joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x180
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0x31c43f0d
mov dword [esp + 0x14], 0x35c333c5
mov dword [esp + 0x18], 0xc93637ca
mov word [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xf5
xor cl, byte [esp + eax + 0x10]
add cl, 0x37
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0xe
jne 0x418030
mov dword [esp + 0x2c], 0x77ea09a0
mov dword [esp + 0x30], 0x73e275e8
mov dword [esp + 0x34], 0x7f2d7136
mov dword [esp + 0x38], 0x7bee7d2f
mov dword [esp + 0x3c], 0x67c979eb
mov dword [esp + 0x40], 0x63f665c5
mov dword [esp + 0x44], 0x6ffd61c8
mov dword [esp + 0x48], 0x6bf66df3
mov dword [esp + 0x4c], 0x5756692e
mov word [esp + 0x50], 0
mov byte [esp + 0x52], 0
mov eax, 0x3e
mov ecx, 0xc1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x12]
mov esi, edx
not esi
lea edi, [edx + edx]
not edi
add edi, edx
and edi, esi
or edi, ecx
or edx, eax
add edx, edi
add dl, 0xcb
mov byte [esp + eax - 0x12], dl
inc eax
dec ecx
cmp eax, 0x65
jne 0x4180b0
movzx ecx, word [esp + 0x2c]
lea eax, [esp + 0x146]
test cx, cx
je 0x418101
lea edx, [esp + 0x2e]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4180f0
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x418131
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418120
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x418161
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418150
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x2c], 0x2724248a
mov byte [esp + 0x30], 0x84
mov word [esp + 0x31], 0
mov byte [esp + 0x33], 0
mov eax, 0x356881e0
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x356881b4]
xor ecx, eax
mov edx, ecx
xor edx, 0x61
and ecx, 0x1e
add ecx, ecx
sub ecx, edx
inc cl
mov byte [esp + eax - 0x356881b4], cl
inc eax
cmp eax, 0x356881e8
jne 0x418190
movzx eax, byte [esp + 0x2c]
test al, al
je 0x4181db
lea ecx, [esp + 0x2d]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4181d0
mov byte [esi], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x146]
push eax
push ecx
push edx
call fcn.0040b9f0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x445ecc]
mov ecx, 0x5c9da943
xor ecx, dword [0x445ed4]
add eax, ecx
inc eax
mov edx, dword [ebp + 0xc]
jmp eax
Function at 0x41b570
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
xor eax, eax
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x41b580
lea ecx, [ebx + eax]
add ecx, 0xfffffffe
mov ebp, ebx
not ebp
and ebp, ecx
add eax, ebx
mov ecx, 1
sub ecx, eax
and ecx, ebx
sub ebp, ecx
sar ebp, 1
lea eax, [esp + 8]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44ce7c]
mov edi, dword [esp + 8]
test edi, edi
jns 0x41b5c7
mov eax, 0xffffffff
jmp 0x41b5ca
lea eax, [edi + edi]
push eax
call fcn.00408770
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44ce7c]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.0043f640
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44618c]
Function at 0x41d670
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
xor ecx, ecx
nop
nop
nop
cmp word [edi + ecx], 0
lea ecx, [ecx + 2]
jne 0x41d680
lea edx, [edi + ecx]
add edx, 0xfffffffe
mov eax, edi
not eax
and eax, edx
add ecx, edi
mov edx, 1
sub edx, ecx
and edx, edi
sub eax, edx
cmp eax, 0xffffffed
jge 0x41d6af
mov eax, 0xffffffff
jmp 0x41d6b2
add eax, 0x12
push eax
call fcn.00408770
add esp, 4
mov esi, eax
mov dword [esp], 0x21932780
mov dword [esp + 4], 0x3da9239f
mov dword [esp + 8], 0x39483f70
mov dword [esp + 0xc], 0x35983b84
mov dword [esp + 0x10], 0x3734
mov byte [esp + 0x14], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
movzx ebx, byte [esp + ecx]
mov ebp, eax
and ebp, 0x12
mov edx, ecx
xor edx, 0xb7403509
add edx, ebp
xor edx, ebx
lea ebx, [edx + 0x52]
mov ebp, 0x2d
sub ebp, edx
and edx, 1
and ebp, 0xb2
and ebx, 0x4d
or ebx, ebp
xor ebx, 0xb3
lea edx, [ebx + edx*2]
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x15
