joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x4026e7
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4026e7
push ebx
call fcn.00408f10
add esp, 4
test eax, eax
je 0x40264a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402651
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402630
jmp 0x402653
mov esi, 0x1505
jmp 0x402653
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x4026e7
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402684
inc ebp
dec ebx
je 0x4026e5
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x4026e5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402680
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408f10
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402680
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408f30
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402680
mov eax, dword [ecx + 0x10]
mov edi, dword [eax + edi*4]
jmp 0x4026e7
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402700
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x4027e7
test edx, edx
je 0x4027e7
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x40274a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402751
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402730
jmp 0x402753
mov esi, 0x1505
jmp 0x402753
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x4027e7
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402784
inc ebx
dec ebp
je 0x4027e5
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x4027e5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402780
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408f10
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402780
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408f30
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402780
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4027e7
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x402d08
mov esi, edx
test edx, edx
je 0x402d08
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x402d08
push esi
call fcn.00408f10
add esp, 4
test eax, eax
je 0x402c5a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402c61
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402c40
jmp 0x402c63
mov ebp, 0x1505
jmp 0x402c63
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x402d10
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402cca
call fcn.00402e00
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x402d08
push ecx
call fcn.00408f10
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x402d7f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402d28
inc ebx
dec esi
je 0x402c7f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402c84
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402d20
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00408f10
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402d20
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408f30
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402d20
mov eax, 0xffffffff
jmp 0x402d08
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402d98
inc ebx
dec esi
je 0x402cc5
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402cca
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402d90
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00408f10
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402d90
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408f30
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402d90
jmp 0x402cca
Function at 0x403520
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4036d6
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x4036cf
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x4035b3
add ebp, dword [esp + 0xc]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp + 0x10]
sub ebx, esi
mov esi, 0x15b0
je 0x4036cf
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x40362d
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x4035d0
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
mov dword [esp + 0x10], ebx
jbe 0x403578
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0xc], eax
je 0x403683
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x403660
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x403570
jmp 0x403695
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x403570
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x4036a0
jmp 0x403570
shl ecx, 0x10
or ecx, edi
jmp 0x4036db
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4036f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40371e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x4037bc
not eax
test bl, 1
jne 0x403725
mov edx, ebx
cmp ebx, 1
jne 0x403756
jmp 0x4037ba
xor eax, eax
jmp 0x4037bc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43da18]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x43da18]
cmp ebx, 1
je 0x4037ba
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43da18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43da18]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43da18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43da18]
add esi, 2
cmp edx, esi
jne 0x403760
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x408d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x408dbc
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x408dbc
test ebx, ebx
je 0x408e5d
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov edi, ebx
and edi, 7
je 0x408e02
neg edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
dec esi
cmp edi, esi
jne 0x408da0
add ecx, esi
add edx, esi
add esi, ebx
cmp ebx, 8
jae 0x408e09
jmp 0x408e5d
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
xor ecx, 3
mov edx, ebx
or edx, 0xfffffffc
and edx, ecx
add edx, eax
mov ebp, ebx
and ebp, 0xfffffffc
add ebp, esi
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, ebp
mov edi, edx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
test bl, 1
je 0x408e5d
and ebx, 2
movzx eax, byte [ebp + ebx]
mov byte [edx + ebx], al
jmp 0x408e5d
mov esi, ebx
cmp ebx, 8
jb 0x408e5d
neg esi
xor edi, edi
nop
nop
nop
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
movzx eax, byte [ecx + edi - 1]
mov byte [edx + edi - 1], al
movzx eax, byte [ecx + edi - 2]
mov byte [edx + edi - 2], al
movzx eax, byte [ecx + edi - 3]
mov byte [edx + edi - 3], al
movzx eax, byte [ecx + edi - 4]
mov byte [edx + edi - 4], al
movzx eax, byte [ecx + edi - 5]
mov byte [edx + edi - 5], al
movzx eax, byte [ecx + edi - 6]
mov byte [edx + edi - 6], al
movzx eax, byte [ecx + edi - 7]
mov byte [edx + edi - 7], al
add edi, 0xfffffff8
cmp esi, edi
jne 0x408e10
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x409370
Capabilities:
Terminate process

Disassembly:
sub esp, 0x124
call fcn.00438f90
test al, 1
jne 0x409384
jmp 0x409459
call fcn.004310d0
test al, 1
jne 0x409392
jmp 0x409452
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 8
cmp eax, 0
setge al
test al, 1
jne 0x4093bb
jmp 0x409450
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
sub esp, 0x24
cmp eax, 0
setge al
test al, 1
jne 0x409419
jmp 0x40944a
call fcn.0040a4a0
test al, 1
jne 0x409424
jmp 0x409448
jmp 0x409426
lea eax, [esp + 0x24]
lea ecx, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409470
call fcn.0040eed0
call fcn.0040c3b0
jmp 0x409448
jmp 0x40944a
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409452
call fcn.00439540
jmp 0x409459
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4094e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40960b
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40951d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409541
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409510
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409510
lea esi, [ebx + 1]
push esi
call fcn.00408cd0
add esp, 4
test ebx, ebx
jle 0x409615
add ebx, eax
add esi, eax
mov dword [esp + 8], esi
mov ebp, eax
jmp 0x409585
mov byte [ebp], dl
mov esi, 1
add edi, 2
add ebp, esi
cmp ebp, ebx
jae 0x409617
movzx edx, word [edi]
test dx, dx
je 0x409617
cmp dx, 0x7f
jbe 0x409570
mov ecx, ebp
not ecx
add ecx, dword [esp + 8]
movzx esi, dx
cmp ecx, 2
jb 0x4095d0
cmp esi, 0x7ff
ja 0x4095d0
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 1], dl
mov esi, 2
jmp 0x409578
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x409578
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [ebp], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 2], dl
mov esi, 3
jmp 0x409578
push 1
call fcn.00408cd0
add esp, 4
mov ebp, eax
mov edi, dword [esp + 0x228]
mov esi, dword [esp + 0x224]
mov byte [ebp], 0
movzx edx, byte [eax]
lea ecx, [esp + 0xc]
mov ebx, ecx
test dl, dl
je 0x409656
inc eax
lea ebx, [esp + 0xc]
jmp 0x40964b
mov byte [ebx], dh
inc ebx
movzx edx, byte [eax]
inc eax
test dl, dl
je 0x409656
mov dh, 0x2f
cmp dl, 0x5c
je 0x409640
mov dh, dl
jmp 0x409640
mov byte [ebx], 0
push 0
push 0
push 0
mov eax, dword [esp + 0xc]
push dword [eax + 8]
add eax, 0x10
push 0
push 0
push edi
push esi
push ecx
push eax
call fcn.00405970
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40bd00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0x3c
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x4c], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x446364]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40bdae
sar edx, 1
lea edi, [esi + 0x1c]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x440d70]
xor eax, eax
jmp 0x40c34a
mov ecx, dword [0x440e0c]
jmp ecx
Function at 0x415bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf0
mov esi, esp
mov ecx, dword [ebp + 0xc]
push eax
mov dword [esi + 0x94], esp
push eax
mov dword [esi + 0x98], esp
sub esp, 0xc
mov dword [esi + 0xa0], esp
sub esp, 0xc
mov dword [esi + 0x88], esp
sub esp, 0x18
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x64], eax
mov esp, eax
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edi + 2], 0
lea edi, [edi + 2]
jne 0x415c40
sar edi, 1
lea eax, [esi + 0x70]
push eax
push 0
push 0
push edi
push ecx
push 0
call dword [0x44769c]
mov ebx, dword [esi + 0x70]
test ebx, ebx
jns 0x415c6d
mov eax, 0xffffffff
jmp 0x415c70
lea eax, [ebx + ebx]
push eax
call fcn.00408cd0
add esp, 4
lea ecx, [esi + 0x70]
push ecx
push ebx
mov dword [esi + 0xc], eax
push eax
push edi
push dword [ebp + 0xc]
push 0
call dword [0x44769c]
mov dword [esi + 0x28], 0xfb44f9aa
mov dword [esi + 0x2c], 0xff69fd59
mov dword [esi + 0x30], 0xf310f16a
mov dword [esi + 0x34], 0xf753f544
mov dword [esi + 0x38], 0xeb7de964
mov dword [esi + 0x3c], 0xef7ded71
mov dword [esi + 0x40], 0xe3e0e170
lea eax, [esi + 0x44]
mov dword [esi + 0x44], 0
mov byte [esi + 0x48], 0
mov dword [esi + 0xa4], 0
mov ecx, dword [esi + 0xa4]
cmp ecx, 0x20
ja 0x415d47
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esi + 0xa4]
mov edx, dword [esi + 0xa4]
movzx edi, byte [esi + edx + 0x28]
mov edx, 0x60544b00
sub edx, ecx
dec ecx
and ecx, edi
or edx, edi
not edx
add edx, edi
sub edx, ecx
mov dword [esi + 0xc0], edx
mov ecx, dword [esi + 0xc0]
mov edx, ecx
xor edx, 6
and ecx, 6
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esi + 0xa4]
mov byte [esi + edx + 0x28], cl
inc dword [esi + 0xa4]
mov ecx, dword [esi + 0xa4]
cmp ecx, 0x21
jb 0x415cf0
lea edi, [esi + 0xa4]
lea edx, [esi + 0x28]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esi + 0xc0]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
jmp dword [0x4420b0]
Function at 0x41e720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x9b5b9945
mov dword [esp + 0x14], 0x97069504
mov dword [esp + 0x18], 0x9373916c
mov dword [esp + 0x1c], 0x8f6f8d00
mov dword [esp + 0x20], 0x8b6e8955
mov dword [esp + 0x24], 0x871e8568
mov dword [esp + 0x28], 0x8314810d
mov dword [esp + 0x2c], 0xbf23bd20
mov dword [esp + 0x30], 0xbb58b92a
mov dword [esp + 0x34], 0xb724b52d
mov dword [esp + 0x38], 0xb356b12c
mov dword [esp + 0x3c], 0xaf3cad5c
mov dword [esp + 0x40], 0xab34a93f
mov dword [esp + 0x44], 0xa732a53d
mov dword [esp + 0x48], 0xa331a13d
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x5d5c
mov dword [esp + 0x4e], 0
mov dword [esp + 0x52], 0
mov word [esp + 0x56], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x47
ja 0x41e815
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
add ecx, 0xbddda3c4
xor ecx, edx
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
add cl, 0xa4
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x48
jb 0x41e7e0
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44769c]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41e85e
mov eax, 0xffffffff
jmp 0x41e861
lea eax, [edi + edi]
push eax
call fcn.00408cd0
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x44769c]
mov dword [esp + 0x10], 0x39a0df8
mov dword [esp + 0x14], 0x7940195
mov dword [esp + 0x18], 0x3bdf05e0
mov dword [esp + 0x1c], 0x3fd839ae
mov dword [esp + 0x20], 0x33a43da5
mov dword [esp + 0x24], 0x373631d4
mov byte [esp + 0x28], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x18
ja 0x41e90f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x39f523d6]
and edx, ecx
add eax, ecx
add eax, 0x39f523d6
add edx, edx
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x26
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x19
jb 0x41e8d0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.004188f0
add esp, 0x14
mov ebx, eax
jmp dword [0x442e80]
Function at 0x42e500
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [ebp + 8]
mov byte [esp + 0xf], 0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x42e6b0
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp + 0x48], eax
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
setne al
test al, 1
jne 0x42e572
jmp 0x42e6aa
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00408f10
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], 0
je 0x42e69a
mov ecx, dword [ebp + 8]
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov bl, byte [esp + 0x14]
mov byte [esp + 0x1c], bl
mov byte [esp + 0x20], 0xd3
mov byte [esp + 0x21], 0xf9
mov byte [esp + 0x22], 0xf3
mov byte [esp + 0x23], 0xfb
mov byte [esp + 0x24], 0xf6
mov byte [esp + 0x25], 0xfa
mov byte [esp + 0x26], 0xc7
mov byte [esp + 0x27], 0xe9
mov byte [esp + 0x28], 0xf8
mov byte [esp + 0x29], 0xb7
mov byte [esp + 0x2a], 0xee
mov byte [esp + 0x2b], 0xeb
mov byte [esp + 0x2c], 0xec
mov byte [esp + 0x2d], 0x61
mov byte [esp + 0x30], 0
mov word [esp + 0x2e], 0
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x10]
cmp esi, 0x11
jae 0x42e67d
mov dword [esp + 0x40], edi
jmp 0x42e61d
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
movzx eax, byte [esp + esi + 0x20]
mov edi, ebx
add edi, 0xf870be92
lea esi, [ebx + eax - 0x78f416e]
and edi, eax
add ebx, 0x92
and ebx, eax
add edi, ebx
mov eax, esi
not eax
mov ebx, edi
and ebx, eax
not edi
and esi, edi
sub esi, ebx
mov dword [esp + 0x44], esi
mov eax, dword [esp + 0x44]
add al, 2
mov esi, dword [esp + 0x10]
mov byte [esp + esi + 0x20], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x11
jb 0x42e61d
mov edi, dword [esp + 0x40]
jmp 0x42e67d
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], edi
call fcn.00409690
sub esp, 0xc
and al, 1
mov byte [esp + 0xf], al
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [esp + 0xf]
jmp 0x42e6b6
jmp 0x42e6b8
jmp 0x42e6ba
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret