joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x421e2a
cmp edi, 1
je 0x421e2a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x421e01
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x421e00
cmp ecx, 0x20
je 0x421e00
cmp ecx, 0x2b
mov edx, edi
je 0x421e20
cmp ecx, 0x2d
jne 0x421e3f
cmp al, 0x2b
sete byte [esp + 3]
inc ebx
jmp 0x421e44
xor edi, edi
test eax, eax
je 0x421ffd
mov dword [eax], 0x16
jmp 0x421ffd
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x421e6d
cmp edx, 0x10
jne 0x421e85
cmp byte [ebx], 0x30
jne 0x421e66
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x421e87
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x421e87
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x421ee0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x421f98
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x421f07
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x421fc8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x421fc8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x421ec0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x421f50
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x421f59
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x421f7d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x421fad
test bl, bl
jne 0x421fad
mov ebx, dword [esp + 0x10]
jmp 0x421ed3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x421eb5
mov esi, edi
test bl, bl
jne 0x421fbb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x421eb5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x421fd6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x421fe4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x421ff4
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x421ffd
cmp byte [esp + 3], 0
jne 0x421ffd
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42b480
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42b5d7
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x42b5cf
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.004098f0
mov ebp, eax
cmp ebp, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42b504
jmp 0x42b5c1
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0xc1
mov byte [esp + 0x19], 0x67
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x5e
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x59
mov byte [esp + 0x1f], 0x6b
mov byte [esp + 0x20], 0x58
mov byte [esp + 0x21], 0x21
mov byte [esp + 0x22], 0x66
mov byte [esp + 0x23], 0x79
mov byte [esp + 0x24], 0x64
mov byte [esp + 0x25], 0xf7
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x13
jne 0x42b557
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x13
jae 0x42b5a1
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0042b940
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x42b56c
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040a0b0
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42b5cf
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42b5d7
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42ff90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x42ffb0
mov dword [esp + 4], 0x767a74c1
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 6
ja 0x430010
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
add esi, 0x396f41eb
xor esi, edi
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0xc]
add bl, 0x69
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 7
jb 0x42ffe0
test edx, edx
je 0x43007e
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x430041
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x430030
cmp edi, 3
jb 0x43007e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x430050
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433ff0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x441c2c]

Function at 0x434080
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xe0e7e6e5
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x4340de
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x887a7729
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x33
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x4340b0
mov edi, dword [esp + 4]
mov eax, dword [0x443f58]
test eax, eax
je 0x434136
xor ecx, ecx
mov edx, dword [0x443f5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x434110
inc ecx
cmp eax, ecx
jne 0x434100
jmp 0x434136
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x434136
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x443f60]
push eax
call fcn.00436440
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x434265
mov dword [esp + 0x10], esi
push dword [esp + 8]
call fcn.00433ee0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 4], 0xe0e7e6e5
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x4341a0
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x887a7729
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0x33
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x434170
mov edi, dword [esp + 4]
mov edx, dword [0x443f58]
test edx, edx
je 0x4341f6
xor ebx, ebx
mov ebp, dword [0x443f5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x4341d1
inc ebx
cmp edx, ebx
jne 0x4341c0
jmp 0x4341f6
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x4341f6
push 0
push ecx
push eax
push 5
push 4
push dword [0x443f60]
push edx
mov esi, eax
call fcn.00436440
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43425c
mov ecx, dword [esp + 0x28]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x434235
add ebx, 2
cmp bp, si
je 0x434220
cmp bp, si
je 0x434247
mov ebx, dword [edx]
test ebx, ebx
jne 0x434210
mov edi, 0xc0000225
jmp 0x43425c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 8], ecx
xor edi, edi
push eax
call fcn.00433ff0
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4342a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, dword [ecx + 4]
test edx, edx
je 0x434370
xor eax, eax
cmp dword [ecx], 0
jne 0x4343c2
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xe0e7e6e5
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x434341
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
add eax, 0x887a7729
xor eax, edx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x33
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x434310
mov eax, dword [esp + 8]
mov esi, dword [0x443f58]
test esi, esi
je 0x4343c2
mov edx, dword [esp + 0x3c]
xor edi, edi
mov ebx, dword [0x443f5c]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x4343cb
inc edi
cmp esi, edi
jne 0x434360
jmp 0x4343c2
mov dword [esp + 0x14], 0xd91a1b14
mov word [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x4343be
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0x12b181bb
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x59
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x434390
mov eax, dword [esp + 0x14]
add esp, 0x2c
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4343c2
lea eax, [esp + 0xc]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x443f60]
push esi
call fcn.00436440
add esp, 0x1c
jmp 0x4343c2

Function at 0x434400
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x4344c1
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0xe0e7e6e5
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x434460
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x887a7729
xor edx, esi
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add dl, 0x33
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x434430
mov edx, dword [0x443f58]
test edx, edx
je 0x4344ae
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x443f5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x434490
inc edi
cmp edx, edi
jne 0x434480
jmp 0x4344ae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4344ae
push eax
push 1
push dword [0x443f60]
push edx
mov esi, ecx
call fcn.00436440
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
add esp, 0xc
pop esi
pop edi
pop ebx
ret
Function at 0x4344d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 4], 0
je 0x434576
mov edx, dword [ecx]
test edx, edx
je 0x434576
mov dword [esp], 0xe0e7e6e5
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x434541
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov esi, dword [esp + 4]
movzx esi, byte [esp + esi]
add eax, 0x887a7729
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x33
mov esi, dword [esp + 4]
mov byte [esp + esi], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x434510
mov edi, dword [ebp + 0x10]
mov eax, dword [esp]
mov ebx, dword [0x443f58]
test ebx, ebx
je 0x434606
xor edi, edi
mov esi, dword [0x443f5c]
nop
nop
nop
cmp dword [esi + edi*8], 0xc766965c
je 0x4345e2
inc edi
cmp ebx, edi
jne 0x434560
mov edi, dword [ebp + 0x10]
jmp 0x434606
mov dword [esp + 8], 0x17d6c9c0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x4345d9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xe835b5ce
xor eax, 0x6835b5ce
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xfa
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x4345a0
mov eax, dword [esp + 8]
jmp 0x4346f2
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x434606
push dword [ebp + 8]
push edx
push 2
push dword [0x443f60]
push esi
mov esi, ecx
call fcn.00436440
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x4346e5
cmp eax, 0xc000010a
jne 0x4346e5
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov edx, dword [ecx]
mov dword [esp + 0x10], 0xe0e7e6e5
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43468e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 0x10]
add eax, 0x887a7729
xor eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x33
mov esi, dword [esp]
mov byte [esp + esi + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x434660
mov eax, dword [esp + 0x10]
mov esi, dword [0x443f58]
test esi, esi
je 0x4346e5
xor edi, edi
mov ebx, dword [0x443f5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e28bda7
je 0x4346c0
inc edi
cmp esi, edi
jne 0x4346b0
jmp 0x4346e5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4346e5
lea eax, [esp + 8]
push eax
push 0
push edx
push 3
push dword [0x443f60]
push esi
mov esi, ecx
call fcn.00436440
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x4346f2
mov esi, eax
call fcn.00434400
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x434700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x30]
test edx, edx
jne 0x434713
lea edx, [esp + 0xc]
mov ecx, dword [ecx]
mov dword [esp + 4], 0xe0e7e6e5
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43475e
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add eax, 0x887a7729
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x33
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x434730
mov eax, dword [esp + 4]
mov ebp, dword [0x443f58]
test ebp, ebp
je 0x4347b4
mov ebx, dword [esp + 0x2c]
xor esi, esi
mov edi, dword [0x443f5c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x3baba5e0
je 0x434790
inc esi
cmp ebp, esi
jne 0x434780
jmp 0x4347b4
mov ebp, dword [edi + esi*8 + 4]
cmp ebp, eax
je 0x4347b4
push edx
push ebx
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
push 5
push dword [0x443f60]
push ebp
call fcn.00436440
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x436380
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44201c]

Function at 0x436480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x250
push dword [0x44bf70]
call fcn.00436f20
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x44221c]
Function at 0x437960
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0x939291a0
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x4379be
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add eax, 0x576a11dc
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xb4
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x437990
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x4427d8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x4427e0]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x4427e0]
jmp dword [0x4427f4]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x4427f8]

Function at 0x437b70
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
movzx eax, word [edi]
mov dword [esp + 8], 0x97963f2d
mov word [esp + 0xc], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x437bdd
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + edx]
add esi, 0xdc11a2a6
add ecx, 0xdc11a2a6
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
add cl, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x437ba0
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x442858]
mov edx, dword [edi + 0x3c]
mov ecx, dword [edi + edx]
mov dword [esp + 8], 0x93924c40
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 4
ja 0x437c50
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 8]
add esi, 0x41836bdc
xor esi, edi
mov dword [esp + 4], esi
mov ebx, dword [esp + 4]
add bl, 0xb4
mov esi, dword [esp]
mov byte [esp + esi + 8], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 5
jb 0x437c20
xor ebx, ebx
cmp ecx, dword [esp + 8]
setne bl
mov esi, dword [esp + 0x44]
jmp dword [ebx*4 + 0x442860]
mov ebx, dword [esi + edx + 0x78]
mov edi, dword [esi + edx + 0x7c]
test edi, edi
sete cl
mov edx, ebx
mov dword [esp + 0x10], ebx
test ebx, ebx
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x442868]
jmp dword [0x442878]
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001670
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 0xffffffff
je 0x1000177b
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10001774
inc edi
cmp dword [ebp - 0x20], 0x10
jb 0x10001738
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10001738
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10001738
mov edx, dword [esi]
test edx, edx
jne 0x10001701
push 0x200
push edx
push dword [0x10017540]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1000175d
lea ebx, [esi + 8]
jmp 0x1000172b
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x1000172b
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x10017540]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1000178c
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100016b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10001774
xor edi, edi
cmp dword [esi], edi
je 0x10001774
push dword [esi]
push edi
push dword [0x10017540]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100024bd
leave
ret
mov ebx, dword [ebp - 0x24]
jmp 0x1000175d
Function at 0x10001791
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edx
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.10001670
test eax, eax
jne 0x100017b9
push 9
pop esi
jmp 0x1000183b
cmp dword [edi], esi
je 0x1000183b
mov dword [ebp - 0xc], esi
cmp dword [edi + 8], esi
jbe 0x1000183b
mov edx, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], edx
push ebx
mov eax, dword [edi]
push dword [eax + edx]
push esi
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
mov dword [ebp - 8], esi
test ebx, ebx
je 0x10001812
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10001806
push dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov ecx, ebx
mov dword [ebp - 8], 1
call fcn.1000151b
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], esi
jne 0x1000181c
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], esi
jmp 0x1000181f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add ecx, 4
mov edx, dword [ebp - 0x10]
inc eax
add edx, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
cmp eax, dword [edi + 8]
jb 0x100017ce
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x10001841
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x100018a4
push ebx
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x10001893
xor ecx, ecx
mov dword [ebp - 4], ecx
push edi
mov eax, dword [esi]
mov eax, dword [ecx + eax]
test eax, eax
je 0x10001886
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10001883
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
inc ebx
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, dword [esi + 8]
jb 0x1000185b
pop edi
push dword [esi]
push 0
push dword [0x10017540]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop esi
leave
ret