joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ddd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov al, byte [ebp + 8]
mov edi, eax
call fcn.0040df70
push eax
push eax
test ebx, ebx
sets al
mov ecx, ebx
sub ecx, 1
sete cl
or al, cl
mov ecx, ebx
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x40de07
jmp 0x40de0c
jmp 0x40df5a
mov eax, edi
movzx ecx, al
mov edi, esi
mov edx, dword [ebp + 0x10]
add edi, edx
add edi, 0xffffffff
mov byte [esi + edx - 1], 0
cmp ecx, 0
sete cl
test cl, 1
jne 0x40de2d
jmp 0x40de3b
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x40df58
cmp ebx, 0xa
sete cl
test cl, 1
jne 0x40de4b
jmp 0x40dee3
jmp 0x40de4d
movzx ecx, al
cmp ecx, 0x64
jb 0x40de90
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
shl edx, 1
lea eax, [0x449770]
add eax, edx
mov bl, byte [edx + 0x449771]
mov edx, edi
add edx, 0xffffffff
mov byte [edi - 1], bl
mov al, byte [eax]
mov edi, edx
add edi, 0xffffffff
mov byte [edx - 1], al
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
jmp 0x40de4d
cmp ecx, 0xa
jae 0x40dea6
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40dee1
mov eax, ecx
xor eax, 0xffffffff
and eax, 2
mov edx, ecx
and edx, 0xfffffffd
imul edx, eax
mov eax, ecx
and eax, 2
or ecx, 2
imul ecx, eax
add ecx, edx
mov al, byte [ecx + 0x449771]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [ecx + 0x449770]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x40dee1
jmp 0x40df58
cmp ebx, 0x10
sete cl
test cl, 1
jne 0x40def2
jmp 0x40def0
jmp 0x40df2d
movzx ecx, al
cmp ecx, 0x10
jge 0x40df0b
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40df58
shl ecx, 1
lea eax, str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF
add eax, ecx
jmp 0x40df17
mov cl, byte [eax + 1]
add edi, 0xffffffff
mov byte [edi], cl
jmp 0x40df21
mov al, byte [eax]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40df58
movzx ecx, al
cmp ecx, 0
jbe 0x40df54
mov eax, ecx
xor edx, edx
div ebx
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebx
mov edi, esi
jmp 0x40df2d
mov esi, edi
jmp 0x40df58
jmp 0x40df5a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40df80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a0
push eax
sub esp, 8
mov dword [ebp - 0x20], esp
sub esp, 0x40
mov dword [ebp - 0x1c], esp
sub esp, 0x80
mov dword [ebp - 0x28], esp
mov eax, dword [0x451d28]
mov dword [ebp - 0x1ac], 0x797a0304
mov dword [ebp - 0x1a8], 0
mov ecx, 0x3f
mov edx, 0xc0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + ecx - 0x1eb]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0xc5
mov byte [ebp + ecx - 0x1eb], bl
inc ecx
dec edx
cmp ecx, 0x47
jne 0x40dfd0
mov ecx, dword [ebp - 0x1ac]
mov dword [ebp - 0x128], 0xcf57c943
mov dword [ebp - 0x124], 0xc35acd5e
mov dword [ebp - 0x120], 0xc752c154
mov dword [ebp - 0x11c], 0xfba8c554
mov dword [ebp - 0x118], 0xff62f99c
mov dword [ebp - 0x114], 0xf3f2fd60
mov word [ebp - 0x110], 0
xor edx, edx
nop
nop
mov esi, edx
and esi, 0x12
mov edi, edx
and edi, 0xd
mov ebx, edx
xor ebx, 0x1823b4d2
sub ebx, edi
add ebx, edx
mov edi, ebx
and edi, esi
xor ebx, esi
lea ebx, [ebx + edi*2]
xor bl, byte [ebp + edx - 0x128]
add bl, 0xe6
mov byte [ebp + edx - 0x128], bl
inc edx
cmp edx, 0x1a
jne 0x40e040
lea edx, [ebp - 0x128]
push ecx
push 0
push edx
call eax
mov esi, eax
mov eax, dword [0x44bb3c]
mov ecx, 0xc912988c
xor ecx, dword [0x44bb44]
add eax, ecx
inc eax
jmp eax
Function at 0x40ff00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebp, dword [esp + 0x450]
mov dword [esp + 0x3c], 0xc157c773
mov dword [esp + 0x40], 0xcd69c35a
mov dword [esp + 0x44], 0xc95acf58
mov dword [esp + 0x48], 0xb51bcb6b
mov dword [esp + 0x4c], 0xb160b76b
mov dword [esp + 0x50], 0xbd52b360
mov dword [esp + 0x54], 0xb907bf54
mov dword [esp + 0x58], 0xa52cbb13
mov dword [esp + 0x5c], 0xa137a708
mov dword [esp + 0x60], 0xad3fa339
mov dword [esp + 0x64], 0xa918af4c
mov dword [esp + 0x68], 0x954aab14
mov dword [esp + 0x6c], 0x91469747
mov dword [esp + 0x70], 0x9d429346
mov dword [esp + 0x74], 0x997e9f59
mov dword [esp + 0x78], 0x85319b21
mov dword [esp + 0x7c], 0x81588712
mov dword [esp + 0x80], 0x8d47835c
mov dword [esp + 0x84], 0x89168f6c
mov dword [esp + 0x88], 0x75568b56
mov dword [esp + 0x8c], 0x7196779f
mov dword [esp + 0x90], 0x7de273b3
mov dword [esp + 0x94], 0x79ea7fec
mov dword [esp + 0x98], 0x65c37bd7
mov dword [esp + 0x9c], 0x61c467cb
mov dword [esp + 0xa0], 0x6dc963d5
mov dword [esp + 0xa4], 0x69bf6ff0
mov dword [esp + 0xa8], 0x55b76bb7
mov dword [esp + 0xac], 0x5180578d
mov dword [esp + 0xb0], 0x5d8c538d
mov dword [esp + 0xb4], 0x59b65fbc
mov dword [esp + 0xb8], 0x45925bed
mov dword [esp + 0xbc], 0x41f147f8
mov dword [esp + 0xc0], 0x4d9643f4
mov dword [esp + 0xc4], 0x49da4fac
mov dword [esp + 0xc8], 0x35df4be3
mov dword [esp + 0xcc], 0x31d6379b
mov dword [esp + 0xd0], 0x3d9d33f9
mov dword [esp + 0xd4], 0x39ab3f91
mov dword [esp + 0xd8], 0x25d13ba9
mov dword [esp + 0xdc], 0x21eb27c4
mov dword [esp + 0xe0], 0x2db02388
mov dword [esp + 0xe4], 0x29b92fbd
mov dword [esp + 0xe8], 0x15fb2b87
mov dword [esp + 0xec], 0x11c517c7
mov dword [esp + 0xf0], 0x1dc413cb
mov dword [esp + 0xf4], 0x19c81fcc
mov dword [esp + 0xf8], 0x5cc1bc8
mov dword [esp + 0xfc], 0x1e607d4
mov dword [esp + 0x100], 0xda103bd
mov dword [esp + 0x104], 0x9ad0fa2
mov dword [esp + 0x108], 0xf5a10b9a
mov dword [esp + 0x10c], 0xf129f725
mov dword [esp + 0x110], 0xfd2bf32d
mov dword [esp + 0x114], 0xf923ff2a
mov dword [esp + 0x118], 0xe5fafb26
mov byte [esp + 0x11c], 0
mov eax, dword [0x451cf8]
mov ecx, 0x5498aab1
mov edi, 0x4e
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x5498aa75]
mov edx, edi
xor edx, ecx
and edx, ebx
xor edx, ecx
mov ebx, edx
and ebx, 1
or edx, 1
add edx, ebx
add dl, 0x8a
mov byte [esp + ecx - 0x5498aa75], dl
inc ecx
dec edi
cmp ecx, 0x5498ab92
jne 0x410160
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
mov esi, ecx
push ecx
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x44c0f4]
mov ecx, 0x89921847
xor ecx, dword [str.8ehv]
add eax, ecx
inc eax
jmp eax
Function at 0x410940
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x100
push eax
push eax
mov esi, esp
sub esp, 8
mov dword [ebp - 0x20], esp
sub esp, 0x10
mov dword [ebp - 0x10], esp
sub esp, 0x200
mov dword [ebp - 0x18], esp
sub esp, 0x30
mov dword [ebp - 0x2c], esp
sub esp, 8
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x1c], esp
mov eax, dword [0x451cf8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10c], 0x23bd215d
mov dword [ebp - 0x108], 0x27bf25ae
mov dword [ebp - 0x104], 0x5bc659c4
mov dword [ebp - 0x100], 0x5f015d3d
mov dword [ebp - 0xfc], 0x530c5105
mov dword [ebp - 0xf8], 0x57765504
mov dword [ebp - 0xf4], 0x4b3d4910
mov dword [ebp - 0xf0], 0x4fd04dd5
mov dword [ebp - 0xec], 0x43dd4124
mov dword [ebp - 0xe8], 0x47d545d3
mov dword [ebp - 0xe4], 0x7b047958
mov dword [ebp - 0xe0], 0x7f5e7d08
mov dword [ebp - 0xdc], 0x73227121
mov dword [ebp - 0xd8], 0x7726752a
mov dword [ebp - 0xd4], 0x6b4a6923
mov dword [ebp - 0xd0], 0x6ff76d1b
mov dword [ebp - 0xcc], 0x633461fe
mov dword [ebp - 0xc8], 0x672d6530
mov dword [ebp - 0xc4], 0x9b1299b8
mov dword [ebp - 0xc0], 0x9fca9dca
mov dword [ebp - 0xbc], 0x93b291c9
mov dword [ebp - 0xb8], 0x970695d5
mov dword [ebp - 0xb4], 0x8b168918
mov dword [ebp - 0xb0], 0x8ff98de9
mov dword [ebp - 0xac], 0x83e081e5
mov dword [ebp - 0xa8], 0x871f85ff
mov dword [ebp - 0xa4], 0xbbe5b92c
mov dword [ebp - 0xa0], 0xbfedbde9
mov dword [ebp - 0x9c], 0xb3ecb1e7
mov dword [ebp - 0x98], 0xb7e0b5e7
mov dword [ebp - 0x94], 0xabf2a988
mov dword [ebp - 0x90], 0xafd6add7
mov dword [ebp - 0x8c], 0xa3dfa1d4
mov dword [ebp - 0x88], 0xa7faa5d8
mov dword [ebp - 0x84], 0xdb46d9f8
mov dword [ebp - 0x80], 0xdf45dd45
mov dword [ebp - 0x7c], 0xd3f2d1b5
mov dword [ebp - 0x78], 0xd7b3d593
mov dword [ebp - 0x74], 0xcb51c9ab
mov dword [ebp - 0x70], 0xcf97cd53
mov dword [ebp - 0x6c], 0xc381c1e0
mov dword [ebp - 0x68], 0xc754c55c
mov dword [ebp - 0x64], 0xfb67f967
mov dword [ebp - 0x60], 0xffa1fd99
mov dword [ebp - 0x5c], 0xf3a3f1a1
mov dword [ebp - 0x58], 0xf7a8f5bd
mov dword [ebp - 0x54], 0xebb4e9b8
mov dword [ebp - 0x50], 0xefb0edbc
mov dword [ebp - 0x4c], 0xe3c2e1b0
mov dword [ebp - 0x48], 0xe787e597
mov dword [ebp - 0x44], 0x1b7b197e
mov dword [ebp - 0x40], 0x1f871d8e
mov dword [ebp - 0x3c], 0x1347114f
mov dword [ebp - 0x38], 0x17411547
mov dword [ebp - 0x34], 0xb590956
mov dword [ebp - 0x30], 0xf0e0d5a
xor ecx, ecx
movzx edx, byte [ebp + ecx - 0x10c]
mov eax, ecx
and eax, 0xce
xor eax, 0x87d5b3ce
mov edi, ecx
and edi, 0x31
sub edi, eax
lea ebx, [edi + 0x2e7d5686]
lea eax, [edi*2 + 0x5cfaad0c]
neg eax
add eax, edi
add eax, 0x85
xor eax, ebx
and eax, edx
xor eax, ebx
add al, 0x68
mov byte [ebp + ecx - 0x10c], al
inc ecx
cmp ecx, 0xe0
jne 0x410b70
lea eax, [ebp - 0x10c]
push 0
push 0
push 0
push 0
push eax
call dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x14], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x44c3cc]
mov ecx, 0x381fbff0
xor ecx, dword [0x44c3d4]
add eax, ecx
inc eax
jmp eax
Function at 0x411260
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44cb94]

Function at 0x41e9d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.0040c670
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41e9f0
sar esi, 1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x45303c]
mov ebx, dword [esp + 0x28]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41ea24
mov eax, 0xffffffff
jmp 0x41ea27
lea eax, [ebx + ebx]
push eax
call fcn.0040c710
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x45303c]
mov eax, dword [esp + 0x28]
mov ecx, eax
add ecx, 0xd
js 0x41ea5c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c710
add esp, 4
mov edi, eax
mov dword [esp + 0xb4], 0x81d28720
mov dword [esp + 0xb8], 0x8d3f8323
mov dword [esp + 0xbc], 0x89ee8f30
mov dword [esp + 0xc0], 0x95258bd6
mov dword [esp + 0xc4], 0x912b9726
mov dword [esp + 0xc8], 0x9d23933b
mov dword [esp + 0xcc], 0x999e9f2a
mov dword [esp + 0xd0], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa1
xor cl, byte [esp + eax + 0xb4]
add cl, 0xdb
mov byte [esp + eax + 0xb4], cl
inc eax
cmp eax, 0x20
jne 0x41ead0
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41eb21
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41eb10
mov word [eax], 0
movzx ecx, word [esp + 0xb4]
test cx, cx
je 0x41eb51
lea edx, [esp + 0xb6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41eb40
mov word [eax], 0
lea eax, [esp + 0x48]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00446250
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44daa0]
Function at 0x425d00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425d10
cmp eax, 0xffffffed
jge 0x425d27
mov eax, 0xffffffff
jmp 0x425d2a
add eax, 0x12
push eax
call fcn.0040c710
add esp, 4
mov esi, eax
mov dword [esp], 0x69076b38
mov dword [esp + 4], 0x6d116f03
mov dword [esp + 8], 0x71407358
mov dword [esp + 0xc], 0x75107714
mov dword [esp + 0x10], 0x7b74
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0xe7
xor cl, byte [esp + eax]
add cl, 0x7d
mov byte [esp + eax], cl
inc eax
cmp eax, 0x14
jne 0x425d60
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x425da1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x425d90
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425dd1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425dc0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.004463e0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44df54]
Function at 0x428770
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x78
mov ebp, dword [esp + 0x8c]
mov eax, dword [0x45303c]
mov dword [esp], 0x41b2476b
mov dword [esp + 4], 0x4daf43d1
mov dword [esp + 8], 0x49da4faf
mov dword [esp + 0xc], 0x75da4b8b
mov dword [esp + 0x10], 0x71ba77e4
mov dword [esp + 0x14], 0x7dee7393
mov dword [esp + 0x18], 0x79517f9f
mov dword [esp + 0x1c], 0x7b78
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x91
xor dl, byte [esp + ecx]
add dl, 0x2b
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x20
jne 0x4287d0
lea esi, [esp + 0x6c]
mov ebx, esp
push esi
push 0
push 0
push 0xe
push ebx
push 0
call eax
mov edi, dword [esp + 0x6c]
test edi, edi
jns 0x428805
mov eax, 0xffffffff
jmp 0x428808
lea eax, [edi + edi]
push eax
call fcn.0040c710
add esp, 4
mov dword [esp + 0x50], eax
mov eax, dword [0x45303c]
mov dword [esp], 0x934691ad
mov dword [esp + 4], 0xaf4dad5b
mov dword [esp + 8], 0xab5ea949
mov dword [esp + 0xc], 0xa756a565
mov dword [esp + 0x10], 0xa37ea150
mov dword [esp + 0x14], 0xbf32bd5d
mov dword [esp + 0x18], 0xbb87b959
mov word [esp + 0x1c], 0xb5b4
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x5c
xor dl, byte [esp + ecx]
add dl, 0x34
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x23
jne 0x428870
push esi
push edi
push dword [esp + 0x58]
push 0xe
push ebx
push 0
call eax
mov eax, dword [esp + 0x6c]
mov ecx, eax
add ecx, 9
jns 0x4288a3
mov eax, 0xffffffff
jmp 0x4288aa
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c710
add esp, 4
mov edi, eax
mov dword [esp], 0xc9bacba8
mov dword [esp + 4], 0xc55bc757
mov dword [esp + 8], 0xc15dc351
mov dword [esp + 0xc], 0xfd65ff59
mov dword [esp + 0x10], 0xf9fafb71
mov dword [esp + 0x14], 0
mov eax, 0x7d22c2c
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx]
mov ecx, eax
or ecx, edx
lea esi, [eax - 0x7d22c00]
or esi, eax
and esi, edx
not ecx
or ecx, esi
add cl, 0xe1
mov byte [ebx], cl
inc ebx
dec eax
cmp eax, 0x7d22c14
jne 0x4288f0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x428941
mov eax, dword [esp + 0x50]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428930
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x428971
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428960
mov word [eax], 0
lea eax, [esp + 0x74]
push eax
push edi
call fcn.004463e0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44e6a4]
Function at 0x4290e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [0x45303c]
mov dword [esp], 0x2165277b
mov dword [esp + 4], 0x5db223b0
mov dword [esp + 8], 0x593d5f20
mov dword [esp + 0xc], 0x55395bd4
mov dword [esp + 0x10], 0x5132570b
mov dword [esp + 0x14], 0x4dca533c
mov dword [esp + 0x18], 0x49d84fc3
mov dword [esp + 0x1c], 0x45d54bd4
mov dword [esp + 0x20], 0x412447d6
mov dword [esp + 0x24], 0x7dd043db
mov dword [esp + 0x28], 0x791a7fe0
mov dword [esp + 0x2c], 0x75e87b08
mov dword [esp + 0x30], 0x71e877e5
mov dword [esp + 0x34], 0x6de673eb
mov dword [esp + 0x38], 0x69e36ff3
mov word [esp + 0x3c], 0x6b68
mov dword [esp + 0x3e], 0
mov word [esp + 0x42], 0
mov ecx, esp
mov edx, 0x46
movzx esi, byte [ecx]
lea ebx, [edx - 0x1cbfe800]
or ebx, esi
and esi, edx
not ebx
or ebx, esi
lea esi, [ebx + 0x70407962]
mov edi, esi
xor edi, 0xfffffffe
or esi, 1
and esi, edi
mov edi, esi
and edi, 0xfd
mov ebp, esi
and ebp, 2
or esi, 2
imul esi, ebp
xor ebp, 2
imul ebp, edi
lea edi, [ebx + ebx]
and edi, 2
sub ebx, edi
add ebx, esi
add ebx, ebp
add bl, 0x63
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 2
jne 0x429180
lea ebp, [esp + 0x44]
mov ebx, esp
push ebp
push 0
push 0
push 0x1e
push ebx
push 0
call eax
mov edi, dword [esp + 0x44]
test edi, edi
jns 0x4291f3
mov eax, 0xffffffff
jmp 0x4291f6
lea eax, [edi + edi]
push eax
call fcn.0040c710
add esp, 4
mov esi, eax
mov eax, dword [0x45303c]
mov dword [esp], 0xe3a3e185
mov dword [esp + 4], 0xe776e574
mov dword [esp + 8], 0xdb7bd99c
mov dword [esp + 0xc], 0xdf7fdd48
mov dword [esp + 0x10], 0xd37ed1b5
mov dword [esp + 0x14], 0xd74ed560
mov dword [esp + 0x18], 0xcb54c95d
mov dword [esp + 0x1c], 0xcf6bcd68
mov dword [esp + 0x20], 0xc360c152
mov dword [esp + 0x24], 0xc754c55d
mov dword [esp + 0x28], 0x3b96399c
mov dword [esp + 0x2c], 0x3fac3d8c
mov dword [esp + 0x30], 0x339431af
mov dword [esp + 0x34], 0x37aa35ad
mov dword [esp + 0x38], 0x2bb9298d
mov word [esp + 0x3c], 0x2d2c
mov dword [esp + 0x3e], 0
mov word [esp + 0x42], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x58
xor dl, byte [esp + ecx]
add dl, 0x48
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x44
jne 0x4292a0
push ebp
push edi
push esi
push 0x1e
push ebx
push 0
call eax
mov dword [esp], 0x239a21f4
mov dword [esp + 4], 0x27982591
mov dword [esp + 8], 0x3b9f399c
mov dword [esp + 0xc], 0x3f9c3d8e
mov dword [esp + 0x10], 0x33803189
mov dword [esp + 0x14], 0x37363590
mov eax, 0x56ab2148
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x56ab2148]
lea edx, [eax - 0x56ab2100]
and edx, ecx
or ecx, eax
xor ecx, edx
mov edx, ecx
or edx, 0x97
add edx, ecx
not ecx
or ecx, 0x97
add edx, ecx
add dl, 2
mov byte [esp + eax - 0x56ab2148], dl
inc eax
cmp eax, 0x56ab2160
jne 0x429300
push 0
push 0
push ebx
push esi
push dword [esp + 0x6c]
call fcn.00423a40
add esp, 0x14
jmp dword [0x44e70c]
Function at 0x42b8f0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x5c], 0x691e6b11
mov dword [esp + 0x60], 0x6d096f03
mov dword [esp + 0x64], 0x7140731f
mov dword [esp + 0x68], 0x750e771b
mov dword [esp + 0x6c], 0x797a7b1f
mov eax, 0x73239de7
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x73239d8b]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x7d
mov byte [esp + eax - 0x73239d8b], cl
inc eax
cmp eax, 0x73239dfb
jne 0x42b950
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x38]
push eax
call fcn.004403e0
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44ee2c]
Function at 0x436f40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4370ac
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
jmp 0x436f9c
xor ebx, ebx
test al, 1
jne 0x436fa7
jmp 0x4370a4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
jmp 0x436fb7
mov dword [esp], ebp
call fcn.0041e150
jmp 0x436fc1
xor ebx, ebx
cmp eax, 0
je 0x437098
mov cl, byte [esp + 0x1c]
mov byte [esp + 0x20], cl
mov byte [esp + 0xc], 0xc1
mov byte [esp + 0xd], 0x27
mov byte [esp + 0xe], 0x25
mov byte [esp + 0xf], 0x29
mov byte [esp + 0x10], 0xde
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x12], 0xd9
mov byte [esp + 0x13], 0x2b
mov byte [esp + 0x14], 0xd8
mov byte [esp + 0x15], 0xe1
mov byte [esp + 0x16], 0x26
mov byte [esp + 0x17], 0x39
mov byte [esp + 0x18], 0x24
mov byte [esp + 0x19], 0xb7
mov ecx, 0xe
mov byte [esp + ecx + 0xc], 0
add ecx, 1
cmp ecx, 0x10
jne 0x43701f
xor ecx, ecx
jmp 0x437030
cmp ecx, 0x10
jae 0x437072
movzx ebx, byte [esp + ecx + 0xc]
mov edx, 0xe0
sub edx, ecx
or edx, ebx
mov dword [esp + 0x24], eax
mov eax, ebp
mov ebp, esi
mov esi, 0xdc469ee0
sub esi, ecx
or esi, ebx
add esi, ecx
sub esi, ebx
add esi, 0x1f
and edx, esi
mov esi, ebp
mov ebp, eax
mov eax, dword [esp + 0x24]
mov bl, 0x64
sub bl, dl
mov byte [esp + ecx + 0xc], bl
add ecx, 1
jmp 0x437030
jmp 0x437074
lea edx, [esp + 0xc]
mov ecx, esi
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.0040d180
sub esp, 0xc
mov bl, al
jmp 0x437091
jmp 0x437093
jmp 0x437095
and bl, 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4370ac
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.004468a0
add esp, 0x14
test eax, eax
js 0x43d396
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00446c30
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43d2ec
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x43d2bd
mov eax, 0xffffffff
jmp 0x43d2bf
add eax, eax
push eax
call fcn.0040c710
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.004471f0
add esp, 0x14
test eax, eax
js 0x43d2e3
mov esi, edi
jmp 0x43d2ec
push edi
call fcn.0040c720
add esp, 4
mov eax, dword [esp]
mov dword [esp + 4], 0x282b2a25
mov word [esp + 8], 0
mov ecx, 0x48
mov edx, 0x37
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 0x45
mov ebx, edx
and ebx, 0x3a
or ebx, edi
xor bl, byte [esp + edx - 0x33]
xor bl, 0x45
add bl, 0xed
mov byte [esp + edx - 0x33], bl
dec ecx
inc edx
cmp edx, 0x3d
jne 0x43d310
mov ecx, dword [0x453040]
test ecx, ecx
je 0x43d37a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x453044]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43d360
inc edi
cmp ecx, edi
jne 0x43d350
jmp 0x43d37a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43d37a
push eax
push 1
push dword [0x453048]
push ecx
call fcn.00443090
add esp, 0x10
test esi, esi
jne 0x43d398
lea eax, [esp + 4]
push eax
call fcn.00446050
add esp, 4
test al, al
je 0x43d396
cmp dword [esp + 4], 1
je 0x43d398
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret