joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4027ce
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40286c
not eax
test bl, 1
jne 0x4027d5
mov edx, ebx
cmp ebx, 1
jne 0x402806
jmp 0x40286a
xor eax, eax
jmp 0x40286c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43f80c]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x43f80c]
cmp ebx, 1
je 0x40286a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43f80c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43f80c]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43f80c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43f80c]
add esi, 2
cmp edx, esi
jne 0x402810
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x4088c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x4480f0], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x448aac], ecx
test eax, eax
je 0x408911
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x448ab0], ecx
add eax, 2
jmp 0x4088d0
mov dword [0x4480ec], 0x270
ret
Function at 0x408ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408d0a
mov edi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and edi, 0x80000000
mov esi, dword [ecx + eax + 0x9c8]
mov edx, esi
and edx, 0x7ffffffe
or edx, edi
shr edx, 1
mov edi, esi
and esi, 1
neg esi
and esi, 0x9908b0df
mov ebx, esi
and ebx, edx
add esi, edx
add ebx, ebx
sub esi, ebx
xor esi, dword [ecx + eax + 0xff8]
mov dword [ecx + eax + 0x1384], esi
add eax, 4
jne 0x408cc0
mov eax, 0x270
jmp 0x408d1c
cmp eax, 0x4e0
jb 0x408d1c
mov esi, ecx
call fcn.00408d70
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
mov edx, ecx
xor edx, 0x1039ffff
or ecx, 0xefc60000
and ecx, edx
mov edx, ecx
and edx, eax
add ecx, eax
add edx, edx
sub ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x408d70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, SysReAllocString
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0x70
mov esi, eax
or esi, 0x270
add esi, edi
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
mov ebx, dword [ecx + esi*4 + 8]
mov edi, ebx
and edi, 0x7ffffffe
or edi, ebp
shr edi, 1
and ebx, 1
neg ebx
and ebx, 0x9908b0df
xor edi, dword [ecx + esi*4 + 0x638]
xor edi, ebx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x408d80
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
jmp 0x408e12
and esi, 0x80000000
mov ebx, edx
and ebx, 0x7ffffffe
or ebx, esi
shr ebx, 1
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, ebx
xor edi, 0x2216c1bd
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
mov esi, edx
cmp eax, 0x4e1
je 0x408e26
mov edx, dword [ecx + eax*4]
mov edi, 0x2216c1bd
test dl, 1
je 0x408de0
mov edi, 0xbb1e7162
jmp 0x408de0
mov edx, dword [ecx + 0x1380]
mov esi, edx
not esi
or esi, 0x80000000
mov eax, SysReAllocString
and eax, dword [ecx + 4]
add edx, esi
inc edx
or eax, edx
mov edx, eax
shr edx, 1
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, edx
mov edx, dword [ecx + 0x634]
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b9b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x434
mov esi, dword [esp + 0x460]
mov ebx, dword [esp + 0x45c]
mov dword [esp + 0x34], 0xb72589fd
mov dword [esp + 0x38], 0xb3dbb532
mov dword [esp + 0x3c], 0xbf2ab124
mov dword [esp + 0x40], 0xbbe9bddd
mov dword [esp + 0x44], 0xa7f4b9e5
mov dword [esp + 0x48], 0xa382a5f4
mov dword [esp + 0x4c], 0xafd5a188
mov dword [esp + 0x50], 0xab38adc5
mov dword [esp + 0x54], 0xd745a9c4
mov dword [esp + 0x58], 0xd34dd54f
mov dword [esp + 0x5c], 0xdfacd1f0
mov dword [esp + 0x60], 0xdbfadda0
mov dword [esp + 0x64], 0xc796d989
mov dword [esp + 0x68], 0xc392c596
mov dword [esp + 0x6c], 0xcfeec187
mov dword [esp + 0x70], 0xcba3cdb7
mov dword [esp + 0x74], 0xf7acc95a
mov dword [esp + 0x78], 0xf3b5f5a8
mov dword [esp + 0x7c], 0xff66f1d0
mov dword [esp + 0x80], 0xfba6fda6
mov dword [esp + 0x84], 0xe7c6f9d1
mov dword [esp + 0x88], 0xe372e5a5
mov dword [esp + 0x8c], 0xef7ae170
mov dword [esp + 0x90], 0xeb91ed81
mov dword [esp + 0x94], 0x1778e985
mov dword [esp + 0x98], 0x137b1563
mov dword [esp + 0x9c], 0x1f4d118c
mov dword [esp + 0xa0], 0x1b451d41
mov dword [esp + 0xa4], 0x7541943
mov dword [esp + 0xa8], 0x358055b
mov dword [esp + 0xac], 0xf260120
mov dword [esp + 0xb0], 0xb420d7b
mov dword [esp + 0xb4], 0x37430974
mov dword [esp + 0xb8], 0x33663540
mov dword [esp + 0xbc], 0x3faa3110
mov dword [esp + 0xc0], 0x3bad3d55
mov dword [esp + 0xc4], 0x27063955
mov dword [esp + 0xc8], 0x234f256f
mov dword [esp + 0xcc], 0x2fb9214f
mov dword [esp + 0xd0], 0x2b032dbf
mov dword [esp + 0xd4], 0x57192908
mov dword [esp + 0xd8], 0x53cc553c
mov dword [esp + 0xdc], 0x5fcb51c3
mov dword [esp + 0xe0], 0x5b095d31
mov dword [esp + 0xe4], 0x47175909
mov dword [esp + 0xe8], 0x4310451d
mov dword [esp + 0xec], 0x4f1c4110
mov dword [esp + 0xf0], 0x4b184d1c
mov dword [esp + 0xf4], 0x77564918
mov dword [esp + 0xf8], 0x7313750b
mov dword [esp + 0xfc], 0x7f1f711a
mov dword [esp + 0x100], 0x7b137de2
mov dword [esp + 0x104], 0x673b792b
mov dword [esp + 0x108], 0x6339653b
mov dword [esp + 0x10c], 0x6f316132
mov dword [esp + 0x110], 0x6b6a6d36
mov eax, dword [0x4494a4]
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x9e
xor dl, byte [esp + ecx + 0x34]
add dl, 0xea
mov byte [esp + ecx + 0x34], dl
inc ecx
cmp ecx, 0xe0
jne 0x40bc00
lea ecx, [esp + 0x34]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
mov dword [esp + 4], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x443000]
mov ecx, dword [0x443008]
mov edx, ecx
and edx, 0x2e78cca2
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x5187335e
jmp eax
Function at 0x412be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x412c00
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x412c20
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x412c40
mov eax, 0xffffffff
jmp 0x412c49
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00408230
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x412c81
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x412c70
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [ebp]
test cx, cx
je 0x412cb1
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x412ca0
mov word [ebx], 0
mov ecx, esp
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x20], eax
push eax
call fcn.0043d8e0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443644]
Function at 0x412f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1278
call fcn.00408200
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x412f50
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44a7f0]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x412f84
mov eax, 0xffffffff
jmp 0x412f87
lea eax, [ebx + ebx]
push eax
call fcn.00408230
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x30], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44a7f0]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, 0xd
js 0x412fbc
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00408230
add esp, 4
mov ebx, eax
mov dword [esp + 0x274], 0x21d227c0
mov dword [esp + 0x278], 0xddaf23c3
mov dword [esp + 0x27c], 0xd9fedf50
mov dword [esp + 0x280], 0xd545db36
mov dword [esp + 0x284], 0xd15bd746
mov dword [esp + 0x288], 0xcd43d34b
mov dword [esp + 0x28c], 0xc9cecf5a
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x274]
mov edi, eax
and edi, 0x32
mov edx, ecx
xor edx, 0x47e52cf9
add edx, edi
mov edi, edx
and edi, esi
add edx, esi
add edi, edi
sub edx, edi
add dl, 0x23
mov byte [esp + ecx + 0x274], dl
inc ecx
add eax, 2
cmp ecx, 0x1c
jne 0x413020
mov eax, dword [esp + 0x28]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x413081
mov eax, dword [esp + 0x28]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413070
mov word [eax], 0
movzx ecx, word [esp + 0x274]
test cx, cx
je 0x4130b1
lea edx, [esp + 0x276]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4130a0
mov word [eax], 0
lea eax, [esp + 0x158]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043d8e0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443abc]
Function at 0x417090
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x180
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x3e8012f
mov dword [esp + 0x14], 0x7e905f7
mov dword [esp + 0x18], 0xb0a09e6
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
mov eax, 0x89b9d840
nop
nop
movzx ecx, byte [esp + eax + 0x764627d0]
xor ecx, eax
mov edx, ecx
and edx, 0x3f
xor ecx, 0xbf
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x764627d0], cl
inc eax
cmp eax, 0x89b9d84f
jne 0x4170d0
mov dword [esp + 0x2c], 0x37ba3940
mov dword [esp + 0x30], 0x334235b8
mov dword [esp + 0x34], 0x4f7d3176
mov dword [esp + 0x38], 0x4b3e4d7f
mov dword [esp + 0x3c], 0x4739493b
mov dword [esp + 0x40], 0x43364525
mov dword [esp + 0x44], 0x5f2d4138
mov dword [esp + 0x48], 0x5bd65dd3
mov dword [esp + 0x4c], 0x5756591e
mov word [esp + 0x50], 0
mov byte [esp + 0x52], 0
xor eax, eax
nop
movzx ecx, byte [esp + eax + 0x2c]
lea edx, [eax - 0x794b84a]
and edx, ecx
add ecx, eax
add ecx, 0xf86b47b6
add edx, edx
sub ecx, edx
add cl, 0x72
mov byte [esp + eax + 0x2c], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x27
jb 0x417150
movzx ecx, word [esp + 0x2c]
lea eax, [esp + 0x146]
test cx, cx
je 0x4171b1
lea edx, [esp + 0x2e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4171a0
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x4171e1
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4171d0
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x417211
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417200
mov word [eax], 0
mov ebx, dword [edi]
mov dword [esp + 0x2c], 0xa7a4a4ca
mov byte [esp + 0x30], 0xc4
mov dword [esp + 0x31], 0
mov eax, 0x50
mov ecx, 0xaf
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x24]
mov edx, eax
and edx, esi
add edx, edx
mov edi, ecx
sub edi, esi
add esi, eax
and edi, edx
not edx
and edx, esi
sub edx, edi
add dl, 0x70
mov byte [esp + eax - 0x24], dl
inc eax
dec ecx
cmp eax, 0x59
jne 0x417240
movzx eax, byte [esp + 0x2c]
test al, al
je 0x41728b
lea ecx, [esp + 0x2d]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x417280
mov byte [ebx], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x146]
push eax
push ecx
push edx
call fcn.0040b2a0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x443dc4]
mov ecx, 0x23f1dd1b
xor ecx, dword [0x443dcc]
add eax, ecx
inc eax
jmp eax
Function at 0x41a4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, ecx
mov esi, dword [esp + 0x2c]
mov byte [esp + 2], 0
mov dword [esp + 0xc], ecx
jmp 0x41a54c
mov eax, dword [esp + 0x2c]
push dword [eax]
call fcn.00408240
add esp, 4
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0x2c]
mov dword [esi], ebx
mov edx, dword [esp + 4]
lea eax, [ebx + edx]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
add eax, ebx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x14]
movzx ecx, byte [esp + 3]
mov ebp, ebx
mov ebx, dword [esp + 0xc]
mov byte [ebp + edx], cl
inc dword [esi + 4]
cmp byte [esp + 2], 0xa
je 0x41a702
push 0x1006c792
push dword [0x4494d8]
call fcn.0043cf80
add esp, 8
push 8
push 1
lea ecx, [esp + 0xa]
push ecx
push dword [ebx]
call eax
test eax, eax
jle 0x41a6c3
movzx ecx, byte [esp + 2]
mov ebp, dword [esi]
mov edi, dword [esi + 4]
mov edx, edi
sub edx, ebp
cmp edi, dword [esi + 8]
jne 0x41a53a
mov byte [esp + 3], cl
mov dword [esp + 0x14], eax
mov eax, edx
and eax, 1
mov ecx, edx
xor ecx, 1
lea eax, [ecx + eax*2]
mov esi, edx
shr esi, 1
mov dword [esp + 4], edx
lea ecx, [esi + edx]
cmp ecx, eax
ja 0x41a5ad
mov ecx, eax
mov dword [esp + 0x10], ecx
push ecx
call fcn.00408230
add esp, 4
mov ebx, eax
test ebp, ebp
je 0x41a512
cmp ebx, ebp
mov edx, dword [esp + 4]
mov dword [esp + 8], ebx
jbe 0x41a682
cmp edi, ebx
jbe 0x41a682
test edx, edx
je 0x41a500
mov edx, dword [esp + 4]
lea eax, [edx + ebp]
dec eax
mov ecx, dword [esp + 8]
add ecx, edx
dec ecx
mov esi, edx
and esi, 7
je 0x41a614
neg esi
xor edx, edx
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp esi, edx
jne 0x41a600
add eax, edx
add ecx, edx
add edx, dword [esp + 4]
sub ebp, edi
cmp ebp, 0xfffffff8
ja 0x41a500
neg edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + esi]
mov byte [ecx + esi], bl
movzx ebx, byte [eax + esi - 1]
mov byte [ecx + esi - 1], bl
movzx ebx, byte [eax + esi - 2]
mov byte [ecx + esi - 2], bl
movzx ebx, byte [eax + esi - 3]
mov byte [ecx + esi - 3], bl
movzx ebx, byte [eax + esi - 4]
mov byte [ecx + esi - 4], bl
movzx ebx, byte [eax + esi - 5]
mov byte [ecx + esi - 5], bl
movzx ebx, byte [eax + esi - 6]
mov byte [ecx + esi - 6], bl
movzx ebx, byte [eax + esi - 7]
mov byte [ecx + esi - 7], bl
add esi, 0xfffffff8
cmp edx, esi
jne 0x41a630
jmp 0x41a500
mov ecx, edx
shr ecx, 2
mov eax, ebp
mov edi, ebx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, edx
and edx, 0xfffffffc
add ebx, edx
add edx, ebp
and esi, 1
mov ebp, edx
mov edi, ebx
mov ecx, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test al, 1
je 0x41a500
mov ecx, dword [esp + 4]
and ecx, 2
movzx edx, byte [edx + ecx]
mov byte [ebx + ecx], dl
jmp 0x41a500
cmp dword [ebx], 0xffffffff
je 0x41a702
push 0xea8d1240
push dword [0x4494d8]
mov esi, eax
call fcn.0043cf80
add esp, 8
push 2
push dword [ebx]
call eax
push 0xa3d60213
push dword [0x4494d8]
call fcn.0043cf80
add esp, 8
push dword [ebx]
call eax
mov eax, esi
mov dword [ebx], 0xffffffff
test eax, eax
setg al
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x41c7f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
xor ecx, ecx
nop
nop
nop
cmp word [edi + ecx], 0
lea ecx, [ecx + 2]
jne 0x41c800
lea edx, [edi + ecx]
add edx, 0xfffffffe
mov eax, edi
not eax
and eax, edx
add ecx, edi
mov edx, 1
sub edx, ecx
and edx, edi
sub eax, edx
cmp eax, 0xffffffed
jge 0x41c82f
mov eax, 0xffffffff
jmp 0x41c832
add eax, 0x12
push eax
call fcn.00408230
add esp, 4
mov esi, eax
mov dword [esp], 0xe173e740
mov dword [esp + 4], 0xdd69e37f
mov dword [esp + 8], 0xd988df90
mov dword [esp + 0xc], 0xd578db44
mov dword [esp + 0x10], 0xd7d4
mov byte [esp + 0x14], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
movzx ebx, byte [esp + ecx]
mov ebp, eax
and ebp, 0x32
mov edx, ecx
xor edx, 0x561980d9
add edx, ebp
mov ebp, edx
and ebp, ebx
add edx, ebx
add ebp, ebp
sub edx, ebp
add dl, 0xc3
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x15
jne 0x41c870
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41c8c1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41c8b0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41c8f1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c8e0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043da60
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x4441e8]
Function at 0x42e280
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
call fcn.00412bd0
sub esp, 0x14
mov edi, esp
jmp 0x42e295
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42e2ac
jmp 0x42e2ae
jmp 0x42e2b0
xor ebx, ebx
cmp eax, 0
je 0x42e44e
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42e2f7
jmp 0x42e446
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x24], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00429170
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42e437
mov dword [ebp - 0x20], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.00408230
sub esp, 8
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00420950
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov byte [edi], 3
mov byte [edi + 1], 0x6d
mov byte [edi + 2], 0x6b
mov byte [edi + 3], 0x53
mov byte [edi + 4], 0x66
mov byte [edi + 5], 0x6a
mov byte [edi + 6], 0x67
mov byte [edi + 7], 0x55
mov byte [edi + 8], 0x6c
mov byte [edi + 9], 0x27
mov byte [edi + 0xa], 0x5e
mov byte [edi + 0xb], 0x53
mov byte [edi + 0xc], 0x58
mov byte [edi + 0xd], 0xcd
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x14
jne 0x42e394
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x14
jae 0x42e405
movzx edx, byte [edi + eax]
mov esi, eax
shl esi, 1
and esi, 0xd05daa60
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, 0x682ed530
add eax, esi
xor eax, edx
xor edx, edx
sub edx, eax
mov ebx, edx
shl ebx, 1
and ebx, 0xe2
xor edx, 0xf715d60e
add edx, 1
mov esi, edx
sub esi, ebx
shl eax, 1
or esi, 1
and edx, 1
sub esi, edx
and eax, 2
xor eax, 2
add eax, esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov byte [edi + edx], al
mov eax, dword [ebp - 0x10]
add eax, 1
jmp 0x42e3a5
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
call fcn.00409190
mov bl, al
and bl, 1
jmp 0x42e425
sub esp, 4
mov dword [esp], esi
call fcn.00408240
add esp, 4
jmp 0x42e435
jmp 0x42e437
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42e44e
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043def0
add esp, 0x14
test eax, eax
js 0x4351a6
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043e290
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x43510a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x4350d8
mov eax, 0xffffffff
jmp 0x4350df
lea eax, [eax*2 + 2]
push eax
call fcn.00408230
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043e860
add esp, 0x14
test eax, eax
jns 0x43510a
push esi
call fcn.00408240
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x80b0a0d
mov word [esp + 8], 0
xor ecx, ecx
nop
nop
mov ebx, edi
and ebx, 6
mov edx, ecx
xor edx, 0x83
add edx, ebx
xor dl, byte [esp + ecx + 4]
add dl, 0x71
mov byte [esp + ecx + 4], dl
inc ecx
add edi, 2
cmp ecx, 6
jne 0x435120
mov ecx, dword [0x44a7f4]
test ecx, ecx
je 0x43518a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44a7f8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x435170
inc edi
cmp ecx, edi
jne 0x435160
jmp 0x43518a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43518a
push eax
push 4
push ecx
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x10
test esi, esi
jne 0x4351a8
lea eax, [esp + 4]
push eax
call fcn.0043d710
add esp, 4
test al, al
je 0x4351a6
cmp dword [esp + 4], 1
je 0x4351a8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436e30
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, dword [esp + 8]
mov dword [esp], 0x57564938
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x6e
xor dl, byte [esp + ecx]
add dl, 0xda
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x436e40
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x452818]
pop ecx
ret