joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17597d2
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor eax, eax
inc esp
movzx ecx, bx
lea eax, [edx + eax + 0x476512ad]
rol eax, 1
not cx
call fcn.01364037
pop edx
pop edx
jne fcn.0128ae71
mov edx, 0x472250a1
movsx ebx, dx
inc edx
mov eax, dword [edx + esi - 0x472250a1]
sal bx, 0x83
dec eax
lea ecx, [edx*4 + 0xc181a84]
dec ebp
lea esi, [esi + edx - 0x4722509d]
xadd bx, dx
jl 0x124b00b

Function at 0x17598a6
Capabilities:
Encode data using base64

Disassembly:
dec ecx
lea ebx, [edx - 0x80]
pop esi
dec eax
lea esi, [edi + edi*2 - 0x10d8d641]
call fcn.01246f3b

Function at 0x17598b9
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop eax
rol ebx, 0x9c
inc ecx
push ebp
dec eax
arpl bp, bp
inc ecx
ror ebp, 0x3f
dec edx
dec dword [esp + ebp]
dec esp
adc ebx, ebp
sal si, 0xc6
inc ecx
pop edi
jne fcn.0123d4f8
inc edx
lea ebp, [ebp + 0x2e14270d]
inc cx
not ecx
xor ebp, 0x7b9e4db1
inc ecx
xor esi, ecx
rol ebp, 3
dec esi
mov dword [esp - 0x9ec4], eax
inc ebp
or esp, ecx
inc ecx
or ah, 0xac
inc edx
xor dword [esp + ebp*4], ebp
jmp 0x17bce1c
jmp 0x136a673
Function at 0x176aff2
Capabilities:
Encode data using xor

Disassembly:
inc ecx
dec ebp
jmp 0x134e7a2
inc ecx
mov ebp, dword [esi + edx - 0x1997f36b]
movsx esi, bx
js 0x17710e9
inc ecx
neg ch
dec eax
lea edx, [ecx*4 + 0x1c23848e]
inc esp
movzx ecx, cx
inc ecx
xor ch, 0xac
inc ebp
xor al, ch
dec esi
lea ebp, [esp + ebp + 8]
inc edx
mov ebp, dword [esp + ecx - 0xca84]
jmp 0x17aedc4
inc esp
or esp, dword [esp + ebp - 0x2101ff83]
or cl, 0x86
dec esp
mov dword [esp + edi - 8], eax
inc ecx
dec esp
shl dx, 0x6e
call fcn.01265141
inc cx
mov esi, dword [edx]
mov edx, 0x19970c94
not dx
inc ecx
mov cl, byte [edx + edx - 0x1997f369]
movsx ebx, dx
dec ebp
lea edx, [edx + edx*2 - 0x332fe6d4]
inc ecx
mov ebp, 0x8127002
inc esp
movzx esp, dx
shr si, cl
inc bx
inc bx
mov dword [edx + ebp - 0x8127002], esi
js 0x12975f8
inc ecx
mov ebp, dword [esi]
mov edx, 0x20a2f524
dec esp
lea ebp, [edx + edx - 0x74d6161]
push edx
dec esi
lea esi, [edx + esi - 0x20a2f520]
inc ecx
xor ebp, eax
not ebp
dec edx
neg dword [esp + ebp - 0x39f888e7]
inc ecx
mov esi, ebp
lea ebp, [ebp + edx + 0x80f0c14]
inc eax
dec dh
ror ebp, 2
sal dx, 0x41
xor ebp, 0x2d385109
inc cx
not ebp
dec esi
mov dword [esp + ebp*2 - 0x73f0ee30], eax
dec eax
lea edi, [edx*8 + 0x6139bb3a]
ror edi, 6
inc esp
mov ecx, esi
inc edx
xor dword [esp + ebp*2 - 0x73f0ee30], ebp
inc ecx
ror ebp, 0xb5
mov ecx, 0x2b04e4a5
inc ecx
pop eax
dec eax
arpl bp, bp
dec esp
add ebx, ebp
mov ebx, edi
dec eax
shl ecx, cl
dec ecx
mov eax, edx
inc esp
movsx esp, dh
inc ecx
not ah
dec ebp
lea edx, [edx + edx - 0x20a2ea4c]
mov ebp, edi
inc edx
mov dword [edx + edx - 0x20a2ea48], eax
inc ebp
mov edi, ecx
movsx eax, cx
jb fcn.0123d4f8
dec eax
not eax
dec eax
dec eax
inc ecx
movzx ecx, cl
dec ecx
sub esp, 0x837651a
dec eax
xor eax, 0x5939bd17
sub cl, 0x1c
dec eax
xadd ecx, ebp
dec esp
xor eax, eax
dec ecx
inc edi
dec esi
lea edx, [ebp + edx - 0xec]
dec ecx
mov dword [edx + ebp*4 - 0x390], eax
neg cl
jb fcn.0123d4f8
dec eax
mov dword [esp + edi - 8], edi
jmp 0x1223dc8
dec ebx
lea edi, [esp + 0x7fa8c314]
dec ebp
lea esi, [esi + edx - 0x1997f367]
inc ecx
mov eax, esp
jle 0x1796d69
add byte [eax], al
pop edi
push esp
jb 0x1771169
arpl word [ebx + 0x4d], bp
outsd dx, dword [esi]
jne 0x1771181
inc ebp
jbe 0x1771177
outsb dx, byte [esi]
je 0x1771115
call fcn.012653ad
rol eax, 2
lea edx, [ecx + ecx*8 - 0x6246c948]
xor edx, ecx
dec eax
jmp 0x179e6d6
das
shr byte [ecx - 0xb08be11], 0x41
mov dword [edx], edx
mov ebx, dword [esp + 8]
inc ecx
mov dword [edx + 4], eax
inc ecx
mov esi, dword [esi]
dec eax
mov dword [esp], ebx
ror word [esp + 0xa], 0xc4
and al, 0x66
ror dword [esp + 0xa], 0xc4
call fcn.01349a9e
mov ecx, edx
inc ecx
xor ebp, eax
push eax
inc eax
sub bh, byte [esp + edx*2 - 0x332fe6d0]
ror ebp, 1
xor ebp, 0x922e2b0b
not di
push esi
call fcn.013485b3
ror eax, 1
xor ebx, eax
dec edx
ror dword [esp + ecx - 0xca87], cl
dec ebx
mov edx, dword [ecx + ebp - 0xca87]
dec ebx
mov dword [edx + ecx - 0xca8d], edx
setae cl
dec edi
lea edx, [edx + ecx*4 - 0x32a22]
dec eax
lea eax, [ecx*2 + 0xe887e3b]
inc ecx
pop edi
jae fcn.0123d4f8
Function at 0x176bbac
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
pop ecx
inc ebp
movsx esi, sp
popfd
inc ebp
movzx ebx, sp
pop esi
pop edx
inc ecx
movzx eax, sp
inc ecx
pop esi
call fcn.01776bf9

Function at 0x176bbf1
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + ecx - 0xa1], eax
inc esi
xor dword [esp + ecx - 0xa1], ebp
dec edx
mov dword [esp + ecx*2 - 0x162], edi
dec di
dec esp
xor ecx, edi
dec esp
mov eax, dword [esp + ebp - 0x2bdf]
inc ecx
xadd cl, ch
dec ebp
arpl bp, bp
setb bl
dec ebp
add ebx, ebp
call fcn.012691ee

Function at 0x17706ae
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
inc ecx
push ecx
dec esp
mov eax, dword [esp + ecx - 0xffda]
call fcn.012646de
inc ebp
mov ebp, dword [esi]
dec ecx
add esi, 4
mov eax, 0x9999f11
inc ebp
xor ebp, eax
inc esp
movsx edi, al
inc ebp
lea ebp, [ebp + eax*4 + 0x1fa07349]
mov ebp, 0xbfb34631
inc ecx
xor bh, 0x84
inc cx
shr edi, 0x8d
inc ecx
bswap ebp
neg al
inc ecx
movsx ecx, bh
inc ecx
movzx ebx, di
inc ecx
ror ebp, 3
and bl, 0xb
dec ebx
inc ecx
dec ebp
movzx esi, al
dec esi
lea esp, [edi*8 + 0x24835601]
dec eax
not esi
inc ecx
push eax
inc esp
xor dword [esp + eax*2 - 0x13333fde], ebp
inc ecx
movzx edx, sp
inc ecx
pop eax
call fcn.01238962
dec eax
neg eax
xadd word [esp + 2], cx
call fcn.0176e280
bswap edi
dec edi
lea esp, [ecx + edi - 0x57db3f6e]
shl byte [esp + ecx - 0xffe0], cl
dec eax
cmovb ebx, dword [esp + ecx - 0xffe1]
dec esp
mov dword [esp + ecx - 0xffe1], eax
dec ebp
lea edi, [edi + ecx*4 + 0x18268793]
inc ecx
not edi
xor dword [esp + ecx - 0xffe1], edi
jmp 0x135afc8
dec eax
mov dword [esp + ecx*2 - 0x3c], ecx
not edi
setae bl
inc sp
and ecx, ebx
dec edx
mov dword [esp + ebp - 0x18286b89], 0xea95cb31
lea edi, [edi + ecx + 0xa3b49e9]
inc esp
mov esp, dword [esp + ecx*2 - 0x38]
dec eax
neg dword [esp + ecx*4 - 0x78]
inc esp
movsx edi, cx
inc ecx
xor edi, esp
not dword [esp + ecx - 0x1c]
not cx
jmp 0x137c481

Function at 0x17728a8
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
add ebx, ecx
dec edx
mov dword [esp + ebp + 0x1f], 0xe72583b8
dec eax
shr edx, 0x6a
jbe 0x17afdae
pop ebx
inc ecx
pop edi
pop eax
inc ecx
pop edi
inc ecx
pop esp
pop edi
jp fcn.0123d4f8

Function at 0x1779aa6
Capabilities:
Encrypt data using speck

Disassembly:
inc edx
sets byte [esp + edi*2 + 9]
pop edi
pop edx
inc ecx
pop esp
je fcn.0123d4f8

Function at 0x1779ab6
Capabilities:
Encrypt data using speck

Disassembly:
rol edx, 1
bswap edx
dec edx
lea eax, [ecx - 0x7ad98d6c]
rol dword [esp + ecx - 0x49cb36c6], cl
xor edx, 0x1e843694
neg eax
bswap edx
call fcn.01793d43
mov ebp, 0x8314f8bd
call fcn.0137c41e

Function at 0x178e07f
Capabilities:
Encrypt data using speck

Disassembly:
push ecx
pop eax
pop ecx
pop ecx
pop eax
jns fcn.0128ae71
rcl byte [ebp + 0x2b]
cli
inc ecx
add bl, byte [esi + 0x2f4e6be7]
invalid
Function at 0x179765b
Capabilities:
Encode data using xor

Disassembly:
dec dword [edi]
mov dh, 0xca
movzx ecx, dl
lea ebp, [ecx + ebp - 0xc2]
setno cl
xor eax, ebx
ror ecx, 0xbf
inc eax
mov dword [esp + ecx*8 - 8], edx
sar ecx, cl
rol word [esp + ecx + 0xf], 0xf
xor eax, 0xfab4cf9d
inc eax
neg eax
sar edx, 0xd3
call fcn.01779392
mov edx, 0x60687d56
jnp 0x179765a
invalid

Function at 0x17a2a7d
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
bswap ebp
dec eax
lea ebp, [ecx*2 - 0x675ef044]
dec eax
lea ecx, [ebp*2 - 0x1965cbcf]
inc ecx
shl bh, 0x26
inc ebp
lea ebp, [ebp + ebp - 0x2de74f7]
inc eax
add byte [esp + ebp + 0x675e1f11], ch
dec word [esp + ebp + 0x675e1f0c]
dec ecx
inc ecx
bswap ebp
jns 0x137cfe4
inc edx
lea eax, [eax + edi + 0x17ba49fa]
dec esi
mov dword [esp + edi - 0xbc], ebp
push edx
inc ecx
push edi
bswap eax
inc ecx
movzx esi, ch
not eax
call fcn.01372b7e
inc ecx
neg cl
inc ecx
xor cl, 0xac
inc ebp
xor al, cl
dec dword [esp + 0xf]
dec esi
lea ecx, [esp + ecx + 0x20]
inc eax
sal dx, 0xe8
dec ecx
mov ebx, dword [ecx]
dec ecx
mov dword [edx - 0x10], ebx
inc cx
and esp, 0xf641d38c
fisttp qword [ecx - 0x7d]
ret 0x41f0
inc ecx
not ebp
inc eax
shr ch, 0x63
inc esp
mov esp, dword [esp + ecx - 0x17ddf61a]
dec eax
mov dword [esp + ecx - 0x17ddf61c], ebx
inc ebp
lea ebp, [ebp + ebp*2 - 0x284a5458]
and word [esp + ecx - 0x17ddf616], bp
call fcn.0136ec04
dec eax
mov dword [esp + ecx - 0x689d], ecx
inc ecx
xor ebp, 0x373c8085
inc ecx
dec ebp
dec esp
lea ecx, [ebx + esi - 0x2eca34d]
jmp 0x1229b79

Function at 0x17a3a58
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
xor edi, 0x9f859392
inc eax
not dh
dec eax
lea eax, [esi + edi + 0xa81441b]
dec eax
neg edi
inc ecx
not edi
dec eax
mov dword [esp + ebx - 0x89], 0x9390daa0
inc ecx
rol edi, 2
inc ecx
mov esp, 0x6bbc1911
inc ecx
inc edi
dec esp
xor dword [esp + ebx - 0x89], esp
dec esp
mov dword [esp + ebx - 0x89], eax
inc esp
xor dword [esp + esi - 0x52b13c76], edi
inc esp
mov ebp, esi
inc ecx
pop eax
dec ebp
arpl di, di
dec ebp
add ebx, edi
dec eax
shr ebx, 0xec
inc esp
xor esp, ebx
call fcn.0129862e
cmc

Function at 0x17a4e76
Capabilities:
Encrypt data using speck

Disassembly:
bswap eax
dec eax
mov dword [esp + edx - 0x6f17], 0xfcb49604
rol eax, 1
dec eax
rol edx, 0xff
inc ecx
pop edi
dec ecx
xor edi, 0x2430f400
not eax
xor si, 0x2d37
shl ecx, cl
inc ecx
push eax
dec eax
sbb esi, edx
xor dword [esp + ecx - 0x80000000], eax
inc ecx
pop eax
not dl
dec eax
shl esi, 0x77
dec eax
arpl ax, ax
and dx, dx
inc eax
ror ch, 0x85
je 0x1342825
dec esp
add ebx, eax
inc esp
mov esp, ebp
dec eax
or ebp, 0xae8f519d
dec ebp
mov ebp, dword [edx + ebp + 0x1708043]
inc ecx
rol edi, 0xbe
jne 0x17aed72
inc eax
neg ch
dec ecx
mov esi, dword [edx + ebp*4 + 0x5c202fc]
dec ebp
lea edx, [edx + ebp*2 + 0x2e10182]
movzx eax, bl
dec ecx
not ebp
dec esp
lea ecx, [eax*8 + 0x55a16b0d]
call fcn.01383785

Function at 0x17a5d2e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push esi
test edx, edx
jmp 0x1267de1
push ebp
and ebp, esp
mov ebp, esp
xor dh, 0xbc
rcl edx, 0x38
mov edx, dword [ebp + 8]
lea esp, [esp - 0x114]
jmp 0x175889d
Function at 0x17b10ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor cl, byte [esi + edx*8 - 0x29f16]
sub word [esp + edx*2 - 0xa7c5], dx
ror edx, 0x8a
add esi, 2
sar dl, 0x21
shr al, cl
mov word [esi], ax
pop edx
jmp edi
jbe fcn.0128ae71
dec ebp
adc ebx, ebp
or ebp, ebp
call fcn.0133f294
mov ebp, 0xa7a979ad
inc ecx
div ebp
movsx edi, bp
inc esp
movsx esp, di
inc ecx
movsx esi, sp
inc edx
mov dword [edi + edx - 0x79ad], edx
shr edi, 0x1f
inc ecx
inc ah
inc edx
mov dword [edi + edx + 4], eax
inc ebp
mov ecx, dword [esi + edi*4]
push edi
jnp 0x1399a18
not edx
not eax
add edx, edx
rol eax, 1
sar ecx, 0x79
neg eax
sub dx, 0xe995
xchg cx, dx
xor ebx, eax
add edi, eax
rol edx, 0xaa
cmovb edx, ecx
rdtsc
sub esi, 8
or ecx, 0x6a9db81c
sal ecx, 8
mov dword [esi + 4], eax
mov dword [esi], edx
jbe 0x127a93b
xor ecx, ecx
sal ecx, 0x9a
xor eax, ebx
inc eax
lea ecx, [edx + edx*4 - 0x5c79217e]
shl ecx, 0x9c
bswap eax
adc dx, 0xf2a2
rol eax, 2
dec eax
push ecx
xor ebx, eax
add edi, eax
movzx ax, byte [esi + edx*4 - 0x14f88]
inc edx
jge 0x125653b
rol eax, 1
mov edx, 0x978ed23e
lea edx, [edx*8 - 0x3066baca]
neg cl
lea eax, [ecx + eax - 0x7071dbb8]
setle dl
neg eax
jmp 0x137adf3
inc cx
ror esp, 0x25
dec esi
lea esi, [edi + esi + 4]
movzx ebx, bp
dec eax
ror dword [esp + edi*2], 0xe9
inc ebp
xor ecx, eax
dec eax
rol dword [esp + edi], 0x18
inc ecx
not ecx
dec esp
lea ebp, [ebx + edi*8 + 0x3125460d]
inc ecx
neg ah
pop edi
inc ecx
dec ecx
push ebx
dec eax
neg dword [esp + edi*4]
inc ecx
rol ecx, 3
dec eax
shl ebp, 0x29
inc ecx
sub ecx, 0x9e21e51e
dec esp
mov dword [esp + edi], eax
inc ecx
shr esp, 0x45
inc ecx
push ebp
dec edx
add dword [esp - 0x732], esi
inc esp
xor dword [esp + edi*8 + 8], ecx
dec esp
mov eax, dword [esp + edi + 8]
inc ecx
push ebp
and byte [esp + edi*2 + 9], bl
inc byte [esp + edi + 8]
dec ebp
arpl cx, cx
inc ecx
movzx ecx, bp
inc ecx
xor bh, ah
dec ebp
adc ebx, ecx
shr ebp, cl
movsx edx, bp
dec esp
mov dword [esp + ebp], ebx
ret 0x10
inc esp
xor al, dh
dec eax
lea esi, [esp + esi + 8]
dec bl
sete dl
inc eax
dec bh
inc esp
mov dword [esi + ebx - 0x55029596], ebp
xor dl, 0xd
call fcn.013408a9
mov eax, dword [ebp]
movzx edx, cx
lea ebp, [ebp + edx*8 - 0x309f4]
jmp 0x138f790
Function at 0x17b49e8
Capabilities:
Encrypt data using speck

Disassembly:
inc edx
mov dword [esp - 0x7db2442b], eax
inc edx
setne byte [esp + edi - 0x3f]
dec ebp
lea esi, [esi + esi*4 - 0x1c97]
inc ecx
xor ch, al
call fcn.01385af0
xor eax, ebx
rol dx, 0x6a
lea ecx, [edx + edx*2 + 0x7bba2397]
inc ecx
rol eax, 2
neg eax
or cx, cx
sbb ecx, 0x18186110
setb dl
ror eax, 1
not ecx
lea eax, [ecx + eax + 0x54d81120]
add cl, dl
sub edx, ecx
dec edx
xor ebx, eax
shr ecx, 0xda
jne 0x1267562
and eax, 0xf218f07
int 0xf
mov bh, 0xf1
dec esi
mov dword [esp + edi*8 - 0x1f8], eax
dec eax
rol ecx, cl
xor dword [esp + esi*4 - 0x1c94], ebp
push ecx
dec esi
mov eax, dword [esp - 0x7db24437]
dec eax
arpl bp, bp
dec esi
mov dword [esp - 0x7db24437], esp
inc eax
inc dh
dec esp
add ebx, ebp
dec edx
sar dword [esp + edi - 0x37], 0xc1
jg 0x136c952
dec esp
mov ebp, dword [esp + 8]
dec ecx
add ebp, 0xffbe7fa2
inc ecx
jmp ebp
adc edi, eax
movzx eax, cx
mov cl, byte [esi + ecx*2 - 0x4e]
call fcn.0133e0ef
inc eax
push ebp
and ch, byte [eax - 0x66]
js 0x126750d
invalid
rol dl, 0x63
jb 0x1754b8e
inc ebx
mov ebx, dword [ebp + esi]
dec edi
lea esi, [ebp + esi + 4]
inc ecx
mov eax, ebp
inc ecx
xor ebx, eax
call fcn.01388457
dec eax
xchg ebx, esi
dec esp
mov dword [esp + eax*2 - 0x5f517a86], eax
inc esp
xor dword [esp + eax - 0x2fa8bd43], ebp
inc ecx
pop eax
dec ebp
arpl bp, bp
inc esp
movsx esp, bl
jmp 0x1396100
inc bx
mov ebx, dword [edx - 0x7db2443f]
inc ecx
push edi
dec edi
lea edx, [esp + edx - 0x7db2443d]
dec edx
dec dword [esp + edi - 0x37]
inc edx
sbb dword [esp - 0x7db24434], edi
inc ebx
movzx ebp, byte [esi - 0x7db2443f]
jp 0x12266d0
mov cl, 0xe9
xor ch, byte [eax + 0x6b]
les eax, [esi + 0x37c9a2fe]
les eax, [esi + 0x3fd58ffe]
les eax, [esi + 0x27e9f7fe]
les eax, [esi - 0x11301c02]
cmpsb byte [esi], byte es:[edi]
cmp al, byte [eax]
inc ecx
or eax, 0x48096a27
add dl, al
and byte [eax + 0x670f8d0a], 0x6f
cmp eax, 0xc56c3dfa
pop es
out dx, al
adc dword [ecx + 0x1840c5d5], ecx
sal dword [eax + 0x1b], cl
mov byte [0xa371c364], al
iretd
dec ebp
add ebx, ebp
push esi
dec eax
sar edx, 0x8d
inc eax
or dh, cl
dec ebp
lea ebp, [edx + eax - 0x2fa8bd3f]
call fcn.0178f241
jb 0x17bcc59
inc esp
sub ebp, ecx
shl bp, 0x85
jne 0x1365a63
mov cl, byte [esi + 2]
lea eax, [eax - 0x6459e0cc]
call fcn.0134075c
lodsb al, byte [esi]
adc eax, 0xffff09ce
jp 0x122e1a1
sar dl, 0xa6
dec ecx
bswap ecx
mov dword [esp + edx], eax
and eax, eax
ror ecx, 1
lea eax, [eax + eax*2 + 0x281ffb28]
not eax
neg edx
xor ebx, ecx
dec byte [esp + edx*4]
jge 0x129ceda
inc ax
lea esi, [edx + esi - 4]
pop eax
xor eax, edx
sal eax, 0x38
mov dword [edx + esi], ecx
push edx
call int.017597d2
adc dword [edx + 0x7f], ebp
push 0xfecb47cb
push es
jge 0x17b49c3
inc edi
retf
rol ecx, 1
xor ebx, ecx
add edi, ecx
movzx ecx, word [esp]
pop ecx
mov dx, word [esi]
dec al
jne 0x17825cf
Function at 0x17b8134
Capabilities:
Encrypt data using speck

Disassembly:
add edx, edx
lea esi, [esi + edx - 0x527ffa]
neg edx
mov byte ss:[ecx], al
call fcn.0129a39b
dec esp
adc ebx, ecx
dec ecx
or edi, ebx
jmp edi
inc ecx
xor ecx, eax
and di, bx
inc cx
sar esp, 0xc1
sal dx, 0x2d
inc ecx
lea ecx, [esp + ecx + 0x2d3ad632]
xor ecx, 0xa880f81f
shl ebx, 0xc6
inc ecx
mov esi, esp
lea ecx, [ecx + ebp*2 - 0x52769366]
inc ecx
mov eax, edi
jp 0x135d142
add ebp, 4
mov ecx, 0x9780a413
movzx eax, cl
xor edx, ebx
shr al, 0x61
lea edx, [eax + edx + 0x599ecbaa]
sar eax, 0xb5
sbb al, 0x95
inc eax
neg edx
inc edx
shr cx, 0xc8
xchg ecx, eax
lea ecx, [eax + ecx*2 + 0x35085591]
neg edx
dec ecx
xor ebx, edx
inc ax
inc cx
add edi, edx
mov ecx, dword [esi]
movzx edx, al
rol edx, 0x6e
mov al, byte [esi + edx*2 - 0x527ffc]
jae 0x1222153
xor ecx, 0xe2281802
inc eax
shl dh, 0x43
inc ebp
movsx ebp, cl
bswap ecx
sal dl, 0x64
inc esp
cmovns esp, ebx
dec esp
sbb ecx, esi
inc ecx
push eax
xor dword [esp + ebp*2 + 0x7ba2e5b6], ecx
inc ecx
pop eax
dec eax
shr ebp, 0xb
dec eax
arpl cx, cx
inc sp
adc esp, eax
js 0x1244c0d
mov edx, dword [ebp]
mov ecx, 0x28968a7
lea ebp, [ecx + ebp - 0x28968a3]
call fcn.017cd799
dec ebp
lea edx, [edx + ebp*2 - 0x3c]
or word [esp + ebp - 0x1c], 0xc031
inc ecx
mov esp, 0x3203db8d
dec eax
lea edx, [ebp + ebp - 0x7ec4584a]
not cl
inc esp
adc dword [esp + ebp - 0x1c], esp
inc cx
sal esp, 0xe9
pop edi
inc ecx
not cl
dec eax
xchg edx, ebp
inc ecx
and cl, cl
inc ecx
movsx ebx, sp
inc esp
movzx ecx, ch
dec eax
lea ebp, [ebx*4 - 0x3dd1dadb]
inc cx
mov dword [edx + ebp*2 + 0x7ba2e5b6], ecx
xor edi, edi
dec esp
lea edi, [ebx*8 - 0xf5b8dd8]
inc ecx
mov ecx, dword [esi + ebp + 0x3dd172db]
dec esi
lea esi, [ebp + esi + 0x3dd172df]
jp 0x129cb11
xor eax, ebx
xchg ch, dl
and dl, cl
sub dx, dx
rol eax, 2
neg eax
sub edx, ecx
ror eax, 1
neg cl
add eax, 0xf133bb0f
xor ebx, eax
add edi, eax
ror ecx, cl
jmp edi
dec esp
mov dword [esp + ebp - 0x84b0], edi
dec esp
mov eax, dword [esp + ebp - 0x84a8]
dec edx
lea ebx, [edi*4 + 0x328ca411]
dec eax
arpl ax, ax
call fcn.017631b5
mov ecx, 0x8b20791f
push ecx
movsx ebp, cl
inc cx
movzx ecx, byte [edx + ebp*2 - 0x3e]
inc ebp
mov cl, byte [edx + ebp*2 - 0x3c]
jmp 0x174f68e

Function at 0x17bb8b7
Capabilities:
Encrypt data using speck

Disassembly:
neg eax
push ecx
add ecx, 0x658ae2a1
call fcn.01788ce0
add ebp, 4
dec dl
neg cl
mov dword [esp], 0x6fb41c20
xor eax, ebx
and dx, word [esp + 9]
shl word [esp + 2], 0xe6
sub eax, 0x86b3d6ac
jmp 0x12375d5
Function at 0x17bceb9
Capabilities:
Encode data using xor
Encrypt data using speck

Disassembly:
push 0x2c87089a
add eax, edx
mov dword [ebp - 4], eax
dec dword [esp + 4]
test ebx, ebx
lea esp, [esp + 8]
je 0x125a2e9
push 0x42b25488
mov eax, dword [ebp + ebx*4]
push 0x4ca49088
mov dword [esp + 4], eax
dec ebx
lea esp, [esp + 4]
jne 0x125a2cc
jmp 0x17b90ef
not eax
mov edx, 0x4787a48f
movsx ecx, dx
mov dword [edx + esi - 0x4787a48f], eax
and ecx, 0x380c2221
mov eax, dword [ebp + ecx*2 - 0x70184002]
lea ebp, [edx + ebp - 0x4787a48b]
call fcn.0178e010
aam 0x42
cmp cl, bh
push eax
pop ds
mov esi, 0x214776cc
out 0x1f, al
mov eax, 0x4620d4bf
or eax, 0xffa80127
add eax, eax
mov ecx, dword [esi]
jge 0x125a2b1
mov eax, dword [esi + 4]
mul ecx
mov dword [esi], edx
mov edx, 0x3a25d69d
jmp 0x12a3be3
mov dword [edx + esi - 0x3a25d699], eax
movsx eax, dx
call fcn.013688bc
lds eax, [esi + 0x3c]
push esp
or dword [esi + 0x3a4277c6], edi
xchg esp, eax
pop edi
push ebp
mov ebp, dword [esp + ecx*2 - 0x14fc0002]
mov dword [esp + ecx*8 - 0x53f00014], ecx
mov eax, dword [ebp + ecx*8 - 0x53f00018]
lea ebp, [ebp + ecx*8 - 0x53f00014]
xor eax, ebx
add ecx, dword [esp + ecx*2 - 0x14fc0003]
dec cx
sbb eax, 0x2930dd98
movzx edx, byte [esp + 4]
lea edx, [edx*2 + 0xdb83b14]
pop ecx
not eax
lea edx, [ecx*4 + 0x7b8d3cad]
sub eax, 0xe1340c0e
inc byte [esp]
rol eax, 1
and cl, 0xba
ror edx, 5
xor ebx, eax
dec dx
ror dl, 5
add edi, eax
pop edx
jmp edi
mov eax, dword [ebp]
push 0x338a98be
lea esp, [esp + 4]
call eax
mov ebx, 0xfc000614
mov ebp, dword [ebp - 4]
ror ebx, 0xe9
movzx esi, bl
mov dword [ebp + ebx*4 - 0x29f8000c], eax
mov ecx, ebx
mov esi, ebp
mov ebp, 0xd19143b3
pop ebx
movzx edi, cl
jae 0x1745445
test ecx, ecx
lea esp, [esp + 8]
je 0x129a760
push 0xde3a542b
mov dword [esp], edi
mov edi, 0xdd1afe8b
movzx edi, byte [edx]
xor edi, eax
call fcn.017438c5

Function at 0x17ca777
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
bswap edi
ror byte [esp + ecx*2 + 2], 0x43
dec edx
lea esi, [ebx + ecx*8 - 0x28df4efb]
inc esp
movzx ebp, ch
dec eax
rol edi, 7
call fcn.01758c17
mov edx, dword [esp + edx + 0x6dd87f88]
mov dword [esp + 8], 0xe6b0268a
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.0176c44c
dec eax
lea edi, [edi + ecx*4 + 0x73c67ae]
dec eax
mov dword [esp + ecx*8], ecx
mov ebp, ebx
or byte [esp + ecx*2 + 4], 0x97
dec eax
neg edi
inc esp
movzx ecx, bx
and word [esp + ecx + 6], bx
je 0x175a434

Function at 0x17cb184
Capabilities:
Encrypt data using speck

Disassembly:
call 0x13545bc
inc esp
movzx ebp, cl
rol bl, 1
dec esi
lea edi, [ebp + ebp*2 + 0x6e195189]
dec ecx
shr ebp, 0x6c
xor bl, 0xaf
Function at 0x17cbe58
Capabilities:
Encrypt data using speck

Disassembly:
movsx eax, dl
add ebp, 4
jmp 0x13563c3
push edx
and byte [esp], 0x16
xor ecx, ebx
add al, byte [esp + 1]
ror eax, 0xee
xchg dword [esp + 4], eax
sub ecx, 0xb50eda9c
inc eax
xor ecx, 0x441ca18f
ror byte [esp + 1], 0xe2
push eax
or ax, ax
neg ecx
inc al
xadd dx, ax
inc ecx
xor ebx, ecx
xchg edx, eax
and ax, word [esp + 6]
shr dword [esp + 6], 0xed
add edi, ecx
call fcn.0129df86
add esi, 2
and al, dl
not al
mov word [esi], ax
mov edx, ecx
mov ecx, dword [ebp]
mov dword [esp], edx
jmp 0x133ea50

Function at 0x17ce6c6
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov byte [esi], al
jmp 0x1757d2a
mov dword [ebp - 4], eax
mov ebx, ecx
cmp ecx, eax
jmp 0x129b51a
mov eax, 0x11392193
mov cl, dl
rol eax, cl
lea esi, [ebp + edx - 0x10c]
add al, dl
xor al, byte [edi + esi]
jmp 0x126ce21
je 0x179758a
inc edx
stc
cmp edx, 0x104
jmp 0x1797584
jb 0x128a3da
mov eax, dword fs:[0x30]
sbb ebx, esp
neg bl
mov eax, dword [eax + 0xc]
ror ch, 0xb1
ror cl, cl
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
jmp 0x126f496
jmp 0x128a3da
movzx esi, di
or esi, 0x9499debd
inc ecx
and ecx, ecx
inc ecx
pop esp
call fcn.017bc2a8
bts eax, eax
lea eax, [ebp - 0x10c]
test sp, cx
clc
xor edx, edx
sub edi, eax
jmp 0x17ca7d1