joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4107e0
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xca8
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
shr eax, 0x1f
jmp dword [eax*4 + 0x449348]

Function at 0x41c950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1120
call fcn.0040c680
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41c970
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f224]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41c9a4
mov eax, 0xffffffff
jmp 0x41c9a7
lea eax, [ebx + ebx]
push eax
call fcn.0040c720
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x20], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44f224]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x41c9dc
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c720
add esp, 4
mov ebx, eax
mov dword [esp + 0x11c], 0x13c611b4
mov dword [esp + 0x120], 0xef5ded4d
mov dword [esp + 0x124], 0xeb0ae964
mov dword [esp + 0x128], 0xe75be54a
mov dword [esp + 0x12c], 0xe351e152
mov dword [esp + 0x130], 0xff49fd45
mov dword [esp + 0x134], 0xfbfaf94e
mov byte [esp + 0x138], 0
mov eax, 0xa91494fc
mov ecx, 3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x56eb6c20]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
add esi, 0xb2991713
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax + 0x56eb6c20], dl
inc eax
dec ecx
cmp eax, 0xa9149519
jne 0x41ca50
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x41cab1
mov eax, dword [esp + 0x18]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41caa0
mov word [eax], 0
movzx ecx, word [esp + 0x11c]
test cx, cx
je 0x41cae1
lea edx, [esp + 0x11e]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cad0
mov word [eax], 0
lea eax, [esp + 0xa8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.004434d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a270]
Function at 0x41f550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x41f64a
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x41f588
mov esi, ebx
mov ecx, dword [esp + 0x1c]
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x41f64c
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.00421ba0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.00421ba0
add esp, 4
mov bl, al
movzx eax, al
mov ecx, eax
not ecx
or ecx, 0x30
add eax, ecx
inc eax
movzx ecx, bh
shr eax, 4
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], al
inc esi
cmp edi, ecx
jae 0x41f574
movzx eax, byte [ebp + edi]
push eax
call fcn.00421ba0
add esp, 4
cmp al, 0x40
je 0x41f570
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
mov edx, esi
and edx, 1
mov ebx, esi
xor ebx, 1
lea ebx, [ebx + edx*2]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], cl
lea ecx, [edi + 1]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
jae 0x41f641
mov byte [esp + 3], al
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.00421ba0
add esp, 4
cmp al, 0x40
je 0x41f56e
movzx ecx, byte [esp + 3]
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x20]
mov byte [ecx + ebx], al
inc ebx
jmp 0x41f56e
mov ecx, edx
mov esi, ebx
jmp 0x41f574
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x422dd0
sar ebp, 1
lea eax, [esp + 8]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44f224]
mov edi, dword [esp + 8]
test edi, edi
jns 0x422dff
mov eax, 0xffffffff
jmp 0x422e02
lea eax, [edi + edi]
push eax
call fcn.0040c720
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44f224]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.00443670
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a6b4]
Function at 0x424980
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x424990
cmp eax, 0xffffffed
jge 0x4249a7
mov eax, 0xffffffff
jmp 0x4249aa
add eax, 0x12
push eax
call fcn.0040c720
add esp, 4
mov esi, eax
mov dword [esp], 0x3e901dc
mov dword [esp + 4], 0x7ff05e1
mov dword [esp + 8], 0xb24093c
mov dword [esp + 0xc], 0xfec0de8
mov word [esp + 0x10], 0x1110
mov dword [esp + 0x12], 0
mov eax, 0x86028c0
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x86028c0]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
lea edx, [eax + ecx]
add ecx, eax
add ecx, 0x3f
not edx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0x86028c0], cl
inc eax
cmp eax, 0x86028d6
jne 0x4249f0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x424a51
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x424a40
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424a81
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424a70
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00443670
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44a77c]
Function at 0x427370
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp + 4], 0xd182cfeb
mov dword [esp + 8], 0xd5b7d3a1
mov dword [esp + 0xc], 0xd9bad7b7
mov dword [esp + 0x10], 0xddaadb9b
mov dword [esp + 0x14], 0xe19adfac
mov dword [esp + 0x18], 0xe596e383
mov dword [esp + 0x1c], 0xe9c1e787
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0xebe8
mov dword [esp + 0x22], 0
mov ecx, 0xdab26a3
mov edx, 0x1b564d46
nop
movzx esi, byte [esp + ecx - 0xdab269f]
mov edi, edx
and edi, 0x56089a
mov ebx, ecx
xor ebx, 0x806bd54d
add edi, ebx
add edi, 0xf254d95d
xor edi, esi
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
add bl, 0x7e
mov byte [esp + ecx - 0xdab269f], bl
inc ecx
add edx, 2
cmp ecx, 0xdab26c5
jne 0x4273d0
lea ebx, [esp + 0x72]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x54]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x44f224]
mov esi, dword [esp + 0x54]
mov edi, 0xffffffff
test esi, esi
jns 0x427461
mov eax, 0xffffffff
jmp 0x427464
lea eax, [esi + esi]
push eax
call fcn.0040c720
add esp, 4
push ebp
push esi
mov dword [esp + 8], eax
push eax
push 0xe
push ebx
push 0
call dword [0x44f224]
mov eax, dword [esp + 0x54]
mov ecx, eax
add ecx, 9
js 0x427491
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040c720
add esp, 4
mov edi, eax
mov dword [esp + 4], 0x895a8b28
mov dword [esp + 8], 0x853b8737
mov dword [esp + 0xc], 0x813d8331
mov dword [esp + 0x10], 0x9d259f39
mov dword [esp + 0x14], 0x999a9b11
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov eax, 0x1de8b9e3
mov ecx, 0x6217461c
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x1de8b9df]
mov ebx, ecx
and ebx, 0x42110089
mov edx, eax
and edx, 0x1de8b376
or edx, ebx
xor edx, esi
xor edx, 0xc2110889
add edx, 0xea745e90
mov esi, edx
xor esi, 0x7e
mov ebx, edx
or ebx, 1
and ebx, esi
xor edx, 1
lea edx, [edx + ebx*2]
mov byte [esp + eax - 0x1de8b9df], dl
inc eax
dec ecx
cmp eax, 0x1de8b9fa
jne 0x4274e0
mov eax, dword [esp]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x427551
mov eax, dword [esp]
lea edx, [eax + 2]
mov eax, edi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427540
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x427581
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427570
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.00443670
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44aeb4]
Function at 0x4279c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0xd10dcf2b
mov dword [esp + 8], 0xd562d360
mov dword [esp + 0xc], 0xd975d710
mov dword [esp + 0x10], 0xdd79db6c
mov dword [esp + 0x14], 0xa102df3b
mov dword [esp + 0x18], 0xa50aa374
mov dword [esp + 0x1c], 0xa908a713
mov dword [esp + 0x20], 0xad0dab0c
mov dword [esp + 0x24], 0xb10caf1e
mov dword [esp + 0x28], 0xb500b31b
mov dword [esp + 0x2c], 0xb96ab710
mov dword [esp + 0x30], 0xbd08bb68
mov dword [esp + 0x34], 0x8118bf0d
mov dword [esp + 0x38], 0x852e832b
mov dword [esp + 0x3c], 0x89338723
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0x8b88
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
mov ecx, 0x2d
nop
movzx esi, byte [esp + ecx - 0x29]
mov edx, ecx
and edx, esi
mov edi, edx
and edi, 0xfffffffd
mov ebx, edx
and ebx, 2
or edx, 2
imul edx, ebx
xor ebx, 2
imul ebx, edi
add edx, ebx
add esi, ecx
add esi, 0xd6024100
mov edi, edx
xor edi, esi
not edx
and edx, esi
add edx, edx
sub edx, edi
add dl, 0x1f
mov byte [esp + ecx - 0x29], dl
inc ecx
cmp ecx, 0x70
jne 0x427a60
lea esi, [esp + 0x4a]
lea ebp, [esp + 4]
mov edx, ebp
mov ecx, 0xf
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44f224]
mov ebx, dword [esp]
test ebx, ebx
jns 0x427aea
mov eax, 0xffffffff
jmp 0x427aed
lea eax, [ebx + ebx]
push eax
call fcn.0040c720
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0x1e
lea eax, [esp + 0x5a]
push eax
push 0
call dword [0x44f224]
mov dword [esp + 4], 0xd166cf18
mov dword [esp + 8], 0xd57cd367
mov dword [esp + 0xc], 0xd971d770
mov dword [esp + 0x10], 0xdd78db6a
mov dword [esp + 0x14], 0xa16cdf77
mov dword [esp + 0x18], 0xa5a2a304
mov word [esp + 0x1c], 0
mov eax, 0xd2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebp]
lea edx, [eax - 0x2224aa00]
or edx, ecx
not edx
and ecx, eax
or ecx, edx
add ecx, 0x5548b21e
mov edx, ecx
xor edx, 0x4c
and ecx, 0x33
add ecx, ecx
sub ecx, edx
add cl, 0x4d
mov byte [ebp], cl
inc ebp
dec eax
cmp eax, 0xb8
jne 0x427b50
lea eax, [esp + 4]
push 0
push 0
push eax
push esi
push dword [esp + 0xac]
call fcn.00422dc0
add esp, 0x14
jmp dword [0x44aeec]
Function at 0x429790
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
mov dword [esp + 8], 0
mov dword [esp], 0
mov esi, 0x20219
mov eax, 1
xor edi, edi
jmp dword [eax*4 + 0x44b510]

Function at 0x42a110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
movzx eax, word [esi]
test ax, ax
je 0x42a273
mov edx, dword [esp + 0x1c]
dec edx
je 0x42a273
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42a160
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x42a210
cmp ebx, 0x7ff
ja 0x42a190
cmp edx, 2
jb 0x42a190
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x42a210
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x42a238
cmp edx, 4
jb 0x42a238
movzx eax, word [esi + 2]
mov dword [esp], eax
add esi, 4
shl ebx, 0xa
and ebx, 0x9ffc00
lea ecx, [ebx + eax]
add ecx, 0xffff2400
add eax, ebx
add eax, 0x2400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
shr eax, 0xc
mov edi, eax
xor edi, 0xc0
or eax, 0x3f
and eax, edi
add al, 0x80
mov byte [ebp + 1], al
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
mov eax, dword [esp]
and al, 0x3f
or al, 0x80
mov ecx, eax
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
mov ecx, eax
sub ecx, ebp
mov esi, edx
not esi
and esi, ecx
not ecx
and ecx, edx
sub ecx, esi
mov esi, edi
mov ebp, eax
mov edx, ecx
movzx eax, word [esi]
test ax, ax
je 0x42a273
test edx, edx
jne 0x42a140
jmp 0x42a273
movzx eax, ax
cmp eax, 0xdc00
jne 0x42a246
mov esi, edi
jmp 0x42a226
cmp edx, 3
jb 0x42a26f
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
lea eax, [ebp + 3]
jmp 0x42a210
mov eax, ebp
jmp 0x42a210
mov byte [ebp], 0
sub ebp, dword [esp + 0x18]
mov eax, ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42a6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x3f601f3
mov dword [esp + 0x58], 0x7e705e1
mov dword [esp + 0x5c], 0xb2409e5
mov dword [esp + 0x60], 0xff60de9
mov dword [esp + 0x64], 0x131211f5
mov word [esp + 0x68], 0
mov eax, 0x86028c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x860286c]
mov edx, eax
and edx, esi
mov edi, edx
or edi, 0xfffffffd
inc edi
mov ecx, edx
and ecx, 0xffffffdd
imul ecx, edi
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
add ecx, esi
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x3f
xor ecx, 0xd61f343f
lea edx, [ecx + edx*2]
and ecx, 1
or edx, 1
add edx, ecx
mov byte [esp + eax - 0x860286c], dl
inc eax
cmp eax, 0x86028d6
jne 0x42a720
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push eax
call fcn.0043d700
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44b5a8]
Function at 0x42cff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc4
mov dword [esp + 0x24], 0x77b77985
mov dword [esp + 0x28], 0x73c275c4
mov dword [esp + 0x2c], 0x4fef71ac
mov dword [esp + 0x30], 0x4beb4dc0
mov dword [esp + 0x34], 0x47e249b5
mov dword [esp + 0x38], 0x43f14596
mov dword [esp + 0x3c], 0x5fe341cc
mov dword [esp + 0x40], 0x5bfb5dec
mov dword [esp + 0x44], 0x57a159e4
mov dword [esp + 0x48], 0x53f655a3
mov dword [esp + 0x4c], 0x2f9351df
mov dword [esp + 0x50], 0x2ba52da3
mov dword [esp + 0x54], 0x27952991
mov dword [esp + 0x58], 0x23d02596
mov dword [esp + 0x5c], 0x3f8b21a8
mov dword [esp + 0x60], 0x3b3a3d88
lea eax, [esp + 0x64]
mov byte [esp + 0x64], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x96
xor dl, byte [esp + ecx + 0x24]
add dl, 0x12
mov byte [esp + ecx + 0x24], dl
inc ecx
cmp ecx, 0x41
jne 0x42d090
lea ebx, [esp + 0x84]
lea edx, [esp + 0x24]
mov edi, ebx
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xc4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x80]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x44f224]
mov edi, dword [esp + 0x80]
test edi, edi
jns 0x42d0f5
mov eax, 0xffffffff
jmp 0x42d0f8
lea eax, [edi + edi]
push eax
call fcn.0040c720
add esp, 4
mov ebp, eax
push esi
push edi
push eax
push 0x1f
push ebx
push 0
call dword [0x44f224]
lea eax, [esp + 0x20]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x8c], ebp
push ebp
call fcn.004434d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b8c8]
Function at 0x42e710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42e76a
cmp edi, 1
je 0x42e76a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42e741
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42e740
cmp ecx, 0x20
je 0x42e740
cmp ecx, 0x2b
mov edx, edi
je 0x42e760
cmp ecx, 0x2d
jne 0x42e77f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42e784
xor edi, edi
test eax, eax
je 0x42e93d
mov dword [eax], 0x16
jmp 0x42e93d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42e7ad
cmp edx, 0x10
jne 0x42e7c5
cmp byte [ebx], 0x30
jne 0x42e7a6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42e7c7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42e7c7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42e820
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42e8d8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42e847
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42e908
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42e908
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42e800
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42e890
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42e899
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42e8bd
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42e8ed
test bl, bl
jne 0x42e8ed
mov ebx, dword [esp + 0x10]
jmp 0x42e813
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42e7f5
mov esi, edi
test bl, bl
jne 0x42e8fb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42e7f5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42e916
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42e924
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42e934
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42e93d
cmp byte [esp + 3], 0
jne 0x42e93d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42e950
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov esi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
xor ebp, ebp
nop
nop
nop
nop
nop
nop
cmp byte [ebx + ebp], 0
lea ebp, [ebp + 1]
jne 0x42e970
push ebp
call fcn.0040c720
add esp, 4
mov dword [esp + 8], esi
mov dword [esi], eax
mov ecx, ebp
shr ecx, 2
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebp
and edx, 0xfffffffc
add eax, edx
add edx, ebx
mov ecx, ebp
and ecx, 3
mov esi, ecx
not esi
or esi, 1
add esi, ecx
shr ecx, 1
mov dword [esp + 4], edx
mov dword [esp], eax
mov edi, eax
mov eax, dword [esp + 4]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
inc esi
je 0x42e9dc
mov eax, ebp
and eax, 2
add edx, eax
mov ecx, dword [esp]
add ecx, eax
push esi
push edx
push ecx
call fcn.0040c750
add esp, 0xc
xor ecx, ecx
cmp ebp, 1
je 0x42ea95
mov eax, 1
sub eax, ebp
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebx]
xor edi, ecx
mov ecx, edi
shr ecx, 1
mov edx, edi
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov esi, edx
shr esi, 1
mov ecx, edi
shl ecx, 0x1e
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, esi
mov ebp, edi
shl ebp, 0x1d
sar ebp, 0x1f
and ebp, 0x76dc419
mov esi, edi
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, ebp
mov ebp, edi
shl ebp, 0x1b
sar ebp, 0x1f
and ebp, 0x1db71064
shl edi, 0x1a
sar edi, 0x1f
and edi, 0x3b6e20c8
xor edi, ebp
xor edi, esi
mov esi, ecx
shr esi, 6
xor edi, esi
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, edi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, edx
inc ebx
inc eax
jne 0x42ea00
not ecx
mov eax, dword [esp + 8]
mov dword [eax + 4], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435680
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4357e9
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
xor ebx, ebx
cmp esi, 0
je 0x4357e1
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.004317e0
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x4357d5
mov ebx, edi
add ebx, 1
mov dword [esp], ebx
call fcn.0040c720
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.0042a110
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0xd3
mov byte [esp + 0x15], 0x85
mov byte [esp + 0x16], 0xfb
mov byte [esp + 0x17], 0x83
mov byte [esp + 0x18], 0xfe
mov byte [esp + 0x19], 0x8a
mov byte [esp + 0x1a], 0xff
mov byte [esp + 0x1b], 0x8d
mov byte [esp + 0x1c], 0xf4
mov byte [esp + 0x1d], 0xcf
mov byte [esp + 0x1e], 0x86
mov byte [esp + 0x1f], 0x83
mov byte [esp + 0x20], 0x98
mov byte [esp + 0x21], 5
mov eax, 0xe
mov ebp, dword [esp + 0x28]
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x12
jne 0x435776
jmp 0x435785
jmp 0x435787
xor eax, eax
cmp eax, 0x12
jae 0x4357a5
mov cl, byte [esp + eax + 0x14]
mov dl, al
add dl, 0xc4
xor dl, cl
add dl, 0x2c
mov byte [esp + eax + 0x14], dl
add eax, 1
jmp 0x435789
jmp 0x4357a7
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], edi
call fcn.0040d3e0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x4357c9
mov dword [esp], ebp
call fcn.0040c730
jmp 0x4357d3
jmp 0x4357d5
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4357e9
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43aa10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + edx + 2], 0
lea edx, [edx + 2]
jne 0x43aa30
mov dword [esp], 0xdedadc51
mov dword [esp + 4], 0
xor ebx, ebx
nop
nop
nop
nop
mov ecx, ebx
add cl, 0xaf
xor cl, byte [esp + ebx]
add cl, 0x95
mov byte [esp + ebx], cl
inc ebx
cmp ebx, 8
jne 0x43aa50
test edx, edx
je 0x43aacb
mov esi, dword [esp]
sar edx, 1
lea ecx, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x43aa91
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
movzx eax, word [edi]
add edi, 2
xor eax, ebp
imul eax, esi
dec edx
mov ebp, eax
dec ebx
jne 0x43aa80
cmp ecx, 3
jb 0x43aacb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [edi]
xor ecx, eax
imul ecx, esi
movzx eax, word [edi + 2]
xor eax, ecx
imul eax, esi
movzx ecx, word [edi + 4]
xor ecx, eax
imul ecx, esi
movzx eax, word [edi + 6]
xor eax, ecx
imul eax, esi
add edi, 8
add edx, 0xfffffffc
jne 0x43aaa0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret