joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16b7741
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using speck

Disassembly:
add ebp, 4
div ecx
mov dword [ebp], edx
mov ecx, 0x45174028
rol ecx, cl
mov dword [ebp + ecx*4 - 0x5d00a110], eax
and ecx, ecx
movsx edx, cl
or edx, edx
lea esi, [esi + ecx - 0x17402849]
jg 0x173ad6e
mov eax, 0x420f8d11
movsx ecx, ax
mov ecx, dword [eax + ebp - 0x420f8d11]
sar ax, 0x46
and ax, 0xdd2d
mov eax, dword [ebp + eax - 0x420fdc20]
ja 0x16fbfc3
mov ecx, 0x95201e9a
lea eax, [ecx + ecx*8 + 0x2b8fa907]
jmp 0x17809d9
rol cl, 0xa1
shr ecx, 0xa7
mov ecx, dword [ecx + ebp - 0xed0e15]
jns 0x1715a3e
mov ecx, 0x322f9c0d
mov eax, ecx
mov edx, dword [ebp + eax - 0x322f9c0d]
sal eax, 0x6d
call fcn.0168f12d
lea esi, [esi + edx - 0x1882dffc]
adc ecx, 0xd523a812
xor eax, ebx
ror eax, 3
call fcn.01750b95
mov eax, 0xdeacbfbc
inc eax
movsx edx, al
mov edx, dword [ebp]
lea ecx, [eax + eax - 0x46d2707c]
mov eax, dword [ebp + ecx - 0x76870efa]
jno 0x1691c8b
sub edi, 4
mov ecx, dword [edi]
mov eax, 0xe2bd5db3
sub al, ah
xor ecx, ebx
shr eax, 0xbc
inc ecx
shl al, 0x47
movzx edx, ax
xor ecx, 0xe68f23b3
call fcn.016c3ec7
call fcn.00d381bf
jp 0x10244a5
jmp 0x16d43ad

Function at 0x16c0d4e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sub esi, 4
mov eax, dword [esi]
mov edx, 0xe90ba203
push edx
xor eax, ebx
mov byte [esp + 1], dh
dec eax
xor eax, 0x788bcfa7
add byte [esp + 3], 0x8b
call fcn.016acf83
neg ebp
call fcn.00d49e3c
jmp 0xd39c82
lea ecx, [eax + eax*4 + 0x5700dda7]
movzx ax, byte [esi + eax*2 - 0x1fffa]
mov cl, byte [edx + esi - 0x5f979100]
mov dword [esp + edx - 0x5f9790fe], edx
sal edx, 0xd2
lea esi, [esi + edx - 0x4407fffe]
pop edx
ja 0x189ad4c
shr al, cl
call fcn.00d0c649
dec ecx
sub ebp, 4
inc ecx
mov ebp, dword [ebp]
xor ebp, edi
inc ecx
mov edi, 0x193f718a
inc ecx
movsx ecx, bh
jmp 0x10ac4e8

Function at 0x16c49fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, edx
rol dx, 0x61
lea ebp, [ecx + ebp - 0x7abb4a13]
mov dword [esp + ecx - 0x7abb4a17], ecx
xor eax, ebx
sar ecx, cl
setns dl
shl cl, 0xe4
inc eax
not eax
inc word [esp + edx - 0x7abb9400]
or dl, byte [esp + edx - 0x7abb9400]
or ecx, 0xc2bed2af
neg eax
sub dx, dx
shl dl, 0x81
sbb eax, 0x82df9b2
xor ecx, edx
xor ebx, eax
neg dx
adc edi, eax
mov eax, dword [esi + edx - 0x7abb0000]
pop ecx
or edx, edx
or edx, ecx
mov cl, byte [esi + edx - 0x7abb4b13]
sete dl
adc dx, dx
lea esi, [esi + edx - 0x7abb95fe]
call fcn.016b6b88

Function at 0x16ca149
Capabilities:
Encrypt data using speck

Disassembly:
add esi, edx
mov dword [esp + eax - 0x12be6885], esi
ret
lea edx, [edx + edx - 0x506b877d]
mov edx, dword [edi + edx - 0x9aa58b1]
call fcn.00f3a17c
mov eax, 0x12be6885
lea edx, [edx + eax*4 - 0x79940045]
or byte [esp + eax - 0x12be6883], al
mov ecx, 0x8f30a82d
rol edx, 3
inc edx
ror dword [esp + eax - 0x12be6885], 0x27
not edx
neg edx
xor ebx, edx
rol ecx, 0x73
jb 0x16aa72d
mov eax, 0x2c010d1e
mov edx, dword [esi + eax*2 - 0x58021a3c]
rol eax, 0xda
lea esi, [esi + eax - 0x78b00430]
bswap eax
jae 0x16f8026
add ax, 0x7e24
xor edx, ebx
mov ecx, 0x642edf91
call fcn.016b0ba7
Function at 0x16cacea
Capabilities:
Encrypt data using speck

Disassembly:
ror eax, 1
xor ebx, eax
call fcn.00f360a8
pop esi
not edx
jp 0x17a87b5
mov eax, dword [ebp]
mov esi, 0x4f9e4897
lea ebp, [ebp + esi - 0x4f9e4893]
or esi, 0x2613b122
sbb si, 0x4609
mov esi, eax
mov edx, 0x422d191c
movsx eax, dl
mov ecx, eax
mov edi, ebp
ror al, 0x87
call fcn.0175bcd8
jmp 0xff90fc
push edx
xor eax, 0x9c1c618d
lea eax, [eax + edx*2 + 0xf003f12]
jmp 0xf569cf
mov edi, ebp
pop eax
mov ebp, edx
pop ebx
jb 0x16a3804
pop ebp
lea ebp, [edx + ebp - 4]
mov eax, dword [ebp + edx]
neg edx
xor eax, ebx
lea ecx, [edx*8 + 0x4530cb8a]
shl cl, 0xa7
rol edx, 0x88
lea eax, [edx + eax + 0x23ba72a9]
lea ecx, [edx*8 + 0x3205953b]
ror eax, 2
lea ecx, [ecx + ecx*2 + 0x6638f51f]
jmp 0x16b4f5a

Function at 0x16cd2a3
Capabilities:
Encrypt data using speck

Disassembly:
bswap edx
inc cl
movsx eax, byte [esp + ecx - 0x24f2a1fd]
ror edx, cl
call fcn.01686e10
mov word [ebp], ax
mov ecx, dword [edi]
mov edx, 0x78915691
lea edi, [edi + edx - 0x7891568d]
call fcn.01688108

Function at 0x16cd2ce
Capabilities:
Encrypt data using speck

Disassembly:
movzx ecx, al
add cx, ax
neg edx
inc edx
jmp 0x1777d34
pop edx
lea esi, [esi + edx*2 - 0xa3b305a]
je 0x167b796
ror eax, 0x4f
mov dword [esi + edx - 0x51d982b], ecx
sal dl, 0xe1
setbe dl
lea edi, [edi + edx*8 - 0x28ecc004]
setae al
mov edx, dword [edi + edx*2 - 0xa3b3000]
or ax, 0xa03a
xor edx, ebx
xor edx, 0x950a6625
jmp 0x16932f8
mov dword [esp], eax
rol dword [esp], 0x96
xor dl, bl
movsx ecx, al
sar ax, 0x4c
neg dl
ror dl, 1
add dl, 0xb2
sub eax, ecx
rol eax, 0xba
lea eax, [ecx*2 - 0x3671e972]
not dl
add eax, eax
add cx, 0x7c17
sub cx, 0x5332
xor bl, dl
lea edx, [esp + edx + 4]
xor dword [esp], 0x2035fd84
xor eax, 0x3f2cc931
mov ecx, dword [edx]
js 0x16ae521
dec eax
not edx
sar ecx, 0xe1
xor ebx, edx
push ecx
inc dword [esp + ecx*4 - 0x1f0ec]
add ebp, edx
call fcn.01618c0b
Function at 0x16cf0e5
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
xor edx, ecx
sal dx, cl
bswap eax
adc cl, cl
add ecx, edx
xor eax, 0xe1afc8bf
sub eax, 0x8a3aa282
push ecx
shl dword [esp], 0x9e
not ecx
xor ebx, eax
shl ecx, 0xe5
inc edx
adc ebp, eax
jmp 0x1847f63
ror cl, 1
movzx edx, al
xor cl, 0x27
sar edx, 0x6f
xor bl, cl
mov word [eax + ebp - 0x22b65a03], cx
movzx cx, byte [ebp + eax*2 - 0x456cb404]
lea eax, [eax*4 - 0x14757956]
shl eax, 0x70
ja 0x17322ae
xor al, byte [ebp + edx*8]
xadd dl, dh
adc cl, al
movsx eax, dl
push eax
add eax, dword [esp + edx*2]
mov word [ebp + edx], cx
mov ecx, 0x1e9973a9
sete dl
xor eax, dword [edi + edx*2 - 1]
pop ecx
lea edi, [edi + edx*2 + 3]
shr ecx, 0x70
lea edx, [ecx + 0x4d1bf51b]
jbe 0x17cead3
sub esi, 4
mov eax, 0x6d3a7937
movzx edx, al
mov ecx, dword [esi + edx*4 - 0xdc]
xor ecx, ebx
sub ecx, 0xe1b62287
inc al
neg ecx
add ax, dx
call fcn.0173cf70
sub cl, 0x35
shr al, 0x26
not cl
jae 0xf43034
xor ebx, edx
add esi, edx
call fcn.0170cf99
xor cl, 0x11
pop eax
sar word [esp + eax - 0x41cc8b9d], 0x6e
not cl
setbe al
rol dword [esp + eax - 0x41cc8afe], 0xd4
xadd dword [esp + eax - 0x41cc8afc], eax
xor bl, cl
inc eax
lea ecx, [esp + ecx + 8]
add al, 0xa7
xor byte [esp + 7], 0x9d
movzx edx, word [esp + 2]
mov ax, word [edx + ecx - 0x6ba4]
mov word [edi + edx*4 - 0x1ae94], ax
mov ecx, dword [ebp + edx*8 - 0x35d26]
lea ebp, [ebp + edx*4 - 0x1ae96]
push edx
movzx eax, dx
jbe 0x16be86a
xor ecx, ebx
rol ecx, 1
xor eax, eax
bswap ecx
call fcn.0176749e
mov eax, dword [edi]
mov cl, byte [edi + 4]
mov edx, 0x57b88435
shr eax, cl
sub dl, dh
shr edx, 5
mov dword [edi + edx*4 - 0xaf71092], eax
jb 0xf39e50
add eax, eax
sal eax, 0x85
rol ecx, 3
lea ecx, [ecx + eax - 0x54ca1c09]
lea eax, [edx + edx*2 - 0xa41de59]
ror ecx, 1
xchg dx, ax
or ax, 0x248e
call fcn.00d3f4fa
mov eax, 0x840f1184
movzx edx, al
sal eax, 0xc5
lea edi, [edi + edx*8 - 0x424]
movzx ecx, dl
shl dl, 0xa6
mov eax, dword [edi + edx*2]
lea ecx, [edx - 0x14eede70]
xor eax, ebx
add cx, dx
inc eax
xadd edx, ecx
sbb cx, 0x67b1
and ecx, ecx
rol eax, 2
jmp 0xee8084
and eax, eax
sbb dx, 0x278f
neg ecx
xor ecx, 0xb63f6db4
jmp 0x16bcc7d
call fcn.00fbf794
call fcn.0184ba4b
add byte [esp + 1], dh
mov word [edi], ax
lea ecx, [edx*2 + 0x2389feae]
jae 0x1710607
mov eax, dword [ebp + edx - 0x158e4d8b]
push edx
xor eax, ebx
neg edx
not dl
dec eax
shl byte [esp + ecx*2 - 0x9b14], 0xc7
call fcn.016c59f1
mov edx, 0x799c618a
mov ecx, dword [ebp + edx - 0x799c6186]
or dl, dh
adc eax, ecx
movzx ecx, dl
mov dword [ecx + ebp - 0xe7], eax
and edx, ecx
lea eax, [edx + 0x37914a0a]
lea ebp, [ebp + edx*2 - 0x1d2]
mov edx, dword [edi + edx*4 - 0x3ac]
shr al, 0xc4
lea edi, [ecx + edi - 0xe7]
neg eax
add eax, eax
xor edx, ebx
xor al, al
ror eax, cl
or ax, cx
lea edx, [edx + ecx*2 + 0x5a9b8241]
push ecx
ror edx, 1
xor edx, 0x6b25210e
sub ax, cx
bswap edx
xor edx, 0x8d24fd06
xchg dword [esp + ecx*2 - 0x1d6], eax
ror ax, cl
jae 0x163a9ae
jmp 0xfdd660
mov dword [esp + ecx - 0x415cae3e], ebp
ret 0xc
mov ecx, dword [esi]
jmp 0x17d4780
Function at 0x16d39bf
Capabilities:
Encrypt data using speck

Disassembly:
and ax, 0x7229
inc ax
jno fcn.016eef86
shl edx, cl
neg eax
sar ecx, cl
mov dword [esp + ecx - 0x11], ecx
adc dword [esp + ecx - 0x11], ecx
dec eax
rol eax, 1
shr byte [esp + ecx*2 - 0x21], 0xa1
call fcn.0184ea68
add ebp, 4
shr ax, 0x88
mov ecx, eax
xor edx, ebx
add cl, cl
rol al, 0x81
inc eax
xor edx, 0x2eaf3389
inc ax
add ax, cx
rol edx, 1
inc edx
not cx
or ecx, 0x4412ee8a
neg edx
neg cl
xor ebx, edx
lea eax, [eax + eax*2 + 0x673c18a0]
add esi, edx
not ecx
inc ax
mov di, word [edi + ecx - 0xb28009e]
jg 0x16ce906
not edx
ror cx, cl
and ecx, ecx
bswap ecx
inc edx
shl ecx, 0xaf
ror cx, 0x47
neg edx
xor cl, cl
ror edx, 3
neg cx
mov eax, ecx
call fcn.0171ca58
inc al
dec edx
call fcn.0176b3cc

Function at 0x16d80c4
Capabilities:
Get number of processors

Disassembly:
pop ecx
mov edx, dword [edi]
call fcn.00cfa86c
call fcn.00e83af2
inc ecx
ror ebx, 3
inc ecx
ror bh, 0x64
inc ecx
sub ebp, eax
dec edx
mov dword [esp + eax + 0x38], edi
pop ebx
neg ax
inc edx
shl byte [esp + eax + 4], 0x63
inc esi
xor dword [esp + eax*4 + 0x30], ebx
neg ax
inc cx
sub ecx, 0x8b4aec00
jl 0xf70a31
xor ecx, esi
inc dword [ecx - 0x3f]
retf
xor byte [eax - 0x79], cl
push esp
and al, 0x10
dec eax
add edx, 0xff88afb9
jmp edx
loope 0xf709be
test byte [esi], dl
push edi
xchg edx, eax
sal edi, 0xf
adc dword [esi + 0x4d], 0x78
add byte [edi], cl
test dword [ebx - 0x72ff95e3], edx
inc esp
xor eax, dword [ebx + eax]
xor byte [ebx], bh
int3
xadd byte [esp + edx*2 - 0x5c], dh
rol dword [esp + edx*8 - 0x994], cl
mov eax, dword [edi + edx - 0x137]
lea edi, [edx + edi - 0x137]
xor eax, ebx
sal word [esp + edx*2 - 0x261], 0x81
rol eax, 2
add edx, edx
xor cx, cx
bswap eax
mov dword [esp + edx - 0x266], edx
xor eax, 0x8525801f
or dx, word [esp + edx - 0x25a]
rol edx, 0x1a
push ecx
not eax
lea eax, [eax + edx - 0xca6ec2]
sub ecx, 0x11855c2e
not eax
xor ebx, eax
sal dl, 0x84
setb dl
add esi, eax
dec byte [esp + 0x10]
sar dword [esp + 3], cl
call fcn.017690fe
mov dword [esi + 4], eax
mov edx, dword [esp]
call fcn.016d499b
push 0x6e007f3a
jmp 0x172cb93
neg dword [esp]
sub edi, 4
jmp 0xf709b4
Function at 0x16e096c
Capabilities:
Encrypt data using speck

Disassembly:
and eax, edx
movsx edx, cl
call fcn.018100ba
mov dword [esp], eax
neg byte [esp + 6]
mov dword [ebp - 4], edx
jle 0x17c2dca
or ecx, 0xc28e5a90
sbb ebp, 4
dec cl
mov edx, dword [esp + 5]
pop edx
pop edx
pop ecx
pop edx
jle fcn.00f1fef8
inc ecx
mov edx, 0x89c6c8d
dec ebp
lea ecx, [edx + 0x51188c13]
inc di
mov edx, dword [esi + edx - 0x89c6c8d]
dec edi
lea esi, [ecx + esi - 0x59b4f89e]
dec edi
lea ebp, [ebp + ecx - 0x59b4f8a1]
inc edi
movzx edi, byte [ecx + ebp - 0x59b4f8a0]
inc ecx
movzx ebp, cl
inc esp
movsx ebx, ch
inc esp
xor bh, bh
inc cx
sal ecx, 0xc7
inc eax
movsx edx, ch
ja 0x18992ae
ror al, 1
and dword [esp + edx*8 - 0x7c294], edx
sbb al, 0x82
xor al, 0xb2
rol edx, 0x12
push edx
xor bl, al
mov ecx, dword [esp + 4]
add ecx, 0xfff01144
jmp ecx
mov edx, dword [ecx + edi - 0xfdf9]
jmp 0x1011d4d
jmp 0x180ff7e
inc ecx
dec bh
inc ecx
shl cl, 0xe5
inc ecx
rol bh, 1
inc ebp
movzx eax, cx
inc ecx
xor bh, 0x1d
call fcn.0186f742
neg eax
shr dword [esp], 0x6f
xor eax, 0x7e05361e
xor ebx, eax
xchg word [esp], cx
pop ecx
add esi, eax
mov eax, dword [edi + ecx*2 - 0x1fbfe]
jmp 0x1841239

Function at 0x16e0daa
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, ecx
rol byte [esp + eax*2 - 0x45e35d1b], 0xa4
add esi, ecx
lea ecx, [edx*2 + 0x66863686]
pop edx
rol al, 0x21
movzx ecx, byte [ebp + eax - 0x22f1ae27]
lea ebp, [ebp + eax*2 - 0x45e35c48]
lea edx, [eax*2 + 0x44808c99]
xor dl, 0x11
js 0x1719cd2
bswap edx
xchg byte [esp + 2], cl
and byte [esp], cl
rol edx, 1
lea eax, [ecx + ecx - 0x7664cd51]
xchg word [esp], ax
mov dword [esp], ecx
xor ebx, edx
and word [esp + 1], 0xbd3c
xchg byte [esp + 3], ch
adc esi, edx
lea edx, [eax + ecx + 0x788e583a]
not byte [esp]
add ecx, 0xef08f004
mov eax, dword [edi + ecx - 0x715d72b2]
lea edi, [edi + ecx - 0x715d72ae]
bswap edx
call fcn.0172281b

Function at 0x16e2575
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx ecx, dx
ror eax, 1
sub eax, 0xc006b5ab
xor ebx, eax
add esi, eax
mov ebp, dword [ebp + edx - 0x10]
mov dword [esp + edx*2 - 0x20], 0xb59af829
sal ecx, 0x9d
and word [esp + edx - 0xe], dx
pop edx
ja fcn.016b7643
movzx dx, byte [edi]
mov cl, byte [edi + 2]
add edi, 2
mov eax, 0x1b9afcbd
shl dl, cl
add al, al
js 0x17e3b7c
mov word [edi + eax - 0x1b9afc7a], dx
movsx ecx, al
lea ebp, [eax + ebp - 0x1b9afc7e]
mov ecx, dword [ebp + eax - 0x1b9afc7a]
lea edx, [eax*4 + 0x1c203ead]
jns 0x188db57

Function at 0x16e309b
Capabilities:
Encrypt data using speck

Disassembly:
lea ebp, [ebp + edx*2 + 4]
jne 0x16b883f
xor ecx, ebx
movsx eax, dl
call fcn.016dce51
mov eax, 0x8780f3b7
movzx edx, ax
mov ecx, dword [esi + edx*2 - 0x1e76e]
and edx, edx
lea eax, [eax + edx*2 - 0x41c9064d]
or al, al
mov ax, word [esi + edx - 0xf3b3]
lea esi, [esi + edx*4 - 0x3ced6]
not edx
call fcn.01636e7e
mov edx, 0xb03b4798
lea ecx, [edx + 0x987a3ac]
mov eax, dword [esi]
rol edx, cl
neg dl
lea esi, [esi + edx - 0x3b47971]
adc ecx, ecx
xor eax, ebx
dec ecx
lea ecx, [ecx*2 + 0x103aa019]
jnp 0x16bd058
lea eax, [edx + eax + 0x4feeacb3]
xor cx, cx
add edx, edx
rol eax, 1
jmp 0x163d165
Function at 0x16e6f8e
Capabilities:
Encrypt data using speck

Disassembly:
adc ebp, eax
mov eax, 0x5da29eab
pop edx
pop eax
pop ecx
pop eax
pop eax
jmp fcn.0176abf9
sub dl, dh
jae 0x17a03a7
sub edi, 4
call fcn.016ba9f3
movzx edx, byte [edx + edi - 0x569dbd8b]
lea edi, [ecx + edi - 0xbd8b]
bswap eax
call fcn.01704f52
movzx ecx, dl
sar edx, cl
xor al, 6
or dl, 0x83
jg 0x1686e77
xor bl, al
lea eax, [esp + eax + 4]
sal edx, cl
jne 0x1742489
neg byte [esp + edx - 0x620021c]
xor al, bl
movzx ecx, dl
ror al, 1
inc ecx
neg al
rol al, 1
xor al, 0x28
call fcn.0175d85b
mov ax, word [ebp + eax*4 - 0x2c26]
and ecx, dword [esp]
not cl
not word [esp + ecx*4 - 0x3f4]
mov cl, byte [ebp + ecx - 0xf9]
adc ebp, 4
shld dx, ax, cl
ror dword [esp], 0x2e
call fcn.017102f1
mov eax, 0xa6393f0c
movzx edx, al
call fcn.016c4f52
lea esi, [esi + ecx*8 - 0x134]
lea eax, [edx - 0x147ccf4b]
mov eax, dword [esi + ecx*4 - 0x98]
call fcn.016e0c59
lea edi, [edi + ecx*2 - 0x3c]
movsx edx, cl
mov edx, dword [ebp + ecx*2 - 0x3e]
xadd dword [esp + ecx*4 - 0x70], ecx
jbe 0xea3754
sbb ebp, 6
inc ecx
not cl
movsx eax, cx
xor edx, ebx
rol word [esp + eax - 0x1e1], 0x27
xor ecx, dword [esp + eax - 0x1e2]
lea edx, [edx + ecx - 0x48c02997]
sal eax, cl
not edx
sub word [esp + ecx - 0x2091da], ax
rol edx, 1
dec edx
call fcn.0170541a
mov edx, dword [eax + ecx*4 - 0x70]
mov dword [edi + ecx*2 - 0x3c], edx
xor cl, ch
jge 0x1718392
lea eax, [eax + ecx*2 + 0x2eb48e15]
lea edx, [ecx + ecx*2 + 0x69a4ed8f]
xor ebx, eax
inc ecx
call fcn.016a17e6
bswap eax
xor ebx, eax
xchg word [esp + edx], cx
ror cx, 0xec
dec dword [esp + edx]
adc ebp, eax
not dword [esp + edx*2]
mov eax, dword [esi + edx]
xor edx, dword [esi + edx*2 + 4]
sal ecx, 0x97
push ecx
lea esi, [esi + ecx + 4]
and eax, edx
not eax
mov dword [esi + ecx*2], eax
and ecx, ecx
xor dword [esp + ecx*2], ebp
ret 4

Function at 0x16e708c
Capabilities:
Encrypt data using speck

Disassembly:
xor eax, ebx
jmp 0x172d834
adc esi, edx
movsx edx, cx
mov ecx, dword [edi + edx*4 - 0x1a038]
sub dx, ax
add dl, 0x3d
mov eax, dword [edi + edx*8 - 0x27258]
ja 0x173716c
push edx
xor ebx, ecx
mov dword [esp + edx + 4], 0xa43420a0
shl dword [esp + edx*2 + 4], 0x91
rol dword [esp + edx*8 + 1], 0xb1
adc ebp, ecx
and word [esp + edx], dx
movsx ecx, dx
mov esi, dword [esi + edx*4]
adc dword [esp + edx + 1], edx
pop eax
pop edx
je fcn.00f0da46
add ecx, eax
movzx eax, dx
mov dword [ebp + edx*4 - 0x705286e4], ecx
mov ecx, eax
lea edi, [edi + edx - 0x1c14a1bd]
dec cx
mov eax, dword [edi + eax*2 - 0x14372]
jno 0xe6ef58
call fcn.01814142
mov dword [eax + edi - 0x22249add], ecx
mov edx, eax
lea ecx, [edx + edx*8 + 0x3596fd2f]
sub edx, 0xfa3ae91e
mov edx, dword [ebp + eax - 0x22249ae1]
rol ecx, cl
setns al
lea ebp, [ebp + eax - 0x222499fd]
xor edx, ebx
dec edx
and cx, ax
and cx, cx
or eax, ecx
rol edx, 2
xadd ax, cx
shl cx, 0x6c
lea edx, [edx + eax + 0x5b3f6e0b]
dec cx
not edx
ror ecx, 0x48
xor ebx, edx
and al, 0xac
jno 0xfce922
xor ebx, eax
not cl
xchg dh, cl
sar cl, 0xa4
add ebp, eax
mov eax, dword [esi + 2]
call fcn.00f5d80e
or ecx, eax
call fcn.017535cc
inc ecx
mov eax, edx
sar eax, 0xa7
shr eax, 0x99
neg ecx
bswap edx
jmp 0x175572e
Function at 0x16e76f9
Capabilities:
Encode data using base64

Disassembly:
push eax
mov dword [esp + eax - 0x4a43db24], ebp
ret 4
sub cl, cl
and eax, edx
mov dword [esp + ecx - 0x4a27b400], 0x6e1a5233
inc cl
add byte [esp + ecx - 0x4a27b3fb], 0x1c
mov ecx, eax
mov edx, dword [esi + 8]
mov eax, dword [esp + 4]
or ecx, edx
pop eax
not ecx
shr eax, 0xb2
or word [esp + eax*2 - 0x370c], ax
mov dword [esi + eax*4 - 0x6e10], ecx
add eax, dword [esp + eax - 0x1b86]
jno 0x174cb11
push eax
lea esi, [esi + eax - 0x4a43db1c]
pop ecx
jp 0xee5c89
mov edx, dword [esi]
call fcn.0100c31c
mov edx, 0xe82b1f8f
lea ecx, [edx + edx*4 + 0x4f851635]
mov eax, dword [ebp]
and cx, cx
call fcn.017d2e06

Function at 0x16e85ec
Capabilities:
Encode data using base64

Disassembly:
shr dword [esp + edx - 0x56e5a], 0x73
seta dl
lea esi, [esi + edx*2 - 0xadc03]
not edx
movzx eax, byte [esi]
neg edx
xor al, bl
call fcn.00efb433

Function at 0x16e863a
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
pop ecx
sub ebp, 4
mov edx, 0x73225722
sub dx, 0xf0a6
movzx eax, dl
mov edx, dword [edx + ebp - 0x7322667c]
movzx ecx, al
xor edx, ebx
bswap ecx
call fcn.0184c3da
mov eax, 0xe6b78d07
shr al, 0xe1
lea edx, [eax*4 + 0x4d215f22]
mov ecx, dword [edi]
xor eax, eax
xor al, 0x28
mov eax, dword [edi + eax - 0x24]
rol edx, 0xd
not ecx
or edx, edx
not eax
push edx
sar dx, 0xaf
shl edx, 0x73
or ecx, eax
movzx eax, dx
mov dword [edi + eax + 4], ecx
jmp 0x16e8af7
xadd word [esp + eax*4 + 2], ax
jno 0x16fd022

Function at 0x16f23ee
Capabilities:
Encode data using xor
Encrypt data using speck

Disassembly:
rol dl, 1
movzx eax, cl
add ecx, 0xf9391f10
not dl
mov dword [esp + eax*2 - 0x10c], eax
dec al
sar cl, 5
inc dl
call fcn.00eac330

Function at 0x16f40c1
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov esp, esi
mov ebx, 0x730b1433
pop edx
call fcn.016a9260
Function at 0x16f8059
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [ebp]
add ebp, 4
mov eax, 0xa7bf0cad
xor edx, ebx
lea ecx, [eax + eax*2 - 0x1affec79]
inc al
sub edx, 0x7cb1cdab
xor edx, 0x551c9abc
dec edx
xor edx, 0x64bcc994
shr ecx, cl
not cx
neg eax
lea edx, [edx + eax - 0x5cebaefb]
call fcn.01720eb0
movzx eax, dl
mov eax, dword [edx + esi - 0xffe4]
call fcn.01740380
xor ecx, 0xbb2aac1e
xor ebx, ecx
xchg ah, al
add ebp, ecx
xor dl, byte [edi + edx*2 - 6]
movsx ecx, al
sub edi, 6
xchg word [esp + 0x13], ax
sal cl, 0xe1
xor dl, bl
shl byte [esp + 0x15], 0xa1
neg dl
sub cl, byte [esp + 0xf]
ror dl, 1
shr cx, 0xca
push ecx
add dl, 0xb2
shr eax, 0xd1
bswap eax
shl eax, cl
not dl
xor bl, dl
dec eax
jo 0x16a36c1
rol ecx, cl
lea edx, [esp + edx + 0x1c]
bswap ecx
mov eax, dword [edx + ecx - 0x1f80ffff]
movsx edx, cl
mov dword [esi + ecx*2 - 0x3f01fffe], eax
sbb edx, 0xf9313486
mov dword [esp + ecx - 0x1f80ffff], ebp
ret 0x18
call fcn.016c68d5
jmp 0xe7a60a
add word [esp + edx - 1], dx
adc ecx, 0xfb359439
shl dword [esp + edx*2 - 2], 0x22
bswap edx
not ecx
js 0x1717c44
xor ebx, ecx
add word [esp + edx - 0xffffff], ax
adc al, dl
not dx
adc esi, ecx
xor eax, dword [ebp + edx - 0x100fffb]
call fcn.017deca8
xor ebx, eax
neg ecx
add edi, eax
or dx, word [edx + ebp]
movsx eax, cx
xchg al, cl
jmp 0x16e6fdc
xadd ecx, edx
dec eax
not eax
xchg ecx, edx
ror edx, 0xf1
call fcn.016edeba
not eax
mov dword [esp + edx - 0x3289b103], ecx
and dx, cx
lea eax, [eax + edx*2 + 0x430c4e89]
sub byte [esp + edx*2 - 0x65122201], 0x98
call fcn.01697db9
mov eax, 0xc01c6c2d
sub esi, 4
lea ecx, [eax + eax*8 + 0x61bfc3a8]
mov eax, dword [esi + ecx*2 - 0x457f227a]
sar cx, 0xa
xor eax, ebx
not cx
lea eax, [eax + ecx*2 - 0xbf9ccad]
mov edx, ecx
jmp 0x17302b2
mov eax, 0x74aa98bc
dec al
lea ebp, [ebp + eax - 0x74aa98bf]
sal eax, 0x66
mov eax, dword [ebp + eax - 0x2aa62ec0]
mov edx, 0xeb21c081
ja 0x17c6ae2
xor eax, ebx
neg eax
movsx ecx, dl
jmp 0x1759eaa
not eax
jmp 0x161fb89
inc edx
rol ecx, 2
mov dword [esp + edx*2 - 2], edx
bswap ecx
and ax, ax
xor ecx, 0x8525801f
inc dx
not ecx
shr dx, 0x41
jns 0xf48d18
call fcn.01745813
jmp 0x16d3a58
jb 0x178b94f
lea ecx, [ecx*2 + 0x19a44d9e]
bswap eax
jmp 0x16e9ab0
sub eax, 0x3f2a9f04
and edx, ecx
sbb edx, ecx
xchg ch, cl
neg eax
sub dx, 0x3989
lea ecx, [edx + edx + 0x720bed98]
rol eax, 1
inc ecx
ror ecx, cl
inc eax
neg ecx
jnp 0x1701aae
inc eax
add cx, 0x7f85
or edx, dword [esp + ecx - 0x2f623ee1]
neg edx
neg eax
not cl
dec byte [esp + ecx*2 - 0x5ec47c34]
sub eax, 0x692201b3
not ecx
jmp 0xeba40d
xor ebx, eax
add esi, eax
jmp 0x16f9ca6
shl ax, 0x84
xor ebx, ecx
mov dword [esp + eax - 0x1c385ffc], edx
sal dword [esp + eax - 0x1c385ffe], 3
add ebp, ecx
mov eax, dword [esi + eax - 0x1c386000]
mov cx, word [eax + edx*4 - 0x179eab00]
lea esi, [edx + esi - 0x5e7aabe]
sub word [esp + edx*4 - 0x179eab00], dx
mov eax, edx
mov word [esi + edx - 0x5e7aac0], cx
call fcn.016ab167
mov ecx, 0x152b17af
mov edx, dword [edi + ecx*2 - 0x2a562f63]
lea edi, [edi + ecx*4 - 0x54ac5ec1]
sal cx, cl
mov ecx, dword [esp + 0xc]
add ecx, 0xff7c5764
jmp ecx
Function at 0x16fbf4f
Capabilities:
Encrypt data using speck

Disassembly:
sal edx, 2
mov dword [esp + eax*2 - 0x20000000], eax
push eax
mov eax, ebp
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 8]
je 0x1826528
Function at 0x170d552
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + edx - 0x6165428e], 0xe828d32
xor cl, bl
call fcn.017c93a0

Function at 0x170df1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
sar dl, 0x27
sar cx, 1
lea ebp, [edx + ebp - 0x2b97ffc]
mov dword [esp + edx*4 - 0xae5fffc], ecx
xor eax, ebx
not edx
mov dword [esp + ecx*2 - 0x572], 0xecbfe308
not eax
not byte [esp + ecx*2 - 0x56c]
dec eax
xor eax, 0x6ca7b612
call fcn.016c033b
xor bl, cl
shl dword [esp], 0x37
lea ecx, [esp + ecx + 4]
jb 0x16d9163
and dword [esp], 0xc1177213
mov eax, dword [esp]
mov byte [ecx + eax - 0x41000000], dl
movzx ecx, al
jb 0x168e695
mov dword [esp + eax - 0x41000000], ebp
ret

Function at 0x1710500
Capabilities:
Encrypt data using speck

Disassembly:
and ax, word [esp + ecx]
mov dword [ecx + ebp], edx
call fcn.017bc1ed
or ecx, 0xd3b4da9c
lea ecx, [ecx + ecx*4 - 0x465464d6]
adc edi, 9
lea eax, [ecx + ecx*4 + 0x73ac13c]
xor ax, ax
xor edx, ebx
ror edx, 1
dec edx
jmp 0x18140f2
xor dl, bl
mov ecx, 0x3e2f2833
xor dl, 0x80
mov dword [esp + ecx*2 - 0x7c5e5066], 0xc1023780
sub ecx, dword [esp + ecx*2 - 0x7c5e5066]
inc dl
and ecx, 0x7cb3a2b4
xadd cl, ch
neg dl
dec dl
rol cx, 0x47
lea ecx, [ecx + ecx*4 - 0x42d1ff5b]
not dl
xor bl, dl
lea edx, [esp + edx + 4]
ror dword [esp + ecx*2 - 0x539d94ba], cl
shr ecx, 0x1d
adc ecx, 0xfe1392a5
mov byte [edx], al
sbb ebp, 4
movzx eax, word [esp]
call fcn.016da3b0
add edx, ecx
xor ebx, eax
sub edx, ecx
jns 0x17615a6
sbb dl, 0x8a
add esi, eax
shr cl, cl
mov edx, dword [edi + edx*2 - 0x400000e7]
jne 0xfc18c8
mov ecx, 0x6e176388
mov edx, dword [edi + ecx - 0x6e176388]
mov eax, dword [edi + ecx - 0x6e176384]
call fcn.01746242
rol eax, 0x2c
lea esi, [esi + eax*2 - 0x3933421d]
xor ecx, ebx
mov dword [esp + eax - 0x1c99a10d], eax
neg ecx
inc ecx
xor ecx, 0xebd3384
inc ecx
xor ebx, ecx
mov dword [esp + eax - 0x1c99a10d], edx
sar dx, 0xf
adc ebp, ecx
movsx ecx, ax
pop ecx
pop edx
pop edx
pop edx
pop eax
pop eax
jmp fcn.00f78eac
push eax
neg edx
xor ecx, 0x6f8c0e2c
dec edx
not cx
neg dword [esp]
rol edx, 1
ror byte [esp + 1], 0xa2
xor ecx, ecx
xor ebx, edx
jmp 0xf05b05