joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4526a5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4527bd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4527bd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0046c400
mov esi, eax
test esi, esi
je 0x4527bd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4527bd
mov ecx, esi
call fcn.00452610
cmp edi, eax
jge 0x4527bd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x452743
mov dword [esp + 0x34], 1
jmp 0x45279e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4527bd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00451b40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x455f20
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x455f86
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x455f86
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x455f67
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x456310
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x456348
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x457030
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x457079
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4574f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4797b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004570a0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00457120
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00457120
lea ecx, [esi + 0xc]
call fcn.0046a961
lea ecx, [esi + 0x10]
call fcn.0046a961
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004586b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004586b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004586b0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046a9d6
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046a9d6
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46cda4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46cddc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046ae31
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046ae09
jmp 0x46cde8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46e499
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46e4db
call fcn.00474252
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46e4db
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46e4d2
xor eax, eax
jmp 0x46e4e3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046e4e9
pop edi
pop esi
pop ebx
ret 4

Function at 0x474782
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4747b0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4747ce
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004746e8
jmp 0x4747ce
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4747ce
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004746e8
test edi, edi
mov eax, edi
jne 0x4747b8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xcede7d
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
not edx
neg al
lea edx, [edx*2 + 0x77139c06]
lea edx, [edx + edx*2 - 0x3dda8e4a]
rol al, 1
sub al, 0x29
mov ecx, edx
rol al, 1
xor bl, al
lea eax, [esp + eax + 4]
neg cl
jno 0x170a91a
jmp 0x1840d15
rol cx, cl
movzx eax, cl
mov cl, byte [esi + eax - 0xc5]
lea esi, [esi + eax - 0xc5]
not eax
shr al, 0x61
sbb eax, eax
not dl
ror eax, 0xee
not cl
js 0x179e4a6
or dl, cl
mov word [eax + esi], dx
movsx ecx, ax
lea edi, [edi + ecx - 4]
mov edx, 0x79344082
lea edx, [eax + edx - 0x114fe8ec]
not cx
push eax
sal al, 0xa1
bswap edx
rol eax, 0x70
dec edx
sar ecx, cl
pop eax
dec eax
neg edx
pop eax
jmp 0x174774f
mov edx, dword [eax + edx - 0x4bd77a68]
lea ebp, [ebp + ecx - 0x4bd77a9c]
mov dword [ebp + ecx - 0x4bd77a98], edx
mov edx, 0x6025ba36
mov dword [esp + ecx - 0x4bd77a98], 0x6d8d830e
mov edx, dword [ecx + edi - 0x4bd77a98]
pop eax
lea edi, [ecx + edi - 0x4bd77a94]
rol ecx, 0xb0
xor edx, ebx
inc ecx
rol edx, 1
inc edx
xor ecx, 0x4500ce8c
sal cl, 0x81
rol edx, 3
sal eax, cl
ror cl, 0x42
jnp 0x17b0b5d
lea edx, [ecx + edx - 0x5b1929e3]
call fcn.016b0d96
sub ebp, 4
mov eax, 0xd993f505
mov eax, dword [ebp]
xor eax, ebx
not eax
mov ecx, 0xf3362891
or cl, 0xb6
xor eax, 0x9a8d4720
movzx edx, cx
lea edx, [ecx + ecx - 0x6fe323e0]
ror cl, 0x66
inc eax
shr dl, 0xa1
or edx, edx
ror eax, 2
bswap edx
shl ecx, 0x6c
inc eax
sar cl, 0x66
ror eax, 3
shl edx, 0x3c
dec edx
xor ebx, eax
ror ecx, 0x36
not edx
adc esi, eax
bswap edx
push edx
mov dl, byte [ecx + edi - 0x3780018a]
dec byte [esp + ecx*2 - 0x6f000314]
lea eax, [ecx + ecx*8 + 0x7e290fb5]
mov al, byte [edi + ecx*2 - 0x6f000312]
lea edi, [edi + ecx*2 - 0x6f000312]
add dl, al
mov word [edi + ecx*2 - 0x6f000314], dx
movzx eax, cl
inc ax
mov dword [esp + eax*8 - 0x458], esi
ret
bswap ecx
inc edx
call fcn.0177d0f4
sub edi, 4
mov ecx, 0x3c1aa228
movsx eax, dx
mov edx, dword [ecx + edi - 0x3c1aa228]
xor edx, ebx
sal cx, 0x2c
inc ax
lea edx, [edx + eax*4 - 0x6424ccd0]
je 0x16c074e
lea ecx, [eax*2 - 0x7ccf10c8]
neg edx
dec cl
shl al, 0xe6
sbb edx, 0x86b25087
rol edx, 1
not ecx
xor ecx, eax
add ax, cx
xor ebx, edx
sar eax, cl
adc ebp, edx
neg ecx
xor ebx, edx
add ebp, edx
sar ecx, 8
mov dword [esp + eax*8 - 0xf8], ebp
ret 4
add ebp, ecx
ror ax, 0x2c
movsx ecx, dx
and dx, ax
mov ecx, dword [ecx + edi - 0x7ee]
sub al, dh
xchg edx, eax
mov ax, word [ecx + edx - 0x72c0b4a3]
inc edx
mov ecx, 0x7e1a3e2b
or dx, dx
mov word [edi + ecx - 0x7e1a3e27], ax
push edx
and dl, byte [esp + edx - 0x72c0b4a1]
jp 0xeafb51
lea edi, [edx + edi - 0x72c0b41c]
or edx, ecx
movzx eax, dl
mov dword [esp + ecx - 0x7e1a3e2b], ebp
ret
Function at 0xd0222f
Capabilities:
Encode data using xor

Disassembly:
inc ebp
movzx edi, ax
inc edx
xadd byte [esp + ecx - 0x11a5], bl
pop ecx
inc ecx
pop edx
pop ebx
pop eax
jle fcn.018803b6
rol edx, 2
call fcn.0182415e
mov al, 0x5c
fisub word [ebx + 0x4c320339]
scasd eax, dword es:[edi]
shr dword [ecx + 0x77], 0x32
dec esp
scasd eax, dword es:[edi]
push ebp
movsd dword es:[edi], dword [esi]
pop ss
xor cl, byte [edi + ebp*4 + 0x4d]
pop ecx
sbb esi, dword [edx]
dec esp
scasd eax, dword es:[edi]
imul ecx, dword [ecx - 0x30], 0xde50b21d
push ds
lahf
pop ss
dec ebp
scasd eax, dword es:[edi]
cmp ah, ch
rcr dword [eax], cl
adc byte [0x8dd453d1], dh
wait
mov al, byte [0x1b45d39]
mov cl, 0x14
loopne 0xd022d4
jecxz 0xd022e1
cmp al, 0x9d
push esi
aam 0xd2
invalid
mov byte [0xada5595], al
pop ebp
sbb bh, 0xa2
xchg ebx, eax
scasb al, byte es:[edi]
cmp al, 0xdd
mov esi, 0x63baee40
aad 0xc3
push es
pop es
inc ebp
invalid

Function at 0xd08eaf
Capabilities:
Encrypt data using speck

Disassembly:
add ebp, 2
ror word [esp + 5], 0x6c
call fcn.01716587
mov ebp, 0x39008ba4
push ebp
inc cx
movzx ebx, byte [esi + ebp*2 - 0x72011748]
inc eax
inc ch
xor dword [esp + ebp - 0x39008ba1], ebp
inc ecx
mov ch, byte [esi + ebp - 0x39008ba3]
dec ecx
adc esi, 2
rol word [esp + 3], 0x2f
inc eax
and bl, ch
not bl
inc ecx
mov ecx, 0x4db5878a
inc bx
mov dword [esi + ecx - 0x4db5878a], ebx
dec edi
lea ebp, [ebp + ecx - 0x4db5878e]
dec ebx
lea ecx, [ecx + ecx*8 + 0xc337808]
call fcn.010a1b75

