joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x423490
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x451b28]
mov edi, dword [esp]
test edi, edi
jns 0x4234bc
mov eax, 0xffffffff
jmp 0x4234bf
lea eax, [edi + edi]
push eax
call fcn.0040cee0
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x451b28]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.004454e0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44caf8]

Function at 0x4255e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4255f0
cmp eax, 0xffffffed
jge 0x425607
mov eax, 0xffffffff
jmp 0x42560a
add eax, 0x12
push eax
call fcn.0040cee0
add esp, 4
mov esi, eax
mov dword [esp], 0x1fb11944
mov dword [esp + 4], 0x63db1db9
mov dword [esp + 8], 0x67146114
mov dword [esp + 0xc], 0x6bcc65c0
mov dword [esp + 0x10], 0x6968
mov byte [esp + 0x14], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
xor edx, 0x38ffd01
mov ebx, eax
and ebx, 0x3c
sub ebx, edx
lea edx, [ebx + 0x3a]
add ebx, ebx
and ebx, 2
xor edx, 0xfe
sub edx, ebx
xor dl, byte [esp + ecx]
mov bl, 0xdd
sub bl, dl
mov byte [esp + ecx], bl
inc ecx
add eax, 2
cmp ecx, 0x15
jne 0x425650
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4256b1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4256a0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4256e1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4256d0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.004454e0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44cbc0]
Function at 0x428130
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp + 4], 0x19ce1bf7
mov dword [esp + 8], 0xe54be7a9
mov dword [esp + 0xc], 0xe156e34b
mov dword [esp + 0x10], 0xed5eef2f
mov dword [esp + 0x14], 0xe926eb5c
mov dword [esp + 0x18], 0xf54af747
mov dword [esp + 0x1c], 0xf119f35b
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 0x20], 0xfff0
mov byte [esp + 0x24], 0
mov ecx, 0xf5f40fb
mov edx, 0xe1417f04
movzx edi, byte [esp + ecx - 0xf5f40f7]
mov esi, edx
or esi, edi
lea ebp, [edx + 0x1ebe8100]
and ebp, 0xec
mov ebx, ecx
and ebx, 0x13
or ebx, ebp
lea ebp, [edi + edi]
not ebp
add ebp, edi
xor ebx, 0xec
or ebx, ebp
and ebx, esi
mov al, 0x18
sub al, bl
mov byte [esp + ecx - 0xf5f40f7], al
inc ecx
dec edx
cmp ecx, 0xf5f411c
jne 0x428190
lea ebx, [esp + 0x7a]
lea eax, [esp + 4]
mov edi, ebx
mov ecx, 7
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x96]
mov ecx, 1
mov eax, dword [esp]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x64]
push edi
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x451b28]
mov esi, dword [esp + 0x64]
mov ebp, 0xffffffff
test esi, esi
jns 0x428224
mov eax, 0xffffffff
jmp 0x428227
lea eax, [esi + esi]
push eax
call fcn.0040cee0
add esp, 4
push edi
push esi
mov dword [esp + 0x70], eax
push eax
push 0xe
push ebx
push 0
call dword [0x451b28]
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
js 0x428254
lea ebp, [eax*2 + 0x12]
push ebp
call fcn.0040cee0
add esp, 4
mov ebp, eax
mov dword [esp + 4], 0xc3b2c1bc
mov dword [esp + 8], 0xc7a5c5a5
mov dword [esp + 0xc], 0xcbabc9a3
mov dword [esp + 0x10], 0xcfabcdab
mov dword [esp + 0x14], 0xf3f2f163
mov dword [esp + 0x18], 0
mov eax, 0xd0
mov ecx, 0x2f
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xcc]
mov edi, ecx
or edi, esi
mov edx, edi
sub edx, esi
add edx, eax
and edx, edi
mov bl, 0xef
sub bl, dl
mov byte [esp + eax - 0xcc], bl
inc eax
dec ecx
cmp eax, 0xe8
jne 0x4282a0
mov esi, dword [esp + 0x68]
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x4282f1
lea edx, [esi + 2]
mov eax, ebp
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4282e0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x428321
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428310
mov word [eax], 0
lea eax, [esp + 0x74]
push eax
push ebp
call fcn.004454e0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d43c]
Function at 0x42de10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc0
mov dword [esp + 0x30], 0xf7b7f985
mov dword [esp + 0x34], 0xf342f544
mov dword [esp + 0x38], 0xcf6ff1ac
mov dword [esp + 0x3c], 0xcb6bcd40
mov dword [esp + 0x40], 0xc762c9b5
mov dword [esp + 0x44], 0xc371c596
mov dword [esp + 0x48], 0xdf63c14c
mov dword [esp + 0x4c], 0xdb7bdd6c
mov dword [esp + 0x50], 0xd7a1d964
mov dword [esp + 0x54], 0xd376d5a3
mov dword [esp + 0x58], 0x2f93d15f
mov dword [esp + 0x5c], 0x2ba52da3
mov dword [esp + 0x60], 0x27952991
mov dword [esp + 0x64], 0x23502596
mov dword [esp + 0x68], 0x3f8b21a8
mov dword [esp + 0x6c], 0x3b3a3d88
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x56
xor dl, byte [esp + ecx + 0x30]
add dl, 0x52
mov byte [esp + ecx + 0x30], dl
inc ecx
cmp ecx, 0x44
jne 0x42deb0
lea ebx, [esp + 0x80]
lea edx, [esp + 0x30]
mov edi, ebx
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xc0]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x7c]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x451b28]
mov edi, dword [esp + 0x7c]
test edi, edi
jns 0x42df0f
mov eax, 0xffffffff
jmp 0x42df12
lea eax, [edi + edi]
push eax
call fcn.0040cee0
add esp, 4
mov ebp, eax
push esi
push edi
push eax
push 0x1f
push ebx
push 0
call dword [0x451b28]
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00445330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44dedc]
Function at 0x432090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx eax, word [esi]
test ax, ax
je 0x4321cf
mov edx, dword [esp + 0x18]
dec edx
je 0x4321cf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x4320e0
lea ecx, [ebp + 1]
mov byte [ebp], bl
jmp 0x432170
cmp ebx, 0x7ff
ja 0x432110
cmp edx, 2
jb 0x432110
mov eax, ebx
shr eax, 6
or al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea ecx, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x432170
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x432194
cmp edx, 4
jb 0x432194
movzx eax, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea ecx, [ebx + eax]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
and al, 0x3f
or al, 0x80
lea ecx, [ebp + 4]
mov byte [ebp + 3], al
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
not eax
and eax, ebp
not ebp
and ebp, ecx
sub edx, ebp
add edx, eax
mov esi, edi
mov ebp, ecx
movzx eax, word [esi]
test ax, ax
je 0x4321cf
test edx, edx
jne 0x4320c0
jmp 0x4321cf
movzx eax, ax
cmp eax, 0xdc00
jne 0x4321a2
mov esi, edi
jmp 0x432182
cmp edx, 3
jb 0x4321cb
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea ecx, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x432170
mov ecx, ebp
jmp 0x432170
mov byte [ebp], 0
mov ecx, ebp
mov eax, dword [esp + 0x14]
xor ecx, eax
not eax
and eax, ebp
add eax, eax
sub eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
call fcn.0040e850
push eax
push eax
test ebx, ebx
sets al
mov ecx, ebx
sub ecx, 1
sete cl
or al, cl
mov ecx, ebx
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x4343b5
jmp 0x4343ba
jmp 0x434546
mov ecx, edi
add ecx, esi
add ecx, 0xffffffff
mov byte [edi + esi - 1], 0
mov edi, dword [ebp + 8]
cmp edi, 0
jne 0x4343dc
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], 0x30
jmp 0x434544
cmp ebx, 0xa
sete al
jmp 0x4343e4
test al, 1
jne 0x4343ed
jmp 0x434474
jmp 0x4343ef
cmp edi, 0x64
setae al
test al, 1
jne 0x4343fb
jmp 0x434435
mov esi, 0x64
mov eax, edi
xor edx, edx
div esi
shl edx, 1
mov al, byte [edx + 0x448761]
mov esi, ecx
add esi, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [edx + 0x448760]
add esi, 0xffffffff
mov byte [ecx - 2], al
mov ecx, 0x64
mov eax, edi
xor edx, edx
div ecx
mov edi, eax
mov ecx, esi
jmp 0x4343ef
cmp edi, 0xa
jae 0x43444f
mov al, byte [edi + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
jmp 0x434443
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
jmp 0x43444d
jmp 0x43446f
shl edi, 1
mov al, byte [edi + 0x448761]
mov edx, edi
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [edx + 0x448760]
add edi, 0xffffffff
mov byte [ecx - 2], al
jmp 0x434544
cmp ebx, 0x10
je 0x43447e
jmp 0x434513
jmp 0x434480
cmp edi, 0x100
jb 0x4344d4
mov eax, edi
and eax, 0xff
mov esi, eax
xor esi, 0xffffffff
and esi, 2
mov edx, eax
and edx, 0xfffffffd
imul edx, esi
mov esi, eax
and esi, 2
or eax, 2
imul eax, esi
sub eax, 0x630efbdd
add eax, edx
mov dl, byte [eax + 0x63538407]
mov esi, ecx
add esi, 0xffffffff
mov byte [ecx - 1], dl
mov al, byte [eax + 0x63538406]
add esi, 0xffffffff
mov byte [ecx - 2], al
shr edi, 8
mov ecx, esi
jmp 0x434480
cmp edi, 0x10
setb al
test al, 1
jne 0x4344e0
jmp 0x4344f1
mov al, byte [edi + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
jmp 0x434544
shl edi, 1
mov al, byte [edi + 0x44882a]
mov edx, edi
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [edx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add edi, 0xffffffff
mov byte [ecx - 2], al
jmp 0x434544
cmp edi, 0
seta al
test al, 1
jne 0x43451f
jmp 0x434540
mov eax, edi
xor edx, edx
div ebx
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, ecx
add esi, 0xffffffff
mov byte [ecx - 1], al
mov eax, edi
xor edx, edx
div ebx
mov edi, eax
mov ecx, esi
jmp 0x434513
mov edi, ecx
jmp 0x434544
jmp 0x434546
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434830
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x330
mov dword [esp + 0x328], 0x44e81c
mov dword [esp + 0xd8], 0
lea eax, [esp + 0xd8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x448aa0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x448ab0
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x324], eax
mov eax, dword [esp + 0x328]
mov ecx, dword [esp + 0x324]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x320], 0x44e824
mov dword [esp + 0x318], 0x44e82c
mov dword [esp + 0x310], 0x44e834
mov dword [esp + 0x308], 0x44e83c
mov dword [esp + 0x300], 0x44e844
mov dword [esp + 0x2f8], 0x44e84c
mov dword [esp + 0x2f0], 0x44e854
mov dword [esp + 0x2e8], 0x44dff0
mov dword [esp + 0x2e4], 0xaa
mov dword [esp + 0x2e0], 0x44e85c
mov dword [esp + 0x2d8], 0x44e864
mov dword [esp + 0x2d0], 0x44e86c
mov dword [esp + 0x2c8], 0x44dff0
mov dword [esp + 0x2c4], 0xb1
mov dword [esp + 0x2c0], 0x44e874
mov dword [esp + 0x2b8], 0x44e87c
mov dword [esp + 0x2b0], 0x44dff0
mov dword [esp + 0x2ac], 0xb1
mov dword [esp + 0x2a8], 0x44e884
mov dword [esp + 0x2a0], 0x44e88c
mov dword [esp + 0x298], 0x44e894
mov dword [esp + 0x290], 0x44e89c
mov dword [esp + 0x288], 0x44e8a4
mov dword [esp + 0x280], 0x44e8ac
mov dword [esp + 0x278], 0x44dff0
mov dword [esp + 0x274], 0xb8
mov dword [esp + 0x270], 0x44dff0
mov dword [esp + 0x26c], 0xb9
mov dword [esp + 0x268], 0x44dff0
mov dword [esp + 0x264], 0xba
mov dword [esp + 0x260], 0x44e8b4
mov dword [esp + 0x258], 0x44e8bc
mov dword [esp + 0x250], 0x44e8c4
mov dword [esp + 0x248], 0x44dff0
mov dword [esp + 0x244], 0xbe
mov dword [esp + 0x240], 0x44e8cc
mov dword [esp + 0x238], 0x44dff0
mov dword [esp + 0x234], 0xc0
mov dword [esp + 0x230], 0x44e8d4
mov dword [esp + 0x228], 0x44e8dc
mov dword [esp + 0x220], 0x44dff0
mov dword [esp + 0x21c], 0xc3
mov dword [esp + 0x218], 0x44dff0
mov dword [esp + 0x214], 0xc4
mov dword [esp + 0x210], 0x44e8e4
mov dword [esp + 0x208], 0x44e8ec
mov dword [esp + 0x200], 0x44dff0
mov dword [esp + 0x1fc], 0xc7
mov dword [esp + 0x1f8], 0x44e8f4
mov dword [esp + 0x1f0], 0x44e8fc
mov dword [esp + 0x1e8], 0x44dff0
mov dword [esp + 0x1e4], 0xca
mov dword [esp + 0x1e0], 0x44dff0
mov dword [esp + 0x1dc], 0xcb
mov dword [esp + 0x1d8], 0x44dff0
mov dword [esp + 0x1d4], 0xcc
mov dword [esp + 0x1d0], 0x44e904
mov dword [esp + 0x1c8], 0x44e90c
mov dword [esp + 0x1c0], 0x44dff0
mov dword [esp + 0x1bc], 0xa4
mov dword [esp + 0x1b8], 0x44dff0
mov dword [esp + 0x1b4], 0xa7
mov dword [esp + 0x1b0], 0x44dff0
mov dword [esp + 0x1ac], 0xac
mov dword [esp + 0x1a8], 0x44dff0
mov dword [esp + 0x1a4], 0xaf
mov dword [esp + 0x1a0], 0x44dff0
mov dword [esp + 0x19c], 0xb3
mov dword [esp + 0x198], 0x44dff0
mov dword [esp + 0x194], 0xb6
mov dword [esp + 0x190], 0x44dff0
mov dword [esp + 0x18c], 0xbb
mov dword [esp + 0x188], 0x44dff0
mov dword [esp + 0x184], 0xc1
mov dword [esp + 0x180], 0x44dff0
mov dword [esp + 0x17c], 0xc8
mov dword [esp + 0x178], 0x44dff0
mov dword [esp + 0x174], 0xce
xor edi, edi
jmp eax
Function at 0x436730
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, dword [esp + 0x48]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4368ff
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
cmp esi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x436795
jmp 0x4368f7
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00432020
jmp 0x4367ad
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4367bf
jmp 0x4368e9
mov dword [esp + 0x30], eax
mov ebx, eax
sub ebx, 0xffffffff
mov dword [esp], ebx
call fcn.0040cee0
mov dword [esp + 0x2c], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.00432090
jmp 0x4367e6
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0xa1
mov byte [esp + 0x15], 0x47
mov byte [esp + 0x16], 0x45
mov byte [esp + 0x17], 0x79
mov byte [esp + 0x18], 0x4e
mov byte [esp + 0x19], 0x7e
mov byte [esp + 0x1a], 0x49
mov byte [esp + 0x1b], 0x7b
mov byte [esp + 0x1c], 0x48
mov byte [esp + 0x1d], 0x81
mov byte [esp + 0x1e], 0x46
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x44
mov byte [esp + 0x21], 0xd7
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x12
jne 0x436839
jmp 0x436848
xor eax, eax
cmp eax, 0x12
jae 0x4368b5
movzx edx, byte [esp + eax + 0x14]
mov dword [esp + 0x28], edx
mov ebx, eax
xor ebx, 0xf0304e9f
mov ecx, eax
shl ecx, 1
and ecx, 0x1f9f62c0
sub ecx, ebx
mov ebx, ecx
add ebx, 0xf6
and ebx, edx
mov ebp, ebx
and ebp, 2
xor ebp, 2
mov edx, edi
mov edi, ebx
and edi, 0xfd
imul edi, ebp
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
add ebx, edi
mov edi, edx
add ecx, 0xf6
add ecx, dword [esp + 0x28]
add ecx, 0x2e
sub ecx, ebx
add cl, 0x1f
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x43684a
lea eax, [esp + 0x14]
mov ecx, edi
mov dword [esp], eax
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], edi
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
call fcn.0040dc00
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x4368dd
mov dword [esp], edi
call fcn.0040cef0
jmp 0x4368e7
jmp 0x4368e9
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x4368f7
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4368ff
and bl, 1
movzx eax, bl
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bbb0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x451b28]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0xf301f12d
mov dword [esp + 0x10], 0xef7ded65
mov dword [esp + 0x14], 0xeb77e964
mov dword [esp + 0x18], 0xe71ae571
mov dword [esp + 0x1c], 0xe37be172
mov dword [esp + 0x20], 0x9f039d12
mov dword [esp + 0x24], 0x9b9a9945
mov byte [esp + 0x28], 0
mov ecx, 0xb6775bac
mov edx, 0x4988a553
nop
movzx eax, byte [esp + ecx + 0x4988a460]
mov edi, ecx
and edi, eax
mov ebx, edi
and ebx, 2
mov esi, edi
or edi, 2
imul edi, ebx
xor ebx, 2
and esi, 0xfffffffd
imul esi, ebx
mov ebx, eax
sub ebx, esi
sub ebx, edi
add edi, esi
add ebx, ecx
sub edi, eax
mov eax, ebx
add edi, edx
and edi, 0xa3
and ebx, 0x5c
or ebx, edi
and eax, 0x23
lea eax, [ebx + eax*2]
inc al
mov byte [esp + ecx + 0x4988a460], al
inc ecx
dec edx
cmp ecx, 0xb6775bc9
jne 0x43bc10
lea eax, [esp + 0x54]
lea edi, [esp + 0x68]
lea ecx, [esp + 0xc]
push eax
push 8
push edi
push 0xd
push ecx
push 0
call dword [esp + 0x1c]
shr eax, 0x1f
jmp dword [eax*4 + 0x44f418]

Function at 0x43c540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00445a50
add esp, 0x14
test eax, eax
js 0x43c6b6
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00445e20
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43c5d7
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43c5a3
mov eax, 0xffffffff
jmp 0x43c5aa
lea eax, [eax*2 + 2]
push eax
call fcn.0040cee0
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.004464e0
add esp, 0x14
test eax, eax
js 0x43c5ce
mov esi, edi
jmp 0x43c5d7
push edi
call fcn.0040cef0
add esp, 4
mov eax, dword [esp]
mov dword [esp + 4], 0x20272625
mov byte [esp + 8], 0
mov ecx, 0xaee1bf39
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x511e40cb]
mov ebx, ecx
and ebx, 0x24
xor ebx, 0x401640a4
mov ebp, ecx
xor ebp, 0xce37d0a4
mov edx, ecx
or edx, 0x20c02f5b
and edx, ebp
or edx, ebx
xor edx, edi
mov edi, edx
xor edi, 0x4e37d0a4
mov ebx, edx
and ebx, 0x6a68bc1d
xor ebx, 0x35df6ffb
add ebx, edi
mov edi, edx
xor edi, 0x46
lea ebx, [edi + ebx*2]
add ebx, 2
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + ecx + 0x511e40cb], bl
inc ecx
cmp ecx, 0xaee1bf3e
jne 0x43c5f0
mov ecx, dword [0x451b2c]
test ecx, ecx
je 0x43c69a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x451b30]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43c680
inc edi
cmp ecx, edi
jne 0x43c670
jmp 0x43c69a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43c69a
push eax
push 1
push dword [0x451b34]
push ecx
call fcn.00442050
add esp, 0x10
test esi, esi
jne 0x43c6b8
lea eax, [esp + 4]
push eax
call fcn.00445130
add esp, 4
test al, al
je 0x43c6b6
cmp dword [esp + 4], 1
je 0x43c6b8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f730
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
setne al
jmp dword [eax*4 + 0x44f934]

Function at 0x43f830
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, ecx
mov dword [esp + 8], 0
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov esi, eax
and esi, 0xa
mov edi, ecx
xor edi, 0x76c0655d
add esi, edi
add esi, 0x382159dc
xor esi, edx
mov edx, esi
and edx, 0x62
xor esi, 0xe2
lea edx, [esi + edx*2]
inc dl
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 5
jne 0x43f860
mov edi, dword [esp]
mov eax, dword [0x451b2c]
test eax, eax
je 0x43f8e6
xor ecx, ecx
mov edx, dword [0x451b30]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43f8c0
inc ecx
cmp eax, ecx
jne 0x43f8b0
jmp 0x43f8e6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43f8e6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x451b34]
push eax
call fcn.00442050
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43fa15
mov dword [esp + 0x10], ebx
push dword [esp + 8]
call fcn.0043f6b0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov ebp, edx
and ebp, 0xa
mov edi, ecx
xor edi, 0x76c0655d
add edi, ebp
add edi, 0x382159dc
xor edi, esi
mov esi, edi
and esi, 0x62
xor edi, 0xe2
lea ebx, [edi + esi*2]
inc bl
mov byte [esp + ecx], bl
inc ecx
add edx, 2
cmp ecx, 5
jne 0x43f920
mov edi, dword [esp]
mov edx, dword [0x451b2c]
test edx, edx
je 0x43f980
xor ebp, ebp
mov esi, dword [0x451b30]
mov ebx, dword [esp + 0x28]
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43f986
inc ebp
cmp edx, ebp
jne 0x43f970
jmp 0x43f9ae
mov ebx, dword [esp + 0x28]
jmp 0x43f9ae
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43f9ae
push 0
push dword [esp + 0x10]
push eax
push 5
push 4
push dword [0x451b34]
push edx
mov esi, eax
call fcn.00442050
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43fa0c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43f9e5
add edi, 2
cmp si, bp
je 0x43f9d0
cmp si, bp
je 0x43f9f7
mov esi, dword [ecx]
test esi, esi
jne 0x43f9c0
mov edi, 0xc0000225
jmp 0x43fa0c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043f730
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4