joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e781
Capabilities:
Encode data using xor

Disassembly:
pop ecx
cmp eax, 0x6f8cb81c
jecxz 0x42e799
jmp 0x42e7bb
xor dh, dl
xchg ebx, eax
push edx
mov edx, 0x551fa8fd
push edx
dec eax
imul edi, dword [ebx + ecx*2], 0x4df562df
dec ebp
dec ebp
push 0xe3fb7de7
outsb dx, byte [esi]
inc esi
sal dword [esi + 0x1a905131], 1
and eax, 0x6b6b3f45
mov edi, 0x53b6a51a
push eax
jo 0x42e778
xchg edx, eax
dec esi
cmpsb byte [esi], byte es:[edi]
inc edi
jb 0x42e79f
ljmp 0x30c2:0x13a8fbe5
Function at 0x4a27ff
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004a29f2
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004ad547
xor ebx, ebx
cmp eax, ebx
jne 0x4a29ad
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004a29f2
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004aa226
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4fbb1b
add esp, 0x10
test eax, eax
jne 0x4a28c8
push esi
call fcn.0049feb1
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4a28c8
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4a28b3
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4a28c8
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a28c1
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004aea5a
cmp byte [esp + 0x13], bl
je 0x4a28f8
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004a2a2f
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4a2968
push 0x14
call 0x4fad88
cmp eax, ebx
pop ecx
je 0x4a2922
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4a2924
xor edi, edi
cmp edi, ebx
je 0x4a2968
push esi
push edi
call fcn.004a1f55
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004a201d
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a2146
add esp, 0x18
call fcn.004a29f2
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004acc14
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a297f
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4a2991
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4a29d4
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4a29d4
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004a201d
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a2146
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aaf2f
Capabilities:
Encode data using xor

Disassembly:
push es
ljmp 0xc687
mov bl, 0xdb
out dx, al
mov fs, word ss:[esi + 0x7655f392]
fisub dword [esi]
and ax, 0x6040
xchg edx, eax
push ebp
jbe 0x4aae6d
and ax, 0x6040
inc eax
pushal
neg byte [ebx + 0x36]
in eax, 0xe8
lahf
cmc
xchg byte [edi - 0x40], al
pop ss
in al, dx
sub dh, 0x52
dec ebx
aam 0x35
test byte [ebp + 0x759c4453], 0x30
xchg byte [ecx - 0x32485d3], ah
out dx, eax
and dh, cl
test eax, 0x7baae4b5
adc al, 0x8e
int 0x46
in al, 0xaa
jnp 0x4aaed5
mov cs, ebp
inc esi
cmc
or dh, dh
mov byte [ebp - 4], 0x56
test al, 0x8a
bnd ja 0x4aae88
jbe 0x4aaeec
aas
xchg ebp, eax
jg 0x4aaeb8
loop 0x4aae97
rcr ah, 0xb3
imul ecx, dword [ebx + edi*8 - 0x25aa6696], 0x29ec8ac3
div byte [esi + eax*4]
fdiv qword [ebx + 0x6afb8c69]
cdq
push ebp
fcmovb st(0), st(3)
mov ch, ah
sub esi, esi
xor al, 0x86
enter 0xffffffffffff9bc5, 0x77
mov cl, 0x6e
outsb dx, byte [esi]
and eax, 0x3145d264
salc
sbb eax, 0xddbd92f3
mov ss, word [ebx]
dec esp
cmp esi, dword [edx + 0x6b]
jg 0x4aae8e
shl dword [edx], 1
inc esp
fnstsw word [esp]
daa
push es
add dword [0x77194106], eax
push ebp
lea eax, [esi + 0x76]
inc edi
int3
imul ecx, edx, 0x52
jecxz 0x4aafa1
pop esp
nop
inc eax
jmp 0x4aaebd
nop
in al, dx
invalid

Function at 0x4ad5f4
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esi]
cmpsd dword [esi], dword es:[edi]
aam 0xaf
sbb edx, dword [esi + 0x49]
and dword [eax + 7], ebx
mov dh, byte [esi + ebx - 0x1c990181]
xor bl, byte [eax - 0x20868a38]
jecxz 0x4ad5f9
mov es, edi
out dx, eax
jne 0x4ad681
leave
pop ecx
ret
add eax, 0xcc65d6a8
xchg dword [edi], esi
jmp [ebx + 0x4d]
int3
xor esi, dword [ebp + 0x33abaddf]
jg 0x4ad6af
in al, 0x7e
add eax, dword [esi]
mov ch, byte [ecx + ebx*8]
arpl bp, cx
out 5, al
in eax, 0xa2
sub eax, dword [edi - 4]
add dh, byte [esi + 7]
xchg esp, eax
mov al, byte [0x2328dbdd]
xchg edi, eax
sbb ah, byte [ecx]
mov edx, 0x62fc1988
leave
test eax, 0x1d957d33
nop
cmpsb byte [esi], byte es:[edi]
pushal
jno 0x4ad643
jge 0x4ad646
sbb eax, 0x7160a690
invalid
cmp dword [ebp - 0x87486fd], eax
mov dword [edi - 0x59b64feb], eax
dec ebp
jb 0x4ad6b9
add edi, dword [ecx - 0x75]
test dword [ecx + 0x49b01587], 0xf3724da6
invalid
Function at 0x401bf0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409046
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x13c], eax
cmp eax, 0xffffffff
je 0x401db6
lea ecx, [ebp - 0x138]
push ecx
push eax
mov dword [ebp - 0x138], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x401db6
jmp 0x401c60
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov edi, 7
mov eax, str.PointBl
mov dword [ebp - 0x140], esp
mov byte [esi], bl
call fcn.00406d10
sub esp, 0x1c
mov dword [ebp - 4], ebx
mov esi, esp
lea eax, [ebp - 0x114]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x144], esp
mov byte [esi], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401cb0
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x114]
call fcn.00406d10
mov dword [ebp - 4], 0xffffffff
call fcn.00401b60
add esp, 0x38
cmp al, bl
jne 0x401dbb
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov edi, 7
mov eax, str.pointbl
mov dword [ebp - 0x144], esp
mov byte [esi], bl
call fcn.00406d10
sub esp, 0x1c
mov dword [ebp - 4], 1
mov esi, esp
lea eax, [ebp - 0x114]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x140], esp
mov byte [esi], bl
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x401d30
sub eax, ecx
mov edi, eax
lea eax, [ebp - 0x114]
call fcn.00406d10
mov dword [ebp - 4], 0xffffffff
call fcn.00401b60
add esp, 0x38
cmp al, bl
jne 0x401dbb
mov ecx, str.PointBlank.exe
lea eax, [ebp - 0x114]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d84
cmp dl, bl
je 0x401d80
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d84
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x401d64
xor eax, eax
jmp 0x401d89
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x401dbb
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x401c60
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401dcb
mov edx, dword [ebp - 0x130]
push edx
push ebx
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408350
mov esp, ebp
pop ebp
ret
Function at 0x402890
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
jae 0x4028b2
lea eax, [ebp + 8]
mov edi, dword [sym.imp.MSVCR100.dll_sprintf]
push eax
lea eax, [ebp - 0x10c]
push str._s.mnth
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 8]
jae 0x4028f2
lea eax, [ebp + 8]
lea ecx, [ebp - 0x220]
push ecx
push eax
lea edx, [ebp - 0x10c]
push str._s_s
push edx
call edi
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
call ebx
lea ecx, [ebp - 0x24c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4028e6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 0x10
jb 0x402940
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408350
mov esp, ebp
pop ebp
ret
Function at 0x4069c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4090f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x406b52
cmp byte [ebx + 0x49], 0
je 0x406b52
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x406b46
lea esi, [ebp - 0x2c]
call fcn.00406200
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x406a33
lea edx, [ebp - 0x2c]
mov eax, edx
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, edx
push ecx
mov ecx, dword [ebx + 0x44]
push eax
lea eax, [ebx + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x406a6b
dec eax
je 0x406a6f
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x406b4d
call fcn.00404bc0
xor al, al
jmp 0x406b54
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x406a7f
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x406aad
cmp edi, 0x10
jae 0x406a8e
lea eax, [ebp - 0x2c]
mov edx, dword [ebx + 0x54]
push edx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x406b3e
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x406b4a
test esi, esi
jne 0x406a27
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x406b6f
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x406b6f
cmp edi, esi
jae 0x406b27
push ecx
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.00406de0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x406a27
mov ecx, eax
cmp edi, 0x10
jae 0x406b03
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x406b1e
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x406a21
test esi, esi
jne 0x406af9
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x406b36
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x406a21
lea esi, [ebp - 0x2c]
call fcn.00404bc0
xor al, al
jmp 0x406b54
lea esi, [ebp - 0x2c]
call fcn.00404bc0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408350
mov esp, ebp
pop ebp
ret
push str.string_too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x4081d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409238
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x408233
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [ebp - 0x7c]
call fcn.00407f90
mov ecx, esi
call fcn.00408040
mov ecx, edi
mov ebx, esi
call fcn.00408120
cmp dword [ebp + 0x1c], 0x10
jb 0x408262
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408350
mov esp, ebp
pop ebp
ret

Function at 0x408350
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d018]
jne 0x40835a
repz ret
jmp fcn.0040876d
Function at 0x15e5018
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec ebp
lea ecx, [ecx + eax - 0xd033]
inc sp
mov dword [eax + esi - 0xd03d], ebp
inc esp
movzx eax, ch
inc eax
movzx ecx, ch
inc ecx
push eax
dec eax
lea ebx, [ebx + eax - 0xd041]
shl byte [esp + eax - 0xd039], 0xc1
dec eax
rol eax, cl
mov edx, dword [ebx + eax*8 - 0xd038]
inc edx
shr dword [esp + eax*4 - 0xf1], 0x22
inc ecx
xor edx, ebx
inc ebp
mov edi, edx
inc esi
xor byte [esp + eax - 0x28], bh
dec esi
lea esp, [ebp + eax*2 + 0x1626402d]
lea edx, [edx + ebp - 0x3865f91d]
bswap edx
call fcn.015d3475
inc esp
movzx edx, al
lea esi, [esi + eax - 0x52ab2e2d]
inc cx
sar edi, 0x49
movzx edx, bp
bswap esi
inc ecx
xchg edx, ebp
inc ebp
movsx esp, dx
ja 0x17623d6
not esi
inc ecx
push ebp
dec ecx
sbb esp, 0xd6ae8c8d
dec esi
Function at 0x15e509a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec ebp
lea ecx, [ecx + ecx - 0x622901c0]
dec ebx
mov dword [edx + ecx - 0x622901b9], esi
jns 0x169d37e
je 0x16527eb
mov esi, dword [ebp + 0xc]
cmp bp, 0x5c81
test esi, esi
je 0x16527eb
mov eax, 0x5a4d
test ax, bx
cmp word [edx], ax
jmp 0x16527e5
mov edx, dword [edi + eax - 0x60000000]
movzx ecx, al
xchg word [esp + ecx*8], ax
pop eax
xor edx, ebx
or ecx, eax
jg 0x15d1e0a
or al, 0x8c
neg edx
ror cx, 0xa1
xor edx, 0x1f8067bd
ror ecx, 0x2a
xor ecx, 0x7323cc96
dec edx
shr eax, cl
sal cx, 0x2d
bswap edx
xor ebx, edx
jmp 0x1650025
mov dword [esp + ecx - 0x430593a5], 0x5db1b619
mov cl, byte [esi + ecx - 0x430593a3]
ror al, 0x41
sbb al, 0xaa
not ax
lea esi, [esi + eax - 0x43056cd6]
ja 0x179edba
sbb ax, ax
xor ecx, ebx
sub ecx, 0xefb70531
shr word [esp + eax*4 + 7], 0x63
jp 0x1775688
push edi
les ebx, [esi - 0x78]
xor ah, ch
dec esp
ljmp 0xc2d0
ror ebp, 1
call fcn.016a2dc6
jne 0x16527eb
mov ecx, dword [eax + 0x78]
test ebp, 0xc919593
cmp edx, 0xf00f4a91
mov dword [ebp - 4], ecx
test ecx, ecx
jmp 0x1670d15
ret
push ebx
cmp si, sp
cmc
test esi, 0x428e0821
push edi
mov dword [ebp - 0x10], eax
cmp si, 0x3027
test sp, si
cmc
mov dword [ebp - 8], 0xffffffff
clc
cmp esi, 0xffff
jmp 0x164cc47
mov eax, dword [edx + 0x3c]
stc
add eax, edx
stc
cmp dword [eax], 0x4550
jmp 0x1608814
ja 0x179cbc6
mov eax, esi
stc
sub eax, dword [ecx + edx + 0x10]
jmp 0x1676ad0
lea ecx, [ecx + ecx*2 + 0x7592fb35]
add ebp, edx
jmp ebp
je 0x1646a0b
xor eax, eax
pop esi
mov esp, ebp
pop ebp
jmp 0x1622299
je 0x16527eb
mov eax, dword [eax + 0x7c]
jmp 0x164576f
jmp 0x165cf0f
push edi
inc esp
xadd byte [esp + ecx - 0x622901b3], dl
dec edx
lea ebx, [ebx + ebp*8 - 0xdcc]
inc edx
shl dword [esp + edx - 0x622900ff], 0x9f
dec esi
sub dword [esp + edx - 0x62290100], ebp
inc edx
mov ebp, dword [ebx + ebp*4 - 0x6e4]
mov esi, 0xf605f994
inc ecx
xor ebp, ebx
jmp 0x16084f1
je 0x165cf19
mov eax, dword [ecx + edx + 0x20]
dec edi
test eax, edx
cmc
add eax, edx
clc
sub ebx, ebx
test ah, bl
cmp esp, 0x6c0765a3
mov dword [ebp - 0xc], eax
cmc
clc
cmp ebx, 0x790d2424
test edi, edi
jl 0x165cf19
jmp 0x168cc6c
xor ecx, 0x78924b4
sar dl, 0x41
ror word [esp + eax], 0x6d
shr dl, 0x21
inc ecx
ror ax, 0x83
bswap ecx
pop edx
xor ebx, ecx
shl dx, 0x6c
adc ebp, ecx
mov dword [esp + eax], ebp
ret 0x10
mov edi, dword [ecx + edx + 0x18]
test edi, edi
jmp 0x176073f
shr dl, cl
shl eax, 0x3a
mov word [esi + eax - 0x60000000], dx
lea edi, [eax + edi - 0x60000004]
jns 0x1227c0f
inc ebp
xchg edi, edx
dec eax
inc esi
and edi, 0x8695dba8
inc ebp
movsx ebp, dx
dec eax
bswap esi
dec edx
lea eax, [edi + edx*4 + 0x12143fad]
dec eax
rol eax, 0x66
dec eax
ror edi, cl
dec eax
not esi
dec esp
xor ebx, esi
dec eax
lea ebp, [edi + eax*8 - 0x5feca79]
shr eax, cl
jns 0x121fca8
Function at 0x15fcaaf
Capabilities:
Encode data using xor

Disassembly:
dec eax
sub ebx, 4
inc esp
mov edx, dword [ebx]
inc ebp
xor edx, ebx
dec eax
mov dword [esp], 0x71a81b0b
inc ecx
neg edx
inc ecx
bswap edx
inc ecx
mov eax, 0x4bb03d00
inc ecx
dec edx
inc ecx
not edx
inc dx
neg dword [esp + eax - 0x4bb03d00]
inc ecx
mov eax, eax
inc edx
sar dword [esp + eax - 0x4bb03cff], 0xb
inc edi
lea edx, [edx + eax*2 + 0x52dd1722]
dec esi
mov dword [esp + eax - 0x4bb03d00], ebx
inc ecx
movzx ebp, ax

Function at 0x1607687
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov eax, dword [ecx + 8]
inc ecx
mov edi, 0xae35f437
dec ecx
add ecx, 8
dec eax
not esi
dec eax
mov dword [esp], 0x820ad01a
dec edx
lea edx, [edi*4 + 0x7daf2a39]
dec ebx
lea ebp, [edi + edi*8 - 0x3e40eb79]
dec eax
not eax
dec eax
or esi, eax
sub dword [esp], 0x1d1c0807
dec ecx
mov dword [ecx], esi
inc ecx
movzx edi, di
dec eax
lea ebx, [ebx + edi*2 - 0x1e872]
jne 0x15ea9f8

Function at 0x16110e8
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xor esi, eax
inc ebp
xchg dl, ch
dec esi
mov dword [esp + ebp + 0x6f], ebx
inc edx
xor dword [esp + ebp + 0x6f], esi
inc ecx
neg dl
sbb cx, 0xd9b1
inc cx
sbb eax, 0x8b4e211f
pushfd
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
add dword [eax], eax
add dh, dh
ror byte [edx - 0x77], cl
push esp
sub al, 0x67
inc edx
mov edi, dword [esp + ebp + 0x69]
dec eax
arpl si, si
call fcn.0162bca5
jl 0x1611153
sub ebp, edx
adc edi, eax
outsd dx, dword [esi]
cmp eax, 0x63324093
imul ecx, dword [0x73324093], 0x27
jae 0x161115c
xor eax, 0x2b324093
or eax, dword [ebp - 0x6d]
inc eax
xor bl, byte [ebx + 0x5b]
or eax, 0x73324093
adc eax, 0xa6d7cba8
inc edx
jnp 0x1611133
mov cl, 0x94
mov edi, 0x97620410
popal
or eax, 0xab0c48eb
bound edx, qword [edi + 0x48eb0d61]
or al, 0xab
pushfd
and ebx, 0x73ba9fef
fstp xword [ecx - 0x6e]
add dl, dl
mov dword [eax + 0x31f0940], edi
pop ebp
add byte [eax], ah
cmp ch, cl
xor al, 0x16
jo 0x1611122
cmp eax, 0x7c79bba6
or dword [ecx + 0x29], 0x5cba33b5
push esi
cmpsb byte [esi], byte es:[edi]
daa
add dh, byte [ebp + 0x7bde6a9c]
add dh, byte [ebp + 0x7736769c]
add dh, byte [ebp + 0x6fe2fa9c]
add dh, byte [ebp - 0x604abe64]
push eax
lea ecx, [eax*4 - 0x42cfe9cd]
neg dl
sub dl, 0x15
sub eax, ecx
xadd ecx, eax
not dl
add ecx, dword [esp + eax*2 - 0x52516e5a]
add dl, 0x9e
sal ax, cl
lea ecx, [ecx*4 - 0x7cfa5b5d]
not dl
lea eax, [ecx + eax*8 - 0x1e4fa96b]
xor bl, dl
shr al, 0x46
jb 0x1610d2e
Function at 0x162de33
Capabilities:
Encode data using xor

Disassembly:
inc di
mov ebp, dword [ebp + 0x27e41cf9]
inc esp
mov esp, eax
dec ebp
lea ecx, [ecx + eax*2 - 0x30e2496a]
inc esp
movsx edx, bh
inc eax
neg dh
inc bp
mov dword [ecx + eax*2 - 0x30e24968], ebp
inc ecx
pop esp
pop ecx
pop ebp
inc ecx
pop edi
jle fcn.015db4d7
inc ecx
mov edi, 0x34aea137
inc ecx
movzx edi, di
dec eax
lea ecx, [edi - 0x4d6bb5f3]
dec eax
lea ebx, [edi + ebx - 0xa13b]
call fcn.016219e3
dec eax
sub ebx, 4
inc ecx
mov edi, 0x731b6d88
inc ecx
push edi
inc esi
mov ebp, dword [ebx + edi - 0x731b6d88]
inc ebp
xor ebp, ebx
inc ebp
mov eax, edi
call fcn.01666726
mov eax, dword ss:[0x69bcc279]
xchg ecx, eax
jecxz 0x162de6d
invalid
push 0xa3bdfd9f
shr dword [eax - 0x61], 0x7d
mov ch, 0xdf
shr dword [eax - 0x61], 0xa1
int1
jecxz 0x162de7f
push 0xffb9bd9f
shr dword [eax - 0x61], 0x81
outsd dx, dword [esi]
push ss
cdq
dec dword [ebx]
cld
sub ebp, ecx
sbb al, 0x7c
sar byte [eax], 1
test eax, 0xa059a2e2
mov ebp, 0x80ed22af
insb byte es:[edi], dx
inc esp
aam 0xfc
mov ecx, 0x463bf75c
int 0xb6
pushfd
retf

Function at 0x1641653
Capabilities:
Encrypt data using speck

Disassembly:
sub al, 0x15
mov dword [esp + ecx + 4], 0x8f10e29d
sal dx, 0xc
jb 0x1795c8c
not al
mov dword [esp + ecx*2], 0xa8aea0a5
xchg dword [esp + ecx*2], ecx
adc al, 0x9e
not al
xor bl, al
xor dword [esp + edx + 4], ecx
lea eax, [esp + eax + 8]
xor edx, dword [eax + edx]
rol word [esp], cl
mov dword [esi + 4], edx
dec cl
call fcn.017aad49
mov ebp, 0xdabf421f
call fcn.0176ca8e
sar al, 0xa1
xor ebx, edx
call fcn.01650030

Function at 0x1642d93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc cx
mov dword [ecx + edi*4 - 0x5f97c28], edx
dec eax
mov dword [esp + edi - 0x17e5f0a], edi
jge 0x17af5f8
not edi
call fcn.017adcf9
dec eax
sub edi, 0x32997a1
dec eax
lea ebx, [edi + ebx + 0x1ab3893]
inc ebp
mov edi, esp
mov edi, dword [edi + ebx + 0x1ab3897]
movsx esi, word [esp + 2]
inc ecx
xor edi, ebx
jmp 0x16527de

Function at 0x16661bf
Capabilities:
Execute syscall

Disassembly:
dec ecx
lea edx, [esp - 0x5aef9ee4]
dec ebp
arpl dx, dx
dec ebp
adc esi, edx
inc ebp
mov ecx, dword [ecx + eax*2 - 0x403dcc36]
inc ebp
xor edi, ebp
inc eax
sete bh
pop eax
pop eax
jne fcn.015db4d7
syscall
call fcn.0176eb5d
mov eax, dword [esp + ecx*4 + 5]
inc eax
xor dh, al
dec esp
add ebp, dword [esp + ecx + 8]
inc esp
or dword [esp + ecx + 0xb], edi
inc cx
xor ecx, ebp
inc ecx
sbb dh, al
inc esp
xor bl, dh
dec edx
lea ebp, [edi + edx + 0x7098859a]
push ecx
inc cx
mov dword [ecx + ecx - 0x912f], esi
dec ebp
lea ecx, [ecx + ecx - 0x912f]
dec eax
dec dword [esp + ecx*2 - 0x12256]
dec esp
mov dword [esp + ecx*4 - 0x244c4], esi
ret 0x10