joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f50
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4040f6
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4040ef
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x403fe0
add ebp, dword [esp + 0x10]
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x4040ef
mov dword [esp], esi
xor edx, edx
cmp ebx, 8
jb 0x40404a
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [ebp]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebp + 7]
add edi, edx
add ecx, edi
mov esi, eax
and esi, 8
xor eax, 8
lea edx, [eax + esi*2]
add ebp, 8
lea esi, [eax + esi*2]
add esi, 7
mov eax, edx
cmp esi, ebx
jb 0x403ff0
mov eax, edx
sub eax, ebx
mov dword [esp + 4], ebx
jae 0x403fa4
sub ebx, edx
mov dword [esp + 0x10], ebx
and ebx, 3
mov dword [esp + 8], ebx
je 0x4040a0
mov dword [esp + 0xc], eax
neg dword [esp + 8]
xor esi, esi
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec esi
cmp dword [esp + 8], esi
jne 0x404080
sub edx, esi
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffffc
ja 0x403fa0
jmp 0x4040ab
mov ebx, ebp
cmp eax, 0xfffffffc
ja 0x403fa0
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x4040c0
jmp 0x403fa0
shl ecx, 0x10
or ecx, edi
jmp 0x4040fb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40416a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40416c
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43880c]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x43880c]
inc esi
cmp edx, esi
jne 0x404130
not eax
jmp 0x40416c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x220]
movzx ecx, word [eax]
test cx, cx
je 0x409f10
mov ebp, eax
add eax, 2
xor ebx, ebx
jmp 0x409e1d
add ebx, edx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409e3f
movzx esi, cx
cmp esi, 0x800
mov ecx, 3
sbb ecx, 0
mov edx, 1
cmp esi, 0x80
jb 0x409e10
mov edx, ecx
jmp 0x409e10
lea esi, [ebx + 1]
push esi
call fcn.00409540
add esp, 4
test ebx, ebx
jle 0x409f1a
add ebx, eax
add esi, eax
mov edi, eax
mov edx, ebp
mov dword [esp], esi
jmp 0x409e74
mov byte [edi], cl
mov esi, 1
add edx, 2
add edi, esi
cmp edi, ebx
jae 0x409f1c
movzx ecx, word [edx]
test cx, cx
je 0x409f1c
cmp cx, 0x7f
jbe 0x409e60
mov esi, edi
not esi
mov ebp, esi
and ebp, dword [esp]
xor esi, dword [esp]
lea ebp, [esi + ebp*2]
movzx esi, cx
cmp ebp, 2
jb 0x409ed0
cmp esi, 0x7ff
ja 0x409ed0
mov esi, edx
mov edx, ecx
shr edx, 6
add dl, 0xc0
mov byte [edi], dl
mov edx, esi
and cl, 0x3f
or cl, 0x80
mov byte [edi + 1], cl
mov esi, 2
jmp 0x409e67
mov dword [esp + 8], esi
xor esi, esi
cmp ebp, 3
jb 0x409e67
mov esi, edx
mov ebp, dword [esp + 8]
mov edx, ebp
shr edx, 0xc
or dl, 0xe0
mov byte [edi], dl
mov edx, esi
shr ebp, 6
mov esi, eax
mov eax, ebp
and al, 0x3f
or al, 0x80
mov byte [edi + 1], al
mov eax, esi
and cl, 0x3f
or cl, 0x80
mov byte [edi + 2], cl
mov esi, 3
jmp 0x409e67
push 1
call fcn.00409540
add esp, 4
mov edi, eax
mov ebp, dword [esp + 0x228]
mov esi, dword [esp + 0x224]
mov byte [edi], 0
xor ecx, ecx
jmp 0x409f45
mov byte [esp + ecx + 0xc], dl
inc ecx
movzx ebx, byte [eax + ecx]
mov dl, 0x2f
cmp ebx, 0x5c
je 0x409f40
test ebx, ebx
je 0x409f58
mov edx, ebx
jmp 0x409f40
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0x10]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push ebp
push esi
push eax
push ecx
call fcn.004061c0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4136a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x4136c0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4136e0
sar ebp, 1
sar eax, 1
add eax, ebp
inc eax
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x413708
mov eax, 0xffffffff
jmp 0x41370a
add eax, eax
push eax
call fcn.00409540
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x413741
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x413730
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x413771
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413760
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00436a40
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43c8e0]
Function at 0x413a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x78
mov eax, dword [esp + 0x90]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413ab0
sar esi, 1
lea ebx, [esp + 0x5c]
push ebx
push 0
push 0
push esi
push eax
push 0
call dword [0x441cec]
mov ebp, dword [esp + 0x5c]
mov edi, 0xffffffff
test ebp, ebp
jns 0x413ae4
mov eax, 0xffffffff
jmp 0x413aeb
lea eax, [ebp*2]
push eax
call fcn.00409540
add esp, 4
push ebx
mov ebx, eax
push ebp
push eax
push esi
push dword [esp + 0xa0]
push 0
call dword [0x441cec]
mov eax, dword [esp + 0x5c]
mov ecx, eax
add ecx, 0xd
js 0x413b1b
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00409540
add esp, 4
mov ebp, eax
mov dword [esp + 0x18], 0x41f247e0
mov dword [esp + 0x1c], 0x4ddf43e3
mov dword [esp + 0x20], 0x492e4fd0
mov dword [esp + 0x24], 0xb5e54bf6
mov dword [esp + 0x28], 0xb12bb726
mov dword [esp + 0x2c], 0xbd23b31b
mov dword [esp + 0x30], 0xb9bebf2a
mov word [esp + 0x34], 0
mov byte [esp + 0x36], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1e
ja 0x413bbb
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x18]
lea edx, [eax + ecx]
add eax, 0xf1
and eax, ecx
add eax, eax
sub edx, eax
add edx, 0xb11627f1
mov dword [esp + 0x4c], edx
mov eax, dword [esp + 0x4c]
add al, 0x4b
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1f
jb 0x413b80
movzx ecx, word [ebx]
mov eax, ebp
test cx, cx
je 0x413be1
lea edx, [ebx + 2]
mov eax, ebp
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413bd0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x413c11
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413c00
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00436a40
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43cba4]
Function at 0x4178d0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4178f0
cmp eax, 0xffffffdd
jge 0x417907
mov eax, 0xffffffff
jmp 0x41790a
add eax, 0x22
push eax
call fcn.00409540
add esp, 4
mov esi, eax
mov dword [esp + 8], 0xe16be700
mov dword [esp + 0xc], 0xfd13e36c
mov dword [esp + 0x10], 0xf91dff0e
mov dword [esp + 0x14], 0xf505fb01
mov dword [esp + 0x18], 0xf10af710
mov dword [esp + 0x1c], 0x8d0cf30f
mov dword [esp + 0x20], 0x89018f6f
mov dword [esp + 0x24], 0x85068b7c
mov word [esp + 0x28], 0x8784
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x4179ae
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x4efbc629
xor eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
add al, 0x33
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x417980
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x4179d1
add ecx, 2
mov eax, esi
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4179c0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x417a01
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4179f0
mov word [eax], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov dword [esp + 8], 0x41d747d3
mov dword [esp + 0xc], 0x4d9543da
mov dword [esp + 0x10], 0x49d64fa3
mov dword [esp + 0x14], 0x75a54bd4
mov dword [esp + 0x18], 0x71eb77e2
mov dword [esp + 0x1c], 0x7de3739b
mov dword [esp + 0x20], 0x79ab7fea
mov dword [esp + 0x24], 0x65af7bad
mov dword [esp + 0x28], 0x6180674e
mov dword [esp + 0x2c], 0x6dff63ff
mov dword [esp + 0x30], 0x69fc6f83
mov dword [esp + 0x34], 0x15fb6ba5
mov dword [esp + 0x38], 0x118a1782
mov dword [esp + 0x3c], 0x1d8a13ff
mov dword [esp + 0x40], 0x19d51f80
mov dword [esp + 0x44], 0x5dd1bf4
mov dword [esp + 0x48], 0x106072e
mov word [esp + 0x4c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x45
ja 0x417b01
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xed27d191
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x2b
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x46
jb 0x417ad0
lea eax, [esp + 0x50]
lea ecx, [esp + 8]
push eax
push 0x417da0
push ecx
push esi
call fcn.00418620
add esp, 0x10
jmp dword [0x43cffc]
Function at 0x417c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [ebp + 8]
push eax
mov ebx, esp
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x417c70
cmp eax, 0xffffffed
jge 0x417c87
mov eax, 0xffffffff
jmp 0x417c8a
add eax, 0x12
push eax
call fcn.00409540
add esp, 4
mov esi, eax
mov dword [ebp - 0x2c], 0x57e149ec
mov dword [ebp - 0x28], 0x53eb55f9
mov dword [ebp - 0x24], 0x5f2c512c
mov dword [ebp - 0x20], 0x5bf45df0
mov word [ebp - 0x1c], 0x5958
mov dword [ebp - 0x1a], 0
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x16
ja 0x417d0c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x2c]
add eax, 0x6a8e156e
xor eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add al, 0xda
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x2c], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0x17
jb 0x417ce0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x417d31
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x417d20
mov word [eax], 0
movzx ecx, word [ebp - 0x2c]
test cx, cx
je 0x417d61
lea edx, [ebp - 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417d50
mov word [eax], 0
push ebx
push esi
call fcn.00436bf0
add esp, 8
mov edi, eax
mov ebx, dword [ebx]
jmp dword [0x43d004]
Function at 0x417c5c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [ebp + 8]
push eax
mov ebx, esp
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x417c70
cmp eax, 0xffffffed
jge 0x417c87
mov eax, 0xffffffff
jmp 0x417c8a
add eax, 0x12
push eax
call fcn.00409540
add esp, 4
mov esi, eax
mov dword [ebp - 0x2c], 0x57e149ec
mov dword [ebp - 0x28], 0x53eb55f9
mov dword [ebp - 0x24], 0x5f2c512c
mov dword [ebp - 0x20], 0x5bf45df0
mov word [ebp - 0x1c], 0x5958
mov dword [ebp - 0x1a], 0
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x16
ja 0x417d0c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x2c]
add eax, 0x6a8e156e
xor eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add al, 0xda
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x2c], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0x17
jb 0x417ce0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x417d31
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x417d20
mov word [eax], 0
movzx ecx, word [ebp - 0x2c]
test cx, cx
je 0x417d61
lea edx, [ebp - 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417d50
mov word [eax], 0
push ebx
push esi
call fcn.00436bf0
add esp, 8
mov edi, eax
mov ebx, dword [ebx]
jmp dword [0x43d004]
Function at 0x41b5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x441cec]
mov dword [esp + 8], 0x6125675b
mov dword [esp + 0xc], 0x7d126310
mov dword [esp + 0x10], 0x791d7f20
mov dword [esp + 0x14], 0x75197bf4
mov dword [esp + 0x18], 0x7112774b
mov dword [esp + 0x1c], 0x8d0a731c
mov dword [esp + 0x20], 0x89f88f03
mov dword [esp + 0x24], 0x85f58bf4
mov dword [esp + 0x28], 0x81e487f6
mov dword [esp + 0x2c], 0x9df083fb
mov dword [esp + 0x30], 0x99fa9fe0
mov dword [esp + 0x34], 0x95e89bc8
mov dword [esp + 0x38], 0x91e897e5
mov dword [esp + 0x3c], 0xade693eb
mov dword [esp + 0x40], 0xa923afd3
mov word [esp + 0x44], 0xaba8
mov dword [esp + 0x46], 0
mov byte [esp + 0x4a], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x42
ja 0x41b6b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0x9cb62fe9
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x73
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x43
jb 0x41b680
lea ebx, [esp + 0x4c]
lea edi, [esp + 8]
push ebx
push 0
push 0
push 0x1e
push edi
push 0
call eax
mov ebp, dword [esp + 0x4c]
test ebp, ebp
jns 0x41b6d3
mov eax, 0xffffffff
jmp 0x41b6da
lea eax, [ebp*2]
push eax
call fcn.00409540
add esp, 4
mov esi, eax
mov eax, dword [0x441cec]
mov dword [esp + 8], 0xf1bdff9b
mov dword [esp + 0xc], 0xf542f340
mov dword [esp + 0x10], 0xc955f7b0
mov dword [esp + 0x14], 0xcd69cb7c
mov dword [esp + 0x18], 0xc162cfab
mov dword [esp + 0x1c], 0xc57ac394
mov dword [esp + 0x20], 0xd978c773
mov dword [esp + 0x24], 0xdd7ddb7c
mov dword [esp + 0x28], 0xd17cdf6e
mov dword [esp + 0x2c], 0xd560d36b
mov dword [esp + 0x30], 0x297ad770
mov dword [esp + 0x34], 0x2d982b78
mov dword [esp + 0x38], 0x21882f9d
mov dword [esp + 0x3c], 0x259e239b
mov dword [esp + 0x40], 0x39932783
mov word [esp + 0x44], 0x3b38
mov dword [esp + 0x46], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x41
ja 0x41b7b0
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0x10bd5
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xd7
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x42
jb 0x41b780
push ebx
push ebp
push esi
push 0x1e
push edi
push 0
call eax
mov dword [esp + 8], 0x13aa11bc
mov dword [esp + 0xc], 0xef58ed61
mov dword [esp + 0x10], 0xeb57e954
mov dword [esp + 0x14], 0xe744e556
mov dword [esp + 0x18], 0xe350e159
mov dword [esp + 0x1c], 0xfffefd40
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x17
ja 0x41b83a
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0xfc]
add eax, ecx
and edx, ecx
add edx, edx
sub eax, edx
add eax, 0xdff974fc
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x14
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x18
jb 0x41b800
push 0
push 0
push edi
push esi
push dword [esp + 0x74]
call fcn.00415f90
add esp, 0x14
jmp dword [0x43d7c4]
Function at 0x41d1b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x850
xor esi, esi
mov eax, 0x20219
mov ecx, 1
lea edi, [esp + 0xc]
xor ebp, ebp
mov dword [esp + 8], 0
jmp 0x41d1f0
jmp dword [ecx*4 + 0x43dcb4]
Function at 0x41de80
Capabilities:
Copy file
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0041dea0
add esp, 4
test al, al
je 0x41e600
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0x98
xor edi, edi
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x43ddd4]
Function at 0x428f80
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2f8
mov dword [esp + 0x2cc], 0x43ea6c
mov dword [esp + 0x7c], 0
lea eax, [esp + 0x7c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4399c0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x4399d0
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2c8], eax
mov eax, dword [esp + 0x2cc]
mov ecx, dword [esp + 0x2c8]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2c4], 0x43ea74
mov dword [esp + 0x2bc], 0x43ea7c
mov dword [esp + 0x2b4], 0x43ea84
mov dword [esp + 0x2ac], 0x43e080
mov dword [esp + 0x2a8], 0x124
mov dword [esp + 0x2a4], 0x43e080
mov dword [esp + 0x2a0], 0x125
mov dword [esp + 0x29c], 0x43ea8c
mov dword [esp + 0x294], 0x43ea94
mov dword [esp + 0x28c], 0x43ea9c
mov dword [esp + 0x284], 0x43eaa4
mov dword [esp + 0x27c], 0x43e080
mov dword [esp + 0x278], 0x12a
mov dword [esp + 0x274], 0x43eaac
mov dword [esp + 0x26c], 0x43e080
mov dword [esp + 0x268], 0x12d
mov dword [esp + 0x264], 0x43e080
mov dword [esp + 0x260], 0x12d
mov dword [esp + 0x25c], 0x43eab4
mov dword [esp + 0x254], 0x43eabc
mov dword [esp + 0x24c], 0x43eac4
mov dword [esp + 0x244], 0x43e080
mov dword [esp + 0x240], 0x131
mov dword [esp + 0x23c], 0x43eacc
mov dword [esp + 0x234], 0x43ead4
mov dword [esp + 0x22c], 0x43e080
mov dword [esp + 0x228], 0x134
mov dword [esp + 0x224], 0x43eadc
mov dword [esp + 0x21c], 0x43eae4
mov dword [esp + 0x214], 0x43eaec
mov dword [esp + 0x20c], 0x43eaf4
mov dword [esp + 0x204], 0x43eafc
mov dword [esp + 0x1fc], 0x43e080
mov dword [esp + 0x1f8], 0x13a
mov dword [esp + 0x1f4], 0x43eb04
mov dword [esp + 0x1ec], 0x43e080
mov dword [esp + 0x1e8], 0x13c
mov dword [esp + 0x1e4], 0x43eb0c
mov dword [esp + 0x1dc], 0x43e080
mov dword [esp + 0x1d8], 0x13e
mov dword [esp + 0x1d4], 0x43e080
mov dword [esp + 0x1d0], 0x13f
mov dword [esp + 0x1cc], 0x43e080
mov dword [esp + 0x1c8], 0x140
mov dword [esp + 0x1c4], 0x43eb14
mov dword [esp + 0x1bc], 0x43e080
mov dword [esp + 0x1b8], 0x142
mov dword [esp + 0x1b4], 0x43e080
mov dword [esp + 0x1b0], 0x143
mov dword [esp + 0x1ac], 0x43e080
mov dword [esp + 0x1a8], 0x144
mov dword [esp + 0x1a4], 0x43e080
mov dword [esp + 0x1a0], 0x145
mov dword [esp + 0x19c], 0x43eb1c
mov dword [esp + 0x194], 0x43eb24
mov dword [esp + 0x18c], 0x43e080
mov dword [esp + 0x188], 0x121
mov dword [esp + 0x184], 0x43e080
mov dword [esp + 0x180], 0x126
mov dword [esp + 0x17c], 0x43e080
mov dword [esp + 0x178], 0x12e
mov dword [esp + 0x174], 0x43e080
mov dword [esp + 0x170], 0x132
mov dword [esp + 0x16c], 0x43e080
mov dword [esp + 0x168], 0x135
mov dword [esp + 0x164], 0x43e080
mov dword [esp + 0x160], 0x138
mov dword [esp + 0x15c], 0x43e080
mov dword [esp + 0x158], 0x146
xor edi, edi
jmp eax
Function at 0x42a510
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42a675
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42a571
jmp 0x42a66f
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.004178a0
mov ebp, eax
jmp 0x42a58b
cmp ebp, 0
setne al
jmp 0x42a593
jmp 0x42a595
xor ebx, ebx
test al, 1
jne 0x42a5a0
jmp 0x42a663
mov al, byte [esp + 0x20]
mov byte [esp + 0x24], al
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x11], 0x27
mov byte [esp + 0x12], 0x25
mov byte [esp + 0x13], 0x29
mov byte [esp + 0x14], 0x5e
mov byte [esp + 0x15], 0x2e
mov byte [esp + 0x16], 0x59
mov byte [esp + 0x17], 0x2b
mov byte [esp + 0x18], 0x58
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x26
mov byte [esp + 0x1b], 0x39
mov byte [esp + 0x1c], 0x24
mov byte [esp + 0x1d], 0xb7
mov eax, 0xe
mov byte [esp + eax + 0x10], 0
add eax, 1
cmp eax, 0x10
jne 0x42a5f3
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x10
jae 0x42a63d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0042a9f0
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x10], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x42a608
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.00409fa0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x42a65f
jmp 0x42a661
jmp 0x42a663
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret