
push eax
mov dword [esi + 0x38], esp
push eax
mov dword [esi + 0x80], esp
sub esp, 0x48
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x78], edx
mov esp, edx
push eax
sub esp, 0x2c
mov dword [esi + 0x7c], esp
sub esp, 0x38
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x60], edx
mov esp, edx
push eax
mov dword [esi + 0x5c], esp
mov dword [esi + 0x18], edi
mov dword [esi + 0xc], ecx
sub esp, 0x18
mov dword [esi + 0x34], esp
sub esp, 0x20
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x3c], edx
mov esp, edx
push eax
mov dword [esi + 0x58], esp
sub esp, 0x10
mov edx, esp
and edx, 0xfffffff8
mov dword [esi + 0x2c], edx
mov esp, edx
mov edx, dword [ebp + 0xc]
mov dword [ecx], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x14]
mov dword [eax], edx
mov byte [edi], 0
mov eax, dword [esi + 0x40]
mov byte [eax], 0
xor eax, eax
mov edx, dword [ebp + 0x10]
test edx, edx
setne al
jmp dword [eax*4 + 0x441ebc]
Function at 0x41aa10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0x83358122
mov dword [esp + 0xc], 0x9f179d3d
mov dword [esp + 0x10], 0x9b6e9952
mov dword [esp + 0x14], 0x97369526
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x9196
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1a
ja 0x41aad0
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
mov esi, ecx
and esi, 0xecde89eb
xor ecx, 0xecde89eb
lea ecx, [ecx + esi*2]
lea esi, [ecx + edx]
and ecx, edx
add ecx, ecx
mov edx, esi
not edx
and edx, ecx
not ecx
and ecx, esi
sub ecx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov edx, ecx
or edx, 0x92
and ecx, 0x92
add ecx, edx
inc cl
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1b
jb 0x41aa70
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41ab00
mov edi, esi
cmp eax, 0xffffffed
jge 0x41ab19
mov eax, 0xffffffff
jmp 0x41ab1c
add eax, 0x12
push eax
call fcn.00409130
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41ab51
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41ab40
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41ab81
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ab70
mov word [eax], 0
push edi
push esi
call fcn.0043a9a0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442200]
Function at 0x42ead0
Capabilities:
Encode data using xor
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov edi, dword [ebp + 8]
push eax
mov dword [esi + 8], esp
push eax
mov eax, esp
sub esp, 0x18
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
mov dword [esi + 0x20], eax
call fcn.00409820
push eax
mov dword [esi + 0x1c], esp
jmp 0x42eb00
jmp 0x42eb02
jmp 0x42eb04
mov dword [esi + 0x24], edi
jmp 0x42eb09
jmp 0x42eb0b
mov byte [esi + 3], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
je 0x42eca8
jmp 0x42eb2c
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esi + 0x2c], eax
jmp 0x42eb4b
jmp 0x42eb4d
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esi + 0xc], eax
cmp dword [esi + 0xc], 0
setne al
test al, 1
jne 0x42eb70
jmp 0x42ec9c
mov eax, dword [esi + 0xc]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 8]
mov dword [ecx], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
jmp 0x42eb8b
sub esp, 4
mov dword [esp], eax
call fcn.00409360
add esp, 4
mov ecx, dword [esi + 0x20]
jmp 0x42eb9e
mov dword [ecx], eax
cmp dword [ecx], 0
setne al
test al, 1
jne 0x42ebaf
jmp 0x42ec8b
mov eax, dword [esi + 0x24]
mov dword [esi + 0x14], eax
mov eax, dword [ecx]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 8]
mov edi, dword [eax]
call fcn.00409820
mov eax, dword [esi + 0x1c]
mov al, byte [eax]
mov byte [esi + 0x10], al
mov byte [ebx], 0x1b
mov byte [ebx + 1], 0x2d
mov byte [ebx + 2], 0x33
mov byte [ebx + 3], 0x2b
mov byte [ebx + 4], 6
mov byte [ebx + 5], 0x12
mov byte [ebx + 6], 7
mov byte [ebx + 7], 0x15
mov byte [ebx + 8], 0xc
mov byte [ebx + 9], 0xd7
mov byte [ebx + 0xa], 0x1e
mov byte [ebx + 0xb], 0x1b
mov byte [ebx + 0xc], 0x10
mov byte [ebx + 0xd], 0xed
mov byte [ebx + 0x10], 0
mov word [ebx + 0xe], 0
mov dword [esi + 4], 0
mov eax, dword [esi + 4]
cmp eax, 0x11
jae 0x42ec67
jmp 0x42ec1e
mov eax, dword [esi + 4]
mov ecx, dword [esi + 4]
movzx ecx, byte [ebx + ecx]
mov edx, eax
and edx, 0xb9ec39c
xor eax, 0xb9ec39c
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x28]
mov ecx, eax
xor ecx, 0xbb
and eax, 0x3b
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esi + 4]
mov byte [ebx + ecx], al
mov eax, dword [esi + 4]
inc eax
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, 0x11
jb 0x42ec1e
jmp 0x42ec67
jmp 0x42ec69
sub esp, 0xc
mov ecx, dword [esi + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], edi
mov eax, dword [esi + 0x18]
mov dword [esp + 8], eax
call fcn.00409a30
jmp 0x42ec84
jmp 0x42ec86
and al, 1
mov byte [esi + 3], al
mov eax, dword [esi + 0xc]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42ec9c
jmp 0x42ec9e
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42eca6
jmp 0x42eca8
mov al, byte [esi + 3]
jmp 0x42ecad
jmp 0x42ecaf
jmp 0x42ecb1
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4339e0
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x433a9d
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x433a40
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.004346b0
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x433a30
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x433ba9
and ebp, 1
xor edi, edi
cmp dword [esp], 1
mov dword [esp + 0x18], ebp
je 0x433b83
sub dword [esp], ebp
xor edi, edi
nop
movzx esi, byte [eax]
mov ecx, edi
or ecx, 1
mov ebp, edi
not ebp
or ebp, 3
add ecx, ebp
shl ecx, 3
shl esi, cl
mov edx, edi
and edx, 0xfffffffc
xor esi, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], esi
movzx ebx, byte [eax + 1]
add eax, 2
lea ecx, [edi + ebp]
add ecx, 2
shl ecx, 3
shl ebx, cl
add edi, 2
xor ebx, esi
mov dword [esp + edx + 0x1c], ebx
cmp edi, dword [esp]
jne 0x433b40
cmp dword [esp + 0x18], 0
mov ebp, dword [esp + 0x74]
je 0x433ba9
movzx eax, byte [eax]
mov ecx, edi
not ecx
or ecx, 3
add ecx, edi
shl ecx, 3
add cl, 8
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp