joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd5a3b5
Capabilities:
Encrypt data using speck

Disassembly:
dec ebp
lea esi, [eax + ecx*8 - 0x59cf94c3]
inc ebp
or eax, eax
bswap esi
inc sp
sbb dword [esp + 4], esi
inc esp
mov edi, dword [esp + 4]
inc ecx
movzx edx, al
rol esi, 3
dec edx
lea eax, [ecx + esi - 0x4dfdc2cb]
rol al, 0xe5
inc cx
sbb edx, eax
dec esp
mov dword [esp + edx - 0x6800], ebx
xor dword [esp + edx*4 - 0x1a000], esi
dec ebp
xchg eax, esi
dec ecx
ror esi, cl
jae 0xddd90b
call fcn.00dce007
inc esp
movsx eax, di
dec edi
mov esp, dword [ebp + edi*2 - 0x9c3a]
dec esp
bts eax, esi
jb 0x92662a
inc ebx
adc esi, dword [esp + edi - 0x4e21]
cdq
inc ecx
sub esi, 0x839ba11d
inc ecx
inc bh
inc ebx
mov dword [esi + ebp - 0x74645ed7], esi
inc ebx
mov edx, dword [esi + edx - 0x74645ee7]
dec ebp
sub edi, esi
inc ecx
xor edx, ebx
inc esp
mov esp, edi
dec ebp
xadd eax, esi
inc cx
shr esi, 0x64
dec edx
inc di
inc ebp
btc esp, eax
inc ecx
movsx esi, bh
ror edx, 2
inc ecx
lea edx, [esi + edx - 0x4b12b637]
inc cx
shr edi, 0xeb
inc eax
movzx ecx, bh
inc ecx
inc esp
rol edx, 2
inc ebp
movzx ecx, ah
inc ebp
xchg ah, al
inc ecx
push ebx
inc edx
xor dword [esp + esi], edx
inc ebp
movsx ebx, ah
inc ecx
xadd bh, dh
inc ecx
pop ebx
xor cl, 0xa5
dec eax
arpl dx, dx
dec ecx
imul edi, edi
dec ecx
rol esi, cl
dec eax
adc ebx, edx
inc edi
mov ecx, dword [ebp + esi*2 + 0xc]
inc cx
rol edi, 0x4b
dec eax
cdq
dec edi
lea ebp, [ebp + esi + 0x10]
inc ecx
neg dh
inc edi
movzx edi, byte [esi + edx - 5]
dec eax
xor edx, ecx
dec edi
lea edx, [edx + esi*2 - 5]
shl dx, 0xa3
push edx
inc ebp
xor bh, bl
dec eax
bswap esi
cwd
inc ecx
ror bh, 1
dec eax
cwde
dec eax
bts edi, 0x93
inc edx
sub dword [esp + esi*4], esi
inc esp
adc bh, al
dec eax
lea ebp, [edx - 0x72ee2860]
call fcn.00d7c432
mov eax, 0x7e813027
movsx ecx, ax
mov edx, dword [ecx + ebp - 0x3027]
shr ax, 0x28
xor ecx, eax
lea ebp, [eax + ebp - 0x7e81002c]
bt ecx, eax
btr cx, 0x82
btr eax, 0x8e
xor edx, ebx
imul eax, eax
neg edx
xor cx, ax
lea edx, [eax + edx - 0x333283e5]
bswap edx
neg edx
jmp 0xd5a306
sub cx, 0xab2e
xor ebx, edx
call fcn.00946ecb
mov edx, 0x2f9db484
mov edx, dword [ebp + edx*2 - 0x5f3b6908]
mov eax, 0xa98b6029
bt eax, eax
mov ecx, eax
mov cl, byte [ebp + 4]
push eax
dec eax
adc word [esp], 0xcf21
shr edx, cl
push eax
neg eax
or eax, eax
mov dword [ebp + eax - 0x56749fd6], edx
mov edx, dword [ebp + eax - 0x56749fd6]
movsx ecx, ax
shr dword [esp + eax - 0x56749fd6], cl
mov eax, dword [eax + ebp - 0x56749fd2]
adc edx, eax
lea eax, [ecx + ecx + 0x390af929]
shr byte [esp + eax*2 - 0x721471b1], 0x86
mov dword [ebp + eax*2 - 0x721471ac], edx
mov edx, dword [esi + eax - 0x390a38dd]
adc dword [esp + eax - 0x390a38d9], eax
push eax
sub byte [esp + eax - 0x390a38d5], ah
xor edx, ebx
rol ecx, 0x77
jae 0xdd500c
xor edx, 0xc60f4c3d
ror eax, cl
sbb eax, ecx
rol edx, 1
neg edx
xor ecx, eax
shl cx, 0x66
lea edx, [edx + eax - 0x4b84d537]
jbe 0xc9b13b
test eax, eax
push 0xf295fe01
call fcn.009f9635

Function at 0xd5a5b0
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0x8d2a6d8a
xor eax, ebx
call fcn.0095f8ae
neg ecx
call fcn.00d97054
Function at 0xd5bff1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + esi*4 - 0xf0], esi
dec eax
lea esi, [edi*8 - 0x21ee55f4]
dec eax
mov esp, eax
dec eax
lea edi, [edi*2 - 0x58c6d554]
pushfd
btc edi, edi
dec ecx
mov esi, eax
dec eax
mov edi, eax
push 0xb2b77114
cld
call fcn.00dcb82a
mov edx, 0x53b0250b
movsx ecx, dl
sar ecx, cl
or ecx, dword [esi + edx - 0x53b0250b]
dec dl
movsx eax, dl
neg edx
mov eax, dword [esi + eax*2 - 0x10]
not edx
or ecx, eax
not ecx
lea eax, [edx + edx*8 + 0x9b5c035]
mov dword [esi + edx - 0x53b02505], ecx
lea ecx, [eax + 0x7b97669b]
mov edx, dword [edi + edx - 0x53b02509]
and ecx, ecx
add eax, eax
lea edi, [edi + ecx - 0x767e741d]
xor edx, ebx
jmp 0xdf9672

Function at 0xd60416
Capabilities:
Check http status code
Encode data using base64

Disassembly:
inc ecx
xor ebp, ebx
inc ecx
mov esi, edi
rol ebp, 1
not ebp
ror ebp, 3
dec ecx
sal edi, cl
jbe 0xc8064a
jmp 0x95398e
sbb ecx, 0xa7918297
sar edx, 0xbf
mov dword [esp + eax*8], 0xb905e43c
ror ecx, 3
xor ebx, ecx
add edi, ecx
not byte [esp + eax + 1]
call fcn.00c7618e
dec ecx
sub edx, 4
mov edx, 0x7893603c
inc esp
movsx edi, dl
inc ecx
movzx ecx, di
inc ebx
mov ebp, dword [edx + edi - 0x3c]
dec esp
lea esi, [ecx*8 - 0x43ec3444]
jmp 0xa17d5a

Function at 0xd62d73
Capabilities:
Encrypt data using speck

Disassembly:
rol cl, 1
cdq
ror dword [esp + 0xc], 0x81
sar eax, 0x7d
neg cl
sub ax, 0x81ac
mov dword [esp + 0x10], edx
btc edx, eax
rol cl, 1
sub cl, 0x8f
ror cl, 1
xadd edx, eax
imul edx, eax
pop edx
xor bl, cl
shl al, 0x86
lea ecx, [esp + ecx + 0x14]
mov edx, dword [ecx]
rol dword [esp + 5], 0xcd
cwde
movzx ecx, ax
mov dword [ebp + ecx*2 - 0x1ff84], edx
not ax
lea ebp, [ebp + ecx*2 - 0x1ff84]
shl ax, 0x8c
movzx edx, al
pop edx
pop ecx
pop edx
pop eax
pop eax
jp fcn.009213ba
mov ecx, dword [edi]
movzx eax, byte [ebp]
mov edx, 0xb83c0595
xor al, bl
add al, 0x35
push edx
and word [esp + 1], 0x9e27
rol al, 1
neg al
sub al, 0x90
or edx, edx
imul edx, dword [esp]
neg dl
ror al, 1
xor edx, dword [esp + edx - 0x1b572847]
xor bl, al
pop edx
sal dx, 0x4f
rol edx, 0x9f
adc eax, esp
bts edx, edx
sar edx, 4
neg dx
mov dword [eax + edx*8 - 0x2e00e000], ecx
movzx ecx, word [ebp + edx - 0x5c01bff]
lea eax, [edx*2 + 0x3c118910]
cmovo dx, ax
jne 0xc75910
das
push ss
stosb byte es:[edi], al
mov bl, 0x17
jnp 0xd62e0d
xchg esi, edi
cmc
dec esp
arpl word [ebx - 0x80], di
invalid
Function at 0xd673a8
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [esi]
xor edx, ebx
lea ecx, [eax + eax + 0x49bc948b]
bt eax, eax
inc edx
add cl, cl
cbw
btr ax, cx
xor edx, 0xae1d19be
sal cl, 0x21
neg edx
neg cx
rol edx, 2
sar ecx, cl
jnp 0xe07f2a
mov eax, 0x11af8598
lea esi, [esi + eax*2 - 0x235f0b34]
lea edx, [eax + eax - 0x76e9daf9]
inc eax
movsx ecx, al
mov edx, dword [esi + eax*2 - 0x235f0b32]
xor edx, ebx
btc ecx, eax
not edx
lea edx, [eax + edx + 0x4172cfeb]
not ecx
jb 0xd625a8
and ecx, 0x78182e2a
xor edx, 0x5fba53a2
ror al, 0xc1
shr al, cl
btr eax, eax
lea edx, [eax + edx - 0x7c2ca8c2]
xor ebx, edx
push ecx
add edi, edx
cwde
mov eax, dword [ebp + ecx*8 - 0x110]
jmp fcn.0094287c
not edx
call fcn.00d4376f
fadd qword [ebp]
sub esi, 4
mov eax, 0xfa1896a1
mul al
jo 0xa3d601
mov edx, dword [edi + eax*8 - 0x1438fc]
inc ax
mov eax, dword [edi + ecx - 0x212caed0]
ror cx, 0xc8
sub word [esp + ecx - 0x212cd8ad], cx
xadd cl, ch
lea edi, [edi + ecx - 0x212cae7a]
xadd dword [esp + ecx*2 - 0x42595d0c], ecx
mov dword ss:[edx + ecx*2 - 0x71250df0], eax
mov eax, ecx
shl eax, 0xb2
mov dword [esp + eax*2 - 0x37c00000], ebp
ret
cbw
xor edx, 0xc62ed61c
dec edx
xor edx, 0xed8a0493
add cl, 0xa
call fcn.00980b04
add byte [eax], al
add byte [ebx + 0x65], dl
je 0xe07f9b
arpl word [edx + 0x6f], si
insb byte es:[edi], dx
insb byte es:[edi], dx
push edx
popal
outsb dx, byte [esi]
invalid
invalid
invalid

Function at 0xd67723
Capabilities:
Encrypt data using speck

Disassembly:
rol edx, cl
inc ecx
neg eax
push ecx
shl dword [esp + edx*2 - 0x7ffff9d0], 0x84
mov dword [esp + 0xc], 0x744320de
lea esp, [esp + 0xc]
call fcn.00de21a8
mov eax, dword [ebp]
mov ecx, 0x9221d79d
add ebp, 4
xor eax, ebx
movsx edx, cx
shl dx, 0x26
btc edx, edx
inc eax
jmp 0x9416b9

Function at 0xd6a5db
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, edx
shr eax, 0xdb
shl word [esp + ecx + 4], 0xe5
shr cl, 0x61
adc edi, edx
mov edx, 0x7d09d59f
call fcn.00d7fe3c
Function at 0xd6e713
Capabilities:
Encrypt data using speck

Disassembly:
neg eax
mov dword [esp + ecx*2 - 0x5049ec82], edx
shr word [esp + ecx - 0x2824f640], 0x67
not edx
bswap eax
neg eax
bswap eax
dec eax
sub dl, 0x23

Function at 0xd73deb
Capabilities:
Encrypt data using speck

Disassembly:
jo 0xddbb39
inc eax
mov dword [esp + ecx - 0x62ab09e0], ecx
inc dx
xor eax, 0xc137c582
ror byte [esp + ecx - 0x62ab09de], 0x22
xor byte [esp + edx*2 - 0x39], 0x82
sal edx, 0x51
not eax
sets cl
xor ebx, eax
shr dword [esp + edx*8 - 0x2000000], 0x61
adc esi, eax
sub cl, dh
mov edx, dword [ecx + edi - 0x62ab0900]
add ecx, dword [esp + ecx - 0x62ab08fe]
jnp 0xd6a5d5
mov eax, dword [edx + esi]
xor eax, ebx
sal dl, 0x61
sbb dl, byte [esp + edx + 3]
ror edx, 0x82
lea eax, [edx + eax - 0x2f754103]
adc ecx, 0xbcff29
xadd byte [esp + ecx - 0xbcff28], cl
sbb dl, 0x32
bswap eax
neg eax
pop edx
lea eax, [eax + ecx - 0x2ad3ef60]
bswap eax
call fcn.00dc9c98
syscall
call fcn.00a17f99
dec ecx
sub edx, 4
jmp 0x97f523

Function at 0xd77796
Capabilities:
Encrypt data using speck

Disassembly:
pop eax
inc edx
btc ecx, eax
add eax, eax
ror edx, 2
bswap edx
ror edx, 3
sar al, 0xa3
inc edx
rol ax, 0xa9
push ecx
or eax, eax
ror edx, 2
neg ecx
bswap edx
xor ebx, edx
add ecx, 0x5b07013e
mov dword [esp + eax - 0x1dee], eax
xadd eax, ecx
adc esi, edx
mul ecx
mov ecx, dword [ecx + edi - 0x1dfe]
mov dword [esp + eax - 0x5cf51f54], 0xc5a3da07
cwde
sar dl, 0x63
mov dx, word [eax + edi - 0x1f5c]
mov word ss:[ecx + eax - 0x1f60], dx
call fcn.00da6d19
rol edx, 2
dec al
or byte [esp + ecx*2 - 0x14fcc000], ah
add cl, cl
bswap edx
sbb word [esp + ecx - 0xa7e6000], cx
not eax
add word [esp + ecx - 0xa7e5fff], ax
dec edx
ror edx, 3
sar dword [esp + ecx - 0xa7e6000], 0xb8
jb 0xd4d1a2
test ebp, 0xd0b5a28b

Function at 0xd79c09
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
xor edx, edi
inc ecx
mov dword [esp], 0xfa078ab6
not dword [esp + 1]
push 0x391c642d
xor edx, 0x798b68bb
sar word [esp + 3], 0xe3
and word [esp + 0xc], 0x48c
dec eax
lea esp, [esp + 0x10]
jne 0xdf7d70
mov edi, 0xc2bca6af
movsx eax, di
movzx ecx, ax
pop edi

Function at 0xd7a334
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor al, bl
mov esi, 0x47b59493
inc esp
movzx edi, si
inc ebp
movsx esi, bh
inc ecx
not al
inc ecx
neg al
inc ecx
add al, 0x1e
inc ecx
rcr byte [esi], 0x41
movzx ecx, dh
dec eax
mov dword [esp + esi - 0x47b59493], 0xd7b5932b
inc ecx
neg al
inc ebp
xor bl, al
sub dword [esp + esi - 0x47b59490], ecx
dec esi
lea eax, [esp + eax + 0x10]
sbb word [esp + esi - 0x47b5948f], 0x1d19
dec esi
lea ecx, [ecx + esi*2 + 0x5e3e7a18]
inc ecx
rol dh, 0x21
inc di
mov esp, dword [edi + eax - 0x9493]
call fcn.009347d4
xchg ebp, eax
sti
jg 0xd7a34c
rcl byte [esi], 0x3c
invalid

Function at 0xd8189a
Capabilities:
Manually build aes constants

Disassembly:
xadd dx, cx
jl 0xd4f45f
not eax
btc cx, dx
xor ebx, eax
neg ecx
add esi, eax
mov dword [esp + edx - 0x440000], edx
lea eax, [ecx + edx*2 - 0x42df81ed]
mov dword [esp + edx*2 - 0x880008], esi
ret 4
Function at 0xd857e5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
shl dword [esp], 0x2d
ror dword [esp], 0xf5
mov dword [ebp], edx
mov ecx, dword [esp]
setns cl
mov dword [ebp + ecx*2 - 0x700001fe], eax
not ecx
inc dword [esp]
sbb esi, 4
mov eax, dword [esi]
shl word [esp + 2], 0x64
not dword [esp]
movzx edx, cx
xor eax, ebx
jmp 0xdbda3b
mov dword [esp], 0x46114b38
mul ecx
jmp 0x9f87aa
not eax
btc edx, edx
sbb eax, 0xd438b3b5
sub dx, 0x3c35
bswap eax
not eax
not byte [esp + edx - 0x4000c2c9]
lea eax, [eax + edx - 0x66918a07]
dec dword [esp + edx - 0x4000c2c9]
xchg ecx, edx
xor ebx, eax
call fcn.0091e8a6

Function at 0xd9d6b5
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [ecx + eax - 2]
and dword [esp + 5], 0xd9231bb7
lea eax, [edx*8 + 0x108a282e]
lea edx, [eax + edx*4 - 0x1dccefcb]
mov dword [edi + eax - 0x447a3ff4], ecx
lea edi, [edx + edi - 0x40a55c09]
rol eax, 0x1e
mov dword [esp + edx - 0x40a55c03], 0x682e4b9b
pop edx
pop edx
pop eax
jne fcn.009419ad

Function at 0xd9e2d7
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
imul ecx
push 0x6208663a
mov ecx, dword [esp]
mov dword [esp + ecx - 0x62086636], 0x3a8970aa
mov dword [ebp + ecx - 0x6208663a], edx
sub ecx, dword [esp + ecx - 0x6208663a]
mov dword [ebp + ecx*2 + 4], eax
xadd dword [esp + ecx + 2], ecx
pop eax
cwde
lea esi, [esi + ecx - 0x70aa620c]
mov edx, dword [esp + ecx - 0x70aa6208]
mov edx, dword [esi + ecx - 0x70aa6208]
sar eax, 0xe5
jns 0xdda4ba
xor edx, ebx
call fcn.00d9dc89
Function at 0xdb6da3
Capabilities:
Encode data using base64

Disassembly:
mov edi, dword [edi*4 + 0xc7e0bc]
or dword [esp + 4], 0x7b302723
jne 0xcb41c5
push ecx
pushfd
mov ecx, 0x399891f
mov ebp, 0xb269d87
add cx, bp
mov ebp, dword [esp + ebp - 0xb269d7b]
mov dword [esp + 0xc], 0x39759f73
mov ecx, dword [esp + ecx*2 - 0x7324d48]
jno 0xdf2cff
jle 0x96b358
jge 0xdf2cff
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.00955e4f
inc ecx
mov eax, 0xcdbf4917
inc ecx
movzx ecx, al
dec esi
lea edx, [ecx + edx - 0x1b]
dec esp
lea edi, [ecx*4 + 0x7e293fbc]
dec ebx
lea esi, [eax + edi*8 + 0x6d10cbbc]
inc edx
mov ebp, dword [ecx + edx - 0x17]
inc esp
movzx esp, cl
inc ecx
xor ebp, ebx
inc ecx
movzx eax, ax
xor ebp, 0x80030c35
inc cx
dec ebp
dec ebp
lea ecx, [eax - 0x36d11a79]
inc ebp
movsx esi, al
neg ebp
dec eax
cwde
not ebp
neg ebp
inc bp
btr ecx, edi
inc cx
btr edi, esi
jb 0xdf0bf5
jmp 0x9223a6
push ebp
call 0x9223bb

Function at 0xdbb89b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ebp
xor esp, ebx
inc eax
and bh, 0xa9
inc ecx
not esp
inc esi
xadd byte [esp + esi*2 - 0x8121], dh
dec esp
lea ecx, [esi*4 + 0x6a85b27]
inc ecx
xor esp, 0x81a3960d
inc ecx
bswap esp
call fcn.00c894ee
add byte [eax], al
add byte [edi + 0x65], al
je 0xc8fe3f
jns 0xc8fe61
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0xc8fdf4
inc ecx
movsx ebp, si
jmp ebx
btr eax, edx
shr dx, 0xe7
neg cl
inc dx
dec cl
or edx, eax
sub edx, edx
ror cl, 1
xadd dl, dh
inc cl
div eax
mov dword [esp + edx], 0xa78ec639
call fcn.00d4feae
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0xc8fed9
inc esp
imul esi, dword [ebx + 0x70], 0x5379616c
je 0xc8feeb
imul ebp, dword [esi + 0x67], 0xb9004173
mov ebx, 0x8d1489ea
mov ah, 0xe
inc ecx
adc eax, 0x8c8beb76
dec esi
mov ch, byte [edx]
in al, dx
salc
mov eax, 0x69035b3b
movzx edx, al
xor ecx, ebx
sub ecx, 0xa7828317
not eax
not eax
ror ecx, 2
xadd dl, ah
inc edx
xor dx, ax
not ecx
rol eax, 0xf7
sal dx, 9
rol ecx, 1
sar dx, 0xe7
adc eax, 0x72adf03c
xor ebx, ecx
neg edx
add edi, ecx
mov ecx, eax
mov ax, word [ebp + eax - 0x106271d9]
add cl, 0xb0
dec edx
neg edx
mov dx, word [ebp + edx*2 - 0x160]
mov edx, dword [ebp + edx*2 - 0x160]
shr ecx, cl
jb 0xd69a39
sar ecx, 0xfe
lea ebp, [ebp + ecx*2 + 2]
not ax
dec ecx
xor ecx, ecx
not dx
or ecx, ecx
or ax, dx
movzx edx, cl
neg edx
mov word [ebp + ecx], ax
and cx, cx
rol cl, 0x42
sar dx, 0xa7
or ecx, edi
jmp ecx
or si, 0xa112
jne 0xc8fdbb

Function at 0xdbbe31
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.00cb7166
xor ecx, 0x2b362714
not dword [esp]
push 0xa284a0a8
dec eax
push 0x6d86382b
lea esp, [esp + 0x20]
jne 0xd690a0
mov ebx, 0x26ad898a
pop ebx
Function at 0xdbd3f2
Capabilities:
Encode data using xor

Disassembly:
not cx
push eax
not dx
and cx, dx
xadd al, ah
cbw
mov word [edi + eax*2], cx
mov ecx, eax
xor dword [esp + eax], ebp
ret 0xc
xor ebx, ecx
movzx edx, ax
ror edx, 0x91
cwde
adc ebp, ecx
mov dword [esp + eax*2 - 0xdd6c], eax
shr dl, 0x83
sal dword [esp + eax - 0x6eaf], 0x9d
mov cx, word [edi + eax*4 - 0x1bad8]
xor dx, word [edi + eax - 0x6eb4]
xadd byte [esp + eax*8 - 0x375ac], al
btc eax, 0x31
shl eax, 0x1b
lea edi, [edi + eax + 2]
or dword [esp + eax + 7], eax
xor dword [esp + eax*8 + 8], eax
jle 0x93a3ae
mov edx, 0x1dab332b
mov ecx, edx
movzx eax, cl
mov eax, dword [edi + edx - 0x1dab332b]
lea edi, [edx + edi - 0x1dab3327]
xor eax, ebx
bts ecx, ecx
btc ecx, ecx
lea eax, [eax + edx*4 - 0x15abb88e]
sbb edx, ecx
and dl, dh
sbb cx, 0x7413
rol eax, 1
add ecx, edx
call fcn.00957708

Function at 0xdbd9b2
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
xchg ecx, eax
xor ebx, edx
shl cl, 0x61
xchg ecx, eax
shr al, 0xe2
adc esi, edx
movzx edx, cl
shr dword [esp + eax - 0x6c57e0ff], cl
mov dword [esp + eax - 0x6c57e107], esi
ret 8
shr edx, 8
call fcn.00d79c09
mov edx, 0x14030316
movzx edx, byte [esi + edx*4 - 0x500c0c59]
mov eax, 0x2fbf0e04
call fcn.00c945bf
mov eax, 0xcea1242c
mov ecx, 0x6997920f
not cl
not edx
push eax
div cl
jmp 0xd8ad4e
mov dword [edi + ecx - 0x699792f0], edx
mov edx, eax
cbw
mov eax, dword [ebp + ecx - 0x699792f0]
xor edx, 0xd136fd8d
lea ebp, [ecx + ebp - 0x699792ec]
sal cx, 0x4e
xor eax, ebx
xadd dword [esp + edx*2 - 0x3f2ee356], ecx
xor eax, 0xe38fa417
call fcn.009344aa
test byte [ebx - 0x5e6e3123], 0xfb
invalid
rol edx, 1
xchg dword [esp + eax - 0x3ffff3], ecx
btr eax, 0x1d
shr word [esp + eax*2 - 0x7fffee], 0xe
dec edx
sal ecx, 0x63
lea ecx, [eax + ecx*2 + 0x1e24dc83]
bswap edx
idiv byte [esp + eax*4 - 0xffffe8]
add cx, ax
inc edx
xchg cx, ax
shl ecx, 0x14
mov dword [esp + eax - 0x3fa4fe], ecx
bswap edx
lea edx, [eax + edx - 0xd51b518]
sbb cl, ch
bswap edx
add ecx, eax
sub eax, 0x6c97860d
dec edx
rol edx, 3
not eax
add dword [esp + eax - 0x6c57e106], ecx
dec edx
bswap ecx
rol edx, 2
neg ecx
jg 0xa1091c
xor edx, edx
and dword [esp], 0xf7b53808
test eax, eax
lea esp, [esp + 4]
je 0xd79c47
push 0x92af6d05
jmp 0xdf7d6c
mov dword [esp], edi
mov edi, 0x6da8c48b
movzx edi, byte [ecx + edi - 0x6da8c48b]
push 0xc4af3b0f
rol dword [esp], 0x10
xor edi, edx
and edi, 0xff
push 0x66bcc482
sal byte [esp + 5], 0x84
mov edi, dword [edi*4 + 0xcc4730]
sar byte [esp + 6], 0x64
jb 0xcc5a4e

Function at 0xdc543a
Capabilities:
Encrypt data using speck

Disassembly:
lea esi, [ecx*4 + 0x22bfcb12]
mov edi, dword [esp + ecx*2 - 0x4402f842]
sub cx, cx
mov esi, dword [esp + ecx*2 - 0x4401fff4]
mov edx, 0x2da6bd10
sal word [esp + ecx - 0x2200fffa], 0x4f
sete dl
mov eax, dword [esp + ecx - 0x2200fff0]
call fcn.00a3d6c3
mov edx, 0xa1980e80
mov ecx, edx
mov ax, word [esi]
mov dx, word [esi + 2]
dec cx
ror cl, 0x24
or ax, dx
lea ecx, [ecx + ecx*2 + 0x7f26a110]
call fcn.00dbcfdd
Function at 0xdc54da
Capabilities:
Encrypt data using speck

Disassembly:
not ecx
rol ecx, 1
call fcn.00c9b520
movsb byte es:[edi], byte [esi]
popfd
pop ebx
bnd jge 0xdc54cc
cmp cl, dh
pushal
mov ebx, dword [ecx]
ror dword [edx], cl
into
pushal
mov ebx, dword [ecx]
iretd

Function at 0xdc89b1
Capabilities:
Encode data using xor
Encrypt data using speck

Disassembly:
jg fcn.00cac2cc
sub ax, ax
adc esi, edx
cdq
mov eax, dword [edi]
xor dword [esp + 3], ecx
mov cl, byte [edi + 4]
sbb dl, dh
adc edi, 6
pop edx
ror edx, 0xa9
mov byte es:[eax], cl
and dx, 0x4a31
pop ecx
jmp esi
xor ebx, ecx
inc eax
or dx, ax
not eax
adc esi, ecx
add eax, edx
mov eax, dword [edi]
movzx ecx, dl
inc cx
sal edx, 0x64
mov edx, dword [edi + ecx*2 - 0x9c]
xor cl, cl
lea edi, [edi + ecx*2 + 8]
seto cl
jg 0xd38cca
mov dword [eax + ecx*2], edx
sub cx, 0x1311
movsx eax, cx
jmp esi
bswap ecx
sbb edx, 0x6b36681
add edx, 0x8783a21c
neg ecx
dec al
lea eax, [eax*2 + 0x3692d593]
mul edx
bswap ecx
neg word [esp + edx - 0x4cd24bbb]
bt dx, ax
imul edx
dec ecx
pop eax
lea eax, [edx*2 + 0x492b6410]
lea edx, [eax - 0xbf5edde]
ror ecx, 2
shl edx, 0x41
btc eax, eax
sar byte [esp + edx - 0x78cb52af], 0x41
bswap ecx
not dl
mov dword [esp + edx - 0x78cb5247], edx
xor ecx, 0x463f3e31
call fcn.00e1abe3
mov edx, 0xfba657a5
mov edx, dword [edi]
mov ecx, 0x7d95192d
dec ecx
mov cl, byte [ecx + edi - 0x7d951928]
jne 0xdfe0ce
xor dh, byte [0xec1cefce]
mov dl, 1
in eax, dx
adc al, 0xbc
and edi, edi
jmp 0xdc8aae
inc eax
neg dh
dec ecx
bts eax, edx
call fcn.00d9c2c5
mov edx, dword [edi]
add edi, 4
mov ecx, 0xe9996c2d
dec ecx
call fcn.00c899b6
mov eax, 0x669fde3d
call fcn.00a1cde7
mov ecx, dword [ebp]
add ebp, 4
mov eax, 0x9b88b935
xor ecx, ebx
rol ecx, 2
bswap ecx
mov edx, 0x7adc301
dec edx
sar ax, 0x25
neg ecx
cwd
ror eax, 0x7d
bts ax, 0xe
inc ecx
lea edx, [edx + edx*4 - 0x4ce95fe5]
btc dx, 0x94
jb 0xd9f912

Function at 0xdca211
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
call eax
mov edx, 0xecb316ab
movzx esi, dl
mov ebp, dword [ebp + esi*2 - 0x15a]
mov ecx, esi
mov dword [ebp + esi - 0xab], eax
lea edx, [ecx*4 + 0x4abb4f23]
inc cx
pop ebx
pop edi
lea esi, [edx + ecx*2 - 0x235060ec]
not edx
pop esi
call fcn.00e034e8
pop ebp
in eax, 0x41
inc ecx
add ebp, dword [ebp + eax*4 + 0x12]
fsubrp st(5)
push ds
in al, dx
stc
xor dh, byte [esi - 0x1b]
push ds
in al, dx
mov eax, dword [0x1ee5360a]
in al, dx
insd dword es:[edi], dx
mov dl, 0xfe
in eax, 0x1e
in al, dx
jno 0xdca24c
push ss
in eax, 0x1e
in al, dx
mov ebp, 0x1ee57622
in al, dx
test eax, 0x1ee59e4a
in al, dx
sbb dword [esi], ebx
rcl word [ebx], 0xa8
xchg dword [ecx + ebp - 0x21], ecx
stosb byte es:[edi], al
invalid
Function at 0xdcf79b
Capabilities:
Encode data using xor

Disassembly:
dec ebp
lea edx, [edx + eax - 0x1ea98]
push ecx
inc ebp
xor dh, bl
dec edx
xadd dword [esp + ecx - 0x791adb97], edi
inc eax
shl bh, 0xa3
inc di
inc ecx
dec dh
inc cx
sar ecx, cl
dec eax
rol dword [esp + eax - 0x1ea92], cl
inc ecx
not dh
inc ecx
adc dh, 0x3a
inc esi
inc ecx
ror dh, 1
inc ecx
neg ecx
inc ebp
xor bl, dh
call fcn.00e12248
mov eax, dword [ebp]
add ebp, 4
xor eax, ebx
mov edx, 0x1a3b9ea9
movsx ecx, dx
xchg dx, cx
neg eax
sub cl, ch
dec eax
call fcn.00926bb6
xor ecx, eax
and byte [esp + eax - 0x192a], cl
lea edx, [esp + edx + 0x10]
mov eax, dword [eax + edx - 0x192d]
xchg dword [esp + ecx - 0x1925], ecx
mov dword [edi + ecx - 0x58e4c8e1], eax
movzx edx, cl
bts cx, 0x33
movzx eax, byte [ebp + ecx - 0x58e4c8d9]
add cx, cx
ror edx, cl
xor al, bl
add al, 0x1e
imul ecx, ecx
not al
sbb al, dl
rol al, 1
xor cx, 0xbd97
xadd dx, cx
cmovnp edx, dword [esp + edx*8 - 0x1be78c]
xor al, 0x16
pop edx
push ecx
not al
shr dword [esp + 5], 0x18
xor bl, al
xchg word [esp + 3], cx
push ecx
lea eax, [esp + eax + 0x14]
sub ecx, ecx
mov dx, word [eax + ecx*8]
mov word [edi + ecx*2 - 8], dx
movsx eax, cx
xadd cx, ax
lea edi, [ecx + edi - 8]
mov edx, dword [ebp + ecx + 3]
lea ebp, [ebp + ecx + 7]
bts eax, eax
xor edx, ebx
btc cx, 0xa7
xchg cx, ax
cbw
rol edx, 3
bswap edx
ror ax, 0x8f
xor dword [esp + ecx + 0xd], ecx
ror edx, cl
lea eax, [ecx + 0x35100b3f]
or ax, 0x4eaa
sbb edx, ecx
inc eax
xor edx, 0x55b33e8a
bswap ecx
xor ebx, edx
call fcn.0095c911
add byte [eax], al
add byte [ebx + 0x65], dl
je 0xdcf90b
jne 0xdcf93c
jae 0xdcf93b
jb 0xdcf8ce
ror edx, 1
push eax
xor ebx, edx
pop ecx
xchg ecx, eax
lea ecx, [eax*4 - 0x2c7aca68]
add ebp, edx
btc cx, cx
cbw
bts eax, eax
mov di, word [eax + edi - 0x45c70128]
xchg al, cl
not cx
jb 0xdc1b64
jae fcn.009419ad
mov eax, 0x8005313
movsx edi, al
not al
dec edx
mov edx, dword [eax + ebp - 0x80053ec]
dec ecx
mov ecx, dword [ebp + eax*2 - 0x1000a7d0]
dec eax
mov dword [edx + eax*4 - 0x20014fb0], ecx
inc eax
movsx edx, bh
inc esp
mov esi, eax
dec ecx
mov ebp, dword [edx + eax - 0x80053f4]
dec ecx
xor ebp, ebx
inc esp
movzx esp, dl
inc eax
shl bh, 0x61
popal
dec esp
lea edi, [edi*2 - 0x58e8df46]
dec eax
bswap ebp
xchg edx, eax
jnp 0xd77bd1
and al, 5
and al, 0xeb
jnp 0xdcf938
ror al, 0xd5
dec edi
mov ah, 0x8b
push 0xb463a9dd
mov ebp, dword [eax + 0x45]
mov ch, 0x57
mov ah, 0x8b
push 0x6bc32ef7
scasd eax, dword es:[edi]
in eax, 0xa6
insb byte es:[edi], dx
or al, 0x45
leave
pop es
stosb byte es:[edi], al
idiv dword [esi + 0x55a377fe]
xchg ecx, eax
sbb ch, byte [ecx - 0x5fb86872]
sub ch, byte [ebp - 0xab86872]
pop esp
mov dword [esi - 0x7c76b869], ecx
ret 0x18bf