joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4108f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x234
mov dword [esp + 0x34], 0x893b8bdf
mov dword [esp + 0x38], 0x8531870e
mov dword [esp + 0x3c], 0x81368330
mov dword [esp + 0x40], 0x9def9f3f
mov dword [esp + 0x44], 0x99e89bd7
mov dword [esp + 0x48], 0x95f697e8
mov dword [esp + 0x4c], 0x913b93ec
mov dword [esp + 0x50], 0xed5cef27
mov dword [esp + 0x54], 0xe95beb50
mov dword [esp + 0x58], 0xe56be761
mov dword [esp + 0x5c], 0xe1b0e384
mov dword [esp + 0x60], 0xfd9eff4c
mov dword [esp + 0x64], 0xf98afbb3
mov dword [esp + 0x68], 0xf586f78a
mov dword [esp + 0x6c], 0xf192f3b1
mov dword [esp + 0x70], 0xcd79cf59
mov dword [esp + 0x74], 0xc980cb7e
mov dword [esp + 0x78], 0xc583c784
mov dword [esp + 0x7c], 0xc14ac3a4
mov dword [esp + 0x80], 0xdd92df8a
mov dword [esp + 0x84], 0xd9badbab
mov dword [esp + 0x88], 0xd566d787
mov dword [esp + 0x8c], 0xd166d364
mov dword [esp + 0x90], 0x2d872f6b
mov dword [esp + 0x94], 0x29942b97
mov dword [esp + 0x98], 0x2591277d
mov dword [esp + 0x9c], 0x215323a8
mov dword [esp + 0xa0], 0x3d733f6b
mov dword [esp + 0xa4], 0x39483b75
mov dword [esp + 0xa8], 0x357c3775
mov dword [esp + 0xac], 0x314a3354
mov dword [esp + 0xb0], 0xd560f65
mov dword [esp + 0xb4], 0x9590ba0
mov dword [esp + 0xb8], 0x572075c
mov dword [esp + 0xbc], 0x1b60364
mov dword [esp + 0xc0], 0x1dab1fb7
mov dword [esp + 0xc4], 0x197a1ba7
mov dword [esp + 0xc8], 0x15ad1741
mov dword [esp + 0xcc], 0x11a713a9
mov dword [esp + 0xd0], 0x6d196fa1
mov dword [esp + 0xd4], 0x69376b0c
mov dword [esp + 0xd8], 0x65e867d0
mov dword [esp + 0xdc], 0x61d163d5
mov dword [esp + 0xe0], 0x7d0f7fdb
mov dword [esp + 0xe4], 0x79357b33
mov dword [esp + 0xe8], 0x7504773f
mov dword [esp + 0xec], 0x71007304
mov dword [esp + 0xf0], 0x4d3c4f00
mov dword [esp + 0xf4], 0x492a4b3c
mov dword [esp + 0xf8], 0x45f947e5
mov dword [esp + 0xfc], 0x41fd43fe
mov dword [esp + 0x100], 0x5de95fce
mov dword [esp + 0x104], 0x59115b2d
mov dword [esp + 0x108], 0x551f5715
mov dword [esp + 0x10c], 0x511f5326
mov dword [esp + 0x110], 0xadaeaf1a
mov byte [esp + 0x114], 0
mov eax, dword [0x450b00]
mov ecx, 0x823b5da3
mov edx, 0x5c
movzx esi, byte [esp + ecx + 0x7dc4a291]
mov edi, edx
xor edi, ecx
and edi, esi
xor edi, ecx
mov esi, edi
and esi, 0x3d0
xor esi, 0xffecf7ff
lea ebp, [edi + esi]
add esi, edi
add esi, 0x74d72bd1
and edi, 0xd0
add edi, ebp
add edi, 0x74d72bd1
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
mov byte [esp + ecx + 0x7dc4a291], bl
inc ecx
dec edx
cmp ecx, 0x823b5e84
jne 0x410b40
lea edi, [esp + 0x34]
push 0
push 0
push 0
push 0
push edi
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x44add4]

Function at 0x410f40
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
shr eax, 0x1f
jmp dword [eax*4 + 0x44b55c]
Function at 0x41ce90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1110
call fcn.0040cd70
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41ceb0
sar esi, 1
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x451e44]
mov ebx, dword [esp + 0x30]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41cee4
mov eax, 0xffffffff
jmp 0x41cee7
lea eax, [ebx + ebx]
push eax
call fcn.0040ce10
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x451e44]
mov eax, dword [esp + 0x30]
mov ecx, eax
add ecx, 0xd
js 0x41cf1c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040ce10
add esp, 4
mov edi, eax
mov dword [esp + 0x10c], 0xc97ecb68
mov dword [esp + 0x110], 0xc54bc757
mov dword [esp + 0x114], 0xc122c348
mov dword [esp + 0x118], 0xbd25bf6a
mov dword [esp + 0x11c], 0xb937bb32
mov dword [esp + 0x120], 0xb527b72f
