joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c350
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x3745396d
mov dword [esp + 0x40], 0x334b35b2
mov dword [esp + 0x44], 0x4f3a3144
mov dword [esp + 0x48], 0x4b794d2d
mov dword [esp + 0x4c], 0x47744905
mov dword [esp + 0x50], 0x43624574
mov dword [esp + 0x54], 0x5f354178
mov dword [esp + 0x58], 0x5b285d25
mov dword [esp + 0x5c], 0x57255924
mov dword [esp + 0x60], 0x53dd55df
mov dword [esp + 0x64], 0x6f3c5170
mov dword [esp + 0x68], 0x6b4a6d00
mov dword [esp + 0x6c], 0x67566959
mov dword [esp + 0x70], 0x63526556
mov dword [esp + 0x74], 0x7f5e6127
mov dword [esp + 0x78], 0x7b037d17
mov dword [esp + 0x7c], 0x773c790a
mov dword [esp + 0x80], 0x73357538
mov dword [esp + 0x84], 0x8f067150
mov dword [esp + 0x88], 0x8bc68dc6
mov dword [esp + 0x8c], 0x87a689b1
mov dword [esp + 0x90], 0x83f285c5
mov dword [esp + 0x94], 0x9fea81f0
mov dword [esp + 0x98], 0x9bf19de1
mov dword [esp + 0x9c], 0x97e899e5
mov dword [esp + 0xa0], 0x93eb95c3
mov dword [esp + 0xa4], 0xaf9d911c
mov dword [esp + 0xa8], 0xabe5ade1
mov dword [esp + 0xac], 0xa794a9e3
mov dword [esp + 0xb0], 0xa3e8a5eb
mov dword [esp + 0xb4], 0xbf86a180
mov dword [esp + 0xb8], 0xbbe2bdeb
mov dword [esp + 0xbc], 0xb7e3b9d4
mov dword [esp + 0xc0], 0xb386b5e0
mov dword [esp + 0xc4], 0xcfbab190
mov dword [esp + 0xc8], 0xcbbdcdb5
mov dword [esp + 0xcc], 0xc7e6c9b5
mov dword [esp + 0xd0], 0xc3bfc59f
mov dword [esp + 0xd4], 0xdfa9c1bf
mov dword [esp + 0xd8], 0xdbe3ddaf
mov dword [esp + 0xdc], 0xd789d9f8
mov dword [esp + 0xe0], 0xd35cd5ac
mov dword [esp + 0xe4], 0xef9bd1a3
mov dword [esp + 0xe8], 0xebd9ed91
mov dword [esp + 0xec], 0xe7d7e9d9
mov dword [esp + 0xf0], 0xe3d0e5ad
mov dword [esp + 0xf4], 0xffcce1d0
mov dword [esp + 0xf8], 0xfbc8fdcc
mov dword [esp + 0xfc], 0xf7d6f9c8
mov dword [esp + 0x100], 0xf393f59b
mov dword [esp + 0x104], 0xf6ff18a
mov dword [esp + 0x108], 0xb730d82
mov dword [esp + 0x10c], 0x74b093b
mov dword [esp + 0x110], 0x349054b
mov dword [esp + 0x114], 0x1f510132
mov dword [esp + 0x118], 0x1b1a1d56
mov byte [esp + 0x11c], 0
mov eax, dword [0x44bae0]
xor ecx, ecx
nop
nop
mov edi, ecx
not edi
movzx esi, byte [esp + ecx + 0x3c]
and edi, 0x4a
mov edx, ecx
and edx, 0xb5
sub edx, edi
lea edi, [esi + esi]
not edi
add edi, esi
and edi, 0x18
mov ebx, esi
not ebx
or ebx, 0xe7
add ebx, esi
inc ebx
or ebx, edi
xor ebx, edx
xor bl, 0x18
add bl, 0x72
mov byte [esp + ecx + 0x3c], bl
inc ecx
cmp ecx, 0xe1
jne 0x40c5a0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
mov dword [esp + 4], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x445ee4]
mov ecx, 0xfbfe6447
xor ecx, dword [0x445eec]
add eax, ecx
inc eax
jmp eax
Function at 0x419040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x419060
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x419080
sar edi, 1
mov ecx, eax
sar ecx, 1
and eax, 2
xor ecx, 1
add eax, edi
lea edx, [ecx + eax]
inc edx
test edx, edx
jns 0x4190a8
mov eax, 0xffffffff
jmp 0x4190b1
add eax, ecx
lea eax, [eax*2 + 2]
push eax
call fcn.00408380
add esp, 4
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x4190e1
add esi, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4190d0
mov word [eax], 0x5c
add eax, 2
mov edx, dword [esp + 0x38]
movzx ecx, word [edx]
test cx, cx
je 0x419111
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419100
mov word [eax], 0
lea ebx, [esp + 0x14]
push 0x60
push 3
push 0x120089
push ebx
push ebp
call fcn.00440af0
add esp, 0x14
mov dword [esp + 4], 0xcf0e094f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov ecx, 0x34f3c782
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x34f3c77e]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
not esi
and esi, 0x8b
and edx, 0x74
sub edx, esi
inc dl
mov byte [esp + ecx - 0x34f3c77e], dl
inc ecx
cmp ecx, 0x34f3c789
jne 0x419150
xor ecx, ecx
cmp eax, dword [esp + 4]
sete cl
jmp dword [ecx*4 + 0x446480]
Function at 0x41d760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0x8328816f
mov dword [esp + 0x14], 0x87298537
mov dword [esp + 0x18], 0x8b8a8926
mov word [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe0
xor cl, byte [esp + eax + 0x10]
add cl, 0xa0
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0xe
jne 0x41d7a0
mov dword [esp + 0x38], 0x971a9900
mov dword [esp + 0x3c], 0x93029518
mov dword [esp + 0x40], 0x8fdd91d6
mov dword [esp + 0x44], 0x8b1e8ddf
mov dword [esp + 0x48], 0x8719891b
mov dword [esp + 0x4c], 0x83168525
mov dword [esp + 0x50], 0xff6d8118
mov dword [esp + 0x54], 0xfb76fd73
mov dword [esp + 0x58], 0xf7f6f9be
xor eax, eax
movzx ecx, byte [esp + eax + 0x38]
mov esi, eax
and esi, 0x26
mov edi, eax
and edi, 0x19
mov edx, eax
xor edx, 0xdc2af4a6
add edx, esi
sub edx, edi
add edx, eax
xor edx, ecx
mov ecx, edx
and ecx, 0x41
xor edx, 0xc1
lea ecx, [edx + ecx*2]
inc cl
mov byte [esp + eax + 0x38], cl
inc eax
cmp eax, 0x24
jne 0x41d800
movzx ecx, word [esp + 0x38]
lea eax, [esp + 0x15c]
test cx, cx
je 0x41d861
lea edx, [esp + 0x3a]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d850
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x41d891
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d880
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41d8c1
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d8b0
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov dword [esp + 0x38], 0xcbccc42e
mov byte [esp + 0x3c], 0x34
mov dword [esp + 0x3d], 0
mov byte [esp + 0x41], 0
mov eax, 0x76
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3e]
lea ecx, [eax - 0x33258b00]
or ecx, edx
and edx, eax
sub ecx, edx
mov edx, ecx
and edx, 0x31
add edx, edx
xor ecx, 0x4e
sub edx, ecx
mov byte [esp + eax - 0x3e], dl
inc eax
cmp eax, 0x80
jne 0x41d8f0
movzx eax, byte [esp + 0x38]
test al, al
je 0x41d93b
lea ecx, [esp + 0x39]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d930
mov byte [edi], 0
lea eax, [esp + 0x144]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x15c]
push eax
push ecx
push edx
call fcn.0040b320
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x446c7c]
mov ecx, 0x6e3a6e7a
xor ecx, dword [0x446c84]
add eax, ecx
inc eax
jmp eax
Function at 0x4212b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x4212c0
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push edi
push 0
call dword [0x44ce34]
mov dword [esp + 0xc], 0x79babba1
mov dword [esp + 0x10], 0
xor ecx, ecx
mov edx, ecx
add dl, 0x1f
xor dl, byte [esp + ecx + 0xc]
add dl, 0x65
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 8
jne case.default.0x421311
xor ecx, ecx
cmp eax, dword [esp + 0xc]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446fc4]
mov ebx, dword [esp]
test ebx, ebx
jns 0x421326
mov eax, 0xffffffff
jmp 0x421329
lea eax, [ebx + ebx]
push eax
call fcn.00408380
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebx
push esi
push ebp
push edi
push 0
call dword [0x44ce34]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446fcc]
jmp dword [0x446fd4]
push esi
call fcn.00408390
add esp, 4
nop
nop
xor ebx, ebx
jmp dword [0x446fe4]
lea edi, [esp + 0xc]
push edi
push esi
call fcn.00440cb0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446fec]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422e50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov ecx, 0xfffffffe
nop
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x422e60
mov eax, ecx
sar eax, 1
and ecx, 0x12
xor eax, 9
add eax, ecx
jns 0x422e80
mov eax, 0xffffffff
jmp 0x422e82
add eax, eax
push eax
call fcn.00408380
add esp, 4
mov esi, eax
mov dword [esp], 0xc3a9c1bc
mov dword [esp + 4], 0xc75fc5a1
mov dword [esp + 8], 0xcbe4c99c
mov dword [esp + 0xc], 0xcfaccda8
mov word [esp + 0x10], 0xf1f0
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 0x10
xor edx, 0xb0
mov ecx, eax
and ecx, 0xf
sub ecx, edx
xor cl, byte [esp + eax]
add cl, 0x70
mov byte [esp + eax], cl
inc eax
cmp eax, 0x17
jne 0x422ed0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x422f11
add edi, 2
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x422f00
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x422f41
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422f30
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00440cb0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x4470b4]
Function at 0x42c3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42c40a
cmp edi, 1
je 0x42c40a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42c3e1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42c3e0
cmp ecx, 0x20
je 0x42c3e0
cmp ecx, 0x2b
mov edx, edi
je 0x42c400
cmp ecx, 0x2d
jne 0x42c41f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42c424
xor edi, edi
test eax, eax
je 0x42c5dd
mov dword [eax], 0x16
jmp 0x42c5dd
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42c44d
cmp edx, 0x10
jne 0x42c465
cmp byte [ebx], 0x30
jne 0x42c446
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42c467
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42c467
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42c4c0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42c578
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42c4e7
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42c5a8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42c5a8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42c4a0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42c530
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42c539
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42c55d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42c58d
test bl, bl
jne 0x42c58d
mov ebx, dword [esp + 0x10]
jmp 0x42c4b3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42c495
mov esi, edi
test bl, bl
jne 0x42c59b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42c495
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42c5b6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42c5c4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42c5d4
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42c5dd
cmp byte [esp + 3], 0
jne 0x42c5dd
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42c5f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, edx
mov edi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov ebx, 0xffffffff
nop
nop
nop
cmp byte [ebp + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x42c610
lea esi, [ebx + 1]
push esi
call fcn.00408380
add esp, 4
mov dword [esp + 4], edi
mov dword [edi], eax
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov dword [esp], esi
mov ecx, esi
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
jne 0x42c673
mov esi, dword [esp]
and esi, 2
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
test ebx, ebx
je 0x42c724
neg ebx
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
xor eax, edx
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov esi, ecx
shr esi, 1
mov edx, eax
shl edx, 0x1e
sar edx, 0x1f
and edx, 0xedb88320
xor edx, esi
mov edi, eax
shl edi, 0x1d
sar edi, 0x1f
and edi, 0x76dc419
mov esi, eax
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, edi
mov edi, eax
shl edi, 0x1b
sar edi, 0x1f
and edi, 0x1db71064
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x3b6e20c8
xor eax, edi
xor eax, esi
mov esi, edx
shr esi, 6
xor eax, esi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0x76dc4190
xor ecx, eax
shl edx, 0x1a
sar edx, 0x1f
and edx, 0xedb88320
xor edx, ecx
inc ebp
inc ebx
jne 0x42c680
not edx
mov eax, dword [esp + 4]
mov dword [eax + 4], edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
jmp 0x42c715
Function at 0x42fab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x42fbf5
mov edx, dword [esp + 0x18]
dec edx
je 0x42fbf5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42fb00
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x42fba0
cmp ebx, 0x7ff
ja 0x42fb30
cmp edx, 2
jb 0x42fb30
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x42fba0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x42fbba
cmp edx, 4
jb 0x42fbba
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
mov edi, eax
xor edi, 0xc0
or eax, 0x3f
and eax, edi
add al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x42fbf5
test edx, edx
jne 0x42fae0
jmp 0x42fbf5
movzx eax, ax
cmp eax, 0xdc00
jne 0x42fbc8
mov esi, edi
jmp 0x42fba8
cmp edx, 3
jb 0x42fbf1
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x42fba0
mov eax, ebp
jmp 0x42fba0
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432820
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2e0
mov dword [esp + 0x2d8], 0x448b9c
mov dword [esp + 0xa0], 0
lea eax, [esp + 0xa0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4435d8
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x4435e8
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2d4], eax
mov eax, dword [esp + 0x2d8]
mov ecx, dword [esp + 0x2d4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x448ba4]
xor ecx, 0xad5904f0
sub eax, ecx
mov dword [esp + 0x2d0], 0x448ba8
mov dword [esp + 0x2c8], 0x448bb4
mov dword [esp + 0x2c0], 0x448bc0
mov dword [esp + 0x2b8], 0x448bcc
mov dword [esp + 0x2b0], 0x448bd8
mov dword [esp + 0x2a8], 0x448be4
mov dword [esp + 0x2a0], 0x448bf0
mov dword [esp + 0x298], 0x4481b0
mov ecx, dword [0x448bfc]
mov dword [esp + 0x178], ecx
mov dword [esp + 0x294], 0x448c04
mov dword [esp + 0x28c], 0x4481b0
mov ecx, dword [0x448c10]
mov dword [esp + 0x1b8], ecx
mov dword [esp + 0x288], 0x4481b0
mov ecx, dword [0x448c18]
mov dword [esp + 0x1b4], ecx
mov dword [esp + 0x284], 0x448c20
mov dword [esp + 0x27c], 0x448c2c
mov dword [esp + 0x274], 0x448c38
mov dword [esp + 0x26c], 0x448c44
mov dword [esp + 0x264], 0x4481b0
mov ecx, dword [0x448c50]
mov dword [esp + 0x1b0], ecx
mov dword [esp + 0x260], 0x448c58
mov dword [esp + 0x258], 0x448c64
mov dword [esp + 0x250], 0x448c70
mov dword [esp + 0x248], 0x4481b0
mov ecx, dword [0x448c7c]
mov dword [esp + 0x1ac], ecx
mov dword [esp + 0x244], 0x4481b0
mov ecx, dword [0x448c84]
mov dword [esp + 0x1a8], ecx
mov dword [esp + 0x240], 0x448c8c
mov dword [esp + 0x238], 0x448c98
mov dword [esp + 0x230], 0x448ca4
mov dword [esp + 0x228], 0x4481b0
mov ecx, dword [0x448cb0]
mov dword [esp + 0x1a0], ecx
mov dword [esp + 0x224], 0x448cb8
mov dword [esp + 0x21c], 0x448cc4
mov dword [esp + 0x214], 0x4481b0
mov ecx, dword [0x448cd0]
mov dword [esp + 0x19c], ecx
mov dword [esp + 0x210], 0x4481b0
mov ecx, dword [0x448cd8]
mov dword [esp + 0x198], ecx
mov dword [esp + 0x20c], 0x448ce0
mov dword [esp + 0x204], 0x4481b0
mov ecx, dword [0x448cec]
mov dword [esp + 0x1a4], ecx
mov dword [esp + 0x200], 0x4481b0
mov ecx, dword [0x448cf4]
mov dword [esp + 0x1bc], ecx
mov dword [esp + 0x1fc], 0x4481b0
mov ecx, dword [0x448cfc]
mov dword [esp + 0x1c0], ecx
mov dword [esp + 0x1f8], 0x448d04
mov dword [esp + 0x1f0], 0x448d10
mov dword [esp + 0x1e8], 0x4481b0
mov ecx, dword [0x448d1c]
mov dword [esp + 0x1e4], 0x4481b0
mov esi, dword [0x448d24]
mov dword [esp + 0x1e0], 0x4481b0
mov edi, dword [0x448d2c]
mov dword [esp + 0x1dc], 0x4481b0
mov edx, dword [0x448d34]
mov dword [esp + 0x194], edx
mov dword [esp + 0x1d8], 0x4481b0
mov edx, dword [0x448d3c]
mov dword [esp + 0x190], edx
mov dword [esp + 0x1d4], 0x4481b0
mov edx, dword [0x448d44]
mov dword [esp + 0x18c], edx
mov dword [esp + 0x1d0], 0x4481b0
mov edx, dword [0x448d4c]
mov dword [esp + 0x188], edx
mov dword [esp + 0x1cc], 0x4481b0
xor ebx, ebx
mov edx, dword [0x448d54]
mov dword [esp + 0x1c4], edx
jmp eax
Function at 0x434730
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
call fcn.00419030
sub esp, 0x10
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x434769
jmp 0x434900
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x4348fa
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x24], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042fa40
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4347d2
jmp 0x4348e9
mov dword [ebp - 0x20], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.00408380
sub esp, 8
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.0042fab0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0xe7
mov byte [edi + 1], 0xcd
mov byte [edi + 2], 0xcf
mov byte [edi + 3], 0xc7
mov byte [edi + 4], 0xca
mov byte [edi + 5], 0xc6
mov byte [edi + 6], 0xd3
mov byte [edi + 7], 0xbd
mov byte [edi + 8], 0xcc
mov byte [edi + 9], 3
mov byte [edi + 0xa], 0x42
mov byte [edi + 0xb], 0x47
mov byte [edi + 0xc], 0x40
mov byte [edi + 0xd], 0xcd
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x10
jne 0x434842
xor edx, edx
mov ecx, dword [ebp + 8]
cmp edx, 0x10
jae 0x4348bb
movzx ecx, byte [edi + edx]
mov dword [ebp - 0x14], ecx
mov eax, edx
add eax, 0xe3df5a76
mov esi, eax
and esi, ecx
mov ebx, esi
and ebx, 2
xor ebx, 2
mov ecx, esi
and ecx, 0xfd
imul ecx, ebx
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
add esi, ecx
sub eax, esi
add eax, dword [ebp - 0x14]
mov ecx, eax
shl ecx, 1
and ecx, 0xc2
xor eax, 0x1746dae1
mov esi, eax
add esi, ecx
and eax, 1
or esi, 1
add esi, 0xd0
add eax, esi
mov ecx, dword [ebp + 8]
mov byte [edi + edx], al
add edx, 1
jmp 0x434853
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
call fcn.00409160
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.00408390
add esp, 4
jmp 0x4348e9
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4348fa
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ecx, dword [esp + 0x28]
xor ebx, ebx
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x438ee0
mov dword [esp], ecx
lea ebp, [ebx - 2]
mov dword [esp + 4], 0x5e5a5cd1
mov byte [esp + 8], 0
mov edx, 0xc3d0d76f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx + 0x3c2f2895]
not eax
mov esi, edx
or esi, eax
lea edi, [esi + esi]
not edi
add edi, esi
and eax, edx
or eax, edi
add al, 0xd5
mov byte [esp + edx + 0x3c2f2895], al
inc edx
cmp edx, 0xc3d0d774
jne 0x438f10
cmp ebx, 2
je 0x438f5c
mov edi, dword [esp + 4]
mov eax, ebp
mov esi, ebp
sar esi, 1
mov edx, edi
not edx
test al, 2
mov dword [esp + 0x10], edx
jne 0x438f65
mov edx, dword [esp + 0x2c]
jmp 0x438f91
mov eax, dword [esp + 0x2c]
jmp 0x439000
dec esi
mov ecx, dword [esp + 0x28]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp], ecx
xor eax, dword [esp + 0x2c]
mov ebp, eax
not ebp
and ebp, edi
mov ecx, eax
and ecx, edx
imul ecx, ebp
mov ebp, eax
and ebp, edi
or eax, edi
imul eax, ebp
add eax, ecx
mov edx, eax
cmp ebx, 4
mov ecx, dword [esp]
je 0x439000
xor ebx, ebx
mov eax, edx
mov dword [esp + 0xc], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
xor ebp, eax
mov eax, ebp
not eax
and eax, edi
mov esi, ebp
mov edx, ecx
mov ecx, dword [esp + 0x10]
and esi, ecx
imul esi, eax
mov eax, ebp
and eax, edi
or ebp, edi
imul ebp, eax
add ebp, esi
movzx eax, word [edx + ebx*2 + 2]
xor eax, ebp
mov esi, eax
not esi
and esi, edi
mov ebp, eax
and ebp, ecx
mov ecx, edx
imul ebp, esi
mov esi, eax
and esi, edi
or eax, edi
imul eax, esi
mov esi, dword [esp + 0xc]
add eax, ebp
add ebx, 2
cmp esi, ebx
jne 0x438fb0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret