joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12169e5
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, 0x3614103b
mov dword [esp + 4], 0x3eb7147e
mov edi, dword [esp + edi*2 - 0x6c282076]
lea esp, [esp + 4]
call fcn.015fe504
inc esp
mov ebx, ebp
inc ecx
not esp
dec edx
jp 0x1606b39
bswap edi
neg edi
sar byte [esp + 0x15], 0x85
inc ebp
movsx ebx, bh
dec esi
mov dword [esp + ebx - 0x6a], ecx
inc ecx
movzx edx, bl
call fcn.0178240d
push esi
inc ebp
lea esp, [esp + edx*2 + 0x79d52323]
inc ecx
neg esp
not byte [esp + edx - 0x373551f8]
inc esp
movsx edx, ch
dec esp
mov dword [esp + edx - 0x373551ff], ecx
jmp 0x163719b
inc ecx
push ebx
pop ebp
inc esp
xor dword [esp + edx*2 - 0x6e6aa3fe], esp
rol ebp, 0xe4
inc sp
adc edx, eax
inc ecx
pop ecx
dec ebp
arpl sp, sp
dec ebp
adc eax, esp
dec ecx
lea edi, [edx + eax*2 + 0x2f056831]
dec eax
mov ecx, dword [ebx + edx*2 - 0x6e6aa3fe]
inc ecx
add edx, 0x7da8738c
shr al, 0xe6
inc ebp
movsx edi, bl
dec eax
mov edx, dword [ebx + edx*2 - 0x6e6aa3f6]
dec eax
mov dword [ecx + ebp*2 - 0x3e0], edx
push eax
inc esp
mov ebp, dword [ebx + ebp*8 - 0xf70]
dec eax
lea ebx, [ebx + eax + 0x14]
dec eax
xadd dword [esp + ebp*2 - 0x3e0], eax
push ebp
inc ebp
mov bh, byte [esi + ebp*2 - 0x3dc]
pop edi
dec ebp
lea esi, [esi + ebp*2 - 0x3db]
inc ebp
xor bh, cl
inc ecx
add eax, edx
call fcn.01731b50
sal cx, cl
ror eax, 3
bswap eax
bswap edx
dec eax
call fcn.0163e58e

Function at 0x15ddb27
Capabilities:
Encode data using xor

Disassembly:
xor dl, 0x27
xor ax, 0x688c
xor bl, dl
bswap ecx
lea edx, [esp + edx + 8]
push esp
adc al, 8
lea eax, [eax*4 + 0x45826b36]
shr ax, cl
and ecx, ecx
mov eax, dword [edx + ecx - 0xed3a587]
mov dword [esi + ecx*2 - 0x1da74b0a], eax
lea esi, [esi + ecx - 0xed3a583]
mov edx, dword [edi + ecx*4 - 0x3b4e9621]
adc ecx, ecx
mov dword [esp + ecx*4 - 0x769d2c38], ecx
lea edi, [ecx + edi - 0x1da74b13]
movsx eax, cl
push eax
xor edx, ebx
neg edx
sal eax, cl
xor word [esp + ecx - 0x1da74b09], ax
ror dword [esp + eax*4 - 0xdfffe], 0xd2
xor edx, 0x82be2314
pop eax
not edx
neg ecx
xor edx, 0x8bf3cab
dec edx
call fcn.0168e651
dec edi
sahf
push esp
lds esi, [esi + 0xf]
jge 0x15ddb33
into
push es
mov dword [ecx + 0x7d], edx
mov ah, 0xce
push es
mov dword [edi + 0x6ceb071], ebp
mov dword [ebp + 0x5d], esi
nop
into
push es
mov dword [edi + 0x3d], edx
int3
Function at 0x15df082
Capabilities:
Encode data using base64

Disassembly:
call fcn.01213bd5
mov esi, 0x9f8777b4
inc ecx
movzx edi, word [esi]
dec eax
lea edx, [esi + esi*2 - 0x40434ed5]
dec ecx
add esi, 2
inc esp
mov ebp, edx
mov ebp, esi
inc esp
movzx edi, dx
inc cx
xor edi, ecx
rol di, 1
push ebp
inc di
ror di, 1
inc edx
shl byte [esp + edi*8 - 0xc235], 0x65
inc di
not di
movsx eax, si
sub di, 0x6d1a
inc esi
mov ebx, dword [esp + edi*2 - 0x308d]
inc eax
inc sp
xor ecx, edi
xadd byte [esp + eax*4 - 0x1decf], dl
sub al, 0x13
dec edx
lea ebx, [ebx + edi - 0x1849]
inc cx
mov dword [edi + ebx - 0x1847], edi
ror bp, 8
jne 0x15f117b
mov ecx, 0x391300a9
lea edi, [edi + ecx*2 - 0x72260156]
mov eax, ecx
xchg ecx, eax
mov ecx, dword [edi + ecx*2 - 0x72260152]
push eax
ror byte [esp + eax - 0x391300a9], 0x63
xor ecx, ebx
bswap ecx
movzx edx, byte [esp + eax*2 - 0x72260152]
sub ecx, 0xb1b98283
call fcn.01798441

Function at 0x15e63a8
Capabilities:
Encode data using xor

Disassembly:
call fcn.015e7c66
popal
push 0x75
inc edi
add dword [edx + 0x5ef87fd8], esp
invalid
invalid

Function at 0x15f6f6f
Capabilities:
Encode data using xor

Disassembly:
inc ecx
movzx eax, byte [esi + edi - 0x33a1b098]
inc ecx
xor al, cl
ror al, 1
shl bp, 0x8c
dec eax
mov dword [esp + edi - 0x33a1b090], edx
inc al
call fcn.0161d9e5
push ecx
pushfd
rcl dword [eax], 0x97
stc
sub edx, ebp
pop ebx
shr dword [eax + 0x21], cl
bswap esi
and dword [edi], ecx
into
pop ebx
shr dword [eax + 9], cl
add edx, edx
pop ebx
shr dword [eax + 0x21], cl
and eax, 0x68d35bf2
sub eax, 0xd35bde1f
rcr byte [ebx - 0x2d], cl
push 0x5bf22521
shr dword [eax + 0x2d], cl
pop ds
ficomp word [ebx - 0x2d]
push 0xdf203d6f
xor al, byte [eax - 0x76]
aas
je 0x15f6f9b
fist dword [ecx]
jno 0x15f6f9d
xchg esp, eax
inc eax
aad 0x83
clc
or byte [ebp + 1], dl
pop edi
ja 0x15f6f4c
jmp 0x15f6fa3

Function at 0x1601ff1
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec eax
shl esi, 0xed
mov word [ebx + eax*2 - 0x2a000000], cx
pop ecx
sar byte [esp + eax*4 - 0x53ffffee], 6
inc ecx
bswap edx
inc ecx
pop edx
pop edx
pop edi
jnp fcn.01799740
inc esp
movzx ebx, dh
dec esp
mov dword [esp + edi], ecx
inc ebp
movsx edx, ch
call fcn.0179b124
inc ecx
mov ebx, 0xd196e424
dec ebx
lea esi, [ebx + ebx*8 + 0x701e522e]
movzx si, byte [ebx]
inc esp
mov ch, byte [ebx + 2]
dec edi
lea edx, [ebx + ebx + 0x1b16e71c]
dec eax
add ebx, 2
inc ebp
and dl, dl
inc ecx
sbb bl, 0x13
dec ebx
lea eax, [edx + ebx*4 - 0x204295cc]
inc eax
not dh
shl eax, 0x89
inc ecx
not ch
dec esi
lea esp, [eax + edx - 0x7fc4f278]
inc ecx
movzx ecx, ah
setp al
inc ecx
and dh, ch
inc esp
movzx edi, cx
mov word [ebx + ecx*2 - 0x1d8], si
inc ecx
mov edi, dword [esi + ecx - 0xec]
dec eax
shl eax, cl
shl al, 6
dec ebp
lea esi, [esi + ecx*2 - 0x1d4]
inc ecx
xor edi, ecx
inc cx
sal ebx, cl
rol cl, 0x43

Function at 0x160275a
Capabilities:
Encode data using base64

Disassembly:
xor edi, 0x6e361413
add edi, ebx
lea esi, [esp + ebp - 0xfeea]
lea ebp, [eax + esi - 0x630401d6]
mov esp, ebp
Function at 0x1607cc5
Capabilities:
Encode data using xor

Disassembly:
inc esp
xor cl, dl
dec ecx
dec esp
dec eax
and eax, 0xc585db13
dec eax
lea edx, [esp + edx + 8]
inc si
mov edx, dword [edx + edi*8 - 0x1a8]
dec edx
mov dword [esp + edi*2 - 0x6a], 0x483d2798
dec edx
lea ebx, [ebx + edi*2 - 0x6c]
call fcn.0174eeb7
push dword [esi]
mov ebx, 0x3c0a19e1
out 0x43, eax
jecxz 0x1607d17
sub al, 0x2a
inc ebx
jecxz 0x1607d1d
push es
push cs
rol dword [ebx - 0x1d], cl
sbb dword [edx], esi
jns 0x1607c9c
push es
xor dword [edx + edx*8 + 0x79], esp
xchg dword [esi], ebx
sar byte [ecx - 0x79], cl
push ds
loop 0x1607d0d
iretd
fistp dword [eax]
lds edx, [eax]
call 0x19d83cca
mov edx, 0xcbec71f2
fnsave dword [eax]
mov eax, 0x2df6e531
push eax
jns 0x1607d02
mov edi, 0xf2ba1877
jno 0x1607d10
retf
jb 0x1607da6
jmp 0xc5fd2e0b
mov gs, word [ecx]
mov al, byte [0x3d3710f3]
and al, 0xca
fdivr qword [esi - 0x48]
out 0xde, eax
test byte [eax], cl
imul esi, dword [eax + 9], 0x11
xchg edi, eax
mov ecx, 0x67e74f3c
aas
invalid

Function at 0x160fef4
Capabilities:
Encode data using xor

Disassembly:
shr al, 0xa1
xor cl, bl
xor al, byte [esp + eax - 0x696a8448]
xor cl, 0xa
add cl, 0xa3
mov dword [esp + eax - 0x696a8445], 0x96a4941c
xchg esi, eax
sbb al, 0x94
movsb byte es:[edi], byte [esi]
xchg esi, eax
add byte [esp + eax - 0x696a8445], al
rol cl, 1
dec cl
xor bl, cl
xor dword [esp + eax - 0x696a8444], 0x1d8f2922
lea ecx, [esp + ecx + 8]
sbb ax, ax
mov byte [ecx + eax - 0x696a0000], dl
inc word [esp + eax - 0x6969ffff]
lea edx, [eax + eax - 0x3cda91d7]
lea edi, [eax + edi - 0x696a0004]
sar dl, 0xc1
call fcn.0167dea5
add esi, 0xfffffffc
call fcn.01623668
lodsb al, byte [esi]
jge 0x160ff0c
sub ah, byte [eax + 0x367382fa]
jmp 0x44ed7fca

Function at 0x1610dea
Capabilities:
Encode data using base64

Disassembly:
movzx edx, cl
mov eax, dword [edi + edx*2 - 0x10e]
call fcn.015f89b0
Function at 0x1610e2b
Capabilities:
Encode data using base64

Disassembly:
add ebp, ecx
shl word [esp + edx*4 - 0x16ff94d2], 0x89
pop ecx
pop eax
pop eax
pop eax
jns fcn.0121c7a0
xadd word [esp + ecx - 0x68064ce0], dx
movzx cx, byte [ecx + eax - 0x68064ce6]
ror dword [esp + edx - 0x68062136], 0x3d
movsx eax, word [esp + edx - 0x68062139]
dec word [esp + edx - 0x68062136]
mov word [esi + eax - 0x52], cx
lea esi, [esi + eax*2 - 0x9e]
and word [esp + edx - 0x68062138], dx
pop ecx
pop eax
jno fcn.0121c7a0
rol bp, 1
inc bp
inc ecx
xor ebx, 0x2a3069a7
inc esp
movzx ebp, word [esp + 1]
inc edx
neg byte [esp + ebp*2 - 0x3bbd]
ror bp, 1
inc bp
not bp
inc edx
movsx ecx, byte [esp + ebp*4 - 0x777a]
inc ecx
movsx edx, bl
inc esi
add dword [esp + ebp - 0x1ddf], ebx
sub bp, 0x6d1a
inc edx
xor byte [esp + ebp - 0x1ddc], 0x17
inc ecx
mov esp, 0xba06d80f
inc sp
xor ecx, ebp
inc dx
neg dword [esp + ebp - 0x1ddf]
inc edx
inc dword [esp + ebp*2 - 0x3bbc]
dec edx
lea ebx, [ebx + ebp - 0x1de1]
inc edx
not byte [esp + ebp - 0x1dda]
inc edx
add byte [esp + ebp - 0x1ddb], dl
inc dx
mov dword [ebx + ebp - 0x1ddf], ebp
inc edi
mov edx, dword [esi + ebp*4 - 0x777c]
inc esi
xchg dword [esp + ebp*2 - 0x3bbc], ebx
inc ecx
add ebp, 0xf2a4178d
inc edx
xor byte [esp + ebx - 0x6ff68009], dl
dec ebp
lea esi, [esi + ecx - 0x19]
inc ebp
xor edx, ecx
inc ecx
shl ebx, 0x3a
dec ecx
rol ebx, 0x65
inc dx
sar dword [esp + ebx*2 - 0xd], 0x24
inc ecx
rol edx, 2
inc ecx
neg edx
sar dword [esp + ecx*2 - 0x3a], 0x36
inc esp
movzx edi, al
inc ecx
not edx
inc edx
ror dword [esp + ebx*4 - 0x18], 0x17
inc ecx
bswap edx
dec esi
mov dword [esp + ebx*2 - 0xe], ecx
rol dx, 0xc9
inc ecx
sub ecx, esp
dec esi
lea esp, [ecx + ebx + 0x2438da05]
inc esi
xor dword [esp + ebx*8 - 0x38], edx
inc ecx
pop ecx
dec edx
lea ebp, [0x11385a22]
inc ebp
or bl, ah
inc ecx
or ecx, ebx
dec ebp
arpl dx, dx
dec ecx
rol ebp, cl
inc ecx
setns ch
dec ebp
adc eax, edx
call fcn.015e6125
dec edx
sub dword [esp - 0x101f6], ecx
dec eax
lea edi, [esp + edi + 0x10]
inc edx
setns byte [esp - 0x80f3]
dec edx
neg dword [esp - 0x80fc]
inc ebp
mov ebp, dword [esp + edi - 0x80ff]
dec eax
xor edx, ebp
inc ecx
ror dl, 5
inc edx
movsx edi, byte [esp - 0x407f5]
dec edx
lea ebx, [ebx - 0x8103]
inc eax
not bh
inc ebp
mov dword [esp + ebx - 0x80ff], ebp
inc esp
adc dl, dl
inc ecx
push ebx
pop edx
inc ecx
pop edi
pop eax
jp fcn.01799740

Function at 0x1618870
Capabilities:
Encode data using xor

Disassembly:
inc ecx
bswap edi
dec esp
mov dword [esp + edx - 0x301697d5], ecx
inc ecx
xor dl, 0xad
call fcn.01784010

Function at 0x1625327
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
rol edx, 2
dec edx
mov dword [esp - 0x441c4de4], ecx
dec edi
lea ebp, [edx - 0x1254eec7]
not ecx
inc ecx
lea edx, [ebp + edx - 0x259b071f]
not edx
dec edx
lea esi, [0x84233c80]
call fcn.015c60d7
Function at 0x16263bf
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jns 0x16625f0
dec esi
add edi, dword [esp + edi*8 - 0x28]
dec edx
mov dword [esp + ebp*2 + 0x7ef5bde0], 0xd1168b16
dec esi
mov dword [esp + ebp + 0x3f7adef8], ecx
inc edx
xor dword [esp + ebp + 0x3f7adef8], eax
dec esi
mov ecx, dword [esp + ebp + 0x3f7adef8]
dec ebp
xchg edi, ebp
dec esi
mov dword [esp + edi*2 + 0x7ef5bde8], edi
dec eax
arpl ax, ax
inc si
xchg dword [esp + edi + 0x3f7adefa], ebp
inc ecx
rol ebp, 0x91
dec edx
neg dword [esp + edi*2 + 0x7ef5bde8]
dec esp
add eax, eax
inc esi
movsx ebx, word [esp + edi + 0x3f7adef1]
inc ecx
mov edx, dword [ebx + ebx - 0x168b]
dec edx
or dword [esp + edi*2 + 0x7ef5bde6], 0x8d878614
inc edx
mov eax, dword [ebx + edi + 0x3f7adef4]
inc edx
movsx esi, word [esp + ebx - 0x1686]
inc ecx
sbb ebp, 0x51b81627
inc ecx
mov ebp, dword [ebp + ebx - 0x2f51e9d2]
inc edx
sal dword [esp + edi + 0x3f7adef3], 0x9c
inc eax
ror dh, 0x86
inc edx
movzx edi, word [esp + ebp - 0x2f51e9d3]
dec ecx
lea ebx, [ebp + ebx - 0x2f51e9d6]
jnp 0x160209f
dec edi
lea ebp, [ebx + ebx*2 - 0x70ea1558]
div ebp
dec esp
test al, 0xea
adc eax, 0x4cf5f78f
lea ebx, [esi*8 + 0x13bbab06]
inc ecx
mov dword [edi + ebx + 0x3f7adef0], edx
pop esi
or word [esp + edi*2 - 0x1effb], 0x4396
inc dx
sbb dword [esp + ebp + 0x70e9d1bb], 0x89423b80
test byte [ebx - 0x1c], bh
mov ebp, 0x894e7ef5
test byte [edi + esi*4], ch
shr ecx, 1
jo 0x1626473
inc edi
mov edi, dword [edi + esi - 0x169fffc]
dec esp
mov dword [esp + edi - 0x1691f], edx
dec ebp
lea esi, [esi + edi*4 - 0x5a498]
xor dword [esp + edi*8 - 0xb490d], edi
or edi, edi
inc ebp
xor edi, ecx
mov edx, 0x5a12d431
inc ebp
movzx ebx, dl
inc ecx
dec edi
call fcn.01629279

Function at 0x164766a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea edi, [edi + eax - 0x28b59ebc]
mov dword [esp + eax*2 - 0x516b3d6c], eax
mov edx, dword [edi + eax*2 - 0x516b3d70]
xor edx, ebx
mov dword [esp + eax - 0x28b59eb8], 0xcf906903
not edx
not word [esp + eax*2 - 0x516b3d6c]
neg byte [esp + eax - 0x28b59eb4]

Function at 0x164fdc1
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc ecx
movzx edi, byte [esi + ecx - 0xe249]
dec ebp
lea esi, [esi + ecx*4 - 0x38923]
inc ecx
xor bh, cl
inc esp
mov esp, dword [esp + ecx - 0xe23f]
inc eax
ror bh, 1
inc eax
inc bh
inc eax
not bh
dec ecx
dec edi
push edx
inc eax
ror bh, 1
inc cx
inc ebp
inc edx
setp byte [esp + edi*2 + 7]
inc eax
xor bh, 0xba
inc eax
ror bh, 1
shr ebp, cl
ja 0x166997e
inc esp
xor cl, bh
dec eax
mov dword [esp + ebp*2 - 0xffffa6], ebp
dec eax
ror ebp, 0x2a
dec eax
lea edi, [esp + edi + 0x28]
inc ecx
push edx
dec esp
mov dword [edi + ecx*2 - 0x1c492], ebx
jb 0x15df1ba
inc eax
sar dh, 0x85
dec esp
mov dword [esp + ecx - 0xe249], eax
ret 0x28
Function at 0x165957d
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0xf5bcb811
sub word [esp + 4], 0xbb87
sbb ecx, ecx
mov dword [esp], ecx
add eax, 0xc8c9019
xor ebx, eax
add ebp, eax
mov ecx, dword [esi]
pop eax
push eax
mov eax, dword [esi + 4]
neg word [esp + 6]
mul ecx
call fcn.015d525a
xchg byte [esp + ecx - 0x68064c1a], cl
or byte [esp + ecx - 0x68064ce5], ch
lea eax, [esp + eax + 8]
mov edx, ecx
jge 0x1610e40

Function at 0x16667a3
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub edi, 0xe2a25082
inc esp
mov dword [ebx + edi*2 - 0x3abb7bf4], edi
sbb byte [esp + edi*2 - 0x3abb7be9], 0xb4
dec edi
lea edi, [ebp + ebp - 0x7effdb55]
jle 0x1686ddf
dec esi
mov dword [esp + ebx*2 - 0x1d06], eax
ret 0x10

Function at 0x1669ebd
Capabilities:
Encode data using xor

Disassembly:
call fcn.016623e5
invalid
dec esp
mov edx, dword [ebx + 8]
dec eax
add ebx, 8
dec ecx
add eax, edx
dec esp
mov dword [esp], ebx
dec eax
mov dword [ebx], eax
dec ebx
lea esi, [ebx + ebx*4 + 0x6c15ce9f]
inc esp
movzx edi, byte [esp + 4]
inc edi
mov ebx, dword [esi + edi*2]
inc edx
sub dword [esp + edi], 0x11ae8a08
jle 0x1222db0
call fcn.0160dba9

Function at 0x167d667
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
movsx ecx, ch
inc edx
neg byte [esp + edi - 0xf4]
inc esi
xor dword [esp + edi - 0xef], esp
dec edx
mov dword [esp + edi*8 - 0x7f8], ecx
inc dx
shl dword [esp + edi*4 - 0x3f2], 0x66
dec esi
mov ecx, dword [esp + edi - 0xef]
add cx, cx
jae 0x161da08
inc ecx
mov edi, 0xc4b18290
inc ecx
push edi
inc ecx
mov eax, dword [esi]
call fcn.017328a5

Function at 0x168d2a3
Capabilities:
Encode data using base64

Disassembly:
neg edx
pop ecx
lea ecx, [eax + eax*2 + 0x3ba3501a]
call fcn.01772887
mov esi, 0xa530bc22
jmp 0x1220bfd

Function at 0x168e9c4
Capabilities:
Authenticate hmac

Disassembly:
dec ax
dec eax
dec cx
rol dword [esp + eax - 0x53bc1f50], 0xd3
xor cx, 0x6303
call fcn.01760312
mov dword [esp + eax - 0x53bc1f56], 0x3e1cd129
movzx ecx, word [edi + eax - 0x53bc1f56]
xor cx, bx
jmp 0x162954d

Function at 0x168fb5e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
lea esp, [esp - 0x114]
cmp al, al
push esi
test edx, edx
jmp 0x164fe4b

Function at 0x1729472
Capabilities:
Encode data using xor

Disassembly:
mov word [ecx + eax - 0x48f52fd9], dx
lea edi, [eax + edi - 0x48f52fdd]
call fcn.01668861
dec esp
lea edx, [ebp + 0x438acca9]
dec esi
mov dword [esp + ebx*2 - 0x166], ecx
inc ebp
mov esp, ebp
inc ecx
pop ebx
inc esp
xor dword [esp + ebp*2 + 8], edi
call fcn.016351b6
push eax
invalid

Function at 0x172cd6b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [edi + ecx - 0x6ee4d01c]
mov dword [esp + ecx - 0x6ee4d018], ecx
xor edx, ebx
shr word [esp + ecx - 0x6ee4d007], 0x88
ror edx, 3
shr ecx, 0x64
inc edx
add ecx, ecx
mov dword [esp + ecx - 0xddc99fe], ecx
bswap edx
neg cx
setae byte [esp + ecx - 0xddc65f7]
xor edx, 0xf3bb1706
call fcn.0173afc4
Function at 0x172cdac
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sar eax, 0x89
adc ebp, ecx
shl dx, 0xe6
mov ecx, dword [eax + esi - 0x31134]
lea edx, [edx*2 - 0x4aefcf70]
sar eax, 0xa8
mov eax, dword [esi + eax*2 - 0x61e]
adc esi, 4
neg edx
sal dx, 0xc9
adc ecx, eax
not edx
movsx eax, dx
shr edx, 0xe1
mov dword [esi + edx - 0x41300fff], ecx
jmp ebp
dec esp
adc dword [esp + edx - 0x681a2514], ecx
inc cx
xor eax, ebx
inc esp
xor dword [esp + edx - 0x681a2514], ebp
call fcn.0165ff5e
mov eax, dword [esi]
mov edx, 0xa53d1b1a
lea ecx, [edx*4 + 0x6c35b70d]
lea ecx, [edx + 0x6c058724]
push ebx
cpuid
sub esi, 0xc
call fcn.0168ad2c
aaa
push eax
sbb al, 0x5b
inc eax
ljmp 0x557d
dec esi
fadd st(5)
mov edi, edx
dec esi
cmc
mov fs, word [eax + 0x2d86f8bb]
sub eax, 0x975a81c8
cdq
mov bl, al
add dword [ecx + 0x3ca2b48f], ebp
jmp 0x1621fbe
cmp al, 0xeb
sub dh, byte [esp + ecx]
in al, dx
pop ebp
mov ds, word [ebp - 0x1b]
les ebx, [eax]
insd dword es:[edi], dx
loop 0x1621f53
mov dword [eax + 0x5d], esi
and ebx, dword [edi]
inc eax
pop edx
push esp
movsd dword es:[edi], dword [esi]
adc dword [ebx - 0x33], edx
xor esp, dword [ecx]
push esp
mov edx, 0x2430b490
push es
test byte [edi], dh
push ebx
mov esp, 0x2aca3ed5
in eax, 0x39
mov ebp, 0xf7419548
dec eax
xchg ebp, eax
inc ecx
invalid
cmp dword [ebp - 0x8be6ab8], edi
aam 0x41
pop ebp
dec ecx
add ebp, 0xffec36c7
inc ecx
jmp ebp
in al, dx
inc dword [ecx - 1]
in eax, 0xf
rcl eax, 0xf7
rcl dword [edx - 0x7ef036f1]
sti
sub eax, dword [esi]
add al, ch
invalid
xadd eax, edx
not ecx
xchg edx, eax
bswap ecx
jno 0x1684bda
call fcn.016777aa
in al, 0x1f
dec esi
adc byte [0xdf5718a9], dl
dec esp
je 0x1621f91
sbb byte [edi - 0x21], dl
inc edx
jnp 0x1621f77
sbb byte [edi - 0x21], dl
and esi, edx
mov ecx, 0x9bdf5718
fnstenv [ecx + 0x18]
push edi
fist word [esp + edi]
jns 0x1622021
push edi
fistp word [edx - 0x1a]
jmp 0xcf41772a
sub al, 0x23
ja 0x1621fcc
and esi, dword [edi - 0x59]
push ds
cmpsb byte [esi], byte es:[edi]
jp 0x162208d
push ds
and eax, 0xaf49aad5
pop edi
cmp al, byte [edi]
sti
je 0x1622022
push dword [edi + 0x52bc82c8]
invalid
in eax, dx
pop eax
xchg esi, eax
and dword [eax], ebp
sub al, 0x39
mov bl, 0xb4
cmp dword [edx], 0x17b310cb
ljmp 0xd5e9
not eax
xor ebx, ecx
lea edx, [eax*4 + 0x4e1e7e00]
jmp 0x120f32b
mov ecx, dword [edi]
mov edx, 0x5195f3a7
xor ecx, ebx
bswap ecx
lea eax, [edx + edx + 0x56b1b027]
lea ecx, [ecx + edx*2 - 0x5d0800ab]
jmp 0x1621fd1
xor ecx, ebx
shr dx, 0xc6
and edx, edx
lea ecx, [ecx + eax - 0x30997552]
neg ecx
mov dword [esp + eax - 0x2368712f], eax
rol ecx, 1
dec eax
jno 0x17347a4
push edi
dec eax
lea eax, [edx + ebp*4 + 0x5124f62d]
inc ecx
bswap ebp
neg byte [esp + edi*2 + 3]
jle 0x16056fc
mov ecx, 0xdb1be93
lea edx, [ecx*8 - 0x5052a158]
movzx eax, cl
mov edx, dword [esi + ecx - 0xdb1be93]
call fcn.0121ec3a
mov ecx, 0x763deb21
neg ecx
sub edi, 4
jmp 0x172c4d5
add ax, word [esp + eax - 0x2368712e]
bswap ecx
lea edx, [edx + edx*8 - 0x33ce11f3]
dec dl
xor ebx, ecx
xchg byte [esp + eax - 0x2368e25c], ah
add ebp, ecx
call fcn.017884bb
Function at 0x173080b
Capabilities:
Encode data using xor

Disassembly:
adc ebp, ecx
inc dl
mov esi, dword [eax + esi]
mov dword [esp + eax], edx
sub edx, dword [esp + eax]
push edx
pop ecx
pop edx
jno fcn.0121c7a0
fucom st(2)
pop es
in eax, 0x17
jge 0x160e41a
mov al, byte [0x71e8269d]
dec ebp
mov byte [ebp + 0x4d4de826], bl
cwde
popfd
call 0x9ef54314
call 0x9efd391a
call 0x1a9f1b0c
mov eax, 0x1e81f927
invalid
or byte [ecx - 0x7f], cl
ret 0x55cc
rol eax, 0x50
sar eax, 0x5c
lea ecx, [ecx + eax*2 + 0x311afe01]
sar eax, 0x65
setns dl
not ecx
sal eax, 0x69
xor ebx, ecx
ror eax, 0x62
jae 0x160e382

Function at 0x17347c7
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x1686d7a
jb 0x160ccbc
add esi, 6
shld edx, eax, cl
mov dword [esi], edx
call fcn.0167d4ca
call fcn.0179aeee
inc esp
xor dword [esp + esi + 0x10], ebp
inc ecx
ror ebx, 0x13
inc esp
movsx ecx, ax
dec edx
mov dword [esp - 0x35f7c7e0], 0xfc011593
dec esp
mov ecx, dword [esp + esi + 0x10]
jb 0x16236a2
mov edx, dword [esi]
mov ecx, 0x7ab2788c
mov eax, dword [esi + ecx - 0x7ab27888]
mov cl, byte [esi + ecx - 0x7ab27884]
jmp 0x15feefa
Function at 0x1743010
Capabilities:
Encrypt data using speck

Disassembly:
not word [esp + 2]
neg dl
mov dx, word [eax]
mov word [esi], dx
movzx edx, byte [esp + 4]
call fcn.01605c14
mov eax, 0xc0856183
movzx edx, al
mov edx, dword [esi + edx*4 - 0x20c]
mov ecx, dword ss:[edx]
mov dword [esi], ecx
sub edi, 4
shr ax, 0x63
mov eax, dword [edi]
mov edx, 0x8e89a927
xor eax, ebx
call fcn.015f9a1a
bswap edx
movsx eax, cl
inc eax
lea edx, [edx + ecx - 0x68662098]
not edx
shl cx, 9
bswap edx
xor ebx, edx
call fcn.017310a8
add cx, 0x6584
xor edx, 0x49b07a20
call fcn.015ea343
daa
in al, 0xee
movsb byte es:[edi], byte [esi]
mov bh, 0x7b
jae 0x1654304
xchg esi, eax
hlt
je 0x16543c3
dec eax
mov cl, 0x7b
mov dh, 0x74
dec eax
pop ebx
pop ebp
mov dh, byte [edi + 0x48]
push ebp
push edi
xchg byte [edi + 0x48], dh
jno 0x16543d6
mov dh, 0x74
dec eax
push edi
cmp eax, 0x6086f03c
dec edx
sar byte [esi + edi*8 - 0x3444019], 0x14
pop ecx
pop bp
sahf
cli
mov eax, dword [0xef181c9f]
popal
ficom dword [edi + 0x6feb7f9f]
xchg edi, eax
scasd eax, dword es:[edi]
ret 0xfb5
outsb dx, byte [esi]
shr dword [ebx + 0x7b], 0x90
invalid
mov ebp, 0xf5dfdcf8
call 0xf562249d
cmc
call 0x623508a3
inc ecx
aaa
inc ecx
imul ebp, dword [eax + 0x73], 0x2e
xlatb
push ebx
pushfd
mov ebx, 0x9609602d
cmp bl, 0x1a
call fcn.0172b1ac
mov eax, dword [esp + ecx*2 - 0x5bb4b1d2]
adc word [esp + ecx - 0x2dda58e9], ax
lea edi, [edi + ecx*2 - 0x5bb4b1d6]
mov ecx, dword [edi + ecx*2 - 0x5bb4b1d2]
xor ecx, ebx
movzx edx, byte [esp + eax*2 - 0x5bb5ca00]
shl dl, 0xe1
rol ecx, 1
xchg dx, ax
rol edx, 0x4e
xchg dword [esp + edx*2 - 0x72800000], eax
lea ecx, [ecx + edx*4 - 0x74ccfd2]
xor eax, 0x4d221a38
pop eax
neg ecx
rol ecx, 3
call fcn.015c36b3
mov eax, 0xc8854a3f
neg eax
ror eax, 1
mov dword [esp], edx
bswap eax
xchg dh, dl
sub dx, dx
inc eax
mov dword [esp + 1], edx
xor ebx, eax
add ebp, eax
movsx eax, byte [esp + 1]
shr dword [esp + eax + 2], 1
and dx, word [esp + eax*2]
adc al, byte [edi + eax*4 - 5]
pop edx
add edi, 0xfffffffb
xor al, bl
mov ecx, edx
neg al
jmp 0x1746e09
neg dword [esp + ecx*2 - 0x3700018e]
and ecx, 0x422ead27
sbb al, 0x23
ror al, 1
add al, 0x1f
lea edx, [ecx*4 - 0x7aed9957]
neg ecx
sar dword [esp], 0x32
xor bl, al
push ecx
lea eax, [esp + eax + 8]
jmp 0x16542e3

Function at 0x174b494
Capabilities:
Execute syscall

Disassembly:
neg cl
call fcn.0168d2a3
inc ecx
mov edi, 0x7b984d05
inc cx
mov dword [edi + ebx - 0x7b984d05], edx
inc ecx
movzx esi, bh
inc edx
mov ecx, dword [esi + esi - 5]
inc ecx
movsx edi, di
inc esp
movzx ebp, si
inc esp
xchg bh, ch
dec edi
lea esi, [edi + esi - 0x7b984d01]
call fcn.0161dda8
sysenter
call fcn.0173b2d7
inc ecx
imul ebp, dword [eax + 0x64], 0x19
movsd dword es:[edi], dword [esi]
ret 0xfb3f
Function at 0x1767606
Capabilities:
Encode data using base64

Disassembly:
rol edx, cl
rol al, 1
dec dword [esp]
shr eax, cl
push edx
movzx ecx, dl
sar edx, 0xe1
mov dword [esi + edx*4 - 0x193c294a], eax
xor dword [esp + edx - 0x64f0a4f], ecx
movsx eax, dl
and word [esp + edx - 0x64f0a4f], dx
mov al, byte [edx + edi - 0x64f0a58]
mov dword [esp + edx - 0x64f0a51], edx
neg dword [esp + edx - 0x64f0a53]
not dword [esp + edx*4 - 0x193c294a]
lea edi, [edx + edi - 0x64f0a58]
sal dx, 0xe6
add edx, 0xb124bb
pop ecx
xor al, bl
shl dword [esp + edx*4 - 0x1c02e5ec], 0x73
dec dword [esp + edx*2 - 0xe0172f6]
dec al
neg al
jmp 0x15c7f25
ror edx, 3
inc edx
pop ecx
mov eax, dword [esp]
bswap edx
not edx
dec edx
neg edx
xor ebx, edx
xadd byte [esp + 3], ah
sar dword [esp], 0x51
movsx ecx, ax
add ebp, edx
mov eax, dword [esi]
mov cl, byte [esi + 4]
mov edx, 0xc9e14a6
inc edx
jnp 0x1674433
push 0x7e368793
pushfd
shr byte [esp + 4], 0x55
call fcn.015fa7ed

Function at 0x178dddf
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esp + edi*8 - 0x157b5]
dec esp
mov dword [esp + edi - 0x2af8], ebp
rol eax, 3
sar esi, 0x66
dec esp
mov dword [esp + edi - 0x2af0], ecx
inc ecx
sets ch
xor dword [esp + edi - 0x2af0], eax
dec eax
and ecx, ecx
xadd word [esp + edi - 0x2af2], di
add byte [esp + edi*2 + 1], 0x35
dec esp
mov ecx, dword [esp + edi + 8]
dec eax
arpl ax, ax
je 0x1220be9
jo 0x163ab86
dec esp
adc eax, eax
dec esi
inc ecx
mov eax, ebp
dec esp
mov dword [esp + edi], eax
ret 8