Function at 0xd0a99a
Capabilities:
Encode data using xor

Disassembly:
inc ecx
sal ah, 0x62
dec eax
mov edi, dword [esp + ecx*2 - 0x1327c50]
movzx edx, bp
dec esp
mov dword [esp + ecx - 0x993e24], esp
dec ebp
arpl di, di
dec esi
lea ebx, [ebx + edx*2 - 0xdcefe9]
dec ecx
adc esi, edi
shl word [esp + ecx - 0x993e1e], 0xe1
dec esp
lea ecx, [ebp*8 + 0x72055323]
inc esp
movsx edi, byte [esp + ecx - 0x993e21]
inc ebp
or esp, dword [esi + ecx*2 - 0x1327c54]
dec esi
lea esi, [ecx + esi - 0x993e24]
inc ecx
pop edi
inc edx
mov dl, byte [ecx + ebp - 0x993e31]
dec ebp
lea ebp, [ebp + ecx*8 - 0x4c9f165]
inc sp
and ebx, dword [esp + ecx*2 - 0x1327c55]
inc eax
xor dl, bh
call fcn.00eb5a3a
stosd dword es:[edi], eax
xchg dword [esi - 0x5d], edi
jnp 0xd0aa75
outsd dx, dword [esi]
fisttp dword [ebx]
sub al, 0x86
pop es
imul ecx, edi
or eax, dword [edi - 0x3044fcd5]
or eax, dword [edi - 0x3050cc81]
or eax, dword [edi - 0x3028a4d5]
or eax, dword [edi + 0x7f1d9e53]
test eax, ebp
xor dword [ebx], esi
sbb al, 0x40
push 0x3d38faf2
mov edi, 0x1b88151
cwde
mul byte [ecx]
in eax, 0xbc
mov al, byte [0x215181ad]
fmul dword [ecx - 0x11]
xchg dword [edi + 0x33], edi
scasd eax, dword es:[edi]
iretd
iretd
and eax, ebx
dec ecx
out dx, eax
push edi
jecxz 0xd0aa22
adc eax, dword [eax + 0x3bedce79]
lahf
ja 0xd0aa4c
jns 0xd0aa2c
in eax, dx
dec ebx
or eax, 0xfd2d4ef5
adc eax, 0xb73043a
pop es
jl 0xd0aa4e
loopne 0xd0aa76
jbe 0xd0aaaf
mov edx, 0x3e041552
ret 0x5296
ret 0x5296
in eax, dx
ja 0xd0aae9
jmp [eax + 0x79]
mov ah, 0x55
sub ecx, dword [esi + ecx*8 + 0xe]
xor dh, byte [esi + 3]
dec ebp
sahf
iretd
Function at 0xd0f7b8
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
sal edi, cl
inc ecx
dec dl
dec esp
mov dword [esp + ebx*4 - 0x6cf5dc6c], ebx
not bp
inc ecx
not dl
call fcn.00cf866e
or ecx, eax
sbb byte [esp + ebp + 0x38], 0x99
inc ebp
movzx ebx, byte [ebp + ebp + 0x32]
xor word [esp + ebp + 0x32], dx
sal bp, 0x81
and cl, byte [esp + ebp + 0x67]
inc esp
xor bl, bh
sar cx, 0x6d
inc ecx
dec bl
call fcn.01675905
mov ecx, 0x272fe03b
lea edi, [edi + ecx*2 - 0x4e5fc07c]
rol cx, 0x86
jae 0x170fb58
pop edi
dec ebp
arpl ax, ax
inc ecx
mov esp, 0x13a3d14
inc ecx
xadd ecx, ecx
dec esp
sbb edx, ecx
dec ecx
add esi, eax
dec ebp
mov edi, dword [esi + ecx*2 - 0x1d45392]
dec esp
lea eax, [edx - 0x75f36cde]
inc ecx
mov cl, byte [esi + ecx - 0xea29c1]
inc ecx
movzx eax, dx
dec ebp
xadd esp, ecx
ror ebp, 0x22
dec ecx
shr edi, cl
dec eax
inc edx
inc ecx
movzx ebx, cl
dec ebp
mov dword [esi + ebp - 0x3a], edi
jo 0xf1ef72
dec ecx
lea ecx, [eax + edx*8 + 0x7300d332]
inc cx
sal ecx, 8
dec ebx
mov ecx, dword [ecx + ebp - 0x13a140c]
dec eax
xor eax, eax
dec edi
lea ebp, [ebp + ecx - 0x13a140c]
call fcn.0166491d
sbb dl, bh
dec ecx
add esi, esp
dec eax
bswap ecx
inc ecx
mov eax, 0xa1a9fd3e
inc di
mov edx, dword [esi + edx - 0x20]
dec ebp
lea esi, [esi + ebp*2 + 0x66]
dec eax
mov dword [esp + ebp + 0x32], 0x7f2fa623
inc esp
or byte [esp + ebp*2 + 0x68], bl
jae 0x17d8f26
inc esp
xor dword [esp + ebx - 0x1b3d770d], ecx
ror ebp, cl
inc ecx
pop ebx
dec eax
mov edi, dword [esp + ebx - 0x1b3d7715]
adc cl, byte [esp + ebx*2 - 0x367aee35]
inc ecx
sal ebx, cl
dec ebp
arpl cx, cx
dec eax
mov dword [esp + ebx - 0x1b3d7715], eax
dec ecx
add esi, ecx
inc esp
or ebx, dword [esp + ebx - 0x1b3d7715]
inc ebp
movzx edx, byte [ebp + ebx*2 - 0x367aee3f]
jp 0x18889d8
dec eax
not eax
jmp 0x188c414
movsx edx, cl
xor eax, ebx
call fcn.0172ecab
dec ebp
lea ebp, [ebp + ebp + 0x31]
jno 0xcfb24f
dec esp
lea ecx, [ecx*4 + 0x896d01f]
inc esp
xor dl, bh
inc esp
xchg edx, edi
inc ecx
not dl
dec eax
sal dword [esp + ebx*4 - 0x6cf5dc72], cl
shr cl, 0x65
inc ecx
dec dl
and dl, 0xb5
dec dword [esp + ebx - 0x1b3d7714]
inc ecx
ror dl, 1
jmp 0xce5518
inc ecx
neg edi
inc ecx
and bl, al
call fcn.00d27f27
Function at 0xd0feb5
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [esi + eax - 0x4331dd8a]
mov edx, eax
xor ecx, ebx
pop edx
movsx edx, ax
inc ecx
xchg edx, eax
sal ax, 0xa7
not ecx
ror eax, 0x55
shr al, 0xa1
or dl, 0x1b
ror ecx, 3
inc edx
bswap ecx
sub dl, 2
neg edx
rol ecx, 1
shl eax, 0x59
dec ecx
inc eax
xor ecx, 0x8282b1ba
neg ecx
xor ebx, ecx
not dx
sub edx, 0x90384312
adc edi, ecx
mov ax, word [ebp + edx*2 - 0x592d350e]
movzx ecx, dl
lea ebp, [ecx + ebp - 0x85]
shl cx, cl
lea esi, [esi + edx - 0x2c969a88]
movzx ecx, byte [esi + edx - 0x2c969a87]
not dl
lea edx, [edx + edx*4 + 0x620bbe91]
lea edx, [edx*8 - 0x65d6a1e4]
xor cl, bl
or dl, 0x17
inc cl
rol cl, 1
inc edx
not edx
push edx
add cl, 0x3a
rol dword [esp + edx - 0x5df08a87], 0x79
call fcn.016fbacc
lea eax, [eax + eax*8 - 0x2ce2d97d]
bswap eax
sub ecx, 0xb33484a6
bswap ecx
jmp 0xe5c54c
lea eax, [eax + edx*8 - 0x14664a47]
neg ecx
lea eax, [edx - 0x23e58e7f]
neg al
xor ebx, ecx
jmp 0xf97173
sub edx, 0xc992d301
add edi, ecx
dec eax
dec ax
js fcn.00f1fef8

Function at 0xd10f17
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + eax - 0xe2f0], 0x1baeb31
dec ebp
arpl ax, ax
dec ecx
add esi, eax
inc ecx
pop ecx
dec ecx
rol ebx, cl
inc ecx
push edx
dec ecx
mov ebx, dword [ebp + eax*2 - 0x1c5ed]
call fcn.00ee8fce
Function at 0xd24dc9
Capabilities:
Encrypt data using speck

Disassembly:
dec byte [esp + 0x13]
xor cl, 0x2a
sal dl, 4
neg cl
sub cl, 0x8e
call fcn.018348af
nop
mov cx, ss
mov ss, cx
jmp 0xec1d5c

Function at 0xd24de9
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
dec esp
or ebx, ebx
inc ecx
not bl
not ebx
dec edx
mov dword [esp - 0x50176414], edi
sal al, 6
inc edx
xor dword [esp + ebx*2 + 0x2800a9b0], edx
dec eax
lea edi, [ecx*2 - 0x33489ae2]
dec edx
mov edi, dword [esp - 0x280bb202]
inc ebx
mov dword [esi - 0x50176424], edx
dec esi
lea edx, [ebx + ebx - 0x4262cb6d]
inc edi
mov esp, dword [ebp - 0x5017642d]
dec ecx
rol ebx, 0x31
dec esp
mov dword [esp + ecx*2 - 0x79e], edx
dec esp
sub dword [esp + ecx - 0x3cf], edx
inc esp
xor esp, edi
dec eax
mov dword [esp + ecx*4 - 0xf34], 0xaf8b718c
inc ebp
movzx ecx, dl
dec eax
mov dword [esp + ecx*2 - 0x78e], 0xd537582c
inc ecx
bswap esp
inc edi
lea esp, [esp + edx + 0x33656f7f]
inc ecx
rol esp, 3
inc ecx
dec esp
inc ecx
mov edx, ecx
inc ecx
neg esp
inc ecx
bswap ebx
dec eax
inc edx
dec eax
shr dword [esp + ecx - 0x3c9], cl
dec eax
mov dword [esp + ecx - 0x3bf], edi
call fcn.00ede4e3
mov edx, 0x95a68a05
dec ebp
mov esp, dword [esi]
mov ebx, 0x5589a23e
inc esp
mov ecx, ebx
inc esp
mov edi, edx
dec ecx
mov eax, dword [esi + ebx - 0x5589a236]
dec ecx
and ecx, 0xbd1d100d
inc ecx
push ecx
inc ecx
movsx ebp, cx
dec ecx
not esp
sal ebp, 0xb
inc ebp
movzx edx, di
dec dword [esp + ebx - 0x5589a23a]
dec eax
not eax
dec ebp
and edi, ecx
ror bp, 0x27
dec esp
or esp, eax
inc ebp
mov ebx, edx
inc ecx
push ecx
inc sp
or ebx, ebp
dec edi
mov dword [ecx + esi - 0x15090004], esp
dec edx
lea ecx, [esp + ecx*2 - 0x2a120000]
shl ebp, 0xe1
inc edx
sal dword [esp + ecx*2 - 0x2a12000e], 0x9c
dec eax
mov ebx, dword [ebx + ecx - 0x5589a23e]
dec edx
neg dword [esp + ecx - 0x15090008]
inc edx
mov eax, dword [esp + ecx*4 - 0x54240029]
dec ebx
mov dword [esi + edi*2 - 0x2a000008], ebx
inc edi
mov edx, dword [ecx + ebp - 0x15090010]
dec ecx
sar ebx, 0xb1
js 0xeb1728
dec edi
lea ebp, [ebp + ecx*2 - 0x2a12001c]
dec edx
shl dword [esp + ecx*4 - 0x54240028], 0xf5
jbe 0xf31a5e
inc ecx
ror edx, 2
inc ecx
bswap edx
inc esi
movzx esp, byte [esp + ecx*4 - 0x5424002d]
dec edx
mov dword [esp + ecx - 0x15090004], edi
jmp 0x1618c4c
inc esp
xor edx, edi
inc si
mov dword [esp + ecx*2 - 0x2a120015], ecx
inc dx
shr dword [esp + ecx*2 - 0x2a12000b], 7
inc ecx
rol edx, 1
inc edi
lea edx, [edx + ecx*8 + 0x544a25d4]
inc edx
and byte [esp + ecx*4 - 0x5424002e], al
inc edx
sub dword [esp + ecx - 0x15090003], ebp
dec edx
sub dword [esp + ecx - 0x15090004], edx
inc ecx
xor edx, 0xe1245d91
dec esi
mov dword [esp + ecx*2 - 0x2a120016], edi
jmp 0xea69bf
call fcn.010ab7c8
inc esi
xor dword [esp + ecx*2 - 0x2a120010], edx
dec ecx
neg ecx
inc dx
inc dword [esp + ecx*4 + 0x54240031]
dec ebx
lea ecx, [edi + ecx*4 - 0x4e620fd3]
dec edx
mov edi, dword [esp + ecx*2 + 0x2a120020]
jo 0xf4cee7
dec ebp
arpl dx, dx
sub ecx, 0xb90314b4
call fcn.00d39c74
lea ebp, [ebp + eax - 0x4906955c]
mov word [ebp + eax - 0x4906955a], dx
call fcn.016ee437
Function at 0xd2e1b8
Capabilities:
Encrypt data using speck

Disassembly:
mov word [ebp + edx], cx
mov dword [esp + edx], edx
sar edx, 0x6c
mov ecx, dword [edi + edx*8]
mov eax, edx
mov dword [esp + edx*2 + 4], edx
lea eax, [edx + eax*8 - 0x4fd3c6c4]
lea edi, [edi + edx*2 + 4]
shl dword [esp + edx*4 + 4], 0xa1
xor ecx, ebx
shl edx, 0x2b
sbb ecx, 0xee1d9c9a
or dx, word [esp + edx*2 + 3]
xor ecx, 0xae12d905
shr dword [esp + edx + 4], 0x9c
not ecx
jae 0xd37a11
dec ecx
dec edi
dec ecx
ror edi, 1
dec ebp
lea edi, [edi + edx*2 + 0x5f21e41a]
xor dx, word [esp + edx*8 - 0x7f805]
dec eax
inc dword [esp + edx - 0xc4]
push edx
dec ecx
xor edi, edi
pop ecx
dec ebp
mov dword [esi + edx*8 - 0x630], edi
inc ebp
movzx ecx, byte [ebp + edx*8 - 0x635]
mov eax, 0xc6aa28a3
dec ebp
lea ebp, [ebp + edx - 0xd2]
inc esp
xor cl, bh
pop ebx
dec eax
sub ebx, ecx
inc ecx
not cl
dec esp
mov dword [esp + edx - 0xbd], esp
movzx ebp, byte [esp + edx*2 - 0x182]
inc ecx
dec cl
call fcn.0186e6e1
dec dword [esp + edx + 4]
and edx, edx
inc ecx
ror byte [esp + edx + 2], 0xc7
bswap ecx
jae 0xfdcf58
dec esp
lea edi, [esp + eax*2 - 0x582ae358]
inc cx
or ebx, ecx
dec esi
mov esp, dword [eax + edi - 0x2c157200]
dec ebp
mov dword [esi + eax*2 - 0x582ae406], esp
inc ebp
mov ecx, dword [ebp + eax*2 - 0x582ae404]
dec esp
lea edi, [ebx + ebx*4 + 0x28a2df80]
inc esp
xor ecx, edi
inc bp
xchg edx, edi
not bx
inc ecx
rol ecx, 1
inc edi
lea ecx, [ecx + edx + 0x61efc1b9]
inc ecx
movsx edx, di
call fcn.00eb6573
push 0x6b
arpl word [esi + 0x3e], ax
cmpsb byte [esi], byte es:[edi]
imul esi, edx, 0x63
inc esi
cmpsb byte ds:[esi], byte es:[edi]
outsd dx, dword [esi]
mov dh, 0x53
cmp dword [ecx - 0x6e04f553], edi
sbb dword [ecx - 0x6e04f503], 0x4b288bd1
sub ecx, esp
and eax, 0xadcd494f
push esi
push esi
mov al, 0x46
leave
add dword [ebp - 0x5e91fb0b], ecx
mov dword [ebp - 0x4691fb0b], edx
loope 0xd37a70
cmc
add al, 0x6e
loope 0xd37b11
adc esi, ecx
mov esi, eax
push ds
sal byte [ecx + 0x5e], 0x17
mov bl, ah
in eax, 0xb8
fnstsw word [ebp - 0x10f416d8]
wait
dec esp
xor dword [ebx - 0x20], ecx
sbb eax, 0xa4083dde
sar dword [eax - 0x11971090], 1
mov ebp, 0xa9b05d35
not edi
imul ebx, ebp, 0x35
sbb al, 0x28
fistp word [eax + ecx - 0x12fbabe6]
or edx, edx
cmpsd dword [esi], dword es:[edi]
dec edi
sahf
aas
sub dword [edx + 0x13fc4f44], edx
shr dword [eax + ebx*2], cl
mov al, 0xb9
xchg edi, edx
imul ebx, ebp, 0x6d
add eax, 0x89cdfb0
shl dl, cl
test al, 0xdf
pushfd
or byte [edi + 0x1ac9909f], bl
xor byte [ebx + 1], ah
arpl word [esi + 0x4e], sp
xchg edi, eax
sbb ebp, dword [edi]
dec eax
sub dh, byte [edi + 0x1c533130]
mov bh, 0x30
xor dword [ebx + 0x1c], edx
inc ecx
scasb al, byte es:[edi]
dec esp
int3
xchg edx, eax
xadd edx, eax
xor ecx, 0xd834d625
jmp 0x16965d1
Function at 0xd30c4c
Capabilities:
Encrypt data using speck

Disassembly:
add dword [esp + edx - 0x5c5c], ecx
lea esi, [esi + edx - 0x5c6a]
shr ecx, 0x21
lea edx, [edx*8 + 0x758bfa85]
mov dword [esp + ecx - 0x73e92e32], edx
xor al, bl
call fcn.016d6092
inc ecx
mov ebp, dword [esi]
inc ecx
mov edx, 0x263a7b36
inc edi
mov esp, dword [esi + edx*2 - 0x4c74f668]
inc ecx
movzx edx, dx
not ebp
inc ecx
not esp
inc ecx
and ebp, esp
inc ecx
push edx
inc ebx
mov dword [edx + esi - 0x263a7b32], ebp
inc esp
and dword [esp + edx - 0x7b32], edx
movsx eax, dx
inc esi
mov dword [esp + edx - 0x263a7b35], edx
inc esi
mov ebx, dword [edx + ebp - 0x7b3a]
call fcn.01099fe5
ror edx, 3
mov eax, ecx
bswap edx
lea eax, [eax*2 + 0x11210a8c]
rol ecx, cl
xor edx, 0x10288c0d
shl ecx, 1
xchg al, cl
adc ecx, ecx
neg edx
rol eax, 0x35
cmovb ecx, eax
rol edx, cl
or cl, al
sal eax, 0x73
xadd ecx, eax
bswap edx
dec edx
ror ax, cl
jo 0x17bdbd2

Function at 0xd35891
Capabilities:
Encrypt data using speck

Disassembly:
inc eax
or ch, 0x3a
dec esi
xchg dword [esp + ecx*4 - 0x68010082], edx
pop ebx
pop ecx
inc ecx
pop edx
pop ebp
inc ecx
pop edx
inc ecx
pop ecx
jne fcn.018803b6
shr dx, 0x6b
not al
call fcn.0188324c

Function at 0xe628f6
Capabilities:
Encrypt data using speck

Disassembly:
add ebp, edx
mov edx, ecx
inc word [esp + edx - 0x6991fa2f]
movzx ecx, byte [ecx + esi - 0x6991fa3e]
mov dword [esp + edx - 0x6991fa35], 0x4b02fe99
jle 0x188a16a
mov ebx, 0xe23cf315
inc ebp
mov esp, dword [ebp - 4]
dec esp
lea ecx, [ebx*4 + 0x4a8a3a2e]
inc esp
xor esp, edi
inc ecx
rol esp, 1
inc ecx
bswap esp
inc ecx
mov ecx, ecx
inc ecx
ror esp, 1
push ecx
inc ebp
lea esp, [esp + ebx - 0xa1e3f70]
inc esp
movzx eax, cx
inc edx
and byte [esp + eax*8 - 0x340d], 0x1d
dec edx
mov dword [esp + eax*4 - 0x1a08], edi
inc esi
xor dword [esp + eax - 0x682], esp
inc ecx
movzx eax, cl
dec ebx
inc esp
movzx ebx, cx
pop edi
jo 0xf09a82
mov edx, 0x991dff13
dec ebp
arpl sp, sp
inc sp
add ebx, ebx
sal cl, 0xe5
inc ecx
shr cl, 0xc6
dec ecx
adc esi, esp
call fcn.00ea5541
xor cl, bl
not cl
ror edx, 0xf7
call fcn.01795762
sti
mov dh, 0x83
xlatb
xor esi, ebp
xchg ecx, eax
mov eax, dword [0xf33ddda8]
dec eax
push ecx

Function at 0xe62a09
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
or dl, byte [edi + eax - 0x35805d95]
xor dl, bl
dec al
xor dl, 6
rol dl, 1
inc dl
xor dl, 5
mov dword [esp + eax*2 - 0x6b00bb28], 0x7d2d3628
push eax
sub dl, 0x2d
or eax, 0xe5170a96
sub al, al
xor bl, dl
inc word [esp + 5]
mov dword [esp + 4], edi
or eax, dword [esp]
xchg byte [esp + 1], al
mov dword [esp], ebp
movsx ebp, al
push ebx
movsx ebx, al
sar ebp, 0xa1
mov ebp, esi

Function at 0xe71bd9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor ecx, ebx
not ecx
mov dword [esp + 0xc], edx
add eax, edx
add byte [esp + eax - 0x2f4b4c22], al
xor ecx, 0xe9208007
dec ax
push edx
dec dx
rol ecx, 3
xor ax, ax
not ecx
or dword [esp + eax - 0x2f4afff0], 0x759975b9
shr eax, 0x3f
xor ebx, ecx
xor word [esp + eax + 2], 0x429
adc edi, ecx
xor word [esp + eax*8 + 0x11], dx
call fcn.016fb6fe