joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4643a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x18
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [edx + 0xc]
call eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._bgm_
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x464435
push str._:_setup_bgm_
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 4]
call fcn.0045f380
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov byte [ecx + edx], al
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x464435
xor al, al
jmp 0x464437
mov al, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x471710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4deb90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
xor edx, edx
mov word [ebp - 0x14], dx
mov eax, 1
mov word [ebp - 0x12], ax
xor ecx, ecx
mov word [ebp - 0x10], cx
xor edx, edx
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
xor ecx, ecx
mov word [ebp - 0xa], cx
xor edx, edx
mov word [ebp - 8], dx
mov eax, 1
mov word [ebp - 6], ax
cmp dword [ebp + 0x18], 0
jne 0x471776
xor eax, eax
jmp 0x4717db
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.004a0b10
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x4717b6
push 0x30
mov ecx, 0x51ca6a0
call fcn.00414f30
push eax
push 0x4d2bd8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.004a49d4
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 6
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.GDI32.dll_GetGlyphOutlineW]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a0848
mov esp, ebp
pop ebp
ret 0x14
Function at 0x476d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x476dde
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x476ddc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x476dd1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
jne 0x476dae
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
add eax, 0x28
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x476dcf
cmp dword [ebp - 0x10], 0x102
jne 0x476dc4
mov byte [ebp - 1], 4
mov eax, dword [ebp - 8]
mov byte [eax + 8], 0
jmp 0x476dcf
mov byte [ebp - 1], 5
mov ecx, dword [ebp - 8]
mov byte [ecx + 8], 0
jmp 0x476ddc
mov byte [ebp - 1], 5
mov edx, dword [ebp - 8]
mov byte [edx + 8], 0
jmp 0x476de2
mov byte [ebp - 1], 2
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8

Function at 0x476df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4deb90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.004768c0
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.COnahole.0
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 0x70], 0
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x68], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x6c], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0x3c
mov byte [ebp - 0x12], 0x30
mov byte [ebp - 0x11], 0x31
mov byte [ebp - 0x10], 0x35
mov byte [ebp - 0xf], 0x32
mov byte [ebp - 0xe], 0x30
mov byte [ebp - 0xd], 0x30
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x30
mov byte [ebp - 0xa], 0x30
mov byte [ebp - 9], 1
mov byte [ebp - 8], 2
mov byte [ebp - 7], 3
mov byte [ebp - 6], 0x68
mov byte [ebp - 5], 0x3e
mov ecx, dword [ebp - 0x18]
add ecx, 0x48
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a0848
mov esp, ebp
pop ebp
ret
Function at 0x499d50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x499d65
lea eax, [ecx + 0xc]
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
test eax, eax
jne 0x499d76
mov eax, 3
pop esi
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x499d85
lea eax, [edx + 2]
pop esi
pop ebp
ret 8
push edi
push 0
lea edi, [ebp + 8]
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
cmp eax, 1
jne 0x499db8
mov eax, dword [ebp + 8]
test eax, eax
jne 0x499dae
mov dword [esi + 0xc], 1
pop esi
pop ebp
ret 8
add dword [esi + 8], eax
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, 0xe
pop esi
pop ebp
ret 8

Function at 0x499dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x499de5
lea eax, [ecx + 0xc]
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
test eax, eax
jne 0x499df6
mov eax, 3
pop esi
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x499e05
lea eax, [edx + 2]
pop esi
pop ebp
ret 8
push edi
push 0
lea edi, [ebp + 8]
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
cmp eax, 1
jne 0x499e38
mov eax, dword [ebp + 8]
test eax, eax
jne 0x499e2e
mov dword [esi + 0xc], 1
pop esi
pop ebp
ret 8
add dword [esi + 8], eax
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, 0xe
pop esi
pop ebp
ret 8
Function at 0x4b4318
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b418e

Function at 0x4b7f3c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b7bb9

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x2e3b2043
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x79d9525a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x154e901
Capabilities:
Get number of processors

Disassembly:
dec eax
mov dword [esp + esi - 0x2a], ebp
inc ebp
xor ebx, ecx
dec ecx
bswap edx
sub ax, word [esp + eax - 0x7411ce27]
inc ecx
ror ebx, 1
not dword [esp + eax - 0x7411ce2a]
imul dword [esp + esi*2 - 0x52]
dec eax
cwde
inc ebp
lea ebx, [ebx + eax - 0x3f6a423d]
inc ecx
mov esp, 0x580ecf09
xadd byte [esp + eax - 0x5a1831cf], cl
jne 0x28d4a1e
invalid
inc ecx
bswap ebx
jge 0x287b83f
xadd cl, ah
inc ebp
lea ebx, [ebx + eax - 0xc08ee42]
shr si, 9
inc esp
sbb edx, esi
xchg word [esp + eax - 0x5a1800d0], bp
inc ecx
xor ebx, 0x44a0c90b
dec esi
mov dword [esp + edx*4], ecx
inc esp
movzx ecx, ch
inc ebp
xchg ecx, edx
inc esi
xor dword [esp + edx], ebx
imul esi
inc ecx
pop ecx
imul bp
dec ebp
arpl bx, bx
dec esp
lea ebp, [ebp*8 + 0x642d7625]
sbb dx, 0x5822
dec ecx
add ebx, ebx
jmp fcn.025824da

Function at 0x1553404
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xd8375c1d
jp 0x2258ee5
dec ebx
call fcn.02298b45

Function at 0x155fe38
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [ebp - 4], eax
mov dword [esp], 0x2ca79ab6
test ebx, ebx
jmp 0x28679eb

Function at 0x1569581
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0xbc8d0f32
lea esp, [esp + 0x10]
je 0x24efe53
Function at 0x157aac5
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
xor ebx, eax
rol edx, 0x64
adc ebp, eax
or edx, dword [edi + edx*4]
xchg dword [esp + 4], ecx
mov ax, word [edi + ecx + 4]
call fcn.0162354e
bswap edx
rol ecx, cl
jae 0x27d2e47
mov cl, byte [ebp]
mov eax, 0xa93308a7
dec ax
movzx ax, byte [ebp + 2]
add ebp, 2
mov edx, 0x6219f9ab
shl dl, 0x82
imul cl
mov ecx, edx
add dl, ch
mov word [edx + ebp - 0x6219f9a5], ax
call int.0159938e
inc cx
not edx
add ax, cx
ror edx, 1
ror cl, 0x63
inc edx
xor ecx, 0x83270b09
sbb ecx, eax
ror edx, 2
neg ecx
bswap edx
bswap eax
xor ebx, edx
and cx, ax
adc esi, edx
shr eax, 0xa1
lea edx, [ecx*4 - 0x7065a3d7]
mov eax, dword [ecx + ebp - 0x352d030c]
lea ecx, [edx + edx*2 - 0x3671c277]
neg ecx
mov ecx, dword [ecx + ebp - 0x9868968]
imul edx, edx
shl dx, 0xa8
rol dx, 0xeb
push ebx
mov ebx, edx
sar ebx, 0x88
cpuid
sbb ebp, 7
jmp 0x2836562

Function at 0x158f6b8
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 0xc], 0x5a1ad
push 0xdc9cbd14
dec edx
xor ebx, edx
add esi, edx
call fcn.027b3f1e
rol ecx, 0x35
xor ebx, edx
not eax
and cl, al
adc ebp, edx
call fcn.0157d48f
mov edx, 0xac1954b8
lea eax, [edx - 0x2f487f4b]
sub eax, 0x9e11f290
mov edx, dword [edi]
jg 0x292d6fe

Function at 0x15b3524
Capabilities:
Encrypt data using speck

Disassembly:
adc esi, ecx
ror byte [esp + eax*2 + 0x65ff4205], 0xa4
imul edx, edx
div dl
mov dx, word [edx + ebp - 0x60b97589]
pop eax
mov eax, 0xd0a92010
add ebp, 2
mov ecx, 0xf0a8a597
not ax
btr cx, cx
movzx eax, byte [edi]
setb byte [esp + 4]
lea ecx, [ecx*2 - 0x4a48f5c4]
adc edi, 0
bt cx, cx
jb 0x270d021
sub esi, 4
mov eax, dword [esi]
mov ecx, 0xf82370a6
xor eax, ebx
mov edx, ecx
and cx, 0x4807
lea eax, [eax + edx - 0x28ae76a]
jno 0x24f9802
mov edx, 0x3b9f66bf
imul dx, dx
bts edx, 0x82
mov edx, dword [esi + edx*2 - 0x773f850a]
mov ecx, 0x4c2aeca5
not ecx
call fcn.015ad47c
mov eax, dword [esi]
add esi, 4
mov ecx, 0xfd1b133e
lea edx, [ecx*4 + 0x4b8e6ca9]
movzx edx, byte [edi + edx*2 - 0x7ff57342]
sal cl, 0xe4
adc edi, 0
xor cl, cl
sal ecx, 0x86
xor dl, bl
rol cx, 0x6d
push ecx
adc dl, 0x8c
and cl, ch
xor ecx, ecx
not ecx
ror dl, 1
xor dl, cl
inc cl
sete cl
inc dword [esp]
rol dl, cl
xor bl, dl
not cl
lea edx, [esp + edx + 4]
rol ecx, cl
mov dword [edx], eax
movsx eax, cl
or word [esp + 1], ax
xadd eax, ecx
mov edx, dword [edi]
neg ax
sar byte [esp + 1], 0x81
sbb ecx, ecx
adc edi, 3
btc eax, 0x36
btc ax, 0x2b
xor edx, ebx
rol ax, 0x2c
adc ecx, 0xeb3657b4
push ecx
ror edx, 1
btr ecx, eax
cwde
setae cl
dec edx
bswap edx
btc ax, 0x80
shl eax, 0xb0
ror edx, 2
sal dword [esp + eax*2 - 0x4101fffc], 0x8e
pop eax
dec edx
xor ebx, edx
add ebp, edx
pop edx
jmp ebp
imul edx, edx
rol eax, 1
shl ecx, cl
btr edx, ecx
inc eax
dec ecx
bts cx, cx
rol ecx, cl
ror eax, 2
call fcn.028b1e7a
xor al, bl
not al
not word [esp + 6]
dec al
imul cx, cx
neg al
imul ecx, ecx
lea ecx, [ecx*8 - 0x443e659]
rol al, 1
dec al
shr byte [esp + 3], cl
sete byte [esp + 4]
sal cl, cl
not al
sbb dword [esp + 3], ecx
neg ecx
call fcn.015d1cad
Function at 0x15b66ea
Capabilities:
Encrypt data using speck

Disassembly:
ror edx, 2
lea edx, [edx + eax*2 - 0x4a1f590e]
xor ebx, edx
mov dword [esp + ecx - 8], ecx
inc ecx
add ebp, edx
movzx eax, byte [edi + ecx*4 - 0x24]
call fcn.028ae3f9
movsx edx, cl
mov eax, dword [edi]
add cl, dl
adc edi, 3
xor ecx, ecx
sbb edx, edx
inc ecx
xor eax, ebx
sar edx, cl
lea eax, [eax + ecx*2 - 0x3008211b]
rol dl, cl
not eax
jnp 0x16109f8
sbb eax, 0xa8304a01
shl cx, 0xe6
call fcn.0154915c
mov eax, 0x18b5df1d
lea edi, [edi + eax*4 - 0x62d77c78]
lea edx, [eax*4 - 0x294dfc72]
shl eax, 0xa1
xadd eax, edx
mov edx, dword [edi + edx*2 - 0x62d77c74]
xor edx, ebx
mov ecx, eax
or cl, al
add ecx, eax
neg edx
dec al
not ax
xor ax, 0xd612
inc edx
neg edx
neg cl
btc ecx, eax
rol edx, 3
xor edx, 0x60ab6105
jmp 0x165196d
xor ebx, edx
add ebp, edx
movzx edx, al
lea ecx, [eax + eax*8 - 0x6e621ae7]
shr edx, 0x74
mov si, word [esi + eax - 0x6af517d6]
je fcn.027b3ecd

Function at 0x15f6bde
Capabilities:
Encode data using xor

Disassembly:
jmp 0x28f1405
xor edx, ebx
neg edx
bts ecx, 0xbd
bt ax, 0x29
sal ecx, 0xf6
rol edx, 1
and eax, 0xc997bb9e
btr ax, 0x17
xor edx, 0xd43e9e26
ror cl, 0x67
bts ecx, eax
adc edx, 0xcc266d93
sar cl, 0x23
xor edx, 0xa2884f1e
xor ebx, edx
add esi, edx
mov edx, eax
imul eax, eax
sal dl, 0x62
jmp esi
mov dword [esp], eax
call fcn.015fb348
mov eax, 0x33865399
mov edx, dword [edi + eax*2 - 0x670ca732]
lea ecx, [eax + eax*2 + 0x402f90a2]
das
inc eax
and cl, ch
not ax
mov cx, word ss:[edx + eax*2 - 0x670d58cc]
lea edi, [edi + eax*2 - 0x670d58ca]
mov edx, eax
mov word [eax + edi - 0x3386ac66], cx
btc eax, eax
lea ebp, [ebp + edx - 0x3386ac6a]
mov edx, dword [ebp + eax - 0x3386ac26]
mov ecx, eax
jb 0x27f0c83
push cs
stosd dword es:[edi], eax
add eax, 0xdfb85dc
jl 0x28f141f
test byte [edx - 5], dh
shl byte [ebx], 1
push esp
scasd eax, dword es:[edi]
invalid

Function at 0x16109d5
Capabilities:
Encrypt data using speck

Disassembly:
xor dl, 0x90
sub dl, 9
xor bl, dl
not ecx
sub ecx, ecx
lea edx, [esp + edx + 4]
sbb ecx, 0x950f8381
mov byte [edx + ecx - 0x6af07c7f], al
jl 0x27ad97f
lea eax, [ecx*2 - 0x17f751f5]
mov ecx, dword [ecx + edi - 0x6af07c7f]
jg 0x28777ee
mov eax, edx
ror ax, 0x69
mov word [ebp + ecx], ax
add ecx, dword [edi + ecx]
pop edx
lea edi, [edx + edi - 0x9e8ddfd]
bts edx, 0x9e
xor ecx, ebx
neg ecx
jmp 0x261e539

Function at 0x1621925
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x10]
je 0x2517cb0
Function at 0x1623679
Capabilities:
Encrypt data using speck

Disassembly:
not ecx
bswap ecx
push 0x2937d035
mov edx, 0xe0807bc
push edx
xor ebx, ecx
not dx
mov dword [esp + edx - 0xe08f83b], 0x111a7305
add ebp, ecx
xadd byte [esp + edx*2 - 0x1c11f073], dl
mov ecx, dword [edi + edx*2 - 0x1c11f01a]
mov edx, dword ss:[edx + ecx - 0xe08f80d]
mov dword [edi], edx
sal word [esp], 0xc2
jne 0x270d000
inc ecx
mov esi, 0x57032ca1
inc ebp
movzx edx, si
jmp 0x26386fe
inc ecx
xor dl, 0x37
inc esp
add ebx, ecx
inc ecx
adc dl, 0x84
dec eax
btc eax, esi
xadd cl, dl
inc ecx
rol dh, 0xc3
inc ecx
ror dl, 1
dec eax
btr edx, 0xa6
bt esi, 0xbc
and esi, 0x9bbe67ac
inc ebp
sbb dl, bl
cwde
sar cx, 0xad
xadd ax, si
inc ebp
xor cl, dl
dec ebx
lea ebp, [ebx + ebx*8 - 0x626a4873]
sar cx, 0xe3
dec edx
lea esi, [ebx*8 + 0x61157ab0]
dec esp
adc edx, esp
dec esp
lea edi, [edx + ebp*2 + 0x2c246718]
inc edi
mov byte [edx + esi - 0x57032c0d], ah
inc cx
sar ebx, 0xcb
inc ebp
movsx esp, ch
imul esi
inc edx
mov esi, dword [ecx + eax]
dec edi
lea edx, [ebp + esi*4 + 0x768fe60b]
dec eax
idiv ebp
dec ebp
add eax, esp
inc ecx
xchg dl, al
dec eax
bt ebp, ecx
sal ebp, 0xd1
inc ecx
xor esi, ecx
inc ecx
not edi
inc cx
xor edx, 0xceff8826
neg esi
inc ecx
add ecx, edi
jae 0x279af08
inc si
mov esp, dword [edi + edx*4 - 0xb284]
inc ecx
movsx edx, dl
inc cx
rol edx, 0xcf
inc ecx
mov eax, edx
dec ecx
lea edi, [edx + edi - 0x964e]
dec esi
lea ebx, [esi*4 - 0x65443974]
inc edi
movzx edx, byte [eax + esi - 0x57032ca1]
inc ecx
mov ebp, 0xfcaa6010
dec esi
lea edi, [esi*4 - 0x40e30953]
dec ebp
lea eax, [eax + eax*8 - 0x4b27f]
inc ecx
movzx ecx, bl
mov esi, eax
inc ecx
sar ch, 0xe2
inc ebp
xor dl, cl
dec eax
lea eax, [ecx + eax*4 - 0x2cdfcc71]
jmp 0x24d373c
mov edx, dword [esp + 0x10]
mov dword [esp + edx - 0x50fa3d00], ebp
ret 0x10
dec esi
bswap eax
dec eax
cdq
inc eax
shr ch, 0xa5
not esi
inc ecx
div ebp
inc ecx
div ebp
rol esi, 2
inc ecx
push ecx
xor dword [esp + eax - 0x440f13e0], esi
inc esp
movzx ecx, ax
inc ecx
pop ecx
inc ecx
div edx
inc cx
xadd esi, ecx
dec eax
arpl si, si
inc ecx
sar edi, cl
ja 0x2877535
Function at 0x162b2f1
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [esp], 0xd41ced31
not byte [esp + 6]
lea esp, [esp + 8]
jne 0x27bb54d

Function at 0x16422c5
Capabilities:
Encode data using xor

Disassembly:
inc edx
rol edx, 3
mov dword [esp], 0x6b015801
bt ecx, ecx
xor ebx, edx
and dword [esp], eax
and byte [esp + 3], ah
adc esi, edx
lea eax, [ecx*2 - 0x5c44dcc2]
lea ecx, [eax + eax*8 + 0x30247b00]
cwde
movzx dx, byte [edi]
not al
call fcn.02519682
inc esp
inc edx
mov dh, 0xf5
stc
shl dword [esi], cl
or bh, byte [ecx - 0xc]
xor edx, dword [ebp + 0x11]
inc eax
inc esp
jnp 0x16422f6
lcall 0x6a91, 0xbf7e87f1
lea ecx, [ebx - 0x43]
xchg ecx, eax
mov dl, 0xd8
or byte [edi + 0xc579039], dh
js 0x1642360
xchg ebp, eax
or eax, 0xfe8da628
insd dword es:[edi], dx
int1
imul ecx, dword [edx], 0xffffffb5
test ebx, esp
invalid
sbb al, byte [edi - 0xe]
stosd dword es:[edi], eax
pop edx
or ebp, dword [edx]
lahf
outsd dx, dword [esi]
or byte [edx], al
loope 0x16423a0
ljmp 0x55d8:0xa7490887
cmpsd dword [esi], dword es:[edi]
fcom dword [ebp - 0x3b]
push ds
and al, 0x5e
add cl, ch
xchg ebx, eax
lock adc dword [ecx + 0x691b6a0a], ebp
test eax, 0x691b6a0a
mov bh, 0xc
cmp byte [ecx - 0x5e], al
jne 0x1642374
invalid
inc ebx
pop es
inc byte [eax]
add byte [eax], al
add byte [ebp - 0x1d], al
push es
mov ecx, 0x74dc00fb
jmp 0x1642341
jae 0x1642353
test eax, 0x6ec41ffd
jmp 0x16423f2
fdivr qword [esi + ecx*8 + 0x1d]
dec ebp
xlatb
add dh, al
iretd

Function at 0x1643532
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov ebx, dword [esp + eax*2 - 0x1c448]
mov ebp, dword [esp + edi - 0x5104e21c]
add edx, dword [esp + edi - 0x5104e224]
mov dword [esp + edx*4 - 0x3742ec10], edx
mov edi, dword [esp + edx - 0xdd0baf6]
lea edi, [edi + edx - 0xdd0bb0a]
push eax
mov edx, dword [edx + edi - 0xdd0bb06]
mov dword [esp + eax - 0xe218], 0xf9148f17
push ecx
xor edx, ebx
imul cx, ax
cwde
dec edx
shl dword [esp + ecx - 0x5104a62c], 0x48
adc word [esp + ecx - 0x5104a63c], ax
pop eax
neg edx
bswap ecx
rol cl, 0xc5
setae cl
ror edx, 2
bswap edx
sar cx, cl
jbe 0x276289e
push 0xc5bb384f
call fcn.027406ed
xor ebx, edx
ror word [esp + eax - 0x5104e21b], 0xab
call fcn.026bb3e8

Function at 0x164363b
Capabilities:
Encrypt data using speck

Disassembly:
push 0x9cb5dda6
inc edx
ror byte [esp + 3], 0xe2
jae 0x2534302
call fcn.027665f7

Function at 0x165099c
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + edx], ebp
ret 4
pop ecx
pop ecx
pop eax
pop eax
pop edx
jno fcn.022ad6bc
adc ecx, dword [esi + ecx*2]
shl eax, 7
shr byte [esp + edx - 0x47168ad], 0xa6
je 0x25bb9a0
mov ax, word [ecx + edx*4 - 0x11c5a2c0]
push edx
jbe 0x27d0504
pop ecx
pop eax
jne fcn.027400f9
rol edx, 0xf8
adc esi, 2
mov word [esi], ax
xor edx, edx
jno 0x1560bc8