joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17702c1
Capabilities:
Encode data using base64

Disassembly:
dec cl
mov dword [esp + edx - 0x419417e3], edx
add edx, 0xfab2b7b0
xor bl, cl
call fcn.0161c84d
mov eax, 0x3386241e
mov ecx, edx
pop eax
pop edx
mov edx, dword [edi + eax*4 - 0x40b0c38]
add ecx, edx
mov edx, ecx
mov eax, dword [eax + edi - 0x102c307]
add edx, eax
shl dword [esp], 0x78
mov dword [edi + 8], edx
mov ecx, dword [esp]
mov eax, ecx
lea edi, [ecx + edi - 0x1efffff8]
jae fcn.00eeabd4
mov dword [esp + ecx - 0x1f000000], ebp
ret

Function at 0x1770af6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sub cx, dx
ror eax, 3
rol dword [esp], cl
neg cx
call fcn.016fb491
xor ecx, 0x4f94552e
xor eax, ebx
mov edx, ecx
bswap eax
or dx, 0x8f2a
lea eax, [ecx + eax - 0x50f24d80]
setnp dl
jno 0x1676ac0
xor dl, bl
mov dword [esp + ecx - 0x4897cc95], ecx
pop ecx
ror dl, 1
call fcn.016963ff
and cx, 0x716
push ecx
adc edi, 4
jmp 0x17273bf

Function at 0x177191c
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
bswap edx
pop ecx
rol eax, 1
movzx ecx, dl
mov byte [esp + ecx - 0x81], 0x34
xor ebx, eax
not edx
mov dword [ebp + edx - 0x30c30e80], eax
sub ecx, dword [esp + edx*2 - 0x61861cf8]
or word [esp + edx - 0x30c30e7a], dx
movzx eax, byte [edi + ecx*4 - 0x32c03c4]
xor al, bl
sal dx, 0x2d
sub dl, 5
lea edx, [edx - 0x69749372]
ror al, 1
inc cl
setne byte [esp + ecx*2 - 0x19601e6]
add al, 0x1b
sal dl, 0xa7
add word [esp + ecx - 0xcb00f3], dx
jl 0x188d1eb
sub al, 0x29
shl cx, 0x68
ror dl, 0xa2
ror ecx, 0xf9
rol al, 1
inc ecx
sets byte [esp + ecx - 0x65f98000]
xor bl, al
lea eax, [esp + eax + 4]
mov ecx, dword [eax + ecx - 0x65f98001]
jmp fcn.0172c65b
neg al
rol al, 1
jmp 0x178c603

Function at 0x1775d1a
Capabilities:
Authenticate hmac

Disassembly:
not eax
mov dword [esp], 0x3a1dab26
movzx ecx, byte [esp]
rol byte [esp + ecx - 0x24], 1
mov dword [esi + ecx*2 - 0x4c], eax
xchg byte [esp + ecx - 0x25], dl
lea edi, [edi + ecx*2 - 0x50]
mov edx, dword [ecx + edi - 0x26]
sbb ecx, ecx
xor edx, ebx
lea edx, [ecx + edx - 0x6423d0a4]
neg edx
sub edx, 0x86b25087
rol edx, 1
movsx eax, cx
push ecx
xor ebx, edx
dec eax
add ebp, edx
call fcn.016b5d7a

Function at 0x1775f5f
Capabilities:
Encrypt data using speck

Disassembly:
add esi, 4
call fcn.0160f4fd
mov ecx, dword [esi + 4]
add esi, 4
mov eax, 0x68241026
or edx, ecx
rol eax, 0x49
movsx ecx, al
call fcn.016be053
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, 0xf01cf719
mov ecx, dword [esi + 8]
jmp 0x16b179d

Function at 0x17773ee
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0x74966cb3
xor bl, dl
sal byte [esp + 7], 0xa5
push ecx
lea edx, [esp + edx + 0x14]
pop ecx
shl cx, 0x85
shl cx, 9
mov dword [edx], eax
mov dword [esp], 0x69a2a03a
or dword [esp + 0xc], 0xe7a34019
mov ecx, dword [edi - 5]
mov eax, 0x5020d015
lea edi, [edi + eax - 0x5020d01a]
jno 0x187e9c3
pop eax
xor ecx, ebx
lea ecx, [ecx + eax - 0x639de307]
call fcn.0175d610

Function at 0x177c7ea
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
not al
neg ecx
xor edx, 0x6aab8d22
adc al, 0xf
shl dx, 0xe5
neg edx
not al
pop edx
js 0x17a7275
Function at 0x1780997
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea eax, [edx + eax + 0x8a631d]
bswap ecx
rol ecx, 0x22
rol eax, 1
ror cx, 0xee
dec dword [esp + ecx*4 - 0x160c397a]
xor ebx, eax
inc cx
add ebp, eax
movzx eax, cl
mov al, byte [ecx + edi - 0x5830e67]
xchg byte [esp + ecx - 0x5830e59], dl
lea edi, [edi + ecx*8 - 0x2c18730e]
xor al, bl
shr dword [esp + ecx - 0x5830e61], 0xe1
add al, 0xf
inc byte [esp + ecx*2 - 0xb061cb6]
neg al
not dx
sal dword [esp + ecx*2 - 0xb061cc1], 0xe9
pop edx
inc al
ror al, cl
add edx, edx
call fcn.00eb4c17
mov edx, 0x3f2a7d35
mov ecx, dword [edi + edx - 0x3f2a7d35]
and edx, edx
jns 0x16b441f
not ecx
lea eax, [esp + eax + 0x10]
shl cl, 0x27
adc cx, cx
neg dword [esp + 8]
mov dword [eax], edx
movzx eax, cl
mov eax, dword [edi + eax - 6]
mov dword [esp], 0x53164c95
xor eax, ebx
inc eax
lea edx, [ecx*2 - 0x6d71bc6c]
push ecx
inc word [esp + edx - 0x600f0384]
rol eax, 3
dec eax
not eax
inc dx
jne 0x171601c
movzx dx, byte [eax + edi - 0x69b0bc71]
neg eax
add ecx, eax
sbb cx, 0x9d0b
mov al, byte [ecx + edi - 0x2b6fc51b]
shr cl, 6
not dl
call fcn.01830449

Function at 0x17826f5
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [edx + ebp - 0xeb6f87d]
shl dx, 0x4a
xor eax, ebx
sal dx, 0x2c
rol eax, 1
pop edx
mov ecx, 0x11f503c
lea eax, [ecx + eax + 0x6b8a0281]
bswap ecx
mov edx, ecx
bswap eax
xchg dx, cx
inc cx
lea eax, [eax + ecx*2 + 0x7b759001]
bswap edx
xor ebx, eax
add edi, eax
not ecx
sal dx, 0xeb
lea ecx, [ecx + edx - 0x6c40b86d]
mov cx, word [esi + edx*4 - 0x47f8002]
movzx eax, byte [edx + ebp - 0x11fdffb]
inc dl
xor al, bl
rol al, 1
sar dx, 0x8f
xor al, dl
xor al, 0xac
neg al
xor bl, al
inc dl
add eax, esp
mov byte [edx + eax - 0x11fff00], cl
movzx eax, byte [ebp + edx*4 - 0x47ffbfa]
jmp 0xe8a6b4

Function at 0x178cb8b
Capabilities:
Encode data using xor

Disassembly:
call fcn.00cee8e6
mov ecx, 0xf31d9d3e
sar cx, 0xce
mov byte [edx + eax - 0x6bcc8e6a], cl
add ax, 0xb289
lea ecx, [eax + eax - 0x766afff1]
movzx eax, byte [edi + ecx - 0x612d81f0]
lea edi, [edi + ecx - 0x612d81ef]
movzx edx, cl
call fcn.0174fa38
mov ecx, dword [edx + edi - 0x28277e9b]
jmp 0xeea6d3

Function at 0x1790013
Capabilities:
Execute syscall

Disassembly:
neg eax
call fcn.0172620c
sysenter
call fcn.01015800

Function at 0x1795d5c
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0xe2212104
sub cl, 6
xor bl, cl
push edx
inc edx
lea ecx, [esp + ecx + 8]
lea edx, [edx + 0x49bfa40b]
shl word [esp + edx - 0x2fbea408], 0xc4
call fcn.0174582b
Function at 0x1797e90
Capabilities:
Encrypt data using speck

Disassembly:
add esi, eax
mov eax, edx
mov dx, word [edi]
shl word [esp + 1], 0xae
adc edi, 2
sub ebp, 1
movzx eax, byte [ebp]
xor al, bl
sar dword [esp], 0x28
xor al, 0x80
push 0x9e9dfd81
call fcn.0182d529
test di, cx
neg cx
and ax, dx
rol cx, 9
sbb ecx, 0x1a8d1d0b
movsx edx, cl
not ax
mov dword [esp + ecx - 0x3c1dc4ed], edx
rol byte [esp + ecx - 0x3c1dc4ed], 0xe1
mov dx, ax
or ecx, 0xb29e30a7
mov ax, word [edi + 4]
not dx
sal ecx, cl
setnp byte [esp + 2]
not ax
and dx, ax
inc byte [esp]
add ecx, ecx
mov word [edi + 4], dx
not word [esp]
movzx edx, byte [ebp - 1]
pop eax
dec ecx
rol ax, 0x67
xor dl, bl
push ecx
add dl, 0x37
xor dl, cl
shl byte [esp + 3], 0x41
call fcn.00f936dc
jmp 0xe91e61

Function at 0x17a00c5
Capabilities:
Encrypt data using speck

Disassembly:
jbe 0x1646a2e
lea esi, [esi + eax - 0x641e1739]
shl eax, 0x87
mov dword [esp + eax - 0xf0b9e78], edx
mov dword [esp + eax - 0xf0b9e7c], eax
push dword [esp + 8]
popfd
mov edx, eax
mov dword [esp + eax - 0xf0b9e80], ebp
ret 8

Function at 0x17a23c0
Capabilities:
Encrypt data using speck

Disassembly:
push ecx
dec dl
xor ebx, eax
mov dword [esp + edx - 0x3413ffeb], edx
add ebp, eax
movzx dx, byte [esi + edx*2 - 0x6827ffdc]
mov al, byte [esi + 4]
add esi, 6
shl word [esp + 2], cl
not dl
shr ecx, 0x1e
adc cl, 0x39
push ecx
not al
shr dword [esp + ecx - 0x3c], cl
jns 0x17fc50f
jnp 0x174ac2e

Function at 0x17ab984
Capabilities:
Encode data using xor

Disassembly:
setne cl
dec edx
sub ax, 0xa1a2
neg edx
dec edx
mov byte [0x4adaf7a1], al
neg edx
dec ax
not ecx
mov dword [esp], eax
lea edx, [edx + ecx - 0x8171f81]
shl eax, cl
sub eax, 0x2108df37
or byte [ecx], ah
xor ebx, edx
call fcn.016530dc
call fcn.010a09b1
dec eax
lds ebx, [esi - 0x3e]
mov byte [edx + 0x27], bl
cmp eax, 0xa1b9b8b8
mov ebp, 0x91e2c5e6
jae 0x17ab98a
insd dword es:[edi], dx
sal byte [ebx], 0x14
inc eax
or byte [ecx + 0x76fb9d5], bl
out dx, eax
pop ebx
sbb byte [edx], bh
sbb eax, 0x182b0777
cmp bl, byte [0x18631707]
cmp bl, byte [0x181bf74f]
cmp bl, byte [0x39af4f37]
adc al, 0x62
shl byte [edi + 0xa], 1
fisub dword [ecx]
sbb dword [edi], 0x2f
pop es
je 0x17ab9a5
sal dword [ecx + 0x3a], 0x50
jno 0x17aba36
push eax
movsb byte es:[edi], byte [esi]
inc ecx
sahf
sub dword es:[ebx - 0x4f], ebp
popfd
pop ebp
or ch, bl
xor eax, 0x628e942b
push ss
jecxz 0x17aba11
jmp [ebp + 0x5d]
insd dword es:[edi], dx
pop ebp
add ebx, dword [edi]
sahf
lahf
sub ebx, dword [ebp + 0x67]
or ch, dl
push ebx
xor ah, byte [ebx - 0x4b]
jecxz 0x17ab9fa
ljmp 0x16f2:0x53e4b8fb
mov al, byte [0x36525285]
or ebx, dword [esp + edx*8 - 0x48260748]
sar dword [esi + 0x2b], 0x7c
dec ecx
jmp 0x17aba89
mov dl, 0xb9
sbb eax, 0xcea62310
add eax, 0xee11a0a
or byte [ebx + 0xe896631], dh
mov edx, 0x3a17d6ba
ror word [esp + edx*2 - 0x742fad74], 0xa1
call fcn.017192ce
Function at 0x17bc343
Capabilities:
Encode data using xor

Disassembly:
call fcn.01781ab1
push 0x9623b70d
sub edi, 4
mov eax, 0x1e025eac
lea edx, [eax + eax*4 - 0x36dd6bd0]
mov eax, dword [edi + eax - 0x1e025eac]
movzx ecx, dl
rol dx, 0xe5
xor eax, ebx
shr ecx, cl
adc dl, dh
js 0x17443a5
ror eax, 3
xchg edx, ecx
sal edx, cl
dec eax
add dword [esp + edx*2], ecx
xor byte [esp + edx + 3], cl
not eax
pop edx
inc edx
lea eax, [eax + edx*2 - 0x3727c32b]
shr ecx, cl
imul ecx
jmp 0x16e212c
rol ecx, 3
ror edx, 0x28
dec ecx
mov dword [esp + edx*8], eax
bswap ecx
inc ecx
xor ebx, ecx
add ebp, ecx
call fcn.0173ca62
mov ecx, 0x7286cc10
or ecx, ecx
lea eax, [ecx*8 + 0x240f0737]
mov ecx, dword [edi + ecx - 0x7286cc10]
mov eax, dword [edi + 4]
jno 0x176d378

Function at 0x17bce50
Capabilities:
Encode data using xor

Disassembly:
dec ecx
sub ebp, 4
push 0x98058933
inc ebp
mov eax, dword [ebp]
inc byte [esp + 4]
call fcn.00f95162
xchg ebp, eax
mov al, 0x75
mov byte [0xe7de46dc], al
scasb al, byte es:[edi]
add al, 0x6e
fsubrp st(7)
scasb al, byte es:[edi]
push esp
pushal
push 0xffffffffffffffde
out 0xae, eax
pushal
add al, 0x4a
fsubrp st(7)
scasb al, byte es:[edi]
or byte [eax], ch
test al, 0x3e
out 0xae, eax
mov esi, 0x59c046da
enter 0xffffffffffff85cd, 0xffffffffffffffac
push esi
mov byte [0xec2a3a17], al
mov dl, 0x86
push esi
enter 0x1fdc, 0x7c
xor eax, 0xf2a688e8
loop 0x17bce57
outsb dx, byte [esi]
invalid

Function at 0x17bdbba
Capabilities:
Encrypt data using speck

Disassembly:
sub ecx, 0xed3234bf
call fcn.017f5c71

Function at 0x17d448f
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using speck

Disassembly:
sbb cx, 0xbf82
pop edx
pop eax
pop edx
pop edx
jno fcn.01713832
Function at 0x17d7595
Capabilities:
Encrypt data using speck

Disassembly:
push edx
xor ebx, ecx
call fcn.00ee3cb7
inc ebp
mov edi, dword [esi + 4]
jne 0xfbc453
dec esp
lea ebx, [ebp + ebp - 0x2c42a275]
dec ecx
adc esi, 4
dec esp
lea ecx, [ebp*2 + 0x2523cd08]
not edx
inc ecx
not edi
inc ecx
or edx, edi
inc ecx
mov dword [esi], edx
and bp, 0x5628
dec esp
lea eax, [ebp + ebp*2 - 0x58dc09e0]
dec ecx
sbb ebp, 4
call fcn.01828ea7
movzx eax, byte [edi - 1]
mov ecx, 0x9d1e6020
xor al, bl
inc al
sar ecx, 0x18
inc cx
ror al, 1
call fcn.016cbfdd
mov dword [esi + ebx*2 - 0x72], ecx
call fcn.00cf1a2f
inc edx
ror byte [esp + ebx - 0x32965c5d], 0xe3
ror edx, 3
inc ecx
mov ecx, 0xf9a41a88
call fcn.0165936d
neg ecx
sub ecx, 0xe007b8b9
jmp 0xe8b808
xor al, 0x27
not al
or cl, ch
sbb al, 0xbd
rol ecx, cl
sbb ecx, 0xdc800929
ror al, 1
sar ecx, 0x35
add al, 0xa4
xor dword [esp + edx - 0x70293ffe], edx
bswap edx
not al
xor bl, al
dec ecx
neg cl
mov byte [esp + edx - 0x5402967], 0
lea eax, [esp + eax + 0xc]
xor dl, byte [esp + edx - 0x540296c]
pop ecx
add dword [esp + edx*4 - 0x1500a796], 0x3304f027
mov edx, dword [eax + edx*4 - 0x1500a798]
mov ecx, 0x960165b7
lea ecx, [ecx + ecx - 0x1b70a1dd]
mov eax, edx
neg dword [esp + ecx - 0x1092298d]
jae 0x101b249
mov edx, 0x8ab64f28
mov cl, byte [edi + ecx - 0x10922991]
sal eax, cl
lea ecx, [edx + edx*4 + 0x5fa8208c]
or dword [esp + ecx*2 - 0x2a6f58a5], 0xc80a711f
mov dword [ecx + edi - 0x1537ac56], eax
sal edx, cl
lea edi, [ecx + edi - 0x1537ac56]
mov ecx, dword [ebp + ecx*4 - 0x54deb14f]
adc ebp, 5
add dword [esp + 4], 0xb3898614
xor ecx, ebx
pop edx
ror ecx, 1
add word [esp + 2], dx
inc ecx
ror dword [esp], 0xa2
jb 0x1757fd8

Function at 0x17e03d7
Capabilities:
Encrypt data using speck

Disassembly:
or ecx, 0x64164ab8
ror al, 1
add word [esp + 5], 0x5e9d
not cx
rol ecx, 0xeb
adc al, 0xb2
mov dword [esp], 0xe81d4e04
xor al, 0xd
jmp 0x1877be0
rol al, 1
rol cx, 0x22
not cx
jae 0xe8ea1f

Function at 0x17e2b4f
Capabilities:
Encrypt data using speck

Disassembly:
pop edx
dec ecx
call fcn.01023e7d
mov dword [ebp], eax
movzx ecx, byte [edi - 5]
call fcn.0184eae1
bswap edx
or al, ah
rol edx, 1
neg ax
not eax
dec edx
not ax
xor ax, cx
rol ecx, cl
xor ebx, edx
neg eax
add ebp, edx
movzx ecx, byte [edi + eax - 0x4ea00960]
movsx edx, ax
lea edi, [edi + edx*8 - 0x4add]
xor cl, bl
sub cl, 0x82
inc edx
or eax, 0xc9bf8c3b
neg cl
inc dl
not cl
neg cl
rol ax, 1
xor bl, cl
and eax, eax
push edx
neg edx
mov word [esi + 2], cx
add esi, 2
call fcn.01894ec9
Function at 0x17e3d57
Capabilities:
Encode data using xor

Disassembly:
push 0x858c1315
add esi, 6
shrd edx, eax, cl
mov ecx, 0xdd3208a1
mov eax, dword [eax + esi - 0x2207fe42]
mov cl, byte [esi + 8]
jno 0x16d2bb2
mov edx, 0x81258b0a
xchg dh, dl
mov ecx, dword [ebp]
movzx eax, dl
and eax, eax
lea ebp, [ebp + eax*2 - 0x112]
xor ecx, ebx
not dx
xadd edx, eax
xor ecx, 0x37a0ed1e
call fcn.01623e7a
ror al, 0x25
neg cl
jmp 0xf847c3
mov edx, 0x1ea984b3
dec dx
or cl, al
mov dword [esp + edx*4 - 0x7aa612c4], 0x29b88f28
mov word [edi + edx - 0x1ea984b0], cx
movzx eax, dx
call fcn.01785155
lea esi, [eax + esi - 0x22903720]
ror ax, 0x69
shl eax, 0x4a
add eax, 0x6b912b31
xor edx, ebx
xor eax, 0x6f840d8d
neg edx
sal eax, 0xba
rol edx, 1
dec eax
inc edx
inc al
dec eax
ror edx, 2
ror al, 0x63
dec ax
xor ebx, edx
call fcn.0180bedd
xor edx, ebx
not edx
movsx ecx, ax
sub ecx, 0x5cacdf3b
neg edx
inc al
neg ecx
ror edx, 1
rol eax, cl
shr cl, 0x85
not edx
xadd word [esp + eax - 0x2207fae8], ax
shl cx, cl
xor ebx, edx
rol word [esp + eax - 0x2207feb8], 0xac
add ebp, edx
pop ecx
movsx edx, al
mov edx, dword [esi + eax - 0x2207feb9]
neg ecx
not al
jb 0x17bc2c1
not eax
or dx, dx
ror eax, 1
xadd byte [esp + 3], dh
not eax
rol eax, 1
movzx ecx, byte [esp]
bswap eax
xor ebx, eax
mov dword [esp + ecx*2 - 0xc], 0x5d2578bb
add ebp, eax
push edx
xor cx, cx
shl cl, 0x63
lea eax, [esp + ecx*4 + 0x64]
or dword [esp + ecx + 1], ecx
dec ecx
call fcn.0176639f
Function at 0x17eb79e
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esi + ecx*4 - 2], eax
sub ecx, ecx
mov eax, dword [esp + ecx*2]
adc ecx, 0x6e9ca091
mov eax, dword [ecx + edi - 0x6e9ca099]
movsx edx, cx
call fcn.017858e5
lea edx, [ecx*2 - 0x456b70d4]
adc ecx, ebp
jmp ecx
xor ebx, eax
not ecx
sal cl, 0xe1
add ebp, eax
mov dword [esp + ecx - 0x50a13864], edx
lea eax, [edx*4 - 0x6dee7da]
mov cx, word [ecx + esi - 0x50a13864]
ror word [esp + edx - 0x3e2c7b6f], 0x4e
setb al
lea edx, [esp + edx*2 - 0x7c58f6ce]
xor eax, eax
mov word [edx + eax*2], cx
movzx ecx, ax
jb 0x1684cc8
lea eax, [esi + eax*2 + 2]
je 0x1643b55

Function at 0x17ffc51
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [edi]
mov eax, dword [edi + 4]
and ecx, eax
pop edx
mov eax, 0x462bfb2a
not ecx
lea edx, [eax*8 - 0x794f0f7d]
xadd al, dh
mov edx, ecx
or eax, eax
mov eax, dword [edi + eax - 0x462bfbeb]
or edx, eax
not edx
mov dword [edi + 8], edx
mov eax, 0x18861431
jmp 0x1761c9c
Function at 0x180c193
Capabilities:
Encrypt data using speck

Disassembly:
rol al, 1
not al
or cl, ch
pop ecx
jl 0xffb11d

Function at 0x180c8ed
Capabilities:
Encode data using xor

Disassembly:
neg dl
xor dl, 6
mov dword [esp + eax - 0x6a04ee2d], eax
xor bl, dl
shl ax, 0x42
dec cx
xor dword [esp + eax - 0x6a04b8ac], ecx
lea edx, [esp + edx + 0xc]
xor eax, 0xf6888ea8
sub dword [esp], eax
shl cl, 0xa5
mov eax, dword [edx]
mov dword [edi - 4], eax
lea edx, [ecx*2 - 0x2a54b6da]
mov dword [esp + 4], edx

Function at 0x18134a5
Capabilities:
Encode data using xor

Disassembly:
inc ecx
rol edx, 1
inc ecx
mov edi, 0xa728f40b
dec eax
lea ecx, [eax*4 + 0x7429d2a6]
dec eax
mov dword [esp + ecx - 0x7429d55a], ecx
inc ecx
not edx
inc ebp
movsx eax, bh
not word [esp + ecx - 0x7429d552]
inc ecx
ror edx, 3
movzx ebp, word [esp + ecx - 0x7429d551]
dec eax
mov dword [esp + ecx - 0x7429d552], edi
call fcn.017f83f2
sbb eax, 0x38f1dcb
pop es
adc ebx, dword [eax + 0x128cc9ba]
lcall 0x668e, 0x8f3c090a
xor cl, byte [ecx]
cmp al, 0x8f
mov dh, 0x8e
cmp cl, byte [ecx]
cmp al, 0x8f
jle 0x18134eb
or word [edi + ecx*4], di
mov byte [0x8d48db53], al
add eax, 0x482bf5e0
sbb edx, dword [ebp - 0x1e]
cmc
dec esi
or al, 0x7d
mov dword [ebp + 0x639860b4], eax
mov bl, 0x23
int1
lodsb al, byte [esi]
idiv ebx
and esi, edx
salc
mov esi, 0x6151a956
out 0x9f, al
in al, dx
jmp 0xe8336a54

Function at 0x1818b4a
Capabilities:
Encode data using base64

Disassembly:
inc eax
mov dword [esp + edx - 0x5fbd8200], 0xaf83a527
jmp 0x17e6263

Function at 0x1818bc7
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x109d5797
mov edx, dword [ebp + ecx - 0x109d5797]
xor edx, ebx
sub ecx, ecx
ror edx, 2
mov eax, ecx
lea edx, [edx + ecx + 0x6106889c]
mov dword [esp + ecx], ecx
xor edx, 0xdaa9008
bswap ecx
jmp 0x1896201

Function at 0x18228ea
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
movzx cx, byte [eax + ecx - 0x29bffaf4]
shr edx, 0xb1
mov word [ebp + edx*8 - 0x35900], cx
call fcn.01718c5f
sal edx, 0x45
lea eax, [eax + edx - 0x5527b498]
shr dl, 0x64
mov dword [esp], edx
ror eax, 1
sub eax, 0x8197929d
movsx ecx, dl
xadd dword [esp + ecx - 0xc], ecx
sbb dword [esp], edx
xor ebx, eax
inc dword [esp]
add esi, eax
and edx, edx
sub dx, 0xd53b
xor word [esp + 1], 0x1fb3
lea eax, [esp + 0x10]
neg ecx
xor dword [esp + ecx*2 - 0x537ff5e8], ecx
jne 0x180b7cc
mov eax, 0x6b990af
movsx edx, ax
dec dl
mov edx, dword [edi + eax*2 - 0xd732162]
call fcn.00f42e4e
inc ecx
xor edx, 0xe0ac23b8
dec eax
inc eax
push edi
add eax, eax
mov ebp, ecx
inc esp
xor dword [esp + eax*4 - 0x38], edx
dec esp
lea ebx, [eax + 0x562cb2bc]
dec eax
sar ecx, 0x56
pop edi
dec ebp
arpl dx, dx
dec ecx
adc esi, edx
push ecx
rdtsc
xor cx, 0x992a
dec esi
lea esi, [ecx + esi - 0x9932]
inc ecx
mov dword [esi + ecx*8 - 0x4c94c], eax
inc ecx
rol al, 0xa6
inc sp
add ebx, ebp
dec eax
lea eax, [ebp - 0x63577cde]
inc ecx
mov dword [esi + ecx*2 - 0x13254], edx
sub cx, word [esp + ecx - 0x9929]
pop edx
jnp fcn.018803b6

Function at 0x1823ad5
Capabilities:
Encrypt data using speck

Disassembly:
inc esp
xor bl, bh
inc ecx
sal dl, 2
call fcn.01008d79
call fcn.00eb69e9
Function at 0x18413c1
Capabilities:
Encode data using xor

Disassembly:
xor cl, bl
dec cl
inc al
call fcn.017496b8

Function at 0x1845bfe
Capabilities:
Encrypt data using speck

Disassembly:
cmova eax, ecx
lea edx, [eax + edx + 0x191308ba]
call fcn.01742c9b
ror edx, 3
neg al
ror al, 0xc1
lea edx, [edx + eax - 0x3b722bf5]
adc eax, ecx
xor edx, 0x6936990a
neg cl
jne 0x16add87
mov edx, dword [edi]
mov dword [esp], 0xb214a40a
mov ecx, dword [esp]
add edi, 4
xor edx, ebx
xor ecx, 0x6eb60cbf
not edx
movsx eax, cl
sbb dword [esp], eax
lea edx, [edx + eax - 0x676db6b1]
jle 0x16d6ee4
add ecx, esp
jmp 0x184ce7d
mov eax, dword [ecx + eax*2 - 0x3a460a62]
call fcn.01021500
call fcn.017546dc

Function at 0x184c569
Capabilities:
Encrypt data using speck

Disassembly:
xor ecx, 0x679f7c2d
rol eax, 0x39
rol eax, 0xa7
bswap ecx
ror ecx, 2
lea ecx, [ecx + eax*8 + 0x212fd7ee]
xor byte [esp + edx - 0x11], ah
call fcn.00e6a986
or dx, 0xd35
xor eax, edi
dec ecx
or edx, 0x29888309
inc ecx
rol dl, 0xe3
lea eax, [ebp + eax - 0x348d7b2f]
inc ecx
push esp
inc ebp
mov edi, esp
call fcn.01877e91
mov byte [eax], cl
push edx
dec word [esp]
mov edx, dword [edi - 5]
mov ecx, 0xa7a3369e
add edi, 0xfffffffb
add ecx, dword [esp]
sal dword [esp + ecx - 0x6e47a778], cl
sal cl, 5
xor edx, ebx
mov eax, dword [esp + ecx - 0x6e47a700]
ror eax, 0x27
lea edx, [edx + ecx + 0x3e2748b]
sar ecx, 0xf9
call fcn.017f0059
sar cx, 0x25
dec edx
bswap edx
xadd eax, ecx
rol edx, 1
inc edx
shr cx, 8
inc ax
xor ebx, edx
or ecx, 0xa6927fae
push eax
adc esi, edx
mov dx, word [edi + eax*2]
add al, ch
neg byte [esp + eax - 0x7f]
mov cx, word [edi + eax*2 - 0xfc]
shr word [esp + eax - 0x7f], 0xe
neg byte [esp + eax - 0x7f]
or dx, cx
or eax, eax
call fcn.01618bd0

Function at 0x184c665
Capabilities:
Encrypt data using speck

Disassembly:
sub esi, 4
sar edx, 0xcd
mov edx, dword [esi]
xor edx, ebx
call fcn.016d60f7

Function at 0x184c677
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
mov dword [esp + ebx - 0x5b25c021], eax
call fcn.016339b8
mov eax, 0x43083705
call fcn.01897ec4

Function at 0x184c6ec
Capabilities:
Encrypt data using speck

Disassembly:
lea ecx, [edx + ecx - 0x33585044]
mov dword [esp + edx - 0x56000000], 0xa804c588
movzx edx, byte [ecx + edi - 0x55ffae92]
xor dl, bl
sar dword [esp + ecx - 0x55ffae8d], 0x8b
shl dword [esp + ecx - 0x55ffae8d], 0x87
not dl
jnp 0x16a36ba
add ecx, ecx
shr cl, 0xc1
ror dl, 1
lea ecx, [ecx + 0x3e3e3a3f]
jmp 0x174e245

Function at 0x1863bf3
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.0171b62c
lea eax, [edx + eax - 0x191eacb8]
xor ebx, eax
call fcn.00cea2fc
mov eax, 0x2922283a
lea ebp, [ebp + eax*2 - 0x52445078]
jmp 0x16c9019

Function at 0x186991d
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
call fcn.016a0538
mov eax, 0x861efc88
ror ax, 5
movzx ecx, byte [esi]
mov edx, eax
jae 0x18265d5
Function at 0x186aec8
Capabilities:
Encode data using xor

Disassembly:
dec edx
lea ebx, [edi*4 + 0x40a1132e]
dec eax
mov dword [esp + edx - 0x4c3a43f8], edi
dec eax
mov dword [esp + edx - 0x4c3a4400], 0x8218e2b1
dec esp
mov dword [esp + edx - 0x4c3a4400], ebx
sub ecx, ebx
inc esp
adc al, 8
mov esp, 0xc748b3c5
test byte [eax + eax], dl
mov esp, 0xe2b1b3c5
sbb byte [edx + 0x149c894c], al
add byte [ebp + eax*8 + 0x44cb2bb3], bh
xor dword [esp + edx - 0x4c3a43f8], ecx
dec ebp
lea esp, [edi + 0x3f19ac3b]
inc cx
dec eax
dec eax
mov edi, dword [esp + edx - 0x4c3a43f8]
call fcn.00f50d38
outsb dx, byte [esi]
dec esp
adc al, 0xc4
inc edx
js 0x186aed3
mov byte [0x35cecc1f], al
and dword [ecx], 0xce0a3fc5
jmp 0x1a9bcd10

Function at 0x1881399
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov word [esi], dx
call fcn.018511ec
jae 0x17206ff
mov ebx, dword [esp + 0x18]
lea esp, [esp + 0x1c]
ret
push 0x223a2989
adc esi, 4
shrd dx, ax, cl
jmp 0x168cfba
not dl
call fcn.0174f336
mov ecx, 0x650f84bb
mov eax, ecx
mov dx, word [esi + eax - 0x650f84bb]
dec eax
mov ax, word [eax + esi - 0x650f84b8]
sar ecx, 0xcc
add ecx, ecx
mov cl, byte [esi + ecx*4 - 0x3287bc]
jne 0x16e4d88

Function at 0x1887dba
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [edx + ecx - 0xa20082], eax
mov dword [esp + ecx*4 - 0x2880208], edi
ret
pop ecx
mov dword [eax], edx
mov ecx, 0x752db09c
movzx edx, cl
sar dx, 0xec
mov eax, dword [edi + edx + 1]
add edx, 0xa22add1a
xor eax, ebx
neg eax
shl edx, 0x1a
rol eax, 3
and edx, 0xa004043d
inc cl
inc eax
sar cl, 0x82
adc ecx, edx
and edx, 0x652e6b97
not eax
jp 0x171055f
sar word [esp + edx - 0xffaa], 0xeb
lea esi, [esi + edx*4 - 0x3fea4]
mov ecx, 0xa20082
lea edx, [esp + edx - 0xff6f]
jb 0x173058f
dec esp
mov dword [esp + ecx*2 - 0x78e], edi
dec ecx
xor edi, edx
dec ebp
mov dword [esi + ecx*2 - 0x7a6], edx
push eax
dec ebp
lea esi, [esi + ecx - 0x3d7]
xadd dword [esp + ecx - 0x3bb], ecx
dec edx
ror dword [esp + ecx*2 - 0x59], 0x28
inc ecx
pop ebx
inc ecx
pop ecx
pop ebx
inc ecx
pop esp
jne fcn.018803b6

Function at 0x188fe9b
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0xc]
je 0x17a9a77

Function at 0x189060f
Capabilities:
Encode data using xor

Disassembly:
sahf
cli
inc dword [ecx + 0xf]
inc ecx
movsx ebx, al
dec esi
lea ebp, [ecx + ebp + 0x5859a83a]
inc ecx
movsx ebx, al
dec esi
lea ebp, [ecx + ebp + 0x5859a83a]
dec eax
sal ecx, 0x84
dec esp
xor ebx, edi
dec ebp
lea ebx, [ebx + ebp + 0x733f320f]
dec eax
sal ebx, 0x75
dec ecx
bswap ebx
dec eax
mov dword [esp + ebp - 0x7c7a], ebp
dec ecx
dec ebx
dec ecx
ror ebx, 1
dec edi
lea ebx, [ebx + edi*2 + 0x5f22e918]
dec ecx
xor edi, ebx
call fcn.00eb59a9
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
loop 0x189060c
xor dword [ecx + 0x7d], esp
mov word [ecx - 0x6c5e0206], ds
imul ecx, dword [ecx + 0x5c], 0xc2e1421b
fidivr dword [esi - 0x6de57918]
add dh, dh
call 0xbc6320f6
out dx, al
call 0x524b20fc
retf 0xcb40