joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebp, dword [esp + 0x450]
mov dword [esp + 0x3c], 0xd96bdb17
mov dword [esp + 0x40], 0xdd61df56
mov dword [esp + 0x44], 0xd16ed360
mov dword [esp + 0x48], 0xd527d777
mov dword [esp + 0x4c], 0xa958ab1f
mov dword [esp + 0x50], 0xad4eaf58
mov dword [esp + 0x54], 0xa10ba354
mov dword [esp + 0x58], 0xa514a71f
mov dword [esp + 0x5c], 0xb90bbb00
mov dword [esp + 0x60], 0xbd0bbf31
mov dword [esp + 0x64], 0xb160b35c
mov dword [esp + 0x68], 0xb556b764
mov dword [esp + 0x6c], 0x897a8b43
mov dword [esp + 0x70], 0x8d7e8f7a
mov dword [esp + 0x74], 0x81628341
mov dword [esp + 0x78], 0x85398729
mov dword [esp + 0x7c], 0x99509b36
mov dword [esp + 0x80], 0x9d539f6c
mov dword [esp + 0x84], 0x911a937c
mov dword [esp + 0x88], 0x9562975a
mov dword [esp + 0x8c], 0x698a6b6b
mov dword [esp + 0x90], 0x6dde6faf
mov dword [esp + 0x94], 0x61de63dc
mov dword [esp + 0x98], 0x65cf67db
mov dword [esp + 0x9c], 0x79dc7bdf
mov dword [esp + 0xa0], 0x7dc17fa5
mov dword [esp + 0xa4], 0x718373c8
mov dword [esp + 0xa8], 0x758377bb
mov dword [esp + 0xac], 0x49b84bbd
mov dword [esp + 0xb0], 0x4d844fbd
mov dword [esp + 0xb4], 0x41ba43ac
mov dword [esp + 0xb8], 0x459e479d
mov dword [esp + 0xbc], 0x59895b90
mov dword [esp + 0xc0], 0x5da25f84
mov dword [esp + 0xc4], 0x51ee53bc
mov dword [esp + 0xc8], 0x55eb57ef
mov dword [esp + 0xcc], 0x29ca2bef
mov dword [esp + 0xd0], 0x2d952ff1
mov dword [esp + 0xd4], 0x219f2389
mov dword [esp + 0xd8], 0x25d92791
mov dword [esp + 0xdc], 0x39ff3bc4
mov dword [esp + 0xe0], 0x3d883f80
mov dword [esp + 0xe4], 0x3181338d
mov dword [esp + 0xe8], 0x35c7378b
mov dword [esp + 0xec], 0x9fd0bc3
mov dword [esp + 0xf0], 0xdfc0fc7
mov dword [esp + 0xf4], 0x1f003fc
mov dword [esp + 0xf8], 0x5f407f0
mov dword [esp + 0xfc], 0x19fa1bf4
mov dword [esp + 0x100], 0x1db91fcd
mov dword [esp + 0x104], 0x11b513a6
mov dword [esp + 0x108], 0x15a917a6
mov dword [esp + 0x10c], 0xe921ebe5
mov dword [esp + 0x110], 0xed27ef1d
mov dword [esp + 0x114], 0xe117e31e
mov dword [esp + 0x118], 0xe5e6e72a
mov dword [esp + 0x11c], 0
mov eax, dword [0x447e9c]
lea ecx, [esp + 0x3c]
xor edx, edx
xor esi, esi
nop
nop
mov edi, edx
and edi, 0xa2
mov ebx, esi
xor ebx, 0xae
sub ebx, edi
inc bl
xor bl, byte [ecx]
add bl, 0x95
mov byte [ecx], bl
inc ecx
dec esi
add edx, 0xfffffffe
cmp esi, 0xffffff1c
jne 0x40bd70
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x441d48]
mov ecx, 0xfc200c83
xor ecx, dword [0x441d50]
add eax, ecx
inc eax
jmp eax
Function at 0x40c400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x240
mov dword [esp + 0x40], 0xe31de13d
mov dword [esp + 0x44], 0xe71fe56e
mov dword [esp + 0x48], 0xfb06f904
mov dword [esp + 0x4c], 0xffc1fd1d
mov dword [esp + 0x50], 0xf3ccf1c5
mov dword [esp + 0x54], 0xf7d6f5c4
mov dword [esp + 0x58], 0x8b5d89b0
mov dword [esp + 0x5c], 0x8f708d75
mov dword [esp + 0x60], 0x837d8164
mov dword [esp + 0x64], 0x87758573
mov dword [esp + 0x68], 0x9b4499b8
mov dword [esp + 0x6c], 0x9fbe9d48
mov dword [esp + 0x70], 0x93a291a1
mov dword [esp + 0x74], 0x97a695aa
mov dword [esp + 0x78], 0xab8aa963
mov dword [esp + 0x7c], 0xaf57ad7b
mov dword [esp + 0x80], 0xa394a15e
mov dword [esp + 0x84], 0xa76da590
mov dword [esp + 0x88], 0xbb32b998
mov dword [esp + 0x8c], 0xbf8abd8a
mov dword [esp + 0x90], 0xb392b189
mov dword [esp + 0x94], 0xb746b575
mov dword [esp + 0x98], 0x4bb649b8
mov dword [esp + 0x9c], 0x4f994da9
mov dword [esp + 0xa0], 0x43a041a5
mov dword [esp + 0xa4], 0x47bf459f
mov dword [esp + 0xa8], 0x5b6559ac
mov dword [esp + 0xac], 0x5f6d5d69
mov dword [esp + 0xb0], 0x536c5167
mov dword [esp + 0xb4], 0x57605567
mov dword [esp + 0xb8], 0x6b526948
mov dword [esp + 0xbc], 0x6fb66db7
mov dword [esp + 0xc0], 0x63bf61b4
mov dword [esp + 0xc4], 0x675a65b8
mov dword [esp + 0xc8], 0x7b867958
mov dword [esp + 0xcc], 0x7f857d85
mov dword [esp + 0xd0], 0x73527195
mov dword [esp + 0xd4], 0x779375b3
mov dword [esp + 0xd8], 0xbf109eb
mov dword [esp + 0xdc], 0xf370df3
mov dword [esp + 0xe0], 0x3c10120
mov dword [esp + 0xe4], 0x7f405fc
mov dword [esp + 0xe8], 0x1be719e7
mov dword [esp + 0xec], 0x1f211df9
mov dword [esp + 0xf0], 0x13231121
mov dword [esp + 0xf4], 0x172815dd
mov dword [esp + 0xf8], 0x2b142918
mov dword [esp + 0xfc], 0x2f102d1c
mov dword [esp + 0x100], 0x23022110
mov dword [esp + 0x104], 0x27c725f7
mov dword [esp + 0x108], 0x3bdb39de
mov dword [esp + 0x10c], 0x3fc73dce
mov dword [esp + 0x110], 0x3307310f
mov dword [esp + 0x114], 0x37013507
mov dword [esp + 0x118], 0xcbf9c9f6
mov dword [esp + 0x11c], 0xcfcecdfa
mov ebp, dword [0x447e9c]
mov esi, 0x5e119e28
mov edi, 0xa1ee61d7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x5e119de8]
mov ebx, esi
and ebx, edx
add ebx, ebx
sub ebx, edx
add ebx, edi
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x38
mov byte [esp + esi - 0x5e119de8], al
inc esi
dec edi
cmp esi, 0x5e119f08
jne 0x40c660
lea eax, [esp + 0x40]
push 0
push 0
push 0
push 0
push eax
call ebp
xor ecx, ecx
mov dword [esp + 0xc], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x441ee8]
mov ecx, dword [0x441ef0]
mov edx, ecx
and edx, 0xcca9e03
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0xf33561fd
jmp eax
Function at 0x413570
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x413590
add eax, edi
add eax, 0xfffffffe
mov ebx, edi
not ebx
and ebx, eax
xor eax, edi
add ebx, ebx
sub ebx, eax
mov esi, dword [ecx + 4]
xor eax, eax
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x4135b0
sar ebx, 1
lea ecx, [esi + eax]
add ecx, 0xfffffffe
mov eax, esi
not eax
and eax, ecx
xor ecx, esi
add eax, eax
sub eax, ecx
sar eax, 1
lea ecx, [ebx + eax]
add ecx, 2
test ecx, ecx
jns 0x4135e1
mov eax, 0xffffffff
jmp 0x4135ea
add eax, ebx
lea eax, [eax*2 + 4]
push eax
call fcn.004082d0
add esp, 4
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x413621
add esi, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x413610
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x413651
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413640
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.0043c6f0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4423e8]
Function at 0x4138f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x300
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413910
sar esi, 1
lea ecx, [esp + 0xcc]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4491f0]
mov ebx, dword [esp + 0xcc]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41394a
mov eax, 0xffffffff
jmp 0x41394d
lea eax, [ebx + ebx]
push eax
call fcn.004082d0
add esp, 4
lea ecx, [esp + 0xcc]
push ecx
push ebx
mov dword [esp + 0x30], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x4491f0]
mov eax, dword [esp + 0xcc]
mov ecx, eax
add ecx, 0xd
js 0x413988
lea edi, [eax*2 + 0x1a]
push edi
call fcn.004082d0
add esp, 4
mov ebx, eax
mov dword [esp + 0x148], 0x9722993c
mov dword [esp + 0x14c], 0x931d9535
mov dword [esp + 0x150], 0x8f6e911c
mov dword [esp + 0x154], 0x8b178d26
mov dword [esp + 0x158], 0x87098906
mov dword [esp + 0x15c], 0x8311851d
mov dword [esp + 0x160], 0x7f7e8112
mov eax, 0xedfd3a66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x1202c6e2]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0xa5f023ff
xor edx, 0xa5f223ff
and ecx, 0x480d1c00
sub ecx, edx
mov esi, ecx
xor esi, 0xfffffffe
mov edx, ecx
or edx, 1
and edx, esi
mov esi, edx
and esi, 0xfd
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, esi
lea esi, [ecx + ecx]
and esi, 2
sub ecx, esi
add ecx, edx
add ecx, edi
inc cl
mov byte [esp + eax + 0x1202c6e2], cl
inc eax
cmp eax, 0xedfd3a82
jne 0x4139f0
mov eax, dword [esp + 0x28]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x413a91
mov eax, dword [esp + 0x28]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413a80
mov word [eax], 0
movzx ecx, word [esp + 0x148]
test cx, cx
je 0x413ac1
lea edx, [esp + 0x14a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413ab0
mov word [eax], 0
lea eax, [esp + 0x30]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043c6f0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442848]
Function at 0x41d710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41d720
cmp eax, 0xffffffed
jge 0x41d737
mov eax, 0xffffffff
jmp 0x41d73a
add eax, 0x12
push eax
call fcn.004082d0
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp], 0x3f913984
mov dword [esp + 4], 0x23bb3d99
mov dword [esp + 8], 0x27742174
mov dword [esp + 0xc], 0x2b8c2580
mov word [esp + 0x10], 0x2928
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, 0x5db8188a
mov ecx, 0x2247e775
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x5db8188a]
mov ebp, ecx
and ebp, 0x27
mov esi, eax
xor esi, 0x58381827
mov edx, eax
or edx, 0x5800098
and edx, esi
or edx, ebp
and edx, 0x5fbcb8ff
xor edx, ebx
xor edx, 0x58381827
lea esi, [edx*2 + 0x56cf0a9a]
add edx, 0x2b67854d
and esi, 2
mov ebx, esi
and ebx, edx
xor esi, edx
xor esi, 1
lea edx, [esi + ebx*2]
mov byte [esp + eax - 0x5db8188a], dl
inc eax
dec ecx
cmp eax, 0x5db818a1
jne 0x41d790
movzx ecx, word [edi]
mov esi, dword [esp + 0x18]
mov eax, esi
test cx, cx
je 0x41d811
add edi, 2
mov eax, esi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41d800
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41d841
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d830
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043c8b0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x442ed0]
Function at 0x426a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x426a5a
cmp edi, 1
je 0x426a5a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x426a31
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x426a30
cmp ecx, 0x20
je 0x426a30
cmp ecx, 0x2b
mov edx, edi
je 0x426a50
cmp ecx, 0x2d
jne 0x426a6f
cmp al, 0x2b
sete byte [esp + 3]
inc ebx
jmp 0x426a74
xor edi, edi
test eax, eax
je 0x426c2d
mov dword [eax], 0x16
jmp 0x426c2d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x426a9d
cmp edx, 0x10
jne 0x426ab5
cmp byte [ebx], 0x30
jne 0x426a96
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x426ab7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x426ab7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x426b10
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x426bc8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x426b37
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x426bf8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x426bf8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x426af0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x426b80
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x426b89
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x426bad
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x426bdd
test bl, bl
jne 0x426bdd
mov ebx, dword [esp + 0x10]
jmp 0x426b03
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x426ae5
mov esi, edi
test bl, bl
jne 0x426beb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x426ae5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x426c06
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x426c14
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x426c24
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x426c2d
cmp byte [esp + 3], 0
jne 0x426c2d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42ecd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00413560
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42ed09
jmp 0x42ee82
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
jmp 0x42ed35
cmp eax, 0
setne cl
jmp 0x42ed3d
jmp 0x42ed3f
xor ebx, ebx
test cl, 1
jne 0x42ed4b
jmp 0x42ee7c
mov dword [ebp - 0x14], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00429920
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42ee6d
mov ecx, eax
and ecx, 1
shl ecx, 1
mov dword [ebp - 0x1c], eax
mov ebx, eax
xor ebx, 1
add ebx, ecx
sub esp, 4
mov dword [esp], ebx
call fcn.004082d0
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00429990
add esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 3
mov byte [edi + 1], 0x6d
mov byte [edi + 2], 0x6b
mov byte [edi + 3], 0x53
mov byte [edi + 4], 0x66
mov byte [edi + 5], 0x6a
mov byte [edi + 6], 0x67
mov byte [edi + 7], 0x55
mov byte [edi + 8], 0x6c
mov byte [edi + 9], 0x27
mov byte [edi + 0xa], 0x5e
mov byte [edi + 0xb], 0x53
mov byte [edi + 0xc], 0x58
mov byte [edi + 0xd], 0xcd
mov eax, 0xe
mov esi, dword [ebp - 0x18]
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x11
jne 0x42edf7
jmp 0x42ee05
xor eax, eax
cmp eax, 0x11
jae 0x42ee34
movzx edx, byte [edi + eax]
mov ebx, eax
add ebx, 0x12632430
xor ebx, edx
add ebx, 0xa4104b0f
mov edx, ebx
shl edx, 1
and edx, 2
xor ebx, 1
add ebx, edx
mov byte [edi + eax], bl
add eax, 1
jmp 0x42ee07
jmp 0x42ee36
jmp 0x42ee38
jmp 0x42ee3a
jmp 0x42ee3c
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.004092c0
mov bl, al
and bl, 1
jmp 0x42ee59
sub esp, 4
mov dword [esp], esi
call fcn.004082e0
add esp, 4
jmp 0x42ee69
jmp 0x42ee6b
jmp 0x42ee6d
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4340a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
lea eax, [esp + 0x10]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x40]
call fcn.0043c6f0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4454b8]

Function at 0x4342d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043cef0
add esp, 0x14
test eax, eax
js 0x4343f6
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043d380
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x43436a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x434338
mov eax, 0xffffffff
jmp 0x43433f
lea eax, [eax*2 + 2]
push eax
call fcn.004082d0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043da30
add esp, 0x14
test eax, eax
jns 0x43436a
push esi
call fcn.004082e0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0xb8bbba85
mov word [esp + 8], 0
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x1f
xor cl, byte [esp + ebx + 4]
add cl, 0x65
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 6
jne 0x434380
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x4343da
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4491f8]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x4343c0
inc edi
cmp ecx, edi
jne 0x4343b0
jmp 0x4343da
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4343da
push eax
push 4
push ecx
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x10
test esi, esi
jne 0x4343f8
lea eax, [esp + 4]
push eax
call fcn.0043c4d0
add esp, 4
test al, al
je 0x4343f6
cmp dword [esp + 4], 1
je 0x4343f8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44586c]

Function at 0x4361a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xb8bbba85
mov word [esp + 4], 0
mov eax, 7
mov ecx, 0x20
nop
nop
nop
mov esi, ecx
and esi, 0x39
mov edx, eax
and edx, 6
or edx, esi
xor dl, byte [esp + eax - 7]
xor dl, 0x39
add dl, 0x65
mov byte [esp + eax - 7], dl
inc eax
dec ecx
cmp eax, 0xd
jne 0x4361d0
mov edi, dword [esp]
mov eax, dword [0x4491f4]
test eax, eax
je 0x436246
xor ecx, ecx
mov edx, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x436220
inc ecx
cmp eax, ecx
jne 0x436210
jmp 0x436246
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x436246
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xa3e2e1e4
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa8
xor cl, byte [esp + eax]
add cl, 0xb8
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x436260
cmp edi, dword [esp]
jne 0x436385
mov dword [esp + 0xc], ebp
push dword [esp + 8]
call fcn.00435ff0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp], 0xb8bbba85
mov word [esp + 4], 0
mov esi, 7
mov edi, 0x20
nop
nop
nop
nop
nop
nop
nop
mov ebp, edi
and ebp, 0x39
mov edx, esi
and edx, 6
or edx, ebp
xor dl, byte [esp + esi - 7]
xor dl, 0x39
add dl, 0x65
mov byte [esp + esi - 7], dl
inc esi
dec edi
cmp esi, 0xd
jne 0x4362b0
mov edi, dword [esp]
mov edx, dword [0x4491f4]
test edx, edx
je 0x436325
xor ebp, ebp
mov esi, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x436300
inc ebp
cmp edx, ebp
jne 0x4362f0
jmp 0x436325
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x436325
push 0
push ecx
push eax
push 5
push 0x10
push edx
push dword [0x4491fc]
mov esi, eax
call fcn.00438f20
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43637c
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x436355
add edi, 2
cmp si, bp
je 0x436340
cmp si, bp
je 0x436367
mov esi, dword [ecx]
test esi, esi
jne 0x436330
mov edi, 0xc0000225
jmp 0x43637c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00436140
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4363c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x436490
xor eax, eax
cmp dword [ecx], 0
jne 0x4364e9
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xb8bbba85
mov word [esp + 4], 0
mov eax, 7
mov esi, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 0x39
mov ebx, eax
and ebx, 6
or ebx, edi
xor bl, byte [esp + eax - 7]
xor bl, 0x39
add bl, 0x65
mov byte [esp + eax - 7], bl
inc eax
dec esi
cmp eax, 0xd
jne 0x436440
mov eax, dword [esp]
mov esi, dword [0x4491f4]
test esi, esi
je 0x4364e9
xor edi, edi
mov ebx, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x4364f2
inc edi
cmp esi, edi
jne 0x436480
jmp 0x4364e9
mov dword [esp + 8], 0x296a6b6c
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
and ecx, 5
mov edx, eax
and edx, 2
mov esi, eax
or esi, 2
imul esi, edx
xor edx, 2
imul edx, ecx
mov ecx, eax
xor ecx, 0x97
add ecx, esi
add ecx, edx
xor cl, byte [esp + eax + 8]
add cl, 0xd
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 7
jne 0x4364b0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4364e9
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x1c
jmp 0x4364e9

Function at 0x436520
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x4365ca
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xb8bbba85
mov word [esp + 4], 0
mov edx, 7
mov esi, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 0x39
mov ebx, edx
and ebx, 6
or ebx, edi
xor bl, byte [esp + edx - 7]
xor bl, 0x39
add bl, 0x65
mov byte [esp + edx - 7], bl
inc edx
dec esi
cmp edx, 0xd
jne 0x436550
mov edx, dword [0x4491f4]
test edx, edx
je 0x4365be
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x4365a0
inc edi
cmp edx, edi
jne 0x436590
jmp 0x4365be
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4365be
push eax
push 4
push edx
push dword [0x4491fc]
mov esi, ecx
call fcn.00438f20
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret