joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402610
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402707
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402707
push ebx
call fcn.00408f50
add esp, 4
test eax, eax
je 0x40266a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402671
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402650
jmp 0x402673
mov esi, 0x1505
jmp 0x402673
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402707
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x4026a4
inc ebp
dec ebx
je 0x402705
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402705
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4026a0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408f50
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4026a0
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408f80
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4026a0
mov eax, dword [ecx + 0x10]
mov edi, dword [eax + edi*4]
jmp 0x402707
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402720
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x402807
test edx, edx
je 0x402807
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x40276a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402771
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402750
jmp 0x402773
mov esi, 0x1505
jmp 0x402773
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x402807
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x4027a4
inc ebx
dec ebp
je 0x402805
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402805
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4027a0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408f50
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4027a0
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408f80
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4027a0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402807
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x402d28
mov esi, edx
test edx, edx
je 0x402d28
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x402d28
push esi
call fcn.00408f50
add esp, 4
test eax, eax
je 0x402c7a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402c81
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402c60
jmp 0x402c83
mov ebp, 0x1505
jmp 0x402c83
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x402d30
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402cea
call fcn.00402e20
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x402d28
push ecx
call fcn.00408f50
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x402d9f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402d48
inc ebx
dec esi
je 0x402c9f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402ca4
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402d40
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00408f50
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402d40
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408f80
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402d40
mov eax, 0xffffffff
jmp 0x402d28
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402db8
inc ebx
dec esi
je 0x402ce5
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402cea
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402db0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00408f50
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402db0
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408f80
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402db0
jmp 0x402cea
Function at 0x4034d0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403686
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
movzx edi, si
shr esi, 0x10
test eax, eax
je 0x40367f
mov ecx, 0x5e6ea9af
mov ebx, eax
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebx
sub ebx, eax
jmp 0x40355c
add ebp, dword [esp + 0xc]
mov eax, edi
mov ecx, 0x80078071
mul ecx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mul ecx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 4]
mov ebx, 0x15b0
je 0x40367f
xor eax, eax
cmp ebx, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 4], ebx
jb 0x4035e6
mov eax, ebx
and eax, 0x1ff8
mov dword [esp], eax
mov edx, 7
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
add eax, edi
add esi, eax
movzx ecx, byte [ebp + 1]
add ecx, eax
add esi, ecx
movzx edi, byte [ebp + 2]
add edi, ecx
mov eax, esi
and eax, edi
xor esi, edi
movzx ecx, byte [ebp + 3]
add ecx, edi
movzx edi, byte [ebp + 4]
add edi, ecx
movzx ebx, byte [ebp + 5]
add ebx, edi
add ecx, esi
lea eax, [ecx + eax*2]
add eax, edi
add eax, ebx
movzx ecx, byte [ebp + 6]
add ecx, ebx
mov esi, eax
and esi, ecx
xor eax, ecx
movzx edi, byte [ebp + 7]
mov ebx, ecx
and ebx, edi
xor ecx, edi
lea edi, [ecx + ebx*2]
mov ebx, dword [esp + 4]
add eax, edi
lea esi, [eax + esi*2]
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x403580
mov eax, dword [esp]
mov ecx, ebx
sub ecx, eax
jbe 0x403524
mov dword [esp], eax
not eax
add eax, ebx
mov edx, ebx
and edx, 3
mov dword [esp + 0xc], ecx
je 0x403631
mov dword [esp + 8], eax
neg edx
xor eax, eax
mov ebx, ebp
nop
nop
nop
nop
movzx ecx, byte [ebx]
inc ebx
add edi, ecx
add esi, edi
dec eax
cmp edx, eax
jne 0x403610
mov ecx, dword [esp]
sub ecx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x403520
jmp 0x40363f
mov ebx, ebp
mov ecx, dword [esp]
cmp eax, 3
jb 0x403520
mov eax, dword [esp + 4]
sub eax, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx + edx]
add ecx, edi
add esi, ecx
movzx edi, byte [ebx + edx + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [ebx + edx + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [ebx + edx + 3]
add edi, ecx
add esi, edi
add edx, 4
cmp eax, edx
jne 0x403650
jmp 0x403520
shl esi, 0x10
or esi, edi
jmp 0x40368b
mov esi, 1
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4036a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4036ce
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40376c
not eax
test bl, 1
jne 0x4036d5
mov edx, ebx
cmp ebx, 1
jne 0x403706
jmp 0x40376a
xor eax, eax
jmp 0x40376c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x440a18]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x440a18]
cmp ebx, 1
je 0x40376a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x440a18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x440a18]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x440a18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x440a18]
add esi, 2
cmp edx, esi
jne 0x403710
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x4094e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409610
sub esp, 0x100
mov esi, esp
call fcn.0043aa40
test al, 1
jne 0x4094ff
jmp 0x4095d8
call fcn.00432530
test al, 1
jne 0x40950d
jmp 0x4095d1
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
setge al
test al, 1
jne 0x409536
jmp 0x4095cf
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
setge al
test al, 1
jne 0x409594
jmp 0x4095c9
call fcn.0040ab40
test al, 1
jne 0x40959f
jmp 0x4095c7
jmp 0x4095a1
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004095f0
add esp, 8
call fcn.0040d710
call fcn.0040c5f0
jmp 0x4095c5
jmp 0x4095c7
jmp 0x4095c9
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4095d1
call fcn.0043af50
jmp 0x4095d8
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40c600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x50], 0xdb2dd90d
mov dword [esp + 0x54], 0xe70fe51e
mov dword [esp + 0x58], 0xe316e114
mov dword [esp + 0x5c], 0xefd9ed0d
mov dword [esp + 0x60], 0xebdce9d5
mov dword [esp + 0x64], 0xf7d6f5c4
mov dword [esp + 0x68], 0xf32df1d8
mov dword [esp + 0x6c], 0xff08fd15
mov dword [esp + 0x70], 0xfb0df914
mov dword [esp + 0x74], 0x8775857b
mov dword [esp + 0x78], 0x835481a0
mov dword [esp + 0x7c], 0x8fae8d50
mov dword [esp + 0x80], 0x8bba89b9
mov dword [esp + 0x84], 0x97a695a2
mov dword [esp + 0x88], 0x93b291ab
mov dword [esp + 0x8c], 0x9f779d43
mov dword [esp + 0x90], 0x9ba4996e
mov dword [esp + 0x94], 0xa79da598
mov dword [esp + 0x98], 0xa35aa180
mov dword [esp + 0x9c], 0xaf92ad92
mov dword [esp + 0xa0], 0xab8aa981
mov dword [esp + 0xa4], 0xb746b575
mov dword [esp + 0xa8], 0xb346b140
mov dword [esp + 0xac], 0xbf61bd51
mov dword [esp + 0xb0], 0xbb58b955
mov dword [esp + 0xb4], 0x47af458f
mov dword [esp + 0xb8], 0x437541bc
mov dword [esp + 0xbc], 0x4f7d4d71
mov dword [esp + 0xc0], 0x4b7c4977
mov dword [esp + 0xc4], 0x57685567
mov dword [esp + 0xc8], 0x537a5170
mov dword [esp + 0xcc], 0x5f965d97
mov dword [esp + 0xd0], 0x5b8f5984
mov dword [esp + 0xd4], 0x675265b0
mov dword [esp + 0xd8], 0x63966140
mov dword [esp + 0xdc], 0x6f856d85
mov dword [esp + 0xe0], 0x6b4a6985
mov dword [esp + 0xe4], 0x779b75bb
mov dword [esp + 0xe8], 0x73997193
mov dword [esp + 0xec], 0x7f577d8b
mov dword [esp + 0xf0], 0x7bb97958
mov dword [esp + 0xf4], 0x7f405ec
mov dword [esp + 0xf8], 0x3f701f7
mov dword [esp + 0xfc], 0xf390de1
mov dword [esp + 0x100], 0xb3b0939
mov dword [esp + 0x104], 0x1720152d
mov dword [esp + 0x108], 0x13241120
mov dword [esp + 0x10c], 0x1f281d2c
mov dword [esp + 0x110], 0x1b3a1928
mov dword [esp + 0x114], 0x27c725f7
mov dword [esp + 0x118], 0x23c321ce
mov dword [esp + 0x11c], 0x2fc72dde
mov dword [esp + 0x120], 0x2b17291f
mov dword [esp + 0x124], 0x37093507
mov dword [esp + 0x128], 0x33013106
mov dword [esp + 0x12c], 0x3f3e3d02
mov ebx, dword [ebp + 8]
mov eax, dword [0x44990c]
mov esi, 0x854c0c1c
movzx edx, byte [esp + esi + 0x7ab3f434]
mov ecx, esi
and ecx, edx
add ecx, ecx
sub edx, ecx
add edx, esi
mov dword [esp + 8], edx
mov ecx, dword [esp + 8]
add cl, 0x3c
mov byte [esp + esi + 0x7ab3f434], cl
movzx ecx, byte [esp + esi + 0x7ab3f435]
lea edx, [esi + 1]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, esi
inc ecx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
add cl, 0x3c
mov byte [esp + esi + 0x7ab3f435], cl
add esi, 2
cmp esi, 0x854c0cfc
jne 0x40c860
lea ecx, [esp + 0x50]
push 0
push 0
push 0
push 0
mov edi, ecx
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x443fd8]
Function at 0x41ed10
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x108
mov dword [esp], 0xb30eb155
mov dword [esp + 4], 0xb715b52b
mov dword [esp + 8], 0xab36a909
mov dword [esp + 0xc], 0xaf3ead6d
mov dword [esp + 0x10], 0xa366a130
mov dword [esp + 0x14], 0xa732a505
mov dword [esp + 0x18], 0x9b7f9939
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x9d9c
mov byte [esp + 0x20], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
lea esi, [ecx + 0x1ef1a4c8]
lea edi, [ecx + edx]
add edi, 0x1ef1a4c8
and esi, edx
add esi, esi
sub edi, esi
mov dword [esp + 0x98], edi
mov edx, dword [esp + 0x98]
add dl, 0x88
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x21
jb 0x41ed70
lea esi, [esp + 0xe6]
mov edx, esp
mov ecx, 7
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x102]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x58]
push edi
push 0
push 0
push 0xe
push esi
push 0
call dword [0x44ac50]
mov ebx, dword [esp + 0x58]
test ebx, ebx
jns 0x41edf7
mov eax, 0xffffffff
jmp 0x41edfa
lea eax, [ebx + ebx]
push eax
call fcn.00408e20
add esp, 4
push edi
push ebx
mov ebx, eax
push eax
push 0xe
push esi
push 0
call dword [0x44ac50]
mov dword [esp], 0x538051f2
mov dword [esp + 4], 0x5ff15df1
mov dword [esp + 8], 0x5bfb59eb
mov dword [esp + 0xc], 0x278b25f3
mov dword [esp + 0x10], 0x2320219b
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x17], 0
mov ecx, 0x32f3dfb3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x32f3dfb3]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov dword [esp + 0x98], edx
mov edx, dword [esp + 0x98]
add dl, 0x1b
mov byte [esp + ecx - 0x32f3dfb3], dl
cmp ecx, 0x32f3dfcd
je 0x41eec3
movzx edx, byte [esp + ecx - 0x32f3dfb2]
lea esi, [ecx + 1]
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
inc edx
mov dword [esp + 0x98], edx
mov edx, dword [esp + 0x98]
add dl, 0x1b
mov byte [esp + ecx - 0x32f3dfb2], dl
add ecx, 2
jmp 0x41ee60
lea edi, [esp + 0x84]
mov edx, esp
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x58]
mov ecx, eax
add ecx, 9
jns 0x41eef7
mov eax, 0xffffffff
jmp 0x41eefc
add eax, eax
add eax, 0x12
push eax
call fcn.00408e20
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41ef31
lea edx, [ebx + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ef20
mov word [eax], 0
movzx ecx, word [esp + 0x84]
test cx, cx
je 0x41ef61
lea edx, [esp + 0x86]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ef50
mov word [eax], 0
lea eax, [esp + 0x80]
push eax
push esi
call fcn.0043e2d0
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x78], ebx
jmp dword [eax*4 + 0x446058]
Function at 0x42e5a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
call fcn.00409610
push eax
mov dword [esi + 0x10], esp
jmp 0x42e5b9
push eax
mov dword [esi + 4], esp
call fcn.00409610
push eax
mov dword [esi + 0x28], esp
jmp 0x42e5c8
push eax
mov eax, esp
push eax
mov dword [esi + 0xc], esp
jmp 0x42e5d1
mov dword [esi + 0x14], eax
call fcn.00409610
push eax
mov edi, esp
sub esp, 0x18
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
jmp 0x42e5e8
push eax
mov dword [esi + 0x24], esp
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov byte [eax], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
je 0x42e753
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 0x28]
mov dword [ecx], eax
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
mov eax, ecx
cmp dword [eax], 0
je 0x42e743
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0xc]
mov dword [ecx], eax
mov eax, ecx
jmp 0x42e66b
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.0041b0f0
add esp, 4
mov dword [edi], eax
cmp dword [edi], 0
je 0x42e732
mov eax, dword [esi + 0x10]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov eax, dword [edi]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x24]
mov al, byte [eax]
mov byte [esi + 8], al
mov byte [ebx], 0xd3
mov byte [ebx + 1], 0xf9
mov byte [ebx + 2], 0xf3
mov byte [ebx + 3], 0xfb
mov byte [ebx + 4], 0xf6
mov byte [ebx + 5], 0xfa
mov byte [ebx + 6], 0xc7
mov byte [ebx + 7], 0xe9
mov byte [ebx + 8], 0xf8
mov byte [ebx + 9], 0xb7
mov byte [ebx + 0xa], 0xee
mov byte [ebx + 0xb], 0xeb
mov byte [ebx + 0xc], 0xec
mov byte [ebx + 0xd], 0x61
mov dword [ebx + 0xe], 0
xor edx, edx
movzx ecx, byte [ebx + edx]
mov edi, edx
add edi, 0x623eb592
lea eax, [edx + ecx + 0x623eb592]
and edi, ecx
add edi, edi
sub eax, edi
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x2c]
add al, 2
mov byte [ebx + edx], al
add edx, 1
cmp edx, 0x12
jne 0x42e6e3
sub esp, 0xc
mov ecx, dword [esi + 0x18]
mov dword [esp], ebx
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 8], eax
call fcn.00409820
and al, 1
mov ecx, dword [esi + 4]
mov byte [ecx], al
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42e745
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42e74d
jmp 0x42e74f
jmp 0x42e751
jmp 0x42e753
mov eax, dword [esi + 4]
mov al, byte [eax]
jmp 0x42e75a
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435370
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edx, 0xfffffffe
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x435380
test edx, edx
je 0x4353fa
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0x4353b2
nop
nop
nop
nop
nop
dec edx
movzx ebx, word [ecx]
add ecx, 2
xor ebx, eax
imul eax, ebx, 0x1000193
dec edi
jne 0x4353a0
cmp esi, 3
jb 0x4353fa
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0x4353c0
pop esi
pop edi
pop ebx
ret
Function at 0x43d410
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
mov dword [esp + 8], 0xc3c21b0d
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
mov esi, ecx
or esi, 0xe1a24c20
lea edi, [esi + edx]
and esi, edx
add esi, esi
sub edi, esi
mov dword [esp + 4], edi
mov edx, dword [esp + 4]
add dl, 0x20
mov byte [esp + ecx + 8], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x10
jb case.default.0x43d48e
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
jmp dword [ecx*4 + 0x44974c]
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + edx]
mov dword [esp + 8], 0x5b5a8488
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
mov ecx, 0x41c964b5
nop
movzx esi, byte [esp + ecx - 0x41c964ad]
lea edi, [ecx - 1]
and edi, esi
add edi, edi
sub esi, edi
add esi, ecx
dec esi
mov dword [esp + 4], esi
mov ebx, dword [esp + 4]
add bl, 0x14
mov byte [esp + ecx - 0x41c964ad], bl
movzx esi, byte [esp + ecx - 0x41c964ac]
mov edi, ecx
and edi, esi
add edi, edi
sub esi, edi
add esi, ecx
mov dword [esp + 4], esi
mov ebx, dword [esp + 4]
add bl, 0x14
mov byte [esp + ecx - 0x41c964ac], bl
add ecx, 2
cmp ecx, 0x41c964c3
jne 0x43d4c0
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor eax, eax
mov edi, dword [ebp + 8]
jmp dword [ecx*4 + 0x449764]
mov esi, dword [edi + edx + 0x7c]
xor ecx, ecx
mov dword [esp + 0x28], esi
test esi, esi
sete cl
jmp dword [ecx*4 + 0x44976c]
mov ebx, dword [edi + edx + 0x78]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x34], ebx
jmp dword [ecx*4 + 0x449774]
mov eax, dword [edi + ebx + 0x20]
add eax, edi
mov dword [esp + 0x30], eax
mov eax, dword [edi + ebx + 0x24]
add eax, edi
mov dword [esp + 0x24], eax
mov eax, dword [edi + ebx + 0x1c]
add eax, edi
mov dword [esp + 0x20], eax
mov eax, dword [edi + ebx + 0x18]
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x2c], eax
cmp edx, eax
setb cl
mov esi, dword [0x449790]
mov dword [esp + 0x18], 2
jmp dword [ecx*4 + 0x44977c]
mov eax, dword [esp + 0x30]
mov eax, dword [eax + edx*4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp esi
mov ecx, dword [case.0x43d48e.4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp dword [esp + 0x18], 2
sete cl
jmp dword [ecx*4 + 0x4497cc]