joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1713d4a
Capabilities:
Encode data using xor

Disassembly:
movzx edx, cl
not al
sub al, 0xbd
push edx
ror al, 1
add al, 0xa4
or dword [esp + edx + 4], edx
push esp
adc al, 4
not al
xor bl, al
lea eax, [esp + eax + 8]
mov ecx, dword [eax + edx]
lea eax, [edx + edx*4 - 0x2cdb59fe]
xchg dword [esp + edx*2], edx
xchg word [esp + edx + 4], ax
mov dword [edi + edx*2 - 4], ecx
sal dword [esp + edx*2 + 2], 0xd1
mov ecx, dword [ebp + edx + 1]
jb 0x1679bb5
xor ecx, ebx
add ax, dx
call fcn.016b9f91
call fcn.016cd456
or ah, byte [edi]
pop ecx
xchg ecx, eax
imul eax, dword [ecx + 0x2e53a9bd], 0xcde9e9b8
loopne 0xe93941
cmp byte [esi - 0x6e3a6d3a], dl
les ebp, [ecx]
popfd
inc edi
xchg edx, eax
add byte [esi + 0x77], bl
out dx, eax
cwde
call 0x698ad2ef
mov esp, 0x8a09a1e1
invalid
neg edx
shl eax, cl
lea edx, [eax + edx - 0x5bd071c]
bswap edx
call fcn.01685963
mov ecx, 0xeea84439
dec cl
lea edx, [ecx*4 - 0x15457ae3]
sub ebp, 4
ror edx, 0x78
lea eax, [ecx + edx*8 - 0x2ec55dda]
not edx
mov eax, dword [ebp]
xor eax, ebx
push ecx
inc dword [esp]
push edx
not eax
and dword [esp + 1], ecx
xor dl, 0x10
sal dword [esp + 4], cl
dec eax
xor dx, dx
or ecx, edx
xor eax, 0x4421af33
dec edx
or edx, edx
rol cl, 0xc2
neg eax
xadd dword [esp + 4], ecx
jbe 0x16fd32f
xor ebx, eax
call fcn.016a71ca
mov ecx, 0x1a9f4e1a
movsx eax, cl
mov al, byte [edi + ecx - 0x1a9f4e1a]
movsx edx, cl
shr cx, 0x29
jae 0x1804092
call fcn.0167e1b4
lea eax, [eax + edx*4 - 0x4c942a8f]
adc dl, dh
inc dl
ror eax, 2
neg eax
bswap eax
add eax, 0x81185128
ror eax, 1
sub eax, 0x8197929d
xor ebx, eax
call fcn.00ea340e
movzx eax, byte [ebp + ecx - 0x6800f69f]
xor al, bl
mov dword [esp + ecx - 0x6800f69f], 0x6a32a812
ror al, 1
inc ecx
not al
shl cx, 0xe6
ror al, 1
or byte [esp + ecx - 0x6800a7fe], ch
and byte [esp + ecx - 0x6800a7fe], cl
xor al, 0x27
jmp 0xe93934

Function at 0x1719c8c
Capabilities:
Parse pe header

Disassembly:
not cl
pop eax
inc cl
xor eax, edx
neg cl
sal edx, 0x35
xor cl, 6
lea edx, [eax + eax + 0x7fbecfb5]
push edx
xor bl, cl
lea ecx, [esp + ecx + 4]
jmp 0xf538d8
mov edx, dword [ecx + eax*2 - 0x793c2ef0]
call fcn.00fd80fc
mov edx, 0x4510d3ad
lea ecx, [edx + 0x183ad40f]
lea ecx, [esp + ecx - 0x5d4ba7ac]
movzx eax, dx
lea eax, [eax + eax*8 - 0x42d4c7d3]
mov ax, word [ecx + edx - 0x4510d3ad]
movsx ecx, dl
mov word [edi + edx - 0x4510d3af], ax
inc cl
movzx eax, byte [ebp + edx - 0x4510d3ae]
xor cl, ch
sbb edx, ecx
xor al, bl
jmp 0x177e386
adc cl, 0xbf
xor dl, bl
sar cl, 0x46
lea ecx, [ecx*4 + 0x16b8d636]
adc dl, 0xa2
rol dl, 1
shr cl, 0xc6
not dl
dec ecx
inc ecx
add dl, 0x86
xor bl, dl
call fcn.016eea01
lea esi, [esi + edx - 0x67daa905]
movzx edx, byte [edx + esi - 0x67daa904]
jne 0x16aa359
and cx, dx
sar dword [esp + eax + 4], 0x72
movsx edx, al
not cx
mov word [eax + edi + 2], cx
lea ecx, [edi + eax + 2]
mov dword [esp + eax], eax
mov dword [eax + edi - 2], ecx
lea edi, [edi + eax*4 - 2]
ror dword [esp + eax*2 + 4], 0xaa
pop eax
pop ecx
jns fcn.016eef86
mov esi, 0x408dae0c
call fcn.01761a3d
lea edi, [edi + edx - 0x67daa902]
ja 0x16ef69c
xor cl, bl
jmp 0xcf1a61
Function at 0x1722d70
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + eax*2 - 0x3da6], 0x94b7a2a4
movzx edx, byte [esi + eax*8 - 0xf698]
ja 0x187ec9b
movsx eax, cx
mov ecx, dword [eax + edi - 0x1ecf]
add edx, ecx
mov ecx, edx
push eax
jmp 0x161b320
bswap ecx
and dword [esp + edx - 0x6133], eax
xadd eax, edx
not byte [esp + 2]
xor ebx, ecx
shr dx, 0x4d
inc ecx
sal al, 0x83
mov dword [esp + edx - 0x6133], edx
ja 0x16bbb9a
mov edx, 0x3d981ebb
lea ecx, [edx + edx*2 - 0x17f43d5f]
mov edx, dword [edi + edx - 0x3d981ebb]
inc ecx
jne 0x164fe47
xor dl, bl
sub dl, 0x17
push eax
ror dl, 1
dec dl
add dword [esp + eax - 0x1ecf], eax
adc ax, ax
neg dl
xor bl, dl
lea edx, [esp + edx + 8]
mov dword [edx + eax - 0x3da6], ecx
movzx edx, byte [eax + esi - 0x3da5]
not al
xor dl, bl
dec dl
movzx ecx, word [esp + eax - 0x3d55]
rol dword [esp + ecx*2 - 0x1c092], cl
sbb eax, ecx
ror dl, 1
rol word [esp + ecx - 0xe046], 0x2e
push ecx
dec dl
rol ecx, cl
neg dl
ror dl, 1
xor bl, dl
neg ax
lea edx, [esp + edx + 0xc]
jno 0x1804d2b

Function at 0x172acca
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + eax*2 - 0x47549c20], 0x78379e21
not ecx
ror byte [esp + eax*2 - 0x47549c1f], 0x63
call fcn.00d3e8aa

Function at 0x17363e1
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, ebx
dec dword [esp + ecx*2 + 0xb]
dec edx
neg edx
xadd dword [esp + ecx*2 + 5], ecx
jp 0x181595e
inc eax
neg eax
dec dword [esp + 0x18]
xor ebx, eax
xadd dword [esp + 0xf], ecx
sub ecx, 0x8c1e3a8c
mov dword [edi + ecx - 0x73e1c57e], eax
lea edi, [edi + ecx - 0x73e1c57e]
xor cx, dx
mov edx, dword [esi + ecx - 0x73e16286]
sbb ecx, ecx
mov dword [esp + ecx*2], ecx
sal ecx, 0x41
lea esi, [ecx + esi + 0xe]
je 0xf02158
mov cx, word [eax + esi + 4]
call fcn.017246c6
mov eax, 0x112cc83b
lea ecx, [eax + eax - 0x615c9646]
mov ecx, dword [eax + ebp - 0x112cc83b]
lea ebp, [ebp + eax*4 - 0x44b320e8]
call fcn.016c648b
not ecx
call fcn.0169fb70
sbb edx, 0xaf307f0e
movzx eax, cl
jmp 0x174484f

Function at 0x173ce8f
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
mov dword [esp + edx - 0x7d52d7ac], edx
neg dword [esp + edx - 0x7d52d7ac]
mov ecx, 0x5a1e72ab
sub eax, 0xe1b62287
push ecx
and ecx, ecx
neg eax
rol eax, 1
call fcn.01784ac9

Function at 0x173e584
Capabilities:
Authenticate hmac

Disassembly:
inc edx
sub edi, 4
xchg dh, dl
and edx, 0xe35fba1
movzx eax, dl
mov dword [edi + edx*4 - 0x2850e800], ecx
and dl, 0x36
pop edx
pop ecx
pop eax
pop eax
pop eax
pop eax
jle fcn.016eef86
bswap edx
mov dword [esp + ecx - 0x7ef4], ecx
xor ax, cx
push ecx
xor edx, 0x382a7f00
lea eax, [eax + eax*8 - 0x4ddccace]
dec edx
sub dword [esp + eax - 0x5dec352e], eax
call fcn.0168e9fe
ror al, cl
jmp 0x1750fdb
push edx
add ecx, edx
adc al, 0xa4
not al
not edx
neg dx
xor bl, al
inc byte [esp + 2]
lea eax, [esp + eax + 0x18]
mov ecx, dword [eax]
jge 0x17267d4
Function at 0x173ea35
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push ecx
rol eax, 1
xor cx, dx
xor ebx, eax
call fcn.00ec5d5e
add esi, edx
mov edx, ecx
sar eax, 0x78
mov eax, dword [edi + eax - 0x75]
js 0x175570f
js 0x100c9ef
sbb edi, 0xfffffff4
mov dword [esp], ecx
xor eax, ebx
mov dword [esp + 3], edx
ror eax, 1
or ecx, edx
dec eax
neg eax
pop edx
ror ecx, 0x55
dec eax
jmp 0x170e5e2

Function at 0x174048a
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
pop edx
pop ecx
pop ecx
jne fcn.01699b49

Function at 0x1740493
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
xor ecx, ebx
lea ecx, [ecx + eax*2 - 0x353dc3a8]
mov dword [esp + eax - 0x44e92ba], 0xa4b0d0af
not dword [esp + eax*2 - 0x89d2574]
ror eax, 0xaa
neg ecx
ror ecx, 3
xadd dword [esp + edx - 0x2a40b4df], eax
rol dword [esp + edx - 0x2a40b4df], 0x14
not ecx
sar al, 0x22
lea eax, [eax*2 + 0x7928ada0]
rol ecx, 2
sub ecx, 0x5639cf27
xor ebx, ecx
call fcn.016ddf34
Function at 0x1740b10
Capabilities:
Encrypt data using speck

Disassembly:
or eax, ecx
movsx ecx, dx
mov dword [ebp + ecx*4 - 0x10170], eax
push edx
mov eax, dword [edi + ecx*2 - 0x80ba]
dec word [esp + ecx*2 - 0x80ba]
call fcn.010302a7
add byte [esi - 0x77], ah
dec edi
add cl, byte [ebx - 0x7c03daac]
in eax, dx
add al, 0xe8
sub dword [ecx], ecx
add al, 0
nop
or eax, dword [ecx - 9]
rol byte [ebp + 0x23], cl
loop 0xe87797
test byte [esp], bl
and dword [eax + edx*4 + 0x23], esp
fldcw word [eax]
jne 0xe877cd
mov word [edi], cs
inc esi
xlatb
mov dh, dh
sbb al, 0x24
mov eax, dword [edi + 4]
mov edx, dword [esp]
jno 0x1611d59
mov eax, 0xaa2d49a9
movsx edx, al
mov edx, dword [esi]
call fcn.01702b92
loop 0xe8783e
add cl, ch
xor eax, 0xe90085f5
mov al, 0xea
xchg ebx, eax
add byte [edi], cl
mov edi, 0x8c8966d0
xor bh, cl
std
invalid
movsx edx, ax
mov word [eax + esi - 0x231], cx
mov eax, dword [edi + eax*4 - 0x8c9]
lea edi, [edi + edx*8 - 0x118d]
xor eax, ebx
shl dx, 0x4d
not eax
not byte [esp + edx*4 - 0x8000]
sete byte [esp + edx - 0x2000]
inc eax
rol eax, 2
rol dl, 0xc7
pop edx
lea eax, [eax + edx + 0x1fbec23a]
jae 0x18717ea
and esi, esp
jg 0xe878a5
leave
retf
rol ax, 0xab
shr dx, cl
jmp 0xeb1944
and eax, eax
mov word [esi + eax - 0x3cc3c5], dx
lea edx, [eax*4 + 0x7c351698]
mov eax, dword [eax + ebp - 0x3cc3c7]
dec dx
xchg dh, dl
xor eax, ebx
lea ecx, [edx*4 + 0x3c938b3c]
or cx, 0x886
rol eax, 2
dec dx
ror cl, 0x81
sal dl, 0xc3
xor eax, 0x1a9c2d3d
and dx, cx
sal edx, cl
push ecx
inc eax
not eax
pop ecx
inc eax
ror dx, cl
neg eax
or edx, 0x9736b00e
xor ebx, eax
and edx, ecx
neg edx
add edi, eax
call fcn.01776625
add ecx, eax
movsx eax, byte [esp]
mov eax, dword [edi + 8]
xchg dword [esp], edx
inc edx
mov dword [esp], 0xa99e7925
mov dword [ecx], eax
xchg byte [esp + 1], dl
mov edx, dword [esi - 4]
dec dword [esp]
xor edx, ebx
mov ecx, 0x70319d03
push ecx
inc edx
xor edx, 0xf90d5289
ror edx, 1
xor edx, 0xd7182fa1
or cl, 0x9d
call fcn.017fa132
mov eax, 0x1e3c7c00
movzx ecx, al
rol eax, 0xf9
mov dx, word [esi + eax*4 - 0xf1e3e0]
add cl, byte [esi + eax*2 - 0x78f1ee]
jmp 0x1761ec0
ja 0xce5387
mov ecx, dword [ebp + 4]
pop edx
mov edx, 0xf09f5da4
not eax
shl dl, 0xc4
xchg dh, dl
not ecx
jnp 0x16ce8d4
lea edx, [esp + edx + 4]
sub dword [esp + eax - 0x231], eax
and byte [esp + eax*2 - 0x45f], 0x8a
not word [esp + eax - 0x231]
mov cx, word [eax + edx - 0x231]
jae 0xe878b2
call fcn.017ec8ab
jmp 0xe8a71f
dec edx
adc dl, 0xbb
xor ebx, eax
movzx ecx, dx
xor dx, 0x7d35
adc ebp, eax
movzx eax, cl
neg ax
jmp ebp

Function at 0x17430f0
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov dword [edi + ecx - 8], edx
lea edi, [edi + ecx*2 - 8]
lea eax, [eax + 0x5dac9806]
mov edx, 0x998fe003
pop ecx
pop edx
pop ecx
pop ecx
jae fcn.00f78eac

Function at 0x174482f
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.0176041f
rol eax, 0xbc
dec ecx
call fcn.017e1c02
Function at 0x17453dd
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
xor ebx, edx
and cl, al
shl eax, 0xc1
adc ebp, edx
not cx
lea edx, [ecx + eax*8 + 0x32a01f30]
and eax, edx
mov eax, dword [esi + eax*8 - 0x2000]
call fcn.016b2c6d
xor edx, ebx
xor edx, eax
jmp 0xfdcee6
not cx
inc ax
xor ebx, edx
xadd ax, cx
adc ebp, edx
mov eax, dword [edi + ecx - 0x5e15fffc]
lea ecx, [ecx*8 - 0x4554c9d8]
mov ecx, dword [edi + 8]
mov edx, 0x5a8a6928
sar edx, 0x46
and eax, ecx
mov ecx, edx
bswap edx
not eax
push ecx
pop ecx
dec ecx
mov dword [edi + ecx - 0x16a299b], eax
lea eax, [ecx - 0x7748ec5b]
or edx, eax
call fcn.017077c5
jmp 0x4c378ac4
sub edx, 0x260a7f18
xor edx, 0xfa08a72f
add al, cl
neg edx
jmp 0xe6130e
add dl, 0xb2
sub eax, ecx
xchg ecx, eax
xor dl, cl
sub al, cl
lea ecx, [eax + ecx*8 - 0x437a24dc]
xor bl, dl
shr ax, 0x6c
adc edx, esp
shl eax, cl
sbb ecx, 0x5a2c048d
not cl
mov eax, dword [edx + ecx - 0x49005c6f]
xor ecx, ecx
lea edx, [ecx - 0x5c479562]
lea esi, [esi + ecx*8 - 4]
mov dword [esi + ecx*8], eax
lea ecx, [edx + ecx*2 - 0xd5c31c1]
movsx eax, dl
ror edx, 0x98
jp fcn.00f0da46
push edx
movzx ecx, dl
xor eax, ebx
bswap eax
neg eax
add dword [esp + ecx - 0x90], 0xcd0a5e93
mov dword [esp + edx - 0x2a07188c], edx
lea eax, [edx + eax + 0x662fb723]
not ecx
and word [esp + edx - 0x2a07188a], 0x6795
not eax
xor cl, 0x94
xor word [esp + edx - 0x2a07188a], 0xf99c
ja 0x17d6ae6
add ebp, eax
add cl, ch
lea eax, [ecx*2 + 0x234ca03]
neg ecx
lea edi, [edi + ecx - 0xd000001]
dec cx
sar al, 0x81
movzx edx, byte [ecx + edi - 0xd00ffff]
xor dl, bl
neg dl
xadd cx, ax
ror dl, 1
neg cx
jb 0x16fcad7
xor ebx, eax
neg cx
ror dl, cl
add edi, eax
call fcn.0174f4b7
mov ecx, dword [ebp]
mov eax, 0xc9200f2e
movsx edx, ax
push edx
mov eax, dword [ebp + edx - 0xf2a]
shl edx, 0xd1
push edx
not ecx
sete byte [esp + edx - 0x1e5bfffc]
neg dl
not eax
or ecx, eax
movsx eax, word [esp + edx*2 - 0x3cb7fffc]
mov dword [ebp + eax*8 - 0x77fc], ecx
mov eax, dword [edi + edx*2 - 0x3cb80000]
shl dword [esp + edx*4 - 0x796ffffc], 0xdd
call fcn.0162311a
mov edx, 0x2c047fa4
add byte [esp + edx - 0x2c047fa2], dh
lea edi, [edi + edx*2 - 0x5808ff47]
sal dx, 0xcf
ror edx, 0x68
xor al, bl
not al
or dl, byte [esp + edx*4 - 0xb01000]
dec edx
js 0xd378bd
inc al
pop edx
xor edx, edx
xor al, 0x3b
or dl, 0x9f
inc edx
ror al, 1
add dl, dl
xor bl, al
sar dx, 0xaf
seta dl
call fcn.01684895
mov eax, 0x8daba5ba
xor edx, ebx
neg edx
movzx ecx, al
push ecx
dec edx
sal ecx, 0x62
bswap edx
inc edx
ror word [esp + ecx - 0x2e8], 0xb
adc cx, 0xe916
xor ebx, edx
xchg dword [esp + ecx - 0xebfe], ecx
xor dword [esp + ecx - 0x1740], eax
adc esi, edx
sar cx, 0xc9
pop edx
lea eax, [ecx + eax*8 + 0x3e054519]
movzx eax, byte [ecx + edi - 7]
lea edi, [edi + ecx*2 - 0x11]
xor al, bl
push ecx
inc al
call fcn.01794170
Function at 0x1746642
Capabilities:
Encode data using xor

Disassembly:
lea esi, [edx + esi - 0x45fc]
and eax, edx
xor ecx, ebx
neg edx
neg ecx
jmp fcn.01678b8b
lea edi, [edx + edi - 0x4a85ee91]
mov cl, byte [eax + esi - 0x453bf013]
sub al, ah
jno 0x16e2055
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov eax, 0x46008232
add ecx, edx
ror al, 0xa5
mov edx, dword [eax + edi - 0x46008289]
jae 0x1730031
dec eax
rol eax, 0xb0
adc ecx, edx
movzx edx, ax
mov dword [edi + edx*8 - 0x22ff8], ecx
and dx, ax
mov ecx, dword [esi + edx*8 - 0x23000]
neg al
jle 0xfde463
invalid
lea esi, [esi + eax - 0x453bf021]
rol eax, 0xde
neg eax
lea eax, [eax + eax - 0x13e5a17f]
mov byte es:[eax + edx - 0x497c666f], cl
movzx edx, ax
lea edi, [edx + edi - 0x6673]
not edx
mov ecx, 0x9d3c352c
mov eax, dword [eax + edi - 0x497c666f]
dec dl
jne 0x16cbdfd
mov edx, dword [eax + esi - 0x453bf017]
mov ecx, 0xbe944003
jmp 0x1652778
mov edx, 0x4a85ee8d
jmp 0x10a8144
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + edi - 0x1a0cd529]
pop edx
mov edx, 0x13b5d53e
xor cl, bl
sub cl, 0
pop eax
mov eax, edx
rol cl, 1
not dl
not cl
inc cl
xor bl, cl
shr al, 0x45
lea ecx, [esp + ecx + 8]
pop eax
lea edx, [edx + edx*8 + 0x5e231413]
adc dl, byte [esp + edx*2 - 0x1f0f2fb5]
mov eax, dword [ecx + edx*4 - 0x3e1e5fdc]
mov dword [ebp + edx*8 - 0x7c3cbfb8], eax
movzx eax, byte [esp + edx*2 - 0x1f0f2fee]
mov eax, dword [edx + edi - 0xf8797fc]
lea edi, [edi + edx - 0xf8797fc]
movzx ecx, dl
ja 0x16f7c7b
mov eax, 0x453bf017
jmp 0x16f7b50

Function at 0x1749980
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dword [esp + 4]
xor ebx, ecx
not edx
sar edx, 0xe6
add ebp, ecx
mov ax, word [edx + edi - 0x7b]
mov dword [esp + edx - 0x7b], 0x8c21cea8
lea edi, [edi + edx*2 - 0xf4]
mov ecx, 0x6eaa0303
movzx ecx, byte [esi + edx - 0x7b]
ror byte [esp + edx*4 - 0x1ec], 0x41
call fcn.00f1fc06

Function at 0x17499b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [edx + ebp - 0x29a9a14]
mov dword [ebp + edx*4 - 0xa6a6840], eax
pop edx
mov esi, ebp
mov ebp, 0xcdbbf8b9
movzx ebx, bp
call fcn.0172152e
Function at 0x174af73
Capabilities:
Encode data using base64

Disassembly:
adc edi, ecx
call fcn.016ee894
inc ecx
bswap ebx
call fcn.00d1cfa3
xor edx, 0x280d93be
setne dl
not ax
xadd cl, ch
not edx
sbb ax, 0x711e
ror ax, 1
or cx, cx
xor bx, ax
shl edx, cl
setbe dl
sub esi, 2
neg ecx
and ecx, 0x18b953a0
mov word [esi + ecx - 0x8910020], ax
call fcn.0185633b
not ecx
setp dl
dec ecx
bswap ecx
sar eax, 0x63
add dword [esp + eax*2 - 0x8914e], 0xbfaa919c
and edx, edx
dec ecx
rol dl, 0xa1
xor ebx, ecx
sub edx, edx
not word [esp + eax - 0x448a5]
jno 0xd104c0
sub edi, 4
mov ecx, 0xc1165a37
or ecx, ecx
movzx eax, cx
mov eax, dword [edi + eax*8 - 0x2d1b8]
sbb cx, cx
mov edx, 0x9a94f0f
inc ecx
xor eax, ebx
shl cl, cl
or ecx, edx
lea eax, [eax + edx*2 + 0x4fc8ce8b]
lea ecx, [edx*8 + 0x1b87260b]
sar dl, cl
or dl, ch
neg eax
not eax
bswap eax
xor ebx, eax
add edx, 0x882ff03a
not ecx
ror dl, 0x86
adc ebp, eax
sub edi, 2
dec cl
movzx eax, word [edi]
xor ax, bx
add ax, 0x8cac
jmp 0x1686971
dec ecx
xor ecx, 0xfa89ae98
shl word [esp + eax*2 - 0x448a8e], 0x4e
neg ecx
dec edx
sal dl, 4
shr edx, 0x1f
dec ecx
or dword [esp + eax*2 - 0x448a8e], eax
jae 0x1703194
Function at 0x17514ce
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0xfffb08cf
inc dword [ecx - 0x5ff04117]
inc edi
cwde
sub al, 0
add byte [ebx + 0x54892414], cl
and al, 4
sbb al, 0x6c
adc bl, byte [ebx + 0x24448b44]
add ch, al
or bl, byte [edx + 0x15]
add byte [edi + eax*8 - 0x6bffdbbc], bl
inc esp
and al, 2
call fcn.00e900be
adc eax, 0x44c79c00
and al, 0
pushfd
mov dword [esp], 0x5119e594
xchg esp, eax
in eax, 0x19
push ecx
call fcn.01833674
xor dword [0x8f6d6425], ecx
dec ecx
leave
push ss
loopne 0xd3a6a6
jp 0xd3a748
std
dec edx
loopne 0xd3a6ac
jp 0xd3a67a
xchg ecx, eax
pop edx
loopne 0xd3a6b2
jp 0xd3a690
xchg ebp, eax
sub ah, al
fnstcw word [edx - 0x3b]
jno 0xd3a711
jo 0xd3a68e
leave
pop ds
test edi, 0x6805feec
xor dword [edi - 0x36], 0x12
fnsave dword [esp + ebp*4 - 0x5e]
cld
cmp ebp, edi
std
loope 0xd3a6e1
push edi
aam 0x88
inc ecx
xchg esi, eax
xchg edi, eax
test al, 0xc6
or edx, dword [ebp + 0x71]
sbb eax, 0x65a6a87d
mov word [ebp + 0x1d], ss
jge 0xd3a6b9
adc dh, 0x48
wait
movsd dword es:[edi], dword [esi]
lds eax, [ebx - 0x79]
dec ebx
test eax, 0x4fb864bc
shl byte [edx], 1
inc esp
sbb bl, dl
int3
outsd dx, dword [esi]
std
and eax, 0xfdcca985
daa
jne 0xd3a6f8
sub eax, 0x58d5d2d5
sbb ch, byte [eax + 0xa73b885]
clc
or bh, al
in eax, dx
salc
loope 0xd3a734
push edi
mov ebx, eax
xchg edi, eax
inc eax
xchg esi, eax
xchg edi, eax
test al, 0x14
out dx, eax
adc bl, byte cs:[0x5cfda87d]
mov dword [0xa87d1d7a], eax
push ss
test eax, 0xaea59b48
xchg esi, eax
jle 0xd3a7dc
xor dword [ecx - 0x17], ebx
pop ebp
mov eax, 0x25314323
pop edx
cmp ecx, eax
push 0xffffffffffffffb8
push 0x1ded6e15
cmp eax, ecx
cmp al, 0x46
inc esi
out dx, al
xchg ebx, eax
aaa
and dword [0x651714c1], ebx
inc ebx
jae 0xd3a715
pop edx
fcom qword [eax]
pop eax
push edx
inc esi
mov eax, dword [0x7444679a]
jge 0xd3a78e
push eax
ret
int1
shr dword [ecx], 1
loopne 0xd3a783
pop eax
add dword [edi + 0x41], 0x19
lodsd eax, dword [esi]
pop ecx
dec ebx
insb byte es:[edi], dx
or ebx, ebp
sahf
cmpsb byte [esi], byte es:[edi]
pop ss
xor ebp, esi
pop ecx
add byte [edx], bh
in eax, 0xe0
loopne 0xd3a7ee
jae 0xd3a7f6
popal
jge 0xd3a871
cmp eax, 0x9759fd02
hlt
or eax, 0x1a060912
sbb dword [edx], ebx
dec esi
lock xchg byte [edi - 0x67f26121], bl
push ds
std
xchg edi, eax
mov ch, 0xb4
imul bl
sbb eax, edi
jle 0xd3a8de
insb byte es:[edi], dx
cmpsb byte [esi], byte es:[edi]
mov ecx, dword [edi]
pop ebp
xor al, 0xf2
stosb byte es:[edi], al
into
pushal
shr bl, 0xec
test dword [eax], 0xd1ef0257
enter 0xffffffffffffcb8f, 0x23
js 0xd3a858
pop eax
add byte [edi - 0x57666011], ch
iretd
adc ebp, dword [ebp + 0x4b74fd9e]
push cs
test dword [esp + edi + 0x1d], edx
int1
wait
sar byte [esi], 1
adc al, 0xf6
cld
invalid
sub eax, 0x59889399
push 0x9f96c784
jmp 0x16be23e
bswap eax
neg eax
xor eax, 0x7ca7041b
add eax, 0xfc14ed82
xor ebx, eax
push 0x8d13e28d
add edi, eax
push 0x3b2fe23e
lea esp, [esp + 0x14]
jmp 0xd3a6b4
sub eax, 0x401b9033
rol eax, 1
jmp 0x1010e01
Function at 0x1754bdf
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [esi + eax - 0x6f3ff312]
push eax
sub ax, 0xe08
mov eax, dword [eax + esi - 0x6f3fe506]
imul ecx
mov dword [esi], edx
inc word [esp]
mov dword [esi + 4], eax
sub edi, 4
mov ecx, dword [edi]
xor ecx, ebx
mov edx, 0xcfbe03b4
mov dword [esp + 4], 0x58b46400
xor ecx, 0x5e323407
pop eax
neg eax
not ecx
lea ecx, [ecx + eax - 0x6ae8edc]

Function at 0x17556ff
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
adc esi, 2
mov dword [esp], 0xc92a51a6
movsx edx, cx
sal dx, cl
mov word [edx + esi - 0xb440], ax

Function at 0x175c49e
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
dec dx
movzx dx, byte [ebp + eax*4 - 0x1439bc]
xor ax, 0xcaab
mov al, byte [ebp + eax - 0x5c4c2]
not dl
not al
and dl, al
mov word [ebp + 2], dx
call fcn.00f76f6c

Function at 0x175e62a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [esi + eax*8 - 0x4b4]
mov dword [esi + eax - 0x96], edx
sbb ax, ax
push ecx
lea edi, [eax + edi - 4]
mov edx, dword [edi + eax*8]
mov dword [esp + eax*4 + 4], eax
xor edx, ebx
shr word [esp + eax*4 + 4], 0xab
sar word [esp + eax + 6], 0x4a
lea edx, [edx + eax*8 - 0x63a76f89]
xor eax, 0xc1138c82
shl eax, cl
not edx
pop ecx
xor edx, 0x1b34f2e
pop ecx
neg edx
and ax, 0x1820
xor ebx, edx
push ecx
add ebp, edx
add ecx, dword [esp + ecx]
pop eax
jle fcn.00f0da46

Function at 0x1760d18
Capabilities:
Encrypt data using speck

Disassembly:
movzx eax, dx
mov edx, dword [edi + eax - 0xf0b4]
lea edi, [edi + eax*2 - 0x1e164]
inc ax
call fcn.016d6d86
add cl, 0x1b
sar eax, 0xff
adc eax, 0x26a8a405
neg cl
shr eax, 7
rol cl, 1
lea eax, [eax + 0x3c13512d]
call fcn.00f629e5
mov edx, 0xad04f0b4
jmp 0xec8006

Function at 0x1763de9
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [eax + edi - 0x59493250]
mov cx, word ss:[edx + eax - 0x5949324c]
lea edx, [eax + eax*4 + 0x26b9b4b7]
call fcn.018520aa
lea eax, [ecx + eax*2 + 0x4106dfb1]
neg edx
lea edx, [edx + eax + 0x376b7935]
sal cx, 0xa7
xor ebx, edx
mov dword [esp + eax - 0x5949324c], eax
add esi, edx
jmp 0xf46756

Function at 0x17675ca
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, 0xfba22102
add ebp, 4
mov ecx, 0x12377d91
or eax, ecx
call fcn.016848d4
lea eax, [esp + eax + 0x10]
setne cl
jnp 0x16c5a59
mov dx, word [eax + ecx - 0x4d92c801]
xchg dword [esp + ecx - 0x4d92c7f9], ecx
mov byte [esp + ecx*2 - 0x379415fa], cl
pop eax
mov word [edi + ecx*4 - 0x6f282c04], dx
mov eax, dword [esp + ecx*2 - 0x379415ff]
push ecx
sbb ecx, eax
lea edi, [ecx + edi - 0x1a280a74]
pop eax
pop edx
pop ecx
pop ecx
jnp fcn.00f78eac
bswap edx
xadd cl, al
ror edx, 3
not edx
dec ax
js 0x16bbc2c
mov edx, 0x8ca64dae
mov edx, dword [ebp]
jmp 0x167b682

Function at 0x1767632
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
call fcn.0176bea7
xor eax, ebx
not dl
lea edx, [edx*8 - 0x62e48aeb]
not eax
movzx ecx, dl
dec cl
xor eax, 0xe9208007
or ecx, ecx
rol eax, 3
call fcn.01880252