joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov al, byte [ebp + 8]
mov edi, eax
cmp dword [ebp + 0x14], 0
setl bl
jmp 0x40dae7
call fcn.0040dca0
mov ecx, dword [ebp + 0x14]
mov eax, ecx
sub eax, 1
sete al
or bl, al
jmp 0x40dafb
cmp ecx, 0x24
setg bh
jmp 0x40db03
call fcn.0040dca0
or bl, bh
jmp 0x40db0c
test bl, 1
jne 0x40db13
jmp 0x40db18
jmp 0x40dc92
mov eax, edi
movzx edx, al
mov ecx, 0x84e2f9ea
sub ecx, edx
add ecx, 0x7b1d0616
mov ecx, dword [ebp + 0x14]
jmp 0x40db2f
add esi, dword [ebp + 0x10]
jmp 0x40db34
mov edi, esi
add edi, 0xffffffff
mov byte [esi - 1], 0
cmp edx, 0
jne 0x40db50
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x40dc92
cmp ecx, 0xa
sete dl
test dl, 1
jne 0x40db60
jmp 0x40dc07
jmp 0x40db62
movzx ecx, al
cmp ecx, 0x64
setae al
test al, 1
jne 0x40db71
jmp 0x40dba9
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
shl edx, 1
mov al, byte [edx + 0x447761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x447760]
add esi, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
mov edi, esi
jmp 0x40db62
cmp ecx, 0xa
jae 0x40dbbf
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40dc02
mov edx, ecx
and edx, 0xfffffffd
mov eax, ecx
or eax, 0xfffffffd
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 2
or ecx, 2
imul ecx, edx
add ecx, eax
lea eax, [0x447760]
add eax, ecx
mov cl, byte [ecx + 0x447761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], cl
jmp 0x40dbf5
mov al, byte [eax]
jmp 0x40dbf9
jmp 0x40dbfb
add esi, 0xffffffff
mov byte [esi], al
jmp 0x40dc02
jmp 0x40dc92
cmp ecx, 0x10
sete cl
test cl, 1
jne 0x40dc16
jmp 0x40dc14
jmp 0x40dc5b
movzx eax, al
cmp eax, 0x10
setl cl
test cl, 1
jne 0x40dc26
jmp 0x40dc37
mov al, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40dc92
shl eax, 1
lea ecx, str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF
add ecx, eax
mov al, byte [eax + 0x44782a]
add edi, 0xffffffff
jmp 0x40dc4d
mov byte [edi], al
mov al, byte [ecx]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40dc92
movzx ecx, al
cmp ecx, 0
seta al
test al, 1
jne 0x40dc6a
jmp 0x40dc8e
mov eax, ecx
xor edx, edx
mov esi, dword [ebp + 0x14]
mov ebx, esi
div ebx
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebx
mov edi, esi
jmp 0x40dc5b
mov esi, edi
jmp 0x40dc92
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40dcb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x19c
mov eax, dword [0x44f950]
mov dword [esp + 0x11c], 0x3020900
mov word [esp + 0x120], 0
xor ecx, ecx
xor byte [esp + ecx + 0x11c], cl
nop
nop
nop
inc ecx
cmp ecx, 6
je 0x40dcef
xor byte [esp + ecx + 0x11c], cl
jmp 0x40dce0
mov ecx, dword [esp + 0x11c]
mov dword [esp + 0x1c], 0x29452bbd
mov dword [esp + 0x20], 0x2d462fba
mov dword [esp + 0x24], 0x51c653b8
mov dword [esp + 0x28], 0x550457c0
mov dword [esp + 0x2c], 0x59365b30
mov dword [esp + 0x30], 0x5d5e5f34
mov dword [esp + 0x34], 0
mov edx, 0x8038cbb7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x7fc73465]
xor esi, edx
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
add bl, 0x6c
mov byte [esp + edx + 0x7fc73465], bl
inc edx
cmp edx, 0x8038cbd3
jne 0x40dd40
lea edx, [esp + 0x1c]
push ecx
push 0
push edx
call eax
mov ecx, 0x44f918
push eax
call fcn.00440790
movzx eax, al
mov eax, dword [eax*4 + 0x449a34]
mov ecx, 0x1a0b389c
xor ecx, dword [0x449a3c]
add eax, ecx
inc eax
jmp eax
Function at 0x40f120
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44f92c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f1ce
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449e54]
xor eax, eax
jmp 0x40f5f5
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4103e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0xf96bfb0f
mov dword [esp + 0x40], 0xe571e77e
mov dword [esp + 0x44], 0xe176e370
mov dword [esp + 0x48], 0xed3fef0f
mov dword [esp + 0x4c], 0xe938eb37
mov dword [esp + 0x50], 0x95b69738
mov dword [esp + 0x54], 0x916b93bc
mov dword [esp + 0x58], 0x9d0c9f07
mov dword [esp + 0x5c], 0x990b9b70
mov dword [esp + 0x60], 0x851b8701
mov dword [esp + 0x64], 0x817083a4
mov dword [esp + 0x68], 0x8dae8f7c
mov dword [esp + 0x6c], 0x895a8b53
mov dword [esp + 0x70], 0xb566b75a
mov dword [esp + 0x74], 0xb192b371
mov dword [esp + 0x78], 0xbd29bf49
mov dword [esp + 0x7c], 0xb960bb2e
mov dword [esp + 0x80], 0xa563a764
mov dword [esp + 0x84], 0xa13aa384
mov dword [esp + 0x88], 0xad72af7a
mov dword [esp + 0x8c], 0xa98aab7b
mov dword [esp + 0x90], 0x55c65767
mov dword [esp + 0x94], 0x51c653c4
mov dword [esp + 0x98], 0x5da75fbb
mov dword [esp + 0x9c], 0x59b45bb7
mov dword [esp + 0xa0], 0x45d147ad
mov dword [esp + 0xa4], 0x419343d8
mov dword [esp + 0xa8], 0x4d934f9b
mov dword [esp + 0xac], 0x49984b95
mov dword [esp + 0xb0], 0x75ac7795
mov dword [esp + 0xb4], 0x715a7354
mov dword [esp + 0xb8], 0x7db67f85
mov dword [esp + 0xbc], 0x79897b80
mov dword [esp + 0xc0], 0x65b2678c
mov dword [esp + 0xc4], 0x61f66344
mov dword [esp + 0xc8], 0x6dfb6ff7
mov dword [esp + 0xcc], 0x694a6b87
mov dword [esp + 0xd0], 0x15fd17a1
mov dword [esp + 0xd4], 0x118713f9
mov dword [esp + 0xd8], 0x1dc91f81
mov dword [esp + 0xdc], 0x19d71b3c
mov dword [esp + 0xe0], 0x59807f0
mov dword [esp + 0xe4], 0x1910395
mov dword [esp + 0xe8], 0xddf0feb
mov dword [esp + 0xec], 0x9d50bd3
mov dword [esp + 0xf0], 0x35e437cf
mov dword [esp + 0xf4], 0x31e033e4
mov dword [esp + 0xf8], 0x3dec3fe0
mov dword [esp + 0xfc], 0x391a3bec
mov dword [esp + 0x100], 0x25c927c5
mov dword [esp + 0x104], 0x21cd23ce
mov dword [esp + 0x108], 0x2db92fbe
mov dword [esp + 0x10c], 0x29f12bfd
mov dword [esp + 0x110], 0xd50fd7f5
mov dword [esp + 0x114], 0xd10fd306
mov dword [esp + 0x118], 0xdddedf0a
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov eax, dword [0x44f920]
mov ecx, 0x69930125
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x699300e9]
lea esi, [ecx - 0x6993007a]
and esi, edi
mov ebx, esi
and ebx, 2
mov ebp, esi
or ebp, 0xfffffffd
inc ebp
mov edx, esi
and edx, 0xfffffffd
imul edx, ebp
or esi, 2
imul esi, ebx
add edx, edi
sub edx, esi
add edx, ecx
mov esi, edx
xor esi, 0xd2
and edx, 0x2d
add edx, edx
sub edx, esi
inc dl
mov byte [esp + ecx - 0x699300e9], dl
inc ecx
cmp ecx, 0x69930208
jne 0x410640
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x44a120]
mov ecx, 0xe29b0ba0
xor ecx, dword [0x44a128]
add eax, ecx
inc eax
jmp eax

Function at 0x410e40
Capabilities:
Authenticate hmac
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44aa24]
Function at 0x41e670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10c8
call fcn.0040c4f0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x41e690
lea edx, [eax + ecx]
add edx, 0xfffffffe
add ecx, eax
mov edi, 1
sub edi, ecx
and edi, eax
mov esi, eax
not esi
and esi, edx
sub esi, edi
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x450c64]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41e6dc
mov eax, 0xffffffff
jmp 0x41e6df
lea eax, [ebx + ebx]
push eax
call fcn.0040c590
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x450c64]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, 0xd
js 0x41e714
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c590
add esp, 4
mov esi, eax
mov dword [esp + 0xc4], 0x93269134
mov dword [esp + 0xc8], 0x9f0d9d3d
mov dword [esp + 0xcc], 0x9b7a9904
mov dword [esp + 0xd0], 0x872b853a
mov dword [esp + 0xd4], 0x83118112
mov dword [esp + 0xd8], 0x8f198d25
mov dword [esp + 0xdc], 0x8b8a891e
mov word [esp + 0xe0], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 8
mov edx, ecx
xor edx, 0xe4
add edx, edi
xor dl, byte [esp + ecx + 0xc4]
add dl, 0x8c
mov byte [esp + ecx + 0xc4], dl
inc ecx
add eax, 2
cmp ecx, 0x1e
jne 0x41e780
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x41e7d1
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e7c0
mov word [eax], 0
movzx ecx, word [esp + 0xc4]
test cx, cx
je 0x41e801
lea edx, [esp + 0xc6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e7f0
mov word [eax], 0
lea eax, [esp + 0x58]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x10], esi
push esi
call fcn.00444a10
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44bb2c]
Function at 0x425b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
lea eax, [esp + 0x2c]
push 0x4021
push 3
push 0x100001
push eax
push dword [esp + 0x64]
call fcn.00444a10
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c090]

Function at 0x428120
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [0x450c64]
mov dword [esp], 0x23e321c5
mov dword [esp + 4], 0x27962594
mov dword [esp + 8], 0x3b9b39fc
mov dword [esp + 0xc], 0x3f9f3d88
mov dword [esp + 0x10], 0x339e31d5
mov dword [esp + 0x14], 0x378e35e0
mov dword [esp + 0x18], 0xbb409bd
mov dword [esp + 0x1c], 0xfab0da8
mov dword [esp + 0x20], 0x3a001b2
mov dword [esp + 0x24], 0x7b405bd
mov dword [esp + 0x28], 0x1bb619bc
mov dword [esp + 0x2c], 0x1fac1dcc
mov dword [esp + 0x30], 0x13b411af
mov dword [esp + 0x34], 0x17aa15ad
mov dword [esp + 0x38], 0xeb59e94d
mov word [esp + 0x3c], 0xedec
mov dword [esp + 0x3e], 0
mov ecx, esp
mov edx, 0x4c2e9137
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx]
mov esi, edx
or esi, edi
lea ebx, [edx - 0x4c2e9100]
and ebx, edi
not esi
or esi, ebx
add esi, 0x7ce8d617
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x4c2e90f5
jne 0x4281c0
lea ebp, [esp + 0x44]
mov ebx, esp
push ebp
push 0
push 0
push 0x1e
push ebx
push 0
call eax
mov edi, dword [esp + 0x44]
test edi, edi
jns 0x428211
mov eax, 0xffffffff
jmp 0x428214
lea eax, [edi + edi]
push eax
call fcn.0040c590
add esp, 4
mov esi, eax
mov eax, dword [0x450c64]
mov dword [esp], 0x91dd9ffb
mov dword [esp + 4], 0x95029300
mov dword [esp + 8], 0x893597d0
mov dword [esp + 0xc], 0x8d298b1c
mov dword [esp + 0x10], 0x81228feb
mov dword [esp + 0x14], 0x851a8334
mov dword [esp + 0x18], 0xf9188713
mov dword [esp + 0x1c], 0xfd5dfb5c
mov dword [esp + 0x20], 0xf15cff6e
mov dword [esp + 0x24], 0xf560f36b
mov dword [esp + 0x28], 0xe95af750
mov dword [esp + 0x2c], 0xed78eb58
mov dword [esp + 0x30], 0xe148ef7d
mov dword [esp + 0x34], 0xe57ee37b
mov dword [esp + 0x38], 0xd973e743
mov word [esp + 0x3c], 0xdbd8
mov dword [esp + 0x3e], 0
mov byte [esp + 0x42], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xa5
xor dl, byte [esp + ecx]
add dl, 0xc7
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x43
jne 0x4282c0
push ebp
push edi
push esi
push 0x1e
push ebx
push 0
call eax
mov dword [esp], 0xb922bb70
mov dword [esp + 4], 0xbd2cbf33
mov dword [esp + 8], 0xb129b358
mov dword [esp + 0xc], 0xb550b726
mov dword [esp + 0x10], 0xa93cab2b
mov dword [esp + 0x14], 0xadaeaf4c
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov eax, 0xa1
mov ecx, 0x1f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
or edi, 0xcb
add edi, eax
mov edx, ecx
and edx, 0x34
or edx, edi
xor dl, byte [esp + ecx - 0x1f]
xor dl, 0xcb
add dl, 0x25
mov byte [esp + ecx - 0x1f], dl
dec eax
inc ecx
cmp ecx, 0x3a
jne 0x428330
push 0
push 0
push ebx
push esi
push dword [esp + 0x6c]
call fcn.00423b80
add esp, 0x14
jmp dword [0x44c68c]
Function at 0x42aab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x89068b01
mov dword [esp + 0x58], 0x85398733
mov dword [esp + 0x5c], 0x81708337
mov dword [esp + 0x60], 0x9d169f3b
mov dword [esp + 0x64], 0x999a9b27
mov dword [esp + 0x68], 0
mov eax, 0xb6c84ba6
mov ecx, 0x6d90974c
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xc6
mov edx, eax
xor edx, 0xe3
add edx, esi
add dl, 0x5a
xor dl, byte [esp + eax + 0x4937b4ae]
add dl, 0x91
mov byte [esp + eax + 0x4937b4ae], dl
inc eax
add ecx, 2
cmp eax, 0xb6c84bbe
jne 0x42ab20
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push eax
call fcn.0043f060
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44cd08]
Function at 0x435f50
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.0040dca0
sub esp, 0x10
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x435f89
jmp 0x436092
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x43608c
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x435fcf
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call fcn.0041dcf0
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x435ff2
jmp 0x43607b
mov cl, byte [edi]
mov byte [ebp - 0x10], cl
mov byte [esi], 0xcf
mov byte [esi + 1], 0x35
mov byte [esi + 2], 0x37
mov byte [esi + 3], 0x3f
mov byte [esi + 4], 0x2a
mov byte [esi + 5], 0x3e
mov byte [esi + 6], 0x23
mov byte [esi + 7], 0x35
mov byte [esi + 8], 0x24
mov byte [esi + 9], 0xf3
mov byte [esi + 0xa], 0x32
mov byte [esi + 0xb], 0xf
mov byte [esi + 0xc], 0x30
mov byte [esi + 0xd], 0x85
mov ecx, 0xe
mov byte [esi + ecx], 0
add ecx, 1
cmp ecx, 0x10
jne 0x436033
xor ecx, ecx
cmp ecx, 0x10
jae 0x43605b
mov dl, byte [esi + ecx]
mov dh, cl
add dh, 0x22
xor dh, dl
add dh, 0x56
mov byte [esi + ecx], dh
add ecx, 1
jmp 0x436041
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.0040cf90
mov bl, al
and bl, 1
jmp 0x43607b
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x43608c
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + edx + 2], 0
lea edx, [edx + 2]
jne 0x43b500
mov dword [esp], 0x121210a3
mov byte [esp + 4], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0xc4
xor cl, byte [esp + ebx]
add cl, 0x2c
mov byte [esp + ebx], cl
inc ebx
cmp ebx, 5
jne 0x43b520
test edx, edx
je 0x43b59e
mov ecx, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x43b561
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [esi]
add esi, 2
xor eax, ebp
imul eax, ecx
mov ebp, eax
dec ebx
jne 0x43b550
cmp edi, 3
jb 0x43b59e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [esi + edi*2]
xor ebx, eax
imul ebx, ecx
movzx eax, word [esi + edi*2 + 2]
xor eax, ebx
imul eax, ecx
movzx ebx, word [esi + edi*2 + 4]
xor ebx, eax
imul ebx, ecx
movzx eax, word [esi + edi*2 + 6]
xor eax, ebx
imul eax, ecx
add edi, 4
cmp edx, edi
jne 0x43b570
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43b880
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov edi, dword [ebp + 8]
mov eax, dword [0x450c64]
mov dword [esp + 0x44], eax
mov dword [esp + 8], 0x13c111ed
mov dword [esp + 0xc], 0xef5ded65
mov dword [esp + 0x10], 0xeb57e964
mov dword [esp + 0x14], 0xe73ae551
mov dword [esp + 0x18], 0xe35be152
mov dword [esp + 0x1c], 0xff43fd72
mov dword [esp + 0x20], 0xfbfaf905
mov word [esp + 0x24], 0
mov eax, 0x3216e97c
mov edx, 0xcde91683
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3216e974]
lea ebx, [ecx + ecx]
not ebx
add ebx, ecx
and ebx, 0x59
mov esi, ecx
not esi
or esi, 0xa6
add esi, ecx
inc esi
or esi, ebx
mov ecx, edx
and ecx, 0x8909042c
mov ebx, eax
and ebx, 0x101280d3
or ebx, ecx
mov ecx, ebx
xor ecx, 0xd3
xor ebx, 0x75
and ebx, ecx
mov ecx, eax
and ecx, 0xa6
or ecx, ebx
xor ecx, esi
add cl, 0x94
mov byte [esp + eax - 0x3216e974], cl
inc eax
dec edx
cmp eax, 0x3216e99a
jne 0x43b8f0
lea eax, [esp + 0x64]
lea esi, [esp + 0x94]
lea ebx, [esp + 8]
push eax
push 8
push esi
push 0xd
push ebx
push 0
call dword [esp + 0x5c]
shr eax, 0x1f
jmp dword [eax*4 + 0x44e44c]
Function at 0x43c3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, 0xffffffff
cmp byte [ebx + esi + 1], 0
lea esi, [esi + 1]
jne 0x43c3c0
mov eax, esi
not eax
mov ecx, esi
and ecx, 3
mov edi, esi
or edi, 3
imul edi, ecx
xor ecx, 3
mov edx, esi
and edx, 0xfffffffc
imul edx, ecx
add edi, edx
shr edi, 2
mov ecx, esi
mov dword [esp + 4], esi
and ecx, 0xfffffffe
and eax, 1
sub ecx, eax
movzx eax, byte [ebx + ecx]
cmp eax, 0x3d
je 0x43c407
cmp eax, 0x2e
jne 0x43c408
dec edi
mov eax, dword [esp + 4]
movzx eax, byte [ebx + eax - 2]
cmp eax, 0x3d
je 0x43c41b
cmp eax, 0x2e
jne 0x43c41c
dec edi
mov dword [esp + 8], edi
mov edx, 0
cmp dword [esp + 4], 0
je 0x43c515
xor esi, esi
mov ebp, 2
jmp 0x43c452
mov edx, ebx
nop
nop
nop
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov esi, edx
cmp ebp, edi
mov ebp, eax
jae 0x43c515
mov edi, dword [esp + 0x40]
movzx eax, byte [edi + ebp - 2]
push eax
call fcn.00422b40
add esp, 4
mov bh, al
movzx eax, byte [edi + ebp - 1]
mov edi, dword [esp + 4]
push eax
call fcn.00422b40
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea edx, [esi + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
cmp ebp, edi
jae 0x43c440
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 4], edx
call fcn.00422b40
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x43c440
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov edx, dword [esp + 0x44]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, edi
jae 0x43c439
mov ecx, dword [esp + 0x40]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov byte [esp + 4], al
call fcn.00422b40
add esp, 4
movzx ecx, byte [esp]
cmp al, 0x40
mov edx, ebx
je 0x43c440
shl cl, 6
mov edx, eax
xor dl, cl
and cl, al
add cl, cl
add cl, dl
mov eax, dword [esp + 0x44]
mov byte [eax + esi + 2], cl
add esi, 3
mov edx, esi
jmp 0x43c440
mov ebx, dword [esp + 8]
cmp edx, ebx
mov eax, 0
jne 0x43c5a5
mov esi, dword [esp + 0x44]
lea edx, [esi + 0x20]
lea edi, [esp + 0xc]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x43c5a1
cmp ebx, 0x21
je 0x43c58b
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x43c560
test bl, 1
je 0x43c5a1
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret