joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov esi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0xc36dc10d
mov dword [esp + 0x3c], 0xc76fc55e
mov dword [esp + 0x40], 0xcb66c964
mov dword [esp + 0x44], 0xcf21cd6d
mov dword [esp + 0x48], 0xb35cb165
mov dword [esp + 0x4c], 0xb756b564
mov dword [esp + 0x50], 0xbb0db950
mov dword [esp + 0x54], 0xbf10bd15
mov dword [esp + 0x58], 0xa30da104
mov dword [esp + 0x5c], 0xa735a533
mov dword [esp + 0x60], 0xab64a948
mov dword [esp + 0x64], 0xaf4ead18
mov dword [esp + 0x68], 0x93429141
mov dword [esp + 0x6c], 0x9746957a
mov dword [esp + 0x70], 0x9b7a9943
mov dword [esp + 0x74], 0x9f379d2b
mov dword [esp + 0x78], 0x8354812e
mov dword [esp + 0x7c], 0x875d8550
mov dword [esp + 0x80], 0x8b128968
mov dword [esp + 0x84], 0x8f5a8d5a
mov dword [esp + 0x88], 0x73927199
mov dword [esp + 0x8c], 0x77e675b5
mov dword [esp + 0x90], 0x7bd679e8
mov dword [esp + 0x94], 0x7fc97dd9
mov dword [esp + 0x98], 0x63c061c5
mov dword [esp + 0x9c], 0x67cf65af
mov dword [esp + 0xa0], 0x6b8569fc
mov dword [esp + 0xa4], 0x6fbd6db9
mov dword [esp + 0xa8], 0x53bc5187
mov dword [esp + 0xac], 0x57805587
mov dword [esp + 0xb0], 0x5bb259b8
mov dword [esp + 0xb4], 0x5f965d97
mov dword [esp + 0xb8], 0x438f41f4
mov dword [esp + 0xbc], 0x47aa4588
mov dword [esp + 0xc0], 0x4be649a8
mov dword [esp + 0xc4], 0x4fe54de5
mov dword [esp + 0xc8], 0x33d23195
mov dword [esp + 0xcc], 0x379335f3
mov dword [esp + 0xd0], 0x3b91399b
mov dword [esp + 0xd4], 0x3fd73d93
mov dword [esp + 0xd8], 0x23e121c0
mov dword [esp + 0xdc], 0x27b4258c
mov dword [esp + 0xe0], 0x2b872987
mov dword [esp + 0xe4], 0x2fc12d89
mov dword [esp + 0xe8], 0x13c311c1
mov dword [esp + 0xec], 0x17f815cd
mov dword [esp + 0xf0], 0x1bf419c8
mov dword [esp + 0xf4], 0x1ff01dcc
mov dword [esp + 0xf8], 0x3e201d0
mov dword [esp + 0xfc], 0x7a705b7
mov dword [esp + 0x100], 0xbab09ae
mov dword [esp + 0x104], 0xfa70d9e
mov dword [esp + 0x108], 0xf327f11f
mov dword [esp + 0x10c], 0xf721f527
mov dword [esp + 0x110], 0xfb29f916
mov dword [esp + 0x114], 0xfffefd2a
mov word [esp + 0x118], 0
mov eax, dword [0x450eac]
mov ecx, 0x51beab30
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + ecx - 0x51beaaf8]
mov edi, ecx
and edi, ebp
mov ebx, edi
and ebx, 0xfffffffd
mov edx, edi
or edx, 0xfffffffd
inc edx
imul edx, ebx
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
add edx, ebp
sub edx, edi
add edx, ecx
mov edi, edx
and edi, 0xd
mov ebx, edx
and ebx, 2
mov ebp, ebx
xor ebp, 2
imul ebp, edi
or edi, 2
imul edi, ebx
xor edx, 0xf
add edx, ebp
add edx, edi
inc dl
mov byte [esp + ecx - 0x51beaaf8], dl
inc ecx
cmp ecx, 0x51beac12
jne 0x40fd70
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x44b17c]
mov ecx, 0xe26ef590
xor ecx, dword [0x44b184]
add ecx, edx
inc ecx
jmp ecx
Function at 0x41ccc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1100
call fcn.0040c950
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41cce0
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4521f0]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41cd14
mov eax, 0xffffffff
jmp 0x41cd17
lea eax, [ebx + ebx]
push eax
call fcn.0040c9f0
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x4521f0]
mov eax, dword [esp + 0x34]
mov ecx, eax
and ecx, 0xd
xor eax, 0xd
lea eax, [eax + ecx*2]
test eax, eax
js 0x41cd51
add eax, eax
mov edi, eax
push edi
call fcn.0040c9f0
add esp, 4
mov ebx, eax
mov dword [esp + 0xfc], 0xf90efb18
mov dword [esp + 0x100], 0xe57be717
mov dword [esp + 0x104], 0xe1c2e378
mov dword [esp + 0x108], 0xed05ef1a
mov dword [esp + 0x10c], 0xe977eb72
mov dword [esp + 0x110], 0x9507977f
mov dword [esp + 0x114], 0x91929306
mov word [esp + 0x118], 0
mov byte [esp + 0x11a], 0
xor eax, eax
nop
nop
nop
movzx edx, byte [esp + eax + 0xfc]
mov esi, eax
and esi, 0xb
mov edi, eax
and edi, 0x14
mov ecx, eax
xor ecx, 0x2560ffab
add ecx, eax
add ecx, esi
sub ecx, edi
xor ecx, edx
mov edx, ecx
not edx
mov esi, edx
or esi, 0xa8
or edx, 0x57
add edx, esi
lea ecx, [edx + ecx*2]
add cl, 0xab
mov byte [esp + eax + 0xfc], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x1f
jb 0x41cdc0
mov eax, dword [esp + 0x2c]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x41ce41
mov eax, dword [esp + 0x2c]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ce30
mov word [eax], 0
movzx ecx, word [esp + 0xfc]
test cx, cx
je 0x41ce71
lea edx, [esp + 0xfe]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ce60
mov word [eax], 0
lea eax, [esp + 0x88]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.004455b0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ca6c]
Function at 0x423790
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x4237a0
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x4521f0]
mov edi, dword [esp]
test edi, edi
jns 0x4237cc
mov eax, 0xffffffff
jmp 0x4237cf
lea eax, [edi + edi]
push eax
call fcn.0040c9f0
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x4521f0]
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00445750
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ceb4]
Function at 0x425550
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425560
cmp eax, 0xffffffed
jge 0x425577
mov eax, 0xffffffff
jmp 0x42557a
add eax, 0x12
push eax
call fcn.0040c9f0
add esp, 4
mov esi, eax
mov dword [esp], 0x43e941fc
mov dword [esp + 4], 0x47df45e1
mov dword [esp + 8], 0x4b24491c
mov dword [esp + 0xc], 0x4fec4de8
mov word [esp + 0x10], 0xb1b0
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, esp
mov ecx, 0xec40550f
nop
movzx ebx, byte [eax]
mov edx, ecx
or edx, ebx
lea ebp, [ecx + 0x13bfab00]
and ebp, ebx
not edx
or edx, ebp
mov ebx, edx
xor ebx, 0x62be56b1
and edx, 0x1d41a94e
add edx, edx
sub edx, ebx
mov ebx, edx
and ebx, 1
xor edx, 1
lea edx, [edx + ebx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0xec4054f8
jne 0x4255c0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x425621
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x425610
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425651
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425640
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00445750
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44cf8c]

Function at 0x425690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
movzx eax, byte [esp + 0x5c]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebp
mov byte [esp + 0x2c], al
test ebp, ebp
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44d0b8]
Function at 0x427fd0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov dword [esp], 0xb9c6bbdf
mov dword [esp + 4], 0xbddbbf29
mov dword [esp + 8], 0xb12eb3db
mov dword [esp + 0xc], 0xb526b7f7
mov dword [esp + 0x10], 0xa9eeab24
mov dword [esp + 0x14], 0xad3aafcf
mov dword [esp + 0x18], 0xa1f9a3cb
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0xa7a0
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
mov ecx, 0x9f
mov edx, 0x60
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x6b
mov ebx, ecx
xor ebx, 0xeb
or ebx, esi
xor bl, byte [esp + ecx - 0x9f]
xor bl, 0xeb
add bl, 0xe5
mov byte [esp + ecx - 0x9f], bl
inc ecx
dec edx
cmp ecx, 0xc2
jne 0x428040
lea ebx, [esp + 0x76]
mov edx, esp
mov ecx, 7
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x92]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x60]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x4521f0]
mov esi, dword [esp + 0x60]
mov edi, 0xffffffff
test esi, esi
jns 0x4280b9
mov eax, 0xffffffff
jmp 0x4280bc
lea eax, [esi + esi]
push eax
call fcn.0040c9f0
add esp, 4
push ebp
push esi
mov dword [esp + 0x70], eax
push eax
push 0xe
push ebx
push 0
call dword [0x4521f0]
mov eax, dword [esp + 0x60]
mov ecx, eax
add ecx, 9
js 0x4280e9
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040c9f0
add esp, 4
mov dword [esp + 0x64], eax
mov dword [esp], 0x77a679dc
mov dword [esp + 4], 0x73cd75d5
mov dword [esp + 8], 0x4fef71c7
mov dword [esp + 0xc], 0x4bf74df7
mov dword [esp + 0x10], 0x474649c7
mov byte [esp + 0x14], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov esi, eax
and esi, 8
mov edi, ecx
xor edi, 0xa2208984
add edi, esi
mov ebx, edi
and ebx, 0x2000196
xor edi, 0x52840596
lea ebp, [edi + ebx*2]
mov esi, 0xa2208983
sub esi, ebp
lea edi, [edi + ebx*2]
add edi, 0x5ddf767c
and edi, 0x563af0b3
and esi, 0xa9c50f4c
or esi, edi
mov edi, edx
xor edi, 0x4c
mov ebx, edx
xor ebx, 0xa9c50f4c
or ebx, edi
xor edx, ebx
xor edx, 0x563af0b3
and edx, esi
xor edx, ebx
neg edx
mov esi, edx
and esi, 0x6f
add esi, esi
xor edx, 0x10
sub edx, esi
add dl, 2
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x15
jne 0x428130
mov edi, dword [esp + 0x68]
movzx ecx, word [edi]
mov ebx, dword [esp + 0x64]
mov eax, ebx
test cx, cx
je 0x4281e1
lea edx, [edi + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4281d0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x428211
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428200
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push ebx
call fcn.00445750
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d658]
Function at 0x4287e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0xb97dbb5f
mov dword [esp + 8], 0xbd2ebf28
mov dword [esp + 0xc], 0xb155b378
mov dword [esp + 0x10], 0xb551b724
mov dword [esp + 0x14], 0xa946ab6f
mov dword [esp + 0x18], 0xad36af5c
mov dword [esp + 0x1c], 0xa130a327
mov dword [esp + 0x20], 0xa53da744
mov dword [esp + 0x24], 0x59bc5b32
mov dword [esp + 0x28], 0x5dc85fc7
mov dword [esp + 0x2c], 0x51be53b8
mov dword [esp + 0x30], 0x55c057a0
mov dword [esp + 0x34], 0x49d04bc5
mov dword [esp + 0x38], 0x4dd24fd7
mov dword [esp + 0x3c], 0x41d743d7
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0x4740
mov dword [esp + 0x42], 0
mov ecx, 0x9c7f50df
mov edx, 0x20
nop
movzx edi, byte [esp + ecx + 0x6380af25]
mov ebx, edx
and ebx, edi
mov esi, ecx
xor esi, edi
add esi, edi
not edi
or edi, edx
sub esi, ebx
and esi, edi
mov ebx, esi
not ebx
mov edi, esi
or ebx, 0x5b
add ebx, esi
xor esi, 0x5b
or edi, 0xa4
and edi, esi
add ebx, edi
add bl, 0xa6
mov byte [esp + ecx + 0x6380af25], bl
inc ecx
dec edx
cmp ecx, 0x9c7f5121
jne 0x428880
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x4521f0]
mov ebp, dword [esp]
test ebp, ebp
jns 0x42890c
mov eax, 0xffffffff
jmp 0x428913
lea eax, [ebp*2]
push eax
call fcn.0040c9f0
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x4521f0]
mov dword [esp + 4], 0xf75e09b4
mov dword [esp + 8], 0xf360f569
mov dword [esp + 0xc], 0xff53f15c
mov dword [esp + 0x10], 0xfb54fd62
mov dword [esp + 0x14], 0xe778f951
mov dword [esp + 0x18], 0xe3e2e548
mov word [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 0x1e
xor edx, 0xfe
lea ecx, [eax + 0x7e]
and ecx, eax
and ecx, 1
or ecx, edx
add cl, 0x82
xor cl, byte [esp + eax + 4]
xor cl, 0xfe
add cl, 0x8a
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x1a
jne 0x428970
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.00423790
add esp, 0x14
jmp dword [0x44d6a0]
Function at 0x4289e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21e4
call fcn.0040c950
mov dword [esp + 0xde4], 0x8f588924
mov dword [esp + 0xde8], 0x83598d49
mov dword [esp + 0xdec], 0x87518159
mov dword [esp + 0xdf0], 0x9b4c8550
mov dword [esp + 0xdf4], 0x9f329931
mov dword [esp + 0xdf8], 0x93459d49
mov dword [esp + 0xdfc], 0x97409155
mov word [esp + 0xe00], 0x9594
mov dword [esp + 0xe02], 0
mov byte [esp + 0xe06], 0
mov eax, 0xb3eb2677
nop
nop
nop
movzx ecx, byte [esp + eax + 0x4c14e76d]
lea edx, [eax + 0x4c14d9eb]
and edx, ecx
add ecx, eax
add edx, edx
mov esi, ecx
sub esi, edx
and ecx, 1
xor esi, 1
lea ecx, [esi + ecx*2]
mov byte [esp + eax + 0x4c14e76d], cl
inc eax
cmp eax, 0xb3eb269a
jne 0x428a60
lea eax, [esp + 0x38]
lea ecx, [esp + 0xde4]
push 0
push 0
push 0x20019
push eax
mov dword [esp + 0x14], ecx
push ecx
call fcn.00445cb0
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x44d6b8]
Function at 0x42b3e0
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042b400
add esp, 4
test al, al
je 0x42bbe0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xe0
mov dword [esp + 0xa0], 0xd160cf07
mov dword [esp + 0xa4], 0xd566d365
mov dword [esp + 0xa8], 0xd97ad777
mov dword [esp + 0xac], 0xdd0adb74
mov dword [esp + 0xb0], 0xa16adf7f
mov dword [esp + 0xb4], 0xa5a2a308
xor eax, eax
nop
nop
movzx edx, byte [esp + eax + 0xa0]
mov ecx, eax
and ecx, 0xd
mov esi, eax
and esi, 0x12
xor esi, 0x88438c53
sub ecx, esi
xor ecx, edx
mov edx, ecx
and edx, 0x9c
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
lea esi, [ecx + ecx]
and esi, 0x3c
sub ecx, esi
add ecx, edi
add ecx, edx
add cl, 0x9f
mov byte [esp + eax + 0xa0], cl
inc eax
cmp eax, 0x18
jne 0x42bc30
mov dword [esp + 0x20], 0x23f0218c
mov dword [esp + 0x24], 0x27e125e1
mov dword [esp + 0x28], 0x3be939e1
mov dword [esp + 0x2c], 0x3fec3de8
mov dword [esp + 0x30], 0x339e3199
mov dword [esp + 0x34], 0x37f735e9
mov dword [esp + 0x38], 0xbd209cb
mov dword [esp + 0x3c], 0xfd00dd5
mov dword [esp + 0x40], 0x3ae01c5
mov dword [esp + 0x44], 0x7d905d7
mov dword [esp + 0x48], 0x1bce19de
mov dword [esp + 0x4c], 0x1fdf1dcb
mov dword [esp + 0x50], 0x13d711c2
mov dword [esp + 0x54], 0x17c015b8
mov dword [esp + 0x58], 0xeb56e949
mov dword [esp + 0x5c], 0xef4bed5a
mov dword [esp + 0x60], 0xe331e14c
mov dword [esp + 0x64], 0xe743e550
mov dword [esp + 0x68], 0xfb47f959
mov word [esp + 0x6c], 0xfdfc
mov dword [esp + 0x6e], 0
lea eax, [esp + 0x20]
mov ecx, 0x622d4337
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
mov esi, ecx
or esi, edx
not esi
lea edi, [ecx - 0x622d4300]
and edi, edx
or edi, esi
mov edx, edi
and edx, 0x68
xor edi, 0xe8
lea edx, [edi + edx*2]
add dl, 0x30
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x622d42e5
jne 0x42bd40
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.0043cd30
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x44dec4]

Function at 0x42b400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x54], 0x71ca7fc9
mov dword [esp + 0x58], 0x75d173d7
mov dword [esp + 0x5c], 0x498877cb
mov dword [esp + 0x60], 0x4dc24bef
mov dword [esp + 0x64], 0x414e4feb
mov byte [esp + 0x68], 0
lea eax, [esp + 0x54]
mov ecx, 0x86f5766a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov edx, edi
not edx
lea ebx, [edi*2 + 1]
lea esi, [edx + edi*2]
inc esi
sub edi, ebx
and edi, 0x510a0189
and esi, 0x28008836
or esi, edi
xor esi, 0x28008836
or esi, ecx
lea edi, [esi + esi]
not edi
add edi, esi
and edx, ecx
or edx, edi
inc edx
mov esi, edx
and esi, 0x6a
add esi, esi
xor edx, 0x15
sub edx, esi
add dl, 2
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x86f57655
jne 0x42b470
lea ebx, [esp + 0x54]
lea ecx, [esp + 0x30]
push ebx
call fcn.0043fb50
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x44de0c]
Function at 0x42fb00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42fb5a
cmp edi, 1
je 0x42fb5a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42fb31
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42fb30
cmp ecx, 0x20
je 0x42fb30
cmp ecx, 0x2b
mov edx, edi
je 0x42fb50
cmp ecx, 0x2d
jne 0x42fb6f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42fb74
xor edi, edi
test eax, eax
je 0x42fd2d
mov dword [eax], 0x16
jmp 0x42fd2d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42fb9d
cmp edx, 0x10
jne 0x42fbb5
cmp byte [ebx], 0x30
jne 0x42fb96
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42fbb7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42fbb7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42fc10
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42fcc8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42fc37
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42fcf8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42fcf8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42fbf0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42fc80
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42fc89
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42fcad
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42fcdd
test bl, bl
jne 0x42fcdd
mov ebx, dword [esp + 0x10]
jmp 0x42fc03
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42fbe5
mov esi, edi
test bl, bl
jne 0x42fceb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42fbe5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42fd06
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42fd14
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42fd24
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42fd2d
cmp byte [esp + 3], 0
jne 0x42fd2d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436870
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x436a01
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
xor ebx, ebx
cmp esi, 0
je 0x4369f9
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.004324f0
mov edi, eax
cmp edi, 0
setne al
jmp 0x4368eb
jmp 0x4368ed
xor ebx, ebx
test al, 1
jne 0x4368f8
jmp 0x4369ed
mov ebx, edi
add ebx, 1
mov dword [esp], ebx
call fcn.0040c9f0
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.0042af20
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0xb9
mov byte [esp + 0x15], 0xc3
mov byte [esp + 0x16], 0xc5
mov byte [esp + 0x17], 0xc1
mov byte [esp + 0x18], 0xd2
mov byte [esp + 0x19], 0xc2
mov byte [esp + 0x1a], 0xd1
mov byte [esp + 0x1b], 0xc7
mov byte [esp + 0x1c], 0xd0
mov byte [esp + 0x1d], 0x89
mov byte [esp + 0x1e], 0xc2
mov byte [esp + 0x1f], 0xc1
mov byte [esp + 0x20], 0xfc
mov byte [esp + 0x21], 0x4b
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x11
jne 0x43696c
mov ebp, dword [esp + 0x28]
xor eax, eax
cmp eax, 0x11
jae 0x4369bb
movzx edx, byte [esp + eax + 0x14]
mov ebx, eax
xor ebx, 0x4358f1ea
mov ecx, eax
or ecx, 0xbca70e15
and ecx, ebx
mov ebx, eax
or ebx, 0xbca70e15
add ecx, ebx
mov ebx, ecx
and ebx, edx
shl ebx, 1
add ecx, edx
sub ecx, ebx
add cl, 0x97
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x43697f
jmp 0x4369bd
jmp 0x4369bf
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], edi
call fcn.0040d4f0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x4369e1
jmp 0x4369e3
mov dword [esp], ebp
call fcn.0040ca00
jmp 0x4369ed
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x436a01
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret