joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403080
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x403188
mov esi, edx
test edx, edx
je 0x403188
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x403188
push esi
call fcn.004094f0
add esp, 4
test eax, eax
je 0x4030da
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4030e1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x4030c0
jmp 0x4030e3
mov ebp, 0x1505
jmp 0x4030e3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x403190
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40314a
call fcn.00403280
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x403188
push ecx
call fcn.004094f0
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x4031ff
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x4031a8
inc ebx
dec esi
je 0x4030ff
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x403104
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x4031a0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.004094f0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4031a0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00409520
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4031a0
mov eax, 0xffffffff
jmp 0x403188
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x403218
inc ebx
dec esi
je 0x403145
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40314a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x403210
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.004094f0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403210
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00409520
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x403210
jmp 0x40314a
Function at 0x403910
Capabilities:
Compute adler32 checksum
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403ac6
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov ecx, edi
shr ecx, 0x10
mov eax, edi
or eax, 0xffff
xor edi, 0xffff0000
and edi, eax
test ebx, ebx
je 0x403abf
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x4039a3
add ebp, dword [esp + 0xc]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp + 0x10]
sub ebx, esi
mov esi, 0x15b0
je 0x403abf
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x403a1d
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x4039c0
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
mov dword [esp + 0x10], ebx
jbe 0x403968
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0xc], eax
je 0x403a73
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x403a50
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x403960
jmp 0x403a85
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x403960
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403a90
jmp 0x403960
shl ecx, 0x10
add ecx, edi
jmp 0x403acb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403b44
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x403b46
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
mov ebp, eax
not ebp
or ebp, 0xf
add eax, ebp
inc eax
mov ebp, edi
and ebp, 0xf
xor ebp, eax
xor ebx, dword [ebp*4 + 0x43da18]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
or edi, ebp
xor edi, ebx
xor eax, dword [edi*4 + 0x43da18]
inc esi
cmp edx, esi
jne 0x403b00
not eax
jmp 0x403b46
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409ab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409b50
sub esp, 0x100
mov esi, esp
call fcn.00437620
test al, 1
jne 0x409acc
jmp 0x409b19
call fcn.00431cf0
jmp 0x409ad3
test al, 1
jne 0x409ad9
jmp 0x409b12
call fcn.0040ab90
test al, 1
jne 0x409ae4
jmp 0x409b10
jmp 0x409ae6
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409b30
add esp, 8
call fcn.0040f7a0
call fcn.0040bbb0
jmp 0x409b0a
jmp 0x409b0c
jmp 0x409b0e
jmp 0x409b10
jmp 0x409b12
call fcn.004382e0
jmp 0x409b19
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x409cda
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x409bed
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409c11
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409be0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409be0
lea esi, [ebx + 1]
push esi
call fcn.00409230
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409ce8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409c58
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x409cea
movzx edx, word [edi]
test dx, dx
je 0x409cea
cmp dx, 0x7f
jbe 0x409c40
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x409ca0
cmp esi, 0x7ff
ja 0x409ca0
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409c47
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x409c47
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409c47
push 1
call fcn.00409230
add esp, 4
mov ebp, eax
jmp 0x409cea
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409d07
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409d02
test eax, eax
jne 0x409d00
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405d60
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x411010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x148
mov word [esp + 0x48], 0x11fb
mov dword [esp + 0x4a], 0
mov dword [esp + 0x4e], 0
mov dword [esp + 0x52], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xd
ja 0x4110af
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx esi, byte [esp + eax + 0x48]
lea eax, [edx - 0x7824a22d]
lea ecx, [edx + esi]
add ecx, 0x87db5dd3
add edx, 0xd3
and edx, esi
and eax, esi
add eax, edx
mov edx, eax
xor edx, ecx
not eax
and eax, ecx
add eax, eax
sub eax, edx
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0xc8]
mov ecx, eax
xor ecx, 0x3a
and eax, 0x3a
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x48], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xe
jb 0x411050
lea esi, [esp + 0x48]
push esi
push dword [ebp + 8]
call fcn.004029a0
add esp, 8
mov edi, eax
xor eax, eax
test edi, edi
sete al
mov ecx, 0x7b5728cb
xor ecx, dword [0x441ac8]
mov eax, dword [eax*4 + 0x441ac0]
add ecx, eax
inc ecx
xor ebx, ebx
xor eax, eax
jmp ecx
Function at 0x415a8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x415a80
sar esi, 1
lea edi, [esp + 0x84]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x449888]
mov ebx, dword [esp + 0x84]
test ebx, ebx
jns 0x415ab5
mov eax, 0xffffffff
jmp 0x415ab8
lea eax, [ebx + ebx]
push eax
call fcn.00409230
add esp, 4
push edi
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x449888]
mov dword [esp + 0x20], 0xf3becdb0
mov dword [esp + 0x24], 0xf761f191
mov dword [esp + 0x28], 0xfbdaf560
mov dword [esp + 0x2c], 0xff9bf982
mov dword [esp + 0x30], 0xe375fd6a
mov dword [esp + 0x34], 0xe775e189
mov dword [esp + 0x38], 0xebeae576
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov byte [esp + 0x40], 0
mov dword [esp + 0x90], 0
mov ecx, dword [esp + 0x90]
cmp ecx, 0x20
ja 0x415b9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x90]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx - 0x5671a3a2]
and esi, edx
add ecx, edx
add ecx, 0xa98e5c5e
add esi, esi
sub ecx, esi
mov dword [esp + 0xac], ecx
mov ecx, dword [esp + 0xac]
mov edx, ecx
or edx, 0x6d
and ecx, 0x6d
add ecx, edx
inc cl
mov edx, dword [esp + 0x90]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0x90]
mov ecx, dword [esp + 0x90]
cmp ecx, 0x21
jb 0x415b40
lea edi, [esp + 0x90]
lea edx, [esp + 0x20]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xac]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x84]
mov ecx, eax
add ecx, 0xd
jns 0x415bd8
mov eax, 0xffffffff
jmp 0x415bdd
add eax, eax
add eax, 0x1a
push eax
call fcn.00409230
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x415c11
lea edx, [ebx + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415c00
mov word [eax], 0
movzx ecx, word [esp + 0x90]
test cx, cx
mov dword [esp + 0x80], ebx
je 0x415c51
lea edx, [esp + 0x92]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415c40
mov word [eax], 0
lea eax, [esp + 0x18]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043ad40
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442978]
Function at 0x41e190
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x33733115
mov dword [esp + 0x14], 0x37a635a4
mov dword [esp + 0x18], 0x2b4b296c
mov dword [esp + 0x1c], 0x2f4f2db8
mov dword [esp + 0x20], 0x234e2105
mov dword [esp + 0x24], 0x27be2550
mov dword [esp + 0x28], 0x5bc459cd
mov dword [esp + 0x2c], 0x5f3b5d38
mov dword [esp + 0x30], 0x533051c2
mov dword [esp + 0x34], 0x57c455cd
mov dword [esp + 0x38], 0x4b26492c
mov dword [esp + 0x3c], 0x4fdc4d3c
mov dword [esp + 0x40], 0x432441df
mov dword [esp + 0x44], 0x47da45dd
mov dword [esp + 0x48], 0x7be9791d
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x7d7c
mov dword [esp + 0x52], 0
mov dword [esp + 0x4e], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x45
ja 0x41e2a7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx esi, byte [esp + ecx + 0x10]
lea edi, [edx - 0x72800b58]
lea ecx, [edx + esi]
add ecx, 0x8d7ff4a8
add edx, 0xa8
xor edx, edi
and edi, esi
and edx, esi
lea edx, [edx + edi*2]
mov esi, ecx
not esi
and esi, edx
not edx
and edx, ecx
sub edx, esi
mov dword [esp + 0x5c], edx
mov ecx, dword [esp + 0x5c]
add cl, 0x68
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x46
jb 0x41e250
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x449888]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41e2f0
mov eax, 0xffffffff
jmp 0x41e2f3
lea eax, [edi + edi]
push eax
call fcn.00409230
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x449888]
mov dword [esp + 0x10], 0xc36ac194
mov dword [esp + 0x14], 0xc768c571
mov dword [esp + 0x18], 0xcb6fc96c
mov dword [esp + 0x1c], 0xcf6ccd7e
mov dword [esp + 0x20], 0xd360d179
mov dword [esp + 0x24], 0xd7d6d570
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x17
ja 0x41e3bf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x60]
mov edi, 0x5e7a379f
sub edi, eax
or edi, ecx
not ecx
or ecx, edx
add edi, ecx
mov eax, 0xfffffffe
sub eax, edi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0x5f
and eax, 0x5f
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
mov eax, dword [esp + 8]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp eax, 0x18
jb 0x41e360
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.00418430
add esp, 0x14
mov ebx, eax
jmp dword [0x443918]
Function at 0x423650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x160
mov dword [esp + 0x10], 0x63236105
mov dword [esp + 0x14], 0x67f665f4
mov dword [esp + 0x18], 0x6bcb692c
mov dword [esp + 0x1c], 0x6fcf6df8
mov dword [esp + 0x20], 0x53525135
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0xe8], 0
mov ecx, dword [esp + 0xe8]
cmp ecx, 0x1b
ja 0x423715
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0xe8]
mov edx, dword [esp + 0xe8]
movzx edx, byte [esp + edx + 0x10]
mov esi, ecx
and esi, 0x26f850d0
xor ecx, 0xa6f850d0
lea ecx, [ecx + esi*2]
xor ecx, edx
mov dword [esp + 0xb8], ecx
mov ecx, dword [esp + 0xb8]
add cl, 0x50
mov edx, dword [esp + 0xe8]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 0xe8]
mov ecx, dword [esp + 0xe8]
cmp ecx, 0x1c
jb 0x4236c0
lea esi, [esp + 0x132]
lea edx, [esp + 0x10]
mov ecx, 5
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x146]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 9
push esi
push 0
call dword [0x449888]
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
add eax, eax
mov dword [esp + 0x48], eax
jmp dword [0x4445fc]
Function at 0x42e800
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [ebp + 8]
mov byte [esp + 0xf], 0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x42e9a0
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp + 0x48], eax
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
setne al
test al, 1
jne 0x42e872
jmp 0x42e99a
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.0041a050
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x3c], 0
je 0x42e988
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov bl, byte [esp + 0x14]
mov byte [esp + 0x1c], bl
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x21], 0x79
mov byte [esp + 0x22], 0x73
mov byte [esp + 0x23], 0x7b
mov byte [esp + 0x24], 0x76
mov byte [esp + 0x25], 0x7a
mov byte [esp + 0x26], 0x67
mov byte [esp + 0x27], 9
mov byte [esp + 0x28], pe_nt_image_headers32
mov byte [esp + 0x29], 0xb7
mov byte [esp + 0x2a], 0xe
mov byte [esp + 0x2b], 0xb
mov byte [esp + 0x2c], 0xc
mov byte [esp + 0x2d], 0x81
mov word [esp + 0x32], 0
mov dword [esp + 0x2e], 0
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x10]
cmp esi, 0x14
jae 0x42e96b
jmp 0x42e91c
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
movzx edi, byte [esp + edi + 0x20]
mov ebx, esi
and ebx, 0xcd2f4c2
xor esi, 0x8cd2f4c2
lea esi, [esi + ebx*2]
mov ebx, esi
add ebx, edi
and esi, edi
add esi, esi
sub ebx, esi
mov dword [esp + 0x44], ebx
mov ebx, dword [esp + 0x44]
add bl, 0xb2
mov esi, dword [esp + 0x10]
mov byte [esp + esi + 0x20], bl
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x10]
cmp esi, 0x14
jb 0x42e91c
jmp 0x42e96b
lea esi, [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.00409d60
sub esp, 0xc
and al, 1
mov byte [esp + 0xf], al
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42e99a
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [esp + 0xf]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4343d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x68
push 7
push 0x100080
push eax
push dword [ebp + 8]
call fcn.0043ad40
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44650c]
Function at 0x435fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 8], 0x232021f6
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xe
ja 0x436038
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x144e565b]
and edx, ecx
add eax, ecx
add eax, 0x144e565b
add edx, edx
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0x82
and eax, 2
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xf
jb 0x435ff0
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
push ecx
push 0
push dword [eax + 0x18]
call dword [0x4518ac]
mov ecx, dword [0x4468e4]
mov edx, 0xea5b2309
xor edx, dword [0x4468ec]
add ecx, edx
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x436440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edx, dword [ecx + 4]
test edx, edx
je 0x436540
xor eax, eax
cmp dword [ecx], 0
jne 0x436545
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x3a393837
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xf
ja 0x436515
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edi, byte [esp + edx + 8]
lea esi, [eax + 0x5d0c1c27]
mov edx, esi
and edx, edi
mov ebx, esi
xor ebx, edi
or esi, edi
xor esi, ebx
add eax, 0x27
and eax, edi
add eax, esi
lea edx, [ebx + edx*2]
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0xef
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x10
jb 0x4364d0
mov eax, dword [esp + 8]
mov esi, dword [0x44988c]
test esi, esi
je 0x436545
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x449890]
nop
nop
cmp dword [ebx + edi*8], 0x94b236a1
je 0x43654f
inc edi
cmp esi, edi
jne 0x436530
jmp 0x436545
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436545
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x449894]
push esi
call fcn.00438470
add esp, 0x1c
jmp 0x436545

Function at 0x436580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [ecx]
test eax, eax
je 0x43666a
mov esi, ecx
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x3a393837
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xf
ja 0x43661a
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx ebx, byte [esp + edx + 0x10]
lea edi, [ecx + 0x5d0c1c27]
mov edx, edi
and edx, ebx
mov eax, edi
xor eax, ebx
or edi, ebx
xor edi, eax
add ecx, 0x27
and ecx, ebx
add ecx, edi
lea eax, [eax + edx*2]
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xef
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x10
jb 0x4365d0
mov ecx, dword [0x44988c]
test ecx, ecx
je 0x43665d
mov edx, dword [esp + 0x10]
xor edi, edi
mov ebx, dword [0x449890]
cmp dword [ebx + edi*8], 0x11081610
je 0x436640
inc edi
cmp ecx, edi
jne 0x436630
jmp 0x43665d
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43665d
push dword [esp + 8]
push 1
push dword [0x449894]
push ecx
call fcn.00438470
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret