joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f8f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebp, dword [esp + 0x468]
mov dword [esp + 0x3c], 0x832d814d
mov dword [esp + 0x40], 0x872f853e
mov dword [esp + 0x44], 0x8b268924
mov dword [esp + 0x48], 0x8f618d2d
mov dword [esp + 0x4c], 0x937c9165
mov dword [esp + 0x50], 0x97769564
mov dword [esp + 0x54], 0x9b4d9970
mov dword [esp + 0x58], 0x9f309d35
mov dword [esp + 0x5c], 0x63cd61c4
mov dword [esp + 0x60], 0x67d565d3
mov dword [esp + 0x64], 0x6ba46988
mov dword [esp + 0x68], 0x6f8e6db8
mov dword [esp + 0x6c], 0x73827181
mov dword [esp + 0x70], 0x7786759a
mov dword [esp + 0x74], 0x7b9a7983
mov dword [esp + 0x78], 0x7fd77dab
mov dword [esp + 0x7c], 0x43b441ee
mov dword [esp + 0x80], 0x47bd45b0
mov dword [esp + 0x84], 0x4bf249a8
mov dword [esp + 0x88], 0x4fba4dba
mov dword [esp + 0x8c], 0x53b251b9
mov dword [esp + 0x90], 0x57e65595
mov dword [esp + 0x94], 0x5bf659e8
mov dword [esp + 0x98], 0x5f895df9
mov dword [esp + 0x9c], 0x23802185
mov dword [esp + 0xa0], 0x278f25ef
mov dword [esp + 0xa4], 0x2bc5299c
mov dword [esp + 0xa8], 0x2fdd2dd9
mov dword [esp + 0xac], 0x33dc31c7
mov dword [esp + 0xb0], 0x37c035c7
mov dword [esp + 0xb4], 0x3bd239d8
mov dword [esp + 0xb8], 0x3ff63df7
mov dword [esp + 0xbc], 0x3cf01d4
mov dword [esp + 0xc0], 0x7ea05c8
mov dword [esp + 0xc4], 0xba609e8
mov dword [esp + 0xc8], 0xfa50da5
mov dword [esp + 0xcc], 0x13f211b5
mov dword [esp + 0xd0], 0x17b315d3
mov dword [esp + 0xd4], 0x1bb119bb
mov dword [esp + 0xd8], 0x1ff71db3
mov dword [esp + 0xdc], 0xe321e100
mov dword [esp + 0xe0], 0xe754e54c
mov dword [esp + 0xe4], 0xeb47e947
mov dword [esp + 0xe8], 0xef01ed49
mov dword [esp + 0xec], 0xf303f101
mov dword [esp + 0xf0], 0xf718f50d
mov dword [esp + 0xf4], 0xfb14f908
mov dword [esp + 0xf8], 0xff10fd0c
mov dword [esp + 0xfc], 0xc322c130
mov dword [esp + 0x100], 0xc767c517
mov dword [esp + 0x104], 0xcb6bc96e
mov dword [esp + 0x108], 0xcf67cd7e
mov dword [esp + 0x10c], 0xd327d13f
mov dword [esp + 0x110], 0xd721d527
mov dword [esp + 0x114], 0xdb29d936
mov dword [esp + 0x118], 0xdfdedd2a
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov eax, dword [0x4509b4]
mov ecx, 0x7b9d3060
mov edx, 0x62cf9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x7b9d3024]
mov edi, edx
and edi, 0x428631
mov ebx, ecx
and ebx, 0x4a1501ce
or ebx, edi
xor ebx, esi
mov esi, ebx
xor esi, 0xd0
add ebx, ebx
and ebx, 0x3c
xor ebx, 0x20
sub ebx, esi
inc bl
mov byte [esp + ecx - 0x7b9d3024], bl
inc ecx
dec edx
cmp ecx, 0x7b9d3143
jne 0x40fb60
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov ecx, 0xc4a3d69f
xor ecx, dword [str.Z_]
mov eax, dword [eax*4 + 0x44af84]
add eax, ecx
inc eax
xor edi, edi
xor ebx, ebx
jmp eax

Function at 0x410bf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44b988]
Function at 0x41cf00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.0040c470
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41cf20
sar esi, 1
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x451cf8]
mov ebx, dword [esp + 0x24]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41cf54
mov eax, 0xffffffff
jmp 0x41cf57
lea eax, [ebx + ebx]
push eax
call fcn.0040c510
add esp, 4
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x451cf8]
mov eax, dword [esp + 0x24]
mov ecx, eax
add ecx, 0xd
js 0x41cf8c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c510
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0xb4], 0xd782c9ac
mov dword [esp + 0xb8], 0xd3add5b5
mov dword [esp + 0xbc], 0xdffed1ac
mov dword [esp + 0xc0], 0xdbb7dd86
mov dword [esp + 0xc4], 0xe799d9a6
mov dword [esp + 0xc8], 0xe391e58d
mov dword [esp + 0xcc], 0xefeee192
mov word [esp + 0xd0], 0
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0xb4]
mov dword [esp + 4], ebx
mov esi, edx
and esi, 0x1c
mov edi, ecx
xor edi, 0x14d9064e
add edi, esi
mov esi, edi
and esi, ebx
add ebx, edi
not ebx
lea esi, [ebx + esi*2]
and esi, edi
mov eax, esi
or eax, 0xfd
inc eax
mov ebx, esi
and ebx, 0x7d
imul ebx, eax
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
sub ebx, esi
add ebx, edi
add bl, byte [esp + 4]
add bl, 0x7a
mov byte [esp + ecx + 0xb4], bl
inc ecx
add edx, 2
cmp ecx, 0x1e
jne 0x41d000
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov ebx, dword [esp + 8]
mov eax, ebx
test cx, cx
je 0x41d091
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d080
mov word [eax], 0
movzx ecx, word [esp + 0xb4]
test cx, cx
je 0x41d0c1
lea edx, [esp + 0xb6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d0b0
mov word [eax], 0
lea eax, [esp + 0x48]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00444db0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c860]
Function at 0x422920
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x422930
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x451cf8]
mov edi, dword [esp]
test edi, edi
jns 0x42295c
mov eax, 0xffffffff
jmp 0x42295f
lea eax, [edi + edi]
push eax
call fcn.0040c510
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x451cf8]
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00444f60
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44cb80]
Function at 0x4242c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4242d0
cmp eax, 0xffffffed
jge 0x4242e7
mov eax, 0xffffffff
jmp 0x4242ea
add eax, 0x12
push eax
call fcn.0040c510
add esp, 4
mov esi, eax
mov dword [esp], 0x31433f50
mov dword [esp + 4], 0x35b93357
mov dword [esp + 8], 0x49083700
mov dword [esp + 0xc], 0x4d284b2c
mov dword [esp + 0x10], 0x4f4c
mov eax, 0x5d97eb35
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x5d97eb35]
lea edx, [eax - 0x5d97eb00]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x76
xor ecx, 0xf6
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x5d97eb35], cl
inc eax
cmp eax, 0x5d97eb49
jne 0x424330
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x424391
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x424380
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4243c1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4243b0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00444f60
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44cc28]

Function at 0x426d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
push eax
sub esp, 0x20
mov ebx, esp
sub esp, 0x18
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x2c], esp
sub esp, 8
mov dword [ebp - 0x34], esp
sub esp, 0x4c
mov dword [ebp - 0x24], esp
sub esp, 0x50
mov dword [ebp - 0x28], esp
push eax
mov edi, esp
sub esp, 0x10
mov dword [ebp - 0x38], esp
sub esp, 0x40
mov dword [ebp - 0x30], esp
mov eax, dword [0x451cf8]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x6c], 0x33e6311d
mov dword [ebp - 0x68], 0x3fdd3dcb
mov dword [ebp - 0x64], 0x3bce39d9
mov dword [ebp - 0x60], 0xc736c505
mov dword [ebp - 0x5c], 0xc30ec130
mov dword [ebp - 0x58], 0xcf32cd2d
mov dword [ebp - 0x54], 0xcbe7c929
mov dword [ebp - 0x50], 0xd5d4
mov eax, 0x74
mov ecx, 0x8b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + eax - 0xe0]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xbc
mov byte [ebp + eax - 0xe0], dl
inc eax
dec ecx
cmp eax, 0x94
jne 0x426da0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], ebx
mov esi, dword [ebp - 0x1c]
jmp dword [0x44d2a0]
Function at 0x4275b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0x451cf8]
