joyce8/EMBER2024-capa huggingface dataset:
Function at 0x134c85c
Capabilities:
Encrypt data using speck

Disassembly:
lea eax, [eax + edx*8 - 0x2832abdf]
shr dx, 0xc4
jp 0x17c9bcd
shl cl, 0xa7
xor edx, ebx
shl word [esp + ecx - 0x6ea362f6], 0x8b
rol edx, 1
sar cx, 0xac
dec cx
lea edx, [ecx + edx + 0x34643129]
mov eax, 0xd81fc592
ror edx, 1
inc edx
not edx
shl ecx, 0x73
xor ebx, edx
add edi, edx
mov dword [esp + ecx - 0x280000], edi
ret 0xc
rol dl, 1
jmp 0x13163fc
mov ecx, 0x3837cc2b
lea edx, [ecx*2 - 0x706dee71]
movzx edx, byte [ecx + esi - 0x3837cc2b]
xor dl, bl
sub dl, 0x8a
jmp 0x124a13d
mov eax, 0x3f023e93
add dl, 0x2f
xor ecx, 0xd437d80e
dec al
not dl
bswap ecx
xchg cx, ax
rol dl, 1
push ecx
xor bl, dl
lea edx, [esp + edx + 4]
ror word [esp + ecx*2 - 0x4a287d23], 2
jae 0x17874f3
and ax, 0x7aa9
mov cx, word [edx + ecx - 0x25143e92]
xor dword [esp + eax*2 - 0x7e040150], eax
rol dword [esp + eax*2 - 0x7e040150], 0x9f
lea ebp, [eax + ebp - 0x3f0200aa]
sete byte [esp + eax - 0x3f0200a8]
not word [esp + eax - 0x3f0200a8]
jns 0x136f150
dec esp
mov dword [esp + ebp - 0x8c], ebp
inc ecx
inc edx
dec ecx
bswap eax
inc ecx
xor edx, 0x96942a01
or edx, dword [esp + ebp*2 - 0x114]
pop ebp
dec eax
lea ebx, [ebp*4 + 0x7e3cf0b3]
inc esp
xor edx, edi
inc cx
nop
inc ecx
inc ch
inc ecx
rol edx, 2
inc esp
mov esi, ecx
inc ecx
bswap eax
shr bx, 0x6d
inc esi
lea edx, [edx + edx - 0x664a02d4]
dec esp
lea esp, [edi + edi*4 + 0x32981483]
sal bp, 0x8a
inc esp
xchg ebp, esp
inc esp
xor edx, edi
inc ecx
push ebx
inc esp
xor dword [esp + ebp*2 - 0x653028fc], edx
inc ecx
pop ebx
dec ecx
bswap esp
dec ebp
arpl dx, dx
inc ecx
shr al, 0xa7
je 0x17cc739
sub esi, 1
jmp 0x130a4c7
mov word [ebp + eax*2 - 0x7e040150], cx
movzx edx, ax
mov ecx, dword [esp + eax*2 - 0x7e040150]
lea esi, [esi + eax - 0x3f0200ac]
lea eax, [ecx + ecx - 0x1ca12fb]
mov eax, dword [esi + eax - 0x18bcdf03]
mov byte [esp + edx - 0xa5], cl
xor eax, ebx
not eax
or ecx, 0x48a51c34
shr cl, 0x24
jne 0x122ac3c
xor eax, 0x7580b700
neg edx
call fcn.0131a2f5
dec ecx
adc esi, edx
inc ax
inc ecx
rol esp, 0x7d
dec esp
adc esp, esi
inc ecx
jmp esp

Function at 0x13540cb
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea edi, [edi + ebp*2 - 0x2a100774]
inc ecx
push ebp
call fcn.01331946
inc eax
rol ecx, 0xe
dec esp
lea edx, [ecx*2 + 0x4bae5039]
dec esp
lea edx, [edx*8 + 0x4605df01]
rol eax, 3
dec ebp
xchg eax, esp
and cx, 0xb883
inc ecx
xchg ah, cl
bswap eax
inc ecx
movsx ebx, ax
inc ecx
shr ah, 0xe1
inc ecx
shl esi, cl
lea eax, [eax + ecx - 0x36c4b28a]
inc esp
xor al, dl
not eax
inc ecx
movzx edi, ah
inc ecx
setge dl
inc ecx
push ebx
xor dword [esp + edx + 0x2ab1a5a2], eax
inc ecx
pop ebx
inc cx
xchg esi, edi
inc ecx
movsx ebp, ax
inc ecx
shl dl, cl
dec eax
arpl ax, ax
call int.0132a2d6
Function at 0x1376c38
Capabilities:
Encode data using xor

Disassembly:
loope 0x1376c9a
js 0x1376c7c
push ss
lds esi, [esi]
shr dword [ecx], 0xf8
add eax, dword [ecx + 3]
inc ecx
add edx, dword [edi + edx*2]
call fcn.01328782
xor esi, 0x469b3987
jb fcn.01376c38
mov esi, dword [esp + esi + 0x59d13685]
mov dword [esp + 0x10], 0xf8cd3149
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.013920f9
jo 0x1376c23
push 0xe1230bd8
cdq
invalid
pop ecx
xchg ebx, eax
stosd dword es:[edi], eax
pop esi
add eax, 0x8bd99bf9
jbe 0x1376c29
pop ebx
sub ebx, dword [edx - 0x56e4f2eb]
stosd dword es:[edi], eax
jge 0x1376cce
xor ebp, esi
dec esi
mov dword [0xf108dfb1], eax
mov cl, 0xdf
or cl, dh
pushal
mov dword [0x44205f4a], eax
ror bl, 0x42
retf 0xc638
shr dword [edi + 0x46], 1
add eax, 0x796dd954
into
cmp dword [ebp - 0x29], ebp
je 0x1376d28
cmp dl, byte [esi + 0x6f1d6ac7]
push ebp
popfd
lcall 0x412, 0x7035b5a8
jnp 0x1376c95
sbb eax, 0x403381a2
jae 0x1376d0d
scasd eax, dword es:[edi]
fadd qword [ecx + 0x2d]
invalid
imul edi, dword [eax + 0x54a91d8], 0x7961275d
mov edi, 0xb27dd761
xchg esi, eax
into
xchg esp, eax
adc dword [edi + 0x5c], ebp
arpl word [esi - 0x76bb2d58], dx
sbb dword [esi - 0x52d1e501], ebp
inc esp
mov dword [ecx], ebx
scasb al, byte es:[edi]
call [edx]
lodsd eax, dword cs:[esi]
push 0xffffffffffffff8e
sub al, 0x79
mov byte [0x6d67994b], al
wait
das
lahf
call [ecx + 0x4b1a86cc]
adc al, 0x12
sub ah, byte [eax]
cmp eax, dword [ebp - 0x34]
invalid

Function at 0x137c77a
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor ebx, ebx
neg ebx
dec eax
dec dword [esp]
inc ebp
movzx esp, al
js 0x17b9864
inc ecx
mov edx, dword [esi + ebp*4 - 0x5adc4810]
dec eax
inc ecx
mov dword [ecx + ebp - 0x16b7120c], edx
dec eax
sar ecx, 0x4e
dec esi
lea ecx, [ebp + ecx - 0x16b7120c]
dec esp
mov dword [esp + ebp - 0x16b71204], edx
setns byte [esp + ecx*2 - 0x1dec46]
inc esp
movsx esi, ch
pop edx
pop edi
jbe fcn.01343929
lea ecx, [eax + 0x3322f30c]
neg ecx
xor edx, 0xd69bad07
shr cx, cl
shr eax, 0x13
rol edx, 1
push ecx
lea edx, [edx + ecx*2 - 0x13d777df]
and ecx, dword [esp + eax*4 - 0x3390]
or ax, word [esp + eax*4 - 0x338e]
xor ebx, edx
add cl, cl
pop eax
call fcn.0175fb5b
dec ecx
add ecx, 8
dec ecx
sub edi, 2
inc ebp
movzx esi, word [edi]
inc bp
xor esi, ebx
inc cx
inc esi
dec eax
mov dword [esp], 0xeb0db8a7
inc cx
ror esi, 1
jmp 0x1383a78
inc cx
not esi
mov ebx, 0x32956115
dec eax
lea eax, [ebx + ebx*4 + 0x38a2f807]
inc esp
movsx eax, ax
inc cx
ror esi, 1
sal dword [esp + ebx*2 - 0x652ac227], 0x14
inc cx
neg esi
inc cx
rol esi, 1
sal byte [esp + ebx - 0x32956110], 6
dec eax
lea ebp, [ebx + ebx*2 - 0xdcc1af5]
inc cx
xor esi, 0xcbfe59b3
xchg dword [esp + ebx - 0x32956110], ebp
inc bp
xor ebx, esi
dec ecx
xor eax, 0x87a06b27
inc word [esp + ebx*2 - 0x652ac224]
dec esi
lea esi, [esp + esi + 8]
dec ebx
lea eax, [eax + eax*4 + 0x6427ab8a]
dec ecx
mov dword [esi + ebx*2 - 0x652ac228], edx
dec ebp
lea edi, [edi + ebx*2 - 0x652ac22c]
inc ecx
mov ebx, dword [edi + ebx*2 - 0x652ac228]
jge 0x1232a90
inc edx
lea ebx, [ebx - 0x743984eb]
call fcn.01382111
dec ecx
not eax
dec eax
arpl bx, bx
dec eax
add esi, ebx
call fcn.01350d58
Function at 0x1382d10
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov edx, 0xe8326b3e
inc esi
movzx ebp, word [esp + eax*4 - 0xf4]
inc ecx
sub esi, 0xbc3a5184
inc edx
sar byte [esp + eax - 0x3a], 0x22
je 0x1371775
call fcn.0179cfc2
inc ebp
xor esi, ebx
inc esp
movsx eax, ch
inc ecx
not esi
inc ecx
xor esi, 0x8a3bf28
dec edx
mov dword [esp + eax - 0x3e], ebp
inc ecx
bswap esi
jmp 0x135269c

Function at 0x1383613
Capabilities:
Encode data using base64

Disassembly:
or dx, dx
mov ecx, dword [esi + edx - 0x699d9426]
xor ecx, ebx
mov eax, 0x40953116
lea edx, [edx*2 - 0x6adf535f]
sub ecx, 0x600794af
bswap ecx
mov dword [esp + edx - 0x685bd4ed], edx
lea ecx, [ecx + edx*2 + 0x29f0dee0]
not edx
neg ecx
lea edx, [eax*2 - 0x537e8b00]
not byte [esp + edx*2 - 0x5b57ae55]
rol edx, 0x36
xor ebx, ecx
and edx, 0x4f02252c
xchg word [esp + edx - 0x4b022022], dx
ja 0x17a2142
adc edi, ecx
mov dword [esp + edx - 0x4b02975b], edi
ret 4
Function at 0x1387f2f
Capabilities:
Encode data using xor

Disassembly:
neg bx
inc edx
lea eax, [eax - 0x202d3327]
inc cx
and esp, 0xd0f7ad32
inc ebp
movsx edx, dh
dec esi
mov dword [esp - 0xa], ebx
inc edx
xor dword [esp - 0x1c], eax
dec esi
mov ebx, dword [esp - 0xa]
add ebx, 0x658ada9f
dec eax
arpl ax, ax
dec edx
mov dword [esp - 0x88], edi
pop edi
dec eax
add esi, eax
dec edx
rol dword [esp - 0x48], 0xfc
inc ecx
movzx edx, al
jae 0x1388789
int1
or ebp, dword [eax - 0x126bd409]
pop es
test al, 0x4c
dec esp
mov dword [esp + ebx*2 + 8], ebx
inc ecx
pop eax
sar ebp, 0x1e
inc esp
xor dword [esp + ebx], ebp
inc ecx
pop ebx
push ecx
dec eax
lea eax, [ebx*8 + 0x501331ad]
inc bp
xchg esp, esi
dec ebp
arpl bp, bp
inc esp
mov eax, dword [esp + ebx*2 + 3]
neg byte [esp + ebx*2 + 3]
dec ecx
add esi, ebp
dec ecx
dec esp
dec ecx
neg esi
inc esi
movzx ebp, word [ebx + edi - 6]
dec eax
xor edi, 0x82a7f32f
not eax
inc esp
xchg dword [esp + ebx*4 + 4], esi
dec ebp
lea edi, [edi + ebx*2 - 6]
not word [esp + ebx + 1]
inc bp
xor ebp, ebx
inc cx
neg ebp
xchg word [esp + ebx + 6], ax
inc cx
ror ebp, 1
sal eax, 0x88
inc cx
inc ebp
pop edx
inc cx
ror ebp, 1
sal edx, 0x1d
push edx
call fcn.01256fda
pop edi
jae fcn.01343929
xor ebx, eax
add edi, eax
mov ecx, dword [ebp]
mov eax, 0x8e2060be
sub ax, 0x738d
movzx dx, byte ss:[ecx]
lea ecx, [eax + 0x530919b1]
add ebp, 2
ror cx, 0x45
xchg dword [esp], ecx
mov word [ebp + ecx*2 - 0x3311e92a], dx
xchg byte [esp + ecx - 0x1988f492], al
jae 0x1306917
inc ecx
mov edi, dword [ecx]
mov ecx, 0xe3221ea1
movzx ebx, cl
movzx edx, bl
inc ecx
mov edx, dword [ecx + ebx*8 - 0x504]
inc esp
movzx esi, bl
not edi
inc ebp
movsx esp, si
not edx
and edi, edx
inc ebp
movsx eax, si
inc ecx
sal esi, cl
inc ecx
mov dword [ecx + ebx*8 - 0x504], edi
jae 0x1778518
mov ecx, 0x5b83bb2b
inc ecx
movzx edx, byte [edi + ecx - 0x5b83bb2c]
call fcn.0175ce40
add byte [esp + ebx*2 - 0x51], 0xbe
inc si
sub dword [esp - 0x67b92e1e], esi
dec esi
mov dword [esp - 0x67b92e21], ebx
dec edi
lea eax, [esp + esi*8 - 0x53e0a26e]
inc ecx
or ah, 0x9e
inc ebp
mov ebx, eax
inc esi
xor dword [esp - 0x67b92eb7], ebp
neg bx
inc dx
shr dword [esp - 0x67b92eb9], 0xe7
dec esi
mov ebx, dword [esp - 0x67b92eb7]
call fcn.0137fe16
inc esp
xor bl, dl
inc esp
xchg al, dh
dec eax
lea edx, [esp + edx + 0x20]
push eax
dec eax
mov ecx, dword [edx + edi]
movsx edx, byte [esp + edi*4 + 0x19]
dec ecx
mov dword [ecx + edi*2 - 0x10], ecx
push ebx
dec ebp
lea ecx, [ecx + edi*2 - 0x10]
call fcn.0131f10a

Function at 0x138d5d7
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0x1a
dec esp
mov dword [esp + edi - 0x978e], ebp
dec cx
dec word [esp + edi - 0x9789]
rol cx, 1
dec eax
bswap edx
pop ebx
dec ebp
xadd ebp, edx
not cx
rol cx, 1
inc sp
xor ebx, ecx
call fcn.0123516e
inc ecx
xor eax, ebx
inc ecx
mov eax, 0x16093d8e
rol eax, 2
dec esi
lea ebp, [eax*4 - 0x55d2c5c9]
call fcn.017a8e8a
Function at 0x138ea33
Capabilities:
Encode data using xor

Disassembly:
dec ebp
arpl dx, dx
dec ecx
add esi, edx
call fcn.013350d7
movzx ecx, dl
mov cl, byte [ebp + edx*2 - 0x64]
xor dx, dx
neg edx
lea ebp, [ebp + edx*2 + 2]
sal ax, cl
mov ecx, edx
ror edx, 0xac
mov word [ebp + edx*2], ax
lea esi, [esi + edx - 4]
bswap edx
setae cl
mov eax, ecx
mov eax, dword [esi + edx*4]
shr cl, 0xc6
xor eax, ebx
shr cx, 0x8b
sbb dl, cl
rol dx, 0x8d
not eax
shr dl, 0x27
call fcn.01233167
dec eax
mov dword [esp], eax
inc ebp
mov edx, dword [edi]
dec eax
xor dword [esp], 0x242f7abf
dec eax
lea ecx, [edx + 0x3b364c16]
sbb dword [esp + 4], eax
inc ebp
xor edx, ebx
dec ebx
lea ebp, [eax + ebp*8 - 0x39e3bce8]
dec eax
shl edx, 0xbc
cmovs cx, ax
inc ecx
ror edx, 1
and dword [esp], edx
inc ecx
bswap edx
inc ecx
ror edx, 2
inc ecx
bswap edx
dec eax
bswap ebx
dec esp
mov dword [esp], ebx
shr ebp, cl
inc esp
mov ebx, ebp
inc esp
xor dword [esp + ebp*2 - 0x28], edx
inc ecx
pop ebx
inc cx
sal ebp, 0x4c
inc esp
movzx esp, dl
jbe 0x1377b8e

Function at 0x1395ec6
Capabilities:
Encode data using base64

Disassembly:
lea edx, [edx + ecx - 0x4d080688]
xor ebx, edx
add edi, edx
mov ecx, ebp
mov dword [esp], 0xa10ec435
jmp 0x179b79c

Function at 0x1397f4b
Capabilities:
Encode data using xor

Disassembly:
push edx
add edi, eax
call fcn.0135830f
mov bh, 0xb1
fisubr word [eax - 0x74]
in al, 0xa
xchg edx, eax
fsub st(0), st(0)
sar dh, 0x2e
xchg edx, eax
fsub st(0), st(0)
aam 0xbe
add dl, byte [edx - 0x695b1724]
pop esi
xchg edx, eax
fsub st(0), st(0)
neg dh
push ds
xchg edx, eax
fsub st(0), st(0)
mov ah, 0x98
shl byte [eax - 0x23b89bd3], 1
push ecx
jl 0x1397fdd
movsd dword es:[edi], dword [esi]
mov al, byte [0xc56fc44b]
and eax, 0xb2088882
sti
rol byte [eax + 0x19], 1
imul byte [esi + 0x5a5a52f5]
push edx
pop edx
pop edx
jl 0x1397f8c
out dx, al
adc cl, byte [edx]
push es
jl 0x1397f92
out dx, al
dec esi
dec esi
sub bh, byte [ebp + esi*8 - 0x12]
bound ecx, qword [edx + 0xe]
jl 0x1397f9e
out dx, al
inc esi
scasb al, byte es:[edi]
outsb dx, byte [esi]
outsb dx, byte [esi]
lds eax, [esi + 0x62]
mov edx, 0xb30f7f51
inc ecx
mov eax, 0xb7511bd1
inc ecx
mov eax, 0xb36f11d1
inc ecx
mov eax, 0x975f51d1
inc ecx
mov eax, 0xa37751d1
inc ecx
mov eax, 0x593d4fd1
cmp eax, 0x417e00fe
cmp eax, 0xfe3d59
jle 0x139801a
sbb byte [eax], 0x64
xor al, 0x73
das
jae 0x139800e
popfd
rcr ebx, 1
in al, dx
mov bl, byte [eax - 0x18]
dec ebp
sti
shl byte [eax - 0xa51f61b], 1
scasb al, byte es:[edi]
sahf
rol byte [ebx - 0x7d65110b], cl
test byte [ebx - 0x141110b], 0xf2
xor ebp, 0xffffffee
mov edx, 0xf583f6f6
out dx, al
mov esi, 0xc56e910a
invalid
wait
stc
mov byte [0xac2677ca], al
mov esp, 0x675f67c
fisub dword [eax + edi*2 - 0x55f98a0a]
mov ah, 0x7c
div byte [ebp + 6]
test al, 0xde
fcomp qword [esi - 0x6ee5fedb]
clc
sbb dword [esi - 7], ebx
imul byte [edx - 0x17]
loop 0x1397fd2
pop edx
xchg ebp, eax
cli
cmc
out 0xd, eax
adc bh, byte [ebp + 0x54]
retf
Function at 0x139d77b
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x82], edi
ret 0x10
mov dword [ebp + ecx*8 - 0x410], eax
mov eax, 0x94ab7638
mov ebx, dword [esp + ecx - 0x7e]
neg edi
push eax
mov edi, dword [esp + edi - 0x54e72072]
mov esi, dword [esp + ecx*2 - 0xf4]
mov dword [esp + ecx - 0x7a], ecx
mov dword [esp + ecx - 0x72], edx
jns 0x137128a

Function at 0x175a73e
Capabilities:
Encode data using base64

Disassembly:
ror ax, 0xa6
dec eax
arpl dx, dx
dec eax
adc esi, edx
inc cx
inc ebp
add ebp, dword [ecx + ebx - 0x6a5dffaa]
call fcn.0138b164
call fcn.012609df
dec ecx
sub edi, 4
jmp 0x17c1569
mov ebx, 0x95a2a8aa
inc ecx
mov edx, dword [edi]
inc esp
movsx edx, bl
inc esp
movzx eax, bx
not ebx
inc ecx
xor edx, ebx
inc ecx
mov esp, 0x74908c1c
bswap edx
inc ecx
mov eax, eax
inc ecx
mov ecx, esp
inc ecx
lea edx, [eax + edx - 0x641eba68]
mov ebp, eax
inc esp
movzx ebp, ch
xor edx, 0x25ba6718
not ebp
shr bl, 0x41
dec eax
sub eax, 0x48eeb2b
dec edx
neg eax
xchg cx, bp
inc cx
sar ebp, 0xae
neg edx
inc ecx
movzx edi, dx
inc ecx
shl ah, 0x21
inc ecx
push ebx
xor dword [esp + ebx - 0x6a5d572a], edx
dec eax
or ebx, edi
inc sp
add edx, ebx
inc ecx
pop ebx
jl 0x138d5bd

Function at 0x1769a30
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor bl, dh
inc eax
neg ch
inc eax
xor al, bh
pop ebx
dec esi
lea esi, [esp + esi + 8]
dec eax
cmovo ebp, edi
ror di, 0x28
inc ebp
mov edx, dword [esi + ebp - 0x48a125fd]
dec eax
sbb eax, ebp
inc ebp
mov dword [ecx + ecx*2 - 4], edx
inc eax
sal bh, 0x42
inc esi
mov edx, dword [ebp + edi - 0x48a12602]
add edi, edi
inc ebp
xor edx, ebx
inc ecx
rol edx, 1
dec eax
mov dword [esp + ecx], 0xc5325eba
inc ecx
rol esp, 0x44
sal eax, 0xc6
inc ebp
lea edx, [edx + ebp*2 - 0x4c91da7a]
inc eax
shr ch, 5
inc ecx
bswap edx
inc esp
movzx ebp, cl
dec eax
inc ecx
xor edx, 0x17b02d22
inc ecx
movzx edx, ch
inc ebp
movsx eax, ch
inc ecx
dec edx
inc ecx
pop esp
inc ecx
xchg al, cl
inc ecx
not edx
dec esi
lea esp, [ecx - 0x1dc89cc9]
inc ecx
inc ebp
inc ebp
add edx, ebp
inc esp
movzx esi, ch
jmp 0x1243fd5

Function at 0x176b072
Capabilities:
Encode data using base64

Disassembly:
jmp 0x17a486f
xor ecx, ebx
movzx edx, al
neg ax
or dword [esp + eax*4], eax
bswap ecx
ror edx, 0xe2
dec ecx
xor ecx, 0xe4978fb6
shr edx, 0xb7
pop edx
sbb eax, edx
neg ecx
inc ax
dec ecx
xor ebx, ecx
add edi, ecx
call fcn.013048ee
mov dword [esp + eax*2 - 0x4568ff56], eax
mov edx, dword [esp + eax*2 - 0x4568ff56]
xor ecx, ebx
mov dword [esp + eax - 0x22b47fab], 0x4087411b
sub ecx, 0x878ce0be
neg eax
not ecx
ja 0x136c1af
adc eax, 0xa31787af
ror ecx, 2
call fcn.0122bc02
jmp 0x1358347
lea ecx, [ecx + eax - 0x2d6678a1]
lea edx, [eax*8 - 0x24e059c1]
xchg edx, eax
xor ecx, 0xb5807594
shr ax, 0x67
sar dword [esp + edx - 0x569a96ae], 0x97
push eax
xor ebx, ecx
call fcn.0133c78c
pushfd
push esi
mov esi, 0x98729ab
push dword [esp + esi - 0x98729a7]
popfd
mov dword [esp + 4], 0xf925fb7d
mov esi, dword [esp + esi - 0x98729ab]
lea esp, [esp + 4]
call fcn.013920f9
Function at 0x1770fc8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc eax
cmp esp, 0x650b98b7
test si, bx
cmp edi, ecx
jb 0x178df7d
lea ecx, [ebp - 0x114]
push ecx
nop
mov al, bh
cbw
mov byte [ebp + edi - 0x114], 0
movzx ax, ch
movsx ax, ch
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x13acbf6
jae 0x179f0af
xor edi, edi
test ecx, ecx
jmp 0x178df6c
je 0x179f0af
mov ebx, dword [ebp + 8]
clc
cmp edi, ebx
jmp 0x1316467
je 0x1253cae
mov byte [ebx + eax], dl
jmp 0x17866cf
mov esp, ebp
jmp 0x179137b
call eax
mov edi, eax
clc
test ebx, 0xa13521a8
test edi, edi
jne 0x133e097
lea edx, [ebp - 0x114]
push edx
movzx eax, bx
lahf
mov eax, dword [sym.imp.kernel32.dll_LoadLibraryA]
call eax
mov edi, eax
clc
stc
test edi, edi
jmp 0x133e091
rol dl, 1
mov dword [esp], eax
ror ax, 0x4f
not dl
ror dl, 1
add eax, 0xd0ae0b1d
adc dword [esp], 0xa338bd2a
xor bl, dl
lea edx, [esp + edx + 4]
mov dword [edx], ecx
sub ax, word [esp + 2]
mov edx, dword [esp]
mov edx, dword [esi + edx - 0x5c3ce030]
lea ecx, [eax*8 + 0x6c882603]
and byte [esp + 1], cl
xor edx, ebx
sal ecx, cl
add cx, cx
jge 0x17bfaef
mov ebp, 0xa13fde0b
dec ecx
sub edi, 1
inc ecx
movzx edi, byte [edi]
inc eax
inc ch
call fcn.017c74cb
dec ecx
bswap edx
dec ebp
xor ebx, edx
call fcn.01759a33
inc edi
jmp 0x1253c9c
jbe 0x1253cae
lea ebx, [ebp - 0x114]
adc dl, 0x85
sub ebx, eax
mov dl, byte [eax]
cmc
test dl, dl
jmp 0x139a507
pop ebp
ret
pop edi
pop ebx
xor eax, eax
movsx esi, si
pop esi
jmp 0x13a731d
sbb edx, 0xf4b58d9a
or al, 0x1a
bswap edx
xor eax, eax
lea edx, [edx + eax + 0x6039d805]
ror edx, 1
not word [esp + eax + 1]
or eax, ecx
neg dword [esp]
xor ebx, edx
neg dword [esp]
add edi, edx
shl al, 2
mov edx, dword [ebp + 4]
xchg dword [esp], ecx
call fcn.012639f9
mov ecx, esi
cmp ebp, ebp
sub ecx, eax
cmc
cmp ecx, 0x104
jmp 0x1303e06

Function at 0x1771074
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov esp, 0xe3c059e
inc ebp
movsx ebp, ax
inc edi
dec edx
lea ecx, [ebp*2 - 0x6ac3aecd]
call fcn.01315833
sar dl, 0x66
dec ebp
lea edi, [edi + eax*2 - 0x84e6]
jp 0x1253d4c
inc ecx
mov edx, 0x1ba17e8e
dec edi
lea esi, [edx + edx*4 - 0x4b461ed3]
inc ecx
movzx ebp, dh
dec edi
lea edi, [edi + edx - 0x1ba17e92]
inc esp
movzx eax, ch
inc ebx
mov edi, dword [edi + esi - 0x3ee159f3]
inc ecx
xor edi, ebx
ror edi, 1
jmp 0x12330c9
sar dword [esp + eax*4 - 0x109ab], cl
inc ebp
movzx esi, word [edi + eax - 0x4277]
dec eax
mov dword [esp + eax*4 - 0x109bc], 0x12bc2c12
jne 0x1350988

Function at 0x1777a2d
Capabilities:
Encode data using base64

Disassembly:
xor esi, edx
and esi, 0xff
mov dword [esp + 4], 0xeb0b649d
mov esi, dword [esi*4 + 0x13aa228]
call fcn.017a5558
Function at 0x17876e1
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc ecx
not esi
or bx, 0x9cb7
inc ecx
or bl, dl
inc ecx
inc esi
dec eax
mov dword [esp + ebp*2 - 0x133b624e], edi
inc ecx
pop eax
call fcn.017ae90f
push edx
mov al, 0x27
mul bl
invalid

Function at 0x1787d33
Capabilities:
Encode data using xor

Disassembly:
or cx, 0x6696
or ecx, 0x978fba85
mov dword [ebp - 4], edx
lea eax, [ecx*2 + 0x6d228287]
ror ax, 0x8b
mov edx, dword [esi - 9]
not dword [esp + 6]
dec cl
adc esi, 0xfffffff7
mov dword [esp], ecx
sub ecx, 0xd29aa58e
xor edx, ebx
bswap ecx
rol edx, 2
add eax, dword [esp + ecx - 0x705af5be]
inc ax
not edx
rol edx, 1
sub edx, 0x1285903c
and ecx, ecx
rol edx, 2
neg dword [esp + ecx - 0x705af5c0]
xchg ah, cl
xor ebx, edx
or ax, word [esp + ecx - 0x705af54f]
xchg dword [esp + ecx - 0x705af550], eax
jl 0x179f5c0
mov dword [ecx + ebp - 0x705af558], edx
js 0x125626a

Function at 0x179a59e
Capabilities:
Encode data using base64

Disassembly:
pop eax
not cx
and dx, cx
mov word [ebp], dx
call fcn.0124ac36

Function at 0x179c516
Capabilities:
Encode data using xor

Disassembly:
add edx, 0x6c2ef116
mov dword [esp], ecx
rol edx, 1
bswap ecx
call fcn.0179b0e5
call fcn.0132080b
call fcn.017c9e84
lds ebp, [ecx]
add al, 0xa8
sar byte [edx - 0x5d02e506], cl
test al, 0xd2
mov edx, 0xa2fd1afa
xor ch, byte [eax - 0x5d02bd80]
xor ch, byte [eax + edx*8 - 0x51f45722]
mov dl, 6
pop edi
jne 0x179c523
fcmovb st(0), st(2)
aaa
retf

Function at 0x179d892
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor ebx, ebx
dec esp
lea ebp, [ecx + edi*2 - 0xc7673f7]
inc edx
sal byte [esp + esi - 0x27fc], 0x21
inc ebx
dec esp
lea eax, [ebp + ebp*2 + 0x27b2a5a6]
jmp fcn.01786a69
dec dword [eax - 9]
pushfd
dec esp
mov al, byte [eax]
salc
clc
lodsd eax, dword [esi]
add edi, dword [ecx + 0x49e7ffff]
dec ecx
dec ecx
dec esi
dec eax
lea ebp, [ecx*8 - 0x65de249]
inc ebx
mov ebx, dword [edi + esi*2 - 0x4ffe]
dec esp
lea edx, [ebp + ecx - 0x11f26d49]
dec edx
mov dword [esp + esi - 0x27ff], eax
jp 0x1324643
dec dword [edi]
mov cl, byte [eax + 0xffb86d]
adc byte [edx - 0x6579fce5], ch
sbb al, 0x74
cmp al, 0xcb
insd dword es:[edi], dx
mov eax, 0xaa1000ff
add byte [eax], dl
stosb byte es:[edi], al
sbb eax, dword [ebx]
xchg byte [edx - 0x34c38be4], bl
adc eax, 0x12fbaaed
lcall 0x5e9f, 0x4766e09
jno 0x179d947
and eax, 0xb3ea780f
aas
jg 0x179d879
and ah, byte [edx]
ror byte [0x7ac712b4], 0xe
inc ebx
into
jecxz 0x179d881
jae 0x179d8b4
xchg esp, eax
cmp esp, esi
lodsd eax, dword [esi]
or ch, byte [ebp + 0x177daad6]
xchg dword [ebx - 0x5b487e1c], esp
xchg ebx, eax
je 0x179d8b8
lodsb al, byte [esi]
push ds
loop 0x179d88c
stosd dword es:[edi], eax
imul ebx, dword [eax - 0x25], 0xebcef0a2
movsd dword es:[edi], dword [esi]
xchg dword [ebp + 0x7e], ebp
rcr dword [ecx], 0xfb
dec esi
invalid
salc
invalid
Function at 0x179ea04
Capabilities:
Encode data using xor

Disassembly:
call fcn.0125f870
ror ebp, 1
rol dx, 0x41
not ebp
dec eax
sub edx, edx
inc ecx
push esi
inc ebp
dec eax
sub edx, 0x24851ca6
xadd dx, bx
sbb al, 0x85
and al, 0x66
xadd edx, ebx
sete al
dec esp
mov dword [esp + ebx - 0x24a7e33a], ebx
xor dword [esp + ebx*2 - 0x494fc694], ebp
inc esp
movzx ebp, dl
dec esp
mov ebx, dword [esp + ebx - 0x24a7e33a]
inc esp
xchg al, ch
dec esi
lea edx, [ebx - 0x39dab965]
dec eax
arpl bp, bp
call fcn.017800a7
aam 0x6f
push cs
stc
mov edi, 0xc4c6db5
jns 0x179ea17
wait
inc ecx
dec esp
or al, 0x79
cmc
out 0x35, eax
dec esp
or al, 0x79
test dword [ecx + 0x790c4c4d], eax
xchg ebx, ebp
or eax, 0xb3790c4c
jmp 0x179e9ff