joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410460
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x1785196d
mov dword [esp + 0x40], 0x138b1592
mov dword [esp + 0x44], 0xf9a1184
mov dword [esp + 0x48], 0xb590d6d
mov dword [esp + 0x4c], 0x7540945
mov dword [esp + 0x50], 0x3220554
mov dword [esp + 0x54], 0x3f550158
mov dword [esp + 0x58], 0x3ba83da5
mov dword [esp + 0x5c], 0x37a539a4
mov dword [esp + 0x60], 0x33bd35bf
mov dword [esp + 0x64], 0x2f5c3110
mov dword [esp + 0x68], 0x2b0a2d40
mov dword [esp + 0x6c], 0x27762979
mov dword [esp + 0x70], 0x23722576
mov dword [esp + 0x74], 0x5f7e2167
mov dword [esp + 0x78], 0x5bc35d37
mov dword [esp + 0x7c], 0x571c59ca
mov dword [esp + 0x80], 0x53155518
mov dword [esp + 0x84], 0x4fc65170
mov dword [esp + 0x88], 0x4b064d06
mov dword [esp + 0x8c], 0x47664911
mov dword [esp + 0x90], 0x43d24505
mov dword [esp + 0x94], 0x7fea41d0
mov dword [esp + 0x98], 0x7b117de1
mov dword [esp + 0x9c], 0x77e879e5
mov dword [esp + 0xa0], 0x73eb7503
mov dword [esp + 0xa4], 0x6f3d71fc
mov dword [esp + 0xa8], 0x6b256d21
mov dword [esp + 0xac], 0x67346923
mov dword [esp + 0xb0], 0x6328652b
mov dword [esp + 0xb4], 0x9fc66140
mov dword [esp + 0xb8], 0x9be29deb
mov dword [esp + 0xbc], 0x97e399f4
mov dword [esp + 0xc0], 0x93c695e0
mov dword [esp + 0xc4], 0x8f1a91b0
mov dword [esp + 0xc8], 0x8b1d8d15
mov dword [esp + 0xcc], 0x87a68915
mov dword [esp + 0xd0], 0x831f85ff
mov dword [esp + 0xd4], 0xbf29811f
mov dword [esp + 0xd8], 0xbbe3bd2f
mov dword [esp + 0xdc], 0xb7c9b998
mov dword [esp + 0xe0], 0xb33cb52c
mov dword [esp + 0xe4], 0xaf3bb123
mov dword [esp + 0xe8], 0xabf9ad31
mov dword [esp + 0xec], 0xa7f7a9f9
mov dword [esp + 0xf0], 0xa3f0a5ed
mov dword [esp + 0xf4], 0xdf8ca1f0
mov dword [esp + 0xf8], 0xdb88dd8c
mov dword [esp + 0xfc], 0xd7f6d988
mov dword [esp + 0x100], 0xd3b3d5bb
mov dword [esp + 0x104], 0xcfafd14a
mov dword [esp + 0x108], 0xcb53cd42
mov dword [esp + 0x10c], 0xc78bc99b
mov dword [esp + 0x110], 0xc389c58b
mov dword [esp + 0x114], 0xffb1c192
mov dword [esp + 0x118], 0xfbfafdb6
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov eax, dword [0x44f02c]
mov ecx, 0x42dadf06
mov edx, 0xf9
movzx esi, byte [esp + ecx - 0x42dadeca]
mov edi, edx
and edi, 0x88
mov ebx, ecx
xor ebx, 0x88
or ebx, edi
xor ebx, esi
xor ebx, 0x88
add bl, 0xe2
mov byte [esp + ecx - 0x42dadeca], bl
inc ecx
dec edx
cmp ecx, 0x42dadfe9
jne 0x4106c0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x449c64]
Function at 0x425270
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov ecx, 0xfffffffe
nop
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x425280
mov eax, ecx
sar eax, 1
and ecx, 0x12
xor eax, 9
add eax, ecx
jns 0x4252a0
mov eax, 0xffffffff
jmp 0x4252a2
add eax, eax
push eax
call fcn.0040c880
add esp, 4
mov esi, eax
mov dword [esp], 0x49df4ba8
mov dword [esp + 4], 0x45c147d3
mov dword [esp + 8], 0x41904388
mov dword [esp + 0xc], 0x7de07fdc
mov dword [esp + 0x10], 0x7b7c
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x13
xor cl, byte [esp + eax]
add cl, 0xa1
mov byte [esp + eax], cl
inc eax
cmp eax, 0x15
jne 0x4252e0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x425321
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x425310
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425351
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425340
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.004446d0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44b89c]
Function at 0x428090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x5c], 0xf935fbd7
mov dword [ebp - 0x58], 0xe576e768
mov dword [ebp - 0x54], 0xe10de328
mov dword [ebp - 0x50], 0xed01ef7c
mov dword [ebp - 0x4c], 0xe90eebc7
mov dword [ebp - 0x48], 0x957e9714
mov dword [ebp - 0x44], 0x9100930f
mov dword [ebp - 0x40], 0x9d759f7c
mov dword [ebp - 0x3c], 0x99749b02
mov dword [ebp - 0x38], 0x8518870f
mov dword [ebp - 0x34], 0x81668368
mov dword [ebp - 0x30], 0x8d108f70
mov dword [ebp - 0x2c], 0x89608b1d
mov dword [ebp - 0x28], 0xb522b71f
mov dword [ebp - 0x24], 0xb12fb35f
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], 0xbfb0
mov dword [ebp - 0x1e], 0
mov byte [ebp - 0x1a], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xab
xor dl, byte [ebp + ecx - 0x5c]
add dl, 0xa9
mov byte [ebp + ecx - 0x5c], dl
inc ecx
cmp ecx, 0x43
jne 0x428130
lea esi, [ebp - 0x9a]
lea edx, [ebp - 0x5c]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x5e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [ebp - 0x10]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x450370]
mov edi, dword [edi]
test edi, edi
jns 0x428189
mov eax, 0xffffffff
jmp 0x42818c
lea eax, [edi + edi]
push eax
call fcn.0040c880
add esp, 4
push dword [ebp - 0x10]
push edi
mov dword [ebp - 0x14], eax
push eax
push 0x1e
lea eax, [ebp - 0x9a]
push eax
push 0
call dword [0x450370]
mov dword [ebx], 0x137a116c
mov dword [ebx + 4], 0x1f881d81
mov dword [ebx + 8], 0x1b771974
mov dword [ebx + 0xc], 0x7640596
mov dword [ebx + 0x10], 0x3900169
mov dword [ebx + 0x14], 0xf0e0d60
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx + ecx]
mov dword [ebp - 0x10], eax
mov edi, ecx
xor edi, 0x3cfb82b2
mov esi, edx
and esi, 0x1a
sub esi, edi
lea ebx, [esi + 0x1ed585b6]
and ebx, eax
mov eax, ebx
and eax, 0xfffffffd
mov edi, ebx
or edi, 0xfd
inc edi
imul edi, eax
mov eax, ebx
and eax, 2
or ebx, 2
imul ebx, eax
sub edi, ebx
mov ebx, dword [ebp - 0x18]
lea eax, [edi + esi]
add eax, 0x1ed585b6
add al, byte [ebp - 0x10]
add al, 0xec
mov byte [ebx + ecx], al
inc ecx
add edx, 2
cmp ecx, 0x1b
jne 0x4281f0
push 0
push 0
push ebx
mov esi, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call fcn.004235b0
add esp, 0x14
jmp dword [0x44bfc8]
Function at 0x428290
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21ec
call fcn.0040c7e0
mov dword [esp + 0x11ec], 0x13601174
mov dword [esp + 0x11f0], 0x1f511d51
mov dword [esp + 0x11f4], 0x1b691951
mov dword [esp + 0x11f8], 0x7740578
mov dword [esp + 0x11fc], 0x3660179
mov dword [esp + 0x1200], 0xf7d0d71
mov dword [esp + 0x1204], 0xb780945
mov dword [esp + 0x1208], 0x3534
mov byte [esp + 0x120c], 0
mov eax, 0x5bc1284
mov ecx, 0x1243ed7b
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x5bc0098]
mov edi, ecx
and edi, 0x12018d58
mov edx, eax
and edx, 0x43810a7
or edx, edi
xor edx, esi
mov esi, edx
xor esi, 0xdf29d3cd
add edx, edx
and edx, 0x242302d4
xor edx, 0xb6030690
sub edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + eax - 0x5bc0098], dl
inc eax
dec ecx
cmp eax, 0x5bc12a5
jne 0x428310
lea eax, [esp + 0x34]
lea esi, [esp + 0x11ec]
push 0
push 0
push 0x20019
push eax
push esi
call fcn.00444c40
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x44bfe0]

Function at 0x42a040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
xor ebp, ebp
mov dword [esp + 8], 0
mov dword [esp], 0x20219
mov eax, 1
mov dword [esp + 4], 0
jmp dword [eax*4 + 0x44c648]
Function at 0x42b070
Capabilities:
Copy file
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042b090
add esp, 4
test al, al
je 0x42ba10
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
push eax
mov dword [ebp - 0x2c], esp
sub esp, 0x24
mov esi, esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x40
mov dword [ebp - 0x18], esp
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], eax
push eax
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x28
mov dword [ebp - 0x40], esp
sub esp, 8
mov dword [ebp - 0xc8], esp
sub esp, 8
mov dword [ebp - 0xc4], esp
sub esp, 8
mov dword [ebp - 0x44], esp
sub esp, 0x24
mov dword [ebp - 0x48], esp
mov dword [ebp - 0xc0], 0x9780b5b
mov dword [ebp - 0xbc], 0x58a0785
mov dword [ebp - 0xb8], 0x176037b
mov dword [ebp - 0xb4], 0x1d4e1f74
mov dword [ebp - 0xb0], 0x19961b63
mov dword [ebp - 0xac], 0x15161760
mov eax, 0x74b62903
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax - 0x74b629c3]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xf1
mov byte [ebp + eax - 0x74b629c3], cl
inc eax
cmp eax, 0x74b6291b
jne 0x42bab0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xa8], 0x3d001dc
mov dword [ebp - 0xa4], 0x7c105c1
mov dword [ebp - 0xa0], 0xbd909c1
mov dword [ebp - 0x9c], 0xfdc0dd8
mov dword [ebp - 0x98], 0x13ce11c9
mov dword [ebp - 0x94], 0x17d715d9
mov dword [ebp - 0x90], 0x1bd219db
mov dword [ebp - 0x8c], 0x1fd01dd5
mov dword [ebp - 0x88], 0x23fe21e5
mov dword [ebp - 0x84], 0x27e925f7
mov dword [ebp - 0x80], 0x2bfe29ee
mov dword [ebp - 0x7c], 0x2fef2dfb
mov dword [ebp - 0x78], 0x33f731e2
mov dword [ebp - 0x74], 0x37e035e8
mov dword [ebp - 0x70], 0x3bd639d9
mov dword [ebp - 0x6c], 0x3fdb3dca
mov dword [ebp - 0x68], 0xc311c11c
mov dword [ebp - 0x64], 0xc723c530
mov dword [ebp - 0x60], 0xcb27c929
mov word [ebp - 0x5c], 0xcdcc
mov dword [ebp - 0x5a], 0
mov eax, 0x39a40
mov ecx, 0x6fbc65bf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebp + eax - 0x39ae8]
mov esi, ecx
and esi, 0x46b4202c
mov edx, eax
and edx, 0x312d3
or edx, esi
xor edx, 0xd3
or edx, edi
lea esi, [ecx - 0x6fbc6500]
and esi, edi
not edx
or edx, esi
add dl, 0xc0
mov byte [ebp + eax - 0x39ae8], dl
inc eax
dec ecx
cmp eax, 0x39a92
jne 0x42bba0
lea eax, [ebp - 0xc0]
lea edi, [ebp - 0xa8]
push eax
push edi
call fcn.0043c4c0
add esp, 8
mov ebx, eax
xor eax, eax
test ebx, ebx
sete al
jmp dword [eax*4 + 0x44c7b8]
Function at 0x42dba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [esp + 0x24], 0xc303c125
mov dword [esp + 0x28], 0xc756c554
mov dword [esp + 0x2c], 0xcb6bc90c
mov dword [esp + 0x30], 0xcf6fcd58
mov dword [esp + 0x34], 0xb30eb155
mov dword [esp + 0x38], 0xb719b57a
mov dword [esp + 0x3c], 0xbb1fb92c
mov dword [esp + 0x40], 0xbf1fbd2c
mov dword [esp + 0x44], 0xa349a104
mov dword [esp + 0x48], 0xa71aa54f
mov dword [esp + 0x4c], 0xab0fa93b
mov dword [esp + 0x50], 0xaf3dad3f
mov dword [esp + 0x54], 0x933d9139
mov dword [esp + 0x58], 0x9778953a
mov dword [esp + 0x5c], 0x9b379900
mov dword [esp + 0x60], 0x9f9e9d30
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0
mov ecx, 0xb0
mov edx, 0x4f
movzx ebx, byte [esp + ecx - 0x8c]
mov esi, ebx
not esi
or esi, edx
or ebx, ecx
and ebx, esi
add bl, 0x90
mov byte [esp + ecx - 0x8c], bl
inc ecx
dec edx
cmp ecx, 0xf4
jne 0x42dc40
lea ebx, [esp + 0x78]
lea edx, [esp + 0x24]
mov edi, ebx
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb8]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x74]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x450370]
mov edi, dword [esp + 0x74]
test edi, edi
jns 0x42dcac
mov eax, 0xffffffff
jmp 0x42dcaf
lea eax, [edi + edi]
push eax
call fcn.0040c880
add esp, 4
mov ebp, eax
push esi
push edi
push eax
push 0x1f
push ebx
push 0
call dword [0x450370]
lea eax, [esp + 0x18]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00444520
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ca10]
Function at 0x42f570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
cmp byte [ebx + eax], 0
lea eax, [eax + 1]
jne 0x42f590
add eax, ebx
dec eax
mov ecx, ebx
not ecx
and ecx, eax
xor eax, ebx
add ecx, ecx
sub ecx, eax
mov dword [esp + 4], ecx
lea ebp, [ecx + 1]
mov dword [esp + 8], ebp
push ebp
call fcn.0040c880
add esp, 4
mov dword [esp], esi
mov dword [esi], eax
mov ecx, ebp
shr ecx, 2
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebp
and edx, 0xfffffffc
add eax, edx
add edx, ebx
mov esi, ebp
and esi, 3
mov ecx, esi
shr ecx, 1
mov dword [esp + 0xc], edx
mov edi, eax
mov ebp, dword [esp + 0xc]
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov ebp, dword [esp + 8]
mov ecx, ebp
xor ecx, 2
and ecx, esi
je 0x42f612
and ebp, 2
add edx, ebp
add eax, ebp
push ecx
push edx
push eax
call fcn.0040c8b0
add esp, 0xc
cmp dword [esp + 4], 0
je 0x42f6cb
mov ecx, 0xffffffff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebx + eax]
xor edi, ecx
mov ecx, edi
shr ecx, 1
mov edx, edi
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov esi, edx
shr esi, 1
mov ecx, edi
shl ecx, 0x1e
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, esi
mov ebp, edi
shl ebp, 0x1d
sar ebp, 0x1f
and ebp, 0x76dc419
mov esi, edi
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, ebp
mov ebp, edi
shl ebp, 0x1b
sar ebp, 0x1f
and ebp, 0x1db71064
shl edi, 0x1a
sar edi, 0x1f
and edi, 0x3b6e20c8
xor edi, ebp
xor edi, esi
mov esi, ecx
shr esi, 6
xor edi, esi
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, edi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, edx
inc eax
cmp dword [esp + 4], eax
jne 0x42f630
not ecx
jmp 0x42f6cd
xor ecx, ecx
mov eax, dword [esp]
mov dword [eax + 4], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435310
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2c0
mov dword [esp + case.0x43075a.94], 0x44d264
mov dword [esp + 0xa0], 0
lea eax, [esp + 0xa0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x447a18
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x447a28
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2b4], eax
mov eax, dword [esp + 0x2b8]
mov ecx, dword [esp + 0x2b4]
mov eax, dword [eax + ecx*4]
mov dword [esp + case.0x43075a.96], 0x44d26c
mov dword [esp + case.0x43075a.98], 0x44d274
mov dword [esp + case.0x43075a.100], 0x44d27c
