joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfea1b9
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [edi + edx*2 - 2]
or ax, word ss:[ecx + eax*2]
movzx ecx, dx
neg edx
call fcn.0173b7c3
mov eax, 0xaa952d1e
mov eax, dword [edi]
mov cx, word [eax]
mov eax, 0xb1805c37
movzx edx, ax
lea edi, [edi + edx*8 - 0x2e1b6]
inc dx
mov word [edi + edx*4 - 0x170e0], cx
mov ecx, dword [ebp + edx*2 - 0xb870]
lea eax, [eax*4 + 0x1e9eb0b0]
xor eax, edx
lea ebp, [ebp + edx - 0x5c34]
xor ecx, ebx
jmp 0x176768b

Function at 0xfeff94
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00e9df7e
mov edx, 0xceb761b8
inc esp
movzx esp, dl
inc ebx
mov eax, dword [ebp - 0x174]
dec ebp
lea ebx, [esp + edx*2 + 0x4faaf897]
inc ecx
movzx ecx, bx
xor eax, edi
inc ebp
mov edx, ebx
bswap eax
jmp 0x100e8ae
push edi
inc sp
xor esp, ecx
dec ecx
not ebx
movsx ebp, cx
inc edx
xor dword [esp - 0xbca8], eax
dec eax
rol edx, cl
inc cx
xadd ebx, ecx
pop edi
dec eax
arpl ax, ax
inc ecx
mov edi, 0xd394aa29
call fcn.01866111
neg edx
dec ecx
neg eax
xor ecx, 0xec1e6436
bswap ecx
mov dword [esp + eax*4 - 0x749b26d4], eax
not edx
call fcn.00d0d2fa
mov ax, word [ebp - 2]
mov dx, word [ebp]
inc ecx
add ax, dx
push ecx
neg cx
mov word [ebp], ax
add byte [esp + 7], 0xa5
neg cl
movzx edx, byte [edi + 4]
pop eax
inc cl
add edi, 5
xor dl, bl
rol byte [esp + 2], 0x44
sar ax, 0x85
inc dl
neg dl
or dword [esp], 0x9d93059c
inc dl
push ecx
dec dword [esp + 4]
xor dl, 0x94
neg dl
sar dword [esp + 2], 2
sbb dword [esp], 0xa02b9033
adc dl, 0x3d
not ecx
xor dl, al
not word [esp + ecx - 0x6cc6ff00]
add dl, 0x82
dec word [esp + ecx - 0x6cc6feff]
ror dl, 1
xchg byte [esp + ecx - 0x6cc6fefc], cl
xor bl, dl
or ax, cx
lea edx, [esp + edx + 8]
xor eax, 0xd63fe498
jge 0x18046eb
mov edx, 0x6d1f0b86
lea edi, [edx + edi - 0x6d1f0b8a]
push edx
movzx eax, dx
movsx ecx, ax
mov ecx, dword [edi + eax - 0xb86]
jmp 0x185829e
dec eax
neg edx
inc cx
adc edx, ebx
inc edx
lea eax, [eax + edx - 0x44162992]
ror eax, 3
inc cx
sar esp, 0x23
inc ecx
sar edx, 0xe5
inc ecx
lea eax, [esp + eax - 0x600bedc9]
jbe 0xfe093c
rol edx, 0xf6
mov word [eax + ebp - 0x45061b69], cx
xchg word [esp + edx - 0x19bffffd], dx
movzx ecx, al
lea ebp, [eax + ebp - 0x45061b69]
call fcn.00fe7700
neg ecx
inc ecx
sal ecx, 0x6b
dec edx
mov dword [esp + ebx - 0x55ac0bbe], edi
ja 0xf46795
inc cx
not esp
aam 0x4b
lea ebp, [edx + eax*8 - 0x76e4c3f6]
inc edx
xor dword [esp + ebx - 0x55ac0bbe], ecx
or ebx, 0xdba3cd34
or edx, 0x7121da20
rol dx, 0x8e
pop edi
call fcn.00fb99d2
xor eax, eax
or al, byte [ebp + edx*2 - 0x2495e800]
lea ebp, [ebp + edx*4 - 0x492bd002]
lea edx, [edx + edx*8 + 0x73122e20]
imul cl
add dl, dh
movsx ecx, dx
xor ecx, edx
mov word [ebp + edx*2 - 0x2f6985d6], ax
jmp esi
not cx
mov cx, word [edx + ecx - 0x6cc60011]
movsx edx, al
jge 0x1017143
call fcn.01780017
not eax
dec dx
xor ecx, ebx
dec dl
not ecx
ror ecx, 2
add byte [esp + edx - 0x6d1f0b84], al
and edx, dword [esp + edx - 0x6d1f0b84]
add dx, 0xea2c
bswap ecx
mov word [esp + edx - 0x6d1ff5ae], 0xedb5
neg ecx
neg dword [esp + edx - 0x6d1ff5b0]
xor ebx, ecx
pop edx
add esi, ecx
mov cl, byte [ebp + edx - 0x124af401]
jmp 0x1794d47
Function at 0xff65ee
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esi + ecx - 0x1d57], edx
mov dword [esp + ecx*2 - 0x3aa6], 0x7c3b0497
movzx edx, cx
xor dx, cx
mov eax, dword [edi + ecx*2 - 0x3aab]
xor eax, ebx
ror byte [esp + ecx*4 - 0x754a], 0x24
lea eax, [ecx + eax + 0x4a9ec95c]
bswap eax
inc ecx
lea eax, [eax + ecx*2 - 0x5987e82f]
seto dl
jae 0x168e5af
bswap eax
xor ebx, eax
ror edx, cl
or ecx, 0x1d8ffc15
or edx, ecx
adc ebp, eax
pop ecx
movzx eax, dl
not edx
movzx edx, word [ecx + edi - 0x7cb3049e]
add ecx, ecx
lea edi, [eax + edi - 0x5c]
dec al
dec cx
adc al, ch
xor dx, bx
call fcn.016f2d48
not al
mov ecx, 0xc0204c17
ror al, 1
dec al
ror al, 1
dec al
shr ecx, 0xdb
neg al
call fcn.00cf93b5

Function at 0xffb10f
Capabilities:
Encrypt data using speck

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.0173cca2
inc al
xor bl, al
ror byte [esp + edx*4 - 0x1da43], 0x63
lea eax, [esp + eax + 4]
mov edx, dword [eax + edx*2 - 0xed22]
mov dword [ebp - 0xa], edx
jb 0x17a235e

Function at 0x100200e
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0x121044], ecx
pop ecx
lea eax, [esp + eax + 8]
sub dl, 0xb3
mov edx, dword [eax + ecx*8 - 0x908220]
lea esi, [ecx + esi - 0x121048]
jge 0x1670671
out dx, eax
in eax, dx
dec dword [edi]
lea eax, [eax - 0x1a]
add byte [esi + edx*4 - 0x7a2b5ede], ah
mov dword [0xd56e2626], eax
popfd
movsb byte es:[edi], byte [esi]
xchg esi, eax
and ah, byte [ecx + 0x26a385d4]
outsb dx, byte es:[esi]
aad 0x9d
xchg ebp, eax
push cs
outsb dx, byte es:[esi]
aad 0xbf
lodsd eax, dword [esi]
cmp ah, byte [esi]
outsb dx, byte [esi]
aad 0xc9
xor dword [edx], 0x91d56e26
std
inc edx
outsb dx, byte es:[esi]
aad 0xf3
mov dh, 0x1b
mov dword [eax], edx
jle 0x1002028
dec ebx
invalid
sal dword [esp + ecx*2 - 0x242086], cl
movsx eax, byte [esp + ecx*2 - 0x242085]
mov dword [esi + ecx*2 - 0x242088], edx
rol dword [esp + ecx - 0x121044], 0x77
sar word [esp + ecx - 0x121041], cl
lea edi, [edi + ecx*2 - 0x24208c]
rol dword [esp + ecx*2 - 0x242085], cl
xchg byte [esp + ecx*4 - 0x484109], cl
mov eax, dword [edi + ecx - 0x1210ce]
xor eax, ebx
lea eax, [ecx + eax + 0x4a8cd5e1]
xchg word [esp + ecx - 0x1210cb], cx
call fcn.01730d7b
Function at 0x100ae10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg bl
xor bl, 0xbf
rol bl, 1
dec ebp
sub ebx, edx
inc cx
sal ecx, 0x8e
inc eax
xor bh, bl
dec ax
dec eax
add ebx, esp
dec edx
lea ecx, [0x7eb1c402]
dec edx
mov ebp, dword [ebx + ebx*4 - 0x12bb4]
inc ecx
movsx ebx, cx
inc ebp
sub ah, cl
dec esp
mov eax, ebp
mov edx, eax
and bx, 0xb73a
dec ecx
sal ecx, 0x19
dec esi
lea edx, [esp + ebx - 0x49dd]
call fcn.0161ed12
and ecx, ecx
neg eax
xor ecx, 0xe911abaf
xchg word [esp + edx - 0x5b1faefb], dx
xor ebx, eax
add dword [esp + edx - 0x5b1f5b1f], ecx
setb byte [esp + edx - 0x5b1f5b1f]
sal edx, 0xae
add esi, eax
sal ecx, cl
sete byte [esp + ecx - 0x488d5d18]
mov eax, dword [edi + ecx - 0x488d5d18]
cmovnp ecx, dword [esp + ecx - 0x488d5d18]
mov ecx, dword [eax + ecx - 0x488d5d18]
mov dword [edi], ecx
lea ecx, [edx*8 - 0x29424bef]
pop edx
jmp esi
xor cl, bl
call fcn.0100a4ba
inc ecx
shl ah, 0x25
dec edi
lea ebp, [ebx + ebp - 0x4b18]
inc eax
xor bl, bh
ror bl, 1
inc sp
or ecx, ebp
jno 0xf0afde
sub edi, 4
mov edx, dword [edi]
push 0x537f984
sar word [esp + 1], 0x2e
mov ecx, dword [esp]
xor edx, ebx
lea eax, [ecx + ecx*2 + 0x7a2ba3b7]
and ecx, eax
sub eax, 0xb58a39b1
lea edx, [ecx + edx + 0x17125d08]
call fcn.00edecf8
movzx edx, byte [edx + edi - 0x40000000]
xor dl, bl
ror dl, 1
pop ecx
add ecx, 0x83f3b5
jmp ecx
mov dword [esp + edx - 0x34c000], 0x2108bd02
lea ebp, [edx + ebp - 0x34bffb]
jno 0xfd12b2
Function at 0x100e4dc
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [edi + edx*4 - 0x4cbfdea8]
bswap edx
ror cx, 0x62
mov dword [esp], ecx
xor eax, ebx
inc eax
call fcn.01770bb6
jnp 0x100e571
inc ebp
in eax, dx
aam 0x9c
mov ebp, 0xbdf3ff97
shr byte [edx - 0x7e], cl
rcr dword [edi], cl
dec esi
cdq
and dl, byte [ecx]
popfd
in eax, dx
or al, byte [esi - 0x2f03e9a0]
aam 0xfd
hlt
jns 0x100e550
or al, 0x3d
lodsb al, byte [esi]
jge 0x100e55a
daa
invalid
dec edi
imul edi, dword [ecx - 0x73ff74d2], 0x86e2b002
dec edi
mov byte [0xda1ae14f], al
invalid
mov eax, dword cs:[eax]
mov word [edx], es
mov al, 0xe2
xchg byte [edi - 0x5e], cl
dec edi
loope 0x100e57a
invalid
jecxz 0x100e5a3
cmp dword es:[ebx - 0x43], esi
jb 0x100e58d
mov bh, 0x88
sub eax, 0xc82e5f88
out 8, eax
or eax, 0xb54fb7d2
cdq
loope 0x100e524
push ecx
fsubp st(6)
pop ebx
dec edi
aaa
inc esp
and dword [ebx], ecx
movsd dword es:[edi], dword [esi]
loop 0x100e526
cwde
jne 0x100e59c
in al, dx
lodsb al, byte [esi]
into
int 0x98
test edx, edx
popfd
aas
invalid
lodsd eax, dword [esi]
lodsb al, byte [esi]
jp 0x100e569
out dx, eax
fidiv dword [edx - 0x45]
ja 0x100e613
mov ebx, 0xa0c16d77
retf 0x1b78
shl dword [eax + 0x7a1b78ca], 0x83
clc
push eax
mov bh, 0x87
cwde
mov dh, byte [edx]
stosd dword es:[edi], eax
mov bh, 0x39
jb 0x100e620
aaa
sal cl, cl
sub eax, 0xef2c5776
fcomp st(4)
xor dh, 0xbd
push esp
jg 0x100e553
dec ebx
sal dword [ebx - 0x4597213e], cl
and eax, 0xec9bb491
lodsd eax, dword [esi]
add ah, bh
jmp 0xd072face
mov ecx, 0xfc759ca0
je 0x100e5c6
salc
cmp eax, 0xdfd28500
aam 0x2a
dec ebx
jl 0x100e6a5
mov dl, 0xde
out dx, al
dec ebx
dec esp
adc esp, 0xffffffb5
ljmp 0x5db4
xchg edx, eax
test dword [edi + ebp*8 - 0x75], edi
fstp xword [edi + 0x695e5bb2]
mov edx, 0x27436758
pop eax
inc ebx
daa
inc eax
dec ebp
movsb byte es:[edi], byte [esi]
pop ebp
or eax, 0x90c64e43
cmc
mov cl, 0x6f
aad 0x5e
das
test al, 0xdb
push 0xffffffffffffffd1
cmc
loope 0x100e721
js 0x100e699
js 0x100e6f8
pop ebx
ret 0x5768
fbld tbyte [edi]
inc eax
pop esi
or dword [edi], ebp
inc ebx
cmpsd dword [esi], dword es:[edi]
mov bl, 0x27
and al, bl
mov edi, 0x77dc0a4c
cmp bl, byte [esi]
pop es
pop ecx
call 0x587c4631
add dword gs:[bx + di - 0x53], edx
fild word [eax + 0x23]
sub al, 0x79
mov byte [edi + 0x5b], bh
stosb byte es:[edi], al
mov byte [0x83d32977], al
int 0x5c
stosd dword es:[edi], eax
mov eax, dword [edi - 0x44a489bd]
cmp eax, 0xf1fb5fa4
movsb byte es:[edi], byte [esi]
pop edi
sti
int1
and al, 0xfc
jg 0x100e710
jno 0x100e6c3
test al, 0x9e
mov edi, 0x2682ae75
test dword gs:[edx - 2], esi
jb 0x100e78d
test dword [edi + ebp + 0x6a], esi
mov esp, 0x519ade9f
arpl word [eax + 0x54], bp
or al, 0x75
jb 0x100e6d9
test al, 0x6c
jnp 0x100e77c
stosd dword es:[edi], eax
ret
jae 0x100e785
xchg ecx, eax
cwde
out 0xe3, eax
pop edx
jno 0x100e739
aad 0xf3
xchg esp, eax
xlatb
dec esi
sub esp, esp
mov dword [0x3f6f47ef], eax
out dx, eax
inc edi
outsd dx, dword [esi]
aas
cmp eax, 0xab333160
ret

Function at 0x101158b
Capabilities:
Encrypt data using speck

Disassembly:
pop edx
jg fcn.018803b6
jmp 0x1775eff
Function at 0x1011d57
Capabilities:
Encrypt data using speck

Disassembly:
sub ecx, 0xb98dcabd
inc eax
sub ch, 0x34
inc ecx
dec ecx
ror ecx, 2
inc ecx
sal ecx, 2
not ecx
inc esp
or edx, edx
inc cx
dec edx
inc ecx
lea ecx, [ecx + ecx - 0x6de9e20a]
dec esi
mov dword [esp + ebx - 0x55ac0bbe], ecx
ror ecx, 2
jmp 0x1017165

Function at 0x101b232
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
mov eax, 0x62ab5b3b
movsx ebx, al
rol word [esp + eax - 0x62ab5b36], 0x84

Function at 0x10295fe
Capabilities:
Encrypt data using speck

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x18]
call fcn.01833674

Function at 0x10307df
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, dword [ecx + edx]
mov dword [esp], 0xab1c021e
mov dword [ebp - 4], edx
push eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp]
or edx, eax
not edx
mov dword [ebp], edx
mov eax, dword [edi + 1]
mov edx, 0x848cee1f
xor eax, ebx
ror dl, 4
jb 0x174ca66
mov edx, dword [ebp]
mov ecx, 0x2583a3a8
mov cx, word [edx + ecx - 0x2583a3a8]
mov edx, 0xe8082816
mov word [ebp + 2], cx
add dx, 0xc81a
mov ecx, 0x961f153f
mov ax, word [ebp + 2]
mov cx, word [ebp + 4]
adc ax, cx
movsx ecx, dl
mov word [ebp + ecx*2 - 0x5c], ax
call fcn.016ecf67
mov eax, 0xe18b30e
movzx edx, al
movsx ecx, dx
mov eax, dword [esi + eax*4 - 0x3862cc3c]
xor eax, ebx
ror eax, 1
xadd edx, ecx
call fcn.00e5c682
mov edx, 0x57a388ab
ror al, 1
inc dx
dec edx
xor al, 0xf
or dl, dl
xor edx, edx
dec al
neg al
neg edx
lea edx, [edx - 0xfd2c6ce]
sal edx, 0xf
xor bl, al
call fcn.00d37c1a
neg eax
rol eax, 3
inc eax
not eax
xor ebx, eax
add esi, eax
jmp 0x1773d53
dec eax
sub byte [esp + edx - 0x19e353f], 0x8b
neg eax
sal dword [esp + edx - 0x19e3540], cl
call fcn.016f6496
mov eax, dword [edi + 5]
lea ecx, [edx + edx*4 - 0x5bd244ef]
rol cx, cl
sbb edx, dword [esp + ecx*2 - 0x75dce32b]
lea edi, [edi + edx*8 - 0xcf1aa1f]
shr ecx, cl
sar byte [esp + edx - 0x19e353c], 0x66
jp 0x17778a6
xor eax, ebx
sal byte [esp + edx - 0x19e353b], 0xc5
ror eax, 1
jmp 0x1770b18
Function at 0x10a8e86
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx + 0x4c78117], cl
add byte [eax], al
add byte [eax - 0x5f7b6165], bh
jmp 0x16fc07b
dec dword [edx - 0x75]
jl 0x10a8df8
adc byte [ecx + 0xf], al
mov esi, 0xc28149d0
mov byte [0x41c1b5b8], al
mov dword [esp + ecx*8 - 0x7bb190d0], edx
not dword [esp + ecx - 0xf76321a]
ror eax, 1
xadd cl, dl
jae 0x16c829b
mov edx, 0x2a9722a3
mov eax, edx
movzx dx, byte [ebp + edx - 0x2a9722a3]
xchg edi, eax
sub cl, byte [ebx - 0x49f0993e]
xchg esp, eax
adc eax, 0xd568dd5d
mov cl, byte [eax + ebp - 0x2a9722a1]
lea eax, [eax + eax - 0x1ee6ac75]
lea ebp, [ebp + eax*2 - 0x6c8f31a0]
aad 0x8d
test byte [eax], al
mov edx, dword [ebx + 0x19]
loope 0x10a8e4b
lodsb al, byte [esi]
inc ebp
pushal
into
jo 0x10a8e57
push eax
sal dl, cl
mov ecx, eax
xor cx, ax
rol byte [esp + ecx - 0x3646fffd], 0xc2
mov word [ebp + ecx*2 - 0x6c8e0000], dx
je 0x16a93d9
push ebx
sub eax, esp
or byte [eax - 0x8e5de58], bh
pop esp
inc ecx
mov edi, 0x6044f615
jne 0x10a8eb5
adc eax, 0x193878f6
mov edi, 0x2c04f615
jge 0x10a8ec1
adc eax, 0xfee870f6
and eax, 0x2d056f6
adc al, 0x60
je 0x10a8ea2
add byte [edi + 0x21], 0x9b
enter 0x3fdf, 0x64
test dl, ah
ror dh, 0x36
cmp al, 0xb4
sbb cl, byte [edi + 0x5a173743]
std
dec esp
out 3, eax
jnp 0x10a8f85
std
dec esp
dec ebx
xchg ebx, eax
dec edi
pop edx
std
dec esp
mov edi, 0xfd5a5f97
dec esp
outsd dx, dword [esi]
adc byte [edx], ch
int3
mov bl, 0x5a
std
dec esp
or dword [edi - 0x6d], 0x5a
std
dec esp
arpl word [ebx + 0x4cfd5aa3], cx
xchg ebx, eax
mov ah, 0x2a
int3
sal eax, 0x21
lea edi, [edi + eax - 0x6c8f31a6]
jne 0x1708c50
neg dword [esp + ecx*2 - 0x1eec6434]
neg eax
xchg dword [esp + ecx*2 - 0x1eec6434], edx
call fcn.016dde5a
inc ecx
not ecx
add al, 9
inc dword [esp + eax - 0x1d3ce382]
dec ecx
ror eax, 0x44
xor ebx, ecx
push edx
sub byte [esp + eax - 0x21d3ce31], al
call fcn.01677560
xor edx, ebx
or eax, eax
not edx
movzx ecx, ax
add al, 0x3c
bswap edx
ror cl, 0x21
or eax, eax
ror edx, 1
inc cx
call fcn.010aa3e2
lea eax, [ecx*8 + 0x6b04e386]
not al
mov ecx, dword [edi + eax - 0x1d3ce379]
xor ecx, ebx
neg ecx
movsx edx, word [esp + eax - 0x1d3ce379]
or dx, dx
jne 0x16cce89

Function at 0x10ab6be
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esi + ecx*4 - 0x1b880]
movzx edx, cl
xor eax, ebx
call fcn.016edde1
mov edx, 0xd72bac9d
jmp 0x161d26c
pushal
test al, 0x31
jmp 0x17cefdf
mov edx, dword [ebp]
mov eax, 0x49a517b1
neg eax
mov eax, dword [ebp + 4]
mov ecx, 0x4593bd01
call fcn.017d7f0e
not dword [esp + edx*4 - 0x30ae10ec]
ror al, 1
call fcn.01767816
jno 0x161d217
adc eax, 0x3c1ced90
fcomp st(0)
pop ebx
add esi, esp
push es
cli
clc
invalid
inc ecx
bswap edi
inc ecx
sub edi, 0xbd320096
inc ecx
bswap edi
call fcn.00d4305d
mov ecx, 0x68945ba7
mov edx, dword [esi + ecx - 0x68945ba7]
mov eax, dword [esi + ecx - 0x68945ba3]
or cl, ch
sbb ecx, ecx
xor cl, byte [esi + ecx*2 + 8]
call int.00f88051
push cs
test dword [ebx - 0x519515b7], eax
mov cs, word [edi - 0x7a]
mov dh, 0x12
cli
mov edx, 0xfeb6af5e
invalid
Function at 0x10ae22d
Capabilities:
Encrypt data using speck

Disassembly:
sar ebx, 0x5e
dec ebp
arpl cx, cx
dec edx
mov dword [esp + edi + 0x38a09193], 0x672f9528
inc ecx
push edi
dec ecx
add esi, ecx
inc edx
shl byte [esp + edx - 0x3a7af7e4], 0x44
dec edi
mov eax, dword [esi + edi*2 + 0x7141232e]
inc edi
movzx ebx, byte [ebp + edx - 0x3a7af7e9]
dec edx
mov dword [esp + edi + 0x38a091ab], 0x65046cad
dec edx
mov dword [esp + edi + 0x38a091a3], 0x4c9982af
dec edi
lea ebp, [ebp + edi + 0x38a0918e]
js 0x163191c
and dx, cx
ror eax, 1
inc edx
shl cl, 0x64
jbe 0x16d0564
inc dx
sub dword [esp + edi*2 + 0x71412333], 0x814a4720
mov ah, 0x3c
mov eax, dword [0xbf38a091]
xchg byte [edx + ebp*2 + 0x41df3244], bl
inc bl
not eax
inc ecx
ror bl, 1
inc ecx
xor bl, 0xa8
inc ecx
ror bl, 1
pop ecx
inc ecx
xor bh, bl
dec esi
lea ebx, [esp + ebx + 0x18]
inc edx
xchg dword [esp + edi + 0x38a09196], ecx
dec edi
mov dword [ebx + edi*2 + 0x71412326], eax
push ebx
pop ebp
inc ecx
push edx
dec edx
lea edx, [esp + edi*2 + 0x7141234e]
inc dx
sub dword [esp + edi + 0x38a091a0], 0xf46b92b
mov edi, 0x23357c8c
inc ecx
jno 0x16319dc
dec edx
mov ebp, dword [edx + edx*2 - 0x74f5efc8]
dec ebx
mov dword [esi + edi*2 + 0x7141232e], ebp
inc dx
neg dword [esp + edi + 0x38a0919b]
push eax
call fcn.00f74c97
xor ebx, edx
mov ecx, dword [esp + 4]
add ecx, 0xff8266ba
jmp ecx
add dl, byte [eax - 0x3f]
enter 0x49da, 0x66
mov dword [esp + eax*2 - 0x27001843], edx
neg eax
and ecx, 0x3d92bc1a
sal cl, 0x65
dec dx
rol eax, 2
sub dl, dl
inc eax
rol eax, 3
call fcn.0187d575

Function at 0x10aff95
Capabilities:
Encode data using xor

Disassembly:
pop es
scasd eax, dword es:[edi]
mov byte [edi - 0x4d], bl
ret
call ecx
ror dword [edi], 0xca
rol ecx, 1
bswap edx
mov dword [esp + eax - 0x36], 0x7327383e
bswap ecx
inc dword [esp + edx - 0x3606061b]
or byte [esp + edx*2 - 0x6c0c0c33], dl
lea ecx, [ecx + edx*4 + 0x89ed648]
xchg dword [esp + eax - 0x36], eax
push edx
rol ecx, 1
dec edx
call fcn.016e9b74
add byte [ebp - 0x6d], al
add byte [eax + 0x361e7b87], al
ja 0x10aff58
insd dword es:[edi], dx
jno 0x10afffd
fiadd word [esi - 0x34]
test byte [edx - 0x27], ch
jns 0x10afff0
outsd dx, dword [esi]
lodsd eax, dword [si]
fstp xword [edi]
retf 0x6fc3
mov byte [edi], bh
fcomp dword [eax + 1]
movsb byte es:[edi], byte [esi]
aaa
aas
xchg esp, eax
jnp 0x10aff94
sbb dh, dh
invalid
test byte [ebp + 0xe62b2c0], 0x5e
rcl byte [ebp - 0x42], cl
push esi
sbb ch, byte [ebx - 0x56ccf9fd]
or al, 0xd5
push ds
rol edi, 0x37
push 0xffffffffffffffda
mov cl, 0xb4
or bl, byte [edi + 0x32d3d214]
wait
mov bl, 0x78
inc edx
mov esp, ebx
adc byte [esi], 0xa4
push 0x41
sub dword [0x91d78c2b], esi
sub eax, 0x9d788c1b
xchg esp, eax
out dx, al
invalid
Function at 0x161002a
Capabilities:
Encode data using base64

Disassembly:
jno 0x16e860c
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 8]
je 0x16e8613
mov eax, 0xe919c622
inc eax
inc eax
mov eax, dword [ebp + ebx*4]
push 0xaa12ceb8
mov dword [esp], eax
js 0xfa0f1c
inc esp
xor dword [esp + ebp*4 - 0x3fff4], ebx
dec eax
mov edi, dword [esp + ebp - 0xfff7]
dec esp
lea esp, [ebp + ebp*4 - 0x2f54ce7b]
dec ebp
arpl bx, bx
inc ecx
rol edx, 0x55
inc ecx
push ecx
dec ecx
adc esi, ebx
neg bl
jnp 0x1865579
dec ebx
jne 0x161003a
mov eax, 0xb40df624
not ax
not eax
mov eax, dword [ebp + eax - 0x4bf2f624]
jmp fcn.00f2f824
inc edx
movzx ebp, byte [ebp + ebp - 0x10007]
dec edx
mov dword [esp + ecx - 0xffef], 0x53b097a0
inc ecx
xor ecx, 0x79aa699b
inc edx
rol byte [esp + edx - 0x63a0000b], 0x64
dec edi
lea ebp, [ebp + ecx - 0x79aa966c]
inc edx
sal byte [esp + edx - 0x639ffffd], 0xc7
call fcn.01856c27

Function at 0x161a154
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
dec esi
lea eax, [ecx*2 + 0x22111695]
inc eax
xor dl, bh
inc ecx
pop esp
ror dl, 1
neg dl
inc ebp
movzx edx, di
dec edi
lea eax, [eax + ebx - 0x47526d56]
inc ebp
xadd ah, dl
xor dl, 0xbf
rol dl, 1
jmp 0x1891a0c
inc ecx
neg cl
dec eax
mov dword [esp + ebx*2 - 0x11c92], ebp
dec ecx
xor ebp, dword [esi + ebx*4 - 0x2391c]
dec esp
xchg dword [esp + ebx - 0x8e49], ecx
inc sp
or edi, eax
dec esp
or edx, ebp
dec esp
lea edi, [eax*4 + 0x59fa51d]
dec ecx
not edx
inc cx
ror ecx, 0x29
dec ecx
mov eax, edx
dec esp
lea edx, [esp + ebx - 0x8dd1]
dec ecx
mov dword [edx + ebx*2 - 0x11c92], eax
inc ecx
movzx edx, byte [ebp + ebx - 0x8e4e]
inc ebp
movzx ebx, di
dec ebp
lea ebp, [ebp + ebx*2 - 0x11c97]
jae 0x1009a7f
call fcn.01621a84

Function at 0x161ca40
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
mov cl, byte [esi + edx - 0x2cac2cad]
dec ebp
lea esi, [esi + edx*2 - 0x59585968]
inc edx
je fcn.0100adee
dec ecx
sal edi, cl
inc esp
movzx edx, dx
inc esp
movsx ebx, dx
dec ebp
mov dword [esi + edx - 0x2cac2cb6], edi
dec edx
lea eax, [ebx*4 + 0x100a8b29]
push edx
dec edi
lea ebp, [ebp + edx - 0x2cba]
dec esp
lea edi, [eax + eax*8 - 0x3c7c39f7]
inc esp
add dl, al
inc ebp
mov edi, dword [ebp + edx*2 - 0x5958596c]
movzx ebp, word [esp + edx*2 - 0x59585969]
dec esp
lea eax, [eax*4 + 0x643cb08d]
inc esp
xor edi, edi
inc edx
xor dword [esp + edx*2 - 0x596b], 0x90083b07
inc ecx
dec edi
inc eax
xchg byte [esp + edx - 0x2cac2cb1], ch
dec esi
xadd dword [esp + edx*4 - 0xb2dc], eax
inc ecx
push eax
inc ecx
neg edi
call fcn.0101e8e5
mov word [edx], cx
mov edx, dword [esp + 3]
xchg dword [esp + 8], edx
call fcn.00ee2ec7
neg dx
inc esp
xor bl, ch
pop eax
inc ecx
xadd bh, cl
inc ecx
bswap edx
inc ecx
xor bh, bl
inc sp
and edi, ebp
xadd ebx, ebp
dec esi
lea ebx, [esp + ebx + 0x28]
dec eax
neg ecx
xadd word [esp + ebx - 0x7fffffcb], cx
inc esi
mov ecx, dword [ecx + ebx + 0x10000]
bswap edx
dec esi
lea eax, [edi*8 + 0x4f1cc11d]
call fcn.00fbb00c
mov edx, 0x2cac2cb5
dec ebp
mov edi, dword [esi + edx*2 - 0x5958596a]
jmp 0xee2aca

Function at 0x161ed12
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.00d05fcd
call fcn.00f7d13b
Function at 0x161ed47
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + ecx - 0x193fcf01], 0x230d212
neg al
sub dword [esp + ecx*4 - 0x64ff3bfc], ecx
inc cx
xor bl, al
dec ecx
call fcn.01780997

Function at 0x161ed66
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
bswap ebp
mov ebp, esp
bsr edx, eax
neg dh
mov edx, dword [ebp + 8]
test edi, 0xaa34afa4
sub esp, 0x114
push esi
test edx, edx
je 0xf7b4c4
mov esi, dword [ebp + 0xc]
cmp bx, si
test dx, sp
test esi, 0x68a38f37
test esi, esi
jmp 0xf75e78

Function at 0x1620851
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [edi + 4]
not cx
je 0x17fb905
movsx eax, cl
mov cl, byte [edi + 8]
shl edx, cl
mov ecx, eax
bswap eax
mov dword [edi + 6], edx
call fcn.00e8add2
shr ebx, 0xc1
inc eax
xor bh, dl
dec eax
lea edx, [esp + edx + 8]
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x14]
call fcn.00ec1f47
xor eax, ebx
rol dx, 0x2e
sbb dl, 0xae
ror eax, 1
inc eax
xor edx, ecx
sub cl, 0xa5
neg eax
sal edx, 0xed
xchg edx, ecx
sbb eax, 0xe007b8b9
dec edx
xor ebx, eax
add esi, eax
sal edx, 0xad
jne 0xf7b8c7
shl byte [esp + 0xa], 0x24
ror cl, 1
ror byte [esp + 2], 0xe3
sar dword [esp + 8], 0x32
xor cl, 0xb8
sal word [esp + 6], 0x8f
rol cl, 1
push edx
call fcn.01759a2c
neg dl
add dl, 0x3d
mov ecx, 0xad85cb1b
not dl
xor ecx, 0x71995b8d
pop eax
adc dl, 0x82
sub ecx, eax
call fcn.00fdc948
dec cl
shl dx, 2
call fcn.00fd60af
inc ebx
movzx edx, byte [ebp + ecx*2 - 0x7576fb68]
inc esp
adc dl, cl
inc esp
cmovs edx, ecx
inc eax
xor dl, bh
dec dl
inc ecx
movzx ebp, bx
rol dl, 1
inc cx
xchg ecx, ecx
inc eax
sar ch, 0x61
xor dl, 0x1d
inc ecx
push edx
inc ecx
xor dl, bh
inc edx
ror byte [esp + eax*2 - 0x7577db44], 0x46
jae 0xfdb764

Function at 0x1622157
Capabilities:
Encrypt data using speck

Disassembly:
movsx edx, word [esp + ecx - 0x180023]
mov word [edi + ecx - 0x18002f], ax
call fcn.0175bd72

Function at 0x1623eca
Capabilities:
Encrypt data using speck

Disassembly:
mov word [ecx + edi - 0xcd3c], ax
call fcn.0161f571

Function at 0x162f450
Capabilities:
Encode data using xor

Disassembly:
shr al, 0xc7
lea esi, [esi + eax - 0x5f75a608]