joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4051c2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4051c2
cmp dword [esp + 0x2c], 0
je 0x4051c2
push esi
call fcn.0040cb70
add esp, 4
test eax, eax
je 0x40511a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405121
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x405100
jmp 0x405123
mov ebx, 0x1505
jmp 0x405123
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4051ca
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405187
call fcn.00405dc0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4051c2
push ecx
call fcn.0040cb70
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40523d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4051e8
inc edi
dec esi
je 0x40513c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405141
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4051e0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cb70
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4051e0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4051e0
mov eax, 0xffffffff
jmp 0x4051c2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405258
inc edi
dec esi
je 0x405182
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405187
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405250
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cb70
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405250
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405250
jmp 0x405187
Function at 0x405b10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405cfa
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405cfa
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405cfa
cmp dword [ecx], 0
jne 0x405cfa
push esi
call fcn.0040cb70
add esp, 4
test eax, eax
je 0x405b7a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405b81
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405b60
jmp 0x405b83
mov edi, 0x1505
jmp 0x405b83
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405c54
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405be1
call fcn.00405dc0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405cfa
push esi
call fcn.0040cb70
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405d10
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cb70
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44e008]
add esp, 4
test eax, eax
je 0x405cf5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040ca90
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405cfa
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405c78
inc ebx
dec edx
je 0x405b9c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405ba1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405c70
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cb70
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405c70
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cba0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405c70
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404c50
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405c49
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406e30
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406fd6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406fcf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406ec5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406fcf
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406f3e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406ee0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406e8d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406f80
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406f60
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406e80
jmp 0x406f8f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406e80
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406fa0
jmp 0x406e80
shl ecx, 0x10
or ecx, edi
jmp 0x406fdb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406ff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40701e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x4070bc
not eax
test bl, 1
jne 0x407025
mov edx, ebx
cmp ebx, 1
jne 0x407056
jmp 0x4070ba
xor eax, eax
jmp 0x4070bc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x44bc50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x44bc50]
cmp ebx, 1
je 0x4070ba
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44bc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44bc50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44bc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44bc50]
add esi, 2
cmp edx, esi
jne 0x407060
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40d1e0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.004448c0
test al, al
je 0x40d3be
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043ca80
test al, al
je 0x40d3b9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xaef744bb
mov dword [esp + 8], 0x222c8e56
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d266
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d3d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d240
mov dword [esp + 4], 0xe69a3e3
mov dword [esp + 8], 0x1461c2f9
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40d2b6
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d430
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40d290
mov dword [esp + 4], 0x43424121
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x40d306
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d490
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x40d2e0
test esi, esi
je 0x40d356
mov dword [esp + 4], 0x19876dd3
mov dword [esp + 8], 0x4348bc7a
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d356
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d4f0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d330
mov dword [esp + 4], 0x9e9f9899
mov dword [esp + 8], 0xa2a39c9d
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d3a6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d570
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d380
call fcn.0040ea50
test al, al
je 0x40d3b9
call fcn.004127d0
call fcn.00410820
call fcn.00445990
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, ecx
mov edi, dword [esp + 0x6c]
add edi, dword [ecx + 0x60]
mov word [esp + 4], 0x4b4d
mov byte [esp + 6], 0x42
mov word [esp + 7], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 4
ja 0x40d85b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x18]
push eax
call fcn.0040e590
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 5
jb 0x40d830
mov dword [esp + 0xc], 0x2e24203e
mov word [esp + 0x10], 0x132a
mov dword [esp + 0x12], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 9
ja 0x40d8bb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 0xc]
push dword [esp + 0x18]
push eax
call fcn.0040e540
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 0xa
jb 0x40d890
mov dword [esp + 0x18], 0x26206c6d
mov dword [esp + 0x1c], 0x2222707c
mov dword [esp + 0x20], 0x2f3a207d
mov dword [esp + 0x24], 0x2a272e23
mov dword [esp + 0x28], 0x62372322
mov dword [esp + 0x2c], 0x38559f99
mov dword [esp + 0x30], 0x353f2d36
mov dword [esp + 0x34], 0x365a7028
mov dword [esp + 0x38], 0xd0cdd1d3
mov dword [esp + 0x3c], 0xc8cfd1cd
mov dword [esp + 0x40], 0xcd8a93c6
mov dword [esp + 0x44], 0x82c3dfc3
mov dword [esp + 0x48], 0xd2c6d0d4
mov dword [esp + 0x4c], 0xd6d8958f
mov dword [esp + 0x50], 0x9987dcd5
mov byte [esp + 0x54], 0x7c
mov dword [esp + 0x55], 0
mov word [esp + 0x59], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x42
ja 0x40d986
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.0040e4c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x43
jb 0x40d960
mov ecx, dword [esp + 0x70]
movzx edx, byte [esp + 0x18]
mov eax, edi
test dl, dl
je 0x40d9ab
lea ebx, [esp + 0x19]
mov eax, edi
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d9a0
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d9cb
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d9c0
mov ecx, dword [esp + 0x74]
mov byte [eax], 0
movzx edx, byte [esp + 0xc]
test dl, dl
je 0x40d9eb
lea ebx, [esp + 0xd]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d9e0
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40da0b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40da00
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x40da2b
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40da20
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x4127d0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44f8d8]

Function at 0x425500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x425520
cmp eax, 0xffffffdd
jge 0x425537
mov eax, 0xffffffff
jmp 0x42553a
add eax, 0x22
push eax
call fcn.0040ca60
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0xf76909ac
mov dword [esp + 0x1c], 0xf361f568
mov dword [esp + 0x20], 0xff5ff16e
mov dword [esp + 0x24], 0xfb57fd57
mov dword [esp + 0x28], 0xe74af95c
mov dword [esp + 0x2c], 0xe348e549
mov dword [esp + 0x30], 0xef73e141
mov dword [esp + 0x34], 0xeb76ed78
mov word [esp + 0x38], 0xe9e8
mov dword [esp + 0x3a], 0
mov byte [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x26
ja 0x4255db
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00426250
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x27
jb 0x4255b0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x425601
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4255f0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x425631
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425620
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x93659165
mov dword [esp + 0x1c], 0xaf9bad26
mov dword [esp + 0x20], 0xab22a955
mov dword [esp + 0x24], 0xa75ba528
mov dword [esp + 0x28], 0xa351a156
mov dword [esp + 0x2c], 0xbf49bd45
mov dword [esp + 0x30], 0xbb81b94e
mov dword [esp + 0x34], 0xb78db58f
mov dword [esp + 0x38], 0xb354b18a
mov dword [esp + 0x3c], 0x4fbd4dc1
mov dword [esp + 0x40], 0x4bb849b5
mov dword [esp + 0x44], 0x47b14587
mov dword [esp + 0x48], 0x43ce41b6
mov dword [esp + 0x4c], 0x5fd65da1
mov dword [esp + 0x50], 0x5b8359d4
mov dword [esp + 0x54], 0x579355a8
mov dword [esp + 0x58], 0x5352516a
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x425716
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.004262d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x4256f0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x4259f0
push ecx
push esi
call fcn.00426630
add esp, 0x10
jmp dword [0x4506e8]
Function at 0x439010
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x439030
cmp eax, 0
setne al
jmp 0x439038
xor ebx, ebx
test al, 1
jne 0x439043
jmp 0x439172
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x43916c
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.0041a9d0
add esp, 4
mov edx, eax
xor ebx, ebx
cmp edx, 0
je 0x439160
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0x51
mov byte [ebp - 0x27], 0x7f
mov byte [ebp - 0x26], 0x7d
mov byte [ebp - 0x25], 0x79
mov byte [ebp - 0x24], 0x76
mov byte [ebp - 0x23], 0x76
mov byte [ebp - 0x22], 0x79
mov byte [ebp - 0x21], 0x8b
mov byte [ebp - 0x20], pe_nt_image_headers32
mov byte [ebp - 0x1f], 0x31
mov byte [ebp - 0x1e], 0x8e
mov byte [ebp - 0x1d], 0x89
mov byte [ebp - 0x1c], 0x8c
mov byte [ebp - 0x1b], 0x1f
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x11
jne 0x4390e6
jmp 0x4390f5
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x11
jae 0x439135
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.0043c9d0
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x4390fc
jmp 0x439137
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d770
mov bl, al
jmp 0x439157
and bl, 1
jmp 0x43915c
jmp 0x43915e
jmp 0x439160
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403a90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404de1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x408460]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi + 0x24], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x2c], edi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x14], ecx
mov cl, byte [ebp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x30], edi
test cl, cl
jne 0x403b63
mov dword [ebp + 0x28], edi
test eax, eax
je 0x403b30
lea ecx, [edx + 0xc]
mov edx, eax
mov eax, dword [ecx]
cmp eax, edi
jbe 0x403b1a
mov edi, eax
add ecx, 0x10
dec edx
jne 0x403b12
mov dword [ebp + 0x28], edi
mov eax, 0x406784
cmp edi, 0x100000
ja 0x403b33
lea eax, [ebp + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x28], eax
add eax, 0xa
push eax
call fcn.00404230
mov edi, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edi
je 0x403b59
push eax
call fcn.004042c6
add esp, 4
mov dword [esi + 0x24], edi
push 0
call fcn.004042c6
add esp, 4
xor ecx, ecx
mov eax, ebx
mov edx, 0x44
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00404230
add esp, 4
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x403baf
push 0x402640
push 0x402600
push ebx
lea edi, [eax + 4]
push 0x44
push edi
mov dword [eax], ebx
call fcn.0040438d
jmp 0x403bb1
xor edi, edi
mov eax, dword [esi + 0x2c]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x403be0
test eax, eax
je 0x403bdd
mov ecx, dword [eax - 4]
lea ebx, [eax - 4]
push 0x402640
push ecx
push 0x44
push eax
call fcn.0040432a
push ebx
call fcn.004042c6
add esp, 4
mov dword [esi + 0x2c], edi
mov ecx, esi
call fcn.004036d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24

Function at 0x710c88
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x7109ec
mov eax, 0xa469e92b
and eax, edx
mov eax, eax
call fcn.00710cbe
and edx, eax
xor dword [ecx], esi
sub edx, 0x7778cbe1
inc eax
add edx, 0xf24b0aad
inc ecx
and eax, edx
or edx, edx
sub edx, eax
cmp ecx, edi
jne fcn.00710c88
and eax, edx
ret