joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405690
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
cmp dword [esp + 0x2c], 0
je 0x405891
mov esi, dword [esp + 0x30]
test esi, esi
je 0x405891
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x405891
cmp dword [ecx], 0
jne 0x405891
push esi
call fcn.0040c670
add esp, 4
test eax, eax
je 0x405704
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x40570b
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
mov ecx, ebx
xor ecx, 1
and ebx, 1
lea ebx, [ecx + ebx*2]
mov ecx, edi
cmp ebx, eax
jb 0x4056e0
jmp 0x40570d
mov edi, 0x1505
jmp 0x40570d
mov edi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x20]
lea ebp, [edx - 1]
mov ebx, edx
sub ebx, 1
mov dword [esp + 0x10], ebx
jae 0x40572c
mov ebp, 0xffffffff
jmp 0x4057e6
mov dword [esp], eax
and ebp, edi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov ebx, ebp
not ebx
inc ebp
mov eax, ebp
jmp 0x40575b
dec ebx
mov eax, ebp
inc eax
dec edx
je 0x4057dd
mov ebp, dword [esp + 0x10]
or ebp, ebx
add ebp, eax
mov esi, dword [esp + 0xc]
mov esi, dword [esi + ebp*4]
cmp esi, 0xffffffff
je 0x4057e2
mov ebp, eax
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405750
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 8], eax
push eax
mov dword [esp + 8], edx
call fcn.0040c670
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x405750
push dword [esp]
push dword [esp + 0xc]
push dword [esp + 0x38]
call fcn.0040c690
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x405750
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.004046d0
mov edx, dword [esp + 0x30]
add esp, 4
mov eax, dword [edx + 0x10]
mov ebx, dword [esp + 0x34]
mov dword [eax + esi*4], ebx
jmp 0x405884
mov ebp, 0xffffffff
mov esi, dword [esp + 0x30]
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405824
call fcn.00405960
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x405891
push esi
call fcn.0040c670
add esp, 4
mov edx, esi
lea esi, [esp + 0x14]
mov ecx, dword [esp + 0x2c]
push esi
mov esi, edx
push edi
push eax
call fcn.004058a0
add esp, 0xc
mov ebp, eax
push esi
call fcn.0040c670
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x448008]
add esp, 4
test eax, eax
je 0x40588c
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c4e0
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov ebx, dword [esp + 0x34]
mov dword [eax + ecx*4], ebx
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [ebx], eax
xor eax, eax
jmp 0x405891
mov eax, 0xffffffff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406950
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406b06
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406aff
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x4069e6
mov eax, dword [esp + 4]
sub eax, dword [esp]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x406aff
xor edx, edx
cmp ebx, 8
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
jb 0x406a68
and ebx, 0x1ff8
mov dword [esp], ebx
xor eax, eax
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx edi, byte [ebp + edx + 4]
add edi, esi
mov eax, ecx
and eax, edi
xor ecx, edi
movzx esi, byte [ebp + edx + 5]
add esi, edi
movzx ebx, byte [ebp + edx + 6]
add ebx, esi
add esi, ecx
lea ecx, [esi + eax*2]
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, ebx
mov ebx, dword [esp + 4]
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ebx
jb 0x406a00
add ebp, eax
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov eax, edx
sub eax, ebx
jae 0x4069ad
mov dword [esp + 0xc], eax
mov eax, ebx
and eax, 3
mov dword [esp], edx
je 0x406aaf
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406a90
mov eax, dword [esp]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4069a0
jmp 0x406abe
mov eax, edx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4069a0
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406ad0
jmp 0x4069a0
shl ecx, 0x10
or ecx, edi
jmp 0x406b0b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406b20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406b4e
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
not ecx
test ebx, ebx
je 0x406bea
test bl, 1
jne 0x406b55
mov edx, ebx
cmp ebx, 1
jne 0x406b86
jmp 0x406bea
xor eax, eax
jmp 0x406bf1
lea edx, [ebx - 1]
movzx esi, byte [eax]
mov edi, ecx
shr edi, 4
xor ecx, esi
and ecx, 0xf
xor edi, dword [ecx*4 + 0x445c50]
inc eax
mov ecx, edi
shr ecx, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor ecx, dword [esi*4 + 0x445c50]
cmp ebx, 1
je 0x406bea
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax + esi]
mov ebx, ecx
shr ebx, 4
xor ecx, edi
and ecx, 0xf
xor ebx, dword [ecx*4 + 0x445c50]
mov ecx, ebx
shr ecx, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor ecx, dword [edi*4 + 0x445c50]
movzx edi, byte [eax + esi + 1]
mov ebx, ecx
shr ebx, 4
xor ecx, edi
and ecx, 0xf
xor ebx, dword [ecx*4 + 0x445c50]
mov ecx, ebx
shr ecx, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor ecx, dword [edi*4 + 0x445c50]
add esi, 2
cmp edx, esi
jne 0x406b90
lea eax, [ecx + ecx]
not eax
add eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x40c4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, ebx
shr ecx, 2
mov esi, ebx
and esi, 0xfffffffc
mov edx, eax
add edx, esi
add esi, edi
mov ebp, edi
mov edi, eax
xchg esi, ebp
rep movsd dword es:[edi], dword [esi]
xchg esi, ebp
mov ecx, ebx
xor ecx, 0xfffffffc
or ebx, 3
and ebx, ecx
mov ecx, ebx
shr ecx, 1
mov ebp, esi
mov edi, edx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov edi, ebx
or edi, 1
mov ebp, ebx
xor ebp, 0xfffffffe
and ebp, edi
je 0x40c5cd
and ebx, 0xfffffffe
add edx, ebx
add esi, ebx
mov edi, ebp
and edi, 7
je 0x40c56b
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + ebx]
mov byte [edx + ebx], cl
inc ebx
cmp edi, ebx
jne 0x40c550
add esi, ebx
add edx, ebx
mov edi, ebp
sub edi, ebx
cmp ebp, 8
jae 0x40c572
jmp 0x40c5cd
mov edi, ebp
cmp ebp, 8
jb 0x40c5cd
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + ecx]
mov byte [edx + ecx], bl
movzx ebx, byte [esi + ecx + 1]
mov byte [edx + ecx + 1], bl
movzx ebx, byte [esi + ecx + 2]
mov byte [edx + ecx + 2], bl
movzx ebx, byte [esi + ecx + 3]
mov byte [edx + ecx + 3], bl
movzx ebx, byte [esi + ecx + 4]
mov byte [edx + ecx + 4], bl
movzx ebx, byte [esi + ecx + 5]
mov byte [edx + ecx + 5], bl
movzx ebx, byte [esi + ecx + 6]
mov byte [edx + ecx + 6], bl
movzx ebx, byte [esi + ecx + 7]
mov byte [edx + ecx + 7], bl
add ecx, 8
cmp edi, ecx
jne 0x40c580
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ddd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov bl, byte [esp + 0x14]
call fcn.0040df70
test ebp, ebp
sets al
mov ecx, ebp
sub ecx, 1
sete cl
or al, cl
mov ecx, ebp
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x40de08
jmp 0x40de0d
jmp 0x40df65
movzx eax, bl
mov ecx, edi
mov edi, esi
add edi, ecx
add edi, 0xffffffff
mov byte [esi + ecx - 1], 0
cmp eax, 0
jne 0x40de2e
add edi, 0xffffffff
mov byte [edi], 0x30
jmp 0x40df63
cmp ebp, 0xa
jne 0x40dec6
jmp 0x40de39
movzx ecx, bl
cmp ecx, 0x64
setae al
test al, 1
jne 0x40de48
jmp 0x40de82
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
shl edx, 1
mov al, byte [edx + 0x446761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x446760]
add esi, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
mov ebx, eax
mov edi, esi
jmp 0x40de39
cmp ecx, 0xa
setb al
test al, 1
jne 0x40de8e
jmp 0x40dea1
lea eax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
add eax, ecx
jmp 0x40de98
mov al, byte [eax]
add edi, 0xffffffff
mov byte [edi], al
jmp 0x40dec1
shl ecx, 1
mov al, byte [ecx + 0x446761]
mov edx, edi
add edx, 0xffffffff
mov byte [edi - 1], al
mov al, byte [ecx + 0x446760]
add edx, 0xffffffff
mov byte [edi - 2], al
mov edi, edx
jmp 0x40df63
cmp ebp, 0x10
sete al
jmp 0x40dece
test al, 1
jne 0x40ded6
jmp 0x40ded4
jmp 0x40df38
movzx eax, bl
jmp 0x40dedb
cmp eax, 0x10
setl cl
test cl, 1
jne 0x40dee8
jmp 0x40defb
mov cl, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov eax, edi
add eax, 0xffffffff
mov byte [edi - 1], cl
mov edi, eax
jmp 0x40df63
mov ecx, eax
and ecx, 0xfffffffd
mov edx, eax
or edx, 0xfffffffd
xor edx, 0xffffffff
imul edx, ecx
mov ecx, eax
and ecx, 2
or eax, 2
imul eax, ecx
add eax, edx
mov dl, byte [eax + 0x44682a]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], dl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add ecx, 0xffffffff
mov byte [edi - 2], al
mov edi, ecx
jmp 0x40df63
movzx ecx, bl
cmp ecx, 0
jbe 0x40df61
mov eax, ecx
xor edx, edx
div ebp
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebp
mov ebx, eax
mov edi, esi
jmp 0x40df38
jmp 0x40df63
mov esi, edi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41a730
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get elevation service for chromium-based browsers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xaa8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41a750
sar esi, 1
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f124]
mov ebx, dword [esp + 0x20]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41a784
mov eax, 0xffffffff
jmp 0x41a787
lea eax, [ebx + ebx]
push eax
call fcn.0040c4b0
add esp, 4
lea ecx, [esp + 0x20]
push ecx
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44f124]
mov eax, dword [esp + 0x20]
mov ecx, eax
add ecx, 0xd
js 0x41a7b9
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c4b0
add esp, 4
mov edi, eax
mov dword [esp + 0x1f8], 0xf1a2ff50
mov dword [esp + 0x1fc], 0xf547f353
mov dword [esp + 0x200], 0xc996f740
mov dword [esp + 0x204], 0xcd6dcb9e
mov dword [esp + 0x208], 0xc17bcf7e
mov dword [esp + 0x20c], 0xc573c37b
mov dword [esp + 0x210], 0xd9c6c77a
mov byte [esp + 0x214], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x48]
cmp eax, 0x1c
ja 0x41a883
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
movzx eax, byte [esp + eax + 0x1f8]
mov edx, ecx
xor edx, 0x3eb73355
add ecx, ecx
and ecx, 0x7d6e66aa
mov esi, ecx
and esi, edx
xor ecx, edx
lea ecx, [ecx + esi*2]
xor ecx, eax
mov dword [esp + 0x698], ecx
mov eax, dword [esp + 0x698]
add al, 0x57
mov ecx, dword [esp + 0x48]
mov byte [esp + ecx + 0x1f8], al
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp eax, 0x1d
jb 0x41a830
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41a8b1
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a8a0
mov word [eax], 0
movzx ecx, word [esp + 0x1f8]
test cx, cx
je 0x41a8e1
lea edx, [esp + 0x1fa]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a8d0
mov word [eax], 0
lea eax, [esp + 0x638]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00443160
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449f74]

Function at 0x41d4b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84
xor eax, eax
cmp dword [esp + 0xa0], 0
setne al
xor ecx, ecx
mov dword [esp + 0xc], 0
xor ebx, ebx
jmp dword [eax*4 + 0x44a0dc]
Function at 0x41ef00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x41ef20
add eax, ebx
add eax, 0xfffffffe
mov edi, ebx
not edi
and edi, eax
add edi, edi
xor eax, ebx
sub edi, eax
sar edi, 1
lea eax, [esp + 0x24]
push eax
push 0
push 0
push edi
push ebx
push 0
call dword [0x44f124]
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x28], eax
jns 0x41ef63
mov eax, 0xffffffff
jmp 0x41ef65
add eax, eax
push eax
call fcn.0040c4b0
add esp, 4
mov esi, eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x2c]
push esi
push edi
push ebx
push 0
call dword [0x44f124]
lea eax, [esp + 0x10]
mov ebx, eax
push eax
push esi
call fcn.00443340
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a2a4]
Function at 0x4208f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov ecx, dword [ebx + 4]
lea eax, [ecx - 2]
mov edx, ecx
nop
nop
add eax, 2
cmp word [edx], 0
lea edx, [edx + 2]
jne 0x420910
mov edx, ecx
not edx
and edx, eax
add edx, edx
xor eax, ecx
sub edx, eax
cmp edx, 0xffffffdd
jge 0x420934
mov edx, 0xffffffff
jmp 0x420937
add edx, 0x22
push edx
call fcn.0040c4b0
add esp, 4
mov esi, eax
mov dword [esp + 8], 0xff909e4
mov dword [esp + 0xc], 0x3f10df8
mov dword [esp + 0x10], 0x7e701f6
mov dword [esp + 0x14], 0x1bff05ff
mov dword [esp + 0x18], 0x1ffa19f4
mov dword [esp + 0x1c], 0x13e81df9
mov dword [esp + 0x20], 0x17e311f1
mov dword [esp + 0x24], 0x2bde15e8
mov dword [esp + 0x28], 0x2928
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x23
ja 0x4209d9
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x901b8642
and eax, 0x101b8642
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
add al, 0xb6
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x24
jb 0x4209a0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x420a01
add ecx, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4209f0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x420a31
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420a20
mov word [eax], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov dword [esp + 8], 0x43ed41ed
mov dword [esp + 0xc], 0x472b45de
mov dword [esp + 0x10], 0x4bd249ed
mov dword [esp + 0x14], 0x4feb4dd8
mov dword [esp + 0x18], 0xb321b11e
mov dword [esp + 0x1c], 0xb719b51d
mov dword [esp + 0x20], 0xbbd1b916
mov dword [esp + 0x24], 0xbfd5bdd7
mov dword [esp + 0x28], 0xa31ca1ca
mov dword [esp + 0x2c], 0xa735a531
mov dword [esp + 0x30], 0xab38a90d
mov dword [esp + 0x34], 0xaf01adef
mov dword [esp + 0x38], 0x9306913e
mov dword [esp + 0x3c], 0x970e9531
mov dword [esp + 0x40], 0x9bd3990c
mov dword [esp + 0x44], 0x9fc39d38
mov dword [esp + 0x48], 0x838281ea
mov dword [esp + 0x4c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x47
ja 0x420b31
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x8c619a70
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xd0
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x48
jb 0x420b00
lea eax, [esp + 0x50]
lea ecx, [esp + 8]
push eax
push 0x420f80
push ecx
push esi
call fcn.00421900
add esp, 0x10
jmp dword [0x44a38c]
Function at 0x428010
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call case.0x4269ad.85
add esp, 4
test al, al
je 0x428770
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0x9c
xor edi, edi
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x44b304]
Function at 0x42b570
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov eax, dword [0x44f124]
mov dword [esp + 0x20], 0x935391ad
mov dword [esp + 0x24], 0xaf5ead5c
mov dword [esp + 0x28], 0xab4ba974
mov dword [esp + 0x2c], 0xa747a528
mov dword [esp + 0x30], 0xa346a19d
mov dword [esp + 0x34], 0xbf49bd6a
mov dword [esp + 0x38], 0xbb47b934
mov dword [esp + 0x3c], 0xb757b544
mov dword [esp + 0x40], 0xb389b14c
mov dword [esp + 0x44], 0x4faa4d77
mov dword [esp + 0x48], 0x4bb749bb
mov dword [esp + 0x4c], 0x47b545b7
mov dword [esp + 0x50], 0x43b541b9
mov dword [esp + 0x54], 0x5f685daa
mov dword [esp + 0x58], 0x5baf59d0
mov dword [esp + 0x5c], 0x575655a0
mov word [esp + 0x60], 0
mov byte [esp + 0x62], 0
Function at 0x4338d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
push eax
mov esi, esp
jmp 0x4338de
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x433901
jmp 0x433a3e
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
jmp 0x43392f
cmp edi, 0
setne al
jmp 0x433937
xor ebx, ebx
test al, 1
jne 0x433942
jmp 0x433a38
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x433950
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.0040c670
add esp, 4
mov edx, eax
cmp edx, 0
setne al
xor ebx, ebx
test al, 1
jne 0x433974
jmp 0x433a2a
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0xd1
mov byte [ebp - 0x27], 0xef
mov byte [ebp - 0x26], 0xed
mov byte [ebp - 0x25], 0xe9
mov byte [ebp - 0x24], 0xf6
mov byte [ebp - 0x23], 0xd6
mov byte [ebp - 0x22], 0xc9
mov byte [ebp - 0x21], 0xdb
mov byte [ebp - 0x20], 0xc8
mov byte [ebp - 0x1f], 0x91
mov byte [ebp - 0x1e], 0xde
mov byte [ebp - 0x1d], 0xd9
mov byte [ebp - 0x1c], 0xdc
mov byte [ebp - 0x1b], 0xaf
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x13
jne 0x4339b6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x13
jae 0x433a03
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.00436340
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x4339ca
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d0d0
mov bl, al
and bl, 1
jmp 0x433a26
jmp 0x433a28
jmp 0x433a2a
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x433a38
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
lea eax, [esp + 0x1c]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x50]
call fcn.00443160
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ca44]
Function at 0x43ce00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov dword [esp + 4], 0xd1cecf3c
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43ce76
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xd01caead
and eax, 0xd01caead
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
mov ecx, edx
xor ecx, eax
add ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov ecx, eax
not ecx
and ecx, 0x61
and eax, 0x9e
sub eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43ce20
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
push ecx
push 0
push dword [eax + 0x18]
call dword [0x457144]
add esp, 0xc
ret

Function at 0x43cea0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44cdc8]