joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf17693
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], ecx
mov edx, dword [ebp]
mov eax, ecx
bswap ecx
dec eax
mov eax, dword [ebp + ecx*2 - 0x727b4df6]
push ecx
not edx
dec ecx
not eax
xor word [esp + ecx - 0x393da6f6], cx
or ecx, ecx
call fcn.0167eb27
call fcn.01818bc7
or di, dx

Function at 0xf23e1f
Capabilities:
Encode data using xor

Disassembly:
inc ecx
ror ah, 0xc1
dec edx
mov edi, dword [esp + edx*2 - 0xfe]
dec edx
mov dword [esp + edx*2 - 0xfe], 0xe533fe2b
dec esi
mov dword [esp + edx*2 - 0x106], edi
jae 0xf88460
inc ecx
mov ebx, 0xb4a00199
call fcn.00cfa93f
not al
mov ecx, 0xf811d12a
neg ecx
dec al
not al
call fcn.017d9bd0
xor al, bl
movzx ecx, dl
rol ecx, 0x49
sbb al, 0x9b
ror dword [ecx + 0x1c], 0x9b
or dl, 0x1c
sub cx, word [esp + edx*2 - 0xb9]
neg al
xor al, 0xb0
call fcn.00f50e93
mov edx, 0x1b075c0e
rol byte [edx], 1
add byte [edx + 0x1b075c0e], bh
xor edx, 0xdd2efa02
mov edx, dword [esi - 4]
mov eax, 0x468422ad
call fcn.01756cc5
das
js 0xf23e7d
lds ebx, [ecx + 0xeb83f0f]
neg byte [ebx + 0xe8c0d2b]
neg byte [ebx + 0xe9c750d]
neg byte [ebx + 0xeb42d01]
neg byte [ebx + 0xebc2d31]
neg byte [ebx - 0x5e126f8b]
mov byte [eax], dh
cmp esp, dword [ebx + 0x45]
mov dl, 0x17
in eax, dx
lcall 0x1fa, 0xeb53266c
or al, dh
add byte [ecx], 0x28
jo 0xf23f15
sub eax, 0x8c06323d
jge 0xf23e68
lodsb al, byte [esi]
pushfd
cmp al, byte [edx]
cld
mov al, byte [0x3a9cbcc4]
add bl, byte [eax - 0x6999b7bc]
pop ss
outsb dx, byte [esi]
cld
and eax, 0x42d3d5a9
test al, 0xf9
test al, 0xef
invalid
mov eax, dword [0x9814ac5]
dec ebx
xchg ebp, eax
pop edi
insb byte es:[edi], dx
jae 0xf23f27
sbb edx, dword [ecx + 0x182f198]
fdiv qword [esp + ebx*4]
xor al, 0x9c
loope 0xf23f67
xor al, byte [esi]
insb byte es:[edi], dx
pop esp
add byte [eax - 0x63], bl
cmp al, byte [edx]
nop
pop eax
sbb byte [eax], bh
popfd
cmp al, byte [edx]
call 0x7788a58a
inc ebx
imul byte [esi + 0x250f7f61]
fsub qword [ecx + 0x272798e2]
fbld tbyte [ebx + 0x276bf0c6]
fbld tbyte [ebx + 0x2753ccc4]
fbld tbyte [ebx + 0x4f1640d6]
push edx
xchg edi, eax
or byte [0x6f88667a], bl
outsd dx, dword [esi]
adc edx, dword [edi - 0x6592669b]
ja 0xf23fc3
push ebx
or byte [edx - 0x56], al
sbb eax, 0xb1ef8c2f
rol dword [edi - 0x515dceb3], 1
xor ebx, dword [eax + 0x77]
dec ebx
xlatb
aad 0x39
mov dword [edi], edi
je 0xf23f6f
inc ebx
dec ebp
mov dword [0xc9887ac4], eax
fld dword fs:[edi]
iretd
fnsave dword [esi + 0x7392897a]
jmp 0x250e2c32
dec eax
adc esi, eax
inc ebx
mov ecx, dword [edx + ebp - 0x8b]
inc si
and dword [esp + edx - 0x75], ebx
inc edx
dec dword [esp + edx*4 - 0x201]
call fcn.00ce6f5a
dec eax
arpl ax, ax
jae 0xf535f3

Function at 0xf2b5f5
Capabilities:
Encrypt data using speck

Disassembly:
pop edx
rol ecx, 1
xor al, ah
lea edx, [eax + eax*8 - 0x4ad373ef]
sbb ecx, 0x5d23aa31
rol ecx, 3
call fcn.0176d633
Function at 0xf2b60f
Capabilities:
Encrypt data using speck

Disassembly:
call 0xf3259a
not al
dec al
xor bl, al
add cl, byte [esp + 2]
lea eax, [esp + eax + 8]
mov dword [eax], edx
jae 0xedc21d
mov ecx, 0xa18f4b3e
mov edx, dword [edi - 4]
mov eax, ecx
or ecx, eax
call fcn.016e5ab9
lea eax, [ecx + eax - 0x72c2f329]
call fcn.0167f9f3
mov byte [eax], dl
push esi
call [ebx + 0xf14bed]
lahf
movsb byte es:[edi], byte [esi]
add edi, edi
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x40ff03a4], edx
sal edi, 0xa4
add edi, edi
add al, 0x54
sal dword [eax], 1
and bh, bh
stc
push esp
insb byte es:[edi], dx
pop ecx
pop es
daa
xchg ebp, eax
mov al, 0xe0
add ch, byte [edi + ebp]
hlt
xadd word [esp + ecx - 0x5f0c55fd], cx
sbb ecx, 0x8bb9fa90
add ebp, 4
sar word [esp + 1], 0xcd
movsx edx, cx
xor eax, ebx
inc byte [esp + 3]
shr dword [esp + 4], cl
bswap eax
neg dl
or byte [esp + 5], dh
mov dword [esp + 3], 0xe89df50a
dec eax
lea ecx, [edx + ecx*4 - 0x295b5b6e]
xadd dword [esp + ecx*2 - 0x47dc8b53], edx
rol eax, 1
rol dx, cl
jb 0x18419c6
ror ecx, 0x63
neg eax
xor ebx, eax
call fcn.016ecef0
not ecx
movzx eax, byte [ebp + ecx - 0x4655ffc9]
sar cx, cl
jne 0x18702ba
mov ecx, 0x5f0c5610
mov dword [esp + ecx - 0x5f0c5610], ecx
not eax
setns cl
and edx, eax
mov eax, 0x1e14b981
mov dword [ecx + esi - 0x5f0c55f8], edx
mov dword [esp + eax*4 - 0x7852e5fc], eax
xor word [esp + ecx - 0x5f0c55f6], ax
lea esi, [esi + eax*4 - 0x7852e5fc]
pop eax
rol al, 0x47
or word [esp + eax - 0x5f0c5607], 0x501f
mov eax, dword [ecx + ebp - 0x5f0c5600]
jne 0xeda74c
rol cl, 1
dec esi
lea edx, [0xfbaf6e24]
dec edi
lea edx, [edx + ecx + 0x10958b9b]
inc ecx
mov edx, edx
neg cl
jmp 0xe8ea1a
sal ax, 7
xor edx, ebx
movsx ecx, al
dec edx
jmp 0x17da2b6
call fcn.01654b4f
sub edi, 4
mov edx, dword [edi]
mov eax, 0x9711c2a4
jmp 0x1685bee
shr al, 0x46
not edx
xor edx, 0x60b6ed9a
sar cl, 0xa1
lea edx, [edx + ecx*4 - 0x791273bc]
jns 0x1619be3
mov edx, 0x4b25f10e
lea edx, [edx + edx*8 - 0x1160a941]
mov ecx, dword [ebp]
sub ebp, 0xfffffffc
jmp 0x175d898
lea edx, [ecx + edx + 0x631b6c24]
jmp 0x16c9373
xor al, bl
dec dword [esp + ecx - 0x4655fff5]
inc al
xor al, 6
not al
xor al, 0xb1
jmp 0x18a2328
movsx edx, cx
sal edx, cl
ror al, 1
shl dl, 0xc6
call fcn.00f42431

Function at 0xf332f7
Capabilities:
Encrypt data using speck

Disassembly:
dec ebp
lea ebp, [ebp + eax*2 - 0x1369e059]
call fcn.00d15f69

Function at 0xf398cb
Capabilities:
Encode data using xor

Disassembly:
dec ecx
lea edi, [edx + eax + 0x5d8b84af]
dec eax
mov edi, dword [esp + eax - 0x43b44b05]
dec eax
mov dword [esp + ebx - 5], 0xbda0aa21
dec edx
lea ecx, [edi*4 + 0x233eae2f]

Function at 0xf42ed4
Capabilities:
Encrypt data using speck

Disassembly:
lea edi, [edx + edi - 0x49615fd6]
sal dl, 3
sar edx, 0xec
shr edx, 0x5e
xor ecx, ebx
lea edx, [edx + 0x54386c83]
lea ecx, [ecx + edx*2 + 0x429ee193]
xor ecx, 0x862746bf
mov eax, edx
call fcn.0171acb7
Function at 0xf4c839
Capabilities:
Encode data using xor

Disassembly:
shr cx, cl
rol eax, 1
lea edx, [ecx*4 + 0x2ca31035]
lea eax, [eax + edx*2 - 0x61708c0b]
xchg ecx, edx
pop ecx
rol eax, 3
inc byte [esp + 7]
inc eax
not dx
not eax
neg eax
mov ecx, 0xd5a3a419
xor ebx, eax
shr edx, cl
call fcn.0170142c
Function at 0xf536bd
Capabilities:
Encode data using base64

Disassembly:
dec ebp
lea esi, [esi + ebx - 0x550707a1]
call fcn.00f9a958
xor word [esp + 5], 0x2f3f
xor eax, 0x950a6625
jmp 0xfd50e1
neg eax
shl dword [esp + 4], 0x5f
inc eax
mov ecx, dword [esp + 4]
pop ecx
inc ecx
not eax
xor ebx, eax
add ebp, eax
neg dword [esp + ecx*4 - 4]
jbe 0x17be84d
xor dword [esp + ecx*8 - 8], ebp
ret

Function at 0xf60cfc
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [eax + ebp - 0x6d800001], edx
call fcn.00d1f3b0
mov ecx, dword [esp + 7]
rol cl, 0x61
rol al, 1
and dword [esp + ecx*8 - 0x4800028f], ecx
jno 0x175eb83
xor ebx, eax
and edx, ecx
call fcn.01747bdf
xor al, 0x3c
sub dword [esp + ecx*4 - 0x2400013c], 0xb1935106
neg word [esp + ecx - 0x900004a]
rol al, 1
xchg dword [esp + ecx*2 - 0x1200009b], ecx
or ecx, ecx
dec al
xchg dword [esp + 9], ecx
xor bl, al
dec ecx
rol ecx, cl
pop ecx
lea eax, [esp + eax + 0xc]
sub ecx, 0x32b433ba
mov dword [eax], edx
sar cl, 0xa3
jb 0x17a0a7b
and word [esp + 4], dx
xor eax, ebx
neg edx
shl edx, 0xe8
or dword [esp + edx*8 - 0x75ffe], ecx
rol eax, 2
lea edx, [edx*2 + 0x1e17b095]
and dword [esp + edx*2 - 0x3c33111f], ecx
xor eax, 0xaf2700b7
push ecx
xor cl, ch
rol eax, 3
neg dword [esp + edx - 0x1e198891]
ror ecx, 0xcb
not eax
xchg dword [esp + edx*2 - 0x3c331121], edx
jne 0x16c92d2
mov eax, dword [esi]
mov ecx, 0xbf362e2d
lea edx, [ecx*4 - 0x29c6c14e]
rol edx, cl
mov cl, byte [esi + edx - 0x3eecda5e]
not edx
jae 0x16213c0

Function at 0xf651c5
Capabilities:
Encode data using xor

Disassembly:
out 0x4d, eax
loop 0xf651f4
sbb al, 0xe1
mov cl, dl
mov cl, 0x54
clc
in eax, 0xa8
cdq
aad 0x8d
js 0xf651a0
in eax, 0xa8
cdq
invalid
dec esp
and al, 0xc
add ecx, 0x63cf
jmp ecx
inc ecx
bswap ecx
xor ebx, ecx
call fcn.01777895
lea ebp, [edi + 0x40]
cmp eax, 0x19936f4e
pop edi
adc al, byte [edx]
add ah, byte [ebx]
xchg ebx, eax
sbb dword [edi + 0x16], ebx
jle 0xf65196
stosd dword es:[edi], eax
dec edx
scasb al, byte es:[edi]
and edx, dword [edi]
bound edi, qword [ecx]
fsub st(0), st(0)
pop esp
xchg ebp, eax
inc ebx
add al, 0xf0
popfd
fst qword [edi]
pop ss
jns 0xf65235
xor dl, byte [ebx]
cld
sti
cli
xor dword [eax - 0x33ddb4e9], esp
pop eax
aaa
js 0xf6520c
lcall 0xebca, 0xa6408e96
fdiv qword [esi + ebp*8 + 0x7d72ac3f]
cmpsd dword [esi], dword es:[edi]
wait
push esp
stosb byte es:[edi], al
push 0xffffffffffffffbb
cmp al, 0xfb
in al, 0x65
and dh, byte [esi]
loop 0xf651ba
jmp 0xf651ea
shr dword [edi + 0x1d46470d], 1
in eax, 0x99
scasd eax, dword es:[edi]
or eax, 0xe51d4647
cdq
push eax
dec si
inc ecx
idiv dword [eax - 0x54]
aaa
scasb al, byte es:[edi]
or eax, 0x1f9c9ad5
rol dword [edi - 0x232cb749], cl
lcall 0x48b7, 0x87d31f9c
rcr esp, cl
or esi, dword [0x66a9f175]
cld
jns 0xf65223
fadd qword [eax - 0x5d]
pushal
clc
jecxz 0xf65268
inc eax
mov dword [0x1be3f860], eax
xor ebx, dword [edi]
and dword [0x2c217526], esp
out 0xfa, al
or al, 0x7b
arpl word [eax + 0x2805336f], cx
sar dword [eax - 0x33b62a3e], 1
cdq
das
push cs
cmpsd dword [esi], dword es:[edi]
adc edx, esi
jno 0xf65246
add esp, eax
mov ebx, 0x1b4fef33
sal edi, 1
invalid
Function at 0xf710f5
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, ecx
not al
add ebp, ecx
mov eax, dword [esi + edx - 0x25b7]
mov dword [esp + edx*2 - 0x4b72], 0xa12c502d
movzx ecx, dx
shl edx, cl
mov cl, byte [esi + edx - 0x71fffffa]
jbe 0x172bdf1
dec eax
push ecx
add dl, 0xaf
xor eax, 0x4421af33
ror dword [esp + ecx - 0x3eeb40], 0x4a
neg eax
call fcn.016a3653
mov ecx, dword [ebp]
mov edx, 0xc507d02c
ror dl, 0x41
mov dl, byte [ebp + 4]
adc ebp, 6
mov byte [ecx], dl
sub edi, 4
mov eax, dword [edi]
call fcn.016fe2d2
add dx, 0x172e
and byte [esp + edx - 0x7200172e], dh
shl eax, cl
add word [esp + edx - 0x7200172d], 0x34a2
or byte [esp + edx - 0x7200172e], dl
mov ecx, 0xef2ea636
mov dword [esi + edx - 0x7200172a], eax
movzx eax, dl
call fcn.0173f177
mov edx, 0x102285be
push edx
movsx ecx, dx
mov edx, dword [edi + edx*4 - 0x408a16fc]
xor edx, ebx
pop ecx
call fcn.0100fc0b
xor eax, ebx
not cx
ror ecx, 0xba
not eax
jae 0x170f8d0

Function at 0xf723a9
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov eax, dword [edi - 4]
movzx ecx, dx
shr dl, 0xa6
xor eax, ebx
inc eax
sar ecx, 0x26
bswap eax
neg eax
and edx, 0xb20d3532
inc ecx
ror dl, 6
ror eax, 1
ror dl, 0x42
xchg dh, dl
xor ebx, eax
xor ecx, 0xfa02c40b
sar cx, 0xec
adc ebp, eax
jmp 0xfcdd95
inc eax
mov dword [esp + eax*4 - 0x508c8304], ecx
add ebp, edx
rol eax, 0xdf
bswap ecx
mov ecx, dword [esi + ecx*8 - 0x5f15cf0]
sar al, 0xa7
call fcn.0185bbe2
mov edx, 0x8132cc24
sub dl, dl
shr eax, cl
mov dword [esi + 2], eax
lea eax, [edx*2 - 0x7ff088ea]
jmp 0xd36107
lea ecx, [ecx + edx*2 + 0x4bae7705]
shr ecx, 0xa3
movzx ecx, byte [ecx + edi - 0x8b62ee6]
jnp 0x1684432
lea edx, [edx - 0x7ff46fd9]
movsx eax, dx
lea edi, [edi + edx - 0xb9030]
or edx, edx
jl 0x1754c26
xor cl, bl
or ax, 0x5118
sar al, 0x45
neg cl
bswap edx
xadd ax, dx
ror cl, 1
rol ax, 0x29
adc cl, 0xb2
not edx
sal edx, 0xe7
not cl
shl eax, 0xa6
xor bl, cl
add ecx, esp
bswap eax
mov eax, dword [ecx + edx*2 - 0x6f2efe00]
mov ecx, edx
mov dword [esi + edx*2 - 0x6f2efe02], eax
ror cx, 0x69
movzx eax, cx
lea esi, [esi + edx - 0x37977f02]
neg ecx
jle fcn.00f0da46
xor ecx, 0xeb01b00b
lea ecx, [ecx + eax - 0x200ff44e]
sar dword [esp], 0x8c
xor ebx, ecx
call fcn.0169fbd1
rol word [esp], 0x2a
movzx edx, byte [edi - 5]
sbb edi, 5
xor dl, bl
not dl
ror byte [esp + 2], 7
sub dword [esp], 0x179658ad
adc word [esp + 2], 0x9f3b
ror dl, 1
jmp 0x100f644
Function at 0xf75d06
Capabilities:
Encrypt data using speck

Disassembly:
inc esp
movsx eax, byte [esp + ebp*2 - 0xbe19f6]
neg ebx
bswap ebx
jmp 0x182f779
inc ecx
dec cl
inc ecx
neg cl
inc ecx
pop eax
push 0xc2a4417
inc ecx
dec cl
inc ecx
xor bh, cl
dec esi
lea ecx, [esp + ecx + 0x18]
inc byte [esp + 0xf]
dec eax
dec dword [esp + 4]
inc ecx
mov dword [ecx], ebp
dec ecx
sub ebp, 4
mov ebp, dword [esp + 0x11]
dec eax
neg dword [esp + ebp*4 - 0x17c3404]
inc ecx
mov ebx, dword [ebp + ebp*8 - 0x2f86828]
xor ebx, edi
add ebx, 0xacab2595
inc esp
movsx esp, ch
neg ebx
movzx ecx, byte [esp + ebp*4 - 0x17c3412]
not ebx
inc esp
add byte [esp + ebp - 0x5f0cf1], ah
jns 0xcf86de
inc ebx
dec eax
mov dword [esp + ebp*2 - 0xbe19fa], edi
sar word [esp + ebp - 0x5f0d02], 0xe2
xor dword [esp + ebp - 0x5f0cf5], ebx
call fcn.01888919

Function at 0xf78989
Capabilities:
Encrypt data using speck

Disassembly:
inc cx
not ebx
inc esp
movsx edi, word [esp + ebx*4 - 0x2dc]
dec eax
xor eax, 0x161f1e89
dec eax
mov dword [esp + ebx*2 - 0x16a], edi
dec eax
add dword [esp + ebx*2 - 0x172], 0xd431a296
jbe 0x101e8ca
dec eax
mov dword [esp], ecx
inc ecx
dec eax
dec ecx
sbb ebp, 5
inc esp
mov byte [esp + 8], bl
inc byte [esp + 3]
xor eax, edi
xadd ebp, ecx
sar word [esp + 7], 0x2e
dec eax
sal byte [esp + 0xf], 0x24
movzx ebx, cl
neg eax
inc ecx
inc esp
sub bl, byte [esp + ebx*8 - 0x5c7]
bswap eax
jle 0xf38036
xor dword [esp + ebx - 0xb1], eax
dec eax
mov edi, dword [esp + ebx - 0xb1]
dec ecx
sal ebx, cl
dec eax
arpl ax, ax
jp 0x1649181
inc esp
movzx ecx, cl
inc esp
xor bl, bl
dec eax
adc esi, eax
inc esp
mov edx, ecx
inc esp
add byte [esp + ebx - 0xb7], bh
dec ecx
mov ecx, dword [esi + ebx*2 - 0x17a]
inc esp
mov ecx, dword [ecx + ebx*8 - 0x5c8]
inc esi
mov dword [ebx + esi - 0xbd], ecx
dec eax
ror ebp, 0x8d
dec ebp
lea esi, [esi + ebx - 0xbd]
dec edx
lea ebp, [ebp + edi - 0x34c8464]
inc ecx
pop edi
inc ecx
pop eax
jns fcn.018803b6
mov edx, 0x4a06d907
inc dl
mov ecx, dword [ebp + edx - 0x4a06d908]
sal edx, 0x50
dec edx
mov ax, word [ebp + 4]
sub dx, dx
push edx
mov word [ecx], ax
mov edx, dword [edi]
dec word [esp + 2]
xor edx, ebx
mov eax, 0x7d24b91a
shr word [esp + eax - 0x7d24b91a], 0xc1
seto byte [esp + eax - 0x7d24b918]
ror edx, 1
mov word [esp + eax - 0x7d24b91a], 0x36ac
ror al, 0x46
dec edx
neg edx
sub ax, ax
movsx ecx, byte [esp + eax - 0x7d240000]
dec edx
sal dword [esp + eax - 0x7d240000], cl
sub cx, ax
rol edx, 1
xor ecx, eax
xor ebx, edx
not byte [esp + eax - 0x7d23ffff]
mov dword [ebp + eax - 0x7d23fffe], edx
mov edx, dword [edi + eax - 0x7d23fffc]
sal byte [esp + eax - 0x7d23fffe], 0xc5
xor edx, ebx
sub dword [esp + eax - 0x7d240000], ecx
call fcn.01007547
call fcn.016327b5
Function at 0xf8b2f5
Capabilities:
Encrypt data using speck

Disassembly:
dec al
adc ecx, edx
or eax, eax
mov dword [ebp + 0xc], ecx
movsx edx, ax
sar al, 0x41
lea ebp, [ebp + edx*2 - 0x77f2]
mov edx, dword [esi + edx*2 - 0x7802]
jge 0x16b17bb
sub esi, 4
lea ecx, [eax*2 - 0x7b428047]
xor edx, ebx
sub edx, 0x84b475bb
call fcn.00eefaf6
aam 0xad
fcom dword [edx]
invalid
mov dword [ebp + 4], edx
mov ecx, dword [ebp + 4]
mov edx, dword [ebp + 8]
and ecx, edx
mov edx, 0xba36e73c
neg dx
mov dword [esp], edx
not ecx
sub dword [esp], edx
sbb dword [esp], 0xa018fa87
jnp 0x1761128
mov dword [ebp + 8], ecx
sub edx, 0x3605ddb1
mov eax, edx
pop ecx
mov ecx, dword [ecx + ebp - 0x5fe70571]
add dx, dx
mov edx, dword [ebp + 0xc]
xor al, al
jp 0xd19535

Function at 0xf8caf1
Capabilities:
Encrypt data using speck

Disassembly:
xor ecx, 0xbe9a0f3b
mov dword [esp + 4], 0x9ad5407
xor ebx, ecx
add esi, ecx
lea esp, [esp + 8]
jmp 0x166e61f
call fcn.00fd3acd

Function at 0xf923c3
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
xor ebx, ecx
push eax
add ebp, ecx
movsx ecx, al
dec al
movzx edx, al
or edx, dword [eax + esi - 0x7ffffffc]
call fcn.018689e3

Function at 0xf9d20b
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using speck

Disassembly:
lea esi, [ecx + esi - 0x996b]
xor edx, ebx
lea eax, [ecx*8 - 0x61dd856a]
mov dword [esp + ecx - 0x996f], 0xe58bb41e
bswap edx
neg ecx
shl eax, 0x22
or ecx, eax
dec edx
bswap edx
inc edx
and al, 0x27
xor ebx, edx
inc ecx
add ebp, edx
add dword [esp + eax - 0x789d1820], eax
mov dx, word [edi + eax - 0x789d1820]
and dword [esp + eax - 0x789d1820], 0xc891f30e
sub ax, cx
lea edi, [edi + eax - 0x789d9964]
jle 0x17d449e
mov dword [esp + eax - 0x789d9966], eax
and dword [esp + eax - 0x789d9966], eax
movzx ecx, byte [esi + eax - 0x789d9966]
shr eax, 0xda
shr ax, 0x41
lea esi, [esi + eax - 0xe]
xor cl, bl
call fcn.01696ba3

Function at 0xf9f306
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
dec bh
call fcn.01861b90
jne 0x178c023
mov eax, 0xfe07c59d
sbb esi, 5
xor edx, ebx
lea ecx, [eax + 0x39993339]
or dword [esp + ecx*2 - 0x6f41f1ac], eax
ror edx, 1
and dword [esp + ecx*2 - 0x6f41f1ac], ecx
xor edx, 0x893f6cb5
shr eax, cl
add cl, byte [esp + eax - 0x3f5]
and byte [esp + eax*2 - 0x7ee], al
rol edx, 1
sal byte [esp + ecx - 0x37a0f80d], 6
and word [esp + eax*2 - 0x7ee], 0xf38a
call fcn.01647d45
xor bl, al
lea eax, [esp + eax + 4]
and dword [esp], edx
mov dword [eax], ecx
or dword [esp], edx
mov edx, dword [esi - 5]
jae 0x163c5bf

Function at 0xfa2d17
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
add edi, ecx
mov dword [esp + eax - 0x4fa7033f], 0xe5928b99
mov edx, dword [eax + esi - 0x4fa7033f]
and eax, 0x5238402f
and ax, ax
mov eax, dword [esi + eax - 0x4220002b]
adc esi, 8
xor ecx, ecx
jmp 0x178ab2a
test eax, eax
lea esp, [esp + 4]
je 0x1795db1
push 0x17bce9b6
mov dword [esp], ebx
Function at 0xfa3fe8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sal eax, 0x22
setnp al
mov dword [edi + 6], ecx
movsx edx, al
movzx ecx, word [ebp + edx*2 - 6]
lea ebp, [ebp + edx*8 - 6]
xadd eax, edx
xor cx, bx
sar eax, 0xf6
sub ax, ax
adc cx, 0x1e05
ror edx, 0x21
add edx, 0xdab0dea4
rol cx, 1
jmp 0xf66b11
dec ecx
dec edi
inc esp
movsx ebx, bx
inc cx
sal edx, 0x2a
dec ecx
ror edi, 1
call fcn.00ff93a6
or dx, cx
mov word [edi + 2], dx
movsx edx, ax
rol eax, 0xb1
mov ecx, dword [edx + edi - 0x4bfe]
jae 0x17b2b9f
dec ecx
sar esp, 0x46
inc esp
movzx edi, dl
inc ecx
neg edx
inc ecx
not edx
inc ecx
dec eax
push ebx
call fcn.00e83a08
inc cx
not cx
bswap edx
xor bx, cx
and dl, 0x22
not dl
sar al, 1
mov word [edi + edx*2 - 0x499d5bb6], cx
lea edi, [edx + edi - 0x24ceadd9]
shr dl, 0x45
mov ecx, eax
sbb al, 0x3f
jmp esi
dec ebp
lea ebp, [ebp + ebx*4 - 0xd]
dec esp
xor edi, edi
dec eax
mov dword [esp + ebx], eax
inc ecx
xchg ah, dl
neg word [esp + ebx + 0xb]
dec ebp
lea edi, [edi + ebx*8 + 0x733fae91]
sets byte [esp + ebx*8 + 2]
inc ecx
shr cl, cl
dec ecx
bswap edi
jb 0xf4dcbf
mov edx, dword [edx + edi - 0x4bfa]
neg eax
neg ax
add ecx, edx
jmp 0xcfe87b

Function at 0xfbc187
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, eax
shl ecx, 0xb3
adc esi, eax
ror dx, 0x2e
mov eax, ecx
inc edx
pop eax
pop eax
pop ecx
jae fcn.00f5ec0e

Function at 0xfbec46
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], 0x2654edd5
call fcn.0173cca2

Function at 0xfbf029
Capabilities:
Encode data using xor

Disassembly:
pop edi
dec esp
and eax, edx
dec ebp
arpl cx, cx
dec ecx
sar ebx, cl
not ebp
dec eax
dec ecx
adc esi, ecx
inc esp
movsx ecx, dx
inc eax
rol ch, 0x22
inc ebp
mov bh, byte [ebp + ebp - 0x5d45206]
add ax, dx
dec esi
lea ebp, [ebp + ebp - 0x5d45206]
dec ecx
ror eax, 0x1d
jns 0xfe53f1
jb 0xd17ac3
rcr esi, cl
inc eax
xlatb
jg 0xd17adc
push ds
adc eax, 0xbaf77ae
push ds
adc eax, 0x4b4727ae
push ds
adc eax, 0x496567ae
add dh, bl
dec eax
pop edx
mov al, 7
cmp dword [edx], esi
neg byte [ecx - 0x396a3da5]
sbb al, 0xa7
mov eax, 0x96d32980
fdiv qword [edi + 0x151e6327]
scasb al, byte es:[edi]
dec edi
rol byte [eax], 0x82
add al, 0xec
stc
stc
sub byte [esp + ecx*8 - 0x71], ah
and al, 0x85
dec esi
xchg esp, eax
push edi
mov byte [edx - 0x21], dl
mov al, byte [0xae86]
xor eax, dword [ecx - 0x8c3f32f]
push edx
fbld tbyte [edi - 0x60]
xchg byte [esi + 0xcd18133], ch
cmp al, 0xf7
sbb dword [ebx], edx
test al, 0xfe
invalid
invalid
sal cx, cl
inc ebp
movsx edi, ax
inc ecx
rol ecx, 3
inc esp
movzx edx, bp
dec ecx
dec ebx
shl ebx, 0x1d
inc ebp
sbb ecx, eax
inc esp
and ebx, ebx
dec esp
mov dword [esp + ebp - 0x5fd15d74], eax
inc ecx
neg ecx
inc ecx
pop esp
sal ebp, 0x45
push edi
inc esp
xor esp, ebp
inc esp
xor dword [esp + eax - 0x5fd15d00], ecx
jmp 0xd17a43
call fcn.00cee0d7
mov ecx, dword [edi]
add edi, 4
call fcn.0177559d
mov eax, 0xbd369c0e
call fcn.017d4f11
Function at 0xfbf545
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
inc edx
xor ebx, edx
rol al, 0x81
add ebp, edx
shr eax, 0xd4
movsx edx, cl
lea ecx, [eax + edi - 0x1df]
add dl, dl
lea edx, [eax + 0x7c11c794]
sar eax, 0xb7
lea edi, [edi + eax*2 + 4]
xor al, byte [esi + eax + 5]
call fcn.017529bc
movzx edx, byte [edi - 1]
mov ecx, 0x4d8eac32
xor dl, bl
xchg ch, cl
inc ecx
add dl, 0xaa
not dl
inc dl
not dl
add dl, 0x2e
sar ecx, 0xc
push ecx
xor bl, dl
push ecx
lea edx, [esp + edx + 8]
shl ecx, 0xba
sar cx, 0xa4
mov byte [edx], al
sub dword [esp], ecx
mov edx, dword [esi + 2]
lea ecx, [ecx*8 + 0x15a2f216]
lea ecx, [esp + ecx - 0x75a2f1f6]
mov eax, 0x1e3f0db4
jno 0x17c41f4

Function at 0xfd45bc
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse pe header

Disassembly:
neg eax
mov ecx, 0x9397ce95
mov edx, ecx
not eax
mov dword [esp], edx
call fcn.016e7d3c
Function at 0xfd843e
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [ebp + edx - 0x500d200e]
mov dword [esp + edx - 0x500d200e], edx
sbb dl, 0x3b
xor eax, ebx
jmp 0x17041c3
neg ecx
neg eax
jmp 0x1759ed1