mov dword [esp], 0x33f3311d
mov dword [esp + 4], 0x3fce3dcc
mov dword [esp + 8], 0x3bdb39f4
mov dword [esp + 0xc], 0xc727c538
mov dword [esp + 0x10], 0xc326c1ed
mov dword [esp + 0x14], 0xcf26cd10
mov dword [esp + 0x18], 0xcb3cc935
mov dword [esp + 0x1c], 0xd73bd538
mov dword [esp + 0x20], 0xd330d122
mov dword [esp + 0x24], 0xdf2cdd35
mov dword [esp + 0x28], 0xdb3ed934
mov dword [esp + 0x2c], 0xe714e534
mov dword [esp + 0x30], 0xe30ce117
mov dword [esp + 0x34], 0xef1aed05
mov dword [esp + 0x38], 0xeb19e905
mov dword [esp + 0x3c], 0xf5f4
mov ecx, 0x74
mov edx, 0xb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x76
mov ebx, ecx
and ebx, 0x89
or ebx, esi
xor bl, byte [esp + ecx - 0x74]
xor bl, 0x76
add bl, 0xbc
mov byte [esp + ecx - 0x74], bl
inc ecx
dec edx
cmp ecx, 0xb4
jne 0x427650
lea ebp, [esp + 0x40]
mov ecx, esp
push ebp
push 0
push 0
push 0x1e
mov ebx, ecx
push ecx
push 0
call eax
mov edi, dword [esp + 0x40]
test edi, edi
jns 0x42769a
mov eax, 0xffffffff
jmp 0x42769d
lea eax, [edi + edi]
push eax
call fcn.0040c510
add esp, 4
mov esi, eax
mov eax, dword [0x451cf8]
mov dword [esp], 0x99559bb7
mov dword [esp + 4], 0xa556a768
mov dword [esp + 8], 0xa14da368
mov dword [esp + 0xc], 0xad41af5c
mov dword [esp + 0x10], 0xa94eab87
mov dword [esp + 0x14], 0xb55eb774
mov dword [esp + 0x18], 0xb140b34f
mov dword [esp + 0x1c], 0xbd55bf5c
mov dword [esp + 0x20], 0xb954bb42
mov dword [esp + 0x24], 0x45b8474f
mov dword [esp + 0x28], 0x41a643a8
mov dword [esp + 0x2c], 0x4db04f90
mov dword [esp + 0x30], 0x49a04bbd
mov dword [esp + 0x34], 0x55a257bf
mov dword [esp + 0x38], 0x51af53bf
mov dword [esp + 0x3c], 0x5f50
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x5b
xor dl, byte [esp + ecx]
add dl, 0x39
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x40
jne 0x427730
push ebp
push edi
push esi
push 0x1e
mov edi, ebx
push ebx
push 0
call eax
mov dword [esp], 0x29822bf0
mov dword [esp + 4], 0x2d9c2f93
mov dword [esp + 8], 0x31993388
mov dword [esp + 0xc], 0x35903786
mov dword [esp + 0x10], 0x398c3b9b
mov dword [esp + 0x14], 0x3d3e3f9c
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov edx, 0x47
movzx eax, byte [esp + edx - 0x47]
mov ebx, eax
mov ebp, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x7d
mul cl
mov ecx, eax
mov eax, ebp
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x9d
mov byte [esp + edx - 0x47], al
inc edx
cmp edx, 0x62
jne 0x427790
push 0
push 0
push edi
push esi
push dword [esp + 0x68]
call fcn.00422920
add esp, 0x14
jmp dword [0x44d308]
Function at 0x427800
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21e8
call fcn.0040c470
mov dword [esp + 0x11e8], 0x49a44ba8
mov dword [esp + 0x11ec], 0x45bf47b3
mov dword [esp + 0x11f0], 0x41af43b3
mov dword [esp + 0x11f4], 0x7d907fac
mov dword [esp + 0x11f8], 0x799e7b9b
mov dword [esp + 0x11fc], 0x759b7793
mov dword [esp + 0x1200], 0x719c738f
mov word [esp + 0x1204], 0x6f70
mov dword [esp + 0x1206], 0
mov eax, 0xb7c2b393
mov ecx, 0x483d4c6c
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x483d5e55]
mov edi, ecx
or edi, esi
lea edx, [esi + esi]
not edx
add edx, esi
or edx, eax
and edx, edi
mov esi, edx
xor esi, 0x1f
not edx
and edx, 0x1f
add edx, edx
sub edx, esi
inc dl
mov byte [esp + eax + 0x483d5e55], dl
inc eax
dec ecx
cmp eax, 0xb7c2b3b5
jne 0x427880
lea eax, [esp + 0x2c]
lea ebp, [esp + 0x11e8]
push 0
push 0
push 0x20019
push eax
push ebp
call fcn.004455e0
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x44d320]

Function at 0x4293d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xd0
push eax
mov edi, esp
push eax
mov dword [ebp - 0x30], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x38], esp
sub esp, 0x800
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov dword [ebp - 0x3c], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
push eax
mov dword [ebp - 0x40], esp
sub esp, 0x14
mov dword [ebp - 0x34], esp
add eax, 2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov eax, 0x20219
mov ecx, 1
mov dword [ebp - 0x1c], 0
jmp dword [ecx*4 + 0x44d9ec]
Function at 0x431de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx edi, word [esi]
test di, di
je 0x431f15
mov edx, dword [esp + 0x18]
dec edx
je 0x431f15
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, di
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x431e30
lea ecx, [ebp + 1]
mov byte [ebp], bl
jmp 0x431ec0
cmp ebx, 0x7ff
ja 0x431e60
cmp edx, 2
jb 0x431e60
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x431ec0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x431eda
cmp edx, 4
jb 0x431eda
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
mov al, 0x3f
sub al, cl
and al, 0x3f
xor al, 0xbf
lea ecx, [ebp + 4]
mov byte [ebp + 3], al
mov edi, esi
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, ecx
mov esi, edi
mov ebp, ecx
movzx edi, word [esi]
test di, di
je 0x431f15
test edx, edx
jne 0x431e10
jmp 0x431f15
movzx eax, cx
cmp eax, 0xdc00
jne 0x431ee8
mov esi, edi
jmp 0x431ec8
cmp edx, 3
jb 0x431f11
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea ecx, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x431ec0
mov ecx, ebp
jmp 0x431ec0
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4360c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x4360ef
jmp 0x436210
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x436208
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x436134
sub esp, 4
mov dword [ebp - 0x28], eax
mov dword [esp], eax
call fcn.0040c7b0
add esp, 4
cmp eax, 0
setne cl
jmp 0x43614d
jmp 0x43614f
xor ebx, ebx
test cl, 1
jne 0x43615b
jmp 0x4361fc
mov cl, byte [esi]
mov byte [ebp - 0x10], cl
mov byte [ebp - 0x24], 0xa3
mov byte [ebp - 0x23], 0xfd
mov byte [ebp - 0x22], 0xfb
mov byte [ebp - 0x21], 0xf3
mov byte [ebp - 0x20], 0xc6
mov byte [ebp - 0x1f], 0xfa
mov byte [ebp - 0x1e], 0xc7
mov byte [ebp - 0x1d], 0xf5
mov byte [ebp - 0x1c], 0xfc
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0xce
mov byte [ebp - 0x19], 0xd3
mov byte [ebp - 0x18], 0xc8
mov byte [ebp - 0x17], 0x5d
mov ecx, 0xe
mov byte [ebp + ecx - 0x24], 0
add ecx, 1
cmp ecx, 0x13
jne 0x43619d
xor ecx, ecx
cmp ecx, 0x13
jae 0x4361d9
movzx esi, byte [ebp + ecx - 0x24]
mov edx, ecx
add edx, 0x18
mov ebx, esi
xor ebx, 0xffffffff
and edx, ebx
mov ebx, 0xe7
sub ebx, ecx
and ebx, esi
or edx, ebx
add dl, 0x88
mov byte [ebp + ecx - 0x24], dl
add ecx, 1
jmp 0x4361ac
lea edx, [ebp - 0x24]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], edx
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.0040d1b0
mov bl, al
and bl, 1
jmp 0x4361fc
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x436210
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b720
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ecx, dword [esp + 0x28]
xor ebx, ebx
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x43b730
mov dword [esp], ecx
lea ecx, [ebx - 2]
mov dword [esp + 4], 0x5e5a5cd1
mov word [esp + 8], 0
mov edi, 0x158d37ef
mov eax, 0xca72c810
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edi - 0x158d37eb]
mov esi, eax
and esi, 0x8260c012
mov edx, edi
and edx, 0x1584054d
or edx, esi
xor edx, ebp
mov esi, edx
and esi, 1
and edx, 0xfe
xor edx, 0xb3
add edx, esi
add dl, 0x54
mov byte [esp + edi - 0x158d37eb], dl
inc edi
dec eax
cmp edi, 0x158d37f5
jne 0x43b760
cmp ebx, 2
je 0x43b7c3
mov edx, dword [esp + 4]
mov esi, ecx
sar esi, 1
mov edi, edx
not edi
test cl, 2
mov dword [esp + 0x10], edi
jne 0x43b7cc
mov ebp, dword [esp + 0x2c]
jmp 0x43b7fa
mov eax, dword [esp + 0x2c]
jmp 0x43b860
dec esi
mov ecx, dword [esp + 0x28]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp], ecx
xor eax, dword [esp + 0x2c]
mov ecx, eax
and ecx, edi
mov edi, edx
mov ebp, eax
not ebp
and ebp, edx
imul ebp, ecx
mov ecx, eax
and ecx, edx
or eax, edx
imul eax, ecx
add eax, ebp
mov ebp, eax
cmp ebx, 4
mov ecx, dword [esp]
je 0x43b860
mov edi, edx
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0xc], esi
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
xor ebp, eax
mov eax, ebp
mov edx, ecx
mov ecx, dword [esp + 0x10]
and eax, ecx
mov esi, ebp
not esi
and esi, edi
imul esi, eax
mov eax, ebp
and eax, edi
or ebp, edi
imul ebp, eax
add ebp, esi
movzx eax, word [edx + ebx*2 + 2]
xor eax, ebp
mov esi, eax
and esi, ecx
mov ecx, edx
mov ebp, eax
not ebp
and ebp, edi
imul ebp, esi
mov esi, eax
and esi, edi
or eax, edi
imul eax, esi
mov esi, dword [esp + 0xc]
add eax, ebp
add ebx, 2
cmp esi, ebx
jne 0x43b810
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c660
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.004455e0
add esp, 0x14
test eax, eax
js 0x43c7b6
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00445ab0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x43c6ff
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x43c6d2
mov eax, 0xffffffff
jmp 0x43c6d4
add eax, eax
push eax
call fcn.0040c510
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.004461b0
add esp, 0x14
test eax, eax
jns 0x43c6ff
push esi
call fcn.0040c520
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x2c2d2e2f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edi + 4]
mov edx, edi
or edx, 0x318c5f8
xor edx, ecx
mov ecx, edx
and ecx, 0x27
xor edx, 0x27
lea ecx, [edx + ecx*2]
inc cl
mov byte [esp + edi + 4], cl
mov ecx, edi
and ecx, 1
xor edi, 1
lea edi, [edi + ecx*2]
cmp edi, 7
jb 0x43c720
mov ecx, dword [0x451cfc]
test ecx, ecx
je 0x43c79a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x451d00]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43c780
inc edi
cmp ecx, edi
jne 0x43c770
jmp 0x43c79a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43c79a
push eax
push 1
push dword [0x451d04]
push ecx
call fcn.00441c30
add esp, 0x10
test esi, esi
jne 0x43c7b8
lea eax, [esp + 4]
push eax
call fcn.00444b80
add esp, 4
test al, al
je 0x43c7b6
cmp dword [esp + 4], 1
je 0x43c7b8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x43ca0e
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x43c958
mov esi, ebx
mov ecx, dword [esp + 0x1c]
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x43ca10
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.004218e0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.004218e0
mov ecx, dword [esp + 0x20]
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
mov edx, dword [esp + 0x20]
mov byte [edx + esi], al
inc esi
cmp edi, ecx
jae 0x43c944
movzx eax, byte [ebp + edi]
push eax
call fcn.004218e0
add esp, 4
cmp al, 0x40
je 0x43c940
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
mov edx, esi
and edx, 1
mov ebx, esi
xor ebx, 1
lea ebx, [ebx + edx*2]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], cl
lea ecx, [edi + 1]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
jae 0x43ca05
mov byte [esp + 3], al
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.004218e0
add esp, 4
cmp al, 0x40
je 0x43c93e
movzx ecx, byte [esp + 3]
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x20]
mov byte [ecx + ebx], al
inc ebx
jmp 0x43c93e
mov ecx, edx
mov esi, ebx
jmp 0x43c944
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret