joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c80
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405e6a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405e6a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405e6a
cmp dword [ecx], 0
jne 0x405e6a
push esi
call fcn.0040cd20
add esp, 4
test eax, eax
je 0x405cea
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405cf1
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405cd0
jmp 0x405cf3
mov edi, 0x1505
jmp 0x405cf3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405dc4
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405d51
call fcn.00405f30
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405e6a
push esi
call fcn.0040cd20
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405e80
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cd20
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44f008]
add esp, 4
test eax, eax
je 0x405e65
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040cc20
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405e6a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405de8
inc ebx
dec edx
je 0x405d0c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405d11
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405de0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cd20
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405de0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cd40
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405de0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404d30
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405db9
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406f90
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x407132
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40712b
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x407020
add ebp, dword [esp + 8]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40712b
xor eax, eax
cmp edx, 8
mov dword [esp], edx
jb 0x40709a
mov eax, edx
and eax, 0x1ff8
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
movzx ebx, byte [ebp + ebx]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 5]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 6]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, edi
lea ebx, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x407040
add ebp, ebx
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], ebx
jbe 0x406fe8
mov ebx, edx
mov edx, eax
or edx, 1
test bl, 1
mov dword [esp + 4], esi
jne 0x4070d0
mov ebx, ebp
cmp dword [esp], edx
je 0x406fe0
jmp 0x4070ed
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
add edi, eax
mov eax, edi
and eax, ecx
xor ecx, edi
lea ecx, [ecx + eax*2]
mov eax, edx
cmp dword [esp], edx
je 0x406fe0
mov edx, dword [esp]
sub edx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + eax]
add esi, edi
mov edi, esi
and edi, ecx
xor ecx, esi
lea ecx, [ecx + edi*2]
movzx edi, byte [ebx + eax + 1]
add edi, esi
mov esi, edi
and esi, ecx
xor ecx, edi
lea ecx, [ecx + esi*2]
add eax, 2
cmp edx, eax
jne 0x407100
jmp 0x406fe0
shl ecx, 0x10
or ecx, edi
jmp 0x407137
mov ecx, 1
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x407150
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4071aa
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4071ac
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44cc50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x44cc50]
inc esi
cmp edx, esi
jne 0x407170
not eax
jmp 0x4071ac
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d2c0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00445580
test al, al
je 0x40d49e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043d1e0
test al, al
je 0x40d499
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x92db8c8f
mov dword [esp + 8], 0x667cba62
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d346
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d4b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d320
mov dword [esp + 4], 0xee578dcd
mov dword [esp + 8], 0xf857aad3
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40d396
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d510
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40d370
mov dword [esp + 4], 0xe3e2e1c1
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x40d3e6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d570
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x40d3c0
test esi, esi
je 0x40d436
mov dword [esp + 4], 0x9b79c3a9
mov dword [esp + 8], 0x312c38fe
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d436
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d5e0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d410
mov dword [esp + 4], 0x1e1f1819
mov dword [esp + 8], 0xe2e31c1d
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d486
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d630
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d460
call fcn.0040ea30
test al, al
je 0x40d499
call fcn.00412750
call fcn.00410570
call fcn.00446700
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov al, byte [esp + 0x1c]
test edi, edi
sets bl
mov esi, edi
sub esi, 1
sete bh
or bl, bh
mov esi, edi
sub esi, 0x25
setge bh
or bl, bh
test bl, 1
jne 0x40e376
jmp 0x40e37b
jmp 0x40e4c4
movzx ebx, al
mov esi, ecx
add esi, edx
add esi, 0xffffffff
mov byte [ecx + edx - 1], 0
cmp ebx, 0
jne 0x40e39f
mov eax, esi
add eax, 0xffffffff
mov byte [esi - 1], 0x30
mov esi, eax
jmp 0x40e4c2
cmp edi, 0xa
jne 0x40e42b
jmp 0x40e3aa
movzx ecx, al
cmp ecx, 0x64
jb 0x40e3ea
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
shl edx, 1
mov al, byte [edx + 0x44d761]
mov edi, esi
add edi, 0xffffffff
mov byte [esi - 1], al
mov al, byte [edx + 0x44d760]
add edi, 0xffffffff
mov byte [esi - 2], al
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
mov esi, edi
jmp 0x40e3aa
cmp ecx, 0xa
setb al
test al, 1
jne 0x40e3f6
jmp 0x40e406
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
add esi, 0xffffffff
jmp 0x40e402
mov byte [esi], al
jmp 0x40e426
shl ecx, 1
mov al, byte [ecx + 0x44d761]
mov edx, esi
add edx, 0xffffffff
mov byte [esi - 1], al
mov al, byte [ecx + 0x44d760]
add edx, 0xffffffff
mov byte [esi - 2], al
mov esi, edx
jmp 0x40e4c2
cmp edi, 0x10
je 0x40e432
jmp 0x40e492
movzx eax, al
cmp eax, 0x10
setl cl
test cl, 1
jne 0x40e442
jmp 0x40e455
mov cl, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov eax, esi
add eax, 0xffffffff
mov byte [esi - 1], cl
mov esi, eax
jmp 0x40e4c2
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 2
mov edx, eax
and edx, 0xfffffffd
imul edx, ecx
mov ecx, eax
and ecx, 2
or eax, 2
imul eax, ecx
add eax, edx
mov cl, byte [eax + 0x44d82a]
mov edx, esi
add edx, 0xffffffff
mov byte [esi - 1], cl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add edx, 0xffffffff
mov byte [esi - 2], al
mov esi, edx
jmp 0x40e4c2
movzx ecx, al
cmp ecx, 0
seta al
test al, 1
jne 0x40e4a1
jmp 0x40e4c0
mov eax, ecx
xor edx, edx
div edi
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov ebx, esi
add ebx, 0xffffffff
mov byte [esi - 1], al
mov eax, ecx
xor edx, edx
div edi
mov esi, ebx
jmp 0x40e492
jmp 0x40e4c2
mov ecx, esi
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
ret

Function at 0x412750
Capabilities:
Contain obfuscated stackstrings
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x4508fc]
Function at 0x422250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov esi, dword [esp + 0x5c]
xor eax, eax
test esi, esi
setne al
xor edi, edi
mov dword [esp + 0x3c], 0
xor ebx, ebx
jmp dword [eax*4 + 0x451584]
Function at 0x426640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x426660
cmp eax, 0xffffffdd
jge 0x426677
mov eax, 0xffffffff
jmp 0x42667a
add eax, 0x22
push eax
call fcn.0040cbf0
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x93019134
mov dword [esp + 0x1c], 0x9f099d00
mov dword [esp + 0x20], 0x9b3b990a
mov dword [esp + 0x24], 0x872b852b
mov dword [esp + 0x28], 0x832e8124
mov dword [esp + 0x2c], 0x8f208d21
mov dword [esp + 0x30], 0x8b178929
mov dword [esp + 0x34], 0x77ea75e0
mov word [esp + 0x38], 0x7170
mov dword [esp + 0x3a], 0
mov word [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x27
ja 0x42671b
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.004273e0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x28
jb 0x4266f0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x426741
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x426730
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x426771
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x426760
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x832d812d
mov dword [esp + 0x1c], 0x87eb853e
mov dword [esp + 0x20], 0x8b32892d
mov dword [esp + 0x24], 0x8f2b8d38
mov dword [esp + 0x28], 0x9321913e
mov dword [esp + 0x2c], 0x9739953d
mov dword [esp + 0x30], 0x9bf19936
mov dword [esp + 0x34], 0x9ff59df7
mov dword [esp + 0x38], 0xe3bce18a
mov dword [esp + 0x3c], 0xe755e551
mov dword [esp + 0x40], 0xeb58e94d
mov dword [esp + 0x44], 0xef41edaf
mov dword [esp + 0x48], 0xf346f15e
mov dword [esp + 0x4c], 0xf74ef551
mov dword [esp + 0x50], 0xfbb3f94c
mov dword [esp + 0x54], 0xff83fd58
mov dword [esp + 0x58], 0xc3c2c1aa
mov byte [esp + 0x5e], 0
mov word [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x46
ja 0x426866
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00427450
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x47
jb 0x426840
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x426b80
push ecx
push esi
call fcn.004277f0
add esp, 0x10
mov ebx, eax
jmp dword [0x4517ec]
Function at 0x4269d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4269e0
mov ecx, eax
sar ecx, 1
xor ecx, 9
and eax, 0x12
add eax, ecx
jns 0x426a00
mov eax, 0xffffffff
jmp 0x426a02
add eax, eax
push eax
call fcn.0040cbf0
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x69c76bd8
mov dword [esp + 8], 0x6df16fc3
mov dword [esp + 0xc], 0x518053b8
mov dword [esp + 0x10], 0x55f057f4
mov dword [esp + 0x14], 0x5b54
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x13
ja 0x426a76
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00426b10
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x14
jb 0x426a50
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x426aa1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x426a90
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x426ad1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x426ac0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0044a3c0
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x451814]
Function at 0x42a200
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x6c
mov esi, dword [0x456550]
mov dword [esp + 0x14], 0xf52092d
mov dword [esp + 0x18], 0x3650d7f
mov dword [esp + 0x1c], 0x77a0161
mov dword [esp + 0x20], 0x1b6a0545
mov dword [esp + 0x24], 0x1f5a1968
mov dword [esp + 0x28], 0x13661d7d
mov dword [esp + 0x2c], 0x17331171
mov dword [esp + 0x30], 0x1514
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1f
ja 0x42a28b
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042ca00
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x20
jb 0x42a260
lea edi, [esp + 0x60]
lea eax, [esp + 0x14]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x60]
test ebx, ebx
jns 0x42a2ae
mov eax, 0xffffffff
jmp 0x42a2b1
lea eax, [ebx + ebx]
push eax
call fcn.0040cbf0
add esp, 4
mov esi, eax
mov ebp, dword [0x456550]
mov dword [esp + 0x14], 0x398e3b57
mov dword [esp + 0x18], 0x258b27a9
mov dword [esp + 0x1c], 0x21b6238b
mov dword [esp + 0x20], 0x2dbe2f6f
mov dword [esp + 0x24], 0x29662bbc
mov dword [esp + 0x28], 0x158a1787
mov dword [esp + 0x2c], 0x117913bb
mov dword [esp + 0x30], 0x1f10
mov byte [esp + 0x34], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x20
ja 0x42a34b
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042ca50
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x21
jb 0x42a320
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebp
mov eax, dword [esp + 0x60]
mov ecx, eax
add ecx, 9
jns 0x42a36b
mov eax, 0xffffffff
jmp 0x42a372
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040cbf0
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0x33623154
mov dword [esp + 0x18], 0x3f5d3d5d
mov dword [esp + 0x1c], 0x3b5b3953
mov dword [esp + 0x20], 0x472b452b
mov dword [esp + 0x24], 0x43424133
mov byte [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x14
ja 0x42a3eb
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042cab0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x15
jb 0x42a3c0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x42a411
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x42a400
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x42a441
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x42a430
mov ebx, dword [esp + 0x80]
mov word [eax], 0
lea eax, [esp + 0x68]
push eax
push edi
call fcn.0044a3c0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x451ec0]
Function at 0x42ddd0
Capabilities:
Contain obfuscated stackstrings
Copy file
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0042ddf0
add esp, 4
test al, al
je 0x42e490
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xb0
mov dword [esp + 8], 0x6110673f
mov dword [esp + 0xc], 0x7dee63ed
mov dword [esp + 0x10], 0x790a7f1f
mov dword [esp + 0x14], 0x752a7b0c
mov dword [esp + 0x18], 0x71fa7717
mov dword [esp + 0x1c], 0x8d727308
mov word [esp + 0x20], 0
mov byte [esp + 0x22], 0
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x38]
cmp eax, 0x1a
ja 0x42e51b
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x38]
movzx eax, byte [esp + eax + 8]
push dword [esp + 0x38]
push eax
call fcn.00431af0
add esp, 8
mov ecx, dword [esp + 0x38]
mov byte [esp + ecx + 8], al
inc dword [esp + 0x38]
mov eax, dword [esp + 0x38]
cmp eax, 0x1b
jb 0x42e4f0
mov dword [esp + 0x38], 0x3f883984
mov dword [esp + 0x3c], 0x23693d79
mov dword [esp + 0x40], 0x27912169
mov dword [esp + 0x44], 0x2b9c2590
mov dword [esp + 0x48], 0x2f922991
mov dword [esp + 0x4c], 0x13532d61
mov dword [esp + 0x50], 0x175e1157
mov dword [esp + 0x54], 0x1ba8155d
mov dword [esp + 0x58], 0x1fa2195d
mov dword [esp + 0x5c], 0x3b11dab
mov dword [esp + 0x60], 0x7b2014a
mov dword [esp + 0x64], 0xb4b05bf
mov dword [esp + 0x68], 0xf4b09be
mov dword [esp + 0x6c], 0x73c80db0
mov dword [esp + 0x70], 0x77da71d1
mov dword [esp + 0x74], 0x7bdf75ee
mov dword [esp + 0x78], 0x7fc979c4
mov dword [esp + 0x7c], 0x63c77de8
mov dword [esp + 0x80], 0x67cb61c1
mov word [esp + 0x84], 0x6564
mov word [esp + 0x8a], 0
mov dword [esp + 0x86], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x2c]
cmp eax, 0x53
ja case.0x42bc27.117
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x2c]
movzx eax, byte [esp + eax + 0x38]
push dword [esp + 0x2c]
push eax
call fcn.00431b40
add esp, 8
mov ecx, dword [esp + 0x2c]
mov byte [esp + ecx + 0x38], al
inc dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp eax, 0x54
jb 0x42e5f0

Function at 0x42ddf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x5c], 0x69fe6bf1
mov dword [esp + 0x60], 0x6dc96fc3
mov dword [esp + 0x64], 0x518053ff
mov dword [esp + 0x68], 0x55ce57fb
mov dword [esp + 0x6c], 0x595a5bff
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 0x13
ja 0x42de8b
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 0x5c]
push dword [esp + 0x14]
push eax
call fcn.00431320
add esp, 8
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 0x5c], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 0x14
jb 0x42de60
lea ebx, [esp + 0x5c]
lea ecx, [esp + 0x44]
push ebx
call fcn.00443bb0
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x4525f8]
Function at 0x439640
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
jmp 0x43965b
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x43966c
jmp 0x4397b1
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
jmp 0x43969a
cmp edi, 0
setne al
jmp 0x4396a2
jmp 0x4396a4
xor ebx, ebx
test al, 1
jne 0x4396af
jmp 0x4397a9
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0041bcd0
mov ebp, eax
jmp 0x4396c9
jmp 0x4396cb
cmp ebp, 0
setne al
xor ebx, ebx
test al, 1
jne 0x4396dc
jmp 0x43979d
mov al, byte [esp + 0x20]
mov byte [esp + 0x24], al
mov byte [esp + 0x10], 0x21
mov byte [esp + 0x11], 7
mov byte [esp + 0x12], 5
mov byte [esp + 0x13], 0x19
mov byte [esp + 0x14], 0xe
mov byte [esp + 0x15], 0x1e
mov byte [esp + 0x16], 9
mov byte [esp + 0x17], 0x1b
mov byte [esp + 0x18], 8
mov byte [esp + 0x19], 0x41
mov byte [esp + 0x1a], 6
mov byte [esp + 0x1b], 9
mov byte [esp + 0x1c], 4
mov byte [esp + 0x1d], 0x77
mov eax, 0xe
mov byte [esp + eax + 0x10], 0
add eax, 1
cmp eax, 0x10
jne 0x43972f
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x10
jae 0x439779
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043d110
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x10], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x439744
jmp 0x43977b
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040d7f0
sub esp, 0xc
mov bl, al
jmp 0x43979a
and bl, 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4397b1
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret