joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb031a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0xb032a8
mov esi, edx
test edx, edx
je 0xb032a8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0xb032a8
push esi
call fcn.00b093d0
add esp, 4
test eax, eax
je 0xb031fa
xor edi, edi
mov ecx, 0x1505
movzx edx, byte [esi + edi]
test edx, edx
je 0xb03201
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0xb031e0
jmp 0xb03203
mov ebp, 0x1505
jmp 0xb03203
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0xb032b0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0xb0326a
call fcn.00b033a0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0xb032a8
push ecx
call fcn.00b093d0
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0xb0331f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0xb032c8
inc ebx
dec esi
je 0xb0321f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0xb03224
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0xb032c0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00b093d0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0xb032c0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00b093f0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0xb032c0
mov eax, 0xffffffff
jmp 0xb032a8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0xb03338
inc ebx
dec esi
je 0xb03265
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0xb0326a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0xb03330
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00b093d0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0xb03330
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00b093f0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0xb03330
jmp 0xb0326a
Function at 0xb03af0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0xb03cb6
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0xb03caf
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0xb03b8b
add ebp, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul esi, edx, 0xfff1
mov eax, ecx
mov edx, 0x80078071
mul edx
sub edi, esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov eax, ebx
not eax
mov edx, dword [esp + 4]
and eax, edx
not edx
and ebx, edx
mov esi, 0x15b0
sub ebx, eax
je 0xb03caf
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0xb03c0d
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0xb03bb0
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
jbe 0xb03b48
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
je 0xb03c63
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0xb03c40
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0xb03b40
jmp 0xb03c75
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0xb03b40
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0xb03c80
jmp 0xb03b40
shl ecx, 0x10
or ecx, edi
jmp 0xb03cbb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xb03cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0xb03d36
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0xb03d38
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebp, eax
shr ebp, 4
xor eax, edi
and eax, 0xf
mov ebx, dword [eax*4 + 0xb41a18]
mov eax, ebx
and eax, ebp
add eax, eax
sub ebx, eax
add ebx, ebp
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
mov edi, dword [edi*4 + 0xb41a18]
mov ebx, eax
and ebx, edi
add eax, edi
add ebx, ebx
sub eax, ebx
inc esi
cmp edx, esi
jne 0xb03cf0
not eax
jmp 0xb03d38
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xb09910
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x158
call fcn.00b3c010
test al, 1
jne 0xb0992b
jmp 0xb09ae0
mov al, byte [esp + 0x28]
mov byte [esp + 0x2c], al
mov byte [esp + 0x30], 0xc6
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0xf7
mov byte [esp + 0x33], 0x63
mov byte [esp + 0x34], 0xc7
mov byte [esp + 0x35], 0x65
mov byte [esp + 0x36], 0xcd
mov byte [esp + 0x37], 0x67
mov byte [esp + 0x38], 0xc7
mov byte [esp + 0x39], 0x69
mov byte [esp + 0x3a], 0xcc
mov byte [esp + 0x3b], 0x6b
mov byte [esp + 0x3c], 0xca
mov byte [esp + 0x3d], 0x6d
mov byte [esp + 0x3e], 0x6e
mov byte [esp + 0x3f], 0x6f
lea eax, [esp + 0x30]
add eax, 0x10
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 3
call fcn.00b09330
xor eax, eax
movzx ecx, byte [esp + eax + 0x30]
mov edx, eax
add edx, 0xda01f310
lea esi, [eax + ecx - 0x25fe0cf0]
and edx, ecx
add edx, edx
sub esi, edx
mov dword [esp + 0x50], esi
mov ecx, dword [esp + 0x50]
add cl, 0x90
mov byte [esp + eax + 0x30], cl
add eax, 1
cmp eax, 0x13
jne 0xb099a6
xor eax, eax
lea eax, [esp + 0x30]
mov dword [esp], 0
mov dword [esp + 4], 1
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
sub esp, 0xc
mov dword [esp + 0x4c], eax
call fcn.00b32980
test al, 1
jne 0xb09a0b
jmp 0xb09ac0
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 8
cmp eax, 0
setge al
test al, 1
jne 0xb09a34
jmp 0xb09abe
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
sub esp, 0x24
cmp eax, 0
jl 0xb09ab8
call fcn.00b0b020
test al, 1
jne 0xb09a96
jmp 0xb09ab6
lea eax, [esp + 0x54]
lea ecx, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00b09af0
call fcn.00b0d440
call fcn.00b0c6c0
jmp 0xb09ab8
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0xb09ac0
cmp dword [esp + 0x4c], 0
je 0xb09ad9
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0xb09ad9
call fcn.00b3c370
jmp 0xb09ae0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0xb17040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0xb17060
sar esi, 1
lea edi, [esp + 0x74]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0xb4b5b0]
mov ebx, dword [esp + 0x74]
test ebx, ebx
jns 0xb1708f
mov eax, 0xffffffff
jmp 0xb17092
lea eax, [ebx + ebx]
push eax
call fcn.00b092b0
add esp, 4
push edi
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0xb4b5b0]
mov dword [esp + 8], 0xfb04f92a
mov dword [esp + 0xc], 0xff69fd19
mov dword [esp + 0x10], 0xf3d0f16a
mov dword [esp + 0x14], 0xf713f504
mov dword [esp + 0x18], 0xeb7de964
mov dword [esp + 0x1c], 0xef7ded71
mov dword [esp + 0x20], 0xe3e0e170
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
mov word [esp + 0x28], 0
mov ecx, 0xd2e5ed9f
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x2d1a1269]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x90]
add dl, 0xa7
mov byte [esp + ecx + 0x2d1a1269], dl
movzx edx, byte [esp + ecx + 0x2d1a126a]
lea esi, [ecx + 1]
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
inc edx
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x90]
add dl, 0xa7
mov byte [esp + ecx + 0x2d1a126a], dl
add ecx, 2
cmp ecx, 0xd2e5edc1
jne 0xb17100
lea edi, [esp + 0xb8]
lea edx, [esp + 8]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x74]
mov ecx, eax
add ecx, 0xd
mov dword [esp + 0x58], ebx
jns 0xb1719b
mov eax, 0xffffffff
jmp 0xb171a0
add eax, eax
add eax, 0x1a
push eax
call fcn.00b092b0
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x58]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0xb171e1
mov eax, dword [esp + 0x58]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xb171d0
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0xb17211
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xb17200
mov word [eax], 0
lea eax, [esp + 0x60]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00b3ef00
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0xb45ca0]

Function at 0xb184b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
xor ebx, ebx
mov dword [esp + 0x54], 0
mov dword [esp + 4], 0
jmp dword [eax*4 + 0xb45dd0]
Function at 0xb20160
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov dword [esp + 8], 0xb4b0d61
mov dword [esp + 0xc], 0x17a609b8
mov dword [esp + 0x10], 0x13b31558
mov dword [esp + 0x14], 0x1fbf11ac
mov dword [esp + 0x18], 0x1bbe1d71
mov dword [esp + 0x1c], 0x67ce1944
mov dword [esp + 0x20], 0x63d065d9
mov dword [esp + 0x24], 0x6fc361cc
mov dword [esp + 0x28], 0x6bc46dd2
mov dword [esp + 0x2c], 0x77c869c1
mov dword [esp + 0x30], 0x73d675d8
mov dword [esp + 0x34], 0x7fc07120
mov dword [esp + 0x38], 0x7bd07dcf
mov dword [esp + 0x3c], 0x47f279d1
mov dword [esp + 0x40], 0x43fd45e9
lea eax, [esp + 0x44]
mov word [esp + 0x44], 0x4140
mov dword [esp + 0x46], 0
mov dword [esp + 0x4a], 0
mov word [esp + 0x4e], 0
xor ecx, ecx
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
lea esi, [ecx - 0x738bf5d6]
lea edi, [ecx + edx]
add edi, 0x8c740a2a
and esi, edx
add esi, esi
sub edi, esi
mov dword [esp + 0x54], edi
mov edx, dword [esp + 0x54]
add dl, 0xda
mov byte [esp + ecx + 8], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x48
jb 0xb20210
lea ebx, [esp + 0x54]
lea edx, [esp + 8]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x90]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0xb4b5b0]
mov edi, dword [esp + 4]
test edi, edi
jns 0xb20292
mov eax, 0xffffffff
jmp 0xb20295
lea eax, [edi + edi]
push eax
call fcn.00b092b0
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0xb4b5b0]
mov dword [esp + 8], 0x235a2d78
mov dword [esp + 0xc], 0x27542155
mov dword [esp + 0x10], 0x3b5f2540
mov dword [esp + 0x14], 0x3f58394e
mov dword [esp + 0x18], 0x33443d45
mov dword [esp + 0x1c], 0x37363154
mov byte [esp + 0x20], 0
mov eax, 0x4382bca6
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x4382bc9e]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x76
mov byte [esp + eax - 0x4382bc9e], cl
cmp eax, 0x4382bcbe
je 0xb20342
movzx ecx, byte [esp + eax - 0x4382bc9d]
lea edx, [eax + 1]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
inc ecx
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x76
mov byte [esp + eax - 0x4382bc9d], cl
add eax, 2
jmp 0xb202f0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push esi
push dword [ebp + 8]
call fcn.00b19bf0
add esp, 0x14
mov ebx, eax
jmp dword [0xb46a90]
Function at 0xb2fdd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
call fcn.00b1c6c0
push eax
mov ecx, esp
push eax
mov eax, esp
push eax
mov ebx, esp
push eax
mov dword [esi + 0xc], esp
push eax
mov dword [esi + 8], esp
push eax
mov dword [esi + 0x24], esp
sub esp, 0x18
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov dword [esi + 0x20], esp
mov dword [esi + 0x28], ecx
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov dword [esi + 0x10], eax
mov byte [eax], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
test al, 1
jne 0xb2fe35
jmp 0xb2ffa2
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebx], eax
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, dword [esi + 0xc]
mov dword [ebx], eax
mov eax, dword [ebx]
jmp 0xb2fe6a
cmp eax, 0
setne al
test al, 1
jne 0xb2fe79
jmp 0xb2ff98
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 8]
mov dword [ecx], eax
mov eax, ecx
mov eax, dword [eax]
jmp 0xb2fe92
sub esp, 4
mov dword [esp], eax
call fcn.00b093d0
add esp, 4
mov ecx, dword [esi + 0x24]
mov dword [ecx], eax
cmp dword [ecx], 0
setne al
test al, 1
jne 0xb2feb4
jmp 0xb2ff88
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [ecx]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
mov al, byte [eax]
mov byte [esi + 4], al
mov byte [edi], 0x93
mov byte [edi + 1], 0xc9
mov byte [edi + 2], 0xcb
mov byte [edi + 3], 0xdb
mov byte [edi + 4], 0xac
mov byte [edi + 5], 0xd8
mov byte [edi + 6], 0xaf
mov byte [edi + 7], 0xd9
mov byte [edi + 8], 0xaa
mov byte [edi + 9], 0x9f
mov byte [edi + 0xa], 0xd8
mov byte [edi + 0xb], 0xcb
mov byte [edi + 0xc], 0xd6
mov byte [edi + 0xd], 0x41
mov eax, edi
add eax, 0xe
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 6
call fcn.00b09330
add esp, 0xc
xor eax, eax
movzx ecx, byte [edi + eax]
mov edx, eax
add edx, 0x29298e0d
lea ebx, [eax + ecx + 0x29298e0d]
and edx, ecx
add edx, edx
sub ebx, edx
mov dword [esi + 0x2c], ebx
mov ecx, dword [esi + 0x2c]
add cl, 0xa5
mov byte [edi + eax], cl
add eax, 1
cmp eax, 0x14
jne 0xb2ff2f
sub esp, 0xc
mov ecx, dword [esi + 0x14]
mov dword [esp], edi
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 8], eax
call fcn.00b09d10
and al, 1
jmp 0xb2ff7c
mov ecx, dword [esi + 0x10]
mov byte [ecx], al
mov ebx, dword [esi + 0xc]
jmp 0xb2ff86
jmp 0xb2ff88
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0xb2ff98
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0xb2ffa0
jmp 0xb2ffa2
mov eax, dword [esi + 0x10]
mov al, byte [eax]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xb36790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
xor edx, edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0xb367a0
lea esi, [ecx + edx]
add esi, 0xfffffffe
mov edx, ecx
not edx
and edx, esi
xor esi, ecx
add edx, edx
sub edx, esi
je 0xb3682a
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0xb367e2
nop
nop
nop
nop
nop
nop
dec edx
movzx ebx, word [ecx]
add ecx, 2
xor ebx, eax
imul eax, ebx, 0x1000193
dec edi
jne 0xb367d0
cmp esi, 3
jb 0xb3682a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0xb367f0
pop esi
pop edi
pop ebx
ret
Function at 0xb3c010
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x9b06990e
mov dword [esp + 0xc], 0x87128528
mov dword [esp + 0x10], 0x83548114
mov dword [esp + 0x14], 0x8f1a8d20
mov dword [esp + 0x18], 0x8b8a891c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x24], 0
mov eax, 0xfe2ebcec
nop
nop
nop
movzx ecx, byte [esp + eax + 0x1d1431c]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x8c
mov byte [esp + eax + 0x1d1431c], cl
cmp eax, 0xfe2ebd08
je 0xb3c0b6
movzx ecx, byte [esp + eax + 0x1d1431d]
lea edx, [eax + 1]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
inc ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x8c
mov byte [esp + eax + 0x1d1431d], cl
add eax, 2
jmp 0xb3c060
lea esi, [esp + 8]
push esi
call fcn.00b3db20
add esp, 4
mov ecx, eax
mov dword [0xb535cc], eax
xor edx, edx
test eax, eax
sete dl
xor eax, eax
jmp dword [edx*4 + 0xb49254]
Function at 0xb3ef00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + edi + 2], 0
lea edi, [edi + 2]
jne 0xb3ef20
sar edi, 1
lea ebx, [edi + 4]
mov ecx, edi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0xb3ef45
mov eax, 0xffffffff
jmp 0xb3ef47
add eax, eax
push eax
call fcn.00b092b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ecx, word [esi]
test cx, cx
je 0xb3ef91
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0xb3ef80
mov word [edx], 0
mov edx, ebx
and edx, 0xfffd
and edi, 2
mov ecx, edi
xor ecx, 2
imul ecx, edx
or ebx, 2
imul ebx, edi
lea edx, [ebx + ecx]
mov word [esp + 0x1c], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0x1e], cx
mov esi, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x12111017
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov eax, 0x9bb1edd3
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x644e1235]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x3b
mov byte [esp + eax + 0x644e1235], cl
movzx ecx, byte [esp + eax + 0x644e1236]
lea edx, [eax + 1]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
inc ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x3b
mov byte [esp + eax + 0x644e1236], cl
add eax, 2
cmp eax, 0x9bb1ede3
jne 0xb3f020
mov edi, dword [esp + 8]
mov eax, dword [0xb4b5b4]
test eax, eax
je 0xb3f0d1
xor ecx, ecx
mov edx, dword [0xb4b5b8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcd669f2f
je 0xb3f0a0
inc ecx
cmp eax, ecx
jne 0xb3f090
jmp 0xb3f0d1
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0xb3f0d1
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0xb4b5bc]
push eax
call fcn.00b3c4d0
add esp, 0x24
mov edi, eax
push esi
call fcn.00b092c0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret