joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402660
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402757
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402757
push ebx
call fcn.00408fc0
add esp, 4
test eax, eax
je 0x4026ba
xor ebp, ebp
mov ecx, 0x1505
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4026c1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4026a0
jmp 0x4026c3
mov esi, 0x1505
jmp 0x4026c3
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402757
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x4026f4
inc ebp
dec ebx
je 0x402755
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402755
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4026f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408fc0
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4026f0
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408fe0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4026f0
mov eax, dword [ecx + 0x10]
mov edi, dword [eax + edi*4]
jmp 0x402757
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402770
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x402857
test edx, edx
je 0x402857
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x4027ba
xor edi, edi
mov ecx, 0x1505
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x4027c1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4027a0
jmp 0x4027c3
mov esi, 0x1505
jmp 0x4027c3
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x402857
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x4027f4
inc ebx
dec ebp
je 0x402855
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402855
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4027f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408fc0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4027f0
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408fe0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4027f0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402857
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c70
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x402d78
mov esi, edx
test edx, edx
je 0x402d78
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x402d78
push esi
call fcn.00408fc0
add esp, 4
test eax, eax
je 0x402cca
xor edi, edi
mov ecx, 0x1505
movzx edx, byte [esi + edi]
test edx, edx
je 0x402cd1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402cb0
jmp 0x402cd3
mov ebp, 0x1505
jmp 0x402cd3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x402d80
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402d3a
call fcn.00402e70
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x402d78
push ecx
call fcn.00408fc0
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x402def
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402d98
inc ebx
dec esi
je 0x402cef
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402cf4
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402d90
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00408fc0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402d90
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408fe0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402d90
mov eax, 0xffffffff
jmp 0x402d78
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402e08
inc ebx
dec esi
je 0x402d35
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402d3a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402e00
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00408fc0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402e00
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408fe0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402e00
jmp 0x402d3a
Function at 0x403560
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403736
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x40372f
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x4035fb
add ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul esi, edx, 0xfff1
mov eax, ecx
mov edx, 0x80078071
mul edx
sub edi, esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov eax, ebx
not eax
mov edx, dword [esp + 4]
and eax, edx
not edx
and ebx, edx
mov esi, 0x15b0
sub ebx, eax
je 0x40372f
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
mov dword [esp + 0xc], ebx
jb 0x40368f
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
mov edx, ecx
and edx, esi
xor ecx, esi
movzx ebx, byte [ebp + eax + 6]
add ebx, esi
movzx esi, byte [ebp + eax + 7]
mov edi, ebx
and edi, esi
xor esi, ebx
lea edi, [esi + edi*2]
mov esi, dword [esp + 4]
add ebx, ecx
lea ecx, [ebx + edx*2]
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x403620
add ebp, edx
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
mov eax, esi
sub eax, edx
jbe 0x4035b8
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0x10], eax
je 0x4036e3
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x4036c0
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x4035b0
jmp 0x4036f5
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x4035b0
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403700
jmp 0x4035b0
shl ecx, 0x10
or ecx, edi
jmp 0x40373b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403750
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4037bd
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4037bf
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
and eax, 0xf
mov ebp, eax
xor ebp, eax
xor ebp, 0xf
and ebp, edi
xor ebp, eax
xor ebx, dword [ebp*4 + 0x43fa18]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
mov edi, dword [edi*4 + 0x43fa18]
mov ebx, eax
and ebx, edi
add eax, edi
add ebx, ebx
sub eax, ebx
inc esi
cmp edx, esi
jne 0x403770
not eax
jmp 0x4037bf
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409640
sub esp, 0x100
mov esi, esp
call fcn.0043a330
test al, 1
jne 0x40952f
jmp 0x409600
call fcn.00432150
test al, 1
jne 0x40953d
jmp 0x4095f9
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
jl 0x4095f7
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
setge al
test al, 1
jne 0x4095be
jmp 0x4095ef
call fcn.0040a650
test al, 1
jne 0x4095c9
jmp 0x4095ed
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409620
add esp, 8
call fcn.0040f4e0
call fcn.0040c630
jmp 0x4095ed
jmp 0x4095ef
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4095f7
jmp 0x4095f9
call fcn.0043a870
jmp 0x409600
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4162e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x416300
sar esi, 1
lea edi, [esp + 0x80]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x449a08]
mov ebx, dword [esp + 0x80]
test ebx, ebx
jns 0x416335
mov eax, 0xffffffff
jmp 0x416338
lea eax, [ebx + ebx]
push eax
call fcn.00408da0
add esp, 4
push edi
push ebx
mov dword [esp + 0x70], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x449a08]
mov dword [esp + 0x20], 0x6bde6dc8
mov dword [esp + 0x24], 0x67e969c9
mov dword [esp + 0x28], 0x630265e8
mov dword [esp + 0x2c], 0x5fc361ca
mov dword [esp + 0x30], 0x5bd55dd2
mov dword [esp + 0x34], 0x57c559c1
mov dword [esp + 0x38], 0x535255c6
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x3f], 0
mov dword [esp + 0xc0], 0
mov ecx, dword [esp + 0xc0]
cmp ecx, 0x22
ja 0x41642e
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 0xc0]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx + edx]
add esi, 0x42272652
add ecx, 0x42272652
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, esi
not ecx
and ecx, esi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x98], ecx
mov ecx, dword [esp + 0x98]
mov edx, ecx
xor edx, 0xc1
and ecx, 0x41
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp + 0xc0]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0xc0]
mov ecx, dword [esp + 0xc0]
cmp ecx, 0x23
jb 0x4163c0
lea edi, [esp + 0xc0]
lea edx, [esp + 0x20]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xdc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x80]
add eax, 0xe
mov ecx, eax
xor ecx, 0xfffffffe
and eax, 0xfffffffe
lea edx, [ecx + eax*2]
inc edx
test edx, edx
jns 0x416473
mov eax, 0xffffffff
jmp 0x41647b
lea eax, [ecx + eax*2]
add eax, eax
add eax, 2
mov esi, dword [esp + 0x68]
push eax
call fcn.00408da0
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x4164b1
lea edx, [esi + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4164a0
mov word [eax], 0
movzx ecx, word [esp + 0xc0]
test cx, cx
je 0x4164e1
lea edx, [esp + 0xc2]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4164d0
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043d270
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x444094]
Function at 0x41b670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0x83358122
mov dword [esp + 0xc], 0x9f179d3d
mov dword [esp + 0x10], 0x9b6e9952
mov dword [esp + 0x14], 0x97369526
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x9196
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1a
ja 0x41b71c
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + edx]
add esi, 0xadb84d6b
add ecx, 0xadb84d6b
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x28], esi
mov ecx, dword [esp + 0x28]
mov edx, ecx
xor edx, 0x12
and ecx, 0x12
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1b
jb 0x41b6d0
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41b750
mov edi, esi
cmp eax, 0xffffffed
jge 0x41b769
mov eax, 0xffffffff
jmp 0x41b76c
add eax, 0x12
push eax
call fcn.00408da0
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41b7a1
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41b790
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41b7d1
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b7c0
mov word [eax], 0
push edi
push esi
call fcn.0043d440
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x444524]

Function at 0x41bc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
movzx eax, byte [ebp + 0x20]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x40], edi
mov byte [esp + 0x44], al
mov ecx, dword [ebp + 0x24]
mov dword [esp + 0x48], ecx
movzx eax, al
xor ebx, ebx
jmp dword [eax*4 + 0x4446f0]
Function at 0x41f990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x8b4b8db1
mov dword [esp + 0x14], 0x87768978
mov dword [esp + 0x18], 0x83638558
mov dword [esp + 0x1c], 0x9f7f810c
mov dword [esp + 0x20], 0x9b7e9da1
mov dword [esp + 0x24], 0x976e9974
mov dword [esp + 0x28], 0x93609519
mov dword [esp + 0x2c], 0xaf53916c
mov dword [esp + 0x30], 0xab54ad22
mov dword [esp + 0x34], 0xa728a951
mov dword [esp + 0x38], 0xa346a558
mov dword [esp + 0x3c], 0xbf30a170
mov dword [esp + 0x40], 0xbb40bd4f
mov dword [esp + 0x44], 0xb742b941
mov dword [esp + 0x48], 0xb33db549
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0xb1b0
mov dword [esp + 0x4e], 0
mov dword [esp + 0x52], 0
mov word [esp + 0x56], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x47
ja 0x41fa8e
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + 0x42]
add ecx, edx
and esi, edx
add esi, esi
sub ecx, esi
add ecx, 0x13e8cd42
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
add cl, 0x32
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x48
jb 0x41fa50
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x449a08]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41fad7
mov eax, 0xffffffff
jmp 0x41fada
lea eax, [edi + edi]
push eax
call fcn.00408da0
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x449a08]
mov dword [esp + 0x10], 0x739a6db8
mov dword [esp + 0x14], 0x77847185
mov dword [esp + 0x18], 0x7b9f7590
mov dword [esp + 0x1c], 0x7f98798e
mov dword [esp + 0x20], 0x3f47d95
mov dword [esp + 0x24], 0x70601e4
mov dword [esp + 0x28], 0
mov dword [esp + 0x2b], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1e
ja 0x41fba5
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x1fb41fae]
lea edi, [eax + 0xae]
xor edi, edx
and edx, ecx
and edi, ecx
add eax, ecx
add eax, 0x1fb41fae
lea ecx, [edi + edx*2]
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0x3d
and eax, 0x3d
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1f
jb 0x41fb50
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.00418eb0
add esp, 0x14
mov ebx, eax
jmp dword [0x444fe4]
Function at 0x421bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x858
mov ecx, 0xfffdfde6
mov eax, 1
mov dword [esp + 0x10], 0
xor ebx, ebx
xor edi, edi
jmp dword [eax*4 + 0x445794]
Function at 0x42ebd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov dword [esi + 0x14], esp
push eax
mov dword [esi + 0x10], esp
push eax
mov edi, esp
sub esp, 0x18
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
mov dword [esi + 0x1c], esp
mov dword [esi + 0x24], eax
mov byte [esi + 7], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
test al, 1
jne 0x42ec22
jmp 0x42ed72
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esi + 0x2c], eax
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
mov eax, ecx
cmp dword [eax], 0
je 0x42ed6c
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x10]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00408fc0
add esp, 4
mov dword [edi], eax
cmp dword [edi], 0
je 0x42ed59
call fcn.00409640
mov ecx, dword [esi + 0x24]
mov edx, dword [edi]
mov eax, dword [esi + 0x10]
mov edi, dword [eax]
mov eax, dword [esi + 0x1c]
mov al, byte [eax]
mov byte [esi + 0xc], al
mov byte [ebx], 0x1b
mov byte [ebx + 1], 0xcd
mov byte [ebx + 2], 0x33
mov byte [ebx + 3], 0xcb
mov byte [ebx + 4], 0x26
mov byte [ebx + 5], 0xd2
mov byte [ebx + 6], 0x27
mov byte [ebx + 7], 0xd5
mov byte [ebx + 8], 0x2c
mov byte [ebx + 9], 0x17
mov byte [ebx + 0xa], 0xde
mov byte [ebx + 0xb], 0xdb
mov byte [ebx + 0xc], 0xd0
mov byte [ebx + 0xd], 0x4d
mov word [ebx + 0x12], 0
mov dword [ebx + 0xe], 0
mov dword [esi + 8], 0
mov eax, dword [esi + 8]
cmp eax, 0x14
jae 0x42ed3f
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edx
jmp 0x42ecff
mov edx, dword [esi + 8]
mov eax, dword [esi + 8]
movzx eax, byte [ebx + eax]
mov edi, edx
add edi, 0x2bc3cf4c
add edx, 0x4c
and edx, eax
or edi, eax
sub edi, edx
mov dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
add al, 0xec
mov edx, dword [esi + 8]
mov byte [ebx + edx], al
mov eax, dword [esi + 8]
inc eax
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0x14
jb 0x42ecff
mov edx, dword [esi + 0x20]
mov edi, dword [esi + 0x18]
jmp 0x42ed3f
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], edi
mov dword [esp + 8], edx
call fcn.00409850
and al, 1
mov byte [esi + 7], al
jmp 0x42ed59
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42ed6c
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [esi + 7]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4356f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov eax, 0xfffffffe
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x435700
test eax, eax
je 0x435723
mov ebx, eax
sar ebx, 1
test al, 2
jne 0x43572a
mov edx, ebx
cmp ebx, 1
jne 0x43575f
jmp 0x4357c9
mov eax, edi
jmp 0x4357c9
lea edx, [ebx - 1]
movzx eax, word [ecx]
add ecx, 2
xor eax, edi
mov esi, eax
and esi, 0x1000193
mov edi, eax
or eax, 0x1000193
imul eax, esi
xor esi, 0x1000193
and edi, 0xfefffe6c
imul edi, esi
add eax, edi
mov edi, eax
cmp ebx, 1
je 0x4357c9
xor esi, esi
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
mov eax, edi
and eax, 0x1000193
mov ebx, edi
or edi, 0x1000193
imul edi, eax
xor eax, 0x1000193
and ebx, 0xfefffe6c
imul ebx, eax
add edi, ebx
movzx eax, word [ecx + esi*2 + 2]
xor eax, edi
mov edi, eax
and edi, 0x1000193
mov ebx, eax
or eax, 0x1000193
imul eax, edi
xor edi, 0x1000193
and ebx, 0xfefffe6c
imul ebx, edi
add eax, ebx
add esi, 2
cmp edx, esi
jne 0x435770
pop esi
pop edi
pop ebx
ret