joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], 0xd9a4dbf5
mov dword [esp + 0x14], 0xddafdfad
mov dword [esp + 0x18], 0xd1d2d3ae
mov dword [esp + 0x1c], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
xor dl, 0x4f
add dl, al
xor dl, byte [esp + ecx + 0x10]
add dl, 0x75
mov byte [esp + ecx + 0x10], dl
inc ecx
add al, 2
cmp ecx, 0x10
jne 0x41baf0
mov dword [esp + 0x28], 0x931e9168
mov dword [esp + 0x2c], 0xaf5ead20
mov dword [esp + 0x30], 0xab9da962
mov dword [esp + 0x34], 0xa752a593
mov dword [esp + 0x38], 0xa341a157
mov dword [esp + 0x3c], 0xbf4abd5d
mov dword [esp + 0x40], 0xbb4db940
mov dword [esp + 0x44], 0xb73ab547
mov dword [esp + 0x48], 0xb3b2b17a
mov word [esp + 0x4c], 0
mov byte [esp + 0x4e], 0
xor eax, eax
movzx edx, byte [esp + eax + 0x28]
lea edi, [eax - 0x777afba4]
lea ebx, [eax + 0x5c]
mov ecx, ebx
and ecx, edi
or ecx, edx
or ebx, edi
and ebx, edx
sub ecx, ebx
add cl, 0x34
mov byte [esp + eax + 0x28], cl
lea ecx, [eax + eax]
and ecx, 2
sub eax, ecx
inc eax
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [eax + edx*2]
cmp eax, 0x27
jb 0x41bb60
movzx ecx, word [esp + 0x28]
lea eax, [esp + 0x154]
test cx, cx
je 0x41bbc1
lea edx, [esp + 0x2a]
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bbb0
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41bbf3
lea edx, [esi + 2]
mov edi, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bbe0
jmp 0x41bbf6
mov edi, dword [ebp + 0xc]
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41bc21
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bc10
mov word [eax], 0
mov edx, dword [edi]
mov dword [esp + 0x28], 0x75787826
mov byte [esp + 0x2c], 0x10
mov word [esp + 0x2d], 0
mov byte [esp + 0x2f], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 5
xor cl, byte [esp + eax + 0x28]
add cl, 0xe7
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 8
jne 0x41bc50
movzx eax, byte [esp + 0x28]
test al, al
je 0x41bc8b
lea ecx, [esp + 0x29]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41bc80
mov edi, edx
mov byte [edx], 0
lea eax, [esp + 0x138]
lea ecx, [esp + 0x148]
lea edx, [esp + 0x24]
lea ebx, [esp + 0x154]
push eax
push ecx
push edx
push ebx
call fcn.0040c640
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x445ae8]
mov ecx, 0x918a7c2e
xor ecx, dword [0x445af0]
add eax, ecx
inc eax
jmp eax
Function at 0x41e250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
cmp dword [ecx], 0xffffffff
je 0x41e3f7
mov esi, ecx
lea eax, [esp + 0x20]
push 0
push 0
push 2
push eax
call fcn.0041f620
test al, al
je 0x41e3f7
movzx eax, byte [esp + 0x21]
mov ecx, eax
and ecx, 0x7f
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0
cmp ecx, 0x7f
je 0x41e2d8
cmp ecx, 0x7e
jne 0x41e3d3
mov word [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 2
push eax
call fcn.0041f620
movzx ecx, word [esp + 8]
rol cx, 8
mov ebx, eax
movzx eax, cx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
jmp 0x41e310
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 8
push eax
call fcn.0041f620
mov ebx, eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
bswap ecx
bswap eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
movzx eax, byte [esp + 0x21]
test al, al
js 0x41e3dd
xor eax, eax
test bl, bl
je 0x41e3f7
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
push edi
mov dword [esp + 0x3c], eax
call fcn.004095d0
add esp, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
mov ecx, esi
push edx
push ebx
push edi
push eax
call fcn.0041f620
mov ebx, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
xor eax, edx
mov edi, dword [esp + 0x28]
xor edi, ecx
or edi, eax
sete byte [esp + 7]
or ecx, edx
setne cl
mov eax, dword [esp + 0x38]
and al, cl
cmp al, 1
jne 0x41e3b3
xor eax, eax
xor edx, edx
nop
mov edi, dword [esp + 0x34]
mov ecx, eax
and ecx, 3
movzx ecx, byte [esp + ecx + 0x30]
xor byte [edi + eax], cl
add eax, 1
adc edx, 0
cmp eax, dword [esp + 0x18]
mov ecx, edx
sbb ecx, dword [esp + 0x1c]
jb 0x41e390
mov edi, dword [ebp + 8]
and bl, byte [esp + 7]
cmp byte [esi + 4], 0
je 0x41e405
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0041f8a0
jmp 0x41e416
xor ebx, ebx
test al, al
jns 0x41e31d
lea eax, [esp + 0x30]
mov ecx, esi
push 0
push 0
push 4
push eax
call fcn.0041f620
test bl, bl
jne 0x41e327
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0041f720
mov eax, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], ecx
mov dword [edi], eax
jmp 0x41e3f9
Function at 0x41f420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, ecx
mov ebp, dword [esp + 0x30]
mov byte [esp + 1], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], ecx
nop
nop
mov ecx, ebx
push 0
push 0
push 1
lea eax, [esp + 0xd]
push eax
call fcn.0041f620
test al, al
je 0x41f616
movzx ecx, byte [esp + 1]
mov esi, dword [ebp]
mov edi, dword [ebp + 4]
mov edx, edi
sub edx, esi
cmp edi, dword [ebp + 8]
jne 0x41f5f7
mov dword [esp + 8], esi
mov byte [esp + 2], cl
mov byte [esp + 3], al
lea eax, [edx + 1]
mov ebp, edx
shr ebp, 1
mov ecx, ebp
and ecx, edx
mov ebx, edx
mov edx, ebp
mov dword [esp + 4], ebx
xor edx, ebx
lea ebx, [edx + ecx*2]
cmp ebx, eax
ja 0x41f49c
mov ebx, eax
push ebx
call fcn.004095d0
add esp, 4
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x41f5d3
mov dword [esp + 0x18], ebx
cmp esi, eax
mov ebx, dword [esp + 4]
mov dword [esp + 0xc], esi
jbe 0x41f57f
cmp edi, esi
jbe 0x41f57f
test ebx, ebx
je 0x41f5bd
mov edx, dword [esp + 4]
mov eax, edx
and eax, 0xfffffffe
mov ecx, edx
not ecx
and ecx, 1
sub eax, ecx
mov ecx, dword [esp + 0xc]
add ecx, eax
mov esi, dword [esp + 8]
add eax, esi
mov ebp, edx
and ebp, 7
je 0x41f514
neg ebp
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp ebp, edx
jne 0x41f500
add eax, edx
add ecx, edx
add edx, dword [esp + 4]
sub esi, edi
cmp esi, 0xfffffff8
ja 0x41f5bd
neg edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + esi]
mov byte [ecx + esi], bl
movzx ebx, byte [eax + esi - 1]
mov byte [ecx + esi - 1], bl
movzx ebx, byte [eax + esi - 2]
mov byte [ecx + esi - 2], bl
movzx ebx, byte [eax + esi - 3]
mov byte [ecx + esi - 3], bl
movzx ebx, byte [eax + esi - 4]
mov byte [ecx + esi - 4], bl
movzx ebx, byte [eax + esi - 5]
mov byte [ecx + esi - 5], bl
movzx ebx, byte [eax + esi - 6]
mov byte [ecx + esi - 6], bl
movzx ebx, byte [eax + esi - 7]
mov byte [ecx + esi - 7], bl
add esi, 0xfffffff8
cmp edx, esi
jne 0x41f530
jmp 0x41f5bd
mov ecx, ebx
shr ecx, 2
mov eax, dword [esp + 8]
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
lea eax, [esi + edx]
add edx, dword [esp + 8]
and ebp, 1
mov esi, edx
mov ecx, ebp
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x41f5bd
mov ecx, dword [esp + 4]
and ecx, 2
movzx edx, byte [edx + ecx]
mov byte [eax + ecx], dl
mov eax, dword [esp + 0x30]
push dword [eax]
call fcn.004095e0
add esp, 4
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0xc]
mov ebp, dword [esp + 0x30]
mov dword [ebp], esi
mov edx, dword [esp + 4]
lea eax, [esi + edx]
mov dword [ebp + 4], eax
add ebx, esi
mov dword [ebp + 8], ebx
movzx eax, byte [esp + 3]
movzx ecx, byte [esp + 2]
mov ebx, dword [esp + 0x14]
mov byte [esi + edx], cl
inc dword [ebp + 4]
cmp byte [esp + 0x10], 0xd
je 0x41f616
movzx ecx, byte [esp + 1]
mov dword [esp + 0x10], ecx
cmp cl, 0xa
jne 0x41f440
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x421830
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x421840
cmp eax, 0xffffffed
jge 0x421857
mov eax, 0xffffffff
jmp 0x42185a
add eax, 0x12
push eax
call fcn.004095d0
add esp, 4
mov esi, eax
mov dword [esp], 0x6319610c
mov dword [esp + 4], 0x67ef6501
mov dword [esp + 8], 0x7b44794c
mov dword [esp + 0xc], 0x7f1c7d18
mov dword [esp + 0x10], 0x7170
mov eax, 0x53bfd3e8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x53bfd3e8]
xor ecx, eax
mov edx, 4
sub edx, ecx
add ecx, 0x7b
and edx, 4
and ecx, 0xfb
sub ecx, edx
inc cl
mov byte [esp + eax - 0x53bfd3e8], cl
inc eax
cmp eax, 0x53bfd3fc
jne 0x4218a0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4218f1
add edi, 2
mov eax, esi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4218e0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x421921
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x421910
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043f420
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x445e60]
Function at 0x42afe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42b03a
cmp edi, 1
je 0x42b03a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42b011
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42b010
cmp ecx, 0x20
je 0x42b010
cmp ecx, 0x2b
mov edx, edi
je 0x42b030
cmp ecx, 0x2d
jne 0x42b04f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42b054
xor edi, edi
test eax, eax
je 0x42b20d
mov dword [eax], 0x16
jmp 0x42b20d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42b07d
cmp edx, 0x10
jne 0x42b095
cmp byte [ebx], 0x30
jne 0x42b076
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42b097
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42b097
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42b0f0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42b1a8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42b117
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42b1d8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42b1d8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42b0d0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42b160
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42b169
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42b18d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42b1bd
test bl, bl
jne 0x42b1bd
mov ebx, dword [esp + 0x10]
jmp 0x42b0e3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42b0c5
mov esi, edi
test bl, bl
jne 0x42b1cb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42b0c5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42b1e6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42b1f4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42b204
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42b20d
cmp byte [esp + 3], 0
jne 0x42b20d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42e6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx edi, word [esi]
test di, di
je 0x42e7fd
mov edx, dword [esp + 0x18]
dec edx
je 0x42e7fd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, di
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42e710
lea ecx, [ebp + 1]
mov byte [ebp], bl
jmp 0x42e7a0
cmp ebx, 0x7ff
ja 0x42e740
cmp edx, 2
jb 0x42e740
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea ecx, [ebp + 2]
jmp 0x42e7a0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x42e7ba
cmp edx, 4
jb 0x42e7ba
shl ebx, 0xa
movzx ecx, word [esi + 2]
lea eax, [ebx + ecx]
add eax, 0xfca02400
add esi, 4
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
mov al, 0x3f
sub al, cl
and al, 0x3f
xor al, 0xbf
lea ecx, [ebp + 4]
mov byte [ebp + 3], al
mov edi, esi
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, ecx
mov esi, edi
mov ebp, ecx
movzx edi, word [esi]
test di, di
je 0x42e7fd
test edx, edx
jne 0x42e6f0
jmp 0x42e7fd
movzx eax, cx
cmp eax, 0xdc00
jne 0x42e7c8
mov esi, edi
jmp 0x42e7a8
cmp edx, 3
jb 0x42e7f9
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
mov ecx, eax
not ecx
or ecx, 0x3f
add ecx, eax
add cl, 0x81
mov byte [ebp + 1], cl
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
lea ecx, [ebp + 3]
jmp 0x42e7a0
mov ecx, ebp
jmp 0x42e7a0
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432890
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00415ce0
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
jmp 0x4328a8
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
xor ebx, ebx
cmp eax, 0
je 0x432a2b
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x432901
jmp 0x432a23
mov dword [ebp - 0x14], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042e650
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x432a12
mov dword [ebp - 0x1c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.004095d0
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.0042e6c0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x8f
mov byte [edi + 1], 0x55
mov byte [edi + 2], 0x57
mov byte [edi + 3], 0x5f
mov byte [edi + 4], 0xaa
mov byte [edi + 5], 0x5e
mov byte [edi + 6], 0xa3
mov byte [edi + 7], 0x55
mov byte [edi + 8], 0xa4
mov byte [edi + 9], 0x93
mov byte [edi + 0xa], 0x52
mov byte [edi + 0xb], 0x4f
mov byte [edi + 0xc], 0x50
mov byte [edi + 0xd], 0xc5
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x14
jne 0x43299e
mov ecx, dword [ebp + 8]
xor eax, eax
jmp 0x4329b1
cmp eax, 0x14
jae 0x4329e0
mov dl, byte [edi + eax]
mov ebx, eax
add ebx, 0x63
mov esi, 0x1c
sub esi, eax
and esi, 0x11
and ebx, 0xee
sub ebx, esi
mov ecx, dword [ebp + 8]
xor bl, dl
add bl, 0x66
mov byte [edi + eax], bl
add eax, 1
jmp 0x4329b1
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x18]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.0040a4a0
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.004095e0
add esp, 4
jmp 0x432a0e
jmp 0x432a10
jmp 0x432a12
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x432a23
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x432a2b
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4375f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x437610
mov dword [esp], 0x6e6a6cf1
mov dword [esp + 4], 0
mov esi, 0xa584d9e7
nop
movzx ebx, byte [esp + esi + 0x5a7b2619]
xor ebx, esi
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0x7c
mov byte [esp + esi + 0x5a7b2619], bl
inc esi
cmp esi, 0xa584d9ef
jne 0x437630
test edx, edx
je 0x4376be
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x437681
mov ebp, eax
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x437670
cmp edi, 3
jb 0x4376be
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x437690
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4384d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.0043fa10
add esp, 0x14
test eax, eax
js 0x438613
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.0043fe30
add esp, 0x24
xor esi, esi
test eax, eax
js 0x438569
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x438535
mov eax, 0xffffffff
jmp 0x43853c
lea eax, [eax*2 + 2]
push eax
call fcn.004095d0
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.00440420
add esp, 0x14
test eax, eax
js 0x438560
mov esi, edi
jmp 0x438569
push edi
call fcn.004095e0
add esp, 4
mov eax, dword [esp + 4]
mov dword [esp], 0x181b1a1d
mov ecx, 0xbb
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0xbb]
lea edi, [ecx - 0x60afe900]
or edi, edx
and edx, ecx
sub edi, edx
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
add dl, 0x58
mov byte [esp + ecx - 0xbb], dl
inc ecx
cmp ecx, 0xbf
jne 0x438580
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x4385fa
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x4385e0
inc edi
cmp ecx, edi
jne 0x4385d0
jmp 0x4385fa
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4385fa
push eax
push 4
push ecx
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x10
test esi, esi
jne 0x438615
mov eax, esp
push eax
call fcn.0043f040
add esp, 4
test al, al
je 0x438613
cmp dword [esp], 1
je 0x438615
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a220
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xb18e8f5c
mov byte [esp + 4], 0
mov ecx, 0x77f47bdd
mov edx, 0x880b8422
nop
nop
nop
movzx edi, byte [esp + ecx - 0x77f47bdd]
lea esi, [edi + edi]
not esi
add esi, edi
mov ebx, ecx
or ebx, edi
not edi
and edi, esi
mov esi, edi
xor esi, edx
add esi, edi
mov ebp, edi
and ebp, ecx
mov edi, esi
not edi
add edi, ebp
lea eax, [ebx + ebx]
not eax
add eax, ebx
sub esi, ebp
and esi, eax
xor edi, eax
add edi, eax
sub edi, esi
lea ebx, [edi + edi]
not ebx
add ebx, edi
add bl, 0xaf
mov byte [esp + ecx - 0x77f47bdd], bl
inc ecx
dec edx
cmp ecx, 0x77f47be2
jne 0x43a240
mov eax, dword [esp]
mov ecx, dword fs:[eax]
push dword [esp + 0x1c]
push 0
push dword [ecx + 0x18]
call dword [0x453d00]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43a2b0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4485a8]
Function at 0x43a620
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43a714
xor eax, eax
cmp dword [ecx], 0
jne 0x43a792
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x181b1a1d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 1
mov ebx, esi
xor ebx, 0xb19c89d9
mov edi, eax
and edi, 2
mov ebp, edi
sub ebp, ebx
mov edx, 0x2b
sub edx, ebp
neg ebx
add ebx, edi
add ebx, 0x14
and edx, 0x35
and ebx, 0x4a
or ebx, edx
xor bl, byte [esp + eax]
xor bl, 0xb5
add bl, 0x59
mov byte [esp + eax], bl
xor esi, 0x9bbaf00d
neg esi
lea eax, [edi + esi]
inc eax
mov edx, eax
and edx, 0xd
xor eax, 0x9bbaf00d
lea eax, [eax + edx*2]
cmp eax, 4
jb 0x43a690
mov eax, dword [esp]
mov esi, dword [0x44bcdc]
test esi, esi
je 0x43a792
xor edi, edi
mov ebx, dword [0x44bce0]
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43a79c
inc edi
cmp esi, edi
jne 0x43a700
jmp 0x43a792
mov dword [esp + 4], 0x146474c
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0x50cf3e91
mov ecx, 0x6e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x50cf3e8d]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, edx
and esi, 0x40c30628
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
add esi, ebx
xor edx, 0x6bf3c72a
mov edi, esi
and edi, edx
xor edx, esi
lea edx, [edx + edi*2]
inc dl
mov byte [esp + eax - 0x50cf3e8d], dl
inc eax
dec ecx
cmp eax, 0x50cf3e98
jne 0x43a740
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43a792
lea eax, [esp + 0x1c]
lea edx, [esp + 4]
push eax
push edx
push dword [esp + 0x40]
push ecx
push 0x10
push esi
push dword [0x44bce4]
call fcn.0043cba0
add esp, 0x1c
jmp 0x43a792
Function at 0x43a7d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43a89e
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0x181b1a1d
xor edx, edx
nop
nop
mov esi, edx
and esi, 1
mov ebx, esi
xor ebx, 0xb19c89d9
mov edi, edx
and edi, 2
mov ebp, edi
sub ebp, ebx
mov eax, 0x2b
sub eax, ebp
neg ebx
add ebx, edi
add ebx, 0x14
and eax, 0x35
and ebx, 0x4a
or ebx, eax
xor bl, byte [esp + edx]
xor bl, 0xb5
add bl, 0x59
mov byte [esp + edx], bl
xor esi, 0x9bbaf00d
neg esi
lea eax, [edi + esi]
inc eax
mov edx, eax
and edx, 0xd
xor eax, 0x9bbaf00d
lea edx, [eax + edx*2]
cmp edx, 4
jb 0x43a7f0
mov edx, dword [0x44bcdc]
test edx, edx
je 0x43a891
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44bce0]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43a870
inc edi
cmp edx, edi
jne 0x43a860
jmp 0x43a891
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43a891
push dword [esp + 4]
push 4
push edx
push dword [0x44bce4]
mov esi, ecx
call fcn.0043cba0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret