joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14c983c
Capabilities:
Encode data using xor

Disassembly:
inc ecx
not dl
inc ecx
xor dl, 0x8e
inc ecx
inc dl
inc ebp
xor bl, dl
dec ecx
lea ecx, [eax + ebx*8 + 0x161033a3]
dec esi
mov dword [esp + eax], eax
dec esi
lea edx, [esp + edx + 0x18]
inc cx
movzx ebx, byte [edx + ebx - 0x2390bb00]
dec edx
xadd dword [esp + eax*2 + 0xb], edi
dec edi
lea esp, [esp + eax*8 - 2]
movzx edx, cl
inc bx
mov dword [eax], ebx
dec eax
inc ecx
inc ebx
mov edx, dword [ebp + eax*2]
inc dx
sal dword [esp + eax + 0x14], cl
dec esp
lea esi, [edi + edi*2 + 0x400686af]
dec edi
lea ebp, [eax + ebp + 4]
inc edx
xor dword [esp + eax*8 + 0x14], ecx
dec esi
lea ecx, [esi*4 + 0x31077632]
inc ecx
xor edx, ebx
inc eax
movzx ebx, bh
jmp 0x14feeec
inc eax
rol bh, 0xe7
ror edx, 2
ror bl, 0x85
inc ecx
inc al
lea edx, [edx + ebx*4 + 0x2145eae]
push edi
inc edx
xadd dword [esp + eax*2 + 0x15], ebx
inc ecx
movsx eax, dh
neg edx
inc eax
or bh, 0x12
rol edi, cl
inc ecx
lea edx, [eax + edx - 0x601bba90]
in al, 0x9f
inc ebp
movsx edi, cl
dec eax
bswap ebx
dec esi
mov dword [esp + eax + 0x17], ebx
dec edx
rol dword [esp + eax + 0xd], cl
inc edx
not dword [esp + eax + 0xd]
inc edx
xor dword [esp + eax*2 + 0x16], edx
dec esi
mov ebx, dword [esp + eax + 0x17]
dec edx
mov dword [esp + eax + 0x17], 0x758f29be
dec eax
and edi, 0x6728b010
inc ebp
mov edx, edi
dec eax
arpl dx, dx
call fcn.023deb66
mov ebp, 0x95310f20
push ds
and ah, byte [ebx + 0x58]
fistp dword [ecx - 0x2a16c6b0]
sub ch, dh
call 0x95cacf49
jo 0x14fef11
mov ah, 0x33
mov es, word [edx + 0x2c2fd4c9]
dec eax
popal
aad 0xc3
test eax, 0x8530112c
jp 0x14fef19
mov al, 0x12
mov ch, 6
mov al, byte [0x922c2cea]
pushfd
mov dword [edx + 0x40], esi
xor ebp, ebp
lcall 0xeb40, 0x5d1c564e
cwde
test bh, 5
fist dword [ebp - 0x7d]
jg 0x14fef8e
inc ebp
into
adc eax, 0x15a8b588
sub dword [ecx - 0x15d883c3], ebp
inc ebx
fistp dword [esi + 0x2625ead5]
invalid

Function at 0x14d4a5c
Capabilities:
Encrypt data using speck

Disassembly:
bswap edx
dec al
lea edx, [edx + eax + 0x2d9a223e]
rol edx, 1
rol cx, 0x44
inc word [esp + eax*2 - 0xc1ba]
xor edx, 0x28c41a3
inc cl
call fcn.0250014a
Function at 0x14ecaa8
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + edx - 0xa800], 0xdf97eb3b
rol ecx, 3
shr edx, 0xe1
jge 0x2520264
rol dx, 0xef
xor ecx, 0x68aac482
sal dl, 0x24
ror ecx, 3
neg eax
inc ecx
push eax
bswap ecx
inc ecx
xadd byte [esp + eax + 3], dh
and word [esp + eax + 1], dx
jle 0x23ffe91
call fcn.0256141e
jo 0x14ecb03
xchg ebx, eax
or byte [edx + 0x4c6b6de0], 0x21
out 0x75, eax
pop esi
push cs
mov dword [0x76fba391], eax
push eax
inc ebx
xor eax, 0xd03346f1
inc esi
xor edx, eax
and cl, cl
pop ebp
cmp ah, cl
push ebp
push edx
add al, 0xdf
sub al, 0xda
cmp edi, dword [edx + 0x1cb39488]
mov edx, 0x1cb39488
mov dx, word [edi + ecx*2 + 2]
lea edi, [ecx + edi + 2]
ror ecx, 0xbb
and ecx, ecx
not ax
adc ecx, ecx
call fcn.0255ca88
xor ebx, ecx
rol dword [esp + eax*4], 0xfa
adc edi, ecx
shl dword [esp + eax*2], 0xae
jbe 0x254b12a
xor ebx, ecx
add edi, ecx
mov dx, word [esi + edx*8 - 0x2a000]
mov ecx, 0xd27e931
mov eax, ecx
mov ax, word [esi + ecx*2 - 0x1a4fd260]
ror ecx, 0x64
ror cx, 0x4f
mov cl, byte [esi + ecx*4 - 0x434bf494]
add esi, 4
sal dword [esp + 4], 0xdd
shrd dx, ax, cl
not byte [esp + 2]
mov word [esi], dx
mov edx, 0xdc1dab07
rol dx, 0xe6
add byte [esp + 5], dh
pop edx
pop eax
jmp edi
add dword [esp + eax*2], edi
ret

Function at 0x1502b1d
Capabilities:
Encode data using xor

Disassembly:
xor edx, 0x230adb2a
not edx
inc edx
mov dword [esp + ecx - 0x6bff105], eax
call fcn.02424ab8
syscall
call fcn.02472c3c
sti
mov esp, 0x5c28d4b2
pop esp
mov ecx, 0x53fb6f1f
push esp
dec ebp
mov cl, bl
sub byte [edi - 0xa602fff], ch
sbb byte ds:[ecx + 0x579ea3a8], cl
sahf
push edi
cmp ch, byte [ebx]
or esp, esi
pop ds
add eax, 0xf9463703
dec dword [edx + edx + 0x3f]
mov esi, 0x61c274a8
xor edi, ecx
js 0x1502b3e
mov esi, 0xd51e406f
jge 0x1502b53
aam 0xcc
loopne 0x1502b7d
les edx, [eax - 0x4d7013b9]
das
cld
adc dl, bl
das
cmp ecx, dword [ecx]
add ebx, 0x214f7476
mov ebp, es
salc
popfd
dec ebx
invalid

Function at 0x150554b
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [ebp]
add ebp, 4
mov eax, 0x861f448c
neg ax
xor ecx, ebx
pop eax
sub ecx, 0x1431ef89
mov edx, 0xfb3ee79e
movsx eax, dl
ror ecx, 1
not ax
xor ecx, 0xd80c0d13
push edx
dec ecx
sar eax, 0xe
xor ecx, 0x76a246b1
jmp 0x243d293
xchg word [esp + 1], dx
not ecx
rol ecx, 1
not ecx
add edx, dword [esp]
dec ecx
shl edx, 0x8f
inc ax
xor ebx, ecx
call fcn.0157c296
Function at 0x157105c
Capabilities:
Encrypt data using chaskey
Encrypt data using speck

Disassembly:
mov cl, byte [ebp + 4]
call fcn.02557a32
in eax, 0xd5
sub esp, eax
imul edi, dword [ebp - 0x42b3aecb], 0x24266995
sbb dword [ebp - 0x15], edx
push esi
jns 0x15034c9
and edx, edx
cmp dword [ebp - 0x19], esi
pop edx
invalid
push 0x10
jmp 0x37dee276
lea esp, [esp + 8]
je 0x254a2e8
call fcn.0243b8d8
mov ecx, dword [edi]
add edi, 4
xor ecx, ebx
xor ecx, 0x7533b520
mov eax, 0x6980999e
mov edx, eax
add edx, 0xb3006f9a
bswap ecx
adc dl, dh
not ecx
neg ecx
inc al
add ax, dx
bswap ecx
shl dx, 0xac
xor ebx, ecx
add esi, ecx
call fcn.024c75fb
mov ecx, 0xc682cfa9
sub ebp, 4
movsx edx, cl
mov eax, dword [ebp]
xor eax, ebx
sub eax, 0xec1be28a
inc dx
jo 0x24b83a9
rol eax, 1
lea eax, [eax + ecx - 0x52fca00b]
xor eax, 0x3363016
xor ebx, eax
add edi, eax
movsx eax, dx
rol ecx, cl
sbb cx, ax
movzx dx, byte [esi + ecx - 0x59f53e2]
jp 0x24124a6
outsd dx, dword [esi]
sbb al, 0x9c
add byte [edx + 0x595068e5], 0x36
jns 0x1571137
ret 0xc125
mov dword [0x66d6c0c1], eax
shr ecx, 1
not eax
rcr edx, cl
pop ecx
mov dword [ebp], edx
shl al, 0xe2
sbb esi, 4
movsx ecx, al
mov edx, eax
sub eax, eax
adc eax, dword [esi + eax]
not edx
ror cx, 0xc1
xor eax, ebx
xchg edx, ecx
call fcn.02584577
add edx, edx
sub cl, 0x30
ror eax, 2
neg eax
bswap eax
xor ebx, eax
add esi, eax
sal ecx, 0xc6
sub ebp, 1
movzx eax, cl
push edx
jmp 0x254b9ef
xor bl, dl
not ecx
add edx, esp
jmp 0x2466828
neg eax
xor eax, 0xa0a6a1a
lea ecx, [edx*4 + 0xea1872c]
neg eax
bswap edx
add edx, 0x3b2dd909
not eax
jne 0x15aee98
inc cl
mov cl, byte [esi + ecx*8 - 0x2cfa9f16]
add esi, 2
shr dl, cl
mov word [esi], dx
ror eax, 0x41
jmp edi
add al, byte [eax + edx]
sub edi, 2
or ecx, 0x4e1e23bb
mov word [edi], ax
lea ecx, [ecx - 0x52566173]
dec ecx
mov edx, ecx
jle fcn.02523680
bswap edx
xor ebx, edx
call fcn.02479bfd
mov eax, dword [ebp + ecx*2 - 0x3a26a71c]
shr dx, 0x29
not cl
xor eax, ebx
xor eax, 0x5934e529
or cx, 0x170c
sbb dx, 0x9317
jne 0x16533db
mov eax, 0xbb0e9582
movzx edx, al
mov edx, dword [ebp + edx - 0x82]
shl al, 5
adc ebp, 4
xor edx, ebx
inc edx
rol edx, 1
mov ecx, 0x502d6bae
and cl, cl
bswap edx
dec dl
sal eax, 6
seta al
neg dl
not cx
sal eax, cl
sbb ecx, ecx
ror dl, 1
xadd eax, ecx
jae 0x163ae73
mov ecx, 0xe020682d
sub ebp, 4
mov eax, dword [ebp]
movzx edx, cx
shr cx, cl
add ecx, edx
xor eax, ebx
xor eax, 0x261e9323
xor cx, 0xd716
inc eax
not cx
rol eax, 1
call fcn.025924ac
mov dword [esp + 1], 0x8b9e00a2
not edx
inc edx
not edx
movzx eax, cl
rol cx, 6
ror edx, 3
mov dword [esp + eax*2], 0x5f214b8d
sub al, 1
xor ebx, edx
add esi, edx
and ax, cx
push ecx
mov dx, word [eax + ebp - 0x31]
add dword [esp + eax - 0x29], eax
mov ax, word [eax + ebp - 0x2f]
pop ecx
jno 0x150347a
xor edx, ebx
xor eax, eax
neg eax
lea ecx, [eax + eax*8 - 0xa7976c7]
neg edx
and ecx, ecx
sal ecx, 0x66
inc edx
inc ax
call fcn.0168256e
movzx edx, byte [ebp + eax*8]
sar dword [esp + eax*4], 0xf7
pop eax
shr al, 0x87
xor dl, bl
add dl, 0x23
inc eax
rol dl, 1
ror cl, 0xc7
inc al
jae 0x24f1f78
Function at 0x1574a9a
Capabilities:
Encode data using xor

Disassembly:
call fcn.02546032
inc ebp
mov al, byte [esp + edx*8 - 0x231ee]
dec eax
lea ebx, [eax + eax*4 + 0x4235890f]
dec esi
lea esp, [edx - 0x463c]
inc ebp
adc dh, al
movsx ebp, ax
dec esp
lea ecx, [eax + ebx*2 + 0x543184a5]
not ax
inc si
mov dword [edx - 0x463e], esi
jmp 0x2471a01

Function at 0x1587e58
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, ecx
sar dx, 0x49
js 0x24f556c
add edi, ecx
mov dword [esp + edx - 0x6a1c0012], edi
ret 4
sar cx, cl
lea eax, [eax + edx - 0x22e88695]
sub cx, dx
ror eax, 2
and edx, ecx
inc edx
xor ebx, eax
ror cx, 0xa1
sbb edx, 0x531452bc
adc esi, eax
mov ax, word [ebp + edx - 0x7167ad49]
xadd ecx, edx
call fcn.023cf98c

Function at 0x15a581a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx*2 - 0x700000], edi
ret 4
ror eax, 3
movsx ecx, dl
mov dword [esp + edx*2 - 0x700000], edx
bswap eax
push edx
xadd byte [esp + edx - 0x37fffb], ch
ror eax, 1
xor ebx, eax
ror dl, 0x42
shr dword [esp + edx - 0x37fffe], 0x23
adc edi, eax
movzx eax, word [esp + edx*2 - 0x6ffffc]
inc dword [esp + edx*2 - 0x6ffffc]
jge 0x15020f2
sub byte [ecx + esi*2 + 0x70b408f0], cl
xor eax, 0x8eb0f7db
dec edi
xchg bh, dh
cmc
add bh, dh
push edi
wait
sub eax, dword [ebx]
or byte [ebx], bl
cmp eax, dword [ebp + 0x5e08ec02]
invalid

Function at 0x15b4d6a
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [ebp]
pop eax
mov eax, dword [ebp + 4]
push 0xd69c98ad
imul ecx
mov ecx, 0x978015b8
mov dword [ebp], edx
sal cx, 0x2b
sal ecx, 0x17
movzx edx, word [esp + ecx]
mov dword [ebp + ecx + 4], eax
lea esi, [esi + ecx*2 - 4]
add word [esp + ecx + 1], dx
mov edx, dword [esi + ecx*2]
sar ecx, 0x46
sbb cx, word [esp + ecx + 2]
sal ecx, cl
xor edx, ebx
dec ecx
add edx, 0x91ae3711
rol cx, 0x41
mov eax, dword [esp + ecx*8 - 0xa757ff0]
bswap edx
xchg al, cl
rol dword [esp + ecx - 0x14eafad], cl
ror word [esp + ecx*2 - 0x29d5f58], 0x28
lea edx, [edx + ecx + 0x5e40a5d7]
bswap edx
rol ecx, 0x39
inc cl
xor ebx, edx
call fcn.0240910d

Function at 0x15f2241
Capabilities:
Encrypt data using speck

Disassembly:
xor eax, dword [esi + eax*4]
lea esi, [ecx + esi + 4]
xor eax, ebx
push ecx
add eax, 0x9fbcf085
call fcn.01624cb4

Function at 0x15f3b02
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xb5
int1
fcomp qword [edx]
adc dword gs:[ebx + 0x2a9eb9ed], eax
and al, 0xae
add eax, 0xbc8b45bb
inc ebp
mov edi, dword [ebp + edx - 0x14209811]
dec eax
mov dword [esp + edx*2 - 0x28413022], 0xc5079518
dec ebp
lea ebp, [ebp + edx - 0x1420980d]
rol dword [esp + edx*2 - 0x2841301e], 0x4c
or dword [esp + edx - 0x14209810], edx
inc ebp
xor edi, ebx
dec eax
lea eax, [edx + edx*2 - 0x75eb6cd1]
inc esi
lea edi, [eax + edi - 0x3f8c307e]
inc ecx
neg edi
call fcn.025ba4ba
sar ecx, cl
mov dword [ebp], edx
mov edx, dword [edi]
jae 0x25056b9
shr byte [ebp + ebp*4 - 0x506451cd], 1
push es
jb 0x15f3aab
mov esi, 0x191441d6
outsb dx, byte [esi]
mov ah, cl
adc al, 0xb5
invalid
call fcn.0251ee7b
xor ecx, 0xcdb9aa12
rol ecx, 1
movzx eax, dl
call fcn.024c3f16
setnp cl
xor al, bl
sub al, cl
jmp fcn.02538da7
Function at 0x15fd005
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [esi]
add dword [esp + 4], eax
push eax
not eax
xor ecx, ebx
ror ecx, 3
xchg dword [esp + eax - 0x70f53d50], eax
xadd dword [esp + eax - 0x1e158546], eax
inc ecx
not ecx
call fcn.024ae68d

Function at 0x15fd147
Capabilities:
Authenticate hmac

Disassembly:
call fcn.015c7d77
mov dword [esp], 0x363828a0
call fcn.016d8978
mov ecx, 0x1a38889c
movzx eax, cl
lea ebp, [ecx + ebp - 0x1a38889d]
neg al
mov al, byte [ebp + ecx - 0x1a38889c]
xor al, bl
movsx edx, cl
add dx, cx
xor al, 0x31
add cl, 0xa3
rol dx, 0x27
rol cx, 0xa2
dec al
xor edx, 0x3b19f282
and ecx, 0x71b753af
not dx
neg al
not al
bswap edx
xor bl, al
add eax, esp
sal dl, 0xc1
lea ecx, [edx + edx*8 - 0x4639d7e]
jle 0x2566cf5

Function at 0x15fe750
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, 0x82a1951d
neg edx
inc edx
neg edx
push ecx
xchg dword [esp], ecx
xor ebx, edx
mov dword [esp + 4], eax

Function at 0x160b9ae
Capabilities:
Execute syscall

Disassembly:
lodsd eax, dword [esi]
lea ebp, [edi + 0x21370cba]
push ecx
mov edi, dword [esp + edi*2 - 0xf310]
lea ebp, [ebp*2 + 0x49a47110]
call fcn.016df9cf
bswap edx
dec esi
mov dword [esp + edx - 0x1fe46543], edx
inc edx
dec dword [esp + edx - 0x1fe46531]
ror edx, 1
dec esi
mov dword [esp + edx - 0x1fe46533], ebx
inc edx
or byte [esp + edx*2 - 0x3fc8ca84], cl
inc edx
xor dword [esp + edx*4 - 0x7f9194fc], edx
inc edx
movsx edi, word [esp + edx*4 - 0x7f919509]
dec esi
mov ebx, dword [esp + edx*4 - 0x7f9194fc]
push edi
dec edi
lea ecx, [edx + edx*8 - 0x60e5fbf1]
dec eax
arpl dx, dx
inc cx
not edx
mov ebp, 0x110f143f
dec eax
add esi, edx
call fcn.01642767
pushfd
adc al, 0xcd
lcall 0x548c, 0x842e01b
jl 0x160b8b6
aaa
rol byte [edx + 0x31], 0x94
xchg esp, eax
add al, 0x6b
outsb dx, byte [esi]
add byte [edx + 0xf], 0xbf
mov esp, 0x6e6af794
imul dword [edx + 0x6e]
or byte [esi - 0x75], 0x9c
xchg esp, eax
add al, 0x6b
outsb dx, byte [esi]
adc byte [edi + 0x4f], 0x8d
mov edx, ss
invalid
outsb dx, byte [esi]
add eax, dword [eax]
or al, 0x11
loopne 0x160b844
inc edx
jb 0x160b890
fild word [edi - 0x35e442b6]
cmpsd dword [esi], dword es:[edi]
or al, 0x69
adc al, 0xa9
add eax, 0xb1c790cf
push ecx
mov byte [ebx], 0xc6
into
insb byte es:[edi], dx
inc byte [ecx + esi*4]
lodsb al, byte [esi]
mov bh, bl
jnp 0x160b933
jmp 0x160b875
jp 0x160b9a1
lcall 0x29af, 0xb5d3e9c2
cmpsb byte [esi], byte es:[edi]
push edi
dec ebx
mov bl, 0x92
xor dl, byte [edx - 0x43f8abee]
inc ecx
mov esi, 0x4af067a
xchg edx, eax
inc eax
cwde
xchg byte [ecx + 0x23c3cac0], bh
retf 0xc2fe
add byte [edx], bh
mov edx, 0xa7c03e8
add al, ch
mov al, byte [0x8900fb19]
mov dword [esp + eax - 0x76f3df00], eax

Function at 0x1621233
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx + eax - 0x1321b56f]
call fcn.015104f6
xor ecx, 0xc517611e
rol eax, 0xf3
xor ebx, ecx
shr dword [esp + edx - 0xf9ec], 0x23
lea edi, [edx + edi - 0xf9f4]
shl edx, 0xf8
pop edx
mov dword [edi], ecx
sbb edx, edx
pop edx
jl fcn.025001a0
enter 0xffffffffffffd3f8, 0xffffffffffffffe5
and byte [edx + ebp], dl
invalid
Function at 0x162fa2b
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.025ae4a4
movzx eax, dl
inc ecx
rol edx, 7
and eax, 0xa934983f
bswap ecx
xor ebx, ecx
push edx
add edi, ecx
mov cx, word [ebp + eax*4]
add ax, ax
rol eax, 0xb6
lea ebp, [ebp + eax*8 + 2]
xor edx, 0xd4a61c1d
lea esi, [esi + edx*2 - 0x35f4b8bd]
neg edx
js 0x169c118
and ebp, ecx
loope 0x162fa61
sti
mov edi, 0xad0a0c1e
int1
add al, 0xa
invalid

Function at 0x1636f93
Capabilities:
Encrypt data using speck

Disassembly:
test ecx, ecx
jmp 0x23ff539
xor edx, edx
jmp 0x15fd402
lea esp, [esp + 4]
je 0x2479cf3
call fcn.024bdfd5

Function at 0x1639f78
Capabilities:
Encode data using xor

Disassembly:
call fcn.024c1ad3
call 0xa9b2787d
push es
push esp
loopne 0x15db92f
not ch
in eax, dx
nop
push ecx
aas
cmpsb byte [esi], byte es:[edi]
mov dl, 0x40
int1
add bl, 0xf3
das
xor eax, 0x76ea525f
xor al, byte [ecx]
movsd dword es:[edi], dword [esi]
invalid
imul ecx, dword [esi - 0x54], 0x2fa111c4
jle 0x15db94d
lodsb al, byte [esi]
les edx, [ecx]
mov eax, dword [0x5e177e2f]
pop esi
xor ah, byte [ecx - 0x3a5190d]
pop esi
cmp cl, byte [esi]
imul edi, ebx, 0xffffffec
salc
cli
loop 0x15db92d
invalid
call 0x704c2e1b
push edx
jecxz 0x15db970
sar byte [edx - 0x72], 1
idiv edi
invalid
popfd
sub dword [esi], ebx
invalid
neg edx
inc edx
sub cx, 0x5d2f
shr cl, 0xa5
ror edx, 1
pop ecx
jmp 0x15db8ae

Function at 0x163efdf
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
cmp word [edx], ax
jmp 0x15b8e92
push edi
jmp 0x24b796f
je 0x25c4ef9
sub eax, eax
mov si, bp
pop esi
mov esp, ebp
mov bp, 0x5305
movzx ebp, cx
pop ebp
ret
je 0x15b8e98
mov eax, dword [eax + 0x7c]
clc
stc
push ebx
jmp 0x15af585
je 0x15b8e98
mov eax, 0x5a4d
cmp bl, dh
cmp bp, 0xa9a7
jmp 0x14c7239
push ebp
mov ebp, esp
sal dx, cl
sbb edx, 0xe9a92abf
test si, 0xb194
mov edx, dword [ebp + 8]
stc
cmp edi, 0xcb2c343e
lea esp, [esp - 0x114]
clc
push esi
test edx, edx
jmp 0x24c3a2d
ja 0x23ec388
mov eax, esi
sub eax, dword [ecx + edx + 0x10]
jmp 0x24c3cda
jl 0x24c3ce2
jmp 0x248165d
mov edi, dword [ecx + edx + 0x18]
test edi, edi
je 0x24c3ce2
mov eax, dword [ecx + edx + 0x20]
dec edi
lea eax, [eax + edx]
test dx, bp
xor ebx, ebx
jmp 0x23ff52d
mov dword [ebp - 0xc], eax
clc
stc
test edi, edi
jmp 0x1e25ddd
jne 0x15b8e98
mov ecx, dword [eax + 0x78]
stc
mov dword [ebp - 4], ecx
stc
test ecx, ecx
jmp 0x160ce00
mov dword [ebp - 0x10], eax
cmc
mov dword [ebp - 8], 0xffffffff
test di, ax
test edi, 0x9cb54b32
cmp esi, 0xffff
jmp 0x16d555a
je 0x15b8e98
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x161dfb0
mov eax, dword [edx + 0x3c]
test ax, cx
clc
cmp bl, ch
lea eax, [eax + edx]
cmp dx, 0x9590
cmp dword [eax], 0x4550
jmp 0x24069ee

Function at 0x16431d0
Capabilities:
Encode data using xor

Disassembly:
call fcn.02527126
mov edx, 0xd6315699
inc ecx
mov ebp, dword [ebp]
movsx ebx, dx
inc esp
mov eax, ebx
dec esi
lea ebp, [ebx + ebp - 0x5695]
dec ebx
lea edi, [eax + eax + 0x562c2791]
call fcn.01701684
Function at 0x16446cc
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], esi
lea esp, [esp + 4]
movzx esi, byte [ecx]
push 0x329cce99
xor esi, eax
and esi, 0xff
push 0xd798ffb9
mov esi, dword [esi*4 + 0x2508b88]
push 0x999504b6
shr eax, 8
ror word [esp + 8], 0x61
xor eax, esi
inc ecx
xor eax, 0xfaafbc07
dec edx
lea esp, [esp + 0xc]
jne 0x16446d4
mov esi, 0xc5063d3f
pop esi
mov edx, 0x469e3b37
not eax
or edx, 0x9589fda9
lea edx, [edx - 0x6b56fcc9]
mov dword [edi + edx - 0x6c4902f6], eax
call fcn.0167ba49

Function at 0x164ebfc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not eax
add eax, 0xf9285102
neg eax
push 0x7133150b
call fcn.02568b42

Function at 0x1653472
Capabilities:
Execute syscall

Disassembly:
mov word [esi + eax - 0xffff], cx
inc ax
and al, ah
lea edx, [eax + eax + 0x3d9f1924]
or eax, edi
jmp eax
mov dword [esp + edx*2], 0x843b61a4
not dl
mov word [edx + edi - 0xff], ax
shr dl, 0x83
mov ecx, dword [edx + ebp - 0x1f]
call fcn.025a3f2c
mov eax, 0xf79ed7a7
jmp 0x240fc62
or cx, dx
not ax
jmp 0x1583a8f
and ax, ax
sbb esi, 4
movsx ecx, ax
movsx edx, cl
sal cl, 3
mov edx, dword [esi]
add ecx, eax
xor edx, ebx
xor edx, 0x926dc80
and cx, cx
sub ecx, ecx
neg edx
jmp 0x251a14a
shl al, 0x46
sub edx, 0xf6b95e2b
shl al, 0xc1
jno 0x2532a3c
inc edx
sub eax, edx
mov ecx, 0xff277d3f
not dx
xadd edx, ecx
xor eax, 0x5e02e62f
shr cx, 0xe3
xor ebx, eax
add edi, eax
rol dl, 0xc6
setb dl
inc dl
mov cx, word [ecx + esi - 0x1fff]
mov dx, word [esi + 2]
add esi, 2
not cx
mov eax, 0x283a2bb
xor eax, eax
not dx
jge 0x16f91a9
mov eax, 0xdf85870b
sub esi, 4
or ax, 0xd60c
movzx ecx, ax
mov edx, dword [esi + ecx*8 - 0x6b878]
xor edx, ebx
lea ecx, [eax + ecx - 0x5f65aaf8]
sar al, cl
neg edx
sub eax, eax
rol eax, 6
bswap eax
sbb edx, 0xce2836b9
rol ax, 1
not edx
xor cl, cl
or eax, ecx
rol edx, 1
sal ecx, 0x7b
sub cx, ax
push eax
lea edx, [edx + eax - 0x769602f6]
not eax
bswap edx
dec al
ror edx, 1
neg edx
call fcn.024e58fc
lea ebp, [eax + ebp - 0x6480c201]
push edx
push edx
xor ecx, ebx
push eax
lea ecx, [eax + ecx - 0x56d0e375]
call fcn.02400af2
bswap edx
setnp al
or cx, cx
sbb eax, eax
adc edx, 0xe1b9bebb
not ax
xor ebx, edx
rol cl, 0xc2
xor cx, 0x4113
adc edi, edx
mov edx, 0x1338f59b
lea esi, [eax + esi - 0x10003]
mov edx, dword [esi + eax - 0xffff]
call fcn.02520f41

Function at 0x165867d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [esp + ecx - 0x6a98a0fa], ecx
push ecx
pop eax
pop eax
pop eax
pop eax
pop edx
ja fcn.01577f93
Function at 0x165efba
Capabilities:
Encode data using base64

Disassembly:
ror edx, 3
mov dword [esp + ecx*8 - 0x40000000], eax
add al, 0x2f
lea edx, [edx + ecx + 0x43173382]
ror edx, 1
call fcn.0257ab77
mov eax, dword [esi]
mov edx, 0x8922a493
movzx dx, byte ss:[eax]
mov ecx, 0x4d27f1af
ror ecx, 0xb2
add esi, 2
dec cl
movsx eax, cl
mov word [esi + eax*8 - 0x240], dx
cmovne cx, ax
lea ebp, [ebp + eax*2 - 0x94]
movzx edx, cx
rol ecx, 0xc8
mov eax, dword [ecx + ebp - 0x6b0048fc]
setae dl
xchg dh, dl
shl ecx, 0x3f
xor eax, ebx
sal cx, 0xad
rol eax, 3
sal ecx, 0x33
neg eax
and cl, 0x36
sbb eax, 0xeb9bf32f
neg eax
call fcn.01e24ffc
je 0x165f056
xchg ebx, eax
xchg esp, eax
xchg ebp, esp
arpl word [esi + 0x4e], si
push ebx
dec eax
pop esi
lodsd eax, dword [esi]
mov ecx, 0xd482bb28
mov dx, word [esi + 4]
sar ecx, cl
adc esi, 6
mov word [eax], dx
movsx edx, cl
neg cx
call fcn.02566f01

Function at 0x165f2bb
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
ror ecx, 1
inc cx
add edi, 0x80416583
loop 0x165f2e7
dec esi
mov dword [esp + edi*2 - 0x1b912], ebx
inc esi
xor dword [esp + edi*2 - 0x1b912], ecx
dec esi
mov ebx, dword [esp + edi - 0xdc81]
add cx, 0x6ea2
dec ebp
arpl cx, cx
leave
movzx ebp, cx
dec edx
mov dword [esp + edi*4 - 0x37244], 0x8201c91f
dec ecx
adc esi, ecx
inc eax
ror ch, cl
inc ecx
dec esi
inc ecx
pop eax
inc ecx
pop esi
inc ecx
pop ecx
jbe fcn.0159a611

Function at 0x1665c52
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
adc edx, 0xdf9eceb8
dec esp
mov dword [esp + edx + 0x20613160], ebx
inc esp
xor dword [esp + edx*2 + 0x40c262a8], ecx
inc ecx
movsx eax, bh
dec esp
mov ebx, dword [esp + edx*2 + 0x40c262a8]
dec ebp
arpl cx, cx
call fcn.023d44b3

Function at 0x167df4a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor ebx, edx
xor ax, ax
or eax, ecx
adc esi, edx
mov dword [esp], ecx
ror dword [esp + 1], cl
pop edx
pop edx
jmp esi
jp 0x15c8616

Function at 0x169c0df
Capabilities:
Encrypt data using speck

Disassembly:
shl cx, cl
dec esp
mov dword [esp + edx - 0x86], edx
adc bl, 0x2d
call fcn.016a2118

Function at 0x16af6bb
Capabilities:
Authenticate hmac

Disassembly:
dec eax
mov edx, dword [esp + 0x18]
pop eax
jmp 0x15f2c47

Function at 0x16bda86
Capabilities:
Encrypt data using speck

Disassembly:
push 0xeb88b410
lea esp, [esp + 4]
call eax
call fcn.0250f98e
mov dword [esp + 4], eax
bswap ecx
inc ecx
call fcn.0160f472
push 0x91b7309b
lea esp, [esp + 8]
je 0x16bdaad
mov eax, dword [ebp + ebx*4]
push eax
dec ebx
jne 0x16bdaa1
mov eax, 0x82870522
lea eax, [eax*4 + 0xf26c906]
mov eax, dword [ebp + eax*2 - 0x3285bb1c]
jmp 0x14faab2

Function at 0x16d15ce
Capabilities:
Encode data using xor

Disassembly:
call fcn.016f0a58
adc al, 0x9a
pop edi
call 0x3b84093c
add eax, 0xf963d5f9
xchg ebp, eax
out dx, al
invalid