joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
push eax
sub esp, 0x18
mov eax, esp
sub esp, 0x190
mov dword [ebp - 0x48], esp
sub esp, 8
mov ebx, esp
sub esp, 0x1c
mov dword [ebp - 0x14], esp
sub esp, 0x80
mov dword [ebp - 0x44], esp
sub esp, 0x100
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x6c
mov dword [ebp - 0x10], esp
sub esp, 0x28
mov dword [ebp - 0x20], esp
sub esp, 0xc
mov dword [ebp - 0x30], esp
sub esp, 0x40
mov dword [ebp - 0x28], esp
sub esp, 0x80
mov dword [ebp - 0x40], esp
mov ecx, dword [0x447268]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x3c], 0x93929990
mov dword [ebp - 0x38], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + edx - 0x3c]
lea edi, [edx + 0xe4]
and edi, ecx
add ecx, edx
add edi, edi
sub ecx, edi
add ecx, 0x1bc3286f
mov edi, ecx
and edi, 1
xor ecx, 1
lea ecx, [ecx + edi*2]
mov byte [ebp + edx - 0x3c], cl
mov ecx, edx
not ecx
or ecx, 1
add ecx, edx
xor edx, 1
lea edx, [edx + ecx*2]
add edx, 2
cmp edx, 8
jb 0x40a5f0
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], ecx
mov dword [eax], 0xc947cb45
mov dword [eax + 4], 0xc567c706
mov dword [eax + 8], 0xc10cc309
mov dword [eax + 0xc], 0xbd22bf12
mov dword [eax + 0x10], 0xb92ebb28
mov word [eax + 0x14], 0xb7b8
mov dword [eax + 0x16], 0
mov ecx, 0xb3
mov edi, 0x4c
nop
nop
movzx edx, byte [eax + ecx - 0xb3]
mov esi, ecx
or esi, edx
not edx
or edx, edi
and edx, esi
add dl, 0x81
mov byte [eax + ecx - 0xb3], dl
inc ecx
dec edi
cmp ecx, 0xcd
jne 0x40a670
push dword [ebp - 0x2c]
push 0
push eax
call dword [ebp - 0x18]
mov ecx, dword [0x440a60]
mov edx, 0x3ba69bb5
xor edx, dword [0x440a64]
add ecx, edx
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x40cbb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0xe97beb57
mov dword [esp + 0x3c], 0xed41ef76
mov dword [esp + 0x40], 0xd17ed340
mov dword [esp + 0x44], 0xd587d777
mov dword [esp + 0x48], 0xd988db8f
mov dword [esp + 0x4c], 0xddbedf88
mov dword [esp + 0x50], 0xc17bc3b4
mov dword [esp + 0x54], 0xc554c76f
mov dword [esp + 0x58], 0xc95bcb60
mov dword [esp + 0x5c], 0xcd5bcf51
mov dword [esp + 0x60], 0x318033ac
mov dword [esp + 0x64], 0x35563784
mov dword [esp + 0x68], 0x396a3b63
mov dword [esp + 0x6c], 0x3d6e3f6a
mov dword [esp + 0x70], 0x21422361
mov dword [esp + 0x74], 0x25892799
mov dword [esp + 0x78], 0x29702bb6
mov dword [esp + 0x7c], 0x2d732f7c
mov dword [esp + 0x80], 0x118a134c
mov dword [esp + 0x84], 0x1542174a
mov dword [esp + 0x88], 0x197a1b7b
mov dword [esp + 0x8c], 0x1d8e1f5f
mov dword [esp + 0x90], 0x1ae038c
mov dword [esp + 0x94], 0x5bf07ab
mov dword [esp + 0x98], 0x9ac0baf
mov dword [esp + 0x9c], 0xda10f45
mov dword [esp + 0xa0], 0x71237398
mov dword [esp + 0xa4], 0x7523772b
mov dword [esp + 0xa8], 0x79287b2d
mov dword [esp + 0xac], 0x7d247f2d
mov dword [esp + 0xb0], 0x610a631c
mov dword [esp + 0xb4], 0x652e672d
mov dword [esp + 0xb8], 0x69d96bd0
mov dword [esp + 0xbc], 0x6d026f24
mov dword [esp + 0xc0], 0x51fe530c
mov dword [esp + 0xc4], 0x55fb57ff
mov dword [esp + 0xc8], 0x593a5bff
mov dword [esp + 0xcc], 0x5df55f11
mov dword [esp + 0xd0], 0x41ef43f9
mov dword [esp + 0xd4], 0x452947d1
mov dword [esp + 0xd8], 0x490f4b24
mov dword [esp + 0xdc], 0x4dd84fe0
mov dword [esp + 0xe0], 0xb121b3dd
mov dword [esp + 0xe4], 0xb5e7b71b
mov dword [esp + 0xe8], 0xb9edbbe3
mov dword [esp + 0xec], 0xbdecbfe7
mov dword [esp + 0xf0], 0xa1f0a3ec
mov dword [esp + 0xf4], 0xa5f4a7f0
mov dword [esp + 0xf8], 0xa9caabf4
mov dword [esp + 0xfc], 0xad09af1d
mov dword [esp + 0x100], 0x91359306
mov dword [esp + 0x104], 0x95399706
mov dword [esp + 0x108], 0x99c19bc5
mov dword [esp + 0x10c], 0x9dc79fcd
mov dword [esp + 0x110], 0x81d783ce
mov dword [esp + 0x114], 0x858687da
mov byte [esp + 0x118], 0
mov eax, dword [0x447238]
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
xor edx, 0x28
mov esi, ecx
or esi, 0x57
and esi, edx
mov edx, ecx
xor edx, 0xd7
lea edx, [edx + esi*2]
xor dl, byte [esp + ecx + 0x38]
add dl, 0xcd
mov byte [esp + ecx + 0x38], dl
inc ecx
cmp ecx, 0xe1
jne 0x40ce00
lea esi, [esp + 0x38]
push 0
push 0
push 0
push 0
push esi
call eax
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x441158]
mov ecx, 0xae7add4d
xor ecx, dword [0x441160]
add eax, ecx
inc eax
jmp eax
Function at 0x413fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x413fe0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x414000
sar edi, 1
sar eax, 1
inc eax
mov ecx, eax
and ecx, edi
xor eax, edi
lea edx, [eax + ecx*2]
inc edx
test edx, edx
jns 0x414025
mov eax, 0xffffffff
jmp 0x41402f
lea eax, [eax + ecx*2]
lea eax, [eax*2 + 2]
push eax
call fcn.00408770
add esp, 4
movzx ecx, word [esi]
mov dword [esp], eax
test cx, cx
je 0x414061
add esi, 2
mov eax, dword [esp]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x414050
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x414093
lea edx, [ebp + 2]
mov esi, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414080
jmp 0x414096
mov esi, dword [esp]
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043b8a0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441598]
Function at 0x414330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x11b0
call fcn.00408740
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x414350
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x448584]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x414384
mov eax, 0xffffffff
jmp 0x414387
lea eax, [ebx + ebx]
push eax
call fcn.00408770
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x448584]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, 0xd
js 0x4143bc
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00408770
add esp, 4
mov edi, eax
mov dword [esp + 0x1ac], 0x9722993c
mov dword [esp + 0x1b0], 0x931d9535
mov dword [esp + 0x1b4], 0x8fee911c
mov dword [esp + 0x1b8], 0x8b178d26
mov dword [esp + 0x1bc], 0x87098906
mov dword [esp + 0x1c0], 0x8311851d
mov dword [esp + 0x1c4], 0xfffe8112
mov byte [esp + 0x1c8], 0
xor eax, eax
xor ecx, ecx
mov esi, ecx
xor esi, 0xda
mov edx, eax
and edx, 0xa
sub edx, esi
xor dl, byte [esp + ecx + 0x1ac]
add dl, 0x42
mov byte [esp + ecx + 0x1ac], dl
inc ecx
add eax, 2
cmp ecx, 0x1d
jne 0x414420
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x414471
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, edi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414460
mov word [eax], 0
movzx ecx, word [esp + 0x1ac]
test cx, cx
je 0x4144a1
lea edx, [esp + 0x1ae]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414490
mov word [eax], 0
lea eax, [esp + 0xa0]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043b8a0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441998]
Function at 0x41a950
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
xor eax, eax
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x41a960
lea ecx, [ebx + eax]
add ecx, 0xfffffffe
add eax, ebx
mov edx, 1
sub edx, eax
and edx, ebx
mov ebp, ebx
not ebp
and ebp, ecx
sub ebp, edx
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x448584]
mov edi, dword [esp]
test edi, edi
jns 0x41a9a4
mov eax, 0xffffffff
jmp 0x41a9a7
lea eax, [edi + edi]
push eax
call fcn.00408770
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x448584]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.0043ba30
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441ee4]
Function at 0x41eebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x8fcf89ed
mov dword [esp + 8], 0x83328d3c
mov dword [esp + 0xc], 0x872781c4
mov dword [esp + 0x10], 0x9b3b8530
mov dword [esp + 0x14], 0x9f3299fd
mov dword [esp + 0x18], 0x932a9dc8
mov dword [esp + 0x1c], 0x97249125
mov dword [esp + 0x20], 0xeb4f9530
mov dword [esp + 0x24], 0xef48e95e
mov dword [esp + 0x28], 0xe354ed55
mov dword [esp + 0x2c], 0xe74ae144
mov dword [esp + 0x30], 0xfb4ce5b4
mov dword [esp + 0x34], 0xff44f94b
mov dword [esp + 0x38], 0xf34efd45
mov dword [esp + 0x3c], 0xf741f155
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0xf5f4
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
mov ecx, 0xa2
mov edx, 0x3d4fa85d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x9e]
mov edi, edx
or edi, esi
not esi
or esi, ecx
and esi, edi
mov edi, 0x328e49d4
sub edi, esi
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
mov byte [esp + ecx - 0x9e], bl
inc ecx
dec edx
cmp ecx, 0xe5
jne 0x41ee50
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x448584]
mov ebp, dword [esp]
test ebp, ebp
jns 0x41eecb
mov eax, 0xffffffff
jmp 0x41eed2
lea eax, [ebp*2]
push eax
call fcn.00408770
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x448584]
mov dword [esp + 4], 0x99729b40
mov dword [esp + 8], 0xa554a763
mov dword [esp + 0xc], 0xa149a348
mov dword [esp + 0x10], 0xad40af5e
mov dword [esp + 0x14], 0xa954ab5b
mov dword [esp + 0x18], 0xb5b6b744
mov byte [esp + 0x1c], 0
mov eax, 0xe87050db
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x178faf29]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x38
add edx, edx
xor ecx, 0x47
sub edx, ecx
mov byte [esp + eax + 0x178faf29], dl
inc eax
cmp eax, 0xe87050f4
jne 0x41ef30
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.0041a950
add esp, 0x14
jmp dword [0x442650]
Function at 0x421620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x440
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x3c], 0x59ee5bf1
mov dword [esp + 0x40], 0x5df95fe3
mov dword [esp + 0x44], 0x512053ef
mov dword [esp + 0x48], 0x55de57eb
mov dword [esp + 0x4c], 0xa9aaabef
mov word [esp + 0x50], 0
mov byte [esp + 0x52], 0
mov eax, 0x12771def
mov ecx, 0x2d88e210
nop
nop
nop
movzx edx, byte [esp + eax - 0x12771db3]
mov esi, ecx
and esi, 0x2988834a
mov edi, eax
and edi, 0x106004b5
or edi, esi
xor edi, edx
mov edx, edi
and edx, 1
xor edi, 0x4b
lea edx, [edi + edx*2]
add dl, 0x54
mov byte [esp + eax - 0x12771db3], dl
inc eax
dec ecx
cmp eax, 0x12771e06
jne 0x421690
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x20]
push eax
call fcn.004354e0
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x442dbc]
Function at 0x424ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
cmp byte [ecx + 8], 0
je 0x424ec2
mov byte [ecx + 8], 0
movzx eax, byte [ecx + 9]
mov byte [edi], al
movzx eax, byte [ecx + 0xa]
mov byte [edx], al
mov eax, 0x4485a4
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov byte [edi], 0
mov byte [ecx + 9], 0
mov byte [edx], 0
mov byte [ecx + 0xa], 0
mov edx, dword [ecx]
xor eax, eax
test edx, edx
je 0x424eb8
cmp byte [edx], 0
jne 0x424ee1
jmp 0x424eb8
inc edx
movzx ebx, byte [edx]
movzx ebp, bl
lea esi, [ebp - 9]
cmp esi, 5
jb case.0x424efc.32
cmp ebp, 0x7a
jg 0x424f1f
lea esi, [ebp - 0x20]
cmp esi, 0x1d
ja case.default.0x424efc
jmp dword [esi*4 + 0x425078]
cmp byte [edx + 1], 0x2f
jne case.0x424efc.33
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx]
test bl, bl
je 0x424ee1
inc edx
cmp bl, 0xa
jne 0x424f10
jmp 0x424ee1
cmp ebp, 0x7b
je case.0x424efc.61
cmp ebp, 0x7d
jne case.0x424efc.33
mov byte [0x4485a4], bl
mov eax, 0x4485a4
mov byte [0x4485a5], 0
inc edx
mov dword [ecx], edx
inc dword [ecx + 4]
jmp 0x424eb8
test ebp, ebp
jne case.0x424efc.33
mov dword [ecx], edx
jmp 0x424eb8
mov dword [esp], 0
xor ebp, ebp
jmp 0x424f65
movzx ebx, byte [edx + 1]
inc edx
movzx edi, bl
cmp edi, 0x5a
jle 0x424fa2
add edi, 0xffffffa5
cmp edi, 0x22
ja case.0x424f75.92
jmp dword [edi*4 + 0x4250f0]
mov al, 1
mov dword [esp], eax
jmp case.0x424f75.92
mov bl, 0x5d
test byte [esp], 1
je case.0x424f75.92
mov eax, dword [esp + 0x1c]
mov byte [eax], 1
mov byte [ecx + 0xa], 1
movzx ebx, byte [edx]
mov dword [esp], 0
jmp case.0x424f75.92
test edi, edi
je case.0x424f75.123
cmp edi, 0x22
je case.0x424f75.123
cmp edi, 0x3d
je case.0x424f75.123
movsx esi, bl
add esi, 0xfffffff7
cmp esi, 5
setae bh
cmp bl, 0x20
setne al
test al, bh
jne 0x424fcd
mov eax, dword [esp]
and al, 1
je case.0x424f75.123
cmp ebp, 0x7ffe
jg 0x424f60
mov byte [ebp + 0x4485a4], bl
inc ebp
jmp 0x424f60
mov dword [ecx], edx
mov eax, 0x4485a4
mov byte [ebp + 0x4485a4], 0
inc dword [ecx + 4]
jmp 0x424eb8
mov byte [edi], 1
mov byte [ecx + 9], 1
jmp 0x425001
inc edx
movzx eax, byte [edx]
lea esi, [eax - 9]
cmp esi, 5
jb 0x425000
cmp eax, 0x20
je 0x425000
cmp eax, 0x22
jne 0x42505d
inc edx
xor esi, esi
movzx ebx, byte [edx]
test ebx, ebx
je 0x425049
cmp ebx, 0x22
je 0x425048
xor eax, eax
cmp bl, 0x7f
sete al
add edx, eax
inc edx
cmp esi, 0x7fff
ja 0x425019
cmp bl, 0x7f
jne 0x42503f
xor ebx, ebx
mov byte [esi + 0x4485a4], bl
inc esi
jmp 0x425019
inc edx
cmp esi, 0x7fff
jl 0x425056
mov esi, 0x7fff
mov byte [esi + 0x4485a4], 0
mov dword [ecx], edx
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
mov dword [ecx + 4], eax
jmp 0x424eb3
Function at 0x42d340
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00413fb0
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
jmp 0x42d358
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x42d372
jmp 0x42d374
xor ebx, ebx
test al, 1
jne 0x42d37f
jmp 0x42d4fb
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
jmp 0x42d3ab
cmp eax, 0
setne cl
jmp 0x42d3b3
jmp 0x42d3b5
xor ebx, ebx
test cl, 1
jne 0x42d3c1
jmp 0x42d4f5
mov dword [ebp - 0x14], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.004284a0
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42d4e4
mov dword [ebp - 0x1c], eax
mov ebx, eax
sub ebx, 0xffffffff
sub esp, 4
mov dword [esp], ebx
call fcn.00408770
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.004206f0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x3f
mov byte [edi + 1], 0x15
mov byte [edi + 2], 0x17
mov byte [edi + 3], 0xef
mov byte [edi + 4], 0x1a
mov byte [edi + 5], 0xee
mov byte [edi + 6], 3
mov byte [edi + 7], 0xf5
mov byte [edi + 8], 4
mov byte [edi + 9], 0x33
mov byte [edi + 0xa], 0xf2
mov byte [edi + 0xb], 0xff
mov byte [edi + 0xc], 0xf0
mov byte [edi + 0xd], 0x65
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x13
jne 0x42d45e
xor edx, edx
mov ecx, dword [ebp + 8]
cmp edx, 0x13
jae 0x42d4ae
movzx ecx, byte [edi + edx]
mov eax, edx
add eax, 0xea
mov esi, 0x15
sub esi, edx
mov ebx, 0x15
sub ebx, edx
and esi, ebx
or eax, ecx
xor ecx, 0xffffffff
or esi, ecx
and eax, esi
mov ecx, dword [ebp + 8]
add al, 0x6e
mov byte [edi + edx], al
mov eax, edx
shl eax, 1
and eax, 2
xor edx, 1
add edx, eax
jmp 0x42d46f
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
jmp 0x42d4b6
jmp 0x42d4b8
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call fcn.004097e0
mov bl, al
jmp 0x42d4cf
jmp 0x42d4d1
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.00408780
add esp, 4
jmp 0x42d4e4
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42d4f5
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4331e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.0043b8a0
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp], 0
jmp dword [eax*4 + 0x444828]

Function at 0x4335f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.0043bee0
add esp, 0x14
test eax, eax
js 0x43374d
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.0043c290
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x43368c
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x43365a
mov eax, 0xffffffff
jmp 0x433661
lea eax, [eax*2 + 2]
push eax
call fcn.00408770
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.0043c840
add esp, 0x14
test eax, eax
jns 0x43368c
push esi
call fcn.00408780
add esp, 4
xor esi, esi
mov eax, dword [esp + 4]
mov dword [esp], 0xb8bbba85
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx]
mov edx, ecx
xor edx, 0x43f64ddf
add edx, edi
xor edx, ebx
lea ebx, [edx + edx]
and ebx, 2
mov ebp, 0x53cf855b
sub ebp, edx
or edx, 0xfffffffe
or ebp, 1
and ebp, edx
not ebp
mov edx, ebx
and edx, ebp
xor ebp, ebx
lea edx, [edx*2]
add edx, ebp
mov byte [esp + ecx], dl
inc ecx
add edi, 2
cmp ecx, 4
jne 0x4336a0
mov ecx, dword [0x448588]
test ecx, ecx
je 0x433734
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x44858c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43371a
mov ebp, edi
and ebp, 1
xor edi, 1
lea edi, [edi + ebp*2]
cmp edi, ecx
jb 0x433700
jmp 0x433734
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x433734
push eax
push 1
push ecx
push dword [0x448590]
call fcn.00437d80
add esp, 0x10
test esi, esi
jne 0x43374f
mov eax, esp
push eax
call fcn.0043b6b0
add esp, 4
test al, al
je 0x43374d
cmp dword [esp], 1
je 0x43374f
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4353b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
mov dword [esp], 0x797a7b54
mov dword [esp + 4], 0
mov ecx, 0x3bac8dc0
mov edx, 0xc0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0xc0]
lea edi, [ecx - 0x3bac8d00]
and edi, esi
or esi, ecx
not esi
or esi, edi
mov edi, esi
and edi, 0x2a5ec4c4
xor esi, 0x2a5ec4c4
lea esi, [esi + edi*2]
mov ebx, esi
or ebx, 1
add ebx, esi
not esi
or esi, 1
add ebx, esi
inc bl
mov byte [esp + edx - 0xc0], bl
dec ecx
inc edx
cmp edx, 0xc8
jne 0x4353e0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
mov edx, dword [0x444c10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx

Function at 0x435470
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x444c38]
Function at 0x4354e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp], 0xb8bbba85
xor eax, eax
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax + 0x43f64ddf]
mov esi, 0x20
sub esi, eax
xor esi, edx
and esi, ecx
xor esi, edx
mov ecx, esi
and ecx, 0x24
xor esi, 0xa4
lea ecx, [esi + ecx*2]
inc cl
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x435500
mov edi, dword [esp]
mov eax, dword [0x448588]
test eax, eax
je 0x435586
xor ecx, ecx
mov edx, dword [0x44858c]
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x435560
inc ecx
cmp eax, ecx
jne 0x435550
jmp 0x435586
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x435586
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push eax
push dword [0x448590]
call fcn.00437d80
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x3c2c1c4
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
mov edx, eax
or edx, 0xd4989d50
mov esi, 1
sub esi, eax
and esi, 1
mov ebx, edx
and ebx, 0xc0900c46
or ebx, esi
xor ebx, eax
xor ebx, ecx
xor ebx, 0x40900c41
and ebx, edx
add ebx, ebx
mov esi, 0xaf
sub esi, eax
and esi, ebx
not ebx
and ebx, edx
add ebx, ecx
sub ebx, esi
add bl, 0x70
mov byte [esp + eax], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 7
jb 0x4355a0
cmp edi, dword [esp]
jne 0x435725
push dword [esp + 8]
call fcn.004353b0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp], 0xb8bbba85
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
lea edi, [edx + 0x43f64ddf]
mov ebx, 0x20
sub ebx, edx
xor ebx, edi
and ebx, esi
xor ebx, edi
mov esi, ebx
and esi, 0x24
xor ebx, 0xa4
lea ebx, [ebx + esi*2]
inc bl
mov byte [esp + edx], bl
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 4
jb 0x435620
mov edi, dword [esp]
mov edx, dword [0x448588]
test edx, edx
mov ebx, dword [esp + 0x24]
je 0x4356c4
xor ebp, ebp
mov esi, dword [0x44858c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x43569f
mov ebx, ebp
and ebx, 1
xor ebp, 1
lea ebp, [ebp + ebx*2]
mov ebx, dword [esp + 0x24]
cmp ebp, edx
jb 0x435680
jmp 0x4356c4
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x4356c4
push 0
push ecx
push eax
push 5
push 4
push edx
push dword [0x448590]
mov esi, eax
call fcn.00437d80
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43571c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [edx + esi]
movzx ebp, word [ebx + esi]
test di, di
je 0x4356f5
add esi, 2
cmp di, bp
je 0x4356e0
cmp di, bp
je 0x435707
mov esi, dword [ecx]
test esi, esi
jne 0x4356d0
mov edi, 0xc0000225
jmp 0x43571c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00435470
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4