joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013e0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x220
mov eax, dword [0x408030]
push esi
push edi
mov ecx, 0xb
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [esp + 0x224], eax
xor eax, eax
mov ecx, 0x35
lea edi, [esp + 0x146]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, str._admininstall
mov esi, 0x408700
mov ecx, 0xe
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x401451
mov ecx, dword [ebp + 8]
push 0x4082a0
push ecx
push str.MSIEXEC.EXE
push str._s__a___sinstall_s_
lea edx, [esp + 0x20]
push edx
jmp 0x401465
mov eax, dword [ebp + 8]
push eax
push str.Setup.exe
push eax
push str._sInstall_s__sInstall_
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x11c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4014c3
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401491
mov ecx, dword [esp + 0xc]
sub eax, edx
push eax
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.HNC_Install
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4014d7
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x224]
call fcn.004019c1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x224]
mov eax, 1
call fcn.004019c1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4014f0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
push esi
call fcn.00401a41
mov ecx, dword [esp + 0x10]
add esp, 4
mov edi, eax
push edi
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x401534
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push eax
push 0x406438
push edi
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x401620
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x408030]
mov dword [esp + 0x214], eax
push 0x104
lea eax, [esp + 8]
push eax
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x401666
mov eax, 1
mov ecx, dword [esp + 0x214]
call fcn.004019c1
add esp, 0x218
ret
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 3], 0x5c
je 0x401682
mov byte [esp + eax + 4], 0x5c
mov byte [esp + eax + 5], 0
push str.MSIEXEC.EXE
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x114]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x120]
push edx
call fcn.004014f0
add esp, 0x18
test eax, eax
je 0x40164e
mov eax, dword [esp]
push str.2.0.0000.0000
push eax
call fcn.00401560
mov ecx, dword [esp + 0x21c]
add esp, 8
inc eax
neg eax
sbb eax, eax
inc eax
call fcn.004019c1
add esp, 0x218
ret

Function at 0x4027eb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp eax, ebx
jbe 0x40280a
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x402804
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x4027f5
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004025b0
aaa
xchg esi, eax
push esp
dec edx
lea eax, [ebp - 0x58]
push eax
call fcn.004025c0
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00402575
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40289e
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004025b0
invalid
Function at 0x402c6e
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x402c64
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x402c5f
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x402c49
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x402c51
cmp edx, ebx
jne 0x402d9f
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x402c20
add eax, dword [eax + 4]
jmp 0x402c0d
mov dword [ebp + 0xc], ebx
jmp 0x402c6f
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402c87
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
leave
mov edi, 0x60000000
jmp 0x402ca5
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
xbegin 0x8b402ca3
js 0x402cc9
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x402d03
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x402cea
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x402cf3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x402cfd
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x402cdf
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x402c69
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x402d50
dec eax
je 0x402d47
sub eax, 3
je 0x402d3e
mov dword [ebp - 4], 0x40
jmp 0x402d6d
mov dword [ebp - 4], 4
jmp 0x402d53
mov dword [ebp - 4], 0x20
jmp 0x402d53
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x402d9f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x402d1f
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004025b0
js 0x402df7
retf 0xffd5
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cld
invalid

Function at 0x402c9d
Capabilities:
Inspect section memory permissions

Disassembly:
xbegin 0x8b402ca3
js 0x402cc9
or byte gs:[eax], al
add byte [eax], al
inc eax
Function at 0x40894b
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
sub ecx, 0xa51cce51
call fcn.00408980
sub ecx, ecx
add ecx, eax
xor dword [esi], edi
push eax
pop ecx
sub eax, 0x59fb3553
add esi, 1
cmp esi, ebx
jne fcn.0040894b
add ecx, 0xf6b68083
add eax, 0x7a40e12a
ret
Function at 0x1735980
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12ce000]
push edi
jmp 0x173599a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x17359a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1735990
mov eax, 1
add ebx, ebx
jne 0x17359b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x17359c4
jne 0x17359e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17359e3
dec eax
add ebx, ebx
jne 0x17359d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x17359a8
add ebx, ebx
jne 0x17359df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1735a35
xor ecx, ecx
sub eax, 3
jb 0x17359fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1735a6a
sar eax, 1
mov ebp, eax
jmp 0x1735a06
add ebx, ebx
jne 0x1735a06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17359d4
inc ecx
add ebx, ebx
jne 0x1735a14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17359d4
add ebx, ebx
jne 0x1735a21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1735a16
jne 0x1735a32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1735a16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1735a54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1735a46
jmp 0x1735996
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1735a54
add edi, ecx
jmp 0x1735996
pop esi
mov edi, esi
mov ecx, 0x40e1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1735a72
cmp byte [edi], 0x11
jne 0x1735a72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1735a77
lea edi, [esi + 0x132e000]
mov eax, dword [edi]
or eax, eax
je 0x1735aef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x257de10]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x257dfb4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1735aa4
mov ecx, edi
jns 0x1735ad3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x257dfbc]
or eax, eax
je 0x1735ae9
mov dword [ebx], eax
add ebx, 4
jmp 0x1735ac1
call dword [esi + 0x257dfb8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1735b20
cmp al, 0xef
ja 0x1735b13
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1735af5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1735b02
mov ebp, dword [esi + 0x257dfc0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1735b54
sub esp, 0xffffff80
jmp 0x420627
Function at 0xc34d63
Capabilities:
Get number of processors

Disassembly:
dec ax
xor ax, 0x5d97
add ax, 0x52bc
call fcn.00c53e13

Function at 0xc37fae
Capabilities:
Encode data using xor

Disassembly:
add ch, cl
inc edi
add byte [edx + 0x333d6522], bh
jmp 0x10b73ed
xor esi, 0xc0bc8dad
inc al
mov dword [esp + esi - 0x436284e1], esi
pop esi
xor al, 0xa4
not si
sal esi, 0xb3
rol al, 1
dec esi
add esi, 0xe90ecd17
xor bl, al
call fcn.011079dd
mov ebp, dword [ebp]
call fcn.01161d17
mov bh, 0x52
inc edx
or dword [ebx], esi
aaa
in eax, 0x44
jns 0xc37fc9
test byte [ebx + 0x56f3352d], bh
ja 0xc37f8f
stosb byte es:[edi], al
mov ebp, 0xb45d5333
xor esp, esi
test bl, al
std
jmp 0xb323060c
mov edx, dword [edi + edx - 0x333d6522]
mov eax, dword [edi + 4]
mov cl, byte [edi + 8]
push 0x9bb24f85
jmp fcn.011350a0

Function at 0xc4346b
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + eax - 0x23106638], ecx
mov ecx, eax
jmp 0x11310d4
neg ebp
mov edx, ebx
push edx
xor ebp, 0x8a9430a7
ror bl, 0xc6
not ebp
or word [esp + eax*2 - 0x462139cf], bx
call fcn.00c8b07f
push eax
mov dword [esp + ecx - 0x23106638], ebp
not eax
push edi
xchg ecx, eax
pushfd
push esi
rol al, cl
mov ecx, 0
mov esi, 0x78209612
mov ebp, 0xbe8b5f27
xor ebp, esi
lea esi, [esp + esi - 0x7820961a]
dec ebp
push ebx
sbb ax, bp
movzx ebx, bp
mov dword [esp + eax*2 - 0x462139c0], ecx
xor ebp, eax
push edx
mov ebp, dword [esp + eax - 0x23109cc0]
jae 0x10c21db
fisttp qword [ecx - 0x39bfbb74]
fidivr word [ecx - 0x74ad17cd]
lodsb al, byte [esi]
add al, 0x40
arpl di, bp
fmul qword [edi]
add eax, 0x10
stc
inc dword [ebp - 0x3d027ae8]
test byte [0xc2fd8518], ah
push esp
pushal
loop 0x1131160
out dx, al
daa
jae 0x1131155
sbb cl, byte [esi]
in al, dx
or eax, ebp
pop ecx
lds esp, [edx + 0x1bca88fc]
test byte [ebx], 0x23
pop edx
sub dl, byte [ecx + edx*8 + 0x10]
std
aad 0xd6
xor al, 0xc
js 0x1131110
lodsb al, byte [esi]
shl byte [eax], cl
movsd dword es:[edi], dword [esi]
add byte [eax], al
add byte [esi + 0x18], ch
fist word [ebx - 0x39]
pop edi
adc al, 0x82
xor dh, byte [ebp - 0x54]
jne 0x1131103
mov eax, dword [0x40594dea]
getsec
sbb eax, 0x57
sub al, 0x92
fcom dword [edi + 0x2c]
xchg edx, eax
bound eax, qword [ebp + 0x6c]
invalid

Function at 0xc476b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x10]
jne 0x10cc832
mov edi, 0xf4becf8f
pop edi

Function at 0xc53e4e
Capabilities:
Encrypt data using speck

Disassembly:
not al
call 0xc89451
cmp di, ax
Function at 0xc569f7
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov al, byte [ebp + 4]
jae 0x11225e3
mov ecx, 0x19851b39
lea edi, [edi + ecx - 0x19851b3a]
movzx ecx, byte [edi + ecx - 0x19851b39]
call fcn.010a98cb
jmp 0x117017d
mov dword [esp + 0x10], 0x7540a7f6
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.010b97de
mov ecx, 0x96a5ca0b
push ecx
movsx eax, cl
mov ecx, dword [ebp + eax - 0xb]
or eax, 0x42aa783b
pop eax
jg 0xc34d73
mov byte [esi], al
jmp 0xe0e3c0
je 0xe0e3d4
inc edx
cmc
cmp edx, 0x104
jb 0x1094188
mov eax, dword fs:[0x30]
mov cx, 0xf8be
btr ecx, edi
bt bx, sp
mov eax, dword [eax + 0xc]
xadd ebx, ebx
shrd ebx, eax, 0x34
mov ecx, dword [eax + 0xc]
sar ebx, cl
mov eax, dword [eax + 0x10]
movzx ebx, cx
xor ebx, 0xceab6a91
mov dword [ebp - 4], eax
shr bx, cl
rcr bh, 0x2b
inc bx
mov ebx, ecx
cmp ax, 0x6b02
test dl, 0x96
cmp ecx, eax
jmp 0x112e5f7
mov eax, 0xa60753ad
bts si, cx
mov cl, dl
btr esi, ebp
ror esi, 0x13
bts si, si
rol eax, cl
lea esi, [ebp + edx - 0x10c]
add al, dl
xor al, byte [edi + esi]
jmp 0xc83a93
push 0xbb8dca1c
adc ebp, 6
call fcn.00c3cc9d
push ebp
mov ebp, esp
lea esp, [esp - 0x10c]
cmp esi, 0x459dd103
push ebx
stc
push esi
jmp 0x11317d1
je 0x10c7f85
lea ebx, [ebx]
xor di, 0xca99
push edi
bt edi, 0xba
mov edi, eax
shl eax, 0x8a
ror ah, 0xb4
lea eax, [ebp - 0x10c]
cmp esp, 0xee17630a
xor edx, edx
sub edi, eax
jmp 0x114a68d
jmp 0x1094188
sub esi, 2
call fcn.00c79b6f
Function at 0xc6e213
Capabilities:
Encode data using base64

Disassembly:
rol ecx, 0x79
ror al, 1
jmp 0x114615c
ror dl, 1
xor dl, 0xbb
not dword [esp]
jmp 0x10ff504
movzx edx, word [ebp]
call fcn.01099ba9
mov ecx, 0x49b37b15
shl ecx, cl
movzx eax, byte [esi + ecx - 0x62a00000]
lea esi, [ecx + esi - 0x629fffff]
ror cl, 0x25
jns 0xe0d1a1
sal dword [esp], 0xc9
xor dl, 0x3d
jmp 0xc4e4b4
xor al, bl
rol ecx, 0xc
add ecx, ecx
inc al
ror ecx, 1
jno 0x10b2a26
or byte [eax], al
add ecx, ecx
xor al, 0xba
sub ecx, ecx
jbe 0xc37977
lds esp, [eax + 0x72d920a7]
mov al, byte [0x72d920a7]
and cl, bl
jb 0x10b2a49
adc byte [ecx + 0x7e], dh
jno 0x10b2ab9
rcr dword [eax], 1
xlatb
mov ebp, 0xf9188b94
insb byte es:[edi], dx
xor dword [esi], edx
shl dword [ebx - 0x16], 1
jo 0x10b2a86
ljmp 0x5b67:0xcc353a70
xor eax, 0x315b67cc
mov ah, 2
jle 0x10b2a33
push esp
das
push ss
insb byte es:[edi], dx
push 0x59ea7953
or dword [ebx], ebp
jb 0x10b2ada
cwde
sbb al, 0x27
jns 0x10b2a24
sub eax, 0x5441a700
sti
add eax, 0xadca27ad
xchg ebp, eax
xchg ebx, eax
pop esp
outsd dx, dword [esi]
inc ecx
inc ebx
xchg ebx, eax
push 0xce7321d2
test byte [ebp + 0x51], ch
loop 0x10b2a35
nop
stosd dword es:[edi], eax
sub dword [ebx], edx
sub dword [ebx], edx
retf
adc byte [edx - 0xc], 0xf9
push edx
cmpsb byte [esi], byte es:[edi]
mov al, byte [0xd3a886a1]
inc esp
mov ecx, 0xcf91ba2d
sal byte [esi + 0x21ad846c], 3
pop edx
push eax
cmp esp, dword [eax + 0x5b]
ja 0x10b2af5
xchg esp, ebx
invalid
fdiv st(6), st(0)
cmpsd dword [esi], dword es:[edi]
mov esp, dword [0xc6989b33]
test cl, 0xd9
xchg ebx, eax
invalid
push esp
and byte [edx - 0x21], ah
jge 0x10b2add
and eax, dword [ecx]
push esp
outsb dx, byte [esi]
in al, 0xad
inc ecx
arpl word [edx], di
xor dl, bh
cmpsd dword [esi], dword es:[edi]
mov dword [0xe4b8b498], eax
test eax, 0x8bfed28b
invalid
rol dl, 1
xor bl, dl
push 0x7a1e6d2a
lea edx, [esp + edx + 0xc]
call fcn.00c7684e
pop eax
inc cl
and al, al
neg cl
xor ax, ax
shl al, 0x21
not al
xor bl, cl
sar al, 0x65
and eax, eax
adc ecx, esp
dec al
setl al
mov al, byte [ecx]
sub edi, 2
call fcn.00c73df8
push ecx
ret 0xadf6
dec ecx
sub ebx, 8
call 0xc734f7
bswap eax
inc cl
dec eax
jle 0x11453d4
mov edx, 0xe88d2f16
sub ebp, 2
jmp 0xc6e209
xor cl, 0xba
sub al, ah
ror cl, 1
inc eax
jl 0x112501a
sal ecx, 0x3b
and ecx, 0x6b15500
inc al
shl ecx, 0x5d
lea ecx, [ecx + ecx*4 + 0x2985beb9]
neg al
xchg ch, cl
xor bl, al
neg cx
add eax, esp
movzx cx, byte [eax + ecx*2 - 0x530a8c84]
call fcn.010f0f8f
loop 0x11461ff
pshufw mm4, qword [esi], 0x42
inc edx
xor ch, ah
adc al, 0xc1
and esi, 0x67fee4b8
jb 0x114618f
jg 0x11461da
push ds
push ss
and ch, bl
push esp
xchg ebp, eax
invalid
aam 0xf2
invalid
invalid

Function at 0xc6e4d7
Capabilities:
Authenticate hmac

Disassembly:
xor al, 0x2f
inc al
rol ecx, 0x5c
add ecx, ecx
xor bl, al
sub ecx, 0x791a5124
lea eax, [esp + eax + 8]
sal dword [esp + ecx - 0x38487aa8], cl
mov dword [esp + ecx - 0x38487aac], ecx
mov cx, word [ecx + eax - 0x38487aac]
sbb ebp, 2
mov word [ebp], cx
lea esp, [esp + 8]
jmp fcn.01145432
Function at 0xc89451
Capabilities:
Encrypt data using speck

Disassembly:
push 0xd71bdd12
xor cl, bl
call fcn.010ff4d8
mov edx, 0x3a98f0b1
inc edx
lea ebp, [ebp + edx - 0x3a98f0b3]
movsx eax, dl
xor edx, 0xbeb0eaab
movzx eax, byte [ebp]
bswap edx
sub dl, dh
call fcn.01125188
call fcn.00c73969
add esi, 1
call fcn.00ca1c06
call fcn.010b1d5f

Function at 0xc914c5
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
stc
clc
cmp edx, esp
cmp esi, 0xffff
jmp 0x1113b2c
je 0x10fa4d5
mov eax, 0x5a4d
cmc
clc
cmp word [edx], ax
jmp 0x10fa4cf
jmp 0xc37189
push ebp
bsr dx, bp
mov ebp, esp
and dh, 0xb5
test bp, sp
rcl dx, 0xa2
mov edx, dword [ebp + 8]
test cx, 0xdc26
jmp 0x1119948
cmp dword [eax], 0x4550
jne 0x10fa4d5
mov ecx, dword [eax + 0x78]
clc
mov dword [ebp - 4], ecx
cmp edi, 0xca324c19
cmc
test ecx, ecx
je 0x10fa4d5
mov eax, dword [eax + 0x7c]
push ebx
cmp dx, 0x6428
clc
push edi
jmp 0xc5529f
jl 0xc37195
jmp 0xca1347
je 0x114af9a
sub eax, eax
pop esi
jmp 0x11124f9
mov esp, ebp
pop ebp
ret
ja 0x111e140
mov eax, esi
stc
sub eax, dword [ecx + edx + 0x10]
jmp 0xc8cc7b
lea esp, [esp - 0x114]
push esi
cmc
cmp sp, 0xdd9e
test edx, edx
je 0x10fa4d5
mov esi, dword [ebp + 0xc]
test esi, 0xabbea88c
test sp, si
test esi, esi
jmp 0xc792b2
mov edi, dword [ecx + edx + 0x18]
stc
cmp sp, bp
test edi, edi
je 0xc37195
mov eax, dword [ecx + edx + 0x20]
jmp 0x1140627
dec edi
add eax, edx
sub ebx, ebx
mov dword [ebp - 0xc], eax
test bp, cx
clc
cmc
test edi, edi
jmp 0x109a358
mov eax, dword [edx + 0x3c]
test esp, edx
add eax, edx
jmp 0xc92b8a

Function at 0xc9152f
Capabilities:
Encrypt data using speck

Disassembly:
xor dx, cx
pop ecx
pop esi
bswap edx
pop edx
call fcn.010d0fec
not ecx
mov dword [edi], ecx
call fcn.01139be4
syscall
call fcn.01127f5c
mov edx, 0x539d9716
mov eax, 0xc30a83ab
movzx esi, dl
mov esp, ebp
pop ebx
pop edi
sal edx, 0xac
not ax
pop eax
pop ebp
mov ecx, edx
js 0xc4e011

Function at 0x1087004
Capabilities:
Encrypt data using speck

Disassembly:
movzx edx, byte [edi + ecx - 0x4853e]
dec cx
or ecx, ecx
mov dword [esp + ecx - 0x4853d], ecx
xor dl, bl
ror ecx, cl
neg dl
jmp 0x109ec63

Function at 0x10a423f
Capabilities:
Encode data using xor

Disassembly:
jno 0x11432f0
add al, 0x84
invalid
call fcn.0115e1fd
mov dx, word [ebp]
mov di, word [ebp + 2]
add ebp, 2
push 0x9598dc0e
not dx
shr word [esp + 2], 0x21
not di
or dx, di
jmp 0xc9ec6c
mov dword [esp], 0x7542958a
call fcn.010b97de
inc ecx
mov ebp, 0xf6bdbf84
inc ebp
or ch, ch
inc ebp
mov ebp, dword [ebx + 4]
call fcn.01093ce7
mov ecx, dword [ebp]
mov esi, 0xb3bdc7a4
shr si, 0xa6
mov si, word [ebp + 4]
jne 0xc545c4
add ebp, edx
call fcn.01088b94
mov esi, 0xc123e837
not esi
lea edi, [esi + edi - 0x3edc17cc]
call fcn.010a2297
mov ecx, 0x4c99343e
mov ecx, dword [ecx + ebp - 0x4c99343e]
mov edx, 0x31a12d34
rol dl, 0x61
mov dx, word [ebp + edx*2 - 0x63425acc]
jae 0xc4bd1a
adc ebp, 6
jmp 0x114cf05
jmp 0x10f9c0d
Function at 0x10b8ccd
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, 0xce8ed501
bswap eax
mov eax, dword [ebp + eax - 0x1d58ece]
jmp 0x10e3e21
lea esp, [esp + 8]
je 0xc870a1
mov eax, dword [ebp + ebx*4]
call 0x1091215
push 0xab08313f
adc eax, edx
mov dword [ebp - 4], eax
dec dword [esp]
ror byte [esp + 2], 0x85
test ebx, ebx
push 0x188cc630
jmp 0xc97b80
mov dword [esp + ebp*4 - 0x521b1400], ebx
mov ebp, edi
mov ebx, edx
dec dl
not ebx
mov ebx, eax
mov edx, ebx
mov eax, 0x833c4d31
shl eax, 0x15
shl edx, 2
sar al, 0x21
xor eax, eax
dec al
mov eax, ebp
jne 0x10991e9
push 0x34104a04
lea esp, [esp + 4]
call eax
push 0xf9a4a48d
not dword [esp]
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov ebx, dword [esp]
mov edi, ebp
mov ebx, dword [esp + ebx*2 - 0xcb6b6e0]
mov ebp, dword [esp + 8]
jmp 0xc33893

Function at 0x10bc7e6
Capabilities:
Encode data using xor

Disassembly:
sar edi, 0xb
xor al, bl
add al, 0x8d
ror al, 1
pop edi
not al
xor al, 0x17
xor bl, al
add eax, esp
movzx di, byte [eax]
jmp 0x115fbf9
test byte [ebx], bl
sar byte [ebp - 0x1c1e3856], 1
push edi
invalid
mov dword [esp], 0x9bb4b1ab
adc ebp, 1
inc dword [esp]
js 0x1095f4b
xor dword [edx - 0x20], ecx
xchg esp, eax
salc
and esi, dword [edx + 0x66287f53]
jb 0x10bc799
jno 0x10bc797
sbb dword [ecx - 0x110b570e], ebx
jnp 0x10bc85d
mov edi, 0x5a46e89f
xor byte [0x7631d164], 0x48
xor al, 0x4e
jecxz 0x10bc818
pop eax
mov ah, byte [edx - 0x46]
movsb byte es:[edi], byte [esi]
add byte [eax], al
add byte [eax], dl
mov dword [0xa4ba830c], eax
movsb byte es:[edi], byte [esi]
add byte [eax], al
add byte [ecx + 0x57], ah
popal
push edi
xchg ecx, eax
jb 0x10bc830
stosd dword es:[edi], eax
cdq
stosb byte es:[edi], al
or ah, bl
mov bl, 0x39
xor bl, cl
adc ebx, edi
xor al, 0xbd
cdq
mov ecx, 0xe642cb44
pop ds
adc al, 0x10
imul ebp, dword [edi - 0x3e], 0xffffffb5
or bl, 0x42
jecxz 0x10bc834
retf
shr byte [edx + ecx], 1
hlt
insd dword es:[edi], dx
int1
inc ebx
out 0xc2, al
cmp dword [edx + ebp - 0x21], 0xfffffffa
cmp dword [esp + eax], ebx
mov byte [0x2e000000], al
add eax, 0xccefb036
dec esi
or bl, byte [eax]
mov ebp, 0x3b8150c
jnp 0x10bc849
outsd dx, dword [esi]
fisttp qword [ecx - 0x76503050]
mov ebp, dword [edi]
lahf
imul eax, dword [edx + 0x59736512], 0xffffffc2
lodsd eax, dword [esi]
sbb dword [eax + 0x599b310f], edx
dec eax
cld
cmp eax, 0x9d5d9ff0
pop ecx
rcl al, 0x59
salc
cmp al, 0x34
mov ebp, 0x6c75e999
mov ebx, 0xc23b694a
nop
cmp bh, ch
leave
salc
retf 0xeb6a