joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400043ba
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
xor r13d, r13d
mov rax, qword [rbp - 0x38]
nop
cmp byte [rax + r13], 0
lea r13, [r13 + 1]
jne 0x1400043d0
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
rol byte [rdi + rsi*8], 1
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140004406
cmp r8w, r9w
je 0x140004460
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140004400
add rdx, 2
cmp r8w, r9w
je 0x140004410
jmp 0x140004400
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x140004493
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
sub rsp, rdi
mov r15, rsp
mov byte [r15], r10b
movzx ebx, byte [rbx]
not bl
or r11b, r10b
not r10b
or r10b, bl
and r10b, r11b
movzx r11d, r10b
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x140004490
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], bl
sub rsp, rdi
mov r14, rsp
mov byte [r14], r11b
movzx r14d, byte [r15]
not r14b
or bl, r11b
not r11b
or r11b, r14b
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x140004490
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
sub rsp, rdi
mov r10, rsp
mov byte [r10], dl
movzx r9d, byte [r9]
not r9b
or r8b, dl
not dl
or dl, r9b
and dl, r8b
movzx edx, dl
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x140004582
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x140004580
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
mov ebx, dword [rbx]
not ebx
or r10d, r11d
not r11d
or r11d, ebx
and r11d, r10d
imul r10d, r11d, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400045a0
cmp r10d, 0xdd833843
jne 0x140004580
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7

Function at 0x1400043f6
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
nop word cs:[rax + rax]
Function at 0x14000453e
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
xor r13d, r13d
mov rax, qword [rbp - 0x38]
nop
cmp byte [rax + r13], 0
lea r13, [r13 + 1]
jne 0x1400043d0
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
rol byte [rdi + rsi*8], 1
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140004406
cmp r8w, r9w
je 0x140004460
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140004400
add rdx, 2
cmp r8w, r9w
je 0x140004410
jmp 0x140004400
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x140004493
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
sub rsp, rdi
mov r15, rsp
mov byte [r15], r10b
movzx ebx, byte [rbx]
not bl
or r11b, r10b
not r10b
or r10b, bl
and r10b, r11b
movzx r11d, r10b
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x140004490
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], bl
sub rsp, rdi
mov r14, rsp
mov byte [r14], r11b
movzx r14d, byte [r15]
not r14b
or bl, r11b
not r11b
or r11b, r14b
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x140004490
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
sub rsp, rdi
mov r10, rsp
mov byte [r10], dl
movzx r9d, byte [r9]
not r9b
or r8b, dl
not dl
or dl, r9b
and dl, r8b
movzx edx, dl
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x140004582
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x140004580
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
mov ebx, dword [rbx]
not ebx
or r10d, r11d
not r11d
or r11d, ebx
and r11d, r10d
imul r10d, r11d, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400045a0
cmp r10d, 0xdd833843
jne 0x140004580
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
Function at 0x140004586
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
xor r13d, r13d
mov rax, qword [rbp - 0x38]
nop
cmp byte [rax + r13], 0
lea r13, [r13 + 1]
jne 0x1400043d0
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
rol byte [rdi + rsi*8], 1
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140004406
cmp r8w, r9w
je 0x140004460
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140004400
add rdx, 2
cmp r8w, r9w
je 0x140004410
jmp 0x140004400
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x140004493
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
sub rsp, rdi
mov r15, rsp
mov byte [r15], r10b
movzx ebx, byte [rbx]
not bl
or r11b, r10b
not r10b
or r10b, bl
and r10b, r11b
movzx r11d, r10b
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x140004490
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], bl
sub rsp, rdi
mov r14, rsp
mov byte [r14], r11b
movzx r14d, byte [r15]
not r14b
or bl, r11b
not r11b
or r11b, r14b
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x140004490
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
sub rsp, rdi
mov r10, rsp
mov byte [r10], dl
movzx r9d, byte [r9]
not r9b
or r8b, dl
not dl
or dl, r9b
and dl, r8b
movzx edx, dl
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x140004582
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x140004580
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
mov ebx, dword [rbx]
not ebx
or r10d, r11d
not r11d
or r11d, ebx
and r11d, r10d
imul r10d, r11d, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400045a0
cmp r10d, 0xdd833843
jne 0x140004580
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
Function at 0x140004611
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140004636
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d

Function at 0x140004637
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140004636
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
Function at 0x140004672
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmp r8w, r9w
je 0x140004690
test r8w, r8w
je 0x140004630
add rdx, 2
cmp r8w, r9w
je 0x140004640
jmp 0x140004630
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
ror dword [rax + 0x41000000], 0xb0
add ebx, ebp
invalid
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
sub rsp, rdi
mov r14, rsp
mov byte [r14], r10b
movzx ebx, byte [rbx]
not bl
or r11b, r10b
not r10b
or r10b, bl
and r10b, r11b
movzx r11d, r10b
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400046c0
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx r11d, r14b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400046c0
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
sub rsp, rdi
mov r10, rsp
mov byte [r10], dl
movzx r9d, byte [r9]
not r9b
or r8b, dl
not dl
or dl, r9b
and dl, r8b
movzx edx, dl
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x1400047a2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x1400047a0
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
mov ebx, r11d
xor ebx, r11d
not ebx
and ebx, r10d
xor ebx, r11d
imul r10d, ebx, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400047c0
cmp r10d, 0x7080d354
jne 0x1400047a0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov ecx, 0xfffffff5
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx ecx, byte [rbp - 0x30]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
Function at 0x14000470a
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmp r8w, r9w
je 0x140004690
test r8w, r8w
je 0x140004630
add rdx, 2
cmp r8w, r9w
je 0x140004640
jmp 0x140004630
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
ror dword [rax + 0x41000000], 0xb0
add ebx, ebp
invalid
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
sub rsp, rdi
mov r14, rsp
mov byte [r14], r10b
movzx ebx, byte [rbx]
not bl
or r11b, r10b
not r10b
or r10b, bl
and r10b, r11b
movzx r11d, r10b
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400046c0
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx r11d, r14b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400046c0
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
sub rsp, rdi
mov r10, rsp
mov byte [r10], dl
movzx r9d, byte [r9]
not r9b
or r8b, dl
not dl
or dl, r9b
and dl, r8b
movzx edx, dl
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x1400047a2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x1400047a0
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
mov ebx, r11d
xor ebx, r11d
not ebx
and ebx, r10d
xor ebx, r11d
imul r10d, ebx, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400047c0
cmp r10d, 0x7080d354
jne 0x1400047a0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov ecx, 0xfffffff5
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx ecx, byte [rbp - 0x30]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
Function at 0x140004762
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmp r8w, r9w
je 0x140004690
test r8w, r8w
je 0x140004630
add rdx, 2
cmp r8w, r9w
je 0x140004640
jmp 0x140004630
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
ror dword [rax + 0x41000000], 0xb0
add ebx, ebp
invalid
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
sub rsp, rdi
mov r14, rsp
mov byte [r14], r10b
movzx ebx, byte [rbx]
not bl
or r11b, r10b
not r10b
or r10b, bl
and r10b, r11b
movzx r11d, r10b
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400046c0
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx r11d, r14b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400046c0
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
sub rsp, rdi
mov r10, rsp
mov byte [r10], dl
movzx r9d, byte [r9]
not r9b
or r8b, dl
not dl
or dl, r9b
and dl, r8b
movzx edx, dl
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x1400047a2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x1400047a0
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
mov ebx, r11d
xor ebx, r11d
not ebx
and ebx, r10d
xor ebx, r11d
imul r10d, ebx, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400047c0
cmp r10d, 0x7080d354
jne 0x1400047a0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov ecx, 0xfffffff5
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx ecx, byte [rbp - 0x30]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
Function at 0x1400047a2
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmp r8w, r9w
je 0x140004690
test r8w, r8w
je 0x140004630
add rdx, 2
cmp r8w, r9w
je 0x140004640
jmp 0x140004630
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
ror dword [rax + 0x41000000], 0xb0
add ebx, ebp
invalid
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
sub rsp, rdi
mov r14, rsp
mov byte [r14], r10b
movzx ebx, byte [rbx]
not bl
or r11b, r10b
not r10b
or r10b, bl
and r10b, r11b
movzx r11d, r10b
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400046c0
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx r11d, r14b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400046c0
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
sub rsp, rdi
mov r10, rsp
mov byte [r10], dl
movzx r9d, byte [r9]
not r9b
or r8b, dl
not dl
or dl, r9b
and dl, r8b
movzx edx, dl
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x1400047a2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x1400047a0
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
mov ebx, r11d
xor ebx, r11d
not ebx
and ebx, r10d
xor ebx, r11d
imul r10d, ebx, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400047c0
cmp r10d, 0x7080d354
jne 0x1400047a0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov ecx, 0xfffffff5
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx ecx, byte [rbp - 0x30]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
Function at 0x140004805
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmp r8w, r9w
je 0x140004690
test r8w, r8w
je 0x140004630
add rdx, 2
cmp r8w, r9w
je 0x140004640
jmp 0x140004630
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
ror dword [rax + 0x41000000], 0xb0
add ebx, ebp
invalid
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
sub rsp, rdi
mov r14, rsp
mov byte [r14], r10b
movzx ebx, byte [rbx]
not bl
or r11b, r10b
not r10b
or r10b, bl
and r10b, r11b
movzx r11d, r10b
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400046c0
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx r11d, r14b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400046c0
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
sub rsp, rdi
mov r10, rsp
mov byte [r10], dl
movzx r9d, byte [r9]
not r9b
or r8b, dl
not dl
or dl, r9b
and dl, r8b
movzx edx, dl
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x1400047a2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x1400047a0
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
mov ebx, r11d
xor ebx, r11d
not ebx
and ebx, r10d
xor ebx, r11d
imul r10d, ebx, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400047c0
cmp r10d, 0x7080d354
jne 0x1400047a0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov ecx, 0xfffffff5
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx ecx, byte [rbp - 0x30]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20

Function at 0x140004838
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x140004846
cmp r9w, r10w
je 0x1400048a0
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [r8 + rsi]
lea ebx, [r11 - 0x41]
mov r10d, r11d
fiadd dword [rcx - 0x7d]
retf 0x6620
cmp ebx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140004840
add r8, 2
cmp r9w, r10w
cmp r9d, r10d
je 0x140004850
jmp 0x140004840
mov rcx, qword [rcx + 0x20]
movsxd rdx, dword [rcx + 0x3c]
lea r8, [rdx + rcx]
movzx r9d, word [rdx + rcx + 0x14]
add r8, r9
add r8, 0x18
add rdx, rcx
add rdx, 0x88
mov byte [rax], al
add byte [rax], al
mov r9b, 1
jmp 0x1400048d3