joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
movzx ecx, byte [edx]
mov ebp, esi
test cl, cl
je 0x40f34b
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
dec edi
mov ebp, esi
jmp 0x40f131
inc edx
lea eax, [ebp + 2]
mov word [ebp], bx
mov ecx, eax
sub ecx, ebp
sar ecx, 1
sub edi, ecx
mov ebp, eax
mov eax, dword [esp + 0x28]
movzx ecx, byte [edx]
test cl, cl
je 0x40f34b
test eax, eax
je 0x40f13d
cmp edx, eax
jae 0x40f34b
test edi, edi
je 0x40f34b
movzx ebx, cl
test cl, cl
jns 0x40f110
mov eax, ebx
not eax
or eax, 0xe0
add eax, ebx
cmp eax, 0xbf
jne 0x40f189
cmp cl, 0xc2
jb 0x40f122
movzx ecx, byte [edx + 1]
movzx esi, cl
mov eax, esi
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40f1eb
and ebx, 0x1f
shl ebx, 6
add edx, 2
and esi, 0x3f
or esi, ebx
jmp 0x40f237
mov eax, ebx
and eax, 0xfffffff0
cmp eax, 0xe0
jne 0x40f1b6
movzx eax, byte [edx + 1]
cmp cl, 0xed
je 0x40f1f1
cmp ebx, 0xe0
jne 0x40f1f9
mov ecx, eax
add al, 0x40
cmp al, 0xe0
mov eax, ecx
jb 0x40f122
jmp 0x40f1f9
mov eax, ebx
and eax, 0xfffffff8
cmp eax, 0xf0
jne 0x40f31d
cmp cl, 0xf4
ja 0x40f122
movzx ecx, byte [edx + 1]
je 0x40f247
cmp ebx, 0xf0
jne 0x40f250
mov eax, ecx
add al, 0x40
cmp al, 0xd0
jb 0x40f122
jmp 0x40f250
inc edx
jmp 0x40f32d
cmp al, 0x9f
ja 0x40f122
mov dword [esp], eax
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40f324
movzx ecx, byte [edx + 2]
movzx esi, cl
mov eax, esi
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40f32a
shl ebx, 0xc
mov eax, dword [esp]
and eax, 0x3f
shl eax, 6
or eax, ebx
add edx, 3
and esi, 0x3f
or esi, eax
lea eax, [ebp + 2]
mov word [ebp], si
mov esi, dword [esp + 0x1c]
jmp 0x40f118
cmp cl, 0x8f
ja 0x40f122
mov eax, ecx
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40f324
mov dword [esp], ecx
movzx ecx, byte [edx + 2]
movzx eax, cl
mov esi, eax
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f32a
movzx ecx, byte [edx + 3]
mov esi, ecx
xor esi, 0xffffff3f
mov dword [esp + 4], ecx
or ecx, 0xc0
and ecx, esi
cmp ecx, 0x80
jne 0x40f33f
shl ebx, 0x12
mov ecx, dword [esp]
and ecx, 0x3f
shl ecx, 0xc
or ecx, ebx
and eax, 0x3f
shl eax, 6
add eax, ecx
add eax, 0xfc400000
add edx, 4
mov ecx, eax
and ecx, 0x1ff800
cmp ecx, 0xd800
mov esi, dword [esp + 0x1c]
je 0x40f122
mov ecx, dword [esp + 4]
and ecx, 0x3f
or ecx, eax
cmp ecx, 0x10000
jb 0x40f122
cmp edi, 2
jb 0x40f31d
add eax, 0xf0000
shr eax, 0xa
and eax, 0x3ff
or eax, 0xd800
mov word [ebp], ax
and ecx, 0x3ff
or ecx, 0xdc00
lea eax, [ebp + 4]
mov word [ebp + 2], cx
jmp 0x40f118
mov eax, ebp
jmp 0x40f118
inc edx
jmp 0x40f122
add edx, 2
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
test cl, cl
jne 0x40f131
jmp 0x40f34b
add edx, 3
mov esi, dword [esp + 0x1c]
jmp 0x40f122
mov word [ebp], 0
sub ebp, esi
sar ebp, 1
mov eax, ebp
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4110e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
shr eax, 0x1f
jmp dword [eax*4 + 0x44a3a0]

Function at 0x41d280
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax], 0
lea eax, [eax + 2]
jne 0x41d2a0
add eax, ebp
add eax, 0xfffffffe
mov edi, ebp
not edi
and edi, eax
xor eax, ebp
add edi, edi
sub edi, eax
mov esi, dword [ecx + 4]
add al, 0x31
rcl byte [eax - 0x6f6f6f70], 0x90
Function at 0x41ff30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x420033
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x41ff79
mov edx, dword [esp + 0x1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x420035
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.00422410
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.00422410
mov edx, dword [esp + 0x20]
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea ecx, [esi + 1]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
cmp edi, edx
jae 0x41ff60
movzx eax, byte [ebp + edi]
push eax
call fcn.00422410
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x41ff60
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov dword [esp], ebx
mov ebx, dword [esp + 0x20]
mov byte [ebx + esi + 1], cl
lea ecx, [edi + 1]
cmp ecx, edx
jae 0x41ff60
mov ebx, eax
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.00422410
add esp, 4
cmp al, 0x40
je 0x41ff4e
shl bl, 6
add al, bl
mov ecx, esi
and ecx, 1
mov edx, dword [esp]
xor edx, 1
lea edx, [edx + ecx*2]
mov dword [esp], edx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 2], al
jmp 0x41ff4e
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x425070
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84
mov eax, dword [esp + 0xa0]
mov ebx, dword [esp + 0x9c]
mov ecx, dword [eax + 4]
mov eax, 0xfffffffe
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x425090
mov ecx, 0xfffffffe
cmp word [ebx + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x4250a0
sar eax, 1
sar ecx, 1
lea edx, [eax + ecx]
add edx, 0x3f
test edx, edx
jns 0x4250c0
mov eax, 0xffffffff
jmp 0x4250c9
add eax, ecx
lea eax, [eax*2 + 0x7e]
push eax
call fcn.0040cd40
add esp, 4
mov esi, eax
mov dword [esp + 0x44], 0x77eb09aa
mov dword [esp + 0x48], 0x73df75eb
mov dword [esp + 0x4c], 0x7f3171ee
mov dword [esp + 0x50], 0x7be87def
mov dword [esp + 0x54], 0x67cb79e4
mov dword [esp + 0x58], 0x63fe65fc
mov dword [esp + 0x5c], 0x6fc26129
mov dword [esp + 0x60], 0x6b366d29
mov dword [esp + 0x64], 0x570f6936
mov dword [esp + 0x68], 0x530b5508
mov dword [esp + 0x6c], 0x5f05510a
mov dword [esp + 0x70], 0x5b035d02
mov dword [esp + 0x74], 0x47e25905
mov dword [esp + 0x78], 0x43ee45ed
mov dword [esp + 0x7c], 0x4f4e41ee
mov word [esp + 0x80], 0
mov byte [esp + 0x82], 0
xor eax, eax
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 0x7c
mov ecx, edi
xor ecx, 0x220959be
mov ebp, edx
and ebp, ecx
xor ecx, edx
lea ecx, [ecx + ebp*2]
xor cl, byte [esp + edi + 0x44]
add cl, 0x4a
mov byte [esp + edi + 0x44], cl
inc edi
add eax, 2
cmp edi, 0x3f
jne 0x425170
mov dword [esp], 0x299f2b78
mov dword [esp + 4], 0x2d9f2f9c
mov dword [esp + 8], 0x3195339a
mov dword [esp + 0xc], 0x359d3799
mov dword [esp + 0x10], 0x399e3b68
mov dword [esp + 0x14], 0x3d943f93
mov dword [esp + 0x18], 0x1b9039b
mov dword [esp + 0x1c], 0x5b207ac
mov dword [esp + 0x20], 0x9b90b58
mov dword [esp + 0x24], 0xdb00fb9
mov dword [esp + 0x28], 0x11b9137f
mov dword [esp + 0x2c], 0x15a217a8
mov dword [esp + 0x30], 0x19a81bbf
mov dword [esp + 0x34], 0x1db11fad
mov dword [esp + 0x38], 0x61d063ad
mov dword [esp + 0x3c], 0x650b670d
mov dword [esp + 0x40], 0x696a6b09
mov eax, esp
mov ecx, 0x956210f8
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov edx, ecx
or edx, edi
lea ebp, [ecx + 0x6a9df000]
xor ebp, ecx
add ebp, ecx
and ebp, edi
not edx
or edx, ebp
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
add dl, 0xdc
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x956210b4
jne 0x425230
Function at 0x425950
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
movzx eax, byte [esp + 0x58]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov ebx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
mov byte [esp + 0x28], al
test esi, esi
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44b9cc]

Function at 0x427fe0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp + 4], 0xb1428fab
mov dword [esp + 8], 0xb557b321
mov dword [esp + 0xc], 0xb95ab757
mov dword [esp + 0x10], 0xbd2abb7b
mov dword [esp + 0x14], 0xa17abf2c
mov dword [esp + 0x18], 0xa536a343
mov dword [esp + 0x1c], 0xa981a747
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0xaba8
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0x5d
xor dl, byte [esp + ecx + 4]
add dl, 0x2f
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x23
jne 0x428040
lea ebx, [esp + 0x7a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x96]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x54]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x45070c]
mov esi, dword [esp + 0x54]
mov edi, 0xffffffff
test esi, esi
jns 0x4280a4
mov eax, 0xffffffff
jmp 0x4280a7
lea eax, [esi + esi]
push eax
call fcn.0040cd40
add esp, 4
push ebp
mov ebp, eax
push esi
push eax
push 0xe
push ebx
push 0
call dword [0x45070c]
mov eax, dword [esp + 0x54]
mov ecx, eax
add ecx, 9
js 0x4280d2
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040cd40
add esp, 4
mov dword [esp + 0x58], eax
mov dword [esp + 4], 0x77a679dc
mov dword [esp + 8], 0x73cd75d5
mov dword [esp + 0xc], 0x4fef71c7
mov dword [esp + 0x10], 0x4bf74df7
mov dword [esp + 0x14], 0x474649c7
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 4]
mov esi, eax
and esi, 0x2c
mov edi, ecx
xor edi, 0x54db6196
add edi, esi
xor edi, edx
lea esi, [edi + 0x57b71811]
mov ebx, esi
not ebx
and esi, 1
mov edx, 0xee
sub edx, edi
or edx, ebx
not edx
or edx, 1
add edx, esi
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 0x14
jne 0x428110
movzx ecx, word [ebp]
mov edi, dword [esp + 0x58]
mov eax, edi
test cx, cx
je 0x428181
lea edx, [ebp + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428170
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x4281b1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4281a0
mov word [eax], 0
lea eax, [esp + 0x74]
push eax
push edi
call fcn.00444990
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44bfbc]
Function at 0x428810
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x57974965
mov dword [esp + 8], 0x53a255a4
mov dword [esp + 0xc], 0x5fbf519c
mov dword [esp + 0x10], 0x5bbb5da0
mov dword [esp + 0x14], 0x67825975
mov dword [esp + 0x18], 0x638a65b8
mov dword [esp + 0x1c], 0x6f9c619d
mov dword [esp + 0x20], 0x6b876d80
mov dword [esp + 0x24], 0x77986996
mov dword [esp + 0x28], 0x738c759d
mov dword [esp + 0x2c], 0x7f9a719c
mov dword [esp + 0x30], 0x7b847dac
mov dword [esp + 0x34], 0x7ec798b
mov dword [esp + 0x38], 0x3f605ed
mov dword [esp + 0x3c], 0xff101ed
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0xd0c
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x8e
xor dl, byte [esp + ecx + 4]
add dl, 0x3a
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x44
jne 0x4288b0
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x45070c]
mov ebp, dword [esp]
test ebp, ebp
jns 0x42890c
mov eax, 0xffffffff
jmp 0x428913
lea eax, [ebp*2]
push eax
call fcn.0040cd40
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x45070c]
mov dword [esp + 4], 0x91069f28
mov dword [esp + 8], 0x950c9307
mov dword [esp + 0xc], 0x89319730
mov dword [esp + 0x10], 0x8d288b1a
mov dword [esp + 0x14], 0x811c8f17
mov dword [esp + 0x18], 0x85828324
mov eax, 0xdcfc01e5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2303fe1f]
xor ecx, eax
mov edx, ecx
mov edi, ecx
xor edi, 0xaf13f686
add edi, ecx
and ecx, 0x8c100286
and edx, 0x50ec0179
sub edi, edx
mov edx, edi
and edx, ecx
xor edi, ecx
lea ecx, [edi + edx*2]
inc cl
mov byte [esp + eax + 0x2303fe1f], cl
inc eax
cmp eax, 0xdcfc01fd
jne 0x428970
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.004235e0
add esp, 0x14
jmp dword [0x44c024]
Function at 0x42b4a0
Capabilities:
Copy file
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042b4c0
add esp, 4
test al, al
je 0x42bb90
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xe0
mov dword [esp + 0xa0], 0x49d84bfb
mov dword [esp + 0xa4], 0x45ca47c5
mov dword [esp + 0xa8], 0x41d643db
mov dword [esp + 0xac], 0xbd0ebfd4
mov dword [esp + 0xb0], 0xb936bb23
mov dword [esp + 0xb4], 0xb5b6b720
mov byte [esp + 0xb8], 0
mov eax, 0xb1dc84f3
mov ecx, 0x4e237b0c
nop
nop
movzx edx, byte [esp + eax + 0x4e237bad]
mov esi, ecx
or esi, edx
lea ebx, [ecx - 0x4e237b00]
and ebx, edx
xor ebx, esi
and ebx, eax
add bl, bl
sub dl, bl
movzx edx, dl
add edx, eax
add dl, 0x41
mov byte [esp + eax + 0x4e237bad], dl
inc eax
dec ecx
cmp eax, 0xb1dc850c
jne 0x42bbf0
mov dword [esp + 0x14], 0xb17c8f70
mov dword [esp + 0x18], 0xb57bb377
mov dword [esp + 0x1c], 0xb943b77f
mov dword [esp + 0x20], 0xbd48bb4c
mov dword [esp + 0x24], 0xa142bf47
mov dword [esp + 0x28], 0xa561a36f
mov dword [esp + 0x2c], 0xa96ea761
mov dword [esp + 0x30], 0xad64ab63
mov dword [esp + 0x34], 0x5152af6b
mov dword [esp + 0x38], 0x55a353a5
mov dword [esp + 0x3c], 0x59a25792
mov dword [esp + 0x40], 0x5d995ba1
mov dword [esp + 0x44], 0x41995fae
mov dword [esp + 0x48], 0x45b443bc
mov dword [esp + 0x4c], 0x49aa47a7
mov dword [esp + 0x50], 0x4dad4bde
mov dword [esp + 0x54], 0x71bb4fb0
mov dword [esp + 0x58], 0x759573e4
mov dword [esp + 0x5c], 0x79997797
mov dword [esp + 0x60], 0x7b78
mov eax, 0xfc6f6a8
mov ecx, 0x1f8ded50
nop
nop
movzx edx, byte [esp + eax - 0xfc6f694]
mov edi, ecx
and edi, 0x1b84e8ba
mov ebx, eax
xor ebx, 0x4dfb7c5d
lea esi, [ebx + edi]
add ebx, edi
add ebx, 0xf0390958
mov ebp, ebx
xor ebp, edx
lea edi, [ebp*2]
not edi
add edi, ebp
and edi, ebx
mov ebx, edi
or ebx, 0xfd
inc ebx
mov ebp, edi
and ebp, 0xfd
imul ebp, ebx
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
sub ebp, edi
add edx, esi
add edx, 0xf0390958
add edx, ebp
add dl, 0x2f
mov byte [esp + eax - 0xfc6f694], dl
inc eax
add ecx, 2
cmp eax, 0xfc6f6f8
jne 0x42bcd0
lea ebp, [esp + 0xa0]
lea edi, [esp + 0x14]
push ebp
push edi
call fcn.0043c5a0
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x44c8b8]
Function at 0x42b4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov esi, esp
push eax
sub esp, 0x3fc
mov eax, esp
mov dword [esi + 0x30], eax
mov ecx, eax
sub esp, 8
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x8c], eax
mov esp, eax
push eax
push eax
mov eax, esp
mov dword [esi + 0x34], eax
mov ebx, eax
sub esp, 0x24
mov eax, esp
mov dword [esi + 0x88], ebx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x58], 0x63f661f3
mov dword [esi + 0x5c], 0x67c765c1
mov dword [esi + 0x60], 0x5b8459c5
mov dword [esi + 0x64], 0x5fd65df9
mov dword [esi + 0x68], 0x535251f5
mov word [esi + 0x6c], 0
mov byte [esi + 0x6e], 0
mov eax, 0x38670798
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax - 0x38670740]
lea edx, [eax - 0x38670700]
and edx, ecx
or ecx, eax
xor ecx, edx
add ecx, 0xe5fcda07
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esi + eax - 0x38670740], cl
inc eax
cmp eax, 0x386707af
jne 0x42b560
lea edi, [esi + 0x58]
lea ecx, [esi + 0x3c]
push edi
call fcn.0043e440
shr eax, 0x1f
xor edx, edx
jmp dword [eax*4 + 0x44c7f0]
Function at 0x42f540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42f59a
cmp edi, 1
je 0x42f59a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42f571
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42f570
cmp ecx, 0x20
je 0x42f570
cmp ecx, 0x2b
mov edx, edi
je 0x42f590
cmp ecx, 0x2d
jne 0x42f5af
cmp al, 0x2b
sete byte [esp + 3]
inc ebx
jmp 0x42f5b4
xor edi, edi
test eax, eax
je 0x42f76d
mov dword [eax], 0x16
jmp 0x42f76d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42f5dd
cmp edx, 0x10
jne 0x42f5f5
cmp byte [ebx], 0x30
jne 0x42f5d6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42f5f7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42f5f7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42f650
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42f708
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42f677
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42f738
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42f738
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42f630
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42f6c0
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42f6c9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42f6ed
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42f71d
test bl, bl
jne 0x42f71d
mov ebx, dword [esp + 0x10]
jmp 0x42f643
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42f625
mov esi, edi
test bl, bl
jne 0x42f72b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42f625
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42f746
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42f754
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42f764
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42f76d
cmp byte [esp + 3], 0
jne 0x42f76d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436c90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [esp + 0x40]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x436e49
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x436e43
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00432360
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x436d17
jmp 0x436e37
mov dword [esp + 0x28], eax
mov ebx, eax
add ebx, 1
mov dword [esp], ebx
call fcn.0040cd40
mov dword [esp + 0x24], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.0042afb0
mov al, byte [esp + 0x1c]
mov byte [esp + 0x20], al
mov byte [esp + 0xc], 0x87
mov byte [esp + 0xd], 0xbd
mov byte [esp + 0xe], 0xbf
mov byte [esp + 0xf], 0xa7
mov byte [esp + 0x10], 0xba
mov byte [esp + 0x11], 0xa6
mov byte [esp + 0x12], 0xb3
mov byte [esp + 0x13], 0xad
mov byte [esp + 0x14], 0xbc
mov byte [esp + 0x15], 0x63
mov byte [esp + 0x16], 0xa2
mov byte [esp + 0x17], 0xa7
mov byte [esp + 0x18], 0xa0
mov byte [esp + 0x19], 0x5d
mov eax, 0xe
mov byte [esp + eax + 0xc], 0
add eax, 1
cmp eax, 0x10
jne 0x436d8f
xor eax, eax
cmp eax, 0x10
jae 0x436e07
movzx edx, byte [esp + eax + 0xc]
mov ebx, eax
shl ebx, 1
and ebx, 0xa5f5d71c
mov ecx, eax
xor ecx, 0xd2faeb8e
add ecx, ebx
mov ebx, ecx
and ebx, edx
mov ebp, ebx
and ebp, 2
xor ebp, 2
mov esi, ebx
and esi, 0xfd
imul esi, ebp
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
add ebx, esi
add ecx, edx
sub ecx, ebx
mov esi, ecx
xor esi, 0x46
mov edx, ecx
or edx, 0x39
and edx, esi
mov esi, dword [esp + 0x40]
shl edx, 1
xor ecx, 0x39
add edx, ecx
add dl, 1
mov byte [esp + eax + 0xc], dl
add eax, 1
jmp 0x436d9e
lea eax, [esp + 0xc]
mov ecx, esi
mov dword [esp], eax
mov esi, dword [esp + 0x24]
mov dword [esp + 4], esi
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
call fcn.0040da00
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], esi
call fcn.0040cd50
jmp 0x436e37
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b560
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43b580
lea edi, [ebx - 2]
mov dword [esp + 8], 0xeeeaec11
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov edx, 0x7abacad7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx - 0x7abacacf]
mov eax, ecx
and eax, edx
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0xcd
mov byte [esp + edx - 0x7abacacf], al
inc edx
cmp edx, 0x7abacade
jne 0x43b5b0
cmp ebx, 2
je 0x43b600
mov edx, esi
mov esi, dword [esp + 8]
mov eax, edi
mov ecx, edi
sar ecx, 1
mov dword [esp + 4], ecx
mov edi, esi
not edi
test al, 2
jne 0x43b607
mov eax, esi
cmp ebx, 4
jne 0x43b63c
jmp 0x43b696
mov ecx, ebp
jmp 0x43b696
dec dword [esp + 4]
movzx ecx, word [edx]
add edx, 2
xor ecx, ebp
mov ebp, ecx
and ebp, edi
mov dword [esp], ebp
mov ebp, ecx
not ebp
and ebp, esi
imul ebp, dword [esp]
mov eax, ecx
and eax, esi
mov dword [esp], eax
mov eax, esi
or ecx, esi
imul ecx, dword [esp]
add ecx, ebp
mov ebp, ecx
cmp ebx, 4
je 0x43b696
mov esi, eax
xor ebx, ebx
mov ecx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edx + ebx*2]
xor ebp, ecx
mov eax, ebp
and eax, edi
mov ecx, ebp
not ecx
and ecx, esi
imul ecx, eax
mov eax, ebp
and eax, esi
or ebp, esi
imul ebp, eax
add ebp, ecx
movzx ecx, word [edx + ebx*2 + 2]
xor ecx, ebp
mov eax, ecx
and eax, edi
mov ebp, ecx
not ebp
and ebp, esi
imul ebp, eax
mov eax, ecx
and eax, esi
or ecx, esi
imul ecx, eax
add ecx, ebp
add ebx, 2
cmp dword [esp + 4], ebx
jne 0x43b650
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret