joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16ea0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x17056
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x1704f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x16f35
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x1704f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x16fb5
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x16f50
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x16efd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x17000
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x16fe0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x16ef0
jmp 0x1700f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x16ef0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x17020
jmp 0x16ef0
shl ecx, 0x10
or ecx, edi
jmp 0x1705b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x17070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x170d4
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x170d6
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebp, eax
shr ebp, 4
xor eax, edi
and eax, 0xf
mov ebx, dword [eax*4 + 0x5cc50]
mov eax, ebx
and eax, ebp
add eax, eax
sub ebx, eax
add ebx, ebp
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x5cc50]
inc esi
cmp edx, esi
jne 0x17090
not eax
jmp 0x170d6
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d1b0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.000557c0
test al, al
je 0x1d3ae
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0004d630
test al, al
je 0x1d3a9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x7e054845
mov dword [esp + 8], 0xaaa01ea2
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x1d236
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0001d3c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x1d210
mov dword [esp + 4], 0xe61f4585
mov dword [esp + 8], 0xe81fba83
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x1d286
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0001d430
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x1d260
test esi, esi
je 0x1d336
mov dword [esp + 4], 0x23222101
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x1d2e6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0001d4c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x1d2c0
mov dword [esp + 4], 0xbf11ef41
mov dword [esp + 8], 0xe9f4e09a
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x1d336
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0001d540
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x1d310
mov dword [esp + 4], 0xf6f7f8f9
mov dword [esp + 8], 0xf2f3f4f5
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x1d396
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0001d5c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x1d370
call fcn.0001ec30
test al, al
je 0x1d3a9
call fcn.00022720
call fcn.00020550
call fcn.000565c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1d840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x58
mov esi, ecx
mov edi, dword [esp + 0x68]
add edi, dword [ecx + 0x60]
mov word [esp + 4], 0x9795
mov byte [esp + 6], 0x9e
mov dword [esp + 7], 0
mov byte [esp + 0xb], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 7
ja 0x1d8ab
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x18]
push eax
call fcn.0001e5d0
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 8
jb 0x1d880
mov dword [esp + 0xc], 0x6080472
mov word [esp + 0x10], 0x6d76
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 0xa
ja 0x1d90b
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 0xc]
push dword [esp + 0x18]
push eax
call fcn.0001e540
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 0xb
jb 0x1d8e0
mov dword [esp + 0x18], 0x46407c7d
mov dword [esp + 0x1c], 0x4242706c
mov dword [esp + 0x20], 0x3fcac00d
mov dword [esp + 0x24], 0x3ac73ec3
mov dword [esp + 0x28], 0x237c3c2
mov dword [esp + 0x2c], 0xc8156f69
mov dword [esp + 0x30], 0xd52fddd6
mov dword [esp + 0x34], 0xd60a10d8
mov dword [esp + 0x38], 0xd0ddd1d3
mov dword [esp + 0x3c], 0xd8dfd1dd
mov dword [esp + 0x40], 0x1d5a33e6
mov dword [esp + 0x44], 0x22e3efe3
mov dword [esp + 0x48], 0x12e61014
mov dword [esp + 0x4c], 0x16e8553f
mov dword [esp + 0x50], 0x49270cf5
mov byte [esp + 0x54], 0x6c
mov word [esp + 0x55], 0
mov byte [esp + 0x57], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x3f
ja 0x1d9d6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.0001e4a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x40
jb 0x1d9b0
mov ecx, dword [esp + 0x6c]
movzx edx, byte [esp + 0x18]
mov eax, edi
test dl, dl
je 0x1d9fb
lea ebx, [esp + 0x19]
mov eax, edi
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x1d9f0
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x1da1b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x1da10
mov ecx, dword [esp + 0x70]
mov byte [eax], 0
movzx edx, byte [esp + 0xc]
test dl, dl
je 0x1da3b
lea ebx, [esp + 0xd]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x1da30
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x1da5b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x1da50
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x1da7b
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x1da70
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x58
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x38ff0
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov esi, dword [0x65f6c]
mov dword [esp + 0x14], 0x71420f6b
mov dword [esp + 0x18], 0x75d773e1
mov dword [esp + 0x1c], 0x79da77d7
mov dword [esp + 0x20], 0x7dea7b3b
mov dword [esp + 0x24], 0x613a7fec
mov dword [esp + 0x28], 0x65f663c3
mov dword [esp + 0x2c], 0x690167c7
mov dword [esp + 0x30], 0x6b68
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1f
ja 0x3907b
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0003c450
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x20
jb 0x39050
lea edi, [esp + 0x64]
lea eax, [esp + 0x14]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x64]
test ebx, ebx
jns 0x3909e
mov eax, 0xffffffff
jmp 0x390a1
lea eax, [ebx + ebx]
push eax
call fcn.0001cb00
add esp, 4
mov esi, eax
mov ebp, dword [0x65f6c]
mov dword [esp + 0x14], 0x71a27f9b
mov dword [esp + 0x18], 0x75d773c1
mov dword [esp + 0x1c], 0x49ca77d7
mov dword [esp + 0x20], 0x4dfa4b8b
mov dword [esp + 0x24], 0x418a4ffc
mov dword [esp + 0x28], 0x45f643e3
mov dword [esp + 0x2c], 0x59a147e7
mov word [esp + 0x30], 0x5b58
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x22
ja 0x3913b
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0003c4c0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x23
jb 0x39110
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebp
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
jns 0x3915b
mov eax, 0xffffffff
jmp 0x39162
lea eax, [eax*2 + 0x12]
push eax
call fcn.0001cb00
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0xc1b6c7a0
mov dword [esp + 0x18], 0xcdafc3a3
mov dword [esp + 0x1c], 0xc9adcf59
mov dword [esp + 0x20], 0xf5a5cba1
mov dword [esp + 0x24], 0xf1f6f769
mov dword [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x17
ja 0x391db
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0003c530
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x18
jb 0x391b0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x39201
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x391f0
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x39231
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x39220
mov ebx, dword [esp + 0x84]
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.0005a380
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x61c20]
Function at 0x3cec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x848
mov dword [esp + 4], 0
xor edi, edi
mov ebx, 0x20219
mov eax, 1
xor ebp, ebp
jmp dword [eax*4 + 0x62384]

Function at 0x3db00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0003db20
add esp, 4
test al, al
je 0x3e200
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa8
xor edi, edi
mov esi, 0x20219
mov eax, 1
lea ebx, [esp + 0x66]
jmp dword [eax*4 + 0x624e4]
Function at 0x49d70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0002dba0
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
jmp 0x49d88
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x49da2
jmp 0x49da4
xor ebx, ebx
test al, 1
jne 0x49daf
jmp 0x49edf
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x1c], edi
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
jmp 0x49de0
cmp edi, 0
setne al
jmp 0x49de8
xor ebx, ebx
test al, 1
jne 0x49df3
jmp 0x49ed9
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.0001cc30
add esp, 4
mov edx, eax
jmp 0x49e14
xor ebx, ebx
cmp edx, 0
je 0x49ecd
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov byte [esi], 0x8f
mov byte [esi + 1], 0xd5
mov byte [esi + 2], 0xd7
mov byte [esi + 3], 0xdf
mov byte [esi + 4], 0xaa
mov byte [esi + 5], 0xde
mov byte [esi + 6], 0xa3
mov byte [esi + 7], 0xd5
mov byte [esi + 8], 0xa4
mov byte [esi + 9], 0x93
mov byte [esi + 0xa], 0xd2
mov byte [esi + 0xb], 0xcf
mov byte [esi + 0xc], 0xd0
mov byte [esi + 0xd], 0x45
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x13
jne 0x49e63
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x13
jae 0x49ead
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov ebx, edx
call fcn.0004d560
mov edx, ebx
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x49e76
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0001d7c0
mov bl, al
and bl, 1
jmp 0x49ecd
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ebx], 0
lea ebx, [ebx + 2]
jne 0x4f980
mov dword [esp + 8], 0x8e8e881f
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x4f9d6
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
push dword [esp]
push eax
call fcn.00053940
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x4f9b0
cmp ebx, 2
je 0x4f9fc
lea eax, [ebx - 2]
mov edx, eax
sar edx, 1
mov edi, dword [esp + 8]
mov ecx, edi
not ecx
test al, 2
mov dword [esp + 0x10], ecx
jne 0x4fa03
cmp ebx, 4
jne 0x4fa37
jmp 0x4fa90
mov eax, ebp
jmp 0x4fa90
dec edx
movzx eax, word [esi]
xor eax, ebp
mov ebp, eax
or ebp, edi
mov dword [esp + 4], ebp
mov ebp, eax
and ebp, edi
imul ebp, dword [esp + 4]
mov dword [esp + 4], ebp
mov ebp, eax
not ebp
and ebp, edi
and eax, ecx
imul eax, ebp
add eax, dword [esp + 4]
add esi, 2
mov ebp, eax
cmp ebx, 4
je 0x4fa90
xor ebx, ebx
mov eax, ebp
mov dword [esp + 4], edx
nop
movzx ebp, word [esi + ebx*2]
xor ebp, eax
mov eax, ebp
or eax, edi
mov ecx, ebp
and ecx, edi
imul ecx, eax
mov eax, ebp
not eax
and eax, edi
mov edx, esi
mov esi, dword [esp + 0x10]
and ebp, esi
imul ebp, eax
add ebp, ecx
movzx eax, word [edx + ebx*2 + 2]
xor eax, ebp
mov ecx, eax
or ecx, edi
mov ebp, eax
and ebp, edi
imul ebp, ecx
mov ecx, eax
not ecx
and ecx, edi
and eax, esi
mov esi, edx
imul eax, ecx
mov edx, dword [esp + 4]
add eax, ebp
add ebx, 2
cmp edx, ebx
jne 0x4fa40
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x507e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, 0xffffffff
cmp byte [edi + esi + 1], 0
lea esi, [esi + 1]
jne 0x507f0
mov eax, esi
and eax, 3
mov edx, esi
or edx, 3
imul edx, eax
xor eax, 3
mov dword [esp], esi
mov ecx, dword [esp]
and ecx, 0xfffffffc
imul ecx, eax
add edx, ecx
mov ecx, dword [esp]
shr edx, 2
movzx eax, byte [edi + ecx - 1]
cmp eax, 0x3d
je 0x5082d
cmp eax, 0x2e
jne 0x5082e
dec edx
movzx eax, byte [edi + ecx - 2]
cmp eax, 0x3d
je 0x5083d
cmp eax, 0x2e
jne 0x5083e
dec edx
mov dword [esp + 8], edx
mov edx, 0
test ecx, ecx
je 0x5094b
xor esi, esi
mov ebp, 2
jmp 0x50872
mov edx, dword [esp + 4]
nop
nop
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov esi, edx
cmp ebp, ecx
mov ebp, eax
jae 0x5094b
mov edi, dword [esp + 0x40]
movzx eax, byte [edi + ebp - 2]
push eax
call fcn.00032950
add esp, 4
mov bh, al
movzx eax, byte [edi + ebp - 1]
push eax
call fcn.00032950
add esp, 4
mov bl, al
movzx eax, al
mov ecx, eax
not ecx
or ecx, 0x30
add eax, ecx
inc eax
movzx ecx, bh
shr eax, 4
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
mov ecx, dword [esp]
lea edx, [esi + 1]
cmp ebp, ecx
jae 0x50860
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 8], edx
call fcn.00032950
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x50860
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea edx, [esi + 2]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x44]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, dword [esp]
mov ecx, dword [esp]
jae 0x50858
mov ebx, eax
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp + 1]
push eax
call fcn.00032950
add esp, 4
cmp al, 0x40
jne 0x50927
mov edx, dword [esp + 4]
jmp 0x50943
shl bl, 6
add al, bl
mov ecx, esi
and ecx, 1
mov edx, dword [esp + 4]
xor edx, 1
lea edx, [edx + ecx*2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
mov ecx, dword [esp]
jmp 0x50860
mov ebx, dword [esp + 8]
cmp edx, ebx
mov eax, 0
jne 0x509e5
mov esi, dword [esp + 0x44]
lea edx, [esi + 0x20]
lea edi, [esp + 0xc]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x509e1
cmp ebx, 0x21
je 0x509cb
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x509a0
test bl, 1
je 0x509e1
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403080
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403094
inc dword [0x4c4054]
add dword [0x4c040c], 0x108
mov edx, dword [0x4c040c]
push esi
push edi
mov ecx, 0x42
mov esi, 0x4c2b30
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x4030c3
push 0
mov eax, 0x4c6048
call fcn.004154f0
cmp dword [0x4c4080], 0
mov dword [0x4c6af0], 0
mov dword [0x4c6af4], 0
je 0x4030eb
push 0x4c46f0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40316f
or ecx, 0xffffffff
cmp byte [esi + 0xea], 0
jne 0x40311a
xor eax, eax
cmp byte [esp + 0x14], 0x64
sete al
mov byte [esi + 0xea], al
test al, al
je 0x40311a
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4c6afc], 0
je 0x40312c
cmp dword [0x4c6af8], 0
jne 0x403135
cmp byte [esi + 0xea], 0
je 0x40316f
cmp byte [esi + 0xea], 0
mov byte [esi + 0xe8], 0
jne 0x40316f
cmp dword [0x4c6afc], 0
jge 0x403157
pop edi
mov dword [esi + 0xdc], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xd8], eax
mov edx, dword [0x4c6afc]
mov dword [esi + 0xdc], edx
pop edi
pop esi
ret
Function at 0x403d90
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x403db4
push esi
call fcn.004040a0
test eax, eax
jne 0x403db4
push str.Cant_open_clipboard_for_writing.
call fcn.00403e90
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x403ded
cmp dword [esi + 0x18], ebx
je 0x403ddf
cmp dword [esi + 8], ebx
je 0x403dd4
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49ebb4
call fcn.00403e90
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x403e26
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x403e4d
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x403e4d
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x403e43
cmp dword [esi + 8], ebx
je 0x403e38
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x403e62
mov dword [esi + 4], ebx
jmp 0x403e26
cmp dword [esi + 0x18], ebx
je 0x403e7f
cmp dword [esi + 8], ebx
je 0x403e74
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49ebd4
call fcn.00403e90
pop edi
pop esi
pop ebx
pop ecx
ret