joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404bc0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x404c2d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404c2d
push esi
call fcn.0040cb80
add esp, 4
test eax, eax
je 0x404c0a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404c11
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404bf0
jmp 0x404c13
mov ebx, 0x1505
jmp 0x404c13
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x404c35
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404c44
inc ebp
dec edi
je 0x404c2b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x404c2b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x404c40
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cb80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404c40
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404c40
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x404c2d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x404c2d
Function at 0x405180
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405292
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405292
cmp dword [esp + 0x2c], 0
je 0x405292
push esi
call fcn.0040cb80
add esp, 4
test eax, eax
je 0x4051ea
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x4051f1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4051d0
jmp 0x4051f3
mov ebx, 0x1505
jmp 0x4051f3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x40529a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405257
call fcn.00405f10
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405292
push ecx
call fcn.0040cb80
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40530d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4052b8
inc edi
dec esi
je 0x40520c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405211
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4052b0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cb80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4052b0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4052b0
mov eax, 0xffffffff
jmp 0x405292
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405328
inc edi
dec esi
je 0x405252
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405257
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405320
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cb80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405320
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405320
jmp 0x405257
Function at 0x405c60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405e4a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405e4a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405e4a
cmp dword [ecx], 0
jne 0x405e4a
push esi
call fcn.0040cb80
add esp, 4
test eax, eax
je 0x405cca
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405cd1
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405cb0
jmp 0x405cd3
mov edi, 0x1505
jmp 0x405cd3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405da4
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405d31
call fcn.00405f10
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405e4a
push esi
call fcn.0040cb80
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405e60
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cb80
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x450008]
add esp, 4
test eax, eax
je 0x405e45
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040caa0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405e4a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405dc8
inc ebx
dec edx
je 0x405cec
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405cf1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405dc0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cb80
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405dc0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cba0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405dc0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404d20
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405d99
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406f90
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x407146
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40713f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x407025
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40713f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x4070a5
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x407040
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406fed
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x4070f0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4070d0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406fe0
jmp 0x4070ff
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406fe0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x407110
jmp 0x406fe0
shl ecx, 0x10
or ecx, edi
jmp 0x40714b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x407160
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4071b9
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4071bb
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44dc50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
not ebp
or ebp, 0xf
add ebx, ebp
inc ebx
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44dc50]
inc esi
cmp edx, esi
jne 0x407180
not eax
jmp 0x4071bb
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d220
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00446210
test al, al
je 0x40d3fe
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043da00
test al, al
je 0x40d3f9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x723b4c4f
mov dword [esp + 8], 0xa65c1aa2
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d2a6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d410
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d280
mov dword [esp + 4], 0x128bb575
mov dword [esp + 8], 0x20936e07
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40d2f6
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d4b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40d2d0
test esi, esi
je 0x40d396
mov dword [esp + 4], 0xfffef9d9
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x40d346
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d530
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x40d320
mov dword [esp + 4], 0x218b75df
mov dword [esp + 8], 0x4750440e
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40d396
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d5b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40d370
mov dword [esp + 4], 0xd6d7c8c9
mov dword [esp + 8], 0xd2d3d4d5
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40d3e6
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d620
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40d3c0
call fcn.0040ed90
test al, al
je 0x40d3f9
call fcn.00412230
call fcn.00410430
call fcn.00447320
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4280d0
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov esi, dword [0x457454]
mov dword [esp + 0x14], 0x9326917d
mov dword [esp + 0x18], 0x9f3d9d0b
mov dword [esp + 0x1c], 0x9b0e9939
mov dword [esp + 0x20], 0x87168545
mov dword [esp + 0x24], 0x834e8110
mov dword [esp + 0x28], 0x8f128d2d
mov dword [esp + 0x2c], 0x8b678929
mov dword [esp + 0x30], 0x7574
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1f
ja 0x42815b
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042b5a0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x20
jb 0x428130
lea edi, [esp + 0x64]
lea eax, [esp + 0x14]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x64]
test ebx, ebx
jns 0x42817e
mov eax, 0xffffffff
jmp 0x428181
lea eax, [ebx + ebx]
push eax
call fcn.0040ca70
add esp, 4
mov esi, eax
mov ebp, dword [0x457454]
mov dword [esp + 0x14], 0x95e0b37
mov dword [esp + 0x18], 0x57b0779
mov dword [esp + 0x1c], 0x176037b
mov dword [esp + 0x20], 0x1d6e1f5f
mov dword [esp + 0x24], 0x19461b6c
mov dword [esp + 0x28], 0x159a1767
mov dword [esp + 0x2c], 0x1129136b
mov word [esp + 0x30], 0x2f10
mov dword [esp + 0x32], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x21
ja 0x42821b
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042b620
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x22
jb 0x4281f0
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebp
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
jns 0x42823b
mov eax, 0xffffffff
jmp 0x428242
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040ca70
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0x3766395c
mov dword [esp + 0x18], 0x334d3555
mov dword [esp + 0x1c], 0x4f2f3147
mov dword [esp + 0x20], 0x4b374d37
mov dword [esp + 0x24], 0x474649c7
mov word [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x15
ja 0x4282bb
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042b690
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x16
jb 0x428290
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x4282e1
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4282d0
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x428311
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428300
mov ebx, dword [esp + 0x84]
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.0044ae30
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x452ad0]
Function at 0x431e10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x431e6a
cmp edi, 1
je 0x431e6a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x431e41
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x431e40
cmp ecx, 0x20
je 0x431e40
cmp ecx, 0x2b
mov edx, edi
je 0x431e60
cmp ecx, 0x2d
jne 0x431e7f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x431e84
xor edi, edi
test eax, eax
je 0x43203d
mov dword [eax], 0x16
jmp 0x43203d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x431ead
cmp edx, 0x10
jne 0x431ec5
cmp byte [ebx], 0x30
jne 0x431ea6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x431ec7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x431ec7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x431f20
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x431fd8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x431f47
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x432008
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x432008
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x431f00
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x431f90
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x431f99
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x431fbd
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x431fed
test bl, bl
jne 0x431fed
mov ebx, dword [esp + 0x10]
jmp 0x431f13
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x431ef5
mov esi, edi
test bl, bl
jne 0x431ffb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x431ef5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x432016
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x432024
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x432034
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x43203d
cmp byte [esp + 3], 0
jne 0x43203d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4393d0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
setne al
jmp 0x4393f1
jmp 0x4393f3
xor ebx, ebx
test al, 1
jne 0x4393fe
jmp 0x439531
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
jmp 0x43942c
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x43943d
jmp 0x43952b
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0040cb80
mov ebp, eax
xor ebx, ebx
cmp ebp, 0
je 0x43951d
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 7
mov byte [esp + 0x19], 0x7d
mov byte [esp + 0x1a], 0x7f
mov byte [esp + 0x1b], 0x67
mov byte [esp + 0x1c], 0x7a
mov byte [esp + 0x1d], 0x66
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x1f], 0x6d
mov byte [esp + 0x20], 0x7c
mov byte [esp + 0x21], 0x23
mov byte [esp + 0x22], 0x62
mov byte [esp + 0x23], 0x67
mov byte [esp + 0x24], 0x60
mov byte [esp + 0x25], 0xdd
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x11
jne 0x4394b3
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x11
jae 0x4394fd
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043d910
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x4394c8
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040d8d0
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x43952b
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x25cf6c1a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3c45c55
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219