joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45159d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x47fa58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4515dd
cmp byte [ebx], 0xa
jne 0x4515dd
or byte [edi + eax + 0x28], 4
jmp 0x4515e2
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4516e1
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4516c4
inc eax
cmp dl, 0xd
je 0x45160e
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x451634
cmp eax, ecx
jae 0x451642
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4515f6
jmp 0x4516e1
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4516bf
cmp dword [ebp - 0x10], 0
je 0x4516bf
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x47fa58]
test byte [eax + edi + 0x28], 0x48
je 0x451699
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x451684
mov byte [esi], dl
jmp 0x451695
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x47fa58]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4516e1
cmp byte [ebp - 1], 0xa
jne 0x4516a8
cmp esi, ebx
jne 0x4516a8
mov byte [esi], 0xa
jmp 0x4516e0
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00452123
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4516e1
mov byte [esi], 0xd
jmp 0x4516e0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x47fa58]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4516de
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4516e1
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4516ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x47fa58]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x451730
cmp word [ebx], dx
jne 0x451730
or byte [eax + edi + 0x28], 4
jmp 0x451735
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x451898
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x451878
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x451776
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4517ac
cmp eax, edx
jae 0x4517ba
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x451751
jmp 0x451898
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x451873
cmp dword [ebp - 0x18], 0
je 0x451873
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x47fa58]
test byte [eax + edi + 0x28], 0x48
je 0x451849
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x45180d
mov word [esi], cx
jmp 0x451844
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x47fa58]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x47fa58]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x47fa58]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x451898
pop eax
cmp word [ebp - 4], ax
jne 0x451859
cmp esi, ebx
jne 0x451859
mov word [esi], ax
jmp 0x451895
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00452123
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x451898
push 0xd
pop eax
jmp 0x451854
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x47fa58]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x451892
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x451898
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4575d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4575fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4575fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40891c
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.00408947
sub edx, 0x70d080fe
sub edx, 0x306a8466
xor dword [ecx], edi
add ecx, 1
cmp ecx, esi
jne fcn.0040891c
dec edx
ret
Function at 0xc0780d
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
neg dh
inc ecx
ror edx, 1
inc ecx
dec edx
push edx
dec eax
sar ecx, cl
inc edx
dec dword [esp - 0x370b6a57]
inc ecx
ror edx, 1
or dx, si
inc edx
movzx eax, byte [esp - 0x370b6a5b]
inc ecx
dec edx
inc edx
sal dword [esp - 0x6e16d4b4], cl
dec edx
mov dword [esp - 0x370b6a5b], esi
inc ecx
rol dh, 0x61
inc ecx
xor edx, 0x49859017
dec esi
mov dword [esp - 0x370b6a53], ecx
pop ebx
inc esp
xor dword [esp + edx*2 - 0x6939fd3e], edx
dec eax
not eax
inc ecx
pop ecx
inc eax
add bh, bl
xor di, dx
dec eax
sar ecx, cl
dec ebp
arpl dx, dx
dec ecx
shr esi, 0xd4
not ecx
inc eax
inc bh
dec ebp
add ebx, edx
dec edi
lea edx, [edi + esi*2 - 0x1ffc]
jmp 0xeba885
rol eax, 3
inc ecx
movzx ebp, dl
bswap eax
dec ecx
shr esp, cl
inc cx
shr esi, 0x2d
inc ecx
push ecx
dec ebp
lea ecx, [edx + ebx*2 - 0x2dedb458]
inc edx
xor dword [esp + edx - 0xa354], eax
dec ecx
and ebx, esi
inc ecx
pop ecx
inc esp
sub edx, ecx
inc ecx
push edx
ror edi, cl
dec eax
arpl ax, ax
inc esp
movsx eax, cx
jne 0xeab994
push 0x2bfae30
jmp 0xf0f3a8
dec esp
adc ebx, eax
bswap ebx
inc ebx
movzx edx, word [ebp + edx - 0x4777e749]
dec ebp
xchg esp, eax
inc cx
xor edx, ecx
xchg ebx, ebp
add dx, 0xf286
inc sp
and dword [esp + edi*8 - 0x1f280cfb], edx
ror dx, 1
inc eax
movsx esi, ch
add dx, 0x7525
ror dx, 1
shr word [esp + edi*8 - 0x1f280cfa], 0x46
inc ecx
not ah
dec dx
dec di
call fcn.00eb3d87
dec edi
mov dword [esp + edi - 0x370b6a61], edx
dec ebp
or esp, eax
dec edi
lea edi, [esi + edi - 0x1005]
dec eax
shl ebx, cl
jns fcn.00f0add5
inc esi
jg 0xeba90a
push 0x6b
push es
mov esp, dword [edi - 0x20787219]
inc ebp
movzx edx, si
lea eax, [eax + ecx + 0x19b4a312]
dec edx
lea edi, [edx*2 + 0x33ec122]
neg eax
inc ebp
movzx esp, dx
movzx ebx, cx
jmp 0xc3bc0f
inc ecx
mov esi, 0xd389b787
dec ecx
sub ebp, 8
dec eax
rol dword [esp], 0xbf
inc ecx
movsx eax, dh
dec eax
lea ebx, [eax + eax*8 - 0x27d15cc3]
dec ebp
mov esp, dword [ebp]
call fcn.00ea3441
test ch, ch

Function at 0xc0c0e6
Capabilities:
Encode data using xor

Disassembly:
dec eax
arpl bp, bp
inc esp
mov edx, ecx
dec esp
add ebx, ebp
dec eax
mov dword [esp + edi - 0xb7], edi
or cx, 0xd9a3
dec ebp
mov edx, dword [edi + edi*4 - 0x2dc]
dec ebp
lea edi, [edi + edi*2 - 0x166]
inc ecx
mov eax, 0x6baef531
dec edx
lea esi, [ebx - 0x54420177]
setbe byte [esp + edi*2 - 0x16d]
dec ebp
lea ebp, [ebp + edi*8 - 0x5b9]
dec eax
ror ecx, cl
inc ecx
push eax
inc ecx
movzx eax, byte [ebp + edi - 0xb7]
jne 0xc1a28e
syscall
call fcn.00ede712
jne 0xef073d
mov eax, 0xa7ba3797
bswap eax
neg eax
movzx eax, byte [ebp + eax - 0x68c8455a]
mov ecx, 0x77bd4d2a
seta cl
xor ecx, ecx
xor al, bl
dec ecx
call fcn.00fdd351
mov eax, 0x88127c39
mov ecx, 0xd6b55e24
push eax
sub ebp, 4
and eax, eax
mov edx, dword [ebp]
xor edx, ebx
neg edx
shl ecx, 0x7f
adc ecx, 0xc514b02a
lea edx, [ecx + edx - 0x70fb628e]
bswap edx
xor edx, 0x8bb0397
sal word [esp], cl
sar ecx, 0x6f
js 0x14b11cf
Function at 0xc123d6
Capabilities:
Encrypt data using speck

Disassembly:
rdtsc
dec esi
lea edi, [ecx + edi + 0x6dd4d523]
dec eax
sar edi, 0x84
dec esp
mov dword [esp + edi - 0x2e036fb7], edx
inc ecx
mov dword [edi + edi - 0x2e036fc3], eax
dec eax
bswap edi
movsx ebp, bl
inc ecx
adc bh, dl
inc edx
mov dword [ebp + edi - 0x67], edx
dec eax
shr esi, 0x59
pop ebp
inc ecx
pop esi
inc ecx
pop esp
jae fcn.00f0add5

Function at 0xc12499
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [ebp + eax*2 - 0x67ff297d]
neg ax
lea ebp, [ebp + eax*2 - 0x67fed68d]
xor edx, ebx
ror edx, 3
sar dword [esp + eax - 0x33ff6b40], 0x5f
movsx ecx, ax
sub eax, 0xe815e683
neg edx
or ecx, 0x6d34831e
dec edx
shl ecx, 0x67
bswap edx
call fcn.00fb62ec

Function at 0xc14806
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor ecx, 0xdab0d313
dec eax
mov dword [esp + edi*2 - 0x55c8], ebp
inc esp
mov eax, edx
lea ecx, [edx + ecx - 0x60028b2f]
dec esp
mov dword [esp + edi*2 - 0x55c8], ecx
sar bp, 0x44
xor dword [esp + edx - 0x6104f63d], ecx
inc eax
movzx ebx, ch
dec ebp
lea edx, [eax + 0x698a27b1]
dec ecx
dec eax
inc ecx
pop ecx
dec edi
lea edi, [esp + edi - 0x40b9a804]
jge 0xc3e0fe
inc ecx
mov dword [edi + edi - 0x2ae4], ecx
inc ecx
or edx, 0x3b2c90b2
call fcn.00fdee89
dec ebp
lea ebp, [ebp + ebp*8 - 0x614]
xor dl, 0x13
call fcn.00c4e4c8

Function at 0xc17feb
Capabilities:
Encrypt data using speck

Disassembly:
inc edx
sar dword [esp + edx + 0x1c], 0xcd
inc ebp
xor ah, cl
dec edx
mov dword [esp + edx*4], 0xc51e280e
inc edx
ror dword [esp + edx*2 + 1], cl
inc ebp
adc ah, dh
inc eax
sal bh, 0x62
inc ecx
not ah
sbb bl, bl
inc ecx
adc ah, 0x80
inc edx
xchg byte [esp + edx*2 + 0xa], al
inc ecx
neg ah
sar ecx, cl
inc dx
or dword [esp + edx*2 + 0x18], 0xe9c0d72f
inc ebp
xor cl, ah
dec esi
lea esp, [esp + 0x28]
add ebx, 0x11032a18
inc edi
mov dword [esp + edx*4], eax
call fcn.00ec1ccc
inc ecx
push 0x25367589
dec word [esp + 1]
jo 0xf260e9
not ecx
mov eax, dword [esp]
lea ecx, [ecx + eax*2 - 0x77f52316]
bswap ecx
lea edx, [eax + eax*2 - 0x5f64c65f]
xor ebx, ecx
jmp 0xf953f0
not ecx
mov dword [esp + edx - 0x49a7e967], eax
or dword [esp + edx - 0x49a7e95f], 0x852b1a01
lea ecx, [edx + ecx - 0x78b0c1a6]
jae 0xc23093
call fcn.00c644ff
Function at 0xc2067e
Capabilities:
Encrypt data using speck

Disassembly:
xadd eax, ecx
bswap edx
xor ebx, edx
ror ax, 0x4e
adc edi, edx
movzx edx, ax
call fcn.00ed9c5e
call fcn.00f9bf8a
mov ecx, 0xe8027408
sub ebp, 4
mov edx, dword [ebp]
xor edx, ebx
sal ecx, 0xe
sbb edx, 0xaf0bed2e
or ecx, 0x73bdf322
mov eax, ecx
sub cl, ah
xor edx, 0xc7a4eeb2
and eax, 0xa89f5c37
and al, ch
sbb cx, cx
bswap edx
shr eax, 6
dec cl
rol ax, 0x49
dec edx
ror edx, 3
bswap ecx
ror ecx, 0x82
lea edx, [edx + ecx - 0x332bf342]
bswap eax
jb 0xc076bf
add byte [eax], al
dec edi
jo 0xc20744
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add byte [esi + 0x3d], ah
movsb byte es:[edi], byte [esi]
jne 0xc20755
cmp ecx, ebp
pop edx
inc ecx
add bh, bh
out 0xc3, eax
cmp al, 0x5e
cmp ecx, dword [esi - 0x6c39156]
adc byte [edi], bh
xor eax, 0x320f8660
pop ss
and eax, 0xb389569a
stosb byte es:[edi], al
push ecx
dec byte [ecx]
sti
pop eax
lahf
retf

Function at 0xc2258f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
mov dword [edi + ecx - 0x22], edx
dec edi
lea ebp, [esp + ebp - 0x7f9ef9b8]
dec eax
or ebp, 0x2b315212
dec esp
mov dword [esp + ecx - 0x22], esp
inc esi
mov eax, dword [ecx + ebp - 0x22]
inc ecx
movzx eax, sp
dec eax
ror ecx, 0xc9
dec edi
lea esi, [esp + 0xe8e059f]
inc ebp
xor eax, ecx
dec edx
and dword [esp - 0x7f9ef9b4], 0x17287eac
dec esp
adc esi, ebp
inc ecx
not eax
pop edi
ror esi, 0xd8
inc ecx
inc eax
jmp 0xf1f463
dec eax
lea esi, [eax*4 - 0x2351e8fe]
inc ecx
neg eax
call fcn.00fd225c
Function at 0xc2e1e3
Capabilities:
Encrypt data using speck

Disassembly:
rol edx, 3
dec esp
and eax, dword [esp + eax + 0x20]
neg edx
dec ecx
xor edi, esi
rol edx, 1
sub edx, 0xf12e77a2
dec esp
mov dword [esp + ecx - 0x72505ee0], ecx
dec esp
mov dword [esp + eax*2 + 8], esi
xor dword [esp + ecx - 0x72505ee0], edx
inc ecx
shl dh, 0xe1
dec eax
lea esi, [ecx + edi*4 + 0x7a9e77b4]
call fcn.00eaec31
push ebx
push 0x16a6a7c
lea esi, [eax - 0x53786431]
aam 0x38
xlatb
push edi
shl edx, 0x37
jae 0xf1ef9f
cmp eax, edi
lea ecx, [edx + ecx + 0x31b295b4]
call fcn.00f9936a
popfd
and al, 9
cmp esp, ebx
imul edi, dword [edx], 0x22515979
and al, 0x4b
add eax, 0x61225159
dec eax
adc dword [ecx + 0x51], ebx
and al, byte [edi]
ror ecx, 0x75
mov bl, 0xbc
clc
sub al, 3
ret

Function at 0xc37455
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
neg al
xor bl, al
mov dword [esp], ecx
lea eax, [esp + eax + 4]
mov dword [eax], edx
mov ecx, dword [ebp - 5]
mov edx, dword [esp]
call fcn.00fb0ce7

Function at 0xc41006
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov ecx, dword [esp - 0x7a]
inc eax
shr bh, 0xa4
inc eax
movzx ebp, bh
dec eax
arpl si, si
jp 0xf06d54
dec esp
add ebx, esi
or edi, 0xbd1b7fb9
mov esi, 0xd00d6611
inc si
mov edi, dword [ebx + edi - 0x7e90b701]
or ebp, 0x11826a38
dec eax
lea edx, [esi + ebx*8 + 0x4d8d7720]
pop ebp
pop esi
inc ecx
pop edx
jno fcn.00f0add5
inc ecx
inc al
call fcn.00faf8f8

Function at 0xc41ea7
Capabilities:
Encode data using xor

Disassembly:
call fcn.00ee5ddd
inc esi
push eax
and eax, 0x6c54a3c4
enter 0xffffffffffff8225, 0x6a
in al, dx
inc esp
and byte [0x74f46a82], 0xc0
and eax, 0x4cf56a82
sub byte [0x4d2d6a82], ah
js 0xc41ef2
sub byte [edx + 0x2d], 0xa5
pushal
and eax, 0x648d6a82
imul ebp, dword fs:[eax], 0xb6e0525e
cmp esp, ecx
aaa
mov byte [ecx + 0x67eec32d], cl
push es
push ebp
cld
adc esi, ebx
test byte [ecx], ah
pop ebx
fidiv word [eax + 0x5c]
and eax, 0xa8b6a4c1
inc edi
sub eax, 0x6bd61551
xor esi, 0x53d442ec
add ecx, ebp
in al, dx
or ah, bh
xchg ebp, eax
add byte fs:[edi - 0x4f], cl
adc al, 0x6c
fcom dword [eax]
cmp al, 0xe
cmp dword [edx + 0x30], edi
cli
inc esi
mov al, byte [0x721d7e0a]
sbb eax, 0xa936650e
or al, 0x39
mov esp, cs
xor esp, ebp
sar eax, 1
xchg edx, eax
invalid

Function at 0xc46c6e
Capabilities:
Encode data using xor

Disassembly:
shrd eax, edx, cl
mov dword [esp], 0xea16b5b2
mov dword [esi], eax
mov eax, 0xd233f11f
lea ecx, [eax + eax*2 + 0x428763a2]
call fcn.00c07185

Function at 0xc494c3
Capabilities:
Encode data using xor

Disassembly:
inc esp
shrd ebp, esp, cl
dec edx
mov dword [esp + eax - 0x4df4f9cd], edi
call fcn.00fdf765
inc ecx
mov esp, 0x77210695
dec edi
mov esp, dword [edi - 0x77210695]
inc ecx
mov esi, 0x4f3b1430
dec ecx
sal esi, 0xca
dec ebp
mov esi, dword [edi + 8]
push 0x8d3a101c
dec ecx
adc edi, 0xc
call fcn.00fd3d30
push edi
imul edi, dword [eax + ebx*2 + 0x49], 0x11
add esp, 0x3daf8a0f
add byte es:[esi - 0x73], cl
movsb byte es:[edi], byte [esi]
mov dword [0x4182be85], eax

Function at 0xc4c25e
Capabilities:
Encrypt data using speck

Disassembly:
dec ebp
lea edi, [edi + ebx*2 - 0x16439ffe]
sal esi, 0x41
inc eax
seto bh
call fcn.00eaf96d
Function at 0xc56159
Capabilities:
Encrypt data using speck

Disassembly:
movzx esi, dl
inc ebp
mov dword [edi + esi*4 - 0xe4], esi
dec eax
sal ebp, 0xee
dec eax
lea edi, [ebp - 0x66507e77]
movzx ebx, si
inc ecx
mov esi, dword [ebp + ebp - 4]
inc esp
movzx esi, bh
dec esp
lea edx, [edi - 0x77530df3]
inc ecx
xor esi, ecx
pop ecx
or di, dx
rol esi, 2
sar ebp, 0x3f
lea esi, [edx + esi - 0x10e2d707]
movzx ecx, dl
jbe 0xf4129f
xor esi, 0xdab0d313
lea esi, [ebp + esi + 0x1026b0e]
jmp 0xf86863

Function at 0xc63a26
Capabilities:
Encrypt data using speck

Disassembly:
xor bl, dl
call fcn.00fc7fff
inc eax
rol ch, 1
inc edx
movzx edi, word [esp - 0x551bd22b]
inc esp
mov esi, edi
inc eax
not ch
dec eax
shl dword [esp + edi - 0x2df3], 0xd5
inc ecx
setne ah
inc ecx
sub ch, ah
dec ebx
lea ebx, [esp + esi*8 + 0x1892ee0a]
inc eax
ror ch, 1
push ebx
inc esp
xor cl, ch
call fcn.00f30e35
mov edx, dword [esi + eax - 0x7a366ded]
mov cx, word [esi + eax - 0x7a366de9]
mov word [edx + eax - 0x7a366ded], cx
lea ecx, [eax + 0x1bbcb4b9]
movzx edx, byte [eax + ebp - 0x7a366df2]
lea ebp, [ebp + eax - 0x7a366df2]
push eax
xor dl, bl
add dl, 0x20
and cx, ax
rol cx, 0xca
not dl
inc dl
not dl
mov dword [esp + eax - 0x7a366de9], 0x521c6b31
sal dword [esp + eax - 0x7a366ded], cl
jp 0xc0fb3f

Function at 0xc65b4c
Capabilities:
Encrypt data using speck

Disassembly:
pop ecx
pop ecx
pop eax
pop eax
pop ecx
jno fcn.00f3ad7e
inc sp
add eax, edx
dec edx
mov dword [edi + edi - 0x1d], ebp
jge 0xf87409
mov edx, 0x61356707
call fcn.00c580bb
Function at 0xea1cc0
Capabilities:
Encode data using xor

Disassembly:
inc edi
movzx eax, byte [esi + ebp - 0x7b8ede83]
pop ebp
inc edx
sub byte [esp + esi - 0x7b8ede82], bl
rol byte [esp + eax - 0x149d2e89], 0x61
inc ebp
xor al, cl
dec eax
mov dword [esp + eax - 0x149d2e81], ebx
dec esi
lea edx, [edx*2 + 0x34ae37a5]
inc ecx
neg al
inc ecx
rol al, 1
pop ecx
inc ecx
pop esi
inc ecx
dec al
dec eax
shl ecx, cl
inc ecx
neg al
dec eax
lea ecx, [ecx + ebx*8 - 0x2a6f8b65]
mov edi, 0x3511b8b3
inc ecx
xor al, 0xac
movsx ebp, ax
inc eax
xor cl, bh
inc ecx
ror al, 1
inc ecx
inc al
inc ecx
xor al, 0xa
inc eax
xchg bh, al
rol ecx, 0x46
inc ebp
xor cl, al
dec eax
lea esi, [ebx*4 - 0x2770e4e]
dec esp
add eax, esp
inc cx
rol edx, cl
inc ebp
mov edx, dword [eax + eax*2 - 0x293a5d66]
neg ebp
inc eax
xadd ch, dh
dec edi
lea edi, [edi + esi*2 - 0x11c52]
inc eax
setno dh
shl edi, 0x99
inc ebp
mov dword [edi + eax - 0x149d2eb3], edx
dec eax
sal edi, cl
dec cl
jns 0xfd2ac9
inc ecx
mov esi, 0xb71cdf03
dec ebx
lea ebx, [esi + esi*2 + 0x1d87e084]
dec ecx
sub ebp, 4
sal bx, 0x64
inc ebp
mov eax, dword [ebp]
inc ebp
xor eax, ecx
inc ecx
mov edx, esi
dec edx
lea edx, [edx + esi*2 - 0x7b468b5f]
inc ebp
movzx edx, dh
inc ecx
neg eax
dec edx
lea ebp, [esi*2 + 0x3298d27]
inc ecx
dec eax
inc ebp
movzx esp, dx
jmp 0xea74db
inc ecx
bswap eax
call fcn.00fcfe8c
mov eax, 0xf00b8d3a
movzx edx, al
jmp 0x14aab0c
jp fcn.00f0add5
mov edx, 0x9bb6a91b
lea edx, [edx*8 + 0x129009ac]
movzx ecx, byte [ebp - 1]
not dl
mov eax, edx
shr ax, 0x85
xor cl, bl
shr dx, 0x8d
xor cl, 0x2d
sub eax, eax
ror ax, 0x41
bswap eax
rol cl, 1
xor dx, ax
shr edx, 0x36
not cl
xchg dx, ax
lea eax, [eax*4 - 0x354b25ca]
rol cl, 1
call fcn.00eb6857
dec esp
inc edi
leave
or eax, dword [ebp + 0x22]
imul esp, dword [ebx + 0x380f9439], 0x67
mov dword [0x16309439], eax
dec edi
mov dword [0x45609439], eax
sbb esp, dword [ebx + 0x6d579439]
xor esp, dword [ebx + 0x1a649439]
jns 0xfd2aff
ljmp 0x8d92:0x66d1f636
jge 0xfd2b41
and al, 0xa5
arpl word [eax], bx
daa
sub esp, eax
mov eax, 0x312ea63b
in eax, dx
add eax, 0x73da478c
cdq
popfd
fistp qword [esi + edx*4 + 0x2b]
dec ecx
cmp dl, byte [ebx - 0x4b]
retf 0x4903

Function at 0xeb0ef8
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [ecx + edx - 0xea1e]
movsx edx, al
shr ax, 0x2c
inc eax
sub esi, 4
add dword [esp + 4], edx
mov dword [esi], ecx
movsx ecx, ax
jbe 0xf283b0
clc
pop edx
pop edx
pop eax
jp fcn.00f3ad7e

Function at 0xeb17d3
Capabilities:
Encode data using xor

Disassembly:
xor ecx, 0x823847af
mov dword [esp + eax - 0x4dc4dff8], eax
add dword [esp + eax - 0x4dc4dff8], eax
ror al, 0x81
neg ecx
xor ebx, ecx
sar dl, 0xa2
jne 0xfb0ad5
add eax, dword [esp + edx - 0x4dc4dffe]
adc edi, ecx
jmp 0xfb9362
Function at 0xec53c3
Capabilities:
Encrypt data using speck

Disassembly:
dec ebp
mov esi, dword [edi + 8]
dec ecx
add edi, 0x10
dec esp
mov dword [ebp], esi
call fcn.00c1a198
bswap eax
mov edx, 0xae2b7a8f
sub eax, 0x20b0cdbd
not eax
lea ecx, [edx + edx*4 - 0x5cc0ac7c]
mov dword [esp + ecx*2 - 0x1431709e], 0x71362caa
sub edx, dword [esp + ecx*8 - 0x50c5c278]
bswap eax
xor ebx, eax
sar dword [esp + edx - 0x3cf54de5], cl
sbb dword [esp + ecx - 0xa18b84f], edx
and cx, word [esp + edx - 0x3cf54de5]
adc edi, eax
mov ax, word [esi + edx*2 - 0x79ea9bca]
call fcn.00fdfda0
movsx bx, bl

Function at 0xed4f88
Capabilities:
Encrypt data using speck

Disassembly:
mov cx, word [esi + eax - 0x80000000]
dec edx
xor al, 3
mov dx, word [esi + 2]
or cx, dx
lea edx, [eax + eax*2 + 0x2a52914]
shr ax, 2
or edx, 0xe480b6a2
not cx
adc al, ah
call fcn.00edfe73

Function at 0xed565b
Capabilities:
Encode data using xor

Disassembly:
inc ebp
lea esp, [esp + esi*4 - 0xc05944f]
add esi, dword [esp + esi*2 - 0x154]
mov ebp, 0xeb050f0a
inc ecx
xor esp, 0x16991885
push ecx
dec esp
add dword [esp + esi*2 - 0x14c], ecx
pop esi
inc esp
xor dword [esp + esi*4 - 0x154], esp
dec esp
mov ecx, dword [esp + esi*4 - 0x154]
neg bp
inc cx
neg edx
dec ebp
arpl sp, sp
dec eax
mov dword [esp + esi - 0x4f], 0xa6b9b3
dec eax
neg edi
dec ebp
add ebx, esp
dec eax
mov dword [esp + esi*2 - 0xae], ebx
jmp 0xfd27b0
inc ecx
mov ecx, dword [edi + esi*4 - 0x158]
dec eax
shr eax, 0x19
dec eax
sal eax, 0x23
inc ecx
add eax, dword [edi + esi - 0x4f]
mul ecx
movsx ecx, byte [esp + esi*4 - 0x155]
inc ecx
mov dword [edi + esi*2 - 0xaa], edx
xadd word [esp + esi*8 - 0x2b0], bp
call fcn.00efab78
cmp byte [ebp - 0xee09c9f], 0x4f
pop es
add byte [bx + 4], dl
inc edx
pop edi
aas
salc
inc ebp
and ebp, dword [edx + 0x5f]
aas
salc
aaa
or eax, 0xd63f5f52
pop edi
sbb al, 0x5e
pop edi
aas
salc
je 0xfd2842
or eax, 0x9ac73006
pop ds
imul esi, edi, 0x4f2d7f8f
add dl, dh
xor byte [eax - 0x12446102], bl
loopne 0xfd286b
mov bl, dh
ret
xchg esi, eax
and ch, dl
and dword [edi], edi
cmp eax, 0xd292db06
loope 0xfd287f
sub byte [ecx], ch
invalid
jl 0xfd2841
invalid
iretd

Function at 0xed6efb
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
bts edx, ebp
inc bp
shl ebp, 0x30
mov ebp, esp
xchg edx, edx
not dh
mov edx, dword [ebp + 8]
clc
test di, si
cmp esi, 0x23321da1
sub esp, 0x114
cmc
test esp, 0x6d273607
push esi
clc
cmc
test edx, edx
jmp 0xfa022a
je 0xf315b5
mov esi, dword [ebp + 0xc]
cmp bx, bp
test esi, esi
jmp 0xfd5ebd
je 0xf315b5
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0xf315af

Function at 0xedbb3b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec eax
inc edx
xor edi, 0xea033021
dec eax
dec ebx
dec eax
lea esp, [esp + 0x10]
jne 0xed6edd
inc ecx
mov esi, 0xab3b7532
inc ecx
movzx ebp, dh
dec eax
lea edx, [ebp + 0x4cb1e297]
inc ecx
pop edi