joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423e00
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x48706c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x423ecc
push dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x20], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x20]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x120], esi
push eax
push 0
lea eax, [ebp - 0x124]
mov dword [ebp - 0x124], 1
push eax
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x10], 1
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.WS2_32.dll_select]
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
je 0x423ecc
js 0x423ecc
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042bab5
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0042bab5
mov esp, ebp
pop ebp
ret 8

Function at 0x427220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4696f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x48706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00424840
mov dword [ebp - 4], 0
lea esi, [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
mov eax, 0x8421085
mul ebx
mov ecx, ebx
mov eax, 0x51eb851f
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0xe
lea edi, [ebx + ecx*4]
add ecx, 0x85
add edi, ecx
imul ecx, ebx, 0x6e
mul ecx
shr edx, 5
sub edx, 0xffffff80
cmp edx, edi
cmova edi, edx
cmp dword [ebp - 0x14], 0x10
push edi
cmovae esi, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edi
call fcn.0044ad11
mov edi, eax
lea edx, [ebp - 0x2c]
push ebx
push esi
mov ecx, edi
call fcn.0041ef00
mov edx, dword [ebp - 0x2c]
mov ecx, 1
add esp, 0xc
cmp edx, ecx
jbe 0x4272dc
nop dword [eax]
mov al, byte [ecx + edi - 1]
xor byte [ecx + edi], al
inc ecx
cmp ecx, edx
jb 0x4272d0
mov eax, dword [ebp - 0x30]
mov dword [eax], edi
mov eax, dword [ebp - 0x34]
mov dword [eax], edx
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x427316
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42730c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x427334
push edx
push ecx
call fcn.0042bafb
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bab5
mov esp, ebp
pop ebp
ret 8
call fcn.0044acc1
int3
Function at 0x42e9fa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x45894c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004587cb

Function at 0x45aef9
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045adfe

Function at 0x45fb05
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f7c5

Function at 0x4059f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426d76
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x45190c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x428da8
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], edx
or dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], ecx
mov eax, dword [ecx + 4]
and dword [ebx + 0x8c], 0xffffffc0
and byte [ebx + 0x91], 0x80
or dword [ebx + 0x94], 0xffffffff
or dword [ebx + 0x98], 0xffffffff
mov dword [ebx + 0x64], eax
xor eax, eax
inc eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], edx
mov byte [ebx + 0x90], 0x4f
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], edx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x405acb
mov eax, dword [ecx + 0x24]
mov dword [ebx + 0x78], eax
mov dword [ecx + 0x24], ebx
mov eax, dword [ebx + 0x5c]
lea edi, [ebx + 0x58]
push 1
push edx
push edi
mov dword [eax + 4], ebx
lea esi, [ebx + 0x54]
mov ecx, dword [ebx + 0x60]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 4
push dword [esi]
mov esi, dword [0x4280f8]
push 6
call esi
push 8
push dword [edi]
mov dword [ebx + 0x7c], eax
push 2
call esi
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x88], eax
mov eax, ebx
mov dword [ebx + 0x84], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4025e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x402643
test edx, edx
je 0x402643
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
mov esi, 0x1505
je 0x40262d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + eax]
test ecx, ecx
je 0x40262d
mov ebx, esi
shl ebx, 5
mov edi, ebx
and edi, esi
xor ebx, esi
add ebx, ecx
lea esi, [ebx + edi*2]
inc eax
cmp ebp, eax
jne 0x402610
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jae 0x40264b
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402664
inc ebx
dec ebp
je 0x402641
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402641
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402660
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408d90
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402660
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408db0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402660
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402643
Function at 0x4033f0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4035c6
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4035bf
mov dword [esp], ebp
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x40347f
mov eax, dword [esp + 4]
add dword [esp], eax
mov esi, dword [esp + 0xc]
mov eax, edi
mov ebp, 0x80078071
mul ebp
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mul ebp
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 8]
mov ebx, 0x15b0
je 0x4035bf
xor ebp, ebp
cmp ebx, 8
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
jb 0x40351c
mov eax, ebx
and eax, 0x1ff8
mov dword [esp + 4], eax
xor edx, edx
mov ebp, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx ebx, byte [ebp + edx]
add ebx, edi
movzx edx, byte [ebp + edx + 1]
add edx, ebx
mov esi, ebx
and esi, ecx
xor ebx, ecx
movzx ecx, byte [ebp + eax + 2]
add ecx, edx
add ebx, edx
movzx edx, byte [ebp + eax + 3]
add edx, ecx
add ebx, ecx
lea ecx, [ebx + esi*2]
mov ebx, dword [esp + 8]
movzx esi, byte [ebp + eax + 4]
add esi, edx
add ecx, edx
movzx edx, byte [ebp + eax + 5]
add edx, esi
add ecx, esi
movzx esi, byte [ebp + eax + 6]
add esi, edx
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, esi
add ecx, esi
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, ebx
jb 0x4034b0
add ebp, edx
mov dword [esp], ebp
mov esi, dword [esp + 0xc]
mov ebp, dword [esp + 4]
mov eax, ebx
sub eax, ebp
jbe 0x40344b
mov edx, ebp
not edx
add edx, ebx
mov esi, ebx
and esi, 3
mov dword [esp + 4], eax
je 0x40356e
mov dword [esp + 0x10], edx
neg esi
xor edx, edx
mov ebx, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x403550
sub ebp, edx
mov edx, dword [esp + 0x10]
cmp edx, 3
jb 0x403440
jmp 0x40357a
mov ebx, dword [esp]
cmp edx, 3
jb 0x403440
mov eax, dword [esp + 8]
sub eax, ebp
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403590
jmp 0x403440
shl ecx, 0x10
or ecx, edi
jmp 0x4035cb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4035e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403632
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
lea eax, [esi + esi]
not eax
add eax, esi
test edx, edx
je 0x40362e
xor esi, esi
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43fa18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43fa18]
inc esi
cmp edx, esi
jne 0x403600
not eax
jmp 0x403634
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x408bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, ebp
jbe 0x408c1d
lea ecx, [esi + ebp]
cmp ecx, eax
jbe 0x408c1d
test esi, esi
je 0x408cdd
lea ecx, [esi + ebp]
dec ecx
lea edx, [eax + esi]
dec edx
mov edi, esi
and edi, 7
je 0x408c81
neg edi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + ebx]
mov byte [edx + ebx], al
dec ebx
cmp edi, ebx
jne 0x408c00
add edx, ebx
lea edi, [esi + ebx]
add ecx, ebx
cmp esi, 8
jae 0x408c88
jmp 0x408cdd
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ebx, esi
and ebx, 0xfffffffc
add eax, ebx
add ebx, ebp
mov ebp, esi
and ebp, 3
mov ecx, ebp
shr ecx, 1
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov ecx, ebp
xor ecx, 0xfffffffe
or ebp, 1
and ebp, ecx
je 0x408cdd
and esi, 2
movzx ecx, byte [ebx + esi]
mov byte [eax + esi], cl
cmp ebp, 1
je 0x408cdd
movzx ecx, byte [ebx + esi + 1]
mov byte [eax + esi + 1], cl
cmp ebp, 2
je 0x408cdd
movzx ecx, byte [ebx + esi + 2]
mov byte [eax + esi + 2], cl
jmp 0x408cdd
mov edi, esi
cmp esi, 8
jb 0x408cdd
neg edi
xor esi, esi
nop
nop
nop
nop
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
movzx eax, byte [ecx + esi - 1]
mov byte [edx + esi - 1], al
movzx eax, byte [ecx + esi - 2]
mov byte [edx + esi - 2], al
movzx eax, byte [ecx + esi - 3]
mov byte [edx + esi - 3], al
movzx eax, byte [ecx + esi - 4]
mov byte [edx + esi - 4], al
movzx eax, byte [ecx + esi - 5]
mov byte [edx + esi - 5], al
movzx eax, byte [ecx + esi - 6]
mov byte [edx + esi - 6], al
movzx eax, byte [ecx + esi - 7]
mov byte [edx + esi - 7], al
add esi, 0xfffffff8
cmp edi, esi
jne 0x408c90
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x409320
Capabilities:
Terminate process

Disassembly:
sub esp, 0x124
call fcn.0043a200
test al, 1
jne 0x409334
jmp 0x4093fe
call fcn.00432850
test al, 1
jne 0x409342
jmp 0x4093f7
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 8
cmp eax, 0
jl 0x4093f5
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
sub esp, 0x24
cmp eax, 0
jl 0x4093eb
call fcn.0040a440
test al, 1
jne 0x4093c7
jmp 0x4093e9
lea eax, [esp + 0x24]
lea ecx, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409410
call fcn.0040ee50
call fcn.0040c350
jmp 0x4093e9
jmp 0x4093eb
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4093f3
jmp 0x4093f5
jmp 0x4093f7
call fcn.0043a550
jmp 0x4093fe
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x4095aa
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x4094bd
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4094e1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x4094b0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x4094b0
lea esi, [ebx + 1]
push esi
call fcn.00408b20
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x4095b8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409528
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x4095ba
movzx edx, word [edi]
test dx, dx
je 0x4095ba
cmp dx, 0x7f
jbe 0x409510
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x409570
cmp esi, 0x7ff
ja 0x409570
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409517
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x409517
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409517
push 1
call fcn.00408b20
add esp, 4
mov ebp, eax
jmp 0x4095ba
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4095d7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x4095d2
test eax, eax
jne 0x4095d0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405800
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x415ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x415ad0
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x415af0
sar ebx, 1
sar eax, 1
lea ecx, [ebx + eax]
add ecx, 2
test ecx, ecx
jns 0x415b10
mov eax, 0xffffffff
jmp 0x415b17
add eax, ebx
add eax, eax
add eax, 4
push eax
call fcn.00408b20
add esp, 4
mov edi, eax
movzx ecx, word [esi]
test cx, cx
je 0x415b41
add esi, 2
mov eax, edi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x415b30
mov word [eax], 0x5c
add eax, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x415b71
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415b60
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043cb20
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443dcc]
Function at 0x415e70
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x415e90
sar esi, 1
lea edi, [esp + 0x6c]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x449c84]
mov ebx, dword [esp + 0x6c]
test ebx, ebx
jns 0x415ebf
mov eax, 0xffffffff
jmp 0x415ec2
lea eax, [ebx + ebx]
push eax
call fcn.00408b20
add esp, 4
push edi
push ebx
mov dword [esp + 0x20], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x449c84]
mov dword [esp + 0x20], 0xabdeadc8
mov dword [esp + 0x24], 0xd749a9c9
mov dword [esp + 0x28], 0xd3f2d548
mov dword [esp + 0x2c], 0xdfb3d1aa
mov dword [esp + 0x30], 0xdb45dd42
mov dword [esp + 0x34], 0xc755d9b1
mov dword [esp + 0x38], 0xc3c2c556
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov word [esp + 0x44], 0
mov dword [esp + 0xa8], 0
mov ecx, dword [esp + 0xa8]
cmp ecx, 0x25
ja 0x415faf
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0xa8]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx + 0xba]
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
add ecx, 0xf48f81ba
mov dword [esp + 0x78], ecx
mov ecx, dword [esp + 0x78]
mov edx, ecx
or edx, 0xe9
and ecx, 0xe9
add ecx, edx
inc cl
mov edx, dword [esp + 0xa8]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0xa8]
mov ecx, dword [esp + 0xa8]
cmp ecx, 0x26
jb 0x415f50
lea edi, [esp + 0xa8]
lea edx, [esp + 0x20]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xc4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x6c]
mov ecx, eax
add ecx, 0xd
mov ebx, dword [ebp + 8]
jns 0x415fe8
mov eax, 0xffffffff
jmp 0x415fed
add eax, eax
add eax, 0x1a
push eax
call fcn.00408b20
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x416021
mov eax, dword [esp + 0x18]
lea edx, [eax + 2]
mov eax, esi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416010
mov word [eax], 0
movzx ecx, word [esp + 0xa8]
test cx, cx
je 0x416051
lea edx, [esp + 0xaa]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416040
mov word [eax], 0
lea eax, [esp + 0x58]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x20], esi
push esi
call fcn.0043cb20
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x444034]

Function at 0x417100
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
xor esi, esi
mov dword [esp + 8], 0
xor edx, edx
jmp dword [eax*4 + 0x444174]
Function at 0x42ebd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov dword [esi + 0x14], esp
push eax
mov ebx, esp
sub esp, 0x18
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov dword [esi + 0x20], esp
mov dword [esi + 0x24], eax
jmp 0x42ebfb
mov byte [esi + 7], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x42ec19
test al, 1
jne 0x42ec22
jmp 0x42ed80
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x42ec3e
mov dword [esi + 0x2c], eax
jmp 0x42ec43
jmp 0x42ec45
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esi + 0xc], eax
jmp 0x42ec5a
mov eax, dword [esi + 0xc]
jmp 0x42ec5f
jmp 0x42ec61
jmp 0x42ec63
cmp eax, 0
je 0x42ed78
mov eax, dword [esi + 0xc]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00408d90
add esp, 4
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x42ed69
call fcn.0040ee40
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx]
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
mov bl, byte [eax]
mov byte [esi + 0x10], bl
mov byte [edi], 0x23
mov byte [edi + 1], 0xd
mov byte [edi + 2], 0xb
mov byte [edi + 3], 0xf3
mov byte [edi + 4], 6
mov byte [edi + 5], 0xa
mov byte [edi + 6], 7
mov byte [edi + 7], 0xf5
mov byte [edi + 8], 0xc
mov byte [edi + 9], 0x47
mov byte [edi + 0xa], 0xfe
mov byte [edi + 0xb], 0xf3
mov byte [edi + 0xc], 0xf8
mov byte [edi + 0xd], 0x6d
mov byte [edi + 0x10], 0
mov word [edi + 0xe], 0
mov dword [esi + 8], 0
mov ebx, dword [esi + 8]
cmp ebx, 0x11
jae 0x42ed4c
mov dword [esi + 0x1c], edx
jmp 0x42ed0a
mov edx, dword [esi + 8]
mov eax, dword [esi + 8]
movzx eax, byte [edi + eax]
mov ebx, edx
add ebx, 0xf0
add edx, eax
and ebx, eax
add ebx, ebx
sub edx, ebx
add edx, 0x46f5f7f0
mov dword [esi + 0x28], edx
mov eax, dword [esi + 0x28]
add al, 0x70
mov edx, dword [esi + 8]
mov byte [edi + edx], al
mov eax, dword [esi + 8]
inc eax
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0x11
jb 0x42ed0a
mov edx, dword [esi + 0x1c]
jmp 0x42ed4c
sub esp, 0xc
mov dword [esp], edi
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00409630
and al, 1
mov byte [esi + 7], al
jmp 0x42ed69
mov eax, dword [esi + 0xc]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42ed80
mov al, byte [esi + 7]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov eax, 0xfffffffe
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x435080
test eax, eax
je 0x4350a3
mov ebx, eax
sar ebx, 1
test al, 2
jne 0x4350aa
mov edx, ebx
cmp ebx, 1
jne 0x4350df
jmp 0x43514a
mov eax, edi
jmp 0x43514a
lea edx, [ebx - 1]
movzx eax, word [ecx]
add ecx, 2
xor eax, edi
mov esi, eax
and esi, 0xfefffe6c
mov edi, eax
and edi, 0x1000193
or eax, 0x1000193
imul eax, edi
xor edi, 0x1000193
imul edi, esi
add eax, edi
mov edi, eax
cmp ebx, 1
je 0x43514a
xor esi, esi
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
mov eax, edi
and eax, 0xfefffe6c
mov ebx, edi
and ebx, 0x1000193
or edi, 0x1000193
imul edi, ebx
xor ebx, 0x1000193
imul ebx, eax
add edi, ebx
movzx eax, word [ecx + esi*2 + 2]
xor eax, edi
mov edi, eax
and edi, 0xfefffe6c
mov ebx, eax
and ebx, 0x1000193
or eax, 0x1000193
imul eax, ebx
xor ebx, 0x1000193
imul ebx, edi
add eax, ebx
add esi, 2
cmp edx, esi
jne 0x4350f0
pop esi
pop edi
pop ebx
ret