joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13d369d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sal ax, 0xa8
dec ecx
sbb ebx, edi
inc cx
mov dword [eax + ebx - 0x6736c592], esi
dec edi
lea ebx, [ebx + edx - 0x14]
dec ebp
lea edi, [esp + eax*8 - 0x286c7e6e]
inc ebp
or eax, esi
inc esi
xadd dword [esp + edx*8 - 0x7c], edi
inc ebx
mov ecx, dword [ebx + edx*8 - 0x80]
inc ecx
movzx esi, bh
xor ecx, edi
push esi
inc ecx
movzx edx, ah
lea ecx, [eax + ecx - 0x517c1f6f]
xor dx, ax
inc ecx
shr dh, 0xa7
inc ecx
push ecx
xor ecx, 0xbb183487
ror ecx, 1
inc edx
neg dword [esp + edx*2 - 0x12]
inc si
or dword [esp + edx*2 - 0xd], edx
inc edx
lea ecx, [ecx + edx*4 - 0xa0cad68]
inc edx
xor dword [esp + edx*4 - 0x30], 0x5e9ac230
pop eax
ror ecx, 3
call fcn.017ba7ac
dec edi
push 0xffffffffffffffe2
rol dword [eax], 1
jle 0x131223c
adc bl, bh
ret
mov byte [edx], bh
add al, 0xbd
invalid
not ax
inc dl
movsx ecx, dl
jnp 0x17b0b94
inc cx
mov esi, dword [eax + ecx - 0x6736c592]
jb 0x1312189
dec esp
lea esi, [eax*2 + 0x33397613]
neg cx
inc ecx
movzx esi, cx
inc edx
dec dword [esp + eax - 0x6736c588]
add cx, 0x93af
inc ebp
mov esp, edx
pop edx
ror cx, 1
inc esi
movsx edi, byte [esp + eax - 0x6736c592]
xor di, cx
inc esp
and edx, eax
dec edx
not dword [esp + eax - 0x6736c592]
dec eax
lea ecx, [esp + ecx + 8]
inc ecx
setnp dh
inc ecx
sar bh, 0x83
jne 0x1396749
mov ax, word [esi + eax - 0xa4c6]
sar dx, 0xa1
mov cx, word [edx + esi - 0xd261]
shl dx, 0x46
inc dl
and ax, cx
jmp 0x1332ec9
mov word [esi + edx*2 - 0x13182], ax
xor ecx, edx
movzx eax, dl
lea edx, [esi + edx - 0x98c0]
dec ecx
mov dword [esi + eax - 0xc4], edx
adc eax, ecx
adc esi, 0xfffffffe
movzx edx, al
xchg cx, ax
jmp fcn.0124cf7b
Function at 0x13d98f0
Capabilities:
Get number of processors

Disassembly:
add ebp, ecx
xadd al, dl
shl dx, 0x48
jbe 0x13a2675
retf
movsx edx, ax
lea edi, [edi + eax - 0x650aeec3]
xadd edx, eax
shl dword [esp + edx - 0x650add8e], 0x85
xor ecx, ebx
add ax, dx
dec eax
bswap ecx
adc dx, word [esp + edx - 0x650add8e]
not edx
setae dl
xor ecx, 0x59c4135
jmp 0x1326dc8
dec cx
push 0x56013a39
mov eax, 0x75071b1a
rol cx, 1
sar ax, 0xe8
inc cx
lea edx, [eax + 0x67b146bd]
inc edx
xor cx, 0x6b0d
add dl, byte [esp + eax - 0x75070014]
bswap edx
dec cx
sal dl, 0xa3
jae 0x134ceed
sal al, 0xc1
shr byte [esp + 2], 0x87
not ecx
ror ecx, 2
xor ebx, ecx
sub dl, 0x8e
jbe 0x122fc1c
push 0xc3b68426
mov ecx, dword [esi]
jmp 0x13af517
push edx
inc ecx
sal dword [esp + eax - 0x4183a482], 0xd8
rol ecx, 1
dec edx
pop eax
dec ecx
call fcn.017ae0ac
dec eax
mov edx, dword [ebx]
dec esp
mov esi, dword [ebx + 8]
inc ecx
mov eax, 0xdb935af
inc edx
mov cl, byte [ebx + eax*4 - 0x36e4d6ac]
inc ecx
movsx esi, ax
inc ebp
mov edi, eax
dec ecx
lea ebx, [eax + ebx - 0xdb935a5]
dec edi
lea edx, [eax + eax*8 - 0x7f60187c]
inc ecx
movzx ebp, di
dec esp
shrd edx, esi, cl
call fcn.013be9e8
dec esi
lea edx, [esi + eax*8 + 0x6a2e8a8c]
dec ecx
shr edx, 0xa3
inc ecx
bswap esp
inc ecx
movzx ecx, si
inc edi
lea esp, [eax - 0x250c47cf]
inc ecx
rol esp, 2
inc edi
lea esp, [esp + esi + 0xd9fd5e5]
push edi
push ecx
inc esi
xor dword [esp + eax*2 - 0x7e2e], esp
inc ebp
movsx ecx, al
inc eax
rol dh, 0x81
dec edx
mov edi, dword [esp + eax*4 - 0xfc64]
inc ecx
movzx edx, cl
dec ebp
arpl sp, sp
dec ebp
adc ebp, esp
dec edi
lea ebx, [ebx + eax - 0x3f1d]
dec ecx
bswap esi
dec edx
shl dword [esp + eax - 0x3f1b], cl
inc ecx
pop esi
inc edi
movzx esp, word [ebx + eax*8 - 0x1f8d8]
inc ecx
dec edx
inc sp
xor esp, edi
dec edx
mov dword [esp + eax - 0x3f1b], 0xaf8e3a37
inc bp
xor esp, edx
inc ecx
mov eax, edx
dec edx
sar dword [esp + eax*4 - 0xfc6c], cl
push ecx
inc cx
inc esp
dec esi
lea edi, [eax*2 - 0x6b50736f]
inc cx
ror esp, 1
inc dx
ror dword [esp + eax*8 - 0x1f8d0], 0x8e
jb 0x138dd35
mov ecx, 0x49b37103
xor cx, cx
lea edx, [ecx*4 + 0x70b94c04]
mov ecx, dword [ecx + esi - 0x49b30000]
sub edx, edx
lea eax, [edx + 0x7b0fbc15]
or edx, dword [esi + edx + 4]
lea eax, [eax*8 - 0x7372f1e1]
add ecx, edx
push eax
mov dword [esi + eax - 0x650aeec3], ecx
mov ecx, eax
mov ecx, dword [eax + edi - 0x650aeec7]
jmp 0x1253fda
mov eax, edx
and eax, dword [esp]
lea edi, [edi + eax - 0x4183a480]
sub dx, 0x8aa
not dword [esp + eax - 0x4183a484]
xor ecx, ebx
mov dword [esp + eax - 0x4183a484], eax
jmp 0x13504af
mov eax, dword [ecx]
mov ecx, 0xa3261c15
push ecx
mov dword [esi], eax
sal byte [esp + 4], 0x65
sub byte [esp + 7], cl
dec byte [esp + 5]
movzx ecx, word [edi]
neg dword [esp]
xor cx, bx
jmp 0x131fc57
mov eax, dword [esi]
mov edx, 0x9029f339
shr edx, 0x9a
mov edx, dword [esi + edx*2 - 0x44]
mov cl, byte [esi + 8]
adc esi, 6
shrd eax, edx, cl
mov ecx, 0x4183a584
mov dword [esp + ecx - 0x4183a584], ecx
mov dword [esi + ecx - 0x4183a584], eax
movsx edx, word [esp + ecx - 0x4183a584]
inc word [esp + ecx - 0x4183a583]
and ecx, dword [esp + ecx - 0x4183a584]
mov ecx, dword [ecx + edi - 0x4183a484]
jns 0x139c598
Function at 0x13dc3f6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.01363ec8
xor ebx, eax
add ebp, eax
lea esp, [esp + 0xc]
jmp 0x13141b7

Function at 0x13e1be9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ebx
mov eax, dword [ecx + ebx - 0x6e020151]
dec ecx
not esi
dec eax
mov dword [esp + ebp*2 - 0x35c], edx
pop edx
xor eax, edi
dec ecx
and ecx, 0xcd3aa8a4
inc ecx
dec dh
inc esp
add dl, dl
rol eax, 3
inc esp
xor byte [esp + ebp*2 - 0x35b], dl
inc ebp
movsx esp, dx
inc ecx
bswap esi
lea eax, [ebp + eax - 0x61129cb6]
inc ecx
movzx esi, dh
dec ecx
ror edx, 0xe1
xor eax, 0xc6ba9181
movzx ecx, byte [esp + ebp*4 - 0x6b7]
inc ebp
add edx, esp
inc edx
rol byte [esp + ecx - 0x4c01fffc], 0x84
sub eax, 0xb9b6801a
dec edx
or dword [esp + esi*2 - 0x39fffffe], edx
dec edx
mov dword [esp + ecx - 0x4c020000], edi
dec eax
dec esi
jns 0x12fbcbb
Function at 0x13e3e3d
Capabilities:
Encode data using xor

Disassembly:
inc edx
mov edx, dword [ebx + esi*2 - 0x570ff04c]
inc edx
mov cl, byte [ebx + esi*2 - 0x570ff048]
inc ecx
inc esi
dec edx
lea ebx, [ebx + esi*2 - 0x570ff04c]
shr edx, cl
dec esi
lea edi, [esi*4 + 0x32ab006]
inc ecx
mov dword [esi + ebx - 0x2b87f827], edx
dec edx
mov dword [esp + esi*2 - 0x570ff04e], 0x8b047497
inc edx
movsx esi, word [esp + esi - 0x2b87f824]
dec edx
sal dword [esp + esi*2 - 0x570ff04e], 0xd3
dec edi
lea ebx, [ebx + esi*2 - 0x570ff052]
inc edi
mov eax, dword [esi + ebx - 0x2b87f827]
inc esp
movzx edx, si
dec ecx
lea eax, [edx + esi*8 - 0x61536174]
mov ah, 0x74
mov dl, 0xf
invalid
dec edx
lea ecx, [esi*8 + 0x51a2902e]
inc esp
xor eax, edi
call fcn.017af557
pop es
jne 0x13e3ea4
ror dword [eax + 0x61], 1
adc byte ss:[ebx + 0x366138ef], dl
adc byte [ebx + 0x366134a3], bh
adc bl, ch
mov bh, 0x20
popal
adc byte ss:[edi + 0x36cb08d3], ah
adc ch, cl
test eax, 0x10475c4c
pop esi
sub eax, 0xb7bf41bb
stc
les eax, [edx + 0x49ed70e0]
jnp 0x13e3f31
mov bh, 0x48
fdiv qword [edx + 0x71]
cmp byte [ecx], 0x28
xchg edx, eax
js 0x13e3f16
mov al, byte [0xdb0e5a9c]
inc esi
jge 0x13e3e81
loope 0x13e3f05
ja 0x13e3ef2
mov ebp, 0x2a4acb70
adc ah, ch
invalid
xchg byte [eax + edx*8], dh
loope 0x13e3f5b
sahf
dec edx
inc eax
ret 0x7c67
test ch, ah
jne 0x13e3f30
insd dword es:[edi], dx
inc esp
imul eax, eax, 0xaeaccf6e
dec ebx
xor ah, byte [edx]
push edi
jge 0x13e3f66
push 0xffffffffffffff87
mov byte [0x46a62c4d], al
ror edi, 0xba
scasb al, byte es:[edi]
aad 0xb5
mov esi, 0x65055005
xor dword [ebx - 0x7a0e9016], ebp
sbb eax, 0x8c85c7aa
sbb al, 0xfb
mov ebx, 0xb8f13c7d
in al, dx
adc byte [ebx + 0x703665e3], ch
mov ch, 0xcc
stc
outsd dx, dword [esi]
aaa
jne 0x8e2b1096
iretd
mov edx, 0xbeb5d5ae
add eax, 0x31650550
stosd dword es:[edi], eax
ljmp 0xc7aa
stosd dword es:[edi], eax
jecxz 0x13e3fb7
jo 0x13e3f0a
int3
aaa
shr esp, 1
mov word [esi - 0x33a7461e], gs
sub al, 0x88
scasb al, byte es:[edi]
loop 0x13e3f1b
pop eax
int3
call dword [ebx]
int1
popal
inc edx
jge 0x13e3f4f
nop
or esp, ebp
arpl word [ebx], sp
arpl word [edi - 0x728c0b49], si
pushfd
not byte [ebx]
std
popfd
leave
js 0x13e3fdc
mov dl, 0x63
mov edx, esp
jns 0x13e3fc0
ret
and al, 0x91
outsb dx, byte [esi]
mov dh, 0xf2
cmc
lahf
xchg ecx, eax
push ebp
test byte [esi + 0x4e416b4], 0x8f
xor edi, ebx
loop 0x13e3f6d
inc edi
push es
and ah, bh
or eax, 0xefe645de
popal
in al, 0x7c
mov dword [0xe34de1c8], eax
sahf
xor dword [ebx + esi], edi
mov ebp, 0xeb336e2a
mov al, 0x1b
and bh, byte [edi]
out 0x90, eax
or dword [edx], edi
pop ecx
or edi, eax
lahf
push es
cmp ch, byte [esi]
lea esi, [ebx + 0x63]
bound ebx, qword [ecx]
rcl byte [ebp + 0x77], cl
mov esi, 0x6cedeafe
lodsb al, byte [esi]
push esp
inc ebx
cmp edx, dword [ebx + 0x62987dc6]
sbb byte [ecx], 0xd3
push 0xdd0ae665
or bl, ch
lcall 0x8b11, 0x866d2d91
stosb byte es:[edi], al
push ebx
int1
pop esi
scasd eax, dword es:[edi]
clc
jl 0x13e4011
pop edi
idiv esi
xchg edi, eax
fild word [0x289c3f31]
push 0x2cec823f
sal byte [edi], 0x65
pop eax
jecxz 0x13e404f
ret
in eax, dx
push cs
retf
Function at 0x13e594f
Capabilities:
Encode data using xor

Disassembly:
call 0x1322b51
shr eax, 0x5a
mov eax, dword [esi + eax*8 - 0x6c]
push 0xdf0cbb98
jns 0x13cbcf7
mul ecx
mov dword [esi], edx
mov edx, dword [esp]
mov dword [esi + 4], eax
movsx eax, dx
movzx ecx, byte [esp]
and dx, dx
mov ecx, dword [edi + ecx*4 - 0x260]
neg edx
dec eax
js 0x13eba83
lea edx, [esp + edx + 0xc]
ror eax, 0x45
xor al, 0x9e
mov byte [edx + eax*8 - 0x3ffff670], cl
lea edx, [eax + eax*8 - 0x42406f61]
call fcn.012f2c99
mov eax, 0x3b162e2d
mov ecx, dword [esi + eax - 0x3b162e2d]
jmp 0x13ad315
lea edi, [edi + edx - 0x20f34464]
xor ecx, ebx
jmp 0x13a7cce
Function at 0x13eb998
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
ror eax, 1
inc ecx
movsx esi, ah
inc ecx
add eax, 0x587d33a
inc ecx
rol eax, 1
inc ecx
push esp
dec esi
lea esi, [esi - 0x34edd5c8]
inc ecx
xor eax, 0x74903a1b
inc esp
mov byte [esp + 5], dh
dec ecx
lea edx, [esp + esi*2 - 0x5d433d4f]
dec ecx
sal esp, 0xa9
inc ecx
adc eax, 0x3f2a15bf
dec eax
mov dword [esp + 8], esi
inc esp
xadd dword [esp + 0xa], esi
dec edx
mov dword [esp + esi*2 - 0x1fff6], edi
inc edx
and dword [esp + esi - 0xfffd], 0x1f1f4913
inc edx
not byte [esp + esi*8 - 0x7fff5]
inc esi
xor dword [esp + esi - 0xfff7], eax
call fcn.0133774c

Function at 0x13edd23
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
mov edi, dword [esp + ecx*8 - 0x28fffff0]
dec eax
mov dword [esp + ecx*2 - 0xa400000], 0xde29ad8f
inc ebp
movsx esp, dl
dec eax
arpl bp, bp
inc esp
xor byte [esp + ecx*4 - 0x147ffff8], dh
dec esp
mov dword [esp + edx*4 - 0x3c254], ecx
dec esp
adc ebp, ebp
inc ecx
pop esi
shl dword [esp + edx - 0xf097], 0x3f
inc ecx
pop esp
inc ecx
pop edi
jbe fcn.01228351

Function at 0x13edd65
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + edx*4 - 0x214], eax
xor dword [esp + edx - 0x75], esi
movzx edi, word [esp + edx - 0x7c]
dec eax
mov edi, dword [esp + edx - 0x75]
call fcn.0123dcc5

Function at 0x13f454b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xchg byte [esp + eax + 6], al
add ax, ax
lea esi, [esi + eax*4 - 0x646]
call fcn.01231d9a

Function at 0x13f88f7
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + eax - 0x5b233736]
sar eax, 0xb4
movzx ecx, al
mov word [esi + eax*8 - 0x2d90], dx
ja 0x1357b97
mov eax, 0xda96a3ab
mov ecx, dword [edi]
rol al, 0x61
movzx edx, ax
lea edi, [edi + edx*2 - 0x146aa]
neg al
adc edx, eax
xor ecx, ebx
or edx, edx
or ax, 0x27a8
not ecx
jae 0x1385d46
call fcn.0125619e
pop ecx
xor ebx, edx
mov dword [esp], eax
sar dword [esp], 0xea
adc ebp, edx
xor byte [esp + 2], 0xbc
mov edx, 0x64a5b12c
movzx eax, byte [edi + edx - 0x64a5b128]
movzx ecx, byte [esp + edx - 0x64a5b12c]
rol dword [esp + edx - 0x64a5b12c], cl
ror ecx, cl
lea edi, [ecx + edi - 0x273]
xor al, bl
rol ecx, cl
xadd word [esp + edx - 0x64a5b12c], cx
ror byte [esp + ecx - 0x7800a4a6], cl
inc al
not al
not cl
inc al
and word [esp + edx - 0x64a5b12b], dx
not al
xor edx, edx
dec edx
sub ecx, dword [esp + ecx - 0x7800a458]
xor bl, al
dec ecx
sal cl, 0xc4
lea eax, [esp + eax + 4]
rol edx, 0x7a
not edx
add dword [esp + edx*2], ecx
add edx, dword [edx + eax]
mov dword [esi], edx
call fcn.017b3f46
mov ecx, dword [esi]
mov edx, 0x1b9f4c18
shl edx, 0x10
mov eax, 0x5b233738
xor dx, word [edx + ecx - 0x4c180000]
jmp 0x124db73
Function at 0x13fc1af
Capabilities:
Encode data using xor

Disassembly:
inc ecx
ror esp, 3
dec edx
rol dword [esp + esi*2], 0x1c
dec edx
rol dword [esp + esi], 0x33
sbb esi, 0xa99ffeb6
dec edx
mov dword [esp + esi], edi
jb 0x121fb08
adc ebp, ecx
or eax, 0x4084033b
jmp ebp
inc ebp
add edx, eax
inc ecx
xor esp, 0xefbcd913
inc bp
xchg edi, eax
inc dx
dec dword [esp + esi + 6]
jl 0x134e8b4
add eax, ebx
out dx, al
ror dword [esi - 0x34], 1
xor eax, 0x4691b110
int3
inc edi
mov esp, dword [ebx + esi - 0x6a848625]
inc cx
sal esi, 0x22
inc ecx
pop ecx
inc esp
xor esp, edi
inc ebp
and esi, edi
inc ebp
movzx eax, di
inc ecx
not esp
inc ecx
not al
dec edx
mov dword [esp + esi*8], 0xd80e202c
inc ecx
bswap esp
jbe 0x13d9398
mov ecx, dword [edi]
add edi, 4
mov edx, 0x2904aab8
lea eax, [edx + edx*4 + 0x9d1018]
xor ecx, ebx
dec eax
shl ax, 0x44
ror ecx, 1
not ax
shr eax, 0x98
and dl, dh
lea ecx, [ecx + edx - 0x7a244ad2]
xor dl, al
rol ecx, 3
inc eax
call fcn.01332ea6
salc
inc esi
xor eax, eax
jl 0x13fc25d
das
cld
sub eax, 0x1ff13aca
adc byte [edi + 0x7b], ah
xor byte [edi - 0x6d65efcb], 0xfa
or dword [edi], ebx
adc al, 0x10
xor esi, esi
retf 0x8b7e

Function at 0x17ab6ac
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jns 0x13f67f2
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.01362e5c
cmp ax, di
stc
jne 0x13bd583

Function at 0x17bb20d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
shr al, 0x42
add ecx, esp
shl ax, 0xac
sbb eax, eax
sar eax, 0x99
mov word [ecx], dx
call fcn.0123e9f7
add eax, 0x3e2ee3bb
neg cl
lea eax, [eax + eax*4 + 0x659d5a92]
not cl
lea eax, [eax - 0x684ecc44]
rol eax, 0x50
xor bl, cl
jmp 0x1256d11
call fcn.01395541
call fcn.0135d8ad
mov eax, dword [edi]
add edi, 4
sar dword [esp], 0xa2
xor eax, ebx
not eax
call fcn.017c00a4
bswap edx
ror al, 0x21
lea edx, [edx + eax - 0x4dc299a3]
inc cl
ror byte [esp + 0xe], 0x86
mov dword [esp], eax
bswap edx
jne 0x138aa50
mov ecx, 0x1eb7a094
lea edx, [ecx*2 - 0x4de508e4]
ror dl, 0x41
mov dx, word [ecx + esi - 0x1eb7a094]
not cl
movzx ecx, byte [edi + ecx - 0x1eb7a06b]
mov eax, 0x692fbe05
neg eax
xor cl, bl
xor al, al
neg al
neg cl
not eax
add cl, 0xa4
sar eax, 0xe3
ror cl, 1
jmp 0x1347bc9
Function at 0x17c18a0
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
seto byte [esp + eax - 0x7a012af8]
xor ebx, edx
and ax, ax
adc ebp, edx
shr al, cl
xchg dword [esp + eax - 0x7a012a3e], ecx
dec byte [esp + ecx - 0x3d00af00]
rdtsc
setb byte [esp + ecx - 0x3d00af01]
mov dword [esp + ecx*2 - 0x7a015e02], ecx
lea esi, [esi + ecx*2 - 0x7a015e0a]
jp 0x13ea4c6
mov dword [ecx + esi - 0x3d00aefd], eax
lea eax, [ecx*2 - 0x20f03d78]
sar cl, 0x63
not byte [esp + ecx*2 - 0x7a015dff]
mov dword [esi + ecx*2 - 0x7a015e00], edx
mov edx, 0x73b2ae98
sub byte [esp + edx - 0x73b2ae97], 0x1e
adc cx, dx
pop ecx
jbe fcn.0124cf7b
not edx
xchg ah, cl
rol eax, 0xeb
rol ecx, 0x96
sub edx, 0xf0257029
and cx, 0x57af
rol edx, cl
dec edx
not edx
xor ax, 0xf13e
xor edx, 0xa187d817
sar al, 0xe4
mov dword [esp + eax - 0x7a012af8], eax
not edx
rol dword [esp + eax - 0x7a012af8], 0x9f
rol word [esp + ecx - 0x7fc44201], 0xe5
adc ecx, 0x7fa4aa01
bswap edx
ja 0x136d616

Function at 0x17c8494
Capabilities:
Encode data using xor

Disassembly:
push 0x5c38969c
dec eax
add ebx, 0xc
dec eax
not dword [esp]
xor esi, esi
call fcn.0139a379
sub edx, edx
movzx ecx, byte [edi + ecx - 0x572b2897]
not edx
adc edi, 1
xor cl, bl
call fcn.0121f0fb
dec esi
lea edi, [edx*8 - 0x70e94dd5]
dec ebp
lea ebx, [ebx + esi*2 - 0x3c2]
inc ecx
mov esi, 0x922ed8b4
inc ebp
mov edi, dword [ebx + esi*4 - 0x77c]
inc esp
movsx ecx, dh
dec esp
lea esp, [edx*8 - 0x576928cf]
inc ecx
add ch, ah
inc esp
xor edi, edi
inc ecx
not edi
inc ecx
dec edi
and si, dx
shl dl, 0x86
inc ecx
rol dl, 0x22
inc ecx
rol edi, 2
inc ebp
lea edi, [edi + esi*4 + 0xea0e01e]
push edi
inc esp
xor dword [esp + esi*4], edi
dec esi
pop edi
inc eax
sal ch, 0x41
dec ecx
inc edx
jno 0x17b3e7a
jmp 0x137dec6

Function at 0x17c860e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], eax
mov ax, word [esi]
shl dword [esp], 0x7b
setbe byte [esp + 3]
mov cl, byte [esi + 2]
Function at 0x76b41370
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_AddClusterResourceDependency___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.AddClusterResourceDependency
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x76b413d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_AddClusterResourceNode___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.AddClusterResourceNode
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x76b41430
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BackupClusterDatabase___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.BackupClusterDatabase
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x76b41490
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CanResourceBeDependent___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.CanResourceBeDependent
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x76b414f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_ChangeClusterResourceGroup___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.ChangeClusterResourceGroup
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x76b41550
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CloseClusterGroup___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.CloseClusterGroup
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x76b415b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CloseClusterNetInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.CloseClusterNetInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x76b41610
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CloseClusterNetwork___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.CloseClusterNetwork
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x76b41670
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CloseClusterNode___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.CloseClusterNode
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x76b416d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CloseClusterNotifyPort___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.CloseClusterNotifyPort
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x76b41730
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CloseClusterResource___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.clusapi.dll
mov dword [ebp - 0x40], str.CloseClusterResource
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4