joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
xor eax, eax
test ecx, ecx
je 0x4026b1
test edx, edx
je 0x4026b1
mov ebp, dword [esp + 0x30]
test ebp, ebp
mov dword [esp], ecx
je 0x4025ea
xor edi, edi
mov ecx, 0x1505
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x4025f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4025d0
jmp 0x4025f3
mov esi, 0x1505
jmp 0x4025f3
mov esi, ecx
mov ebx, dword [esp]
mov ebp, dword [ebx + 0x20]
test ebp, ebp
je 0x4026b1
mov dword [esp + 8], edx
mov eax, ebp
or eax, 0xfffffffe
mov ecx, ebp
and ecx, 0xfffffffe
add eax, ecx
inc eax
and eax, esi
mov dword [esp + 0x18], eax
lea eax, [ebp - 1]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x10], eax
xor edi, edi
mov edx, ebp
mov dword [esp + 4], ebp
jmp 0x40263f
mov eax, edi
xor eax, 1
and edi, 1
lea edi, [eax + edi*2]
cmp edi, edx
jae 0x4026af
mov eax, edi
mov ebp, dword [esp + 0x18]
and eax, ebp
mov ecx, edi
xor ecx, ebp
lea eax, [ecx + eax*2]
and eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ebp, dword [ecx + eax*4]
cmp ebp, 0xffffffff
je 0x4026af
mov eax, dword [ebx + 8]
cmp dword [eax + ebp*4], esi
jne 0x402630
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408c90
mov edx, dword [esp + 8]
mov ebx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x30]
jne 0x402630
push dword [esp + 0x30]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408cb0
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402630
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4026b1
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4033f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4035a6
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x40359f
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x403483
add ebp, dword [esp + 0xc]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp + 0x10]
sub ebx, esi
mov esi, 0x15b0
je 0x40359f
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x4034fd
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x4034a0
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
mov dword [esp + 0x10], ebx
jbe 0x403448
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0xc], eax
je 0x403553
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x403530
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x403440
jmp 0x403565
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x403440
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403570
jmp 0x403440
shl ecx, 0x10
or ecx, edi
jmp 0x4035ab
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4035c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403617
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0x403619
not eax
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
not esi
add edx, edx
movzx edi, byte [ecx]
inc ecx
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x442a18]
mov eax, ebx
shr eax, 4
shr edi, 4
and ebx, 0xf
xor ebx, edi
xor eax, dword [ebx*4 + 0x442a18]
add edx, esi
jne 0x4035e0
not eax
jmp 0x403619
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x4094f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40961c
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40952d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409551
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409520
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409520
lea esi, [ebx + 1]
push esi
call fcn.00408a60
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x40962a
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409598
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x40962c
movzx edx, word [edi]
test dx, dx
je 0x40962c
cmp dx, 0x7f
jbe 0x409580
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x4095e0
cmp ecx, 2
jb 0x4095e0
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409587
xor esi, esi
cmp ecx, 3
jb 0x409587
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
mov ecx, edx
not ecx
or ecx, 0x3f
add ecx, edx
add cl, 0x81
mov byte [eax + 2], cl
mov esi, 3
jmp 0x409587
push 1
call fcn.00408a60
add esp, 4
mov ebp, eax
jmp 0x40962c
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409657
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409652
test eax, eax
jne 0x409650
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004057d0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x419310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, dword [ebp + 0xc]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x419330
sar ebx, 1
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push ebx
push edi
push 0
call dword [0x44c2c4]
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp], eax
jns 0x419362
mov eax, 0xffffffff
jmp 0x419364
add eax, eax
push eax
call fcn.00408a60
add esp, 4
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 4]
push esi
push ebx
push edi
push 0
call dword [0x44c2c4]
lea eax, [esp + 0x20]
push eax
push esi
call fcn.0043f9d0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446f9c]
Function at 0x41b9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov dword [esp + 8], 0xeba9d5ba
mov dword [esp + 0xc], 0xef67e991
mov dword [esp + 0x10], 0xe3deedda
mov dword [esp + 0x14], 0xe786e186
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov word [esp + 0x18], 0xe5e6
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1d], 0
xor eax, eax
movzx esi, byte [esp + eax + 8]
lea edx, [eax + eax]
mov edi, edx
and edi, 0x3a
mov ecx, eax
xor ecx, 0x56726b5d
add ecx, edi
xor ecx, esi
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
add cl, 0x75
mov byte [esp + eax + 8], cl
and edx, 2
xor eax, 1
add eax, edx
cmp eax, 0x19
jb 0x41ba20
lea edi, [esp + 0x28]
lea eax, [esp + 8]
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x38]
mov ecx, 1
mov eax, dword [esp + 4]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41ba80
cmp eax, 0xffffffed
jge 0x41ba97
mov eax, 0xffffffff
jmp 0x41ba9a
add eax, 0x12
push eax
call fcn.00408a60
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41bad1
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41bac0
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41bb01
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41baf0
mov word [eax], 0
lea eax, [esp + 8]
push eax
push esi
call fcn.0043f9d0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44708c]
Function at 0x41fa40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov dword [esp], 0xa3e3a1f9
mov dword [esp + 4], 0xdf4cdd32
mov dword [esp + 8], 0xdbbbd9a2
mov dword [esp + 0xc], 0xd7b7d556
mov dword [esp + 0x10], 0xd3b4d189
mov dword [esp + 0x14], 0xcf54cdbe
mov dword [esp + 0x18], 0xcb5ec941
mov dword [esp + 0x1c], 0xc75bc556
mov dword [esp + 0x20], 0xc3a2c154
mov dword [esp + 0x24], 0xff6efd59
mov dword [esp + 0x28], 0xfb9cf962
mov dword [esp + 0x2c], 0xf766f58a
mov dword [esp + 0x30], 0xf36ef167
mov dword [esp + 0x34], 0xef78ed69
mov dword [esp + 0x38], 0xeb65e971
lea eax, [esp + 0x3c]
mov word [esp + 0x3c], 0xe5ea
mov dword [esp + 0x3e], 0
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
mov ecx, 0x9022c13b
nop
nop
nop
movzx edx, byte [esp + ecx + 0x6fdd3ec5]
xor edx, ecx
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x54]
mov esi, edx
or esi, 0x62
and edx, 0x62
add edx, esi
inc dl
mov byte [esp + ecx + 0x6fdd3ec5], dl
movzx edx, byte [esp + ecx + 0x6fdd3ec6]
lea esi, [ecx + 1]
xor esi, edx
mov dword [esp + 0x54], esi
mov edx, dword [esp + 0x54]
mov esi, edx
or esi, 0x62
and edx, 0x62
add edx, esi
inc dl
mov byte [esp + ecx + 0x6fdd3ec6], dl
add ecx, 2
cmp ecx, 0x9022c183
jne 0x41faf0
lea ebx, [esp + 0x54]
mov edx, esp
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x90]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x4c]
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44c2c4]
mov esi, dword [esp + 0x4c]
test esi, esi
jns 0x41fb8f
mov eax, 0xffffffff
jmp 0x41fb92
lea eax, [esi + esi]
push eax
call fcn.00408a60
add esp, 4
push edi
push esi
mov dword [esp + 0x50], eax
push eax
push 0x1e
push ebx
push 0
call dword [0x44c2c4]
mov dword [esp], 0x6bf26dc0
mov dword [esp + 4], 0x67f469e5
mov dword [esp + 8], 0x63ff65f8
mov dword [esp + 0xc], 0x5fc061ee
mov dword [esp + 0x10], 0x5bd45dc5
mov dword [esp + 0x14], 0x575659c4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1b], 0
xor eax, eax
nop
nop
movzx edx, byte [esp + eax]
lea ecx, [eax - 0x64572cae]
and ecx, edx
lea edi, [ecx + ecx]
not edi
add edi, ecx
mov esi, edi
not esi
and edi, 2
and esi, 0xfffffffd
imul esi, edi
mov edi, ecx
and edi, 2
or ecx, 2
imul ecx, edi
add ecx, esi
add edx, eax
add edx, 0x9ba8d352
lea esi, [ecx + ecx]
not esi
add esi, ecx
xor ecx, edx
and esi, edx
add esi, esi
sub esi, ecx
mov dword [esp + 0x50], esi
mov ecx, dword [esp + 0x50]
mov edx, ecx
xor edx, 0xc2
mov esi, ecx
and esi, 0xc0
lea edi, [esi + 2]
and ecx, 2
imul edi, ecx
xor ecx, 2
imul ecx, esi
add ecx, edx
add ecx, edi
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x1f
jb 0x41fbf0
push 0
push 0
lea eax, [esp + 8]
push eax
mov esi, dword [esp + 0x54]
push esi
push dword [ebp + 8]
call fcn.00419310
add esp, 0x14
mov ebx, eax
jmp dword [0x4479f4]
Function at 0x422fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.00422fe0
add esp, 4
test al, al
je 0x422fd3
mov al, 1
ret
jmp fcn.00423b80

Function at 0x422fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x470
mov esi, esp
push eax
mov dword [esi + 0x2c], esp
push eax
mov dword [esi + 0x4c], esp
sub esp, 0x10
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x48], eax
mov esp, eax
push eax
sub esp, 0x24
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x30], eax
mov esp, eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x68], 0xb326b123
mov dword [esi + 0x6c], 0xb717b511
mov dword [esi + 0x70], 0xab74a935
mov dword [esi + 0x74], 0xaf26ad09
mov dword [esi + 0x78], 0xa3a2a105
mov dword [esi + 0x7c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 8
mov edi, edx
xor edi, 0xfffffffd
add edi, edx
mov ecx, edi
not ecx
and edi, edx
mov ebx, edx
not ebx
and ebx, ecx
imul ebx, edi
mov edi, edx
and edi, ecx
or ecx, edx
movzx edx, byte [esi + eax + 0x68]
imul ecx, edi
add ecx, ebx
mov edi, eax
xor edi, 0x94972c48
mov ebx, ecx
and ebx, edi
or edi, ecx
add edi, ebx
mov ecx, edi
not ecx
mov ebx, ecx
or ebx, edx
sub ecx, ebx
add edi, edx
lea ecx, [edi + ecx*2]
mov dword [esi + 0x50], ecx
mov ecx, dword [esi + 0x50]
add cl, 8
mov byte [esi + eax + 0x68], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x18
jb 0x423060
lea edi, [esi + 0x68]
lea ecx, [esi + 0x38]
push edi
call fcn.0043aa70
jmp dword [0x4482b0]
Function at 0x430e80
Capabilities:
Encode data using xor
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [ebp + 8]
mov byte [esp + 0x13], 0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x43105b
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp + 0x50], eax
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x431053
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00408c90
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], 0
je 0x43103d
mov eax, dword [ebp + 8]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x44], eax
jmp 0x430f2c
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x40], eax
jmp 0x430f36
mov al, byte [esp + 0x14]
mov byte [esp + 0x1c], al
mov byte [esp + 0x20], 0x73
mov byte [esp + 0x21], 0x95
mov byte [esp + 0x22], 0x93
mov byte [esp + 0x23], 0xab
mov byte [esp + 0x24], 0x98
mov byte [esp + 0x25], 0xac
mov byte [esp + 0x26], 0x9f
mov byte [esp + 0x27], 0xad
mov byte [esp + 0x28], 0x9a
mov byte [esp + 0x29], 0x4f
mov byte [esp + 0x2a], 0xb4
mov byte [esp + 0x2b], 0xbb
mov byte [esp + 0x2c], 0xb6
mov byte [esp + 0x2d], 0x25
lea eax, [esp + 0x20]
add eax, 0xe
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 5
call fcn.00408bf0
xor eax, eax
movzx edx, byte [esp + eax + 0x20]
mov ecx, eax
add ecx, 0x154dec07
mov ebx, 0xeab213f8
sub ebx, eax
mov edi, ebx
and edi, 0x8cbc145a
mov esi, ecx
and esi, 0x7343eba5
or edi, esi
xor edi, 0xa5
lea esi, [eax + ebx*2 + 8]
and esi, ebx
and esi, edi
not esi
and esi, edx
or ecx, edx
xor esi, ecx
mov dword [esp + 0x4c], esi
mov edx, dword [esp + 0x4c]
mov ecx, edx
or ecx, 0xce
add ecx, 1
and edx, 0xce
add ecx, edx
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x13
jne 0x430fa7
jmp 0x43100c
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
call fcn.004096b0
sub esp, 0xc
jmp 0x431031
and al, 1
mov byte [esp + 0x13], al
jmp 0x431039
jmp 0x43103b
jmp 0x43103d
mov eax, dword [esp + 0x18]
jmp 0x431043
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x431051
jmp 0x431053
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x43105b
mov al, byte [esp + 0x13]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435540
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov ebp, dword [esp + 0x6c]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x10], 0xc3d2e1f0
mov dword [esp + 0xc], 0x10325476
mov dword [esp + 8], 0x98badcfe
mov dword [esp + 4], 0xefcdab89
mov dword [esp], 0x67452301
cmp ebp, 0x40
jb 0x4355fd
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x14], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x14], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x14], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x14], ecx
add esi, 4
cmp esi, 0x40
jne 0x4355a0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 4]
push eax
call fcn.00439190
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x435590
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x6c]
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, ebp
and edx, 0x3f
je 0x4356b5
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
lea ecx, [esi*8]
shl edi, cl
inc eax
mov ecx, esi
and ecx, 0xfffffffc
xor dword [esp + ecx + 0x14], edi
mov ecx, esi
and ecx, 1
xor esi, 1
lea esi, [esi + ecx*2]
cmp esi, edx
jb 0x435690
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x14], eax
mov esi, dword [esp + 0x70]
mov eax, ebp
not eax
test al, 0x38
jne 0x435704
lea edi, [esp + 0x14]
mov eax, esp
push edi
push eax
call fcn.00439190
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x54]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x4c], ebx
shr ebp, 0x1d
mov dword [esp + 0x50], ebp
lea eax, [esp + 0x14]
mov ecx, esp
push eax
push ecx
call fcn.00439190
add esp, 8
mov eax, dword [esp]
mov dword [esi], eax
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x10], eax
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4368f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
xor edx, edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x436900
lea esi, [ecx + edx]
add esi, 0xfffffffe
add edx, ecx
mov edi, 1
sub edi, edx
and edi, ecx
mov edx, ecx
not edx
and edx, esi
sub edx, edi
je 0x43699a
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0x436952
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx ebx, word [ecx]
add ecx, 2
xor ebx, eax
imul eax, ebx, 0x1000193
dec edi
jne 0x436940
cmp esi, 3
jb 0x43699a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0x436960
pop esi
pop edi
pop ebx
ret
Function at 0x437080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
lea eax, [esp + 0x28]
push 0x68
push 7
push 0x100080
push eax
push dword [ebp + 8]
call fcn.0043f7b0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449b04]
Function at 0x43a8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 8], 0x232021f6
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov ecx, 0x24
mov edx, 0xcfe922db
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x3016dd2d]
lea edi, [esi + esi]
not edi
add edi, esi
and edi, edx
and esi, ecx
or esi, edi
mov dword [esp + 4], esi
mov esi, dword [esp + 4]
mov edi, esi
not edi
or edi, 0x50a00c02
lea ebx, [esi + edi]
inc ebx
mov edi, ebx
and edi, 0xfd
mov eax, ebx
and eax, 2
or ebx, 2
imul ebx, eax
xor eax, 2
imul eax, edi
xor esi, 2
add ebx, esi
add ebx, eax
inc bl
mov byte [esp + edx + 0x3016dd2d], bl
dec ecx
inc edx
cmp ecx, 0x1b
jne 0x43a8f0
mov eax, dword [esp + 8]
mov ecx, dword fs:[eax]
push dword [ebp + 8]
push 0
push dword [ecx + 0x18]
call dword [0x4542e8]
mov ecx, dword [0x449f8c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
nop
nop
nop
jmp ecx