joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41c9e7
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x41c918
mov ebp, ebx
mov esi, ebp
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x41c9e9
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0041efc0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0041efc0
add esp, 4
shl bh, 2
mov ah, al
shr ah, 4
and ah, 3
or ah, bh
mov ecx, esi
and ecx, 1
mov edx, esi
xor edx, 1
lea ebx, [edx + ecx*2]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], ah
cmp edi, ecx
jae 0x41c900
mov byte [esp + 3], al
movzx eax, byte [ebp + edi]
push eax
call fcn.0041efc0
add esp, 4
cmp al, 0x40
jne 0x41c980
mov ebp, ebx
mov ecx, dword [esp + 0x1c]
jmp 0x41c902
movzx edx, byte [esp + 3]
shl dl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, dl
lea ebp, [ebx + 1]
mov edx, dword [esp + 0x20]
mov byte [edx + ebx], cl
lea ecx, [edi + 1]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
jae 0x41c9e0
mov esi, ebx
mov ebx, eax
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.0041efc0
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x41c902
shl bl, 6
add al, bl
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
add esi, 2
mov ebp, esi
jmp 0x41c902
mov ecx, edx
jmp 0x41c902
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41cf70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov ebx, dword [ebp + 0x10]
mov dword [esp + 8], 0x3f9039eb
mov dword [esp + 0xc], 0x23b13dab
mov dword [esp + 0x10], 0x272621b2
mov byte [esp + 0x14], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
lea esi, [ecx - 0x55c55db6]
lea edi, [ecx + 0x4a]
and edi, edx
or esi, edx
mov edx, esi
not edx
lea edx, [esi + edx*2]
inc edx
or edx, edi
mov esi, edx
not esi
and esi, 0xd
xor edx, 0x72
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx + 8], dl
and eax, 1
not ecx
or ecx, 1
sub eax, ecx
mov ecx, eax
cmp eax, 0xd
jb 0x41cfb0
mov dword [esp + 0x30], 0x89068b34
mov dword [esp + 0x34], 0x85368704
mov dword [esp + 0x38], 0x81f383c2
mov dword [esp + 0x3c], 0x9d2a9ff1
mov dword [esp + 0x40], 0x99279b2d
mov dword [esp + 0x44], 0x95229727
mov dword [esp + 0x48], 0x9123932c
mov dword [esp + 0x4c], 0xed62ef1d
mov dword [esp + 0x50], 0xe9eaebaa
mov word [esp + 0x54], 0
lea eax, [esp + 0x30]
mov ecx, 0x52345e5c
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
xor edx, ecx
mov esi, 0x9b05d7cf
sub esi, edx
mov edi, esi
and edi, 1
add edx, 0x30
and edx, 0xc4
and esi, 0x3b
or esi, edx
xor esi, 0xc5
lea edx, [esi + edi*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x52345e36
jne 0x41d050
movzx ecx, word [esp + 0x30]
lea eax, [esp + 0x14c]
test cx, cx
je 0x41d0b1
lea edx, [esp + 0x32]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d0a0
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x41d0e1
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d0d0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x41d111
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d100
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [esp + 0x30], 0xd5d8d866
mov byte [esp + 0x34], 0x70
mov word [esp + 0x35], 0
mov byte [esp + 0x37], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x95
xor cl, byte [esp + eax + 0x30]
add cl, 0x17
mov byte [esp + eax + 0x30], cl
add eax, 0x9331ed7a
mov ecx, eax
or ecx, 0x6cce1287
and eax, 0x87
add eax, ecx
cmp eax, 8
jb 0x41d140
movzx eax, byte [esp + 0x30]
test al, al
je 0x41d18b
lea ecx, [esp + 0x31]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d180
mov ebx, edx
mov byte [edx], 0
lea eax, [esp + 0x140]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x14c]
push eax
push ecx
push edx
call fcn.0040b170
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x445d50]
mov ecx, 0x83b8babb
xor ecx, dword [0x445d58]
add eax, ecx
inc eax
jmp eax
Function at 0x422cb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov ecx, 0xfffffffe
nop
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x422cc0
mov eax, ecx
sar eax, 1
and ecx, 0x12
xor eax, 9
add eax, ecx
jns 0x422ce0
mov eax, 0xffffffff
jmp 0x422ce2
add eax, eax
push eax
call fcn.004082d0
add esp, 4
mov esi, eax
mov dword [esp], 0x81338720
mov dword [esp + 4], 0x8d39832f
mov dword [esp + 8], 0x89788f70
mov dword [esp + 0xc], 0x95288b24
mov word [esp + 0x10], 0x9794
mov dword [esp + 0x12], 0
mov word [esp + 0x16], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx]
lea edx, [ecx + 0x1823dae1]
xor edx, ebx
neg edx
mov ebx, edx
and ebx, 0x66
add ebx, ebx
xor edx, 0x99
sub edx, ebx
add dl, 2
mov byte [esp + ecx], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 0x1e
sub eax, edx
add eax, ecx
mov ecx, eax
cmp eax, 0x18
jb 0x422d30
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x422d91
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x422d80
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x422dc1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422db0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043f130
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x446194]
Function at 0x4253d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
push eax
push eax
mov esi, esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x58], 0xb97dbb5f
mov dword [ebp - 0x54], 0xbd2ebf28
mov dword [ebp - 0x50], 0xb155b378
mov dword [ebp - 0x4c], 0xb551b724
mov dword [ebp - 0x48], 0xa946ab6f
mov dword [ebp - 0x44], 0xad36af5c
mov dword [ebp - 0x40], 0xa130a327
mov dword [ebp - 0x3c], 0xa53da744
mov dword [ebp - 0x38], 0x59bc5b32
mov dword [ebp - 0x34], 0x5dc85fc7
mov dword [ebp - 0x30], 0x51be53b8
mov dword [ebp - 0x2c], 0x55c057a0
mov dword [ebp - 0x28], 0x49d04bc5
mov dword [ebp - 0x24], 0x4dd24fd7
mov dword [ebp - 0x20], 0x41d743d7
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x4740
mov byte [ebp - 0x18], 0
mov ecx, 0xce9b8cdf
mov eax, 0x20
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebp + ecx + 0x316472c9]
mov edx, eax
xor edx, ecx
and edx, edi
xor edx, ecx
mov edi, edx
and edi, 0x24
xor edx, 0xa4
lea edx, [edx + edi*2]
inc dl
mov byte [ebp + ecx + 0x316472c9], dl
inc ecx
dec eax
cmp ecx, 0xce9b8d20
jne 0x425470
mov dword [ebp - 0x10], ebx
lea edx, [ebp - 0x96]
lea ebx, [ebp - 0x58]
mov eax, ebx
mov edi, edx
mov ecx, 0xf
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp - 0x5a]
mov ecx, 1
mov eax, dword [ebp - 0x14]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
push ebx
push 0
push 0
push 0x1e
push edx
push 0
call dword [0x44be2c]
mov dword [esi], 0xf7b689a7
mov word [esi + 4], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esi + ebx]
mov ecx, ebx
and ecx, 2
xor ecx, 0xf529d22
mov edx, ebx
and edx, 5
sub edx, ecx
mov ecx, edx
and ecx, edi
add edx, edi
add ecx, ecx
sub edx, ecx
mov ecx, 0x7c
sub ecx, edx
add edx, 3
and ecx, 0x59
and edx, 0xa6
sub edx, ecx
mov byte [esi + ebx], dl
inc ebx
cmp ebx, 6
jne case.default.0x425537
xor ecx, ecx
cmp eax, dword [esi]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44672c]
mov esi, dword [ebp - 0x58]
test esi, esi
jns 0x42554c
mov eax, 0xffffffff
jmp 0x42554f
lea eax, [esi + esi]
mov ebx, dword [ebp - 0x10]
push eax
call fcn.004082d0
add esp, 4
mov edi, eax
lea eax, [ebp - 0x58]
push eax
push esi
push edi
push 0x1e
lea eax, [ebp - 0x96]
push eax
push 0
call dword [0x44be2c]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446734]
xor eax, eax
xor ebx, ebx
jmp dword [0x44673c]
mov dword [ebx], 0x71c67fa8
mov dword [ebx + 4], 0x75cc73c7
mov dword [ebx + 8], 0x49d177d0
mov dword [ebx + 0xc], 0x4de84bfa
mov dword [ebx + 0x10], 0x41fc4ff7
mov dword [ebx + 0x14], 0x454243e4
mov word [ebx + 0x18], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
mov esi, eax
and esi, 0x2a
mov edx, ecx
xor edx, 0x15
add edx, esi
xor dl, byte [ebx + ecx]
add dl, 0x97
mov byte [ebx + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x1a
jne 0x4255c0
push 0
push 0
push ebx
push edi
push dword [ebp + 8]
call fcn.00420c90
add esp, 0x14
mov ebx, eax
jmp dword [0x44673c]
push edi
call fcn.004082e0
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x30]
jmp dword [0x446750]
Function at 0x4278e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ecx, word [esi]
test cx, cx
je 0x427a58
mov ebp, dword [esp + 0x1c]
dec ebp
je 0x427a58
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x427930
lea ecx, [eax + 1]
mov byte [eax], bl
jmp 0x427a00
cmp ebx, 0x7ff
ja 0x427960
cmp ebp, 2
jb 0x427960
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 2]
mov byte [eax + 1], bl
jmp 0x427a00
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x427a1a
cmp ebp, 4
jb 0x427a1a
movzx edx, word [esi + 2]
mov dword [esp], edx
add esi, 4
mov ecx, ebx
not ecx
and ecx, 0xd800
and ebx, 0x27ff
sub ebx, ecx
shl ebx, 0xa
mov ecx, edx
not ecx
and ecx, 0xdc00
and edx, 0x23ff
sub edx, ecx
lea ecx, [edx + ebx]
add edx, ebx
add edx, 0x10000
mov ebx, edx
shr ebx, 0x12
mov edi, edx
shr edi, 0x11
and edi, 0xe0
xor ebx, 0xf0
add ebx, edi
mov byte [eax], bl
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov ecx, dword [esp]
and cl, 0x3f
or cl, 0x80
mov edx, ecx
lea ecx, [eax + 4]
mov byte [eax + 3], dl
mov edi, esi
nop
nop
add ebp, eax
sub ebp, ecx
mov esi, edi
mov eax, ecx
movzx ecx, word [esi]
test cx, cx
je 0x427a58
test ebp, ebp
jne 0x427910
jmp 0x427a58
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x427a29
mov esi, edi
jmp 0x427a08
cmp ebp, 3
jb 0x427a54
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x427a00
mov ecx, eax
jmp 0x427a00
mov byte [eax], 0
sub eax, dword [esp + 0x18]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4286c1
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add ecx, 2
cmp word [edx], 0
jne 0x4286d0
sub edx, eax
cmp edx, 0xffffffd9
mov dword [esp + 8], eax
jge 0x4286fd
mov edx, 0xffffffff
jmp 0x428700
add edx, 0x26
push edx
call fcn.004082d0
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x812b8720
mov dword [esp + 0x20], 0x8d348331
mov dword [esp + 0x24], 0x89258f22
mov dword [esp + 0x28], 0x952e8b21
mov dword [esp + 0x2c], 0x91279739
mov dword [esp + 0x30], 0x9d3c9326
mov dword [esp + 0x34], 0x99379f37
mov dword [esp + 0x38], 0x65249b6e
mov dword [esp + 0x3c], 0x61c867c8
mov word [esp + 0x40], 0x6360
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor eax, eax
xor ecx, ecx
nop
movzx esi, byte [esp + ecx + 0x1c]
mov ebx, eax
and ebx, 0x42
mov edx, ecx
xor edx, 0xab259561
add edx, ebx
mov ebx, edx
and ebx, esi
mov edi, ebx
or edi, 0xfd
inc edi
mov ebp, ebx
and ebp, 0xfffffffd
imul ebp, edi
mov edi, ebx
and edi, 2
or ebx, 2
imul ebx, edi
sub ebp, ebx
add edx, esi
add edx, ebp
add dl, 0x1b
mov byte [esp + ecx + 0x1c], dl
inc ecx
add eax, 2
cmp ecx, 0x2c
jne 0x428770
mov esi, dword [esp + 8]
movzx ecx, word [esi]
mov edi, dword [esp + 0x14]
mov eax, edi
test cx, cx
je 0x4287f1
mov edx, esi
add edx, 2
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4287e0
mov word [eax], 0
movzx ecx, word [esp + 0x1c]
test cx, cx
lea ebp, [esp + 0x1c]
je 0x428821
lea edx, [esp + 0x1e]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428810
mov word [eax], 0
jmp dword [0x446f54]

Function at 0x42882c
Capabilities:
Copy file

Disassembly:
push esi
call fcn.004082e0
add esp, 4
xor eax, eax
cmp word [edi], 0x2a
sete al
jmp dword [eax*4 + 0x446f5c]

Function at 0x428845
Capabilities:
Copy file
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
cmp word [edi], 0x2a
sete al
jmp dword [eax*4 + 0x446f5c]
Function at 0x428ce0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x1c], 0x6132675b
mov dword [esp + 0x20], 0x7d1f6311
mov dword [esp + 0x24], 0x790a7f1f
mov dword [esp + 0x28], 0x750a7b3b
mov dword [esp + 0x2c], 0x712a7704
mov dword [esp + 0x30], 0x8dfe7313
mov dword [esp + 0x34], 0x89b18fef
mov dword [esp + 0x38], 0x85e78bec
mov dword [esp + 0x3c], 0x81f98708
mov dword [esp + 0x40], 0x9df583e3
mov dword [esp + 0x44], 0x99ea9ff8
mov dword [esp + 0x48], 0x95e79be9
mov dword [esp + 0x4c], 0x91e297f7
mov dword [esp + 0x50], 0xad1c93a6
mov dword [esp + 0x54], 0xa9d0afd0
lea eax, [esp + 0x58]
mov dword [esp + 0x58], 0xaba8
mov byte [esp + 0x5c], 0
lea ecx, [esp + 0x1c]
mov edx, 0x4cc55f16
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx]
mov esi, edx
or esi, edi
mov ebx, edx
xor ebx, edi
add ebx, edi
not edi
and edi, edx
lea ebp, [edi + edi]
not ebp
add ebp, edi
not ebx
add ebx, esi
and ebx, ebp
add bl, 0x73
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x4cc55ed5
jne 0x428d80
lea edx, [esp + 0x1c]
lea esi, [esp + 0xa4]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xe0]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0xa0]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44be2c]
mov dword [esp + 0x1c], 0x438281e3
mov dword [esp + 0x20], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0xa0
xor dl, byte [esp + ecx + 0x1c]
add dl, 0xe0
mov byte [esp + ecx + 0x1c], dl
inc ecx
cmp ecx, 8
jne 0x428e00
jmp dword [0x446fd0]

Function at 0x428e1c
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xor ecx, ecx
cmp eax, dword [esp + 0x1c]
setne cl
xor eax, eax
mov esi, dword [esp + 0x18]
jmp dword [ecx*4 + 0x446fd4]

Function at 0x429a2d
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x60]
test ebx, ebx
jns 0x429a3c
mov eax, 0xffffffff
jmp 0x429a3f
lea eax, [ebx + ebx]
push eax
call fcn.004082d0
add esp, 4
push edi
push ebx
mov dword [esp + 0x44], eax
push eax
push 9
push esi
push 0
call dword [0x44be2c]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447104]
Function at 0x42a7e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc4
mov dword [esp + 0x20], 0x1c5072b
mov dword [esp + 0x24], 0xdf203f0
mov dword [esp + 0x28], 0x9ed0fc0
mov dword [esp + 0x2c], 0x15e90bf4
mov dword [esp + 0x30], 0x11f2173b
mov dword [esp + 0x34], 0x1de313c6
mov dword [esp + 0x38], 0x19f11fe0
mov dword [esp + 0x3c], 0x25f91be8
mov dword [esp + 0x40], 0x211327c8
mov dword [esp + 0x44], 0x2dc62315
mov dword [esp + 0x48], 0x29c12fd1
mov dword [esp + 0x4c], 0x35d72bd5
mov dword [esp + 0x50], 0x31c737df
mov dword [esp + 0x54], 0x3d0433c6
mov dword [esp + 0x58], 0x39c93fc4
mov dword [esp + 0x5c], 0xc53a3bcc
lea eax, [esp + 0x60]
mov byte [esp + 0x60], 0
mov ecx, 0xb17574c1
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x4e8a8b5f]
mov esi, ecx
or esi, edx
not edx
mov edi, ecx
or edi, edx
sub edx, edi
add edx, esi
add dl, 0x3b
mov byte [esp + ecx + 0x4e8a8b5f], dl
inc ecx
cmp ecx, 0xb1757502
jne 0x42a790
lea esi, [esp + 0x84]
lea edx, [esp + 0x20]
mov edi, esi
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xc4]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x80]
push edi
push 0
push 0
push 0x1f
push esi
push 0
call dword [0x44be2c]
mov dword [esp + 0x20], 0xe3222143
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
nop
nop
nop
nop
mov ecx, ebx
add cl, 8
xor cl, byte [esp + ebx + 0x20]
add cl, 0xd8
mov byte [esp + ebx + 0x20], cl
inc ebx
cmp ebx, 7
jne case.default.0x42a831
xor ecx, ecx
cmp eax, dword [esp + 0x20]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4471f4]
Function at 0x432dd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00418780
sub esp, 0x10
mov edi, esp
jmp 0x432de5
call fcn.00418780
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x432e10
jmp 0x432f6f
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x432e2c
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x432e4e
jmp 0x432f67
mov dword [ebp - 0x14], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042eb30
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x432f56
mov dword [ebp - 0x1c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.004082d0
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.004278e0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x67
mov byte [edi + 1], 0x8d
mov byte [edi + 2], 0x8f
mov byte [edi + 3], 0x87
mov byte [edi + 4], 0x8a
mov byte [edi + 5], 0x86
mov byte [edi + 6], 0x73
mov byte [edi + 7], 0x9d
mov byte [edi + 8], 0x8c
mov byte [edi + 9], 0x43
mov byte [edi + 0xa], 0x82
mov byte [edi + 0xb], 0x87
mov byte [edi + 0xc], 0x80
mov byte [edi + 0xd], 0xd
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x10
jne 0x432eeb
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x10
jae 0x432f22
mov dl, byte [edi + eax]
mov esi, eax
shl esi, 1
and esi, 0xc
mov ebx, eax
xor ebx, 6
add ebx, esi
mov ecx, dword [ebp + 8]
xor bl, dl
add bl, 0xe2
mov byte [edi + eax], bl
add eax, 1
jmp 0x432efc
mov esi, dword [ebp - 0x18]
jmp 0x432f27
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.00409070
mov bl, al
and bl, 1
jmp 0x432f44
sub esp, 4
mov dword [esp], esi
call fcn.004082e0
add esp, 4
jmp 0x432f54
jmp 0x432f56
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x432f67
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x432f6f
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x24]
xor edx, edx
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x437e40
mov dword [esp + 8], ecx
lea eax, [edx - 2]
mov dword [esp], eax
mov dword [esp + 4], 0x969a9401
mov edi, 0x45465adb
mov ebx, 0x3ab9a524
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edi - 0x45465ad7]
mov eax, edi
xor eax, ebp
or eax, ebx
not eax
add eax, eax
mov esi, eax
xor esi, edi
and eax, ebx
add eax, eax
sub eax, esi
mov esi, eax
xor esi, ebp
not eax
and eax, ebp
add eax, eax
sub eax, esi
add al, 0xb9
mov byte [esp + edi - 0x45465ad7], al
inc edi
dec ebx
cmp edi, 0x45465adf
jne 0x437e70
cmp edx, 2
je 0x437ecd
mov ebp, dword [esp + 4]
mov eax, dword [esp]
mov ebx, eax
sar ebx, 1
mov edi, ebp
not edi
test al, 2
mov esi, dword [esp + 0x28]
mov dword [esp + 0xc], edi
jne 0x437ed6
jmp 0x437f01
mov eax, dword [esp + 0x28]
jmp 0x437f67
dec ebx
mov ecx, dword [esp + 0x24]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp + 8], ecx
xor eax, esi
mov esi, eax
not esi
and esi, ebp
mov ecx, eax
and ecx, edi
imul ecx, esi
mov esi, eax
and esi, ebp
or eax, ebp
imul eax, esi
add eax, ecx
mov esi, eax
cmp edx, 4
mov edi, dword [esp + 8]
je 0x437f67
xor edx, edx
mov eax, esi
mov dword [esp], ebx
mov ecx, dword [esp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edi + edx*2]
xor esi, eax
mov eax, esi
not eax
and eax, ebp
mov ebx, esi
and ebx, ecx
imul ebx, eax
mov eax, esi
and eax, ebp
or esi, ebp
imul esi, eax
add esi, ebx
movzx eax, word [edi + edx*2 + 2]
xor eax, esi
mov esi, eax
not esi
and esi, ebp
mov ebx, eax
and ebx, ecx
imul ebx, esi
mov esi, eax
and esi, ebp
or eax, ebp
imul eax, esi
add eax, ebx
mov ebx, dword [esp]
add edx, 2
cmp ebx, edx
jne 0x437f20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437f70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 0xc], 0x111e1f24
mov word [esp + 0x10], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 5
xor cl, byte [esp + eax + 0xc]
add cl, 0xe7
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 6
jne 0x437f90
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x6c6d6e6f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0x68
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x64]
mov ebx, edx
and ebx, eax
add bl, bl
sub dl, bl
movzx edx, dl
add edx, eax
add dl, 0xf8
mov byte [esp + eax - 0x64], dl
inc eax
cmp eax, 0x6f
jne 0x437fd0
mov eax, dword [esp + 4]
mov edx, dword [0x44be30]
test edx, edx
je 0x438041
xor esi, esi
mov edi, dword [0x44be34]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xeb857808
je 0x438020
inc esi
cmp edx, esi
jne 0x438010
jmp 0x438041
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x438041
lea eax, [esp + 0x14]
push eax
push ecx
push 0xffffffffffffffff
push 0xc
push edx
push dword [0x44be38]
call fcn.0043c860
add esp, 0x18
test eax, eax
js 0x4380c0
mov ebp, dword [esp + 0x14]
mov dword [esp + 4], 0x6c6d6e6f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0x68
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x64]
mov ebx, edx
and ebx, eax
add bl, bl
sub dl, bl
movzx edx, dl
add edx, eax
add dl, 0xf8
mov byte [esp + eax - 0x64], dl
inc eax
cmp eax, 0x6f
jne 0x438070
mov eax, dword [esp + 4]
mov edx, dword [0x44be30]
test edx, edx
je 0x4380d3
xor esi, esi
mov edi, dword [0x44be34]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x8869e8e9
je 0x4380c7
inc esi
cmp edx, esi
jne 0x4380b0
jmp 0x4380d3
xor ebx, ebx
jmp 0x438161
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x43816b
mov dword [esp + 4], 0x6c6d6e6f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov edx, 0x68
nop
nop
nop
nop
movzx ecx, byte [esp + edx - 0x64]
mov ebx, ecx
and ebx, edx
add bl, bl
sub cl, bl
movzx ecx, cl
add ecx, edx
add cl, 0xf8
mov byte [esp + edx - 0x64], cl
inc edx
cmp edx, 0x6f
jne 0x4380f0
test eax, eax
setns bl
mov eax, dword [0x44be30]
test eax, eax
movzx ecx, byte [esp + 3]
je 0x43815f
mov edx, dword [esp + 4]
xor esi, esi
mov edi, dword [0x44be34]
nop
nop
cmp dword [edi + esi*8], 0x1b6183f2
je 0x438140
inc esi
cmp eax, esi
jne 0x438130
jmp 0x43815f
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x43815f
push ebp
push 4
push eax
push dword [0x44be38]
call fcn.0043c860
movzx ecx, byte [esp + 0x13]
add esp, 0x10
and bl, cl
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
lea esi, [esp + 0xc]
push eax
push 4
push esi
push 0x14
push ebp
push 0x14
push edx
push dword [0x44be38]
call fcn.0043c860
add esp, 0x20
mov ebp, dword [esp + 0x14]
cmp dword [esp + 0xc], 0
setne byte [esp + 3]
jmp 0x4380d3