joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc70
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push esi
sub esp, 0x14
call fcn.0043e390
test al, al
je 0x40cec1
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.00435b60
test al, al
je 0x40cebc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0x62a5106d
mov dword [esp + 0xc], 0x16184216
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40ccfe
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xfec6412d
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x1f
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40ccd0
mov dword [esp + 8], 0x2fbad6d
mov dword [esp + 0xc], 0x10e3467f
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40cd7a
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xc9be6ac6
and eax, 0xc9be6ac6
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
mov ecx, edx
xor ecx, eax
add ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x22
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40cd30
test esi, esi
je 0x40ce49
mov dword [esp + 8], 0x131211f1
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x40cde6
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xc2c952fc
and eax, 0xc2c952fc
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0xec
and eax, 0x13
add eax, eax
sub eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x40cda0
mov dword [esp + 8], 0xe10bb5df
mov dword [esp + 0xc], 0x4750448e
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40ce49
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xb63be722
and eax, 0x363be722
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x56
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40ce10
mov dword [esp + 8], 0x42454447
mov dword [esp + 0xc], 0x4e414043
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40cea9
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x80119cf1
and eax, 0x119cf1
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x4b
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40ce70
call fcn.0040df60
test al, al
je 0x40cebc
call fcn.00410be0
call fcn.0040f7b0
call fcn.0043f4f0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40ddb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov bl, byte [esp + 0x14]
call fcn.0040df50
test ebp, ebp
sets al
mov ecx, ebp
sub ecx, 1
sete cl
or al, cl
mov ecx, ebp
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x40dde8
jmp 0x40dded
jmp 0x40df40
movzx eax, bl
mov ecx, edi
mov edi, esi
add edi, ecx
add edi, 0xffffffff
mov byte [esi + ecx - 1], 0
cmp eax, 0
jne 0x40de11
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x40df3e
cmp ebp, 0xa
jne 0x40deb9
jmp 0x40de1c
movzx ecx, bl
cmp ecx, 0x64
jb 0x40de5e
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
shl edx, 1
mov al, byte [edx + 0x446761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x446760]
add esi, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
mov ebx, eax
mov edi, esi
jmp 0x40de1c
cmp ecx, 0xa
setb al
test al, 1
jne 0x40de6a
jmp 0x40de7b
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40deb4
mov eax, ecx
and eax, 0xfffffffd
mov edx, ecx
or edx, 0xfffffffd
xor edx, 0xffffffff
imul edx, eax
mov eax, ecx
and eax, 2
or ecx, 2
imul ecx, eax
add ecx, edx
mov al, byte [ecx + 0x446761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [ecx + 0x446760]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x40df3e
cmp ebp, 0x10
je 0x40dec0
jmp 0x40df03
movzx eax, bl
jmp 0x40dec5
cmp eax, 0x10
setl cl
test cl, 1
jne 0x40ded2
jmp 0x40dee3
mov al, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40df3e
shl eax, 1
mov cl, byte [eax + 0x44682a]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], cl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x40df3e
movzx ecx, bl
cmp ecx, 0
seta al
test al, 1
jne 0x40df12
jmp 0x40df3a
mov eax, ecx
xor edx, edx
div ebp
lea eax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
add eax, edx
mov al, byte [eax]
jmp 0x40df24
jmp 0x40df26
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebp
mov ebx, eax
mov edi, esi
jmp 0x40df03
mov esi, edi
jmp 0x40df3e
jmp 0x40df40
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40df60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a4
push eax
sub esp, 0x7c
mov dword [ebp - 0x24], esp
mov esi, dword [0x44e43c]
mov dword [ebp - 0x1b0], 0x4f4e7148
mov word [ebp - 0x1ac], 0
mov byte [ebp - 0x1aa], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 6
ja 0x40e011
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x1b0]
mov edx, ecx
xor edx, 0x1903de92
add ecx, ecx
and ecx, 0x3207bd24
mov edi, ecx
and edi, edx
xor ecx, edx
lea ecx, [ecx + edi*2]
mov edx, ecx
and edx, eax
add ecx, eax
add edx, edx
sub ecx, edx
mov dword [ebp - 0x130], ecx
mov eax, dword [ebp - 0x130]
mov ecx, eax
xor ecx, 0xda
and eax, 0x25
add eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x1b0], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 7
jb 0x40dfb0
mov ebx, dword [ebp - 0x1b0]
mov dword [ebp - 0x130], 0xe17de76d
mov dword [ebp - 0x12c], 0xdd7ae376
mov dword [ebp - 0x128], 0xd952df50
mov dword [ebp - 0x124], 0xd58cdb48
mov dword [ebp - 0x120], 0xd142d748
mov dword [ebp - 0x11c], 0xcdd2d344
mov word [ebp - 0x118], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x19
ja 0x40e0ad
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x130]
mov edx, eax
xor edx, 0x7665659
and eax, 0x7665659
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add al, 0x43
mov ecx, dword [ebp - 0x14]
mov byte [ebp + ecx - 0x130], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x1a
jb 0x40e070
mov eax, dword [0x448a3c]
mov ecx, 0x77098a0e
xor ecx, dword [0x448a40]
add eax, ecx
inc eax
jmp eax
Function at 0x410be0
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x118
mov esi, esp
push eax
push eax
mov dword [esi + 0x18], esp
sub esp, 0x24
mov dword [esi + 0x10], esp
push eax
mov dword [esi + 0x64], esp
push eax
mov dword [esi + 0x8c], esp
sub esp, 0x68
mov dword [esi + 0x14], esp
sub esp, 0x10
mov dword [esi + 0x88], esp
sub esp, 0x208
mov dword [esi + 0x84], esp
sub esp, 8
mov dword [esi + 0x24], esp
sub esp, 8
mov dword [esi + 0x6c], esp
sub esp, 8
mov dword [esi + 0x70], esp
sub esp, 8
mov edx, esp
sub esp, 0x68
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
sub esp, 0x64
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x60], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x5c], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x58], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x54], eax
mov esp, eax
push eax
sub esp, 0xfc
mov dword [esi + 0x20], esp
sub esp, 8
mov dword [esi + 0x30], esp
sub esp, 8
mov dword [esi + 0x50], esp
sub esp, 0x24
mov dword [esi + 0x28], esp
push eax
mov dword [esi + 0x40], esp
push eax
mov dword [esi + 0x3c], esp
sub esp, 0x68
mov dword [esi + 0x34], esp
sub esp, 0x10
mov ecx, esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x4c], eax
mov esp, eax
push eax
sub esp, 8
mov eax, esp
sub esp, 0x800
mov dword [esi + 0x2c], esp
sub esp, 0x80
mov dword [esi + 0x68], esp
mov dword [esi + 0x74], edx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x7c], eax
sub esp, 0x44
mov dword [esi + 0x78], esp
sub esp, 0x10
mov dword [esi + 0x38], esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x449640]
Function at 0x41a1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xaa8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41a1e0
sar esi, 1
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f750]
mov ebx, dword [esp + 0x24]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41a214
mov eax, 0xffffffff
jmp 0x41a217
lea eax, [ebx + ebx]
push eax
call fcn.0040c580
add esp, 4
lea ecx, [esp + 0x24]
push ecx
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44f750]
mov eax, dword [esp + 0x24]
mov ecx, eax
add ecx, 0xd
js 0x41a247
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c580
add esp, 4
mov edi, eax
mov dword [esp + 0x1f8], 0x13e611f4
mov dword [esp + 0x1fc], 0x1f8d1dfd
mov dword [esp + 0x200], 0x1b3a1984
mov dword [esp + 0x204], 0x7eb05fa
mov dword [esp + 0x208], 0x3910192
mov dword [esp + 0x20c], 0xf990de5
mov dword [esp + 0x210], 0xb0a099e
mov word [esp + 0x214], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x48]
cmp eax, 0x1d
ja 0x41a317
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
movzx ecx, byte [esp + ecx + 0x1f8]
mov edx, eax
xor edx, 0x568653c4
and eax, 0xd68653c4
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x698], eax
mov eax, dword [esp + 0x698]
mov ecx, eax
not ecx
and ecx, 0xd4
and eax, 0x2b
sub eax, ecx
mov ecx, dword [esp + 0x48]
mov byte [esp + ecx + 0x1f8], al
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp eax, 0x1e
jb 0x41a2c0
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x41a341
lea edx, [ebx + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a330
mov word [eax], 0
movzx ecx, word [esp + 0x1f8]
test cx, cx
mov dword [esp + 0x1c], ebx
je 0x41a371
lea edx, [esp + 0x1fa]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a360
mov word [eax], 0
lea eax, [esp + 0x638]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00442ec0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449fa8]
Function at 0x41e690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x40]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x41e6a0
sar ebp, 1
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44f750]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41e6cf
mov eax, 0xffffffff
jmp 0x41e6d2
lea eax, [edi + edi]
push eax
call fcn.0040c580
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44f750]
lea ebx, [esp + 0x14]
push ebx
push esi
call fcn.00443080
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a2e4]

Function at 0x4202d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4202e0
cmp eax, 0xffffffed
jge 0x4202f7
mov eax, 0xffffffff
jmp 0x4202fa
add eax, 0x12
push eax
call fcn.0040c580
add esp, 4
mov esi, eax
mov dword [esp + 4], 0xd163cf10
mov dword [esp + 8], 0xd569d377
mov dword [esp + 0xc], 0xd938d720
mov dword [esp + 0x10], 0xdd78db7c
mov word [esp + 0x14], 0xdfdc
mov dword [esp + 0x16], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x15
ja 0x420389
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xe5e94c2d
and eax, 0xe5e94c2d
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0x1f
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x16
jb 0x420350
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4203b1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4203a0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x4203e1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4203d0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00443080
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x44a3b4]
Function at 0x427370
Capabilities:
Copy file
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00427390
add esp, 4
test al, al
je 0x427bb0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
xor edi, edi
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x44b578]
Function at 0x42a210
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [0x44f750]
mov dword [esp + 0x20], 0x81c587eb
mov dword [esp + 0x24], 0x8d328330
mov dword [esp + 0x28], 0x892d8fc0
mov dword [esp + 0x2c], 0x95298b34
mov dword [esp + 0x30], 0x913297fb
mov dword [esp + 0x34], 0x9d2393c6
mov dword [esp + 0x38], 0x99319f20
mov dword [esp + 0x3c], 0xe5399b28
mov dword [esp + 0x40], 0xe193e748
mov dword [esp + 0x44], 0xed46e395
mov dword [esp + 0x48], 0xe941ef51
mov dword [esp + 0x4c], 0xf557eb55
mov dword [esp + 0x50], 0xf147f75f
mov dword [esp + 0x54], 0xfd84f346
mov dword [esp + 0x58], 0xf949ff44
mov dword [esp + 0x5c], 0xc5fafb4c
mov dword [esp + 0x60], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x43
ja 0x42a320
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x20]
mov esi, ecx
xor esi, 0xf92a2621
add ecx, ecx
and ecx, 0xf2544c42
mov edi, ecx
and edi, esi
xor ecx, esi
lea ecx, [ecx + edi*2]
lea esi, [ecx + edx]
and ecx, edx
mov edx, esi
not edx
and edx, ecx
add edx, ecx
not ecx
and ecx, esi
sub ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
mov edx, ecx
xor edx, 0xa5
and ecx, 0x5a
add ecx, ecx
sub ecx, edx
mov edx, dword [esp]
mov byte [esp + edx + 0x20], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x44
jb 0x42a2c0
lea esi, [esp + 0x7c]
lea ecx, [esp + 0x20]
push esi
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov edi, dword [esp + 0x7c]
test edi, edi
jns 0x42a343
mov eax, 0xffffffff
jmp 0x42a346
lea eax, [edi + edi]
push eax
call fcn.0040c580
add esp, 4
mov ebp, eax
mov eax, dword [0x44f750]
mov dword [esp + 0x20], 0x77370965
mov dword [esp + 0x24], 0x73e275e4
mov dword [esp + 0x28], 0x7fdf713c
mov dword [esp + 0x2c], 0x7bdb7de0
mov dword [esp + 0x30], 0x67c27915
mov dword [esp + 0x34], 0x63f165d6
mov dword [esp + 0x38], 0x6fc361fc
mov dword [esp + 0x3c], 0x6bcb6dfc
mov dword [esp + 0x40], 0x570169c4
mov dword [esp + 0x44], 0x53f65503
mov dword [esp + 0x48], 0x5ff351cf
mov dword [esp + 0x4c], 0x5bc55dc3
mov dword [esp + 0x50], 0x47d559f1
mov dword [esp + 0x54], 0x431045d6
mov dword [esp + 0x58], 0x4fdb41d8
mov dword [esp + 0x5c], 0x4b4a4dd8
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x3f
ja 0x42a42b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x20]
mov ebx, ecx
xor ebx, 0xc21fef3e
and ecx, 0xc21fef3e
lea ecx, [ebx + ecx*2]
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xca
mov edx, dword [esp]
mov byte [esp + edx + 0x20], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x40
jb 0x42a3f0
push esi
push edi
push ebp
push 0x1f
lea ecx, [esp + 0x30]
push ecx
push 0
call eax
lea eax, [esp + 0x64]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00442ec0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b848]
movsb byte es:[edi], byte [esi]
Function at 0x432d80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0040df50
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x432db9
jmp 0x432edf
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x432ed9
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.0040c690
add esp, 4
mov edx, eax
xor ebx, ebx
cmp edx, 0
je 0x432eca
mov al, byte [edi]
mov byte [ebp - 0x14], al
mov byte [esi], 0xdf
mov byte [esi + 1], 0xf5
mov byte [esi + 2], 0xf7
mov byte [esi + 3], 0xef
mov byte [esi + 4], 0xfa
mov byte [esi + 5], 0xee
mov byte [esi + 6], 0xc3
mov byte [esi + 7], 0xd5
mov byte [esi + 8], 0xc4
mov byte [esi + 9], 0x93
mov byte [esi + 0xa], 0xd2
mov byte [esi + 0xb], 0xdf
mov byte [esi + 0xc], 0xd0
mov byte [esi + 0xd], 0xa5
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x11
jne 0x432e5c
jmp 0x432e6a
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x11
jae 0x432ea8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov edi, edx
call fcn.00435ae0
mov edx, edi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x432e71
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d0c0
mov bl, al
and bl, 1
jmp 0x432ec8
jmp 0x432eca
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4382c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x4382e0
mov dword [esp + 4], 0xcecec8bf
mov byte [esp + 8], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 4
ja 0x438340
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
add esi, 0xbbbfe632
xor esi, edi
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0xc]
add bl, 6
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 5
jb 0x438310
test edx, edx
je 0x4383ae
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x438371
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x438360
cmp edi, 3
jb 0x4383ae
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x438380
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c600
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0xb9babb54
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x43c66b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0x772ebdf
and ecx, 0x772ebdf
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xa5
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x43c630
mov ecx, dword [esp + 4]
mov ecx, dword fs:[ecx]
mov edx, dword [0x44d2d0]
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx

Function at 0x43c6c0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44d308]