joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406930
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406ae6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406adf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4069c5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406adf
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406a4c
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
mov eax, ecx
and eax, edi
xor ecx, edi
lea ecx, [ecx + eax*2]
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x4069e0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40698d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406a90
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406a70
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406980
jmp 0x406a9f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406980
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406ab0
jmp 0x406980
shl ecx, 0x10
or ecx, edi
jmp 0x406aeb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406b61
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406b63
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
mov ebp, eax
xor ebp, 0x3ffffff0
or eax, 0xf
and eax, ebp
mov ebp, edi
and ebp, 0xf
xor ebp, eax
xor ebx, dword [ebp*4 + 0x44cc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44cc50]
inc esi
cmp edx, esi
jne 0x406b20
not eax
jmp 0x406b63
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cd20
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.004453c0
test al, al
je 0x40cf1e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043ce10
test al, al
je 0x40cf19
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x2c5303d
mov dword [esp + 8], 0x5628e256
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40cda6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cf30
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40cd80
mov dword [esp + 4], 0xb2db1555
mov dword [esp + 8], 0x80d37ea7
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40cdf6
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cfb0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40cdd0
test esi, esi
je 0x40ceb6
mov dword [esp + 4], 0x898a8bf3
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x40ce56
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d030
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x40ce30
mov dword [esp + 4], 0x31ab0d77
mov dword [esp + 8], 0xefe0dc16
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40ceb6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d0b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40ce90
mov dword [esp + 4], 0x36373839
mov dword [esp + 8], 0x32333435
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40cf06
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d140
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40cee0
call fcn.0040e860
test al, al
je 0x40cf19
call fcn.00411e80
call fcn.004100f0
call fcn.00446460
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x410100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov esi, dword [0x454e9c]
mov dword [esp + 0x3c], 0xc95bcbbf
mov dword [esp + 0x40], 0xc551c74e
mov dword [esp + 0x44], 0xc156c350
mov dword [esp + 0x48], 0xfdafff5f
mov dword [esp + 0x4c], 0xf9a8fbb7
mov dword [esp + 0x50], 0xf5d6f7a8
mov dword [esp + 0x54], 0xf19bf3ac
mov dword [esp + 0x58], 0xed7cef67
mov dword [esp + 0x5c], 0xe97beb70
mov dword [esp + 0x60], 0xe56be761
mov dword [esp + 0x64], 0xe190e3c4
mov dword [esp + 0x68], 0x1d3e1f8c
mov dword [esp + 0x6c], 0x194a1b53
mov dword [esp + 0x70], 0x1546174a
mov dword [esp + 0x74], 0x11321351
mov dword [esp + 0x78], 0xd990f79
mov dword [esp + 0x7c], 0x9400b9e
mov dword [esp + 0x80], 0x5430744
mov dword [esp + 0x84], 0x18a0324
mov dword [esp + 0x88], 0x3d723f4a
mov dword [esp + 0x8c], 0x391a3b6b
mov dword [esp + 0x90], 0x35a63747
mov dword [esp + 0x94], 0x31a633a4
mov dword [esp + 0x98], 0x2d472fab
mov dword [esp + 0x9c], 0x29b42bb7
mov dword [esp + 0xa0], 0x25b1275d
mov dword [esp + 0xa4], 0x217323a8
mov dword [esp + 0xa8], 0x5d135f6b
mov dword [esp + 0xac], 0x59085b15
mov dword [esp + 0xb0], 0x551c5715
mov dword [esp + 0xb4], 0x510a5374
mov dword [esp + 0xb8], 0x4d364f25
mov dword [esp + 0xbc], 0x49394b20
mov dword [esp + 0xc0], 0x4512473c
mov dword [esp + 0xc4], 0x41d64364
mov dword [esp + 0xc8], 0x7deb7fd7
mov dword [esp + 0xcc], 0x795a7be7
mov dword [esp + 0xd0], 0x75ed7701
mov dword [esp + 0xd4], 0x71e773e9
mov dword [esp + 0xd8], 0x6d396fe1
mov dword [esp + 0xdc], 0x69176b4c
mov dword [esp + 0xe0], 0x65e867f0
mov dword [esp + 0xe4], 0x61f163f5
mov dword [esp + 0xe8], 0x9dcf9ffb
mov dword [esp + 0xec], 0x99d59bd3
mov dword [esp + 0xf0], 0x95c497df
mov dword [esp + 0xf4], 0x91c093c4
mov dword [esp + 0xf8], 0x8ddc8fc0
mov dword [esp + 0xfc], 0x89aa8bdc
mov dword [esp + 0x100], 0x851987e5
mov dword [esp + 0x104], 0x811d831e
mov dword [esp + 0x108], 0xbd29bf0e
mov dword [esp + 0x10c], 0xb9f1bbed
mov dword [esp + 0x110], 0xb5ffb7f5
mov dword [esp + 0x114], 0xb1ffb3e6
mov dword [esp + 0x118], 0xadaeaffa
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xdf
ja 0x41038d
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
movzx eax, byte [esp + eax + 0x3c]
push dword [esp + 8]
push eax
call fcn.004117a0
add esp, 8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x3c], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xe0
jb 0x410360
mov edi, dword [esp + 0x468]
mov ebp, dword [esp + 0x464]
lea ebx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebx
call esi
mov esi, eax
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x44fbec]
add eax, dword [ecx]
fiadd word [ebx]
inc ecx
add bl, ch
add eax, dword [ecx]
jb 0x44fbfe
inc ecx
Function at 0x4108e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x240
mov esi, dword [0x454e9c]
mov dword [esp + 0x40], 0xf7d0955
mov dword [esp + 0x44], 0x37b0d82
mov dword [esp + 0x48], 0x77a017c
mov dword [esp + 0x4c], 0x1b290565
mov dword [esp + 0x50], 0x1f2c192d
mov dword [esp + 0x54], 0x13321d2c
mov dword [esp + 0x58], 0x177d1128
mov dword [esp + 0x5c], 0x2b58156d
mov dword [esp + 0x60], 0x2f5d294c
mov dword [esp + 0x64], 0x23552da7
mov dword [esp + 0x68], 0x27742100
mov dword [esp + 0x6c], 0x3b1a2570
mov dword [esp + 0x70], 0x3f0e3909
mov dword [esp + 0x74], 0x33023d0e
mov dword [esp + 0x78], 0x3716317f
mov dword [esp + 0x7c], 0x4b33355f
mov dword [esp + 0x80], 0x4f04493a
mov dword [esp + 0x84], 0x430d4d78
mov dword [esp + 0x88], 0x47ce4160
mov dword [esp + 0x8c], 0x5b6e450e
mov dword [esp + 0x90], 0x5f7e5961
mov dword [esp + 0x94], 0x53225d1d
mov dword [esp + 0x98], 0x572a5120
mov dword [esp + 0x9c], 0x6b015531
mov dword [esp + 0xa0], 0x6f08690d
mov dword [esp + 0xa4], 0x631b6d33
mov dword [esp + 0xa8], 0x67556114
mov dword [esp + 0xac], 0x7b4d6551
mov dword [esp + 0xb0], 0x7f4c7933
mov dword [esp + 0xb4], 0x73387d4b
mov dword [esp + 0xb8], 0x774e7150
mov dword [esp + 0xbc], 0x8bd2752b
mov dword [esp + 0xc0], 0x8fd389dc
mov dword [esp + 0xc4], 0x83be8dd0
mov dword [esp + 0xc8], 0x87fa81a0
mov dword [esp + 0xcc], 0x9be585fd
mov dword [esp + 0xd0], 0x9fbe99fd
mov dword [esp + 0xd4], 0x93f79dc7
mov dword [esp + 0xd8], 0x97e991f7
mov dword [esp + 0xdc], 0xab9395e7
mov dword [esp + 0xe0], 0xafe9a988
mov dword [esp + 0xe4], 0xa3d4add4
mov dword [esp + 0xe8], 0xa7dba1d3
mov dword [esp + 0xec], 0xbb89a5c1
mov dword [esp + 0xf0], 0xbf8fb989
mov dword [esp + 0xf4], 0xb380bdf5
mov dword [esp + 0xf8], 0xb784b180
mov dword [esp + 0xfc], 0xcbf8b584
mov dword [esp + 0x100], 0xcfeec9f8
mov dword [esp + 0x104], 0xc3a3cd9b
mov dword [esp + 0x108], 0xc7a7c1ba
mov dword [esp + 0x10c], 0xdba3c5b2
mov dword [esp + 0x110], 0xdfebd9eb
mov dword [esp + 0x114], 0xd399ddeb
mov dword [esp + 0x118], 0xd7e1d1e2
mov dword [esp + 0x11c], 0xebead59e
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xdf
ja 0x410b6d
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
movzx eax, byte [esp + eax + 0x40]
push dword [esp + 8]
push eax
call fcn.00411a20
add esp, 8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x40], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xe0
jb 0x410b40
lea ebx, [esp + 0x40]
push 0
push 0
push 0
push 0
push ebx
call esi
xor ecx, ecx
mov dword [esp + 0x38], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44fcc4]
Function at 0x424510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x424530
cmp eax, 0xffffffdd
jge 0x424547
mov eax, 0xffffffff
jmp 0x42454a
add eax, 0x22
push eax
call fcn.0040c610
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x1fb07e0
mov dword [esp + 0x1c], 0xdf303fc
mov dword [esp + 0x20], 0x9ed0ffe
mov dword [esp + 0x24], 0x15e50be1
mov dword [esp + 0x28], 0x11fa17f0
mov dword [esp + 0x2c], 0x1dfc13ff
mov dword [esp + 0x30], 0x19e11fff
mov dword [esp + 0x34], 0x25e61bec
mov dword [esp + 0x38], 0x2724
mov byte [esp + 0x3c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x24
ja 0x4245eb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.004253b0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x25
jb 0x4245c0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x424611
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x424600
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424641
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424630
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x51ff4fe3
mov dword [esp + 0x1c], 0x553d53ea
mov dword [esp + 0x20], 0x59ee57f3
mov dword [esp + 0x24], 0x5dfd5bec
mov dword [esp + 0x28], 0xa1eb5ff2
mov dword [esp + 0x2c], 0xa513a30b
mov dword [esp + 0x30], 0xa9cba70a
mov dword [esp + 0x34], 0xadc7abc5
mov dword [esp + 0x38], 0xb1f0afc6
mov dword [esp + 0x3c], 0xb507b307
mov dword [esp + 0x40], 0xb904b713
mov dword [esp + 0x44], 0xbd0bbbfd
mov dword [esp + 0x48], 0x810abf12
mov dword [esp + 0x4c], 0x853a8327
mov dword [esp + 0x50], 0x89cd8730
mov dword [esp + 0x54], 0x8df58b2c
mov dword [esp + 0x58], 0x918e8fe6
mov byte [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x44
ja 0x424726
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00425420
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x45
jb 0x424700
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x424a20
push ecx
push esi
call fcn.00425800
add esp, 0x10
jmp dword [0x451324]
Function at 0x428e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov esi, dword [0x4561e0]
mov dword [esp + 4], 0x99d59bb7
mov dword [esp + 8], 0xa5d6a7e8
mov dword [esp + 0xc], 0xa1cda3e8
mov dword [esp + 0x10], 0xadc1afdc
mov dword [esp + 0x14], 0xa9ceab87
mov dword [esp + 0x18], 0xb5deb7f4
mov dword [esp + 0x1c], 0xb1c0b3cf
mov dword [esp + 0x20], 0xbdd5bfdc
mov dword [esp + 0x24], 0xb9d4bbc2
mov dword [esp + 0x28], 0xc5b8c7cf
mov dword [esp + 0x2c], 0xc1a6c3a8
mov dword [esp + 0x30], 0xcdb0cf90
mov dword [esp + 0x34], 0xc9a0cbbd
mov dword [esp + 0x38], 0xd5a2d7bf
mov dword [esp + 0x3c], 0xd1afd3bf
mov dword [esp + 0x40], 0xdfd0
mov byte [esp + 0x44], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x40
ja 0x428ef6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0042afb0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x41
jb 0x428ed0
lea ebp, [esp + 0x48]
lea eax, [esp + 4]
push ebp
push 0
push 0
push 0x1e
push eax
push 0
call esi
mov edi, dword [esp + 0x48]
test edi, edi
jns 0x428f19
mov eax, 0xffffffff
jmp 0x428f1c
lea eax, [edi + edi]
push eax
call fcn.0040c610
add esp, 4
mov esi, eax
mov ebx, dword [0x4561e0]
mov dword [esp + 4], 0xb7f789a5
mov dword [esp + 8], 0xb322b524
mov dword [esp + 0xc], 0xbfdfb1fc
mov dword [esp + 0x10], 0xbbdbbd20
mov dword [esp + 0x14], 0xa7c2b995
mov dword [esp + 0x18], 0xa3caa5d8
mov dword [esp + 0x1c], 0xaf3ca13d
mov dword [esp + 0x20], 0xabc7adc0
mov dword [esp + 0x24], 0xd7b8a936
mov dword [esp + 0x28], 0xd34cd5bd
mov dword [esp + 0x2c], 0xdfbad1bc
mov dword [esp + 0x30], 0xdb44ddac
mov dword [esp + 0x34], 0xc7acd94b
mov dword [esp + 0x38], 0xc356c5ad
mov dword [esp + 0x3c], 0xcf51c1ad
mov dword [esp + 0x40], 0xcdcc
mov byte [esp + 0x44], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x40
ja 0x428ff6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0042b040
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x41
jb 0x428fd0
push ebp
push edi
push esi
push 0x1e
lea edi, [esp + 0x14]
push edi
push 0
call ebx
mov dword [esp + 4], 0x29422b50
mov dword [esp + 8], 0x2dbc2fb3
mov dword [esp + 0xc], 0x51395348
mov dword [esp + 0x10], 0x553057c6
mov dword [esp + 0x14], 0x59cc5b3b
mov dword [esp + 0x18], 0x5d5e5f3c
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x17
ja 0x429076
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0042b0c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x18
jb 0x429050
push 0
push 0
push edi
push esi
push dword [esp + 0x70]
call fcn.00422be0
add esp, 0x14
jmp dword [0x451a78]
Function at 0x42c280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0042c2a0
add esp, 4
test al, al
je 0x42c9b0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
xor ebp, ebp
mov esi, 0x20219
mov eax, 1
jmp dword [eax*4 + 0x45228c]
Function at 0x4385e0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x438600
cmp eax, 0
setne al
jmp 0x438608
xor ebx, ebx
test al, 1
jne 0x438613
jmp 0x438746
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x438650
jmp 0x43873e
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.0040c720
add esp, 4
mov edx, eax
jmp 0x438671
jmp 0x438673
xor ebx, ebx
cmp edx, 0
je 0x438732
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0xc9
mov byte [ebp - 0x27], 0x33
mov byte [ebp - 0x26], 0x2d
mov byte [ebp - 0x25], 0x31
mov byte [ebp - 0x24], 0x22
mov byte [ebp - 0x23], 0x32
mov byte [ebp - 0x22], 0x21
mov byte [ebp - 0x21], 0x3f
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0xf9
mov byte [ebp - 0x1e], 0x32
mov byte [ebp - 0x1d], 0x31
mov byte [ebp - 0x1c], 0x34
mov byte [ebp - 0x1b], 0x8b
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x11
jne 0x4386c0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x11
jae 0x43870d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.0043cd10
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x4386d4
jmp 0x43870f
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d3d0
mov bl, al
and bl, 1
jmp 0x438732
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x438746
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x447f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x2c]
jb 0x44802d
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
not ecx
or ecx, 0xfffffffc
add ecx, ebx
lea eax, [esi + ecx]
inc eax
lea edx, [ecx + ebp]
inc edx
mov ebp, ebx
and ebp, 3
mov ecx, ebp
shr ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov ecx, ebp
xor ecx, 0xfffffffe
or ebp, 1
and ebp, ecx
je 0x448026
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [eax + ebx], cl
cmp ebp, 1
je 0x448026
movzx ecx, byte [edx + ebx + 1]
mov byte [eax + ebx + 1], cl
cmp ebp, 2
je 0x448026
movzx ecx, byte [edx + ebx + 2]
mov byte [eax + ebx + 2], cl
xor eax, eax
jmp 0x4481a1
mov dword [esp + 4], 0x484b4a4d
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x448076
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00448fb0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x448050
mov eax, dword [esp + 4]
mov ecx, dword [0x4561e4]
test ecx, ecx
je 0x4480d2
xor edx, edx
mov esi, dword [0x4561e8]
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x54ca534e
je 0x4480a4
inc edx
cmp ecx, edx
jne 0x448090
mov esi, dword [esp + 0x2c]
jmp 0x4480d2
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
mov esi, dword [esp + 0x2c]
je 0x4480d2
lea eax, [esp + 0xc]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x4561ec]
push ecx
call fcn.00446a00
add esp, 0x28
test eax, eax
js 0x4481a1
push 0xc95dc39
push dword [0x45e1f8]
call fcn.00449680
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x24]
call eax
mov esi, eax
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0x484b4a4d
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x448156
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00448fb0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x448130
mov ecx, dword [0x4561e4]
test ecx, ecx
je 0x448181
mov edx, dword [esp + 4]
xor ebx, ebx
mov ebp, dword [0x4561e8]
mov eax, esi
nop
nop
cmp dword [ebp + ebx*8], 0x625b6034
je 0x448185
inc ebx
cmp ecx, ebx
jne 0x448170
jmp 0x4481a1
mov eax, esi
jmp 0x4481a1
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, edx
je 0x4481a1
push edi
push 1
push dword [0x4561ec]
push ecx
call fcn.00446a00
mov eax, esi
add esp, 0x10
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret