joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1637ed9
Capabilities:
Encrypt data using speck

Disassembly:
neg ecx
shr al, 0xc3
xor ecx, 0xbc951f39
call fcn.01725b40
shl ecx, cl
lea edx, [ecx*8 - 0x35efd2d9]
lea eax, [eax + ecx*4 + 0x25b8b4bc]
xor ebx, eax
mov dword [edi + ecx*2 - 0x43317ffc], eax
mov eax, dword [esp + ecx - 0x2198bffc]
lea edi, [edi + ecx*2 - 0x43317ffc]
neg dl
mov dword [esp + ecx - 0x2198c000], esi
ret 4
rol dword [esp + 3], 4
mov dx, ax
mov eax, 0x7f1f7c35
or eax, dword [esp + eax - 0x7f1f7c2f]
movzx dx, dl
pop ecx
and cx, word [esp + eax - 0x7f5f7c30]
sal ecx, 0x5d
mov al, byte [esi + eax - 0x7f5f7c35]
adc dl, al
add byte [esp + 1], cl
mov word [esi], dx
call fcn.00f3a423
not ecx
ror eax, 0xa
shr edx, 0xd5
sar dl, 0x87
lea ecx, [ecx + edx*2 + 0x609966b4]
jnp 0x16b3863
rol ecx, 1
push edx
xor ebx, ecx
dec word [esp + edx*4 + 2]
shr word [esp + edx*4 + 4], 0x69
adc ebp, ecx
lea edx, [esp + edx + 0x48]
xchg dword [esp], eax
ror dword [esp + 1], 0x57
or word [esp + 2], ax
xor al, byte [edx]
jmp 0xfd1ec2
lea edx, [ecx + ecx*2 + 0x4988a097]
xor eax, 0x52476b9
call fcn.016bd1bf
push 0x4da4069b
mov edx, dword [ebp]
call fcn.00fc55cc
ror dl, 0xa2
mov eax, edx
rol ecx, 3
sal dword [esp + edx - 0x98e0], 0x25
dec ecx
dec eax
add eax, 0x293ae99b
jno 0xff667d
xor ecx, ebx
mov eax, edx
ror ax, 0x8f
lea ecx, [eax + ecx + 0x20b4844]
sbb dx, 0xe815
jo 0xe5c48b

Function at 0x163dc7e
Capabilities:
Encrypt data using speck

Disassembly:
xor cl, 0x83
mov dword [esp + 4], 0xf396e8e
rol cl, 1
call fcn.017f065b
mov ecx, esp
and cl, 0x37

Function at 0x164b0a1
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + edi*8], edi
jl 0xe818c9
inc ebx
mov ecx, dword [ebp + eax - 0x548c6792]
mov ebp, 0x87bc4301
xor ecx, edi
jmp 0xf759dc

Function at 0x165391b
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + ecx - 0x67b395a9]
neg cl
not cl
push eax
sbb ecx, edx
ror edx, cl
popfd
add ecx, edx
jne 0xffae59
sbb dx, dx
mov eax, dword [esi + edx - 0x63030000]
lea esi, [edx + esi - 0x6302fffc]
dec ecx
xor eax, ebx
and cl, ch
sar cl, 0x81
or dx, cx
ror eax, 1
bswap edx
not eax
or ecx, ecx
sar cx, 0xcc
bswap eax
sar cl, 0xa2
lea eax, [eax + ecx - 0x4b4d1bf7]
xor ebx, eax
add ebp, eax
call fcn.0175e7b6
ror dx, 0xc2
add ebp, ecx
mov esi, dword [esi + edx*8 - 0x1be1600]
xor byte [esp + edx*2 - 0x6f8574], 0xe
pop edx
pop ecx
pop ecx
pop ecx
jle fcn.0176abf9
sub ecx, 0x98353b1f
shr dx, 0xa2
and edx, edx
xor ebx, ecx
inc dx
sub dx, dx
sub edx, edx
adc edi, ecx
call fcn.01720503
mov edx, 0x67b39518
mov eax, dword [edi + edx - 0x67b39518]
mov ecx, edx
xadd cl, dh
jno 0xf5296c
mov ecx, 0xfa98e90d
movsx edx, cx
mov ecx, dword [ebp]
xor ecx, ebx
call fcn.00eae7c2
Function at 0x165b8a6
Capabilities:
Parse pe header

Disassembly:
inc esp
inc edx
mov cl, byte [ecx + esi - 0xcdd4]
inc ecx
shr al, cl
dec eax
lea ecx, [edx*4 - 0x61de6ad4]
inc sp
xadd ebp, edx
inc si
mov dword [ebp + esi - 0x755], eax
push ecx
inc ebp
mov ebx, dword [ebp + ebp - 0x75a]
add dword [esp + ebp*2 - 0xe9f], ecx
dec esi
lea ebp, [ebx + ebp - 0xf6a47e]
inc esp
xor ebx, edi
mov eax, 0x1c91e7bb
inc ecx
sub ebx, 0xb98dcabd
dec esp
xchg dword [esp + ebp*2 - 0xea1], edx
inc ecx
ror ebx, 2
inc ecx
not ebx
inc ebp
lea ebx, [ebx + ebp*2 - 0x1739c1c0]
inc cx
not edx
dec ebp
lea edi, [ecx - 0xaf3a655]
inc ecx
ror ebx, 2
sar dword [esp + ebp - 0x74b], cl
inc ebp
movzx esp, dl
dec ecx
lea ecx, [ecx + ecx*2 + 0xc1fdba9]
inc ecx
neg ebx
dec dword [esp + ebp*2 - 0xea6]
inc esp
and byte [esp + ebp - 0x73d], ah
dec eax
mov dword [esp + ebp - 0x73d], edi
rol word [esp + ebp*2 - 0xe9f], cl
inc esp
mov eax, eax
inc esp
xor dword [esp + ebp - 0x73d], ebx
and dword [esp + ebp - 0x742], ebx
ror word [esp + ebp*4 - 0x1d4c], cl
jne 0x1682f7c
movzx eax, byte [esi + edx - 0x57]
call fcn.00fa2450
inc ecx
mov eax, 0x48832aaa
dec ebx
mov ecx, dword [eax + esi - 0x48832aaa]
dec esi
mov ebx, dword [ecx + eax - 0x48832aaa]
inc ecx
mov edx, eax
dec ebp
mov dword [esi + edx - 0x48832aaa], ebx
inc edi
mov ecx, dword [eax + ebp - 0x48832aae]
xor edx, 0x4b97e28
jg 0xd32bda
push 0xe784b235
sub esi, 4
mov edx, dword [esp]
jmp 0xfd2151
lea ecx, [edx*8 + 0x330dfc8d]
mov eax, dword [esi + ecx - 0x6f338e35]
xor ecx, ecx
jns 0x167080c
inc sp
movzx ebx, byte [eax + ebp - 0xd51a]
inc bp
mov eax, ebx
inc ecx
mov edx, 0xac8e323b
dec eax
mov dword [esp + ebp*4 - 0x35468], 0x65aa50a0
inc bp
movzx eax, al
push ecx
inc cx
sbb ecx, edx
jb 0xebbeda
jmp 0xfbe9ec
lea edx, [ecx + edx + 0x381d2418]
xor eax, ebx
ror cx, 6
inc eax
jmp 0x17e517a
dec eax
mov edi, dword [esp + ebp - 0x73d]
inc sp
adc dword [esp + ebp*4 - 0x1d40], esp
call fcn.0165aceb
add esi, dword [ecx]
and eax, esi
dec esi
push esp
or byte [0x204803f6], ah
xor al, 0x61
test byte [ebx], 0x48
jo 0x1683017
test byte [ebx], 0x48
lea esi, [ebp + edx*2 - 0xa]
add ecx, dword [eax + 0x50]
insb byte es:[edi], dx
inc ebp
cmc
cld
mov dh, 0x5a
cmp byte [ebx], bh
cmc
rcl dword [edx - 0x601cd3dd], cl
fst qword [ecx - 0x26da5b4d]
cli
cmp eax, 0x29e5bdb9
jg 0x1682fd3
and eax, 0xee96fb61
cwde
sub bl, bl
mov ebx, 0x8faad0a0
or al, 0xee
cmp byte [ecx - 0x708806cd], al
mulps xmm4, xmmword [0x16d1e542]
invalid
cmp al, 0x41
call fcn.00fb3dc2
bswap edx
not edx
movzx eax, cx
or eax, 0x2f9c5230
ror cx, 0x25
xor ebx, edx
add ebp, edx
movsx edx, al
movzx eax, byte [esi + eax*2 - 0x5f38e76a]
and dl, dl
js 0x17bbe76
ror eax, 1
rol edx, 0xad
lea eax, [eax + ecx - 0x77b0cf3f]
neg eax
neg edx
dec eax
rol eax, 1
lea edx, [ecx + ecx*4 + 0x7c027a3e]
xor ebx, eax
and dx, 0xc132
adc edi, eax
lea eax, [ecx + edx + 0x18098f8f]
add cx, word [edx + ebp - 0x7c024032]
push eax
mov ax, word [ebp + edx - 0x7c024030]
call fcn.016bcf28
adc esi, 1
lea ecx, [edx + ecx*2 + 0x48281a25]
xor al, bl
or ecx, edx
add cx, cx
sub al, 0x3c
ror dl, 0x64
adc edx, ecx
ror al, 1
call fcn.0162850b
add cl, cl
jns 0x16d6463
Function at 0x16661ec
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov dword [ecx + ebp - 0xffd2], eax
mov eax, dword [edx + edi - 0x141be52d]
add edx, edx
not ecx
mov dword [esp + edx - 0x2837ca52], 0x19b6c125
xor eax, ebx
ror dx, cl
setb cl
rol eax, 1
jmp 0x18046ff

Function at 0x1668078
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x67
daa
popal
retf
xor byte [edi - 0x2f962eb0], 0xd8
or dl, byte [ebx]
jne 0xe25b7c
xchg ebp, eax
sar dword [ebp + 0x1c8a2137], 0x7b
dec ebx
sbb bh, bl
cmp bl, dl
push cs
mov byte [edx + 0x17632c3], dh
xor dword [edx - 0x50ecb5e3], esp
invalid
rol ecx, 1
mov dword [esp + eax - 0x405a5d87], eax
dec ecx
xor edx, dword [esp + eax - 0x405a5d87]
seto byte [esp + eax - 0x405a5d87]
xor ecx, 0x9f99a9b1
inc ecx
xor ebx, ecx
push eax
add esi, ecx
sar al, 0x86
mov edx, dword [ebp + eax - 0x405a5e07]
add eax, 0xbfa5a1f9
lea ebp, [ebp + eax - 0x405a5e07]
or eax, eax
movzx ecx, ax
xor edx, ebx
add ax, 0xdc38
bswap edx
inc edx
ror al, 6
xor edx, 0xef00aca0
sub edx, 0xfea41d89
neg edx
add eax, 0x8096620
cmovle cx, word [esp + eax - 0x4863a0f8]
call fcn.01794212
add al, 8
pop edi
pushfd
mov bh, 0xe8
xor al, cl
adc al, byte [eax]
jne 0x16680a2
fadd qword [ecx]
xor dword [ebx - 0x461ee7f5], 0x1ae08f26
loope 0x16680ff
jp 0x16680d6
loopne 0x166810f
loope 0x166811d
inc esi
xchg edi, eax
loopne 0x1668115
loope 0x16680cb
mov bh, 0xe0
sbb ah, cl
and bh, byte [esi]
sahf
loopne 0x166811b
loope 0x1668125
sahf
sbb ch, byte [ebp + 0x38e7241b]
fmul dword [ecx]
retf 0x2148
sbb esp, dword [edi]
cmp al, bl
or edx, ecx
dec eax
and ebp, edi
mov ebx, 0x5f5eb9c0
pop edi
pop esi
leave
frndint
mov al, byte [0xe9a1e860]
jno 0x1668107
pushal
call 0xe7d86ac2
mov eax, dword [0x5ae671e9]
pop edx
invalid
inc esi
mov dword [eax + 0x1a220387], ebp
pop edx
mov dword [eax - 0x64844079], ebp
sub ch, byte [0x8fd16e4f]
dec edi
mov es, word [edi]
jp 0x166810f
out 0x87, eax
jle 0x16681b4
sar dword [edi], 1
fild dword [edx + 0x7e]
jno 0x166811b
cmp al, 0xbb
xor bh, byte [esi + 0x71]
shr edi, 1
mov bh, 0x16
jle 0x16681c6
sar dword [edi + 0x33f3e0cb], 1
jo 0x1668171
push cs
cmpsb byte [esi], byte es:[edi]
mov bl, 0x39
aaa
salc
dec edx
int 0x4b
mov eax, 0xee0a9f17
dec ecx
frndint
mov al, byte [0x1d8bc78]
fadd dword [ecx]
jno 0x166815b
pop edx
cli
aaa
invalid
cwde
adc esi, dword [esi + 0x6da4c6de]
sti
sar dword [esi], 0x19
sub eax, 0xdb0bfd0f
jl 0x1668212
xor dword [ebx + 0x6f], eax
sbb byte [ecx], bh
dec edi
cmp bl, byte [ebp - 0x23]
cld
ror dword [edx], cl
xchg byte [esi], cl
mov esi, 0xc7617610
xchg esi, eax
sbb esp, dword [ebx]
xlatb
dec ecx
cmpsb byte [si], byte es:[di]
cdq
retf
pop esp
wait
xchg ebp, eax
inc edx
fdivr qword [edx + eax*2 + 0x39f0a440]
sub eax, 0xdda9e9
mov cl, 0xbc
jmp 0xe25be8
Function at 0x166849f
Capabilities:
Encode data using xor

Disassembly:
rol eax, 3
shr edx, cl
add ecx, 0xa58eaf02
shl cx, cl
bswap eax
xchg edx, ecx
inc cx
xor ebx, eax
inc edx
add ebp, eax
mov edx, dword [edi + ecx - 0xbd0]
or ecx, ecx
lea eax, [ecx + ecx*2 - 0x35c5bc79]
shr al, 0x62
mov cl, byte [edi + ecx*2 - 0x179c]
ror al, 0x63
lea eax, [eax + eax + 0x5dbe2c15]
add edi, 6
or ax, ax
jp 0x17645a2
call fcn.00f4e7f5
mov edx, 0x2f3d338d
movsx eax, dl
lea esi, [ebx]
cmp eax, 0xc2be0f2f
lea esi, [esi + edx*2 - 0x5e7a671e]
mov eax, dword [esi + edx - 0x2f3d338d]
mov ecx, edx
xor eax, ebx
and ecx, 0xcd08ce09
bswap eax
ja 0x16bb353
test byte [edx], bl
mov dh, byte [ecx - 0x3972d5ee]
test al, 0x7b
test byte [edi + 0x3e], bl
dec ebx
sub dword [eax], 0xffffff9d
fsubrp st(7)
mov dh, 0xb
out dx, al
loopne 0x16684a5
mov cl, 0xbf
jmp 0xeff5ac43
xor eax, 0xc5b9d22e
sar edx, cl
neg eax
inc edx
setnp dl
jge 0xedfa4b
mov byte es:[edx], cl
js 0x17ff9d3

Function at 0x1669af3
Capabilities:
Encode data using xor

Disassembly:
add byte [esi - 0x77], cl
test ah, al
push eax
lahf
invalid
dec esi
mov dword [esp + eax*8 - 0x150060b0], eax
inc ebp
mov ecx, eax
dec edi
lea esi, [esi + eax*2 - 0x540182a]
inc esi
mov edx, dword [esp + eax*2 - 0x540182a]
inc ecx
movzx ecx, dx
call fcn.00febb7a
fisttp dword [edi - 0x3aeab109]
aad 0x66
sbb dword [ebx], edx
mov cl, 0xbc
mov ah, 0x18
aad 6
mov cl, 0x5c
push esp
or ch, dl
push es
mov cl, 0x8c
pushal
xor ch, dl
push es
mov cl, 0xb4
les edx, [eax - 0x2b]
push es
mov cl, 0xd4
sbb dword [edi], eax
jb 0x1669af2
out dx, eax
invalid

Function at 0x166a5f7
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
mov word [esi + edx], cx
xchg edx, eax
movzx edx, word [ebp + eax + 1]
push eax
xor word [esp + eax], ax
xor dx, bx
mov ecx, 0x8c273b05
rol dx, 1
neg dx
shr al, 0xa5
push eax
inc cl
ror dx, 1
inc dx
not dx
xor bx, dx
dec eax
ror ecx, 0xba
inc eax
mov word [esi + eax*2 - 2], dx
lea edx, [ecx + ecx - 0x22e11a65]
inc dl
not word [esp + eax*4 + 1]
lea esi, [esi + eax*2 - 2]
bswap eax
call fcn.0175b7d5
ror eax, 3
mov dword [esp + edx*4 - 0x73720000], 0x83a21d8d
shr dword [esp + edx*4 - 0x7371fffc], cl
jae 0x188d121
xor ebx, eax
bswap ecx
pop edx
add ebp, eax
mov eax, dword [esi + ecx*8 - 0x8000000]
call fcn.00fe3e40
lea esi, [edx + esi - 1]
movzx eax, byte [esi + edx*2]
or edx, 0x738ce720
xor al, bl
sal dl, 0xc2
ror al, 1
add dx, dx
sub al, 0xaa
xor edx, 0x6baa353a
dec edx
rol al, 1
push edx
xor al, 0x3c
sal dword [esp + edx - 0x1826fa39], 0x42
call fcn.016e4863
and al, byte [esp]
mov cx, dx
movzx cx, cl
mov al, byte [esi]
mov edx, dword [esp]
not cl
pop edx
not al
sub dx, dx
ror dl, 0xe1
shl edx, 0xf0
and cl, al
lea eax, [edx + 0x343fb528]
not al
jmp 0xfcc067

Function at 0x166b8a0
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + esi - 0x5f03]
mov dword [esp + esi*2 - 0xbe62], 0x1dbd3d8f
mov dword [esp + esi - 0x5f33], ebp
not edi
call fcn.016cc437
Function at 0x1680000
Capabilities:
Encrypt data using speck

Disassembly:
and ecx, ecx
mov ecx, dword [esi - 4]
movsx edx, ax
xor dx, ax
xor ax, word [ecx + edx]
mov word [esi + edx*8 - 2], ax
mov dword [esp + edx], 0x228293f
movzx ecx, dl
inc word [esp + edx]
lea esi, [esi + edx*4 - 2]
neg word [esp + edx + 1]
pop ecx
js fcn.01713832
sub eax, 0xe1b62287
sar word [esp + 4], 0x29
call fcn.00f01745

Function at 0x1680ebb
Capabilities:
Encrypt data using speck

Disassembly:
xor eax, 0x551a7289
not ecx
xor ax, dx
ror eax, 0x1a
mov dword [esp + edx - 0x1200000], edx
rol ecx, 1
add dword [esp + edx*8 - 0x9000000], 0x5c114693
sbb ax, dx
not ecx
add word [esp + edx*4 - 0x47fffff], ax
rol ecx, 2
inc byte [esp + edx*2 - 0x2400000]
call fcn.0178f1dd

Function at 0x1688225
Capabilities:
Encrypt data using speck

Disassembly:
pop eax
dec dl
rol dl, 1
push 0x54a92b14
pop eax
xor dl, 0x8c
sub eax, 0xc7b7c002
shr dword [esp + 2], 0x5f
xadd dword [esp + 3], eax
dec dl
not dword [esp + 4]
or byte [esp + 2], ah
inc ax
neg dl
sar eax, 0xb6
call fcn.016252e8
inc edx
xor ecx, dword [esp + eax*2 - 0x3931828]
neg edx
xor ebx, edx
add ebp, edx
lea edx, [ecx*4 - 0x50cef9fb]
rol ecx, cl
jae 0x1650cc3

Function at 0x168a756
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 4], eax
mov dword [esp], 0xfc1d8b99
test ebx, ebx
lea esp, [esp + 4]
je 0x18937fa

Function at 0x168a950
Capabilities:
Get number of processors

Disassembly:
or al, ah
xor dword [esp + eax*2 - 0x472b615a], eax
neg ecx
inc ax
mov dword [esp + eax - 0x2395b0b2], 0x7a0ee72e
lea eax, [eax*8 - 0xbf41e77]
not ecx
jne 0x17196f2
call fcn.016bcaef
lea edx, [eax + eax*4 - 0x6674d5c2]
sub ecx, 0x8e136319
call fcn.0163daae
xor ebx, ecx
and dword [esp + 1], 0x363897a9
mov edx, 0x54b2131d
adc esi, ecx
call fcn.01769063

Function at 0x168c448
Capabilities:
Encrypt data using speck

Disassembly:
sbb eax, 0xb41fba82
pop edx
jmp 0x175bd36
mov dword [esp + edx - 0x3c5f57f2], ecx
neg eax
add dl, byte [esp + edx - 0x3c5f57f0]
jl 0xeafe4c
or edx, 0x3b3994b7
xor ebx, eax
add esi, eax
neg ecx
add ecx, esi
jmp ecx

Function at 0x168eb83
Capabilities:
Encrypt data using speck

Disassembly:
add esi, ecx
mov eax, dword [edx + ebp - 0xff]
movzx ecx, byte [esp + edx*2 - 0x1fe]
lea ecx, [edx*2 - 0x494e7643]
mov dword [esp + edx*4 - 0x3fc], ebx
sub cl, dl
call fcn.0168b6b3
jmp 0xd24d6a
not dl
xor ecx, 0x6787c7a2
xor ebx, ecx
mov dword [esp + edx*8 - 0x7f8], eax
jmp 0x168b2cc

Function at 0x1693ddb
Capabilities:
Get number of processors

Disassembly:
call 0x16cce7e
xor edx, ebx
rol eax, 0xa7
inc edx
neg edx
rol eax, 0xa1
not edx
dec eax
rol edx, 1
bswap edx
sar eax, 0x64
movsx ecx, ax
not edx
ror cx, cl
xor ebx, edx
add ebp, edx
mov eax, dword [eax + edi - 0x5e6340b]
movsx edx, cl
sar edx, cl
mov dword [esp + ecx - 0x8166], edx
mov dword [esp + ecx*2 - 0x102cc], ebx
lea ecx, [edx + ecx + 0x6cb6e817]
neg cx
cpuid
jno 0xf709af
Function at 0x1696db3
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using speck

Disassembly:
xadd cl, al
neg edx
mov dword [esp + ecx - 0x6bf164e], 0x90a387b2
dec cx
sub edx, 0x79b4f818
shl cx, 0xc3
dec byte [esp + ecx*2 - 0xd7f6505]
ror edx, 3
bswap edx
lea eax, [eax + ecx*4 + 0x58b4ee90]
xor ebx, edx
shr ecx, 0xcd
mov dword [esp + ecx - 0x35f1], ecx
add esi, edx
pop ecx
movsx ecx, ax
movzx cx, byte [ebp + ecx*2 - 0x52a]
movsx edx, ax
call fcn.01784780
shr dx, cl
add ax, ax
mov word [ebp + eax - 0x149fa52c], dx
lea edx, [eax*8 - 0x726b9d63]
setae dl
jno 0x173ce65
mov edx, 0x3d15aca7
mov ecx, 0xfc1c0726
mov eax, 0xc3b5ff34
mov ecx, dword [edi + edx - 0x3d15aca7]
sub dx, ax
neg ax
and ax, ax
lea edi, [edx + edi - 0x3d15ad6f]
xadd eax, edx
shr dx, 0xe1
sub edx, edx
xor ecx, ebx
rol ecx, 1
and edx, 0x1fb797a6
push edx
inc ecx
and dword [esp + edx], edx
ror ecx, 1
shl dword [esp + eax*2 - 0x1955c7e], 0x8e
add dl, 0xb3
bswap ecx
sbb dword [esp + edx*4 - 0x2cc], 0xe9a8a61f
sal edx, 0x25
lea ecx, [ecx + edx*4 - 0x2a3f8025]
je 0x1710b3a
adc edx, 0xe5aa2610
xor ebx, ecx
and edx, dword [esp + eax*2 - 0x1955c7e]
adc esi, ecx
pop eax
dec eax
mov eax, dword [edx + ebp - 0x4021860]
movzx ecx, dl
call fcn.01750ff9

Function at 0x1696eae
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using speck

Disassembly:
cmove ax, word [esp + eax + 5]
xor bl, dl
and ax, ax
sub eax, 0x19109581
shr eax, 0x83
mov dword [esp + eax*4 - 0x7377b538], ebp
lea eax, [eax + eax*8 + 0x4a839a8a]
mov dword [esp + eax - 0x4e50f251], esi
movsx ebp, al
inc eax
push ebx
jnp 0x16fcfe9
mov ebx, 0xd7350189
jns 0x183113f
mov edx, dword [ebp + eax]
inc eax
jge 0x1653185
call fcn.01868748
call fcn.01709c13

Function at 0x1696eef
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using speck

Disassembly:
mov word [edx + ebp - 0x42040c02], ax
inc dx
lea esi, [esi + edx - 0x42040c07]
neg cx
not dx
mov ecx, dword [esi + ecx - 0x612e2673]
lea eax, [edx*8 + 0x36217403]
inc edx
xor ecx, ebx
sub ecx, 0xc41b3b25
xor ecx, 0x3c991438
mov dword [esp + eax - 0x464913e3], 0x4319559d
lea ecx, [edx + ecx + 0x213172c2]
add dword [esp + edx - 0x4204f3fd], edx
call fcn.01710d6c
Function at 0x16a5409
Capabilities:
Encode data using xor

Disassembly:
xor edx, dword [edi + eax*2 - 0x152d6]
movsx ecx, ax
xadd ecx, eax
mov cl, byte [edi + ecx*8 - 0x296ac]
sar eax, 0xf3
call fcn.01751361
lea edi, [ecx + edi + 1]
jae 0x17c54e6
add byte [esp + ecx + 1], 0xba
movsx edx, cx
xor al, bl
neg al
ror al, 1
mov dword [esp + ecx], ecx
sub al, 0x82
xor al, 0xb2
or dword [esp + ecx*4], edx
xor bl, al
lea eax, [esp + eax + 4]
lea ecx, [ecx - 0x60502368]
add dl, byte [eax + edx*8]
sub ebp, 2
movzx eax, cx
sub dword [esp + eax - 0xdc98], ecx
mov word [ebp + eax*2 - 0x1b930], dx
xor ecx, 0x6a950db5
call fcn.00fc05f0
mov eax, 0xed077b26
jnp 0x17c553b
in eax, dx
sal eax, 0xc3
movzx eax, byte [esi + eax - 0x683bd931]
mov edx, 0xe0375388
movsx ecx, dl
xor al, bl
inc edx
dec al
neg al
call fcn.017c98f1
fisubr dword [esi - 3]
xchg esi, eax
jecxz 0x17c5531
push es
iretd
das
or byte [edi], dl
nop
cmpsd dword [esi], dword es:[edi]
mov dword [0x9008f3e2], eax
out 0xfb, eax
sal bl, cl
or byte [eax - 0xc7d2821], dl
or byte [eax - 0xc1d3871], dl
or byte [eax + 0x38b277ef], dl
nop
xor bl, bl
stc
pop eax
jge 0x17c5593
invalid
sub ecx, eax
mov ecx, 0x894c8b80
shr ecx, 1
or byte [ebx - 0x260ae6b4], 0x80
mov ecx, dword [ecx + ebp*8 - 0x53]
cdq
or byte [ebx - 0xf6156b4], 0xba
invalid

Function at 0x16a9954
Capabilities:
Encode data using base64

Disassembly:
not edx
add al, ch
mov dword [esp + eax - 0x12d62045], 0x939c3933
xor ebx, edx
or dword [esp + ecx - 0x62db4508], eax
jle 0x1752fca
Function at 0x16acf88
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec ecx
sub ebp, 1
inc esp
movsx ebx, bx
inc ecx
movsx ecx, bl
jmp 0x17df7c9
shl ax, 0x29
mov ecx, dword [esp + eax*4]
or eax, dword [ebp + eax*8 + 0xc]
and cx, 0x7fb2
shl dword [esp], 0x23
or edx, eax
or cl, cl
not edx
mov dword [ebp + 0xc], edx
adc ebp, 0xc
pop eax
jmp esi
movzx esi, byte [ecx]
push 0xff293da0
jmp 0x1712f3d
inc cx
dec edx
dec edx
mov dword [esp + eax - 0x1c01384], edi
inc esi
xor dword [esp + eax*2 - 0x3802718], ebx
call fcn.00eb1d7d
shr al, 0xe5
push edx
mov edx, dword [eax + ebp + 8]
jns 0xedf0a5
xor cx, 0x3998
mov dword [edi - 4], eax
or cx, cx
ror ecx, cl
mov dword [edi - 8], edx
call fcn.01839ea8
inc bp
mov edx, dword [esi]
dec ecx
add esi, 2
mov ebx, 0xf48dffa8
jmp 0x161f202
jmp 0xeac31c
jmp 0x17ccae8
xor esi, eax
call fcn.01613dda
sub eax, 0x468fb222
mov edx, ecx
not eax
or cx, word [esp]
and cx, 0x1a36
neg eax
xor ebx, eax
call fcn.016d0e33
mov word [edi], ax
pop edx
pop eax
xor eax, esi
jmp eax
dec edx
lea esp, [esp + 0x14]
jne 0xee50d7
call fcn.0177a768
mov ecx, 0xa403f727
sal cl, 1
mov edx, dword [edi]
movsx eax, cl
ror al, 0xe1
mov eax, dword ss:[edx + eax*4 - 0x9c]
movsx edx, cx
xor edx, edx
mov dword [edx + edi], eax
rol ecx, cl
bswap edx
rdtsc
dec cx
ja 0xfb98df
inc ecx
fild dword [ebx]
pop edi
outsd dx, dword [esi]
inc esp
and al, 0x79
xchg edi, eax
mov byte [ecx], cl
arpl word [ecx - 0x503c0b57], si
test dword [edx - 0x36], ebp
xchg dword [eax + 0x77], ebp
out 0x3d, eax
dec edi
pop es
lcall 0xecb6, 0x47a503d
in ax, dx
sub al, 0xe1
and byte [ecx], bl
retf 0xa2f9
inc ecx
movzx ecx, byte [ebp]
jmp 0x185809b
inc ecx
shl bl, 0xa4
inc eax
xor cl, bh
inc esp
mov ecx, ebx
inc cl
dec edi
lea eax, [ebx + ecx*4 - 0xcfa235a]
inc esp
or ebx, ebx
inc esp
movzx edi, bl
xor cl, 2
dec cl
inc ecx
mov ebp, edi
inc ecx
shl al, 0x25
inc bl
xor cl, 0x1b
call fcn.01671926
inc ecx
ror ebx, 1
inc esi
sub byte [esp + eax - 0x1c01386], bh
inc edi
lea ebx, [ebx + edx*4 + 0x1f21beb9]
jbe 0xf75e31

Function at 0x16b176f
Capabilities:
Encrypt data using speck

Disassembly:
movzx ax, byte [edi + eax*2 - 0x529a1132]
add edx, edx
mov cl, byte [ecx + edi - 0x5f11cf3e]
xor dx, 0xe035
push edx
call fcn.0172bcab
Function at 0x16b17dc
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, 0xd904bb14
add edi, 2
rol ecx, cl
lea ecx, [ecx + ecx*2 + 0x7eb76ca1]
or dx, ax
and cx, cx
movsx eax, cl
not dx
shl cl, cl
sub eax, ecx
not eax
mov word [edi], dx
dec ecx
jb 0x167b773
sbb ebp, 4
mov edx, dword [ebp]
xor cx, ax
shr ecx, cl
xor edx, ebx
lea edx, [edx + ecx + 0x340f248d]
ror edx, 2
inc al
not edx
inc eax
xchg ecx, eax
xadd al, ah
dec edx
dec ecx
xor ebx, edx
xor cl, 3
adc esi, edx
jmp esi
rol ecx, 3
and edx, edx
not ecx
movsx eax, dx
xchg dh, al
ror ax, 0x6b
xor ecx, 0xbc9c4d35
not edx
shl al, 0x67
not ecx
jbe 0xf00d52
rol ax, 0x8a
bswap ecx
call fcn.00faad55
ja 0x16b066c
add ebp, edx
mov dword [esp], ecx
mov dword [esp + 4], 0x9922a607
mov ecx, esi
dec dword [esp + 3]
bswap eax
lea eax, [eax + eax*2 - 0x48e6315a]
sub esi, 4
lea edx, [eax + eax*8 - 0x65e0fbc9]
sub dword [esp + edx - 0x4391dc2c], eax
sete dl
mov dword [esi + edx - 0x4391dc00], ecx
lea ecx, [eax*2 - 0x1d63ffd8]
not edx
pop edx
pop edx
pop eax
jp fcn.00f0da46
mov dx, word [edi]
mov eax, 0xc4239694
not al
mov ax, word [edi + 2]
jmp 0xd43165

Function at 0x16b227f
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
sub ebp, 2
mov dword [esp], eax
pop eax
sar ax, 0x4b
mov word [ebp], dx
mov ecx, eax
ja 0x16c3b72
sbb esi, 4
lea edx, [eax + ecx*4 + 0x1321772a]
add cl, cl
mov eax, dword [esi]
ror dl, 0x65
cmovnp ecx, edx
xor eax, ebx
sub eax, 0x93b6612e
add ecx, 0xc4b02615
jns 0x176132e
ror edx, 0xfc
lea edx, [ecx + ecx + 0x538b9b0]
neg eax
jmp 0x1734c0e
ror eax, 1
shl cl, 6
dec ecx
lea ecx, [edx*2 + 0x252c8022]
not eax
and cl, 0xab
xor dx, cx
call fcn.01726d5e

Function at 0x16b274d
Capabilities:
Encrypt data using speck

Disassembly:
pop eax
pop ecx
pop eax
pop edx
pop ecx
jns fcn.00f5ec0e
ror edx, 1
movsx eax, cl
rol word [esp + ecx - 0x11040080], cl
sub edx, 0xca2cfb29
and al, 0xba
xadd al, cl
add ecx, eax
bswap edx
add eax, eax
sbb dword [esp + ecx - 0x1103ff86], ecx
not edx
xor byte [esp + ecx - 0x1103ff83], ah
call fcn.018a087c
mov dl, byte [ebp + 2]
add al, 0xa3
lea eax, [eax*4 - 0x55568666]
sub al, 0x88
add ebp, 2
add cl, dl
xor eax, eax
call fcn.016952b4
mov eax, 0x617eb22
mov esp, ebp
movsx edi, ax
lea edx, [edi + edi*2 + 0x639e4e89]
pop edx
sar edi, 0x87
add edi, 0x4a87922c
jbe 0x169bbeb

Function at 0x16b27c9
Capabilities:
Encrypt data using speck

Disassembly:
neg eax
add ebp, edx
sub al, byte [esp + ecx*4 - 0x10288]
ror al, 0x83
mov dx, word [edi + ecx*8 - 0x20518]
mov dword [esp + ecx*8 - 0x20518], ecx
mov cl, byte [edi + ecx - 0x40a1]
ror word [esp + 2], 0xec
sub ax, word [esp + 4]
adc edi, 2
add dword [esp + 4], eax
ror byte [esp], 0x61
pop eax
shr dx, cl
call fcn.0169d8a4
fadd qword [edi]
jmp 0x16ff1c5

Function at 0x16b387d
Capabilities:
Encrypt data using speck

Disassembly:
shrd edx, eax, cl
mov dword [esp], 0x521147a4
rol byte [esp + 2], 2
mov dword [ebp], edx
sbb edi, 4
mov eax, dword [edi]
xor eax, ebx
call fcn.01748954
mov eax, dword [ebp + 4]
mov cl, byte [ebp + 8]
add ebp, 6
jmp 0x163c6de