jne 0x41d6f0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41d761
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41d750
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41d791
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d780
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043f640
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x446254]
Function at 0x41fd40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x58], 0x3373311d
mov dword [ebp - 0x54], 0x3f4e3d4c
mov dword [ebp - 0x50], 0x3b5b3974
mov dword [ebp - 0x4c], 0x47274538
mov dword [ebp - 0x48], 0x4326416d
mov dword [ebp - 0x44], 0x4f264d10
mov dword [ebp - 0x40], 0x4b3c4935
mov dword [ebp - 0x3c], 0x573b5538
mov dword [ebp - 0x38], 0x53305122
mov dword [ebp - 0x34], 0x5f2c5d35
mov dword [ebp - 0x30], 0x5b3e5934
mov dword [ebp - 0x2c], 0x67146534
mov dword [ebp - 0x28], 0x630c6117
mov dword [ebp - 0x24], 0x6f1a6d05
mov dword [ebp - 0x20], 0x6b196905
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov word [ebp - 0x1c], 0x7574
mov dword [ebp - 0x1a], 0
mov word [ebp - 0x16], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ecx - 0x58]
lea esi, [ecx + 0x34]
and esi, edx
lea edi, [ecx + edx]
add edi, 0xa374c32f
add esi, esi
mov edx, edi
sub edx, esi
and edi, 1
or edx, 1
add edx, edi
mov byte [ebp + ecx - 0x58], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x44
jb 0x41fde0
lea eax, [ebp - 0x96]
lea edx, [ebp - 0x58]
mov edi, eax
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x5a]
mov ecx, 1
mov edx, dword [ebp - 0x14]
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov esi, dword [ebp - 0x10]
push esi
push 0
push 0
push 0x1e
push eax
push 0
call dword [0x44ce7c]
mov edi, dword [esi]
test edi, edi
jns 0x41fe5d
mov eax, 0xffffffff
jmp 0x41fe60
lea eax, [edi + edi]
push eax
call fcn.00408770
add esp, 4
push esi
push edi
mov dword [ebp - 0x10], eax
push eax
push 0x1e
lea eax, [ebp - 0x96]
push eax
push 0
call dword [0x44ce7c]
mov dword [ebx], 0x239a21f4
mov dword [ebx + 4], 0x27982591
mov dword [ebx + 8], 0x3b9f399c
mov dword [ebx + 0xc], 0x3f9c3d8e
mov dword [ebx + 0x10], 0x33803189
mov dword [ebx + 0x14], 0x37363590
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
mov eax, 0x47
mov ecx, 0x7161f7b7
nop
nop
nop
movzx edx, byte [ebx + eax - 0x47]
lea esi, [eax - 0x38b0fbff]
lea edi, [edx + edx]
not edi
add edi, edx
and edi, esi
lea esi, [ecx - 0x7161f700]
or esi, ecx
and esi, edx
or esi, edi
add esi, 0x1b74ea97
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [ebx + eax - 0x47], dl
inc eax
dec ecx
cmp eax, 0x62
jne 0x41fec0
push 0
push 0
push ebx
mov esi, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
call fcn.0041b570
add esp, 0x14
jmp dword [0x446848]
Function at 0x41fe39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x58], 0x3373311d
mov dword [ebp - 0x54], 0x3f4e3d4c
mov dword [ebp - 0x50], 0x3b5b3974
mov dword [ebp - 0x4c], 0x47274538
mov dword [ebp - 0x48], 0x4326416d
mov dword [ebp - 0x44], 0x4f264d10
mov dword [ebp - 0x40], 0x4b3c4935
mov dword [ebp - 0x3c], 0x573b5538
mov dword [ebp - 0x38], 0x53305122
mov dword [ebp - 0x34], 0x5f2c5d35
mov dword [ebp - 0x30], 0x5b3e5934
mov dword [ebp - 0x2c], 0x67146534
mov dword [ebp - 0x28], 0x630c6117
mov dword [ebp - 0x24], 0x6f1a6d05
mov dword [ebp - 0x20], 0x6b196905
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov word [ebp - 0x1c], 0x7574
mov dword [ebp - 0x1a], 0
mov word [ebp - 0x16], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ecx - 0x58]
lea esi, [ecx + 0x34]
and esi, edx
lea edi, [ecx + edx]
add edi, 0xa374c32f
add esi, esi
mov edx, edi
sub edx, esi
and edi, 1
or edx, 1
add edx, edi
mov byte [ebp + ecx - 0x58], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x44
jb 0x41fde0
lea eax, [ebp - 0x96]
lea edx, [ebp - 0x58]
mov edi, eax
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x5a]
mov ecx, 1
mov edx, dword [ebp - 0x14]
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov esi, dword [ebp - 0x10]
push esi
push 0
push 0
push 0x1e
push eax
push 0
call dword [0x44ce7c]
mov edi, dword [esi]
test edi, edi
jns 0x41fe5d
mov eax, 0xffffffff
jmp 0x41fe60
lea eax, [edi + edi]
push eax
call fcn.00408770
add esp, 4
push esi
push edi
mov dword [ebp - 0x10], eax
push eax
push 0x1e
lea eax, [ebp - 0x96]
push eax
push 0
call dword [0x44ce7c]
mov dword [ebx], 0x239a21f4
mov dword [ebx + 4], 0x27982591
mov dword [ebx + 8], 0x3b9f399c
mov dword [ebx + 0xc], 0x3f9c3d8e
mov dword [ebx + 0x10], 0x33803189
mov dword [ebx + 0x14], 0x37363590
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
mov eax, 0x47
mov ecx, 0x7161f7b7
nop
nop
nop
movzx edx, byte [ebx + eax - 0x47]
lea esi, [eax - 0x38b0fbff]
lea edi, [edx + edx]
not edi
add edi, edx
and edi, esi
lea esi, [ecx - 0x7161f700]
or esi, ecx
and esi, edx
or esi, edi
add esi, 0x1b74ea97
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [ebx + eax - 0x47], dl
inc eax
dec ecx
cmp eax, 0x62
jne 0x41fec0
push 0
push 0
push ebx
mov esi, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
call fcn.0041b570
add esp, 0x14
jmp dword [0x446848]
Function at 0x422ae0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x450
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x4c], 0x971a9917
mov dword [esp + 0x50], 0x93339509
mov dword [esp + 0x54], 0x8fdc9105
mov dword [esp + 0x58], 0x8b028d11
mov dword [esp + 0x5c], 0x87868915
mov byte [esp + 0x60], 0
mov eax, 0x5cb90626
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x5cb905da]
lea edx, [eax - 0x5cb90600]
and edx, ecx
or ecx, eax
xor ecx, edx
mov edx, ecx
and edx, 0x41
xor ecx, 0x41
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x5cb905da], cl
inc eax
cmp eax, 0x5cb9063b
jne 0x422b50
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x24]
push eax
call fcn.004389b0
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x446f4c]
Function at 0x42a480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x42a5c1
mov eax, dword [esp + 0x18]
mov edx, eax
not edx
lea edx, [edx + eax*2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test edx, edx
je 0x42a5c1
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42a4d0
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x42a570
cmp ebx, 0x7ff
ja 0x42a500
cmp edx, 2
jb 0x42a500
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x42a570
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x42a586
cmp edx, 4
jb 0x42a586
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
mov eax, ecx
xor eax, 0xdc00
and ecx, 0x23ff
add ecx, ecx
sub ecx, eax
lea edi, [ebx + ecx]
add edi, 0xfca00000
lea eax, [ebx + ecx]
add eax, 0xfca10000
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
mov eax, edi
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
jne 0x42a4b0
jmp 0x42a5c1
movzx eax, ax
cmp eax, 0xdc00
jne 0x42a594
mov esi, edi
jmp 0x42a578
cmp edx, 3
jb 0x42a5bd
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x42a570
mov eax, ebp
jmp 0x42a570
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42f8a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
call fcn.00413bd0
push eax
mov edi, esp
jmp 0x42f8b3
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42f8c7
jmp 0x42f8c9
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42f8da
jmp 0x42fa7f
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
jmp 0x42f90c
xor ebx, ebx
test cl, 1
jne 0x42f918
jmp 0x42fa79
sub esp, 4
mov dword [ebp - 0x30], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042a410
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42f949
jmp 0x42fa68
mov ebx, eax
add ebx, 1
mov dword [ebp - 0x2c], eax
sub esp, 4
mov dword [esp], ebx
call fcn.00408770
add esp, 4
mov dword [ebp - 0x10], eax
jmp 0x42f964
sub esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.0042a480
add esp, 0xc
mov al, byte [edi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0x59
mov byte [ebp - 0x27], 0xb3
mov byte [ebp - 0x26], 0xbd
mov byte [ebp - 0x25], 0xb1
mov byte [ebp - 0x24], 0x42
mov byte [ebp - 0x23], 0xb2
mov byte [ebp - 0x22], 0x41
mov byte [ebp - 0x21], 0xcf
mov byte [ebp - 0x20], 0xc0
mov byte [ebp - 0x1f], 9
mov byte [ebp - 0x1e], 0xd2
mov byte [ebp - 0x1d], 0xd1
mov byte [ebp - 0x1c], 0xd4
mov byte [ebp - 0x1b], 0x5b
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x13
jne 0x42f9bf
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x13
jae 0x42fa34
movzx ecx, byte [ebp + eax - 0x28]
mov esi, eax
shl esi, 1
and esi, 0x109c9772
mov edx, eax
xor edx, 0x84e4bb9
add edx, esi
mov esi, edx
and esi, ecx
mov ebx, esi
and ebx, 0xfd
mov edi, esi
and edi, 2
xor edi, 2
imul edi, ebx
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
add esi, edi
add edx, ecx
mov ecx, edx
xor ecx, 0xffffffff
mov edi, esi
and edi, ecx
xor esi, 0xffffffff
and edx, esi
mov ecx, dword [ebp + 8]
sub edx, edi
add dl, 0x63
mov byte [ebp + eax - 0x28], dl
add eax, 1
jmp 0x42f9d1
lea eax, [ebp - 0x28]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
call fcn.00409700
mov bl, al
and bl, 1
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00408780
add esp, 4
jmp 0x42fa68
sub esp, 4
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42fa79
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x435d00
lea esi, [ebx - 2]
mov dword [esp + 4], 0x22262489
mov byte [esp + 8], 0
xor edx, edx
nop
nop
nop
nop
mov eax, edx
add al, 0xb9
xor al, byte [esp + edx + 4]
add al, 0x63
mov byte [esp + edx + 4], al
inc edx
cmp edx, 5
jne 0x435d20
cmp ebx, 2
je 0x435d52
mov dword [esp], ecx
mov edi, dword [esp + 4]
mov eax, esi
sar esi, 1
mov edx, edi
not edx
test al, 2
mov dword [esp + 0x10], edx
jne 0x435d59
jmp 0x435d83
mov eax, ebp
jmp 0x435de8
dec esi
mov ecx, dword [esp + 0x28]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp], ecx
xor eax, ebp
mov ebp, eax
not ebp
and ebp, edi
mov ecx, eax
and ecx, edx
imul ecx, ebp
mov ebp, eax
and ebp, edi
or eax, edi
imul eax, ebp
add eax, ecx
mov ebp, eax
cmp ebx, 4
mov edx, dword [esp]
je 0x435de8
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edx + ebx*2]
xor ebp, eax
mov eax, ebp
not eax
and eax, edi
mov esi, ebp
and esi, ecx
imul esi, eax
mov eax, ebp
and eax, edi
or ebp, edi
imul ebp, eax
add ebp, esi
movzx eax, word [edx + ebx*2 + 2]
xor eax, ebp
mov esi, eax
not esi
and esi, edi
mov ebp, eax
and ebp, ecx
imul ebp, esi
mov esi, eax
and esi, edi
or eax, edi
imul eax, esi
mov esi, dword [esp + 0xc]
add eax, ebp
add ebx, 2
cmp esi, ebx
jne 0x435da0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436900
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.0043f4c0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448e8c]

Function at 0x436b80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.0043fb20
add esp, 0x14
test eax, eax
js 0x436cbf
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043fec0
add esp, 0x24
mov ecx, eax
xor esi, esi
mov eax, 0
test ecx, ecx
js 0x436c1f
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x436be9
mov eax, 0xffffffff
jmp 0x436bf0
lea eax, [eax*2 + 2]
push eax
call fcn.00408770
add esp, 4
push edi
mov edi, eax
push eax
push 0
push ebx
push dword [esp + 0x10]
call fcn.004404b0
add esp, 0x14
test eax, eax
js 0x436c14
mov eax, edi
jmp 0x436c1f
push edi
call fcn.00408780
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0x3c3d3a3b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 4
mov ebx, edx
xor ebx, 0x4a
add ebx, edi
xor bl, byte [esp + edx + 4]
add bl, 0x8e
mov byte [esp + edx + 4], bl
inc edx
add esi, 2
cmp edx, 7
jne 0x436c40
mov edx, dword [0x44ce80]
test edx, edx
je 0x436cae
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44ce84]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x436c90
inc edi
cmp edx, edi
jne 0x436c80
jmp 0x436cae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x436cae
push ecx
push 4
push edx
push dword [0x44ce88]
mov esi, eax
call fcn.0043c030
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x436cc1
lea eax, [esp + 4]
push eax
call fcn.0043f2b0
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
Function at 0x4388d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0x212627f4
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x79
xor dl, byte [esp + ecx]
add dl, 0xa3
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 6
jne 0x4388f0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x454ea4]
add esp, 8
ret

Function at 0x438920
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4492cc]
Function at 0x438c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov esi, dword [ecx + 8]
test esi, esi
je 0x438d37
xor eax, eax
cmp dword [ecx], 0
jne 0x438e1e
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x34], eax
mov dword [esp + 0xc], 0x6c6d6e6f
mov byte [esp + 0x10], 0
xor eax, eax
mov esi, 0xc1c6de16
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0xc]
mov ebp, eax
or ebp, edi
or ebp, 0x3e3921e8
lea edx, [esi + 1]
or edx, edi
lea edi, [eax + edx]
add edi, 0x3e3921e9
xor edi, ebp
mov ebx, esi
sub ebx, edx
and ebx, ebp
add ebx, ebx
sub ebx, edi
add bl, 0x78
mov byte [esp + eax + 0xc], bl
inc eax
dec esi
cmp eax, 5
jne 0x438cc0
mov eax, dword [esp + 0xc]
mov esi, dword [0x44ce80]
test esi, esi
je 0x438e1e
xor edi, edi
mov ebx, dword [0x44ce84]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x438e28
inc edi
cmp esi, edi
jne 0x438d20
jmp 0x438e1e
mov dword [esp + 0x18], 0xc3020108
mov word [esp + 0x1c], 0
xor esi, esi
mov edi, 0x1e898aff
mov edx, 0xe1767500
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x14], edx
movzx eax, byte [esp + esi + 0x18]
mov dword [esp + 8], eax
mov ecx, esi
and ecx, eax
add ecx, ecx
sub ecx, eax
add ecx, edi
lea eax, [esi - 0x1e898b00]
and eax, ecx
mov dword [esp + 4], eax
mov ebp, eax
and ebp, 2
mov ecx, eax
or ecx, 2
imul ebp, ecx
mov ebx, eax
shr al, 1
and al, 1
mul cl
mov byte [esp + 3], al
mov ecx, dword [esp + 4]
and ecx, 0xe1767505
mov dword [esp + 4], ecx
or ebx, 0xfffffffd
lea eax, [ebx + 1]
imul eax, ecx
add eax, dword [esp + 8]
mov ecx, eax
sub ecx, ebp
add eax, edx
sub eax, ebp
lea edx, [esi + ecx]
add edx, 0xe1767500
mov ebp, edx
shr al, 1
and al, 1
mov ecx, edx
or dl, 2
mul dl
mov dh, al
inc bl
mov eax, ebx
mul byte [esp + 4]
mov dl, byte [esp + 3]
add dl, dl
add dh, dh
add dh, dl
not ecx
and ebp, 0xfd
and ecx, 2
imul ecx, ebp
add cl, dh
mov edx, dword [esp + 0x14]
sub cl, al
sub cl, byte [esp + 8]
movzx eax, cl
add eax, edi
inc al
mov byte [esp + esi + 0x18], al
dec edi
inc edx
inc esi
cmp esi, 6
jne 0x438d60
mov eax, dword [esp + 0x18]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x438e1e
lea eax, [esp + 0x30]
lea edx, [esp + 0x18]
push eax
push edx
push dword [esp + 0x54]
push ecx
push 0x10
push esi
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x1c
jmp 0x438e1e
Function at 0x438e60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x438f1e
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], 0x6c6d6e6f
mov byte [esp + 4], 0
xor edx, edx
mov esi, 0xc1c6de16
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx]
mov ebp, edx
or ebp, edi
or ebp, 0x3e3921e8
lea eax, [esi + 1]
or eax, edi
lea edi, [edx + eax]
add edi, 0x3e3921e9
xor edi, ebp
mov ebx, esi
sub ebx, eax
and ebx, ebp
add ebx, ebx
sub ebx, edi
add bl, 0x78
mov byte [esp + edx], bl
inc edx
dec esi
cmp edx, 5
jne 0x438e90
mov edx, dword [0x44ce80]
test edx, edx
je 0x438f11
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44ce84]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x438ef0
inc edi
cmp edx, edi
jne 0x438ee0
jmp 0x438f11
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x438f11
push dword [esp + 8]
push 4
push edx
push dword [0x44ce88]
mov esi, ecx
call fcn.0043c030
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret