joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3df3b
Capabilities:
Encrypt data using speck

Disassembly:
mov byte [esp + 0xc], dh
jmp 0x3fea2
push dword [esp + 0xc]
mov dword [esp + 0x24], edx
pushal
mov dword [esp + 0x40], eax
jmp 0x353f2
lea esp, [esp + 8]
jno 0x49360
je 0x29a00
pushal
bswap dx
push ebx
setns dh
lea edx, [ebp - 0x10]
pushal
push dword [esp]
mov byte [esp], cl
mov dword [esp + 0x44], edx
pushfd
mov dword [esp + 0x44], eax
push 0x14bea091
call fcn.00038910
je 0x29a00
pushfd
not dh
lea edx, [ebp - 0x10]
pushal
jmp 0x3ab58
jmp 0x3e4e0

Function at 0x3e22c
Capabilities:
Encrypt data using speck

Disassembly:
pushal
pushfd
call fcn.0003da11
mov byte [esp], bh
lea esp, [esp + 0x10]
je 0x477c7
movzx ax, al
mov eax, dword [ebp - 0xc]
push 0x9387febd
test sp, di
test si, 0x726c
test eax, eax
pushfd
push 0xd964391
lea esp, [esp + 0xc]
je 0x477c7
movsx dx, cl
not edx
lea edx, [ebp - 0x10]
pushfd
pushal
mov dword [esp + 0x20], edx
jmp 0x2de6d

Function at 0x3e47a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
pushfd
mov word [esp], 0xf808
mov dword [esp + 0x48], edi
push esp
mov dword [esp + 4], ebp
mov byte [esp + 0x18], 0x46
lea esp, [esp + 0x4c]
call sub.ntoskrnl.exe_memcpy
stc
bsr ax, di
xor dl, 0x35
neg dl
add esp, 0x18
rdtsc
rdtsc
mov edx, 0xc8bf017
movsx ax, dl
mov edx, dword [0x22440]
push eax
cwde
mov eax, dword [edx + ebx*8 + 8]
pushal
lea esp, [esp + 0x24]
jmp 0x3073f

Function at 0x3e59a
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
je 0x3d741
inc cl
call fcn.00044ee7
push 0x93a7104b
lea edx, [ebp - 4]
lea esp, [esp + 4]
movsx ax, al
call fcn.00045a2b
mov cl, byte [eax]
push dword [esp]
pushfd
inc eax
stc
test cl, cl
call fcn.000161c9
sub eax, edx
bswap bx
push 0x5e5747bc
jmp 0x3fd8b
mov cl, byte [eax]
jmp 0x3f016
not cl
pushfd
mov cl, byte [esp]
jmp 0x2ecb0
dec esi
bswap dx
mov edx, dword [0x22448]
push 0x26ca24f9
mov eax, dword [edx + esi*8 + 4]
mov word [esp + 4], 0x8f88
mov byte [esp + 4], 0xfe
movzx dx, al
inc dl
lea edx, [eax + 1]
mov cl, 0xc6
dec cl
jmp 0x3a6d7
pushal
push dword [esp + 0xc]
inc eax
bt ax, 1
cmc
push 0xf908a002
test cl, cl
jmp 0x42dcf
bswap bx
mov ebx, eax
mov word [esp], 0xf073
call fcn.00028668
lea esp, [esp + 0x28]
jl 0x274f2
xchg edx, eax
add ecx, dword [0x223a4]
movzx dx, cl
rdtsc
mov dword [ebp - 4], ecx
pushal
jmp 0x49939
lea esp, [esp + 0x30]
jne 0x1592c
lea ebx, [ecx + 0x19e3c9b]
jmp 0x3a20e
jmp 0x40a54
call fcn.0002a835

Function at 0x3f2c5
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], eax
pushfd
mov dword [esp], 0
call fcn.0003017c
mov byte [esp], ch
mov word [esp], 0xe4eb
jmp 0x3753f

Function at 0x3f55c
Capabilities:
Encrypt data using speck

Disassembly:
cmp esp, ecx
cmc
push ebp
add esp, 0x14
pushal
clc
cmp ax, 0xd2f3
test eax, eax
mov byte [esp + 8], ah
jmp 0x47581
mov dword [esp + 8], esi
mov byte [esp], 0xa9
pushal
lea esp, [esp + 0x28]
call sub.ntoskrnl.exe_memcpy
btr ax, bx
pushfd
mov eax, dword [0x22428]
jmp 0x2dd4f
pushfd
lea esp, [esp + 0x24]
je 0x3ca73
pushal
push ecx
push ebx
mov dword [esp + 0x24], 0
pushfd
push ebx
pushfd
mov dword [esp + 0x2c], eax
pushfd
mov dword [esp + 0x2c], 0x2fe1f
jmp 0x2c9e8
Function at 0x3f589
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x24]
je 0x274f2
call fcn.0002dee8
cmc
test byte [eax + 3], 0xf
call fcn.0004a18e
lea esp, [esp + 0x28]
call fcn.00016b80
ror cl, 7
cmp cl, 0xe5
mov ecx, dword [ebp - 4]
push 0xae1fb657
stc
cmc
test esp, 0x693fe463
test ecx, ecx
pushal
jmp 0x2e68a

Function at 0x403d5
Capabilities:
Encrypt data using speck

Disassembly:
push esp
mov dword [esp + 0x34], str.IoFreeWorkItem
push 0x81d5ebbd
pushfd
pushfd
pushfd
lea esp, [esp + 0x44]
call fcn.00016b80
cmc
mov ecx, dword [ebp - 4]
bt sp, cx
push edx
test ecx, ecx
mov byte [esp], ch
pushal
pushal
pushfd
lea esp, [esp + 0x48]
je 0x274f2
pushal
bt dx, 5
test eax, eax
call fcn.0002b3fb
push esp
add eax, 0xc350
cmc
cmp dl, 0xdb
clc
call fcn.0003336a

Function at 0x4049e
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x28]
jb 0x2f300
push ecx
pushal
lea esp, [esp + 0x24]
jmp fcn.00037845

Function at 0x41bdc
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
cmp eax, dword [0x2241c]
jmp loc.00017844

Function at 0x426c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x3880c
call fcn.0002eac7
jmp 0x25c3e

Function at 0x42e40
Capabilities:
Encrypt data using speck

Disassembly:
push eax
pushfd
mov dword [esp + 0xc], eax
pushal
mov dword [esp + 0x28], 0x4c3e6
call fcn.0003f44b
stc
test eax, eax
pushfd
lea esp, [esp + 4]
jl 0x11872

Function at 0x42f02
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xae06c381
mov byte [esp], 0x2f
mov byte [esp], 0xba
lea esp, [esp + 4]
jne 0x253f7
cmp dx, di
call fcn.00046773
pushfd
cmc
test cl, cl
push dword [esp]
lea esp, [esp + 0x14]
jo 0x14ada
push ebx
push 0x2498b22a
lea esp, [esp + 8]
jne 0x253f7
cmc
pushfd
sub eax, edx
push ebx
pushal
mov dword [esp + 0x24], eax
call fcn.0004ac4d

Function at 0x42fe8
Capabilities:
Encrypt data using speck

Disassembly:
mov byte [esp], 0x3d
mov byte [esp + 4], 0xf5
pushal
lea esp, [esp + 0x28]
je 0x44a7a
bswap dx
call fcn.000386ca
test eax, eax
jmp 0x31a4f

Function at 0x4361d
Capabilities:
Encrypt data using speck

Disassembly:
pushfd
lea esp, [esp + 4]
jae 0x26ea9
pushal
mov dl, byte [ecx]
pushfd
pushfd
pushfd
inc ecx
cmc
clc
test dl, cl
cmc
test dl, dl
jmp loc.0002cc01
mov dword [esp + 0x20], 0
pushfd
mov dword [esp + 0x20], 0x2c890
mov word [esp + 4], si
mov word [esp + 0x10], 0xc698
pushal
push ecx
push dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
pop dword [esp + 0x40]
push 0xe86aa16d
push 0x3b94fe1f
push dword [esp + 0x48]
ret 0x4c
sub ecx, esi
jmp 0x2de44
call fcn.000466ec
mov dh, 0xb1
xchg ch, dh
mov ecx, dword [eax + esi*8 + 4]
pushfd
push dword [esp]
not dl
mov edx, dword [ebp - 4]
push dword [esp + 4]
pushfd
mov dword [esp + 0xc], ebx
pushal
mov byte [esp], dh
jmp 0x42c67
mov dword [esp + 0x28], ecx
pushfd
call fcn.0002b76c
pushal
push dword [esp]
jmp 0x28bf8
pushfd
pushfd
lea esp, [esp + 0x44]
jne 0x15559
test cl, ch
jmp 0x292a6

Function at 0x43f5e
Capabilities:
Reference http user-agent string

Disassembly:
pushfd
lea esp, [esp + 0x10]
je 0x3d977
push ebp
call fcn.000454d2
Function at 0x43f6f
Capabilities:
Reference http user-agent string

Disassembly:
lea esp, [esp + 0x40]
jb 0x2a64b
movsx eax, dl
lahf
dec ebx
cdq
mov ecx, dword [0x22440]
not ax
mov eax, dword [ecx + ebx*8 + 4]
pushfd
bswap edx
not cl
mov byte [esp], bl
lea edx, [eax + 1]
pushal
inc cl
mov byte [esp + 4], 0xc3
mov cl, byte [eax]
jmp loc.000112c8
cwde
pushfd
mov eax, dword [ebp + 0x10]
not ch
setnp ch
not ch
movsx cx, dl
mov ecx, dword [ebp + 0x14]
pushfd
push ecx
mov dword [esp], ebp
mov dword [esp + 0xc], eax
pushfd
mov dword [esp + 0xc], ecx
pushal
push dword [esp]
mov dword [esp + 0x2c], str.GET__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nUser_Agent:Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.1__r_n_r_n
call fcn.00029160
pushfd
lea esp, [esp + 0x2c]
call sub.ntoskrnl.exe_rand
xor bx, 0xd10e
movzx bx, dl
mov ebx, eax
pushal
cmc
and ebx, esi
pushal
jmp 0x4b247
clc
cmp ebx, esi
jmp 0x327ce

Function at 0x449cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xb589d84b
call fcn.00049b20
lea esp, [esp + 8]
jne 0x49fa8
cmp ax, 0x6fb3
bt si, si
sub ecx, 4
bt ebp, edx
add eax, 4
test bl, dh
push 0x2e19f02d
jmp loc.0001170e
push esi
push 0xae68d7c9
push 0x441fa801
mov dword [esp + 4], edi
jmp 0x29a5c
pushfd
mov dword [esp], 8
jmp 0x49591

Function at 0x44a9e
Capabilities:
Encrypt data using speck

Disassembly:
pushfd
mov dword [esp + 0x1c], ecx
pushfd
mov dword [esp + 0x1c], str.IoFreeWorkItem
push dword [esp]
pushfd
jmp 0x314ff
shr al, 7
add ecx, dword [0x223a4]
not ah
mov dword [ebp - 4], ecx
lahf
pop eax
mov dword [0x223d0], ecx
mov al, 0xe3
lea eax, [ebp - 4]
jo 0x49654
pushal
mov dword [esp + 0x1c], eax
mov dword [esp], esp
lea ecx, [ebp - 0x10]
jmp 0x3700e
movsx cx, bl
push eax
pushal
mov byte [esp + 0xc], al
not cx
movzx cx, dl
lea ecx, [ebp - 0x10]
push eax
mov dword [esp + 0x20], ecx
jmp 0x45ba8

Function at 0x44d82
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x10]
jne 0x3db97
push 0xfad76a33
sub eax, edx
pushal
jmp 0x3ac29
call fcn.0002dbca
jmp 0x2a622

Function at 0x45995
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x38]
je 0x3d56e
push 0x2443ae50
cmc
aas
mov eax, dword [0x2244c]
pushal
mov word [esp], 0xbb77
cmp eax, esi
mov byte [esp + 4], ah
lea esp, [esp + 0x24]
je 0x11537
pushal
jmp 0x4c4a2
jmp 0x27152

Function at 0x45b56
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
pushfd
lea eax, [ebp - 0x10]
pushfd
pushfd
mov dword [esp + 8], eax
pushal
mov word [esp + 0xc], sp
pushfd
mov byte [esp + 4], 0x28
mov dword [esp + 0x28], str.IoAllocateWorkItem
push ebx
lea esp, [esp + 0x2c]
call fcn.00016b80
ror ecx, 9
mov ecx, dword [ebp - 4]
pushal
test ecx, ecx
pushal
call fcn.00028663
lea esp, [esp + 0xc]
jl 0x11872
setg al
lea eax, [edi - 0x5fddcfbc]
pushfd
pop edx
lea edx, [ebp - 4]
lahf
cwde
lea eax, [edi*8 - 0x5b735834]
jmp 0x36e7c

Function at 0x46052
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0xc]
jl 0x2fc3d
cwde
call fcn.00044a9e
Function at 0x464a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [eax]
push 0xb78ee170
pushfd
lea esp, [esp + 0x10]
call sub.ntoskrnl.exe_rand
inc bx
rol bh, 6
shld bx, bp, cl
mov ebx, eax
test ch, 0xcd
jmp 0x36210

Function at 0x4662c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0
call fcn.0004bb1f

Function at 0x466f5
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [0x223d0], ecx
movzx cx, dl
cwde
lea eax, [ebp - 4]
movzx cx, dl
mov cx, word [esp]
mov dword [esp + 8], eax
pushal
lea ecx, [ebp - 0x10]
call fcn.0003638b

Function at 0x4695f
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.0004784c
lea esp, [esp + 0x28]
je 0x2fc3d
clc
test eax, eax
pushfd
call fcn.00040f15

Function at 0x46b4b
Capabilities:
Encrypt data using speck

Disassembly:
pushal
jmp 0x3ec02
mov dword [esp + 0x40], ecx
push 0x5389617
mov dword [esp + 0x40], eax
lea esp, [esp + 0x40]
jne 0x2b628
push ebp
lea esp, [esp + 4]
call fcn.00017ad0
call fcn.0003c649
pushfd
lea esp, [esp + 0x28]
je 0x26d10
pushfd
mov byte [esp], dh
pushal
push dword [esp]
lea esp, [esp + 0x28]
jmp 0x4bba6
pushfd
pushal
lea esp, [esp + 0x24]
call fcn.00017ad0
pushal
lea esp, [esp + 0x20]
call fcn.0001f180
cmp cl, 0xd8
stc
add eax, dword [0x226ac]
stc
push 0x723a52fa
mov dword [ebp - 0x30], eax
stc
clc
cmc
cmp dword [0x22464], 0
pushal
mov byte [esp + 4], dh
push ecx
lea esp, [esp + 0x28]
je 0x3ec26
cmc
stc
clc
stc
cmp word [0x22468], 0
pushal
mov word [esp], 0x40ac
mov word [esp + 8], 0x5f02
pushal
lea esp, [esp + 0x40]
je 0x3ec26
jmp 0x4bea3
add eax, 0x36ee80
push edx
pushal
push ebx
mov byte [esp + 4], 0x8c
lea esp, [esp + 0x28]
jmp 0x3ec15
lea esp, [esp + 4]
call fcn.0001adf0
jmp 0x35b9a
bt di, cx
bt dx, cx
pushfd
test eax, eax
mov word [esp], 0x18ee
pushal
jmp 0x2887c
pushal
push 0x3d830d71
mov dword [esp + 0x44], ebx
jmp 0x26cef
call fcn.00014750
jmp 0x4223e
not dl
lea edx, [edx*2 - 0x1fe90b3d]
pushal
mov dword [ebp - 0x28], eax
lea esp, [esp + 0x20]
push edi
movzx cx, al
rcl ecx, 5
pushal
rol si, 8
pushfd
movzx ecx, si
jmp 0x36691
pushfd
test al, al
call fcn.000158bb
mov dword [0x223c4], edi
pushfd
call fcn.000469d7
call fcn.0003c24d
mov esp, ebp
lea ebp, [ecx + 0x7b24e39c]
lea ebp, [ebp - 0x367ac58e]
bswap bp
movsx bp, dl
pop ebp
pushfd
mov word [esp], ax
pushfd
push 0x3596c1ea
push dword [esp + 0xc]
ret 0x28
pushfd
lea esp, [esp + 4]
jb 0x3ec26
jmp 0x39ad1
mov dword [esp + 4], eax
jmp 0x348d2
movsx ecx, dl
not ecx
push 0
not ch
bts cx, 4
jmp 0x4143e
call fcn.0001f180
push ecx
clc
stc
cmc
cmp eax, dword [ebp - 0x28]
lea esp, [esp + 4]
jge 0x45f42
jb 0x3ec26
pushfd
lea esp, [esp + 4]
call fcn.00014750
pushfd
stc
test al, al
pushal
mov byte [esp], dh
pushal
pushfd
lea esp, [esp + 0x48]
je 0x140b0
pushal
lea esp, [esp + 0x20]
call fcn.0001f180
jmp 0x2d0de
Function at 0x46d07
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 0x1c], eax
lea esp, [esp + 0x1c]
jo 0x3706e
push edi
jmp 0x37af4
push 0x698171e0
push 0x3777938
jmp 0x2b009
pushal
lea esp, [esp + 0x20]
call fcn.00018c80
cmc
call fcn.0002842f
test eax, eax
mov word [esp], sp
mov byte [esp], bl
pushfd
push edi
lea esp, [esp + 0xc]
jl 0x2fc3d
bsf ax, dx
sar ah, 1
aaa
add ecx, dword [0x223a4]
mov ah, 0x57
push esi
mov dword [ebp - 4], ecx
push 0x9fb5a66b
call fcn.0001bb89
jmp 0x2d7b6

Function at 0x46fa2
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov word [esp], 0xa5d1
lea esp, [esp + 0x2c]
call fcn.0001e970
cmc
jmp 0x2ce24
pushfd
not eax
pushal
clc
mov dword [ebp - 0x18], eax
push dword [esp + 4]
jmp 0x3dac1
cmp dword [0x226f4], eax
call fcn.00028915
pushal
mov ecx, dword [eax + ebx*8 + 4]
push 0xe146101c
mov dword [esp + 0x28], edx
push 0xf9a377f4
push 0xee5474cc
mov dword [esp + 0x2c], ecx
mov byte [esp], bl
mov word [esp], dx
mov dword [esp + 0x28], edi
pushfd
jmp 0x469e1
jmp 0x376db
jmp 0x294cd

Function at 0x47aaf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
jmp 0x4665f
mov dword [esp + 0x28], edx
jmp loc.00014ca2
mov dword [esp + 0x24], ecx
jmp 0x42b75

Function at 0x48053
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x2c]
call fcn.0001e930
pushal
pushfd
lea eax, [ebp - 8]
pushal
bswap cx
call fcn.00049339
push edi
push dword [esp + 8]
mov dword [0x223e0], eax
jmp 0x3f3e6
mov dword [esp + 0x2c], 0x22068
jmp 0x46354

Function at 0x48362
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 4], 0xa1
push edx
lea esp, [esp + 0x14]
jae 0x2f247
pushal
push ebp
pushfd
lea esp, [esp + 0x28]
jmp fcn.00049b29
mov byte [esp + 8], 0xf0
sub esi, esi
cmp dh, 0xc3
stc
clc
mov dword [esp + 4], edi
cmp eax, esi
call fcn.0003fe5b
jmp 0x4033a

Function at 0x48402
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 0x40], esi
jmp 0x48ba6

Function at 0x48518
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 0x28], esi
pushfd
lea esp, [esp + 0x2c]
call fcn.00014430
jmp 0x2c28b
call fcn.00015fec
mov byte [esp + 4], 0xc7
call fcn.0002515b
pushfd
jmp 0x26491

Function at 0x48a87
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x26585
add esp, 4
jnp 0x3cfc1
clc
cmc
cmp edi, 1
call fcn.0002e9a9

Function at 0x48ab3
Capabilities:
Complete processing asynchronous io request

Disassembly:
lea esp, [esp + 8]
call fcn.00013e60
push eax
mov byte [esp], al
lea esp, [esp + 4]
jmp fcn.000140f9
mov dword [esp + 4], str.REGISTRYMACHINESYSTEMCurrentControlSetControlSession_Manager
pushfd
jmp 0x2bbf6

Function at 0x492ff
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0x258cf
jmp 0x2dc8e
test cl, cl
push 0x46dc1d28
jmp 0x27375
Function at 0x4937f
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x27097
jb 0x40f10
push 0x6562515a
cmp eax, 0x58
pushal
lea esp, [esp + 0x24]
jb 0x40f10
push esp
pushfd
mov dword [esp + 4], ecx
movzx dx, al
movsx dx, al
call fcn.0002754b
push dword [esp + 0xc]
mov dword [ebp - 0x10], 0
mov dword [esp], ecx
lea esp, [esp + 0x50]
call fcn.00014de0
bt bp, dx
mov ebx, eax
push edx
test ebx, ebx
pushfd
pushal
push esi
lea esp, [esp + 0x2c]
je 0x45976
sar dx, 0xa
bts dx, di
bts dx, cx
not edx
mov edx, dword [ebp - 0x34]
pushfd
test cl, dl
test cl, dh
pushal
mov dword [ebp - 0x10], edx
cmc
cmp edx, 0x58
lea esp, [esp + 0x24]
jp 0x44eec
jb 0x40f10
shrd ax, si, 4
btr cx, 2
clc
btc esi, ebp
mov ecx, dword [ebx + 4]
btc eax, eax
mov eax, dword [ebx]
stc
rol esi, cl
lea esi, [eax + ecx]
clc
stc
bt ecx, edx
cmp edx, esi
jmp 0x26d63
lea esp, [esp + 0x24]
je 0x373ab
pushfd
pushal
call fcn.0002ce95
stc
pushal
sub eax, edx
call fcn.00030555
jb 0x40f10
lahf
push 0x6b49f526
pushal
clc
mov ecx, dword [ebx + 4]
stc
sbb si, 0x4384
das
shr ah, 3
mov eax, dword [ebx]
cmp cl, 0
inc si
lea esi, [eax + ecx]
test dh, 0x4e
cmp dh, ch
test esp, 0xb5f28816
cmp edx, esi
call fcn.0004a764
jmp 0x43ec8
cmp ecx, 0x24045d86
pushfd
stc
cmp byte [ebp - 1], 0
pushal
jmp 0x3d4dc
jmp 0x34a7a

Function at 0x49416
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 8]
jl 0x2fc3d
bsf ax, dx
cmp dh, dh
add ecx, dword [0x223a4]
call fcn.0003a5cd
jmp 0x3bd6a

Function at 0x497f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
call fcn.0003210d
mov dword [esp + 8], 0xe67cb8ee
lea esp, [esp + 0x3c]
call fcn.000153f0
push esi
pushfd
pushal
pushfd
lea esp, [esp + 0x2c]
jmp fcn.00046483
pushfd
pushal
lea esp, [esp + 0x2c]
jae 0x17c82
movsx cx, al
lea ecx, [ebx - 0x78799089]
seta dh
mov ecx, dword [eax]
lea edx, [ecx*8 + 0x57b697e6]
pushal
mov edx, dword [ebp + 0x18]
mov dword [esp], 0x22864cb8
lea esp, [esp + 0x20]
jg 0x2ad17
pushal
mov dword [edx], ecx
lea esp, [esp + 0x20]

Function at 0x49c24
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x18], eax
pushal
jmp 0x2eb82

Function at 0x4b692
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x20]
call fcn.00016b80
rcr ch, cl
shr ch, cl
sub cx, 0xe9ef
not ch
mov ecx, dword [ebp - 4]
push esp
test ecx, ecx
jmp 0x3738f

Function at 0x4b8dd
Capabilities:
Encrypt data using speck

Disassembly:
cmp esi, edi
mov dword [esp + 4], ebx
lea esp, [esp + 0x28]
jb 0x15908
call fcn.0003e59a

Function at 0x4b8f2
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x42511
pushal
push dword [esp]
lea esp, [esp + 0x30]
je 0x29a00
clc
mov eax, dword [ebp - 0xc]
pushal
pushal
test al, ah
cmc
test eax, eax
jmp 0x46c76

Function at 0x4bb1f
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.000419e3
push 1
test ebx, 0xb0a7a059
cmc
stc
clc
push 0x22700
jmp loc.00015853
Function at 0x402262
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a2c4]
jne 0x40226c
repz ret
jmp fcn.004028b1

Function at 0x404a1b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a2c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403975
and dword [ebp - 0x14], 0
cmp dword [0x40ba6c], 0
mov dword [ebp - 0x18], eax
jne 0x404ace
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404b76
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x407cfc
push ebx
call edi
test eax, eax
je 0x404b76
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40ba6c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40ba70], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40ba74], eax
call edi
push eax
call esi
mov dword [0x40ba7c], eax
test eax, eax
je 0x404ace
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40ba78], eax
mov eax, dword [0x40ba78]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404b27
cmp dword [0x40ba7c], ecx
je 0x404b27
push eax
call esi
push dword [0x40ba7c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404b27
test ebx, ebx
je 0x404b27
call edi
test eax, eax
je 0x404b1e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404b1e
test byte [ebp - 8], 1
jne 0x404b27
or dword [ebp + 0x10], 0x200000
jmp 0x404b5a
mov eax, dword [0x40ba70]
cmp eax, dword [ebp - 0x18]
je 0x404b5a
push eax
call esi
test eax, eax
je 0x404b5a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404b5a
mov eax, dword [0x40ba74]
cmp eax, dword [ebp - 0x18]
je 0x404b5a
push eax
call esi
test eax, eax
je 0x404b5a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40ba6c]
call esi
test eax, eax
je 0x404b76
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404b78
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402262
leave
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0xd7a7397
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x19e2454a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4269b9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4269f8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4269f8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4269f8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4269f8
cmp dword [ecx + 0x74], 0xe
jbe 0x4269f8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438da0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438dcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438dcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x282cb8c
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
je 0x15d1f10
cmp bl, bh
dec esi
mov esi, dword [eax + 0x3c]
pushal
call fcn.028260d9
frstor dword [edx - 0x4addbad7]
xor byte [edi + 0x3bac7b8d], ah
mov dl, byte [0xf37bacab]
mov byte [0xaa94abca], al
mov eax, 0x3c67a1e7
sub ebp, ebp
dec edx
popfd
aam 0xd1
stosd dword es:[edi], eax
xor eax, 0x75df4fcc
sti
pop ss
adc cl, cl
jle 0x282cbf7
imul ebp, dword [ecx], 0xbc4fda23
pop esp
int 0x41
xchg edx, eax
retf 0x8291
out 0x90, eax
les ebx, [ebx + 0x3d2a9a9d]
pop ds
adc byte [eax], ah
not dword [ebp + 0x66]
sbb dword [esi + 0x10], 0x639f99d6
lodsb al, byte [esi]
mov ebx, 0xaf719517
mov esi, 0x497ce7e1
and dword [ebx + ecx*2 + 0x55177d22], esp
and bh, byte [ebp + 0x17]
push ebp
adc al, 0x1b
xor eax, 0xb907b95b
add ebp, esp
jl 0x282cc21
int1
fstp dword [ebx]
sal dword [ebx + edi*8 + 0x5e517cbd], 0x23
push ecx
call 0x288935ba
or dword [eax + 0x2f], esi
or dword es:[eax + 0x2f], esi
inc esi
push ecx
fsubr qword [ebx - 0x12]
jno 0x282cc4c
jg 0x282cc1a
jle 0x282cc3a
sal dword [ebp + edi*4 + 0x6ddc8bd2], cl
pop esi
popfd
ror byte [ebx - 0x62a19224], cl
mov edx, 0x66b1cc6b
jecxz 0x282cc7d
add dword [edx - 0x7733ed83], ebx
xchg esp, eax
push ecx
xchg edi, eax
sub byte [ecx], dl
mov dl, 0xc4
loopne 0x282ccb7
adc dword [esi], esp
les ebp, [edx - 0x6298e87a]
dec esp
pop eax
out dx, eax
xchg ecx, eax
invalid
push eax
cmp byte [edi - 0x4659598f], 0x2f
inc eax
and al, 0x1b
dec ebp
cli
inc ebx
or al, 0x21
sub al, 0x2a
fisttp qword [edi]
sbb eax, dword [edi + edi*8 - 0x7f]
fstpnce st(1), st(0)
in eax, dx
movntps xmmword [edx + edi*4], xmm4
inc ecx
pop esi
inc esp
invalid
inc ebp
jbe 0x282cd1d
xlatb
js 0x282cc3f
daa
or byte [esi - 0x69aa51b], bl
sahf
xor al, 0x4f
invalid
jmp 0xeadac376