mov dword [esp + case.0x43075a.102], 0x44d284
mov dword [esp + case.0x43075a.102], 0x44d28c
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x284], 0xab
mov dword [esp + case.0x43075a.106], 0x44d294
mov dword [esp + case.0x43075a.106], 0x44d29c
mov dword [esp + case.0x43075a.110], 0x44d2a4
mov dword [esp + case.0x43075a.112], 0x44d2ac
mov dword [esp + case.0x43075a.112], 0x44d2b4
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x254], 0xb2
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x24c], 0xb2
mov dword [esp + case.0x43075a.116], 0x44d2bc
mov dword [esp + case.0x43075a.118], 0x44d2c4
mov dword [esp + case.0x43075a.120], 0x44d2cc
mov dword [esp + case.0x43075a.122], 0x44d2d4
mov dword [esp + case.0x43075a.124], 0x44d2dc
mov dword [esp + case.0x43075a.126], 0x44d2e4
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x214], 0xb9
mov dword [esp + case.0x43075a.128], 0x44d2ec
mov dword [esp + case.0x43075a.130], 0x44d2f4
mov dword [esp + case.0x43075a.132], 0x44d2fc
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x1f4], 0xbd
mov dword [esp + case.0x43075a.134], 0x44d304
mov dword [esp + case.0x43075a.136], 0x44d30c
mov dword [esp + case.0x43075a.138], 0x44d314
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x1d4], 0xc1
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x1cc], 0xc2
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x1c4], 0xc3
mov dword [esp + case.0x43075a.140], 0x44d31c
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x1b4], 0xc5
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x1ac], 0xc6
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x1a4], 0xc7
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x19c], 0xc8
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x194], 0xa9
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x18c], 0xac
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x184], 0xaf
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x17c], 0xb4
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x174], 0xb7
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x16c], 0xbb
mov dword [esp + case.0x42d47f.96], 0x44cb10
mov dword [esp + 0x164], 0xbe
xor edi, edi
jmp eax
Function at 0x436b70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.0040e190
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x436ba9
jmp 0x436d61
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x436be5
jmp 0x436d5b
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x436bf6
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call fcn.004321d0
add esp, 4
mov ecx, dword [ebp - 0x1c]
jmp 0x436c0c
jmp 0x436c0e
cmp eax, 0
setne dl
xor ebx, ebx
test dl, 1
jne 0x436c20
jmp 0x436d4f
mov ecx, eax
and ecx, 1
shl ecx, 1
mov dword [ebp - 0x18], eax
mov ebx, eax
xor ebx, 1
add ebx, ecx
sub esp, 4
mov dword [esp], ebx
call fcn.0040c880
add esp, 4
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
call fcn.0040d2b0
add esp, 0xc
mov al, byte [esi]
mov byte [ebp - 0x10], al
mov byte [edi], 0xcf
mov byte [edi + 1], 0x35
mov byte [edi + 2], 0x37
mov byte [edi + 3], 0x3f
mov byte [edi + 4], 0x2a
mov byte [edi + 5], 0x3e
mov byte [edi + 6], 0x23
mov byte [edi + 7], 0x35
mov byte [edi + 8], 0x24
mov byte [edi + 9], 0xf3
mov byte [edi + 0xa], 0x32
mov byte [edi + 0xb], 0xf
mov byte [edi + 0xc], 0x30
mov byte [edi + 0xd], 0x85
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x11
jne 0x436c9c
xor eax, eax
mov edx, dword [ebp - 0x18]
cmp eax, 0x11
jae 0x436d17
movzx ecx, byte [edi + eax]
mov esi, 0xa628425d
sub esi, eax
mov edx, 0xa628425d
sub edx, eax
or esi, edx
mov edx, eax
add edx, 0x59d7bda2
xor esi, 0xffffffff
or edx, esi
mov esi, edx
shl esi, 1
xor esi, 0xffffffff
mov ebx, edx
add ebx, esi
mov esi, edx
and esi, 0x971319fb
and ebx, 0x68ece604
or esi, ebx
xor esi, ecx
or edx, ecx
xor esi, 0xfb
and edx, esi
mov ebx, eax
add ebx, 0xa2
or ebx, ecx
xor edx, 0xffffffff
and ebx, edx
mov edx, dword [ebp - 0x18]
add bl, 0xd6
mov byte [edi + eax], bl
add eax, 1
jmp 0x436cad
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], edi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d410
mov bl, al
and bl, 1
jmp 0x436d37
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call fcn.0040c890
add esp, 4
mov ecx, dword [ebp - 0x1c]
jmp 0x436d4d
jmp 0x436d4f
sub esp, 4
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e210
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44e10c]

Function at 0x43e2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6d44c02c]
xor ecx, eax
mov edx, ecx
not edx
add ecx, 0x2257c0db
or edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax + 0x6d44c02c], cl
inc eax
cmp eax, 0x92bb3fd8
jne 0x43e2f0
mov edi, dword [esp]
mov eax, dword [0x450374]
test eax, eax
je 0x43e376
xor ecx, ecx
mov edx, dword [0x450378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43e350
inc ecx
cmp eax, ecx
jne 0x43e340
jmp 0x43e376
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43e376
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x45037c]
push eax
call fcn.00440f10
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xff3e393c
mov byte [esp + 4], 0
mov eax, 0x7302b58a
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7302b58a]
xor ecx, eax
mov edx, ecx
and edx, 0x4d
xor ecx, 0x4d
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x7302b58a], cl
inc eax
cmp eax, 0x7302b58f
jne 0x43e390
cmp edi, dword [esp]
jne 0x43e4c5
mov dword [esp + 0xc], esi
push dword [esp + 8]
call fcn.0043e1b0
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0xf4f5f6f7
mov edx, 0x92bb3fd4
nop
movzx ecx, byte [esp + edx + 0x6d44c02c]
xor ecx, edx
mov esi, ecx
not esi
add ecx, 0x2257c0db
or esi, ecx
and esi, 1
or ecx, 1
add ecx, esi
mov byte [esp + edx + 0x6d44c02c], cl
inc edx
cmp edx, 0x92bb3fd8
jne 0x43e3e0
mov edi, dword [esp]
mov edx, dword [0x450374]
test edx, edx
je 0x43e465
xor ecx, ecx
mov esi, dword [0x450378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0x9abdb589
je 0x43e440
inc ecx
cmp edx, ecx
jne 0x43e430
jmp 0x43e465
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0x43e465
push 0
push ebp
push eax
push 5
push 4
push dword [0x45037c]
push edx
mov esi, eax
call fcn.00440f10
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43e4bc
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43e495
add edi, 2
cmp si, bp
je 0x43e480
cmp si, bp
je 0x43e4a7
mov esi, dword [ecx]
test esi, esi
jne 0x43e470
mov edi, 0xc0000225
jmp 0x43e4bc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043e210
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4