joyce8/EMBER2024-capa huggingface dataset:
Function at 0x676a78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x6c1434]
push eax
call sub.kernel32.dll_EnterCriticalSection
xor eax, eax
push ebp
push 0x676b87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6c0ec4]
mov eax, dword [eax]
call fcn.005c4170
mov eax, dword [reloc.wsock32.dll_htons]
mov eax, dword [eax]
call fcn.004f9dc8
mov eax, dword [0x6c0604]
mov eax, dword [eax]
call fcn.005aedd4
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0xabcff8]
cmp eax, 0x2710
jbe 0x676b6e
call sub.kernel32.dll_GetTickCount_1
mov dword [0xabcff8], eax
mov eax, dword [0x6c0f8c]
mov eax, dword [eax]
call fcn.0050778c
mov eax, dword [0x6c10e4]
mov eax, dword [eax]
call fcn.0050ba50
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
call fcn.004e5fa0
xor eax, eax
push ebp
push 0x676b67
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x676b4d
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
cmp esi, eax
jae 0x676b47
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x676b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x676b6e
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
call fcn.004e5fac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x676b8e
mov eax, dword [0x6c1434]
push eax
call sub.kernel32.dll_LeaveCriticalSection
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x408490
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470b97
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4941b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea ebx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], ebx
mov dword [ebx + 0x24], 0
mov ecx, dword [ebp + 0x30]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x408544
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [ebx + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x68]
push 9
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
call fcn.00408070
mov ecx, dword [edi + 0x1c]
mov edx, dword [edi + 0x10]
mov byte [ebp - 4], 6
mov byte [ebp - 0xd], 1
test ecx, ecx
jns 0x408582
mov eax, ecx
neg eax
je 0x408582
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x40858a
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
lea eax, [ebp - 0xd]
and ecx, 0x1f
push eax
push 1
push ecx
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x10]
call fcn.0040af50
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x4085b9
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x415990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471990
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4941b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x4159d7
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x4159f8
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4159e4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp + 0xc], eax
cmp dword [eax], esi
je 0x415a1b
mov esi, dword [eax + 4]
mov esi, dword [esi]
mov edx, dword [edi + 0x10]
jmp 0x415a23
mov eax, dword [ebp + 0xc]
cmp esi, dword [eax]
je 0x415aa4
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x14], ecx
jb 0x415a3b
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x415a45
mov ecx, dword [edi]
cmp edx, dword [ebp - 0x14]
jne 0x415a20
push edx
push eax
push ecx
call fcn.004172c0
mov edx, dword [edi + 0x10]
add esp, 0xc
test eax, eax
mov eax, dword [ebp + 0xc]
jne 0x415a23
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.00416630
push 0x2c
push edi
call fcn.004639cf
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x415ad1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x18]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x415aeb
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x415b0d
cmp eax, esi
jne 0x415af3
mov dword [ecx], edi
jmp 0x415b0d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x415b0d
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00416e60
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x415ebc
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x415ed8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x415ec7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x415f11
cmp eax, edi
jne 0x415f09
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x415f19
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x415f19
cmp eax, edi
jne 0x415f19
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00416630
push 0x2c
push edi
call fcn.004639cf
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4173a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 8], ecx
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
mov dword [ebp - 4], eax
jb 0x4173bf
mov esi, dword [edi]
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x4173e1
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4173d0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x41740b
mov eax, ebx
jmp 0x41740f
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x41748e
cmp dword [edi + 0x14], 8
lea eax, [esi + 8]
mov ecx, edi
jb 0x417420
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 8
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x417436
mov eax, dword [eax]
cmp edx, dword [ebp - 4]
jne 0x41744a
push edx
push ecx
push eax
call fcn.004172c0
add esp, 0xc
test eax, eax
je 0x417454
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x417403
cmp dword [ebp - 0x10], 8
lea eax, [esi + 8]
jb 0x41745f
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
jb 0x417467
mov edi, dword [edi]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jne 0x41747e
push ecx
push eax
push edi
call fcn.004172c0
add esp, 0xc
test eax, eax
je 0x417480
mov esi, ebx
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x419450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471f90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4941b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x419494
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x4194b2
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x4194a0
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x41954e
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x41954e
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x4194ea
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x4194f4
mov ecx, dword [edi]
push edx
push eax
push dword [edi + 0x10]
push ecx
call fcn.0041b960
add esp, 0x10
test al, al
mov eax, dword [ebp + 0xc]
je 0x4194d5
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.00409b50
push 0x30
push edi
call fcn.004639cf
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x41957b
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x419595
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x4195b7
cmp eax, esi
jne 0x41959d
mov dword [ecx], edi
jmp 0x4195b7
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4195b7
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00427600
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428aa0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473a38
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4941b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
push dword [esi + 4]
mov ecx, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
call fcn.00414590
mov edi, eax
mov dword [ebp - 0x18], 0
mov edx, edi
mov dword [ebp - 0x14], 7
xor eax, eax
mov word [ebp - 0x28], ax
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x428b00
sub edx, ecx
lea ecx, [ebp - 0x28]
sar edx, 1
push edx
push edi
call fcn.00413ff0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.00437fc0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x428b68
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428b5e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428ba6
push edx
push ecx
call fcn.004639cf
add esp, 8
mov ecx, dword [esi + 8]
xor eax, eax
push dword [esi + 4]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov ecx, dword [ecx + 0x30]
mov word [ebp - 0x28], ax
call fcn.004141f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004639dd
mov esp, ebp
pop ebp
ret
call fcn.00465400
int3

Function at 0x428d60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4941b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov bl, byte [eax]
mov eax, dword [esi + 8]
mov byte [ebp - 0x44], bl
push dword [ebp - 0x44]
push dword [esi + 4]
mov ecx, dword [eax + 0x34]
call fcn.004383c0
mov eax, dword [esi + 8]
push dword [esi + 4]
mov ecx, dword [eax + 0x30]
mov edi, dword [eax + 0x34]
call fcn.00414590
mov esi, eax
xor eax, eax
mov edx, esi
lea ecx, [edx + 2]
test bl, bl
je 0x428e04
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x428dd2
sub edx, ecx
lea ecx, [ebp - 0x28]
sar edx, 1
push edx
push esi
call fcn.00413ff0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.004377c0
lea ecx, [ebp - 0x28]
jmp 0x428e44
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x428e16
sub edx, ecx
lea ecx, [ebp - 0x40]
sar edx, 1
push edx
push esi
call fcn.00413ff0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.00438a20
lea ecx, [ebp - 0x40]
call fcn.00409870
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004639dd
mov esp, ebp
pop ebp
ret 4
Function at 0x42c4b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x42c4e1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x42c4d0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x42ce80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x42ce9b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x42ceb7
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x42cea6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x42cef0
cmp eax, edi
jne 0x42cee8
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x42cef8
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x42cef8
cmp eax, edi
jne 0x42cefb
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.00409b50
push 0x30
push edi
call fcn.004639cf
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42d240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 8], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], ebx
jb 0x42d25f
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x42d281
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x42d270
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x42d2ab
mov eax, ebx
jmp 0x42d2af
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x42d31a
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, edi
jb 0x42d2c0
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 0x10
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x42d2d6
mov eax, dword [eax]
push dword [ebp - 4]
push ecx
push edx
push eax
call fcn.0041b960
add esp, 0x10
test al, al
jne 0x42d2f2
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x42d2a3
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x42d2fd
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x42d305
mov edi, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [ebp - 4]
push edi
call fcn.0041b960
add esp, 0x10
test al, al
cmovne ebx, esi
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x430b90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4941b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], 0
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x430c27
call fcn.0044b33a
add eax, 0x7a120
push 0
push 0x64
adc edx, 0
push edx
push eax
call fcn.00463910
push 0
push 0x3b9aca00
mov esi, eax
push edx
push esi
call fcn.00463860
mov dword [ebp - 0x28], eax
imul eax, eax, 0x3b9aca00
mov dword [ebp - 0x24], edx
sub esi, eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], esi
movups xmm0, xmmword [ebp - 0x28]
push eax
movups xmmword [ebp - 0x14], xmm0
call fcn.0044b25c
mov esi, dword [ebp - 0x18]
add esp, 4
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xa
jl 0x430bb0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004639dd
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x10]
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp dword [edi + 0x14], 8
mov esi, eax
mov ecx, dword [edi + 0x10]
jb 0x430c47
mov edi, dword [edi]
lea ecx, [ecx*2 + 2]
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004639dd
mov esp, ebp
pop ebp
ret
Function at 0x431510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x4315e4
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x4315d3
jg 0x431548
test edx, edx
je 0x4315d3
call fcn.0042a370
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x431598
jg 0x43155e
test esi, esi
je 0x431598
cmp ebx, eax
jg 0x43156d
jl 0x431568
cmp edi, esi
jae 0x43156d
mov esi, edi
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x4315ba
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4315cd
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [ebp - 4]
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jg 0x431548
jl 0x4315cd
test edi, edi
jne 0x431548
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x431603
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x431605
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x4316ad
jg 0x43161f
test esi, esi
je 0x4316ad
test eax, eax
jl 0x43165e
jg 0x431629
test ebx, ebx
je 0x43165e
cmp edi, eax
jg 0x431638
jl 0x431633
cmp esi, ebx
jae 0x431638
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0xc
add dword [ebp + 8], ebx
sub esi, ebx
sbb edi, dword [ebp + 0x10]
mov eax, dword [ecx + 0x2c]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x431664
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edi, edi
jl 0x4316ad
jg 0x43166e
test esi, esi
je 0x4316ad
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x4316ad
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x431699
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [ebp + 8]
call sub.msvcrt.dll_fread
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc