joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8a64f2
Capabilities:
Encode data using xor

Disassembly:
cld
movsx eax, word [esp + 0xc]
neg word [esp + eax*2 - 0xdc4b]
mov edx, dword [edi + eax - 0x6e2c]
lea edi, [edi + eax*8 - 0x3715c]
xor edx, ebx
and eax, 0xb9b438ae
call fcn.007f2239
mov ecx, 0xb7a52801
movzx eax, byte [esi]
mov edx, 0xde3fcfb9
add esi, 1
shr edx, 0xe1
xor al, bl
add al, 0x3b
call fcn.007e1bfb
inc ecx
insb byte es:[edi], dx
and al, 4
mov ebx, 0x8bd0a50f
dec esp
and al, 4
shr dword [esp + 4], 0xbb
shld eax, edx, cl
mov ecx, dword [esp + 4]
call fcn.00bb528c
imul esp, dword [ebp - 0x2f], 4
jp 0x8a652a
shr ecx, 0xc8
clc
jge 0x8a6530
push ecx
test eax, esp
clc
jge 0x8a6536
jns 0x8a656c
pushal
clc
jge 0x8a653c
jns 0x8a652a
dec eax
clc
jge 0x8a6542
jno 0x8a657c
inc eax
clc
jge 0x8a6548
jns 0x8a64aa
mov al, 0xf8
clc
jge 0x8a654e
or dword [ecx + 0x20], eax
clc
jge 0x8a6554
cdq
js 0x8a64f0
cmp al, 0x47
sal dword [edx + 0x22], 0xf6
mov esp, 0x94f10061
mov ecx, dword [esi + 4]
mov es, word [eax + eax]
add byte [eax], al
pop esp
mov dl, byte [edi]
add eax, 0x1e2e9a3b
push ds
test dword [ebp + ebx*4 - 0x7ace3da2], ecx
pop eax
or al, 0x6e
ret 0x8531
xor dword [ebp - 0x3d91f3a8], eax
xor dword [ebp - 0x3d310338], eax
xor dword [ebp - 0x3d810a6c], eax
xor dword [ebp - 0x3d492320], eax
xor dword [ebp - 0x3d69a2bc], eax
xor dword [ebp - 0x3dc98b98], eax
xor dword [ebp + 0x7690c5c0], eax
pop esi
ret 0x8531
nop
jbe 0x8a6571
pop esi
enter 0xffffffffffff8444, 4
jp 0x8a65a7
xchg esp, eax
jo 0x8a659e
clc
jge 0x8a65ad
dec esp
enter 0xfffffffffffff8fd, 0x7d
and esp, esp
nop
aad 0xf8
jge 0x8a65b9
in al, dx
adc al, 0x25
clc
jge 0x8a65bf
sbb al, 0x70
push ebp
clc
jge 0x8a65c5
or al, 0xec
invalid
clc
jge 0x8a65cb
jl 0x8a65fc
insd dword es:[edi], dx
clc
jge 0x8a65d1
aam 0x95
cmpsd dword [esi], dword es:[edi]
cmp al, 0x47
ror dword [edi + 0x61bcf647], 0x4e
sub al, 0x94
mov esp, 0x942c4e61
mov ecx, dword [esi + 4]
mov es, word [eax + eax]
add byte [eax], al
or dword [edx - 0x68f9fae9], 0x41851e2e
adc dword [ebx - 0x3e], ebp
mov dl, byte [edi]
add eax, 0x1e2e9706
xchg edi, eax
push ds
push ds
test dword [ecx + 0x11], eax
imul eax, edx, 0x31
test dword [ebp + 0x31c2ebb9], ebp
test dword [0x31c26329], eax
test dword [ecx], edi
pop ecx
cmp eax, edx
xor dword [ebp - 0x3d144653], eax
xor dword [ebp - 0x3d9cd6fb], eax
xor dword [ebp - 0x3dc4a6c7], eax
xor dword [ebp - 0x3ddc5763], eax
xor dword [ebp - 0x3d147e43], eax
xor dword [ebp - 0x3d5c97db], eax
xor dword [ebp + 0x76ed5155], eax
pop esi
pop esi
or byte [ebp + 0x5e58cd8e], al
call dword [edi]
loopne 0x8a65c9
out 0xa3, eax
int1
salc
cmpsd dword [esi], dword es:[edi]
cld
and ecx, dword [ebx - 0x7e1d8338]
add byte [eax], al
add byte [eax], al
or dword [ebx + 0x62], esp
fisubr word [edi]
in al, 0xcb
mov bh, 0x9c
std
fsub st(5)
mov ch, 0x68
daa
in al, 0xee
pop es
test al, 0x3f
sub bl, byte [ecx - 0x5ae511de]
or ah, 0xe5
invalid
Function at 0x8a9616
Capabilities:
Encrypt data using speck

Disassembly:
mov ebx, dword [esp + ebx - 0x7fc159bb]
push 0x5736142c
push 0x242a95a5
mov ebp, dword [esp + 0x10]
call fcn.00c065ee
mov dword [esp], edx
neg edx
rol cl, 1
neg dx
pop edx
inc cl
lea edx, [edx*8 - 0x74cc9b74]
add dx, dx
not cl
jbe 0x8a63d9
inc cl
or edx, edx
xor bl, cl
sar dl, 0x61
adc ecx, esp

Function at 0x8b197a
Capabilities:
Encode data using base64

Disassembly:
not ecx
xor al, bl
or ecx, ecx
inc al
mov dword [esp], 0x74180915
bswap ecx
xor cx, word [esp + ecx - 0x5955f8fe]
not al
add ecx, ecx
ror word [esp + 2], cl
rol al, 1
xchg word [esp + 1], cx
ror ecx, 0x55
jae 0xc77a8e
mov ecx, dword [ebp]
add ebp, 4
mov edx, 0xa423bfbd
movsx eax, dl
xor ecx, ebx
inc ax
jno 0xc63448
dec ecx
inc dl
not ecx
not dx
js 0x836c50
xor al, 0x84
and byte [esp + ecx - 0x5c384d94], 0x99
jne 0xc0ca5a
mov edx, 0x7201063a
lea eax, [edx - 0x5463eaf6]
jmp 0xc559c1
Function at 0x8b9099
Capabilities:
Encrypt data using speck

Disassembly:
sub ecx, edx
mov dword [esp + ecx - 0x69e287a0], 0x252b0688
bswap eax
not eax
xor ebx, eax
xchg dword [esp + ecx - 0x69e287a0], edx
and dword [esp + edx*2 - 0x4a560d10], 0xfc35ed99
pop ecx
adc edi, eax
movzx dx, byte [edx + esi - 0x252b0688]
mov dword [esp + 4], ecx
mov al, byte [esi + 2]
add esi, 2
shl ecx, 0x70
lea ecx, [ecx + ecx*4 + 0xd296c07]
mov dword [esp + ecx*4 - 0x54a5b01c], ecx
or dl, al
ror cx, 0x45
shr dword [esp + ecx - 0x15293b5c], 0x2a
not dl
jne 0xc60548
mov word [esi + ecx - 0x15293b60], dx
mov dword [esp + ecx - 0x15293b60], edi
ret 4

Function at 0x8ba667
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information

Disassembly:
xor bl, dl
lea edx, [esp + edx + 0xc]
mov al, byte [ecx + edx]
lea edx, [ecx*4 + 0x28b36bb6]
mov word [esi + ecx - 4], ax
lea esi, [ecx + esi - 4]
bt ecx, 0xb2
pop eax
pop eax
pop eax
jae fcn.008001e8
mov edx, 0x59ab820b
not edx
mov eax, dword [edi]
ror edx, 0xe3
lea ecx, [edx*4 + 0x133fc481]
lea edi, [ecx + edi - 0x666a0375]
sbb ecx, ecx
call fcn.008c4b6d

Function at 0x8ba6af
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information

Disassembly:
setp byte [esp + eax - 0x62a11304]
mov ecx, dword [ebp + eax - 0x62a11304]
call fcn.0085cabf
xor edx, 0x73020115
neg ecx
btc ecx, eax
add ax, cx
neg edx
xor ebx, edx
bt ecx, 0xbb
add ebp, edx
movsx edx, cx
mov ax, word [esi + ecx - 0x4fdffe01]
mov dx, word [esi + ecx - 0x4fdffdff]
lea esi, [ecx + esi - 0x4fdffdff]
sar cl, cl
not ax
shl cx, 0x2e
sub ecx, ecx
sar cl, 0xa4
not dx
bswap ecx
btr cx, cx
jae 0xb431a3
dec esi
xadd dword [esp + eax - 0x4312cd05], eax
xor dl, 0x9e
add dl, 0x23
call fcn.007342fa
jns 0x719a04
inc ecx
xor dl, ah
inc edx
inc dword [esp + ebx*2 - 0x19b07]
dec esi
mov dword [esp + ebx*2 - 0x19b10], ebx
sub dl, 0x98
inc bp
bt ebp, edi
jae 0x8a1036
mov ecx, 0xb4b19e0e
lea edx, [ecx + ecx*4 + 0x31a80c17]
mov eax, edx
mov edx, dword [edi]
add edi, 4
dec cx
btr cx, ax
xor al, al
xor edx, ebx
inc edx
and ecx, eax
sbb ax, ax
not edx
rol edx, 2
sar eax, 0x2a
rol cl, 0x44
ja 0x7c46f4
or ax, dx
mov word [esi + ecx*4], ax
mov edx, ecx
push edx
add dword [esp + ecx], ebp
ret

Function at 0x8beb48
Capabilities:
Encrypt data using speck

Disassembly:
xadd cx, dx
add edx, ecx
lea eax, [esp + eax + 0x14]
not edx
movzx dx, byte [edx + eax - 0x7fc810d2]
movzx eax, word [esp + ecx - 0x6a18e8b5]
mov dword [esp + ecx - 0x6a18e8c1], ecx
lea esi, [ecx + esi - 0x6a18e8c7]
mov word [ecx + esi - 0x6a18e8c5], dx
rol al, cl
pop eax
pop eax
pop ecx
pop edx
pop edx
jne fcn.007e2cc2
Function at 0x8c200b
Capabilities:
Encode data using xor

Disassembly:
cwde
inc word [esp + eax*4 - 0x1dec6]
xor ecx, 0xe5a42086
ror ecx, 1
not ecx
or eax, dword [esp + eax*4 - 0x1dec4]
xor ebx, ecx
add esi, ecx
pop ecx
idiv ecx
sar dword [esp + eax*2 - 0x80f5c], 0xc8
mov dword [esp + eax*2 - 0x80f5c], esi
ret
neg word [esp + ecx*2 - 0x1aa]
adc ecx, 0x409e470c
not dl
seto cl
xor bl, dl
mov dword [esp + ecx - 0x409e4700], 0x2ab5e692
ror ecx, 0x41
mov word [ebp + ecx - 0x204f2380], dx
idiv byte [esp + ecx*2 - 0x409e46fa]
mov ecx, dword [esi + ecx*2 - 0x409e4705]
add esi, 0xfffffffb
mov esp, 0x61b9064c
mov edi, 0xfb4e8c8b
sti
mov eax, 0xc683bf61
sti
shr dword [esp + 3], 0xaa
xor ecx, ebx
dec ecx
call fcn.0082c913
add eax, dword [ebp + 0xcedb300]
jge 0x8c2037
mov edi, 0x3fff6a8
test dword [eax], eax
mov bl, 0xed
or al, 0x7d
fcmovnbe st(0), st(5)
fadd qword [ebp - 0x2a24befe]
aad 0xdc
test dword [edx], eax
inc ecx
fcmovnbe st(0), st(5)
fadd qword [ecx - 0x2a249eec]
fdivr st(1), st(0)
add ah, bl
jns 0x8c2040
fsubr qword [edi]
lodsd eax, dword [esi]
jecxz 0x8c2050
jae 0x8c209d
in al, dx
cld
invalid
jmp 0x7cae80
Function at 0x8c381d
Capabilities:
Encrypt data using speck

Disassembly:
not edx
lea eax, [ecx + ecx*8 - 0x5b4af9ff]
sub ecx, 0x9fb28fb4
sbb edx, 0x640ecf2d
bswap edx
ror cl, 0xc7
and cl, al
lea edx, [edx + ecx*2 + 0x28e9388]
imul ecx, eax
and eax, ecx
lea eax, [eax*4 - 0x76e5ed42]
not edx
btr cx, 0x21
shl cx, 0xc6
cwde
ror edx, 1
dec eax
xor edx, 0x743d7c16
xadd cl, al
xor ebx, edx
add ebp, edx
jmp fcn.007a41b7
mov ebp, dword [esp + ecx*2 - 0x31133788]
movsx ebx, cx
mov ebx, dword [esp + ecx*4 - 0x62266f28]
lea ecx, [ecx*8 + 0x108847b2]
mov dword [esp + 0x10], ecx
jmp 0xc1fad0
inc ecx
btc esi, 0x13
inc ebp
xor dl, ah
inc ecx
inc dl
inc ebp
movsx ebp, ax
inc ebp
movzx edi, si
inc ecx
not dl
inc ecx
movzx esi, bp
inc ecx
movzx ecx, ax
inc ecx
add dl, 0xae
call fcn.00b881fa
mov ecx, 0xa7985f87
dec cx
mov edx, dword [ebp]
movsx eax, cx
lea ebp, [ebp + eax*2 - 0xbf08]
xor edx, ebx
shl ecx, 0x34
and eax, 0xe93d732
lea edx, [edx + eax*4 + 0x200dca98]
rol edx, 1
xor edx, 0xc79f62aa
bts ecx, eax
rol ecx, 0xf3
neg edx
call fcn.00c41176
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 3]
mov edx, dword [esp + ecx - 0x18899bbe]
push ecx
mov dword [esp + ecx - 0x18899bbe], ecx
jmp 0x75d4b3
lea edx, [edx*2 + 0x7fb0f080]
not ax
mul al
add ecx, esp
bts eax, 0x20
cwde
mov ax, word [ecx + edx - 0x7fb2ee82]
jb 0xb77bdf
not edx
bt cx, cx
and eax, edx
lea edx, [ecx + ecx*4 + 0x6932dea2]
call fcn.00c74a6c
xor ecx, esi
dec dword [esp + 0xf]
shr dword [esp + 0x10], 0x38
sar dword [esp + 0xd], 0x77
inc eax
ror dword [esp + 8], 0x7c
jae 0xc41ddf
and cl, dl
add eax, 0xab5c833
call fcn.00c024d6
jmp 0x83862b
btr ax, ax
push eax
neg ax
neg eax
not cl
not dl
jns 0x8d0467
movsx ecx, dx
lea edi, [edx + edi - 0x7fb2ee84]
xchg cl, dl
neg edx
sub ecx, ecx
mov word [edi + ecx*4], ax
mov edx, dword [esi + ecx*2]
movzx eax, cx
and eax, 0xae03b68f
shr ecx, 0xec
lea esi, [ecx + esi + 4]
adc cx, ax
xor edx, ebx
dec edx
rol eax, 7
jae 0x759916
out dx, al
wait
and esp, dword [ebp + 0x18ada38a]
jp 0xb77bcd
mov ch, bh
mov dl, 0x70
jp 0xb77bd3
mov cl, bh
or eax, 0x8aaf7a40
or esp, dword [edx - 0x758d8668]
out dx, al
or esp, ebp
nop
xor dl, byte [esi + esi*4 + 0x42754837]
push esi
rol byte [ebp + 0x1d6cf425], 1
sal dword [ebp + 0xa], 1
xchg ebp, eax
xor edx, dword [esi - 0x750f648e]
xor dword [eax - 0x4e], esi
mov ecx, 0x3dc22848
loopne 0xb77c63
enter 0xffffffffffffe49d, 0xffffffffffffff9a
in al, dx
andps xmm4, xmm1
mov cl, 0x5f
lodsb al, byte [esi]
lcall 0xe7dd, 0xdde7a330
xor byte [ebx - 0x18222219], ah
mov bh, 0x8e
invalid
mov ecx, dword [esp + 0x24]
lea esp, [esp + 0x28]
ret
jb 0x870d4f
xor ecx, 0x9482d5bb
call fcn.007a6356
inc ecx
mov eax, 0xb125120c
inc ebp
movsx ebx, ax
inc esi
movzx edx, byte [edi + ebx*2 - 0x2419]
inc ebp
movzx esi, bl
jmp 0x766a69
Function at 0x8c951f
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], 0xe00a4035
mov dword [esp], edi
Function at 0x8d0478
Capabilities:
Encrypt data using speck

Disassembly:
or eax, ecx
xor edx, 0xd79c55b3
mov dword [esp + ecx - 0xa02a100], 0xaf2e4922
cbw
not edx
call fcn.007c3750

Function at 0x8d0df6
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0xfea15a00
xor esi, eax
dec word [esp + 2]
and esi, 0xff
ror word [esp + 1], 0x61
sal word [esp + 1], 5
sar dword [esp], 0x46
mov esi, dword [esi*4 + 0x76af10]
call fcn.0074c456
rol ax, 0xe9
neg edx
bt ecx, eax
xor edx, 0xd5ac543e
xor ecx, 0xf01596ab
ror ecx, 0x7d
cwde
sbb edx, 0xbaa0039b
shl ax, 0xf
sar ecx, 0x6d
sal cl, 0xc7
bswap edx
cwde
setb al
not edx
add cl, ch
xor ebx, edx
sar cx, 0x86
adc edi, edx
mov eax, dword [ebp + eax - 1]
sal cl, 0xc3
mov ecx, dword [ebp + 4]
mov edx, 0xd097a627
xor dl, dh
bts edx, edx
adc ebp, 8
call fcn.00819576

Function at 0x8d69b5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
add edi, edx
mov edx, dword [esi + 4]
rol dword [esp + 6], cl
mov dword [esp], eax
inc cx
sbb esi, 0xfffffff7
call fcn.007bb04b

Function at 0x8e2d8f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Parse pe header

Disassembly:
dec ebx
mov dword [edi + ecx - 0x699ebd15], esi
dec ecx
rol ebx, cl
inc ecx
or edi, 0xf2ea118
dec eax
mov dword [esp + ebp - 0x699e4825], 0x3c930e30
dec edi
lea ecx, [edi + ecx - 0x6fbebd25]
sbb dx, word [esp + ebp - 0x699e4822]
neg dx
pop esi
pop eax
jns fcn.008a1785
lea ebp, [edx + ebp - 0xc]
xchg edx, ecx
call fcn.00bc819c
ror ebp, 0x5a
inc esi
mov ebp, dword [edi + ebx*2 - 0xc82c]
inc ebp
xor ebp, esp
jmp 0xc5fd91
inc ecx
movsx ecx, dl
btr bp, si
inc ecx
xor al, ah
sub al, 0x98
dec ecx
inc edx
xor al, 0x9e
dec eax
btr ecx, 0xa
dec esp
or edi, ecx
inc esp
movzx ebp, cx
adc al, 0x23
inc bp
or ebp, edi
inc ecx
push edi
neg al
inc edx
xadd byte [esp + eax - 0x6641783], cl
inc ecx
pop eax
neg si
not al
inc esp
xor ah, al
inc ecx
sal edx, 0x31
dec ecx
sal edx, cl
inc eax
xadd dh, ch
dec eax
adc eax, esp
inc esp
mov dword [eax + esi - 0x9b7c], ebx
sal edx, 0xfc
call fcn.0073a3fa
bts cx, 0x27
xor ecx, ecx
adc ebp, edx
xor cx, ax
pop ecx
jg fcn.007e2cc2
inc ebp
movsx esi, ax
inc ecx
dec ebp
inc eax
shr ch, 0x61
inc ecx
neg ebp
inc ecx
push esp
inc esp
xor dword [esp + ebp*2 - 0xa80], ebp
inc ecx
pop esp
dec ebp
arpl bp, bp
dec eax
xor ebp, esi
inc ecx
ror dh, 0x62
dec ecx
add ebx, ebp
shl ebp, 0xbc
dec ecx
inc eax
dec esp
lea edi, [ebp*2 + 0x46895a04]
inc esi
mov ebx, dword [ebp + ecx - 0x60000000]
dec ebp
lea ecx, [ecx + ebp - 0x5ffffffc]
inc ecx
rol eax, 0xc8
inc ecx
movsx eax, ax
cdq
dec edx
lea edi, [edi + eax*2 - 0xcc82f09]
inc eax
xchg al, dh
inc edx
movzx eax, byte [edi + eax - 0x6641784]
ja 0xb777a3
inc ecx
movzx esi, ax
inc ecx
ror ebp, 1
inc ecx
not ebp
dec esi
lea edx, [ebx*2 - 0x18684253]
jmp 0xc4608e

Function at 0x8e721b
Capabilities:
Encode data using base64
Encrypt data using speck
Manually build aes constants

Disassembly:
not edx
xor edx, 0x3d229d9d
inc ecx
pop ebx
inc esp
movsx ebp, al
inc ecx
push esp
inc ecx
dec dh
xor dword [esp + eax + 0x1150805b], edx
call fcn.00724663
dec ecx
shr edx, 0x71
jbe 0x7967c3
Function at 0x8e9521
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information

Disassembly:
sbb dl, 0x38
ror word [esp + eax], 0x4d
neg dl
rol dword [esp + eax], cl
xor dl, cl
bswap ecx
lea eax, [eax + ecx*4 - 0x3cfee9f0]
xor ecx, eax
rol dl, 1
ror ax, 0xe2
xor bl, dl
lea edx, [esp + edx + 4]
cwde
mov ecx, dword [edx + eax*2 - 0x191e]
lea edx, [eax*8 + 0x7da9a226]
call fcn.00bdc2ef
lea esi, [ecx + esi + 4]
xor eax, ebx
sar cx, 0xc7
lea eax, [eax + ecx + 0x129edd81]
sub cl, 0x86
movsx edx, cl
ror eax, 3
bt dx, 0x15
bt ecx, 0xae
xadd edx, ecx
adc eax, 0x86169890
push ecx
sar ecx, 0x51
xadd dword [esp + ecx*4], edx
xor eax, 0x8a2d4b8d
xor ebx, eax
ror cl, 0x43
xchg dh, cl
sbb word [esp + ecx*8 + 1], cx
adc ebp, eax
or edx, ecx
adc dx, cx
mov edi, dword [edi + ecx]
xor dl, dl
pop edx
jno fcn.007a41b7
ror word [esp + eax + 2], 0xe3
jae 0x73f1fd
mov ebx, dword [esp + ebx - 0x58360daf]
mov dword [esp + 4], 0x7a9d831d
lea esp, [esp + 4]
call fcn.00c47f0d
dec eax
ror dword [esp + eax - 0x6812], 0xbb
xor al, byte [esp + eax - 0x6812]
mov dword [esi + eax - 0x68f2], ecx
inc ecx
adc dh, 0x30
inc esp
mov ebp, dword [edi + eax - 0x68f7]
dec eax
lea edi, [edi + eax - 0x68f7]
dec eax
or ebp, dword [esp + eax*8 - 0x34790]
cwde
inc ebp
xor ebp, esp
call fcn.00bcb3e7
xor ax, ax
rol edx, 2
not cx
and eax, 0xe234d713
lea edx, [eax + edx - 0x6ea0213e]
xor ebx, edx
ror eax, cl
inc ax
adc edi, edx
inc eax
bswap eax
movsx edx, cl
movzx edx, byte [ebp + eax*4 - 0x8000000]
not eax
push eax
lea eax, [eax + ecx + 0x1af708]
lea ebp, [ebp + eax*2 - 0x12c4ee0b]
shr eax, cl
xor dl, bl
and dword [esp + ecx*2 - 0x168efffe], 0x809af9a2
adc dl, cl
ror dl, 1
jmp 0x83561b

Function at 0x8eb864
Capabilities:
Encrypt data using speck

Disassembly:
add dl, 0x9f
xchg ch, al
ror dl, 1
sub cl, al
push eax
neg dl
inc dl
sal ax, 0x8e
imul ecx, ecx
not dl
adc dl, al
xor bl, dl
dec dword [esp + ecx*2 - 0x72478622]
jne 0x8c03f8
mov dx, word [esi + ecx - 0xc2]
shr dword [esp + ecx - 0xc0], cl
mov cl, byte [esi + ecx*4 - 0x30c]
adc esi, 4
call fcn.007a4c99
jmp 0x81a130

Function at 0x8eb983
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00b3b463
inc dword [esp + 0x10]
push 0xffade819
xor ebx, edx
add edi, edx
lea esp, [esp + 0x18]
push 0xec0d3eab
lea esp, [esp + 4]
jmp 0x788f6e

Function at 0xb342ec
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
call fcn.00c2a4e6

Function at 0xb3634d
Capabilities:
Encrypt data using speck

Disassembly:
sbb dl, 0xc
shr eax, cl
mov dword [esp + ecx*2 - 0x17fed614], 0xee08e9a6
lea eax, [eax + ecx*4 + 0x58161a33]
ror dl, 1
lea eax, [ecx*2 - 0x4fed6563]
xor dl, 0xb8
shr cx, cl
xor bl, dl
not ecx
ror cl, 0xa4
lea edx, [esp + edx + 4]
movzx ax, byte [edx]
movzx edx, cx
lea esi, [esi + edx*2 - 0x1febe]
sal byte [esp + edx*2 - 0x1feba], 0x84
add dx, word [esp + edx*2 - 0x1febc]
xor cx, cx
mov word [edx + esi - 0xe904], ax
xchg byte [esp + edx - 0xe902], cl
pop edx
jns fcn.007e2cc2

Function at 0xb36671
Capabilities:
Encrypt data using speck

Disassembly:
xor dl, bl
mov dword [esp + ecx*8], eax
inc cx
sub dl, 0x8d
Function at 0xb3b9d3
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information

Disassembly:
shl cl, 0x43
xor bl, dl
add eax, ecx
adc edx, esp
btr eax, ecx
jb 0x7e2d7a
dec edx
mov dword [esp + 0x312ab64f], 0xadbec5a1
dec esi
mov esi, dword [esp + 0x312ab66f]
dec edx
mov eax, dword [esp + 0x62556ca6]
dec edi
lea esp, [esp + 0x132f7387]
dec eax
mov dword [esp + 0x48], 0x3f261782
call fcn.00ba9a4a
mov edx, 0x78941d9f
movzx eax, dx
movzx edx, byte [ebp + edx - 0x78941d9f]
shl eax, 0xf8
xor dl, bl
xor dl, 0xb9
xor al, 0xb4
rol dl, 1
not al
movzx ecx, al
inc dl
and ecx, 0xea25da23
neg dl
jmp 0x7eef06

Function at 0xb3cf12
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Parse credit card information

Disassembly:
dec edx
mov dword [esp + edx*4 - 0x1ffff334], ebp
sub edx, 0xcbbf8aa4
inc ecx
sar bl, 0x23
dec esp
lea ebp, [esi + esi + 0xe896b22]
dec edx
xor dword [esp + esi*2 - 0x207336f], esi
neg edx
inc esi
add dword [esp + esi - 0x10399b7], esi
jb 0x7185cf
mov edx, 0x46196996
call fcn.00c3e8c0

Function at 0xb45303
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
bswap edx
not eax
inc eax
mov dword [esp + ecx*2], ecx
xor eax, 0x7a045ba3
neg dword [esp + ecx]
neg ecx
lea eax, [eax + edx*2 + 0x44e1c583]
sal dword [esp + ecx], 0xe1
xor eax, 0xa5850d07
pop edx
btc dx, dx
xor ebx, eax
rol dl, 7
adc ebp, eax
or dl, dl
lea eax, [ecx + ecx*4 + 0x27b803ba]
add edx, 0x132f4c0a
xor cx, word [esi + ecx*2]
lea esi, [edx + esi - 0x132f4c88]
mov bl, 0xd0
in al, dx
rol edx, 0xd2
xor cx, bx
inc dx
inc cx
rol edx, 0x56
inc dx
lea edx, [eax*4 - 0x1cd8dd54]
xor cx, 0x3116
add dx, ax
shr al, 0x25
sal al, 0x81
not cx
call fcn.007b8459
out 0xa1, eax
mov esp, 0x65e55f01
jae fcn.00b453f8
lock and dword [esi - 9], 0x30dfe8d1
invalid
jl 0xb453e8
in eax, 0x65
jae 0xb45348
xchg ebp, eax
pop ss
in eax, 0x65
jae 0xb453be
pushal
aaa
in eax, 0x65
jae 0xb45370
in al, dx
sbb bl, al
stc
mov dword [edx], esi
xor ebp, dword [eax]
inc ebx
imul edx, dword [eax + 0x762bb06a], 0xffffffb0
and dword [ecx + 0x29], eax
fiadd word [eax + 0x6e]
push 0x689d4964
dec esi
push 0x548f4964
jb 0xb45420
dec ecx
xchg dword [edx + edx*2], edx
or edi, dword [ebx + 0x4c]
jnp 0xb4540c
mov byte [0x424648d], al
test al, 0x66
btc ecx, 0x9b
invalid
pop ss
Function at 0xb453f8
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
ror ecx, 1
xor ecx, 0x768f68a0
sal eax, 0xde
rol edx, 0x1b
ror word [esp + edx - 0xc3b], 4
xor ebx, ecx
ror dword [esp + edx - 0xc38], 0xd0
adc ebp, ecx
cdq
pop eax
movzx eax, byte [edi + edx]
add dl, 0xbe
lea edi, [edi + edx - 0xbd]
xor al, bl
xchg dword [esp + edx - 0xba], edx
mov ecx, 0xc737890e
xchg dh, dl
inc al
btr edx, 0x88
cmovb cx, dx
rol al, 1
inc al
rol al, 1
and word [esp + edx*2 - 0x73fd], dx
neg edx
xor al, 0x1f
neg dl
xor bl, al
push ecx
sub esi, 2
mov word [esi], ax
shl dword [esp + 8], 0xe8
dec byte [esp + 5]
pop edx
pop eax
pop eax
jge fcn.007e2cc2
sysenter
push edi
mov edi, 0xf7870616
pushfd
test di, di
mov edi, dword [esp + edi + 0x878f9ee]
mov dword [esp + 4], 0x8d5ec974
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00799864

Function at 0xb48267
Capabilities:
Encrypt data using speck

Disassembly:
inc eax
mov dword [esp], 0x52a9833c
pop edx
not edx
xor eax, 0xc32fc416
neg dx
not edx
sbb eax, 0x75021416
sal ecx, 0xdd
bswap eax
sal cl, 0x87
add edx, ecx
xor ebx, eax
lea ebp, [ecx + ebp - 0x60000004]
mov dword [ebp + ecx - 0x60000000], eax
btc ecx, edx
ror edx, 0xf8
lea esi, [ecx + esi - 0x60000008]
mov ecx, dword [esi + ecx - 0x60000004]
mov eax, edx
jae 0x712754
xadd al, dh
xor ecx, ebx
xadd eax, edx
neg edx
bswap ecx
shl edx, 0xc9
inc dx
sbb ax, ax
neg ecx
inc eax
inc ecx
btc edx, eax
add edx, edx
neg ecx
dec dl
idiv eax
dec ecx
not ecx
rol edx, 0x7d
div al
div eax
xor ebx, ecx
imul al
neg eax
add edi, ecx
movsx ecx, al
xadd cx, ax
jl fcn.008c0304

Function at 0xb48bdc
Capabilities:
Encrypt data using speck

Disassembly:
xor al, bl
sal dword [esp + ecx + 4], 0xd
mov dword [esp + ecx], ecx
setbe cl
rol al, cl
add al, cl
mov edx, dword [esp + ecx + 3]
ror al, cl
shl dl, cl
neg al
neg edx
rol word [esp + ecx*2 + 2], 0x69
or cl, byte [esp + ecx + 1]
xor al, 0x9f
xor bl, al
add ecx, ecx
lea eax, [esp + eax + 8]
mov ecx, dword [eax + ecx*2 - 4]
movsx eax, dl
sar dx, 0x4a
mov dword [eax + esi - 8], ecx
lea esi, [esi + eax - 8]
adc word [esp + eax*8 + 3], 0x44ac
pop eax
pop eax
jp fcn.007ce4d4
mov edx, 0x4aa06c02
movsx ecx, dl
xchg dh, dl
mov edx, dword [edi + ecx - 2]
movzx eax, cx
or eax, ecx
lea edi, [edi + ecx + 2]
xor edx, ebx
neg eax
push eax
and byte [esp + ecx*4 - 5], ch
inc edx
jmp 0xc5b43e
sub edx, 0xc62d9a99
rol ecx, 0x7d
add eax, eax
xor ebx, edx
ror ecx, cl
or ax, 0x4b36
adc ebp, edx
shl ecx, 0x33
mov esi, dword [esi]
movsx edx, cl
neg al
imul edx, ecx
jae fcn.007e2cc2
pop ecx
not edx
bswap eax
dec edx
inc ax
inc ax
neg edx
bts ecx, 0x25
setb al
rol edx, 2
jmp 0xbcf349
Function at 0xb4da7c
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Encrypt data using speck
Parse credit card information

Disassembly:
jno 0xb9d227
call fcn.00b31f53
xor bl, cl
lea ecx, [esp + ecx + 8]
shr dx, 0x6a
sar dl, 0x41
mov eax, dword [ecx]
not word [esp + 2]
movzx ecx, dx
ror word [esp + ecx*4 - 0x4c], 0xe2
lea esi, [ecx + esi - 0x17]
sub ecx, ecx
mov dword [esi + ecx*2], eax
mov eax, dword [edi + ecx*8]
jns 0x7b2737
lea edi, [edi + ecx + 4]
xchg word [esp + ecx*2 + 2], dx
shr ecx, 1
mov word [esp + ecx*8 + 4], cx
xor eax, ebx
rol dx, 0x26
jae 0x778c6e
bswap eax
neg dx
inc dl
sbb eax, ecx
neg edx
rol eax, 1
xor eax, 0x5dbcb7b8
dec dl
setg dl
btc ecx, 0x9d
xor ebx, eax
push edx
sal edx, 0x21
sub dx, dx
adc ebp, eax
rol edx, 0xef
movsx eax, dx
pop eax
pop eax
pop eax
jb fcn.007e2cc2
mov eax, 0xcb2b1e02
cbw
mov edx, dword [edi]
movzx ecx, al
ror cx, 0x61
mov ecx, dword [ecx + edx - 1]
sal eax, 0x9d
mov dword [edi + eax*2 - 0x80000000], ecx
movzx edx, ax
mov ecx, dword [esi + eax*2 - 0x80000000]
lea esi, [esi + edx*8 + 4]
not dx
xor ecx, ebx
ror ecx, 1
mul edx
shl edx, 0x1d
rol eax, 0x5c
inc ecx
push edx
bswap ecx
lea edx, [edx + eax*8 + 0x2f35569c]
call fcn.0087323e
mov dl, 0xe4
push 0xf82149b2
aam 0xb1
dec esi
dec esi
and dword [eax], ecx
cmp al, 0x69
dec esi
dec esi
and eax, edx
dec ecx
dec esi
dec esi
and eax, edx
mov eax, 0x214e4ec9
nop
sub al, 9
dec esi
dec esi
and dword [eax + 0x4e4e196c], esi
and dword [eax + 0x70], eax
sub dword [esi + 0x4e], ecx
and dword [eax], esi
or ebx, ebp
mov dh, byte [ecx + eax*8 + 0x23]
xor eax, dword [eax - 0x71]
popal
sub dword [eax + 0x48eb822], ebp
add byte [eax], al
add byte [0x6205243c], al
jecxz 0xb9d2a7
sal byte [ebx], cl
retf
sub eax, 0x2f9ca185
je 0xb9d318
test ecx, esp
lodsb al, byte [esi]
inc edi
je 0xb9d31e
test dword [ebp + 0x274f7bd], edi
test dword [0x2749f7c], esi
mov ebp, 0x850274f7
xor eax, 0x2749f7c
test dword [ecx + 0x274a7fd], esp
test dword [ebp + 0x27477dc], ebx
test dword [ecx + 4], eax
iretd