mov dword [esp + 0x124], 0xb1b2b326
mov word [esp + 0x128], 0
xor eax, eax
movzx ecx, byte [esp + eax + 0x10c]
mov esi, eax
and esi, 0xd
xor esi, 0x506ba9cd
mov edx, eax
and edx, 0x12
sub edx, esi
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add dl, cl
inc dl
mov byte [esp + eax + 0x10c], dl
inc eax
cmp eax, 0x1e
jne 0x41cf80
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41cfe1
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cfd0
mov word [eax], 0
movzx ecx, word [esp + 0x10c]
test cx, cx
je 0x41d011
lea edx, [esp + 0x10e]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d000
mov word [eax], 0
lea eax, [esp + 0xa0]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.004450a0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c5dc]
Function at 0x41fdb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41feb7
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x41fde8
mov ebp, ebx
mov esi, ebp
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x41feb9
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.004224c0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.004224c0
add esp, 4
shl bh, 2
mov ah, al
shr ah, 4
and ah, 3
or ah, bh
mov ecx, esi
and ecx, 1
mov edx, esi
xor edx, 1
lea ebx, [edx + ecx*2]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], ah
cmp edi, ecx
jae 0x41fdd0
mov byte [esp + 3], al
movzx eax, byte [ebp + edi]
push eax
call fcn.004224c0
add esp, 4
cmp al, 0x40
jne 0x41fe50
mov ebp, ebx
mov ecx, dword [esp + 0x1c]
jmp 0x41fdd2
movzx edx, byte [esp + 3]
shl dl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, dl
lea ebp, [ebx + 1]
mov edx, dword [esp + 0x20]
mov byte [edx + ebx], cl
lea ecx, [edi + 1]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
jae 0x41feb0
mov esi, ebx
mov ebx, eax
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.004224c0
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x41fdd2
shl bl, 6
add al, bl
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
add esi, 2
mov ebp, esi
jmp 0x41fdd2
mov ecx, edx
jmp 0x41fdd2
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x425970
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
movzx ebx, byte [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push eax
mov edi, esp
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], esi
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], bl
test eax, eax
setg cl
and cl, bl
movzx eax, cl
jmp dword [eax*4 + 0x44ccc0]
Function at 0x428170
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp + 4], 0x83ce81e5
mov dword [esp + 8], 0x8725852b
mov dword [esp + 0xc], 0x8b268929
mov dword [esp + 0x10], 0x8f3e8dcd
mov dword [esp + 0x14], 0x93d69120
mov dword [esp + 0x18], 0x97229535
mov dword [esp + 0x1c], 0x9bff9939
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0x9d9c
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
mov ecx, 0x20800a20
nop
movzx edx, byte [esp + ecx - 0x20800a1c]
mov esi, ecx
and esi, edx
mov edi, esi
and edi, 0x7d
mov ebp, esi
and ebp, 2
mov ebx, esi
or ebx, 0xfffffffd
inc ebx
imul ebx, edi
or esi, 2
imul esi, ebp
sub ebx, esi
add edx, ecx
add ebx, edx
and edx, 1
or ebx, 1
add ebx, edx
add bl, 0x5f
mov byte [esp + ecx - 0x20800a1c], bl
inc ecx
cmp ecx, 0x20800a43
jne 0x4281d0
lea ebp, [esp + 0x72]
lea edx, [esp + 4]
mov ecx, 7
mov edi, ebp
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x451e44]
mov ebx, dword [esp]
mov edi, 0xffffffff
test ebx, ebx
jns 0x428261
mov eax, 0xffffffff
jmp 0x428264
lea eax, [ebx + ebx]
push eax
call fcn.0040ce10
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebx
push esi
push 0xe
push ebp
push 0
call dword [0x451e44]
mov eax, dword [esp]
mov ecx, eax
add ecx, 9
js 0x428290
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040ce10
add esp, 4
mov edi, eax
mov dword [esp + 4], 0x13c211b4
mov dword [esp + 8], 0xef4ded4d
mov dword [esp + 0xc], 0xeb4be953
mov dword [esp + 0x10], 0xe75be55b
mov dword [esp + 0x14], 0xe3e2e153
mov dword [esp + 0x18], 0
xor eax, eax
xor ecx, ecx
nop
mov ebx, eax
and ebx, 0x38
mov edx, ecx
xor edx, 0xfc
add edx, ebx
xor dl, byte [esp + ecx + 4]
add dl, 0x14
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 0x18
jne 0x4282d0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x428321
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428310
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x428351
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428340
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.00445230
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d394]
Function at 0x428900
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x63236145
mov dword [esp + 8], 0x67166514
mov dword [esp + 0xc], 0x7b1b793c
mov dword [esp + 0x10], 0x7f1f7d08
mov dword [esp + 0x14], 0x731e7155
mov dword [esp + 0x18], 0x770e7520
mov dword [esp + 0x1c], 0x8bf489fd
mov dword [esp + 0x20], 0x8feb8de8
mov dword [esp + 0x24], 0x83e081f2
mov dword [esp + 0x28], 0x87f485fd
mov dword [esp + 0x2c], 0x9bf699fc
mov dword [esp + 0x30], 0x9fec9dcc
mov dword [esp + 0x34], 0x93f491ef
mov dword [esp + 0x38], 0x97ea95ed
mov dword [esp + 0x3c], 0xabd9a9cd
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0xadac
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0x68
xor dl, byte [esp + ecx + 4]
add dl, 0xf8
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x43
jne 0x4289a0
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x451e44]
mov ebp, dword [esp]
test ebp, ebp
jns 0x4289fc
mov eax, 0xffffffff
jmp 0x428a03
lea eax, [ebp*2]
push eax
call fcn.0040ce10
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x451e44]
mov dword [esp + 4], 0x61fe67c8
mov dword [esp + 8], 0x5df463ef
mov dword [esp + 0xc], 0x59c15fc0
mov dword [esp + 0x10], 0x55f85bca
mov dword [esp + 0x14], 0x51c457cf
mov dword [esp + 0x18], 0x4d5253cc
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
mov eax, 0xffffffff
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, al
or bl, 0x32
mov bh, cl
and bh, 0x32
sub bl, bh
movzx ebx, bl
add ebx, edx
add ebx, ecx
add bl, 0x1b
xor bl, byte [esp + edx + 4]
add bl, 0x83
mov byte [esp + edx + 4], bl
lea edi, [edx + 1]
dec eax
add ecx, 2
mov edx, edi
cmp edi, 0x1b
jne 0x428a70
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.004238a0
add esp, 0x14
jmp dword [0x44d3ec]
Function at 0x42e010
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc4
mov dword [esp + 0x2c], 0x8f4f896d
mov dword [esp + 0x30], 0x83328d3c
mov dword [esp + 0x34], 0x87278144
mov dword [esp + 0x38], 0x9b3b8530
mov dword [esp + 0x3c], 0x9f32997d
mov dword [esp + 0x40], 0x93219d4e
mov dword [esp + 0x44], 0x97339124
mov dword [esp + 0x48], 0x6bcb9524
mov dword [esp + 0x4c], 0x6f9169cc
mov dword [esp + 0x50], 0x63ce6d93
mov dword [esp + 0x54], 0x67c361d7
mov dword [esp + 0x58], 0x7bcd65d3
mov dword [esp + 0x5c], 0x7fcd79c1
mov dword [esp + 0x60], 0x73807dce
mov dword [esp + 0x64], 0x77cb71f8
mov dword [esp + 0x68], 0x4b4a75c8
lea eax, [esp + 0x6c]
mov word [esp + 0x6c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x62
xor dl, byte [esp + ecx + 0x2c]
add dl, 0x16
mov byte [esp + ecx + 0x2c], dl
inc ecx
cmp ecx, 0x42
jne 0x42e0b0
lea ebx, [esp + 0x84]
lea edx, [esp + 0x2c]
mov edi, ebx
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xc4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x80]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x451e44]
mov edi, dword [esp + 0x80]
test edi, edi
jns 0x42e115
mov eax, 0xffffffff
jmp 0x42e118
lea eax, [edi + edi]
push eax
call fcn.0040ce10
add esp, 4
push esi
push edi
push eax
push 0x1f
push ebx
mov ebx, eax
push 0
call dword [0x451e44]
lea eax, [esp + 0x1c]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.004450a0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44de80]
Function at 0x42f850
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, edx
mov edi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov ebx, 0xffffffff
nop
nop
nop
cmp byte [ebp + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x42f870
lea esi, [ebx + 1]
push esi
call fcn.0040ce10
add esp, 4
mov dword [esp + 4], edi
mov dword [edi], eax
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov dword [esp], esi
mov ecx, esi
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
jne 0x42f8d3
mov esi, dword [esp]
and esi, 2
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
test ebx, ebx
je 0x42f984
neg ebx
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
xor eax, edx
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov esi, ecx
shr esi, 1
mov edx, eax
shl edx, 0x1e
sar edx, 0x1f
and edx, 0xedb88320
xor edx, esi
mov edi, eax
shl edi, 0x1d
sar edi, 0x1f
and edi, 0x76dc419
mov esi, eax
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, edi
mov edi, eax
shl edi, 0x1b
sar edi, 0x1f
and edi, 0x1db71064
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x3b6e20c8
xor eax, edi
xor eax, esi
mov esi, edx
shr esi, 6
xor eax, esi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0x76dc4190
xor ecx, eax
shl edx, 0x1a
sar edx, 0x1f
and edx, 0xedb88320
xor edx, ecx
inc ebp
inc ebx
jne 0x42f8e0
not edx
mov eax, dword [esp + 4]
mov dword [eax + 4], edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
jmp 0x42f975
Function at 0x436bc0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x436d61
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
xor ebx, ebx
cmp esi, 0
je 0x436d59
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00432b70
mov edi, eax
cmp edi, 0
setne al
jmp 0x436c3b
jmp 0x436c3d
xor ebx, ebx
test al, 1
jne 0x436c48
jmp 0x436d4d
mov ebx, edi
add ebx, 1
mov dword [esp], ebx
call fcn.0040ce10
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.0042adb0
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0x27
mov byte [esp + 0x15], 0xd
mov byte [esp + 0x16], 0xf
mov byte [esp + 0x17], 7
mov byte [esp + 0x18], 0xa
mov byte [esp + 0x19], 6
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 0x1d
mov byte [esp + 0x1c], 0xc
mov byte [esp + 0x1d], 0x43
mov byte [esp + 0x1e], 2
mov byte [esp + 0x1f], 7
mov byte [esp + 0x20], 0
mov byte [esp + 0x21], 0x8d
mov eax, 0xe
mov ebp, dword [esp + 0x28]
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x12
jne 0x436cc0
xor eax, eax
cmp eax, 0x12
jae 0x436d1b
movzx edx, byte [esp + eax + 0x14]
mov ebx, eax
and ebx, 0x6ca45f72
xor ebx, 0x6ca45f72
mov ecx, eax
and ecx, 0x935ba08d
sub ecx, ebx
add ecx, 0x3662858
xor ecx, edx
mov edx, ecx
shl edx, 1
and edx, 2
xor ecx, 0xe371381
mov ebx, ecx
add ebx, edx
and ecx, 1
or ebx, 1
add ecx, ebx
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x436ccf
jmp 0x436d1d
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], edi
call fcn.0040d8e0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x436d3f
jmp 0x436d41
mov dword [esp], ebp
call fcn.0040ce20
jmp 0x436d4b
jmp 0x436d4d
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x436d61
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c870
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00445770
add esp, 0x14
test eax, eax
js 0x43c993
lea edi, [esp + 8]
lea eax, [esp + 0xc]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.00445b60
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x43c911
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x43c8e4
mov eax, 0xffffffff
jmp 0x43c8e6
add eax, eax
push eax
call fcn.0040ce10
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.00446140
add esp, 0x14
test eax, eax
jns 0x43c911
push esi
call fcn.0040ce20
add esp, 4
xor esi, esi
mov eax, dword [esp + 4]
mov dword [esp], 0x60676665
nop
nop
nop
nop
mov ecx, ebx
add cl, 0xe9
xor cl, byte [esp + ebx]
add cl, 0x73
mov byte [esp + ebx], cl
inc ebx
cmp ebx, 4
jne 0x43c920
mov ecx, dword [0x451e48]
test ecx, ecx
je 0x43c97a
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x451e4c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43c960
inc edi
cmp ecx, edi
jne 0x43c950
jmp 0x43c97a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43c97a
push eax
push 1
push ecx
push dword [0x451e50]
call fcn.00441a80
add esp, 0x10
test esi, esi
jne 0x43c995
mov eax, esp
push eax
call fcn.00444eb0
add esp, 4
test al, al
je 0x43c993
cmp dword [esp], 1
je 0x43c995
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0x60676665
mov eax, 0xc11c8ee9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x3ee37117]
xor ecx, eax
add ecx, 0x3a713572
mov edx, ecx
xor edx, 0xf3
and ecx, 0xc
add ecx, ecx
sub ecx, edx
add cl, 0xf4
mov byte [esp + eax + 0x3ee37117], cl
inc eax
cmp eax, 0xc11c8eed
jne 0x43e710
mov edi, dword [esp]
mov eax, dword [0x451e48]
test eax, eax
je 0x43e796
xor ecx, ecx
mov edx, dword [0x451e4c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43e770
inc ecx
cmp eax, ecx
jne 0x43e760
jmp 0x43e796
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43e796
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push eax
push dword [0x451e50]
call fcn.00441a80
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x1c6c7c8
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x1e93d451
mov ecx, 0xae
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x1e93d451]
mov esi, eax
or esi, edx
not edx
or edx, ecx
and edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
add dl, 0x6a
mov byte [esp + eax - 0x1e93d451], dl
inc eax
dec ecx
cmp eax, 0x1e93d458
jne 0x43e7c0
cmp edi, dword [esp]
jne 0x43e905
mov dword [esp + 0xc], ebp
push dword [esp + 8]
call fcn.0043e5b0
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0x60676665
mov edx, 0xc11c8ee9
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx + 0x3ee37117]
xor ecx, edx
add ecx, 0x3a713572
mov esi, ecx
xor esi, 0xf3
and ecx, 0xc
add ecx, ecx
sub ecx, esi
add cl, 0xf4
mov byte [esp + edx + 0x3ee37117], cl
inc edx
cmp edx, 0xc11c8eed
jne 0x43e820
mov edi, dword [esp]
mov edx, dword [0x451e48]
test edx, edx
je 0x43e8a5
xor ecx, ecx
mov esi, dword [0x451e4c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0x9abdb589
je 0x43e880
inc ecx
cmp edx, ecx
jne 0x43e870
jmp 0x43e8a5
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0x43e8a5
push 0
push ebp
push eax
push 5
push 4
push edx
push dword [0x451e50]
mov esi, eax
call fcn.00441a80
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43e8fc
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43e8d5
add edi, 2
cmp si, bp
je 0x43e8c0
cmp si, bp
je 0x43e8e7
mov esi, dword [ecx]
test esi, esi
jne 0x43e8b0
mov edi, 0xc0000225
jmp 0x43e8fc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043e640
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4