joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cd543
Capabilities:
Encrypt data using speck

Disassembly:
rep stosw word es:[edi], ax
and ax, si
mov ecx, dword [ebp + 8]
lea eax, [ecx - 1]
clc
jmp 0x67818e
or esi, edx
inc ecx
test dx, di
stc
cmp edi, 5
jmp 0x624a7e
rep stosd dword es:[edi], eax
jmp 0x7b3cca
sub edi, edi
cmp ebx, esi
cmp ecx, dword [ebp - 0x40]
jmp 0x607ffb
push esi
push edi
or di, cx
mov edi, 1
mov esi, edi
cmp esp, esi
shl esi, cl
xchg cl, cl
mov ecx, dword [eax + 4]
test ah, 0x38
stc
sub ebx, ebx
cmc
stc
mov dword [ebp - 0x20], edx
stc
cmc
sub esi, edi
test cl, dl
mov dword [ebp - 0x44], esi
xor esi, ebx
sar si, 0x39
mov esi, edi
test edi, 0x2e80093a
cmp di, ax
shl esi, cl
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
cmp bx, sp
mov byte [ebp - 1], bl
cmp eax, ebp
cmc
sub esi, edi
stc
mov dword [ebp - 0x48], esi
btc esi, ecx
mov esi, dword [eax]
cmc
cmp eax, esp
mov dword [ecx], ebx
mov ecx, dword [ebp + 0x14]
cmp ebx, esi
mov dword [ecx], ebx
ror ecx, cl
mov ecx, dword [eax + 4]
movzx eax, bp
lea ecx, [ecx + esi]
bts ax, bx
mov eax, 0x300
clc
shl eax, cl
mov dword [ebp - 0x3c], esi
cmp bp, 0x5385
cmc
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
clc
add eax, 0x736
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
jmp 0x636009
inc edi
cmp esp, ebp
cmp esp, 0x5919788a
jmp 0x56f2b7
mov byte [ecx], dl
call fcn.00683117
push ebp
add bp, di
sub cx, 0xa1b8
btr ecx, esi
mov ebp, esp
shr dx, cl
sub esp, 0x48
sar ch, 0x2a
adc edx, esp
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
push ebx
cmp eax, ebp
test dx, 0x40a2
jmp 0x5aa2e6
mov eax, edx
test edi, edi
shl edx, 0x10
or eax, edx
shr ecx, 1
jmp 0x57bf8c
je 0x612274
movzx edx, byte [ecx]
test si, si
shl esi, 8
jmp 0x5cac0d
jl 0x588fae
mov dword [ebp - 8], ecx
bt edx, ebx
lea esp, [esp]
mov dword [ebp - 0x2c], edi
jmp 0x65adb1
je 0x55d883
mov ecx, eax
btr di, bp
mov eax, 0x400
shl di, 0x9a
mov edi, edx
movzx edx, ax
jmp 0x5e4d2e
mov dword [ebp - 0x40], eax
sub esi, esi
stc
or eax, 0xffffffff
jmp 0x588faa
adc ecx, ecx
jmp 0x55d87d

Function at 0x5d4fd0
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x14]
jns fcn.00650585
add dl, 0x24
add dword [esp + 8], 0x5337fbaa
mov dword [esp], 0xffbbe722
xor bl, dl
shr dword [esp + 3], 0xa4
lea edx, [esp + edx + 0x14]
mov dword [edx], ecx
jb 0x5aa2dc
mov cl, byte [edi + ecx*8 - 0x10ce]
jns 0x69a693
call fcn.0062ba10

Function at 0x5dac18
Capabilities:
Encrypt data using speck

Disassembly:
adc ebp, 0
jmp 0x7b54d5
jmp 0x7b3195
inc esp
xor ch, cl
push 0xea803085
dec eax
sar dword [esp + 5], 0xd
dec eax
lea ecx, [esp + ecx + 0x18]
call fcn.005d7368
sub cl, 0xbd
dec eax
mov dword [esp], 0x81bb5a26
rol cl, 1
inc dword [esp + 2]
sal dword [esp + 4], 5
jb 0x697ad3
mov si, word [edi]
mov eax, 0x46a52c0d
add al, 0x2f
inc eax
lea edi, [edi + eax - 0x46a52c3b]
inc eax
not eax
neg ax
movzx eax, byte [ebp]
jns 0x57cb14
jmp 0x7b1ceb

Function at 0x5e36f8
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x20]
jnp fcn.007b8e25
Function at 0x5e4cf3
Capabilities:
Encrypt data using speck

Disassembly:
mov word [esp + 0x14], 0x7c27
mov dword [edi], ebp
call fcn.00572bd2
mov eax, 0x9b20421
movzx edi, al
movzx edx, ax
mov ebp, dword [esi + eax - 0x9b20421]
btr dx, ax
movzx ecx, ax
lea esi, [eax + esi - 0x9b2041d]
and eax, ecx
add edi, 0x1435e324
mov edi, ebp
mov ebp, esi
mov esi, 0x5e2d1bbc
mul ax
cwde
jo 0x586d72

Function at 0x600e08
Capabilities:
Encrypt data using speck

Disassembly:
push 0x11318c37
dec ecx
bswap edx
dec ecx
xor edx, 0x4c3d2624
dec ecx
not edx
call fcn.005c8b6b
Function at 0x609b1b
Capabilities:
Encrypt data using speck

Disassembly:
dec bx
push 0x568e5021
push 0x82217300
inc sp
xor ebp, ebx
call fcn.0062af29
dec edx
mov dword [esp], ebx
jb 0x66c806
jp 0x7c75d6
call fcn.0057d075

Function at 0x647cbd
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], eax
push 0xbfaf551c
push dword [esp + 4]
popfd
lea esp, [esp + 8]
jmp fcn.007aaf59
lea esp, [esp + 0x10]
jmp fcn.005edd86
add eax, 0x4838e800
idiv bh
shld edx, edi, cl
push 0x2cbb2683
mov dword [esi], edx
jmp 0x5ee908
mov dword [esp + 8], 0x9073a87d
lea esp, [esp + 8]
call fcn.005d6aa0
mov eax, 0xe1a8330a
mov eax, dword [esi]
push 0xa822cd9f
neg dword [esp]
adc esi, 3
mov byte [esp], 0x31
dec dword [esp]
jns 0x5a6257
in al, 0xa2
and byte [ebx], ah
cmpsd dword [esi], dword es:[edi]
and esi, dword [0x607ccc84]
scasd eax, dword es:[edi]
add eax, 0xeeb80313
pop esp
inc esi
pushal
xchg ecx, eax
adc al, al
jb 0x647d55
ja 0x647c91
stosd dword es:[edi], eax
lcall 0xe601, 0xb6a0790
stosd dword es:[edi], eax
xor ch, al
sbb dh, byte [bx + 0x4d]
ljmp 0xa717

Function at 0x66d17e
Capabilities:
Encrypt data using speck

Disassembly:
add byte [edx + 0x6b], dh
pop es
retf
push eax
inc esp
enter 0x72d5, 0xffffffffffffffe7
jge 0x617209
push eax
invalid
rcr dword [edx + edx - 0x30], 1
adc eax, 0xb1fb94d
cmpsd dword [esi], dword es:[edi]
test eax, 0x45ea7be
and byte [edi + 0x7b2fb96b], ah
invalid
pushfd
mov ecx, 0x8386c82e
mov ebx, ecx
movsx ebx, bl
call fcn.007b5aa4
in eax, 0xb4
xchg esp, eax
mov ecx, 0xc48a506f
scasb al, byte es:[edi]
xchg dword [ecx], ebp
cmp ah, byte ss:[ecx - 0x44257555]
salc
je 0x61723b
mov word [ebx + ecx*4 + 0x51dd2a64], ds
push 0xffffffffffffffff
pushal
in eax, dx
mov bh, ch
jb 0x6172dd
inc esi
clc
lahf
loope 0x61724e
ret 0xcf29
cmp eax, 0x5f1f187b
cmp eax, 0x67d5940
sal byte [0xa0e00952], cl
inc edx
mov dl, 0x5f
inc esp
salc
sti
invalid
test di, 0xd28
js 0x66d165
or edi, edi
test edi, 0xf20441b8
mov edi, dword [esp + edi*2 + 0x38b286de]
je 0x617275
jge 0x66d165
add dword [esp], 0xff84a541
call fcn.005df031
push 0xc332a86
mov edx, dword [esp]
mov ecx, dword [edi + edx*4 - 0x30ccaa18]
mov edx, dword [edi + edx - 0xc332a82]
sal word [esp + 2], 0xa4
setb byte [esp]
adc edi, 8
jmp 0x6766c0
mov dword fs:[ecx], edx
call 0x659e7f
Function at 0x67ff82
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x20]
jne 0x6765f1
pop esi
jmp 0x607559
shl byte [esp + 0x14], 0xa7
dec edx
jmp 0x5c08f1
not eax
mov dword [ebp], eax
jmp fcn.005d3092
movzx esi, byte [edi]
call fcn.005b9e1e
xor eax, 0x4888aa17
jmp 0x607068

Function at 0x69e1b8
Capabilities:
Encode data using xor

Disassembly:
push 0x772e76be
and ax, cx
jmp 0x69f664
mov dword [edi], esi
call fcn.0068be09
mov dword [ebp], edi
mov dword [esp + 4], 0xfe223fb5
not dword [esp + 0x10]
push 0xf610d6a7
lea esp, [esp + 0x18]
jmp fcn.00613e7d
jae 0x7b3db4
push ds
mov dl, 0x53
mov esi, dword [esi - 0x56]
inc ecx
out 0xe, eax
scasb al, byte es:[edi]
push ebp
cmp dword [edx - 0x56], 0x7d
push dword [eax + 0x70]
add eax, 0x72a40551
mov ecx, 0x25c27fa5
jb 0x69e242
pop ebx
lea eax, [esi - 0x15]
sbb ecx, dword [edx]
invalid
jo 0x69e2a3
sbb eax, dword [edi + 0x15deed8f]
jno 0x69e268
mov ah, 0xc2
fxch st(4)
imul edx, dword [eax + 0x3f], 0xffffffa4
pushfd
ljmp 0x8626
mov dh, 0x86
test dl, cl
arpl dx, bx
neg dword [0x5462a75d]
mov dl, 0xc0
mov bl, 0x39
cdq
ljmp 0xa017
pop es
and eax, 0x25354396
adc al, 0x47
pop ebx
mov al, pe_nt_image_headers32
leave
xor ebx, eax
push es
or eax, 0x9604e2ed
cmp ecx, edi
or ecx, ebx
sbb cl, bl
movsb byte es:[edi], byte [esi]
sub bl, byte [eax - 0x6de0a7d3]
sbb eax, dword [edx + 0x5f76db73]
jae 0x69e280
jbe 0x69e306
adc dword [0x614c1c71], edx
or dl, ch
inc esi
dec eax
cmp ebp, dword [0x39634c1c]
sub byte [edx - 0x32c1358a], al
cmp al, byte [ebp + 0x34]
sti
inc edi
daa
invalid
jbe 0x69e361
pop eax
xor dword [0xd3132ebf], edx
mov bh, bl
adc ecx, esi
ror bh, cl
std
pop esp
sbb eax, 0xbf8dd22d
push ebp
cmp eax, 0x2e754e0a
mov edi, 0x7a023d55
dec edi
stosb byte es:[edi], al
imul dword [0xce6b6d94]
xchg dword [ecx - 0x7a23d23e], ebx
sub eax, 0x55bf154a
mov ebp, 0xb160f033
jmp 0x69e39e
adc ah, ch
movsd dword es:[edi], dword [esi]
mov ebx, 0x5529356a
mov ebp, 0x55290566
mov ebp, 0x1275717a
wait
pop esp
cmp esp, dword [eax - 0x2a]
stosb byte es:[edi], al
ret 0xcedb
and eax, 0xdc6119c7
xlatb
sbb edi, dword [ebx + eax + 0x2388d2d0]
mov edi, 0xfd927ceb
dec edi
cli
sqrtps xmm3, xmm7
fsubr dword [ebx - 0x61]
or ebp, dword [ebx + 0x6a]
push ebp
sbb ebp, esi
invalid
push 0xda996625
mov word [esi], ax
jmp 0x7c01eb
mov dword [esp], 0x2e018c2b
adc esi, 2
not ax
sal dword [esp], 0x5c
not cx
adc dword [esp], 0x297b4a1
jae 0x644b65
mov esi, dword fs:[ecx + esi - 0x891af]
jmp 0x69d610
call fcn.00567a09

Function at 0x7aae19
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 0xb], 0xbf931fa8
call fcn.0065a9b4
movzx edx, byte [esi]
mov eax, 0xe607fd16
add esi, 1
xor dl, bl
call fcn.00601c4d
Function at 0x7ab024
Capabilities:
Encode data using xor

Disassembly:
jp 0x5ba6b2
call fcn.005beb99
call fcn.00570ec3
call fcn.007c1c39
lea esp, [esp + 0x14]
jns fcn.007b8e25
or ax, 0x2689
mov eax, dword [edi + 4]
push 0xce272c9e
adc edi, 4
sar dword [esp], 0x64
jae 0x62c755
or ebp, eax
not ebp
push 0x123d1387
call fcn.0058019f
mov dword [0xc76c50c6], eax
xor ebx, dword [edi + 0x2a]
mov bl, 0x91
jns 0x611bf1
mov al, 0x7c
pop ecx
lahf
arpl word [ebp - 0x385fbbad], si
pop edi
sbb ebp, ecx
jle 0x611c6c
xchg esi, eax
aaa
lds eax, [ecx]
outsb dx, byte [esi]
push ds
sub byte [edx], dh
clc
adc dword [edi + 0xf], 0x57
xlatb
test al, 0xfa
adc byte [eax + 0x294f5525], 0x3a
add al, byte [ebx + 0x52]
dec eax
cmp al, byte [esi + 0x13]
arpl word [ecx], ax
loope 0x611ca0
imul ecx, eax, 0xec58eeba
xor byte [edx], 0x70
fist word [ebx - 0x6a]
aaa
lds ebx, [edx + ebx*8 - 0x29]
invalid
das
and al, 0xc4
or byte [esi - 0x54], 0x66
cmc
mov dl, byte [edx]
push esi
aam 0xb4
cli
mov es, word [edi + edi - 0x59]
in eax, dx
ljmp 0xadc
movsb byte es:[edi], byte [esi]
mov cl, 0x3d
imul ecx, eax, 0x740d32ba
out dx, al
sub eax, 0x1a97d32
int 0x17
pop ecx
aas
dec eax
add al, 0x18
add dword [edi - 0x4d], ebp
add dword [edx + 0x377ca642], ebp
and al, 0xec
mov bl, 0x1f
invalid
rol cx, 0xe2
btr ecx, 0x30
adc dl, 0xb1
xor dl, 0x1e
sub ecx, 0xe73a6386
btr cx, cx
lea ecx, [ecx*2 + 0x1200d284]
xor bl, dl
add edx, esp
or cx, cx
sal ecx, cl
or cl, byte [edx]
sub edi, 2
push 0xff877031
jmp 0x65d997
xor cl, 4
sub word [esp + 5], 0x74ad
jae 0x61e957
dec cl
sal dword [esp + 4], 0x97
sar word [esp + 4], 0x48
xor bl, cl
push 0x9baa4cbe
mov dword [esp + 4], 0x8613e728
ror word [esp + 0xa], 0x68
sbb ebp, 2
mov word [ebp], cx
not dword [esp + 6]
lea esp, [esp + 0xc]
jmp fcn.00613e7d
mov word [edi], cx
call fcn.005a8b7d
mov word [ebp], cx
call fcn.005754db
xchg edx, eax
push edx
and dword [edx - 0x64], edx
retf
and byte [esp + 6], 0xa
lea ecx, [esp + ecx + 0x14]
mov byte [ecx], dl
jb 0x611bca
jno 0x559f93
call fcn.005ae469

Function at 0x7b4a17
Capabilities:
Encode data using xor

Disassembly:
push 0x23089210
test ecx, ecx
not word [esp + 5]
lea esp, [esp + 8]
je 0x5df777
jmp 0x5eee20
jmp 0x7c4456
jmp 0x7b4a0f
mov dword [esi + 4], eax
call fcn.0061b928
mov eax, dword [ebp]
mov ecx, 0xf5b915aa
mov ecx, dword [ebp + 4]
push 0x51075c37
add ebp, 4
xor edx, edx
shr dword [esp], 0xef
jb 0x587b47
push edi
Function at 0x7c7f05
Capabilities:
Encrypt data using speck

Disassembly:
or al, byte [edx + eax - 0x62000000]
sub esi, 2
mov word [esi], ax
call fcn.005a724f
out 6, al
and dword [eax + edx*2 + 0x58], esi
and ebp, ebp
invalid
xor bl, dl
add dword [esp + eax - 0x61fffffc], eax
sar ax, 0xc1
lea edx, [esp + edx + 8]
bt ax, 0x2b
neg dword [esp + eax - 0x61fffffd]
js 0x5fc34f
add byte [ebx + ecx*8], 0x95
pop esp
adc bl, bl
invalid
movzx edx, byte [edi + eax*2 - 0x1e35cf46]
xor dl, bl
xor dl, 0x11
add dl, 0xb1
not dl
and byte [esp + eax - 0xf1ae79f], 0x12
dec eax
rol dl, 1
mov dword [esp + eax*2 - 0x1e35cf44], 0x2793c734
inc dword [esp + eax - 0xf1ae7a2]
xor eax, 0x9f10ff93
inc dl
sal eax, 0x99
adc dword [esp + eax - 0x61fffffc], eax
jg 0x606d6f
insd dword es:[edi], dx
cli
and byte [ebx - 0x763ebeb3], bl
xor al, 0x42
hlt
Function at 0x401b87
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401bc6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401bc6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401bc6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401bc6
cmp dword [ecx + 0x74], 0xe
jbe 0x401bc6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x2a840972
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x2a840981
pop dword [ebp - 0x24]
mov eax, 0x131bb63c
sub eax, 0xe897acbb
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xd490842e
sub dword [ebp - 0x34], 0x863e3ee3
mov dword [ebp - 0x30], 0x9e7e83e2
sub dword [ebp - 0x30], 0x6c4b379d
mov dword [ebp - 0x2c], 0xd9e29c45
add dword [ebp - 0x2c], 0x7269a7e9
mov dword [ebp - 0x28], 0xdcc80449
sub dword [ebp - 0x28], 0xdcc80449
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xcdb4849a
add dword [ebp - 0x34], 0xa6bde4bc
mov dword [ebp - 0x30], 0x73b53d0
add dword [ebp - 0x30], 0x3a310da5
mov dword [ebp - 0x2c], 0x337d9855
sub dword [ebp - 0x2c], 0xd00e2be9
mov dword [ebp - 0x28], 0x453aef0e
sub dword [ebp - 0x28], 0x453aef0e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xf680039d
sub eax, 0xcbfae261
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x48cf4
push 0
call eax
mov ecx, 0x4281
xor esi, esi
add esi, eax
mov edi, 0xc68fc45c
add edi, 0x63f825a4
add edi, dword [ebp - 0x24]
mov edx, 0x353e758a
sub edx, 0x3c95030b
sub dword [ebp - 4], esi
mov ebx, dword [edi]
sub dword [ebp - 4], 0x29ffd700
sub ebx, edx
xor dword [ebp - 0x10], eax
mov dword [esi], ebx
add esi, 4
add edi, 0xe2d7cf3f
sub edi, 0xe2d7cf3b
loop 0x2a840a9a
add eax, 0xfcd7
mov ebx, eax
add eax, 5
mov ecx, 0x2a800000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x2a84a76f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a851e75
call fcn.2a8015aa
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a840972
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a84a7b4
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a84a7b6
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a849b77
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a80187a
ret
Function at 0xa9b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a9b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa9b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9b06a
add dl, dl
jne 0xa9b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9b0dc
xor eax, eax
add dl, dl
jne 0xa9b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9b17d
add dl, dl
jne 0xa9b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa9b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa9b075
mov eax, 1
add dl, dl
jne 0xa9b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9b0e1
sub eax, ebx
mov ebx, 1
jne 0xa9b128
mov ecx, 1
add dl, dl
jne 0xa9b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa9b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa9b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9b136
cmp eax, 0x7d00
jae 0xa9b16d
cmp eax, 0x500
jb 0xa9b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa9b075
cmp eax, 0x7f
ja 0xa9b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa9b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa9b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa9b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10037e87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10037e96
pop dword [ebp - 0xc]
mov eax, 0xa87ba002
add eax, 0x6787de94
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x41fe2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x5b491d62
sub ecx, 0x5b48d88c
xor edx, edx
add edx, eax
mov ebx, 0x409983c2
sub ebx, 0x30810fc2
add ebx, dword [ebp - 0xc]
mov edi, 0xdc82154
sub edi, 0x401667f1
sub dword [ebp - 4], 0xe91cb817
mov esi, dword [ebx]
sub dword [ebp - 4], ebx
xor esi, edi
add dword [ebp - 8], 0x52f8a3f3
mov dword [edx], esi
xor dword [ebp - 8], 0xe043520b
add edx, 0x47dd1f5a
sub edx, 0x47dd1f56
add ebx, 0xe780f393
add ebx, 0x187f0c71
loop 0x10037ef2
add eax, 0xb31fde63
sub eax, 0xb31ed838
xor ebx, ebx
add ebx, eax
add eax, 0x4ee514c9
add eax, 0xb11aeb3c
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10072480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1007251b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100724d2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100724d2
cmp esi, ebx
jge 0x100724d2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10072515
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10072515
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783d8]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783d8]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007252d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
mov eax, dword [ebp + 8]
je 0x10072778
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072792
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10037e87
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076730
leave
ret 4

Function at 0x10072960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072996
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100729f5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10037e87
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10037e87
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10037e87
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076730
leave
ret 0x10
Function at 0x10072a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10072a3c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10072a6d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10072a6b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10037e87
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10072a6d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076730
leave
ret 8
Function at 0x41a520
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4aa85b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049f2c9
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41a5a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049d00b
mov eax, dword [eax]
push 0x540cdc
push eax
call fcn.0048efa4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049f554
test bl, bl
je 0x41a5a2
push 0x540cdc
lea ecx, [esp + 0xc]
call fcn.0049f8e4
push 0x540ce8
lea ecx, [esp + 0xc]
call fcn.0049f8e4
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41a5de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049f554
jmp 0x41a6a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41a662
lea edx, [esp + 0x7c]
push 0x540ce4
push edx
call fcn.0048efa4
add esp, 8
test eax, eax
je 0x41a662
lea eax, [esp + 0x7c]
push 0x540ce0
push eax
call fcn.0048efa4
add esp, 8
test eax, eax
je 0x41a662
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a5f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049f554
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41aea0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41